Raw IP Captures

A Raw IP capture can read data from network interfaces that work with IP, but without Ethernet. Certain VPN tunnel interfaces or Tailscale are Raw IP.

Capture Configuration

A Raw IP capture is configured like this:

[rawip_interfaces.tailscale0]
active = true

In this case, the local network interface is called tailscale0.

Limitations

Note that, because there is no Ethernet data, certain Nzyme functionality is degrated when working with Raw IP data.

For example, an SSH connection over a Tailscale interface will be recorded and display IP addresses, but not provide any underlying asset information. There is a planned feature to enrich Tailscale connections with information from the Tailscale APIs.

All data recorded on Raw IP interfaces will be displayed along all other Ethernet data, without specific filtering required.