Overview

Packet Capture Improvements

Peek now supports capturing packets for an individual SIM. This new feature now lets you capture packets for a single device without the need to create a Virtual Private Gateway. For more information, refer to the SIM Usage documentation.

In addition, you can now also stop an ongoing packet capture session. This can be useful if you want to start a packet capture session that allows ample time to collect packet data, but then want to stop capturing once you have completed testing in order to avoid waiting for a packet capture session to stop. Packets that are captured prior to stopping a packet capture session are still available to download.

Soracom Peek is a managed packet capture service which collects the IP packets of traffic from devices that use Soracom Air for Cellular SIMs. Peek gives you the ability to inspect the network behavior of your devices, even if your device or server doesn't support packet capturing. Peek allows you to capture packets quickly and easily, without setting up any servers to mirror or inspect traffic.

Peek overview

Peek provides a simple and secure way to capture packets, and can be used in many situations where you are typically unable to inspect your devices network behavior:

Troubleshoot abnormal device behavior - If your device suddenly stops communicating with your server, or behaves abnormally, using Peek to capture packets will allow you to inspect the network traffic between cellular and IP networks and understand whether a problem occured on the device or cellular network (if a packet never arrived), or afterwards (if a packet arrived but doesn't make it to your server).
Debug network architecture - When building your application, there are many parts of its network architecture to check, such which transmission protocol the device uses, what servers the device connects to, and whether or not data is encrypted. Using Peek to capture packets will allow you to perform detailed analysis to verify that your device is behaving according to your design.
Identify the source of high data usage - While Soracom's SIM management tools let you easily check the data usage of each SIM, you can only check how much data was used, not what the data usage was for. By capturing packets with Peek, you can quickly find out what requests your device is making, and which servers it is communicating with.
Improve security - Similarly, your application may have strict requirements to ensure that data is not sent to an unauthorized destination. Peek will allow you to perform an audit of your device and check for any packets that are being sent to an unrecognized server. You can then update the Outbound Filter setting of your VPG to quickly block these unauthorized requests.

Features

With Peek, you can capture packets on-demand without setting up any servers.
Peek can be enabled directly in the User Console or via the Soracom API or Soracom CLI.
Packets coming from or going to a SIM, or transiting through a VPG, are captured during the duration you specify (up to 24 hours).
Packet files are stored as a pcap file, which can be analyzed many common network traffic analyzers.
Packet capture files are stored securely on Soracom platform and are automatically deleted after 7 days. You can also manually delete them.
A temporary signed URL is generated each time you request to download the results of a packet capture session.
Peek does not affect network latency or throughput during capturing.

Capture Methods

Peek provides two methods for packet capture:

SIM Packet Capture

With SIM-based packet capture, Peek captures the packets of all IP traffic where the source or destination address of the packet matches your SIM.

VPG Packet Capture

With VPG-based packet capture, Peek captures the packets of all IP traffic that passes through a Virtual Private Gateway (VPG). After creating a VPG and assigning SIMs to it, all cellular network traffic to and from the devices will be routed through the VPG. Then, when you request packet capture, Peek will create a packet capture session which will collect all IP traffic in the VPG throughout the duration of the session.

Requirements

To capture packets using Peek:

Your device must be connected using a Soracom IoT SIM and online.
When capturing packets in a VPG, the SIM should belong to VPG.

Limitations

Before using Peek, please be aware of the following limitations:

Peek packet capture will only capture packets where the source or destination address of the packet matches the IP address of your SIM(s), such as traffic between your device and the Internet, or traffic between your device and a Soracom service. The following network traffic cannot be captured:
- Traffic between a Soracom service, such as Beam, Funnel, or Funk, and the Internet or external cloud services.
- VXLAN traffic between a VPG and a Gate Peer.
VPG-based packet capture is only available for Type-E and Type-F VPGs. If you are using a Type-C or Type-D VPG, you must migrate them to either Type-E or Type-F in order to use Peek.
When you start a packet capture session, there is a short delay of a few seconds to a few minutes as Peek initializes packet capturing. You should allow for a sufficient window in order to ensure the desired traffic is captured. Once a packet capture session has started, its status will change to CAPTURING.
The maximum amount of data that can be captured in one packet capture session is 5 GB.
A packet capture session can continue for up to 24 hours.
Packet capture files are automatically deleted after 7 days. You can also delete it manually.
For security, when requesting to download a packet capture file, a secure URL will be generated and is valid for 5 minutes. As long as you start downloading the file before the URL expires, your download will not be interrupted even if it takes longer than 5 minutes to download.
The Prefix used for a packet capture session can only consist of numbers, letters, underscores, and hyphens, and must be 100 characters or less.

Compatibility

Peek SIM-based packet capture is available for all Air for Cellular SIMs.
Peek SIM-based packet capture is not available for Arc Virtual SIMs.
Peek VPG-based packet capture is only available for Type-E and Type-F VPGs.

Compared to Junction

While Peek provides similar packet capturing functionality as Junction, there are some important differences.

Peek automatically creates a pcap file after a packet capture session finishes. Unlike Junction, you cannot download or inspect packets while they are being captured.

The maximum duration of a Peek packet capture session is limited to 24 hours.

Soracom Junction does not have these limitations, and is therefore better suited if you need real-time monitoring or the ability to capture packets for durations longer than 24 hours.