1a8e07101SRui Paulo<HTML><HEAD> 2a8e07101SRui Paulo<STYLE type="text/css"> 3a8e07101SRui Paulo<!-- 4a8e07101SRui PauloA { text-decoration:none } 5a8e07101SRui Paulo--> 6a8e07101SRui Paulo</STYLE> 7a8e07101SRui Paulo</HEAD> 8a8e07101SRui Paulo<BODY> 9a8e07101SRui Paulo 10a8e07101SRui Paulo<TABLE WIDTH=100%><TR> 11a8e07101SRui Paulo <TD ALIGN=LEFT VALIGN=TOP> 12a8e07101SRui Paulo <FONT SIZE=+0 FACE="COURIER"><B>A "Distributed Pcap" for<BR>Remote Monitoring LANs & WANs</B><BR> 13a8e07101SRui Paulo (Design Notes for the SITA ACN device)</FONT> 14a8e07101SRui Paulo </TD> 15a8e07101SRui Paulo <TD ALIGN=RIGHT VALIGN=TOP> 16a8e07101SRui Paulo Fulko Hew<BR>SITA INC Canada, Inc.<BR>Revised: October 2, 2007 17a8e07101SRui Paulo </TD> 18a8e07101SRui Paulo</TR></TABLE> 19a8e07101SRui Paulo 20a8e07101SRui Paulo 21a8e07101SRui Paulo<H3>SUMMARY</H3> 22a8e07101SRui Paulo<UL> 23a0ee43a1SRui Paulo <STRONG>Note:</STRONG> This document is part of the libpcap Git and was derived from 'pcap.3' (circa Aug/07). 24a8e07101SRui Paulo <P> 256f9cba8fSJoseph Mingrone The ACN provides a customized/distributed version of this library that allows SMPs to 26a8e07101SRui Paulo interact with the various IOPs within the site providing a standard mechanism 27a8e07101SRui Paulo to capture LAN and WAN message traffic. 28a8e07101SRui Paulo <P> 29a8e07101SRui Paulo <CENTER> 30a8e07101SRui Paulo <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3 WIDTH=75%> 31a8e07101SRui Paulo <TR> 32a8e07101SRui Paulo <TH VALIGN=TOP>SMP</TH> 33a8e07101SRui Paulo <TD VALIGN=TOP>The Supervisory Management Processor where Wireshark (or equivalent) 346f9cba8fSJoseph Mingrone runs in conjunction with a libpcap front-end.</TD> 35a8e07101SRui Paulo </TR> 36a8e07101SRui Paulo <TR> 37a8e07101SRui Paulo <TH VALIGN=TOP>IOP</TH> 38a8e07101SRui Paulo <TD VALIGN=TOP>I/O Processors where the monitored ports exist in conjunction 39a8e07101SRui Paulo with a custom device driver/libpcap back-end.</TD> 40a8e07101SRui Paulo </TR> 41a8e07101SRui Paulo </TABLE> 42a8e07101SRui Paulo </CENTER> 43a8e07101SRui Paulo <P> 44a8e07101SRui Paulo Each IOP will be capable of supporting multiple connections from an SMP 45a8e07101SRui Paulo enabling monitoring of more than one interface at a time, each through 466f9cba8fSJoseph Mingrone its own separate connection. The IOP is responsible to ensure and report 47a8e07101SRui Paulo an error if any attempt is made to monitor the same interface more than once. 48a8e07101SRui Paulo <P> 49a8e07101SRui Paulo There are three applications that will be supported by the ACN version of libpcap. 50a8e07101SRui Paulo They each use a slightly different mode for looping/capturing and termination 51a8e07101SRui Paulo as summarized in the following table: 52a8e07101SRui Paulo <P> 53a8e07101SRui Paulo <CENTER> 54a8e07101SRui Paulo <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3> 55a8e07101SRui Paulo <TR><TH>Application</TH> <TH>Capture</TH> <TH>Termination</TH></TR> 56a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>wireshark</TH> 57a8e07101SRui Paulo <TD VALIGN=TOP>pcap_dispatch(all packets in one buffer of capture only)</TD> 58a8e07101SRui Paulo <TD VALIGN=TOP>pcap_breakloop()</TD> 59a8e07101SRui Paulo </TR> 60a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>tshark</TH> 61a8e07101SRui Paulo <TD VALIGN=TOP>pcap_dispatch(one buffer of capture only)</TD> 62a8e07101SRui Paulo <TD VALIGN=TOP>Since a CTRL-C was used to terminate the application, pcap_breakloop() is never called.</TD> 63a8e07101SRui Paulo </TR> 64a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>tcpdump</TH> 65a8e07101SRui Paulo <TD VALIGN=TOP>pcap_loop(all packets in the next buffer, and loop forever)</TD> 66a8e07101SRui Paulo <TD VALIGN=TOP>pcap_breakloop()</TD> 67a8e07101SRui Paulo </TR> 68a8e07101SRui Paulo </TABLE> 69a8e07101SRui Paulo </CENTER> 70a8e07101SRui Paulo <P> 71a8e07101SRui Paulo <B>Note: </B>In all cases, the termination of capturing is always (apparently) followed by 72a8e07101SRui Paulo pcap_close(). Pcap_breakloop() is only used to stop/suspend looping/processing, 73a8e07101SRui Paulo and upon close interpretation of the function definitions, it is possible to resume 74a8e07101SRui Paulo capturing following a pcap_breakloop() without any re-initialization. 75a8e07101SRui Paulo <P> 76a8e07101SRui Paulo <H4>ACN Limitations</H4> 77a8e07101SRui Paulo <OL> 78a8e07101SRui Paulo <LI>Monitoring of backup IOPs is not currently supported. 79a8e07101SRui Paulo <LI>Ethernet interfaces cannot be monitored in promiscuous mode. 80a8e07101SRui Paulo </OL> 81a8e07101SRui Paulo 82a8e07101SRui Paulo</UL> 83a8e07101SRui Paulo 84a8e07101SRui Paulo<H3>ROUTINES</H3> 85a8e07101SRui Paulo<UL> 86a8e07101SRui Paulo The following list of functions is the sub-set of Pcap functions that have been 87a8e07101SRui Paulo altered/enhanced to support the ACN remote monitoring facility. The remainder of the Pcap 88a8e07101SRui Paulo functions continue to perform their duties un-altered. Libpcap only supports this 89a8e07101SRui Paulo mode of operation if it has been configured/compiled for SITA/ACN support. 90a8e07101SRui Paulo <P> 91a8e07101SRui Paulo <UL><FONT FACE=COURIER> 92a8e07101SRui Paulo pcap_findalldevs<BR> 93a8e07101SRui Paulo pcap_freealldevs<BR> 94a8e07101SRui Paulo pcap_open_live<BR> 95a8e07101SRui Paulo pcap_close<BR> 96a8e07101SRui Paulo pcap_setfilter<BR> 97a8e07101SRui Paulo pcap_dispatch<BR> 98a8e07101SRui Paulo pcap_loop<BR> 99a8e07101SRui Paulo pcap_next<BR> 100a8e07101SRui Paulo pcap_next_ex<BR> 101a8e07101SRui Paulo pcap_stats<BR> 102a8e07101SRui Paulo </FONT></UL> 103a8e07101SRui Paulo 104a8e07101SRui Paulo These subroutines have been modified for the ACN specific distributed and remote monitoring 105a8e07101SRui Paulo ability perform the following basic functions. More detail is provided in the 106a8e07101SRui Paulo "SMP/IOP Inter-Process Communication Protocol" section. 107a8e07101SRui Paulo <P> 108a8e07101SRui Paulo<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3> 109a8e07101SRui Paulo <TR> 110a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=2><B>pcap_open_live()</B></TD> 111a8e07101SRui Paulo <TD VALIGN=TOP>Used to obtain a packet capture descriptor to look at packets on the network.</TD> 112a8e07101SRui Paulo </TR> 113a8e07101SRui Paulo <TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%> 114a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH> 115a8e07101SRui Paulo <TD> 116a8e07101SRui Paulo The SMP will open a connection to the selected IOP on its 'sniffer' port 117a8e07101SRui Paulo to ensure it is available. It sends a null terminated string identifying 118a8e07101SRui Paulo the interface to be monitored. 119a8e07101SRui Paulo </TD> 120a8e07101SRui Paulo </TR> 121a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH> 122a8e07101SRui Paulo <TD> 123a8e07101SRui Paulo After any required processing is complete, the IOP will return a 1246f9cba8fSJoseph Mingrone null terminated string containing an error message if one occurred. 1256f9cba8fSJoseph Mingrone If no error occurred, a empty string is still returned. 126a8e07101SRui Paulo Errors are: 127a8e07101SRui Paulo <UL> 128a8e07101SRui Paulo <LI>"Interface (xxx) does not exist." 129a8e07101SRui Paulo <LI>"Interface (xxx) not configured." 130a8e07101SRui Paulo <LI>"Interface (xxx) already being monitored." 131a8e07101SRui Paulo </UL> 132a8e07101SRui Paulo </TD> 133a8e07101SRui Paulo </TR> 134a8e07101SRui Paulo </TABLE></TD></TR> 135a8e07101SRui Paulo 136a8e07101SRui Paulo <TR> 137a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=2><B>pcap_findalldevs()</B></TD> 138a8e07101SRui Paulo <TD VALIGN=TOP>It constructs a list of network devices that can be opened with pcap_open_live().</TD> 139a8e07101SRui Paulo </TR> 140a8e07101SRui Paulo <TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%> 141a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP</TH> 142a8e07101SRui Paulo <TD> 143a8e07101SRui Paulo It obtains a list of IOPs currently available (via /etc/hosts). 144a8e07101SRui Paulo </TD> 145a8e07101SRui Paulo </TR> 146a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH> 147a8e07101SRui Paulo <TD> 148a8e07101SRui Paulo The SMP will sequentially open a connection to each IOP on its 'sniffer' port to ensure 149a8e07101SRui Paulo the IOP is available. 150a8e07101SRui Paulo It sends a null terminated empty interface ID followed by the query request command. 151a8e07101SRui Paulo </TD> 152a8e07101SRui Paulo </TR> 153a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH> 154a8e07101SRui Paulo <TD>The IOP returns an error response and its list of devices. 155a8e07101SRui Paulo </TD> 156a8e07101SRui Paulo </TR> 157a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH> 158a8e07101SRui Paulo <TD> 159a8e07101SRui Paulo The SMP closes the TCP connection with each IOP. 160a8e07101SRui Paulo </TD> 161a8e07101SRui Paulo </TR> 162a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP</TH> 163a8e07101SRui Paulo <TD> 164a8e07101SRui Paulo The SMP adds the received information to its internal structure. 165a8e07101SRui Paulo </TD> 166a8e07101SRui Paulo </TR> 167a8e07101SRui Paulo </TABLE></TD></TR> 168a8e07101SRui Paulo 169a8e07101SRui Paulo <TR> 170a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=2><B>pcap_freealldevs()</B></TD> 171a8e07101SRui Paulo <TD VALIGN=TOP>Used to free a list allocated by pcap_findalldevs().</TD> 172a8e07101SRui Paulo </TR> 173a8e07101SRui Paulo <TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%> 174a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP</TH> 175a8e07101SRui Paulo <TD> 176a8e07101SRui Paulo The SMP frees the structure it built as a result of the previous 177a8e07101SRui Paulo invocation of pcap_findalldevs(). 178a8e07101SRui Paulo </TD> 179a8e07101SRui Paulo </TR> 180a8e07101SRui Paulo </TABLE></TD></TR> 181a8e07101SRui Paulo 182a8e07101SRui Paulo <TR> 183a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=2><B>pcap_dispatch()</B></TD> 184a8e07101SRui Paulo <TD VALIGN=TOP>Used to collect and process packets.</TD> 185a8e07101SRui Paulo </TR> 186a8e07101SRui Paulo <TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%> 187a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH> 188a8e07101SRui Paulo <TD> 189a8e07101SRui Paulo On the first invocation of pcap_dispatch(), pcap_loop(), or pcap_next(), or pcap_next_ex() following a pcap_open_live(), 190a8e07101SRui Paulo the SMP will pass down the monitor start command and various parameters the IOP should use. 191a8e07101SRui Paulo </TD> 192a8e07101SRui Paulo </TR> 193a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH> 194a8e07101SRui Paulo <TD> 195a8e07101SRui Paulo The IOP now sends a stream of captured data. 196a8e07101SRui Paulo </TD> 197a8e07101SRui Paulo </TR> 198a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP</TH> 199a8e07101SRui Paulo <TD> 200a8e07101SRui Paulo The SMP will read the reverse channel of the connection between the SMP and the 201a8e07101SRui Paulo IOP that provides the captured data (via 'p->read_op' which is 'pcap_read_linux()' 202a8e07101SRui Paulo until the select() call returns a 'no more data' indication. 203a8e07101SRui Paulo It will the process (at most) the next 'cnt' packets and invoke the specified 204a8e07101SRui Paulo callback function for each packet processed. 205a8e07101SRui Paulo </TD> 206a8e07101SRui Paulo </TR> 207a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>IOP</TH> 208a8e07101SRui Paulo <TD> 209a8e07101SRui Paulo The IOP continues to listen for additional commands as well as capturing and forwarding data to the SMP. 210a8e07101SRui Paulo </TD> 211a8e07101SRui Paulo </TR> 212a8e07101SRui Paulo </TABLE></TD></TR> 213a8e07101SRui Paulo 214a8e07101SRui Paulo <TR> 215a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=2><B>pcap_loop()</B></TD> 216a8e07101SRui Paulo <TD VALIGN=TOP> 217a8e07101SRui Paulo Is similar to pcap_dispatch() except it keeps reading packets until 218a8e07101SRui Paulo the requested number of packets are processed or an error occurs. 219a8e07101SRui Paulo </TD> 220a8e07101SRui Paulo </TR> 221a8e07101SRui Paulo <TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%> 222a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH> 223a8e07101SRui Paulo <TD> 224a8e07101SRui Paulo On the first invocation of pcap_dispatch(), pcap_loop(), or pcap_next(), or pcap_next_ex() following a pcap_open_live(), 225a8e07101SRui Paulo the SMP will pass down the monitor start command and various parameters the IOP should use. 226a8e07101SRui Paulo </TD> 227a8e07101SRui Paulo </TR> 228a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH> 229a8e07101SRui Paulo <TD> 230a8e07101SRui Paulo The IOP now sends a stream of captured data. 231a8e07101SRui Paulo </TD> 232a8e07101SRui Paulo </TR> 233a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP</TH> 234a8e07101SRui Paulo <TD> 235a8e07101SRui Paulo The SMP continuously reads the next packet from the reverse channel of the connection 236a8e07101SRui Paulo between the SMP and the IOP that provides the captured data (via 'p->read_op' 237a8e07101SRui Paulo which is 'pcap_read_linux()' until 'cnt' packets have been received. 238a8e07101SRui Paulo The specified callback function will be invoked for each packet received. 239a8e07101SRui Paulo </TD> 240a8e07101SRui Paulo </TR> 241a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>IOP</TH> 242a8e07101SRui Paulo <TD> 243a8e07101SRui Paulo The IOP continues to listen for additional commands as well as capturing and forwarding data to the SMP. 244a8e07101SRui Paulo </TD> 245a8e07101SRui Paulo </TR> 246a8e07101SRui Paulo </TABLE></TD></TR> 247a8e07101SRui Paulo 248a8e07101SRui Paulo <TR> 249a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=2><B>pcap_next()</B></TD> 250a8e07101SRui Paulo <TD VALIGN=TOP> 251a8e07101SRui Paulo It reads the next packet (by calling pcap_dispatch() with a count of 1) 252a8e07101SRui Paulo and returns a pointer to the data in that packet. 253a8e07101SRui Paulo </TD> 254a8e07101SRui Paulo </TR> 255a8e07101SRui Paulo <TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%> 256a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH> 257a8e07101SRui Paulo <TD> 258a8e07101SRui Paulo On the first invocation of pcap_dispatch(), pcap_loop(), or pcap_next(), or pcap_next_ex() following a pcap_open_live(), 259a8e07101SRui Paulo the SMP will pass down the monitor start command and various parameters the IOP should use. 260a8e07101SRui Paulo </TD> 261a8e07101SRui Paulo </TR> 262a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH> 263a8e07101SRui Paulo <TD> 264a8e07101SRui Paulo The IOP now sends a stream of captured data. 265a8e07101SRui Paulo </TD> 266a8e07101SRui Paulo </TR> 267a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP</TH> 268a8e07101SRui Paulo <TD> 269a8e07101SRui Paulo The SMP reads only the next packet from the reverse channel of the connection 270a8e07101SRui Paulo between the SMP and the IOP that provides the captured data (via calling pcap_dispatch() 271a8e07101SRui Paulo with a count of 1) and returns a pointer to that data by invoking an internal callback. 272a8e07101SRui Paulo </TD> 273a8e07101SRui Paulo </TR> 274a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>IOP</TH> 275a8e07101SRui Paulo <TD> 276a8e07101SRui Paulo The IOP continues to listen for additional commands as well as capturing and forwarding data to the SMP. 277a8e07101SRui Paulo </TD> 278a8e07101SRui Paulo </TR> 279a8e07101SRui Paulo </TABLE></TD></TR> 280a8e07101SRui Paulo 281a8e07101SRui Paulo <TR> 282a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=2><B>pcap_next_ex()</B></TD> 283a8e07101SRui Paulo <TD VALIGN=TOP>Reads the next packet and returns a success/failure indication.</TD> 284a8e07101SRui Paulo </TR> 285a8e07101SRui Paulo <TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%> 286a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH> 287a8e07101SRui Paulo <TD> 288a8e07101SRui Paulo On the first invocation of pcap_dispatch(), pcap_loop(), or pcap_next(), or pcap_next_ex() following a pcap_open_live(), 289a8e07101SRui Paulo the SMP will pass down the monitor start command and various parameters the IOP should use. 290a8e07101SRui Paulo </TD> 291a8e07101SRui Paulo </TR> 292a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH> 293a8e07101SRui Paulo <TD> 294a8e07101SRui Paulo The IOP now sends a stream of captured data. 295a8e07101SRui Paulo </TD> 296a8e07101SRui Paulo </TR> 297a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP</TH> 298a8e07101SRui Paulo <TD> 299a8e07101SRui Paulo The SMP reads only the next packet from the reverse channel of the connection 300a8e07101SRui Paulo between the SMP and the IOP that provides the captured data (via calling pcap_dispatch() 3016f9cba8fSJoseph Mingrone with a count of 1) and returns separate pointers to both the 302a8e07101SRui Paulo packet header and packet data by invoking an internal callback. 303a8e07101SRui Paulo </TD> 304a8e07101SRui Paulo </TR> 305a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>IOP</TH> 306a8e07101SRui Paulo <TD> 307a8e07101SRui Paulo The IOP continues to listen for additional commands as well as capturing and forwarding data to the SMP. 308a8e07101SRui Paulo </TD> 309a8e07101SRui Paulo </TR> 310a8e07101SRui Paulo </TABLE></TD></TR> 311a8e07101SRui Paulo 312a8e07101SRui Paulo <TR> 313a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=2><B>pcap_setfilter()</B></TD> 314a8e07101SRui Paulo <TD VALIGN=TOP>Used to specify a filter program.</TD> 315a8e07101SRui Paulo </TR> 316a8e07101SRui Paulo <TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%> 317a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH> 318a8e07101SRui Paulo <TD> 319a8e07101SRui Paulo The SMP sends a 'set filter' command followed by the BPF commands. 320a8e07101SRui Paulo </TD> 321a8e07101SRui Paulo </TR> 322a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH> 323a8e07101SRui Paulo <TD> 324a8e07101SRui Paulo The IOP returns a null terminated error string if it failed to accept the filter. 3256f9cba8fSJoseph Mingrone If no error occurred, then a NULL terminated empty string is returned instead. 326a8e07101SRui Paulo Errors are: 327a8e07101SRui Paulo <UL> 328a8e07101SRui Paulo <LI>"Invalid BPF." 329a8e07101SRui Paulo <LI>"Insufficient resources for BPF." 330a8e07101SRui Paulo </UL> 331a8e07101SRui Paulo </TD> 332a8e07101SRui Paulo </TR> 333a8e07101SRui Paulo </TABLE></TD></TR> 334a8e07101SRui Paulo 335a8e07101SRui Paulo <TR> 336a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=2><B>pcap_stats()</B></TD> 337a8e07101SRui Paulo <TD VALIGN=TOP>Fills in a pcap_stat struct with packet statistics.</TD> 338a8e07101SRui Paulo </TR> 339a8e07101SRui Paulo <TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%> 340a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH> 341a8e07101SRui Paulo <TD> 342a8e07101SRui Paulo The SMP sends a message to the IOP requesting its statistics. 343a8e07101SRui Paulo </TD> 344a8e07101SRui Paulo </TR> 345a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH> 346a8e07101SRui Paulo <TD> 347a8e07101SRui Paulo The IOP returns the statistics. 348a8e07101SRui Paulo </TD> 349a8e07101SRui Paulo </TR> 350a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP</TH> 351a8e07101SRui Paulo <TD> 352a8e07101SRui Paulo The SMP fills in the structure provided with the information retrieved from the IOP. 353a8e07101SRui Paulo </TD> 354a8e07101SRui Paulo </TR> 355a8e07101SRui Paulo </TABLE></TD></TR> 356a8e07101SRui Paulo 357a8e07101SRui Paulo <TR> 358a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=2><B>pcap_close()</B></TD> 359a8e07101SRui Paulo <TD VALIGN=TOP>Closes the file and deallocates resources.</TD> 360a8e07101SRui Paulo </TR> 361a8e07101SRui Paulo <TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%> 362a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH> 363a8e07101SRui Paulo <TD> 364a8e07101SRui Paulo The SMP closes the file descriptor, and if the descriptor is that of 3656f9cba8fSJoseph Mingrone the communication session with an IOP, it too is terminated. 366a8e07101SRui Paulo </TD> 367a8e07101SRui Paulo </TR> 368a8e07101SRui Paulo <TR><TH VALIGN=TOP NOWRAP>IOP</TH> 369a8e07101SRui Paulo <TD> 370a8e07101SRui Paulo If the IOP detects that its communication session with an SMP 371a8e07101SRui Paulo has closed, it will terminate any monitoring in progress, 372a8e07101SRui Paulo release any resources and close its end of the session. 3736f9cba8fSJoseph Mingrone It will not maintain persistence of any information or prior mode of operation. 374a8e07101SRui Paulo </TD> 375a8e07101SRui Paulo </TR> 376a8e07101SRui Paulo </TABLE></TD></TR> 377a8e07101SRui Paulo</TABLE> 378a8e07101SRui Paulo</UL> 379a8e07101SRui Paulo 380a8e07101SRui Paulo<P> 381a8e07101SRui Paulo<H3>SMP/IOP Inter-Process Communication Protocol</H3> 382a8e07101SRui Paulo 383a8e07101SRui Paulo<UL> 384a8e07101SRui Paulo <LI><P>Communications between an SMP and an IOP consists of a TCP session 385a8e07101SRui Paulo between an ephemeral port on the SMP and the well known port of 49152 386a8e07101SRui Paulo (which is the first available port in the 'dynamic and/or private port' 387a8e07101SRui Paulo range) on an IOP. 388a8e07101SRui Paulo <LI><P>Following a TCP open operation the IOP receives a null terminated 389a8e07101SRui Paulo 'interface ID' string to determine the type of operation that follows: 390a8e07101SRui Paulo <LI><P>Every command received by an IOP implies a 'stop trace/stop forwarding' operation must 391a8e07101SRui Paulo occur before executing the received command. 392a8e07101SRui Paulo <LI><P>A session is closed when the SMP closes the TCP session with the IOP. 393a8e07101SRui Paulo Obviously monitoring and forwarding is also stopped at that time. 394a8e07101SRui Paulo 395a8e07101SRui Paulo <B>Note: </B>All multi-octet entities are sent in network neutral order. 396a8e07101SRui Paulo <P> 397a8e07101SRui Paulo 398a8e07101SRui Paulo <TABLE BORDER=0 CELLSPACING=0 CELLPADDING=5> 399a8e07101SRui Paulo <TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR> 400a8e07101SRui Paulo <TR> 401a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=6>pcap_findalldevs()</TD> 402a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD> 403a8e07101SRui Paulo <TD VALIGN=TOP>Open socket (to each IOP), and sends: 404a8e07101SRui Paulo <P> 405a8e07101SRui Paulo <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3> 406a8e07101SRui Paulo <TR> 407a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH> 408a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH> 409a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Description</TH> 410a8e07101SRui Paulo </TR> 411a8e07101SRui Paulo <TR> 412a8e07101SRui Paulo <TD VALIGN=TOP>Interface ID</TD> 413a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 41457e22627SCy Schubert <TD VALIGN=TOP>A NULL to indicate an empty 'interface ID'.</TD> 415a8e07101SRui Paulo </TR> 416a8e07101SRui Paulo </TABLE> 417a8e07101SRui Paulo </TD> 418a8e07101SRui Paulo </TR> 419a8e07101SRui Paulo <TR> 420a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD> 421a8e07101SRui Paulo <TD VALIGN=TOP>Send its (possibly empty) NULL terminated error response string.</TD> 422a8e07101SRui Paulo </TR> 423a8e07101SRui Paulo <TR> 424a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD> 425a8e07101SRui Paulo <TD VALIGN=TOP>Sends the 'interface query request': 426a8e07101SRui Paulo <P> 427a8e07101SRui Paulo <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3> 428a8e07101SRui Paulo <TR> 429a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH> 430a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH> 431a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Description</TH> 432a8e07101SRui Paulo </TR> 433a8e07101SRui Paulo <TR> 434a8e07101SRui Paulo <TD VALIGN=TOP>Interface ID</TD> 435a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 436a8e07101SRui Paulo <TD VALIGN=TOP>A 'Q' (indicating 'interface query request').</TD> 437a8e07101SRui Paulo </TR> 438a8e07101SRui Paulo </TABLE> 439a8e07101SRui Paulo </TD> 440a8e07101SRui Paulo </TR> 441a8e07101SRui Paulo <TR> 442a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD> 443a8e07101SRui Paulo <TD VALIGN=TOP>The IOP returns a list of sequences of information as 444a8e07101SRui Paulo defined by the return parameter of this function call (as shown in the following table). 4456f9cba8fSJoseph Mingrone Elements are specified by providing an unsigned byte preceding the actual data that contains length information. 446a8e07101SRui Paulo <P> 447a8e07101SRui Paulo <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3> 448a8e07101SRui Paulo <TR> 449a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Notes:</TH> 450a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH> 451a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH> 452a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Description</TH> 453a8e07101SRui Paulo </TR> 454a8e07101SRui Paulo <TR> 455a8e07101SRui Paulo <TD ROWSPAN=7> </TD> 456a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=RIGHT>length</TD> 457a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 458a8e07101SRui Paulo <TD VALIGN=TOP>The number of octets in the name field that follows.</TD> 459a8e07101SRui Paulo </TR> 460a8e07101SRui Paulo <TR><TD VALIGN=TOP ALIGN=LEFT>Name</TD> 461a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1-255</TD> 462a8e07101SRui Paulo <TD VALIGN=TOP>The name of the interface. The format of the name is an alphabetic string (indicating 463a8e07101SRui Paulo the type of interface) followed by an optional numeric string (indicating the interface's 464a8e07101SRui Paulo sequence number). 465a8e07101SRui Paulo Sequence numbers (if needed) will begin at zero and progress monotonically upwards. 466a8e07101SRui Paulo (i.e. 'eth0', 'lo', 'wan0', etc.) 467a8e07101SRui Paulo <P> 468a8e07101SRui Paulo For an IOP, the alphabetic string will be one of: 'eth', 'wan', and 'lo' 469a8e07101SRui Paulo for Ethernet, WAN ports and the IP loopback device respectively. 470a8e07101SRui Paulo An IOP currently supports: 'eth0', 'eth1', 'lo', 'wan0' ... 'wan7'. 471a8e07101SRui Paulo <P> 472a8e07101SRui Paulo <B>Note:</B> IOPs and ACNs will not currently support the concept of 'any' interface.</TD> 473a8e07101SRui Paulo </TR> 474a8e07101SRui Paulo <TR><TD VALIGN=TOP ALIGN=RIGHT>length</TD> 475a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 476a8e07101SRui Paulo <TD VALIGN=TOP>The number of octets in the interface description field that follows.</TD> 477a8e07101SRui Paulo </TR> 478a8e07101SRui Paulo <TR><TD VALIGN=TOP ALIGN=LEFT>Interface Description</TD> 479a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>0-255</TD> 480a8e07101SRui Paulo <TD VALIGN=TOP>A description of the interface or it may be an empty string. (i.e. 'ALC')</TD> 481a8e07101SRui Paulo </TR> 482a8e07101SRui Paulo <TR><TD VALIGN=TOP ALIGN=LEFT>Interface Type</TD> 483a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>4</TD> 484a8e07101SRui Paulo <TD VALIGN=TOP>The type of interface as defined in the description for pcap_datalink() (in network neutral order).</TD> 485a8e07101SRui Paulo </TR> 486a8e07101SRui Paulo <TR><TD VALIGN=TOP ALIGN=LEFT>Loopback Flag</TD> 487a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 488a8e07101SRui Paulo <TD VALIGN=TOP>1 = if the interface is a loopback interface, zero = otherwise.</TD> 489a8e07101SRui Paulo </TR> 490a8e07101SRui Paulo <TR><TD VALIGN=TOP ALIGN=RIGHT>count</TD> 491a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 492a8e07101SRui Paulo <TD VALIGN=TOP># of address entries that follow. 493a8e07101SRui Paulo Each entry is a series of bytes in network neutral order. 494a8e07101SRui Paulo See the parameter definition above for more details.</TD> 495a8e07101SRui Paulo </TR> 496a8e07101SRui Paulo <TR> 497a8e07101SRui Paulo <TD ALIGN=CENTER ROWSPAN=8 WIDTH=1%>Repeated 'count' number of times.</TD> 498a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=RIGHT>length</TD> 499a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 500a8e07101SRui Paulo <TD VALIGN=TOP>The number of octets in the address field that follows.</TD> 501a8e07101SRui Paulo </TR> 502a8e07101SRui Paulo <TR><TD VALIGN=TOP ALIGN=LEFT>Address</TD> 503a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1-255</TD> 504a8e07101SRui Paulo <TD VALIGN=TOP>The address of this interface (in network neutral order).</TD> 505a8e07101SRui Paulo </TR> 506a8e07101SRui Paulo <TR><TD VALIGN=TOP ALIGN=RIGHT>length</TD> 507a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 508a8e07101SRui Paulo <TD VALIGN=TOP>The number of octets in the netmask field that follows.</TD> 509a8e07101SRui Paulo </TR> 510a8e07101SRui Paulo <TR><TD VALIGN=TOP ALIGN=LEFT>Network Mask</TD> 511a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>0-255</TD> 512a8e07101SRui Paulo <TD VALIGN=TOP>The network mask used on this interface (if applicable) (in network neutral order).</TD> 513a8e07101SRui Paulo </TR> 514a8e07101SRui Paulo <TR><TD VALIGN=TOP ALIGN=RIGHT>length</TD> 515a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 516a8e07101SRui Paulo <TD VALIGN=TOP>The number of octets in the broadcast address field that follows.</TD> 517a8e07101SRui Paulo </TR> 518a8e07101SRui Paulo <TR><TD VALIGN=TOP ALIGN=LEFT>Broadcast Address</TD> 519a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>0-255</TD> 520a8e07101SRui Paulo <TD VALIGN=TOP>The broadcast address of this interface (if applicable) (in network neutral order).</TD> 521a8e07101SRui Paulo </TR> 522a8e07101SRui Paulo <TR><TD VALIGN=TOP ALIGN=RIGHT>length</TD> 523a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 524a8e07101SRui Paulo <TD VALIGN=TOP>The number of octets in the destination address field that follows.</TD> 525a8e07101SRui Paulo </TR> 526a8e07101SRui Paulo <TR><TD VALIGN=TOP ALIGN=LEFT>Destination Address</TD> 527a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>0-255</TD> 528a8e07101SRui Paulo <TD VALIGN=TOP>The destination address of this interface (if applicable) (in network neutral order).</TD> 529a8e07101SRui Paulo </TR> 530a8e07101SRui Paulo </TABLE> 531a8e07101SRui Paulo </TR> 532a8e07101SRui Paulo <TR> 533a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD> 534a8e07101SRui Paulo <TD VALIGN=TOP>Close the socket.</TD> 535a8e07101SRui Paulo </TR> 536a8e07101SRui Paulo <TR> 537a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD> 538a8e07101SRui Paulo <TD VALIGN=TOP>Close the socket.</TD> 539a8e07101SRui Paulo </TR> 540a8e07101SRui Paulo <TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR> 541a8e07101SRui Paulo <TR> 542a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=2>pcap_open_live()</TD> 543a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD> 544a8e07101SRui Paulo <TD VALIGN=TOP>Open socket, and sends: 545a8e07101SRui Paulo <P> 546a8e07101SRui Paulo <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3> 547a8e07101SRui Paulo <TR> 548a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH> 549a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH> 550a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Description</TH> 551a8e07101SRui Paulo </TR> 552a8e07101SRui Paulo <TR> 553a8e07101SRui Paulo <TD VALIGN=TOP>Interface ID</TD> 554a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>'n'</TD> 555a8e07101SRui Paulo <TD VALIGN=TOP>'n' octets containing a NULL terminated interface name string.</TD> 556a8e07101SRui Paulo </TR> 557a8e07101SRui Paulo </TABLE> 558a8e07101SRui Paulo </TD> 559a8e07101SRui Paulo </TR> 560a8e07101SRui Paulo <TR> 561a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD> 562a8e07101SRui Paulo <TD VALIGN=TOP>Send its NULL terminated error response string.</TD> 563a8e07101SRui Paulo </TR> 564a8e07101SRui Paulo <TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR> 565a8e07101SRui Paulo <TR> 566a8e07101SRui Paulo <TD VALIGN=TOP NOWRAP ROWSPAN=2>pcap_dispatch()<BR>pcap_loop()<BR>pcap_next()<BR>pcap_next_ex()</TD> 567a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD> 568a8e07101SRui Paulo <TD VALIGN=TOP>On the first invocation following a pcap_open_live() or pcap_breakloop() additional information is sent: 569a8e07101SRui Paulo <P> 570a8e07101SRui Paulo <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3> 571a8e07101SRui Paulo <TR> 572a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH> 573a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH> 574a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Description</TH> 575a8e07101SRui Paulo </TR> 576a8e07101SRui Paulo <TR> 577a8e07101SRui Paulo <TD VALIGN=TOP>command</TD> 578a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 579a8e07101SRui Paulo <TD VALIGN=TOP>'M' (indicating 'monitor start')</TD> 580a8e07101SRui Paulo </TR> 581a8e07101SRui Paulo <TR> 582a8e07101SRui Paulo <TD VALIGN=TOP>snaplen</TD> 583a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>4</TD> 584a8e07101SRui Paulo <TD VALIGN=TOP>snaplen</TD> 585a8e07101SRui Paulo </TR> 586a8e07101SRui Paulo <TR> 587a8e07101SRui Paulo <TD VALIGN=TOP>timeout</TD> 588a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 589a8e07101SRui Paulo <TD VALIGN=TOP>timeout value (in milliseconds)</TD> 590a8e07101SRui Paulo </TR> 591a8e07101SRui Paulo <TR> 592a8e07101SRui Paulo <TD VALIGN=TOP>promiscuous</TD> 593a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 594a8e07101SRui Paulo <TD VALIGN=TOP>A flag indicating that the interface being monitored show operate 595a8e07101SRui Paulo in promiscuous mode. [off(0) / on(NZ)]</TD> 596a8e07101SRui Paulo </TR> 597a8e07101SRui Paulo <TR> 598a8e07101SRui Paulo <TD VALIGN=TOP>direction</TD> 599a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 600*afdbf109SJoseph Mingrone <TD VALIGN=TOP>A flag indicating the direction of traffic that should be captured [both(0) / in(1) / out(2)]</TD> 601a8e07101SRui Paulo </TR> 602a8e07101SRui Paulo </TABLE> 603a8e07101SRui Paulo </TD> 604a8e07101SRui Paulo </TR> 605a8e07101SRui Paulo <TR> 606a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD> 607a8e07101SRui Paulo <TD VALIGN=TOP>Sends captured packets.</TD> 608a8e07101SRui Paulo </TR> 609a8e07101SRui Paulo <TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR> 610a8e07101SRui Paulo <TR> 611a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=2>pcap_setfilter()</TD> 612a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD> 613a8e07101SRui Paulo <TD VALIGN=TOP>At any time, the SMP can issue a set filter command which contains 614a8e07101SRui Paulo an indicator, a count of the number of statements in the filter, 615a8e07101SRui Paulo followed by the sequence of filter commands represented as a sequence 616a8e07101SRui Paulo of C-style structures. 617a8e07101SRui Paulo <P> 618a8e07101SRui Paulo <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3> 619a8e07101SRui Paulo <TR> 620a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH> 621a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH> 622a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Description</TH> 623a8e07101SRui Paulo </TR> 624a8e07101SRui Paulo <TR> 625a8e07101SRui Paulo <TD VALIGN=TOP>command</TD> 626a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 627a8e07101SRui Paulo <TD VALIGN=TOP>'F' (indicating 'filter')</TD> 628a8e07101SRui Paulo </TR> 629a8e07101SRui Paulo <TR> 630a8e07101SRui Paulo <TD VALIGN=TOP>count</TD> 631a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>4</TD> 632a8e07101SRui Paulo <TD VALIGN=TOP>The number of command in the Berkeley Packet Filter that follow.</TD> 633a8e07101SRui Paulo </TR> 634a8e07101SRui Paulo <TR> 635a8e07101SRui Paulo <TD VALIGN=TOP>BPF program</TD> 636a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>'n'</TD> 637a8e07101SRui Paulo <TD VALIGN=TOP>8 bytes of each command (repeated 'n' times).<BR> 638a8e07101SRui Paulo Each command consists of that C-style structure which contains: 639a8e07101SRui Paulo <P> 640a8e07101SRui Paulo <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3> 641a8e07101SRui Paulo <TR> 642a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH> 643a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH> 644a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Description</TH> 645a8e07101SRui Paulo </TR> 646a8e07101SRui Paulo <TR> 647a8e07101SRui Paulo <TD VALIGN=TOP>opcode</TD> 648a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>2</TD> 649a8e07101SRui Paulo <TD VALIGN=TOP>The command's opcode.</TD> 650a8e07101SRui Paulo </TR> 651a8e07101SRui Paulo <TR> 652a8e07101SRui Paulo <TD VALIGN=TOP>'jt'</TD> 653a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 654a8e07101SRui Paulo <TD VALIGN=TOP>The 'jump if true' program counter offset.</TD> 655a8e07101SRui Paulo </TR> 656a8e07101SRui Paulo <TR> 657a8e07101SRui Paulo <TD VALIGN=TOP>'jf'</TD> 658a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 659a8e07101SRui Paulo <TD VALIGN=TOP>The 'jump if false' program counter offset.</TD> 660a8e07101SRui Paulo </TR> 661a8e07101SRui Paulo <TR> 662a8e07101SRui Paulo <TD VALIGN=TOP>'k'</TD> 663a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>4</TD> 664a8e07101SRui Paulo <TD VALIGN=TOP>The 'other' data field.</TD> 665a8e07101SRui Paulo </TR> 666a8e07101SRui Paulo </TABLE> 667a8e07101SRui Paulo <P> 668a8e07101SRui Paulo Refer to the bpf(4) man page for more details. 669a8e07101SRui Paulo </TD> 670a8e07101SRui Paulo </TR> 671a8e07101SRui Paulo </TABLE> 672a8e07101SRui Paulo </TD> 673a8e07101SRui Paulo </TR> 674a8e07101SRui Paulo <TR> 675a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD> 676a8e07101SRui Paulo <TD VALIGN=TOP>In return the IOP will send its (possibly empty) NULL terminated error response string.</TD> 677a8e07101SRui Paulo </TR> 678a8e07101SRui Paulo <TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR> 679a8e07101SRui Paulo <TR> 680a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=2>pcap_stats()</TD> 681a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD> 682a8e07101SRui Paulo <TD VALIGN=TOP>At any time, the SMP can issue a 'retrieve statistics' command which contains:<BR> 683a8e07101SRui Paulo <P> 684a8e07101SRui Paulo <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3> 685a8e07101SRui Paulo <TR> 686a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH> 687a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH> 688a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Description</TH> 689a8e07101SRui Paulo </TR> 690a8e07101SRui Paulo <TR> 691a8e07101SRui Paulo <TD VALIGN=TOP>command</TD> 692a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>1</TD> 693a8e07101SRui Paulo <TD VALIGN=TOP>'S' (indicating 'request statistics')</TD> 694a8e07101SRui Paulo </TR> 695a8e07101SRui Paulo </TABLE> 696a8e07101SRui Paulo </TD> 697a8e07101SRui Paulo </TR> 698a8e07101SRui Paulo <TR> 699a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD> 700a8e07101SRui Paulo <TD VALIGN=TOP>In return the IOP will send: 701a8e07101SRui Paulo <P> 702a8e07101SRui Paulo <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3> 703a8e07101SRui Paulo <TR> 704a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH> 705a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH> 706a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Description</TH> 707a8e07101SRui Paulo </TR> 708a8e07101SRui Paulo <TR> 709a8e07101SRui Paulo <TD VALIGN=TOP>ps_recv</TD> 710a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>4</TD> 711a8e07101SRui Paulo <TD VALIGN=TOP>The number of packets that passed the filter.</TD> 712a8e07101SRui Paulo </TR> 713a8e07101SRui Paulo <TR> 714a8e07101SRui Paulo <TD VALIGN=TOP>ps_drop</TD> 715a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>4</TD> 716a8e07101SRui Paulo <TD VALIGN=TOP>The number of packets that were dropped because the input queue was full, 717a8e07101SRui Paulo regardless of whether they passed the filter.</TD> 718a8e07101SRui Paulo </TR> 719a8e07101SRui Paulo <TR> 720a8e07101SRui Paulo <TD VALIGN=TOP>ps_ifdrop</TD> 721a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER>4</TD> 7226f9cba8fSJoseph Mingrone <TD VALIGN=TOP>The number of packets dropped by the network interface 723a8e07101SRui Paulo (regardless of whether they would have passed the input filter).</TD> 724a8e07101SRui Paulo </TR> 725a8e07101SRui Paulo </TABLE> 726a8e07101SRui Paulo </TD> 727a8e07101SRui Paulo </TR> 728a8e07101SRui Paulo <TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR> 729a8e07101SRui Paulo <TR> 730a8e07101SRui Paulo <TD VALIGN=TOP ROWSPAN=1>pcap_close()</TD> 731a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD> 732a8e07101SRui Paulo <TD VALIGN=TOP>At any time, the SMP can close the TCP session with the IOP.</TD> 733a8e07101SRui Paulo </TR> 734a8e07101SRui Paulo <TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR> 735a8e07101SRui Paulo </TABLE> 736a8e07101SRui Paulo</UL> 737a8e07101SRui Paulo 738a8e07101SRui Paulo<H3>Interface ID Naming Convention</H3> 739a8e07101SRui Paulo<UL> 740a8e07101SRui Paulo Each interface within an IOP will be referred to uniquely. Since an currently contains 741a8e07101SRui Paulo 8 monitorable WAN ports and a monitorable Ethernet port, the naming convention is: 742a8e07101SRui Paulo <P> 743a8e07101SRui Paulo <CENTER> 744a8e07101SRui Paulo <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3> 745a8e07101SRui Paulo <TR><TH>Interface #</TH> <TH>Type</TH> <TH>Name</TH></TR> 746a8e07101SRui Paulo <TR><TD ALIGN=CENTER>1</TD> <TD ALIGN=CENTER>WAN</TD> <TD ALIGN=CENTER>wan0</TD></TR> 747a8e07101SRui Paulo <TR><TD ALIGN=CENTER>2</TD> <TD ALIGN=CENTER>WAN</TD> <TD ALIGN=CENTER>wan1</TD></TR> 748a8e07101SRui Paulo <TR><TD ALIGN=CENTER>3</TD> <TD ALIGN=CENTER>WAN</TD> <TD ALIGN=CENTER>wan2</TD></TR> 749a8e07101SRui Paulo <TR><TD ALIGN=CENTER>4</TD> <TD ALIGN=CENTER>WAN</TD> <TD ALIGN=CENTER>wan3</TD></TR> 750a8e07101SRui Paulo <TR><TD ALIGN=CENTER>5</TD> <TD ALIGN=CENTER>WAN</TD> <TD ALIGN=CENTER>wan4</TD></TR> 751a8e07101SRui Paulo <TR><TD ALIGN=CENTER>6</TD> <TD ALIGN=CENTER>WAN</TD> <TD ALIGN=CENTER>wan5</TD></TR> 752a8e07101SRui Paulo <TR><TD ALIGN=CENTER>7</TD> <TD ALIGN=CENTER>WAN</TD> <TD ALIGN=CENTER>wan6</TD></TR> 753a8e07101SRui Paulo <TR><TD ALIGN=CENTER>8</TD> <TD ALIGN=CENTER>WAN</TD> <TD ALIGN=CENTER>wan7</TD></TR> 754a8e07101SRui Paulo <TR><TD ALIGN=CENTER>9</TD> <TD ALIGN=CENTER>Ethernet</TD> <TD ALIGN=CENTER>eth0</TD></TR> 755a8e07101SRui Paulo <TR><TD ALIGN=CENTER>10</TD> <TD ALIGN=CENTER>Ethernet</TD> <TD ALIGN=CENTER>eth1</TD></TR> 756a8e07101SRui Paulo </TABLE> 757a8e07101SRui Paulo </CENTER> 758a8e07101SRui Paulo</UL> 759a8e07101SRui Paulo 760a8e07101SRui Paulo<H3>Packet Trace Data Format</H3> 761a8e07101SRui Paulo<UL> 762a8e07101SRui Paulo The format of the trace data that is sent to the SMP follows a portion of the libpcap file format 763a8e07101SRui Paulo and is summarized here. This format specifies the generic requirements needed to 764a8e07101SRui Paulo be able to decode packets, but does not cover ACN specifics such as custom MAC addressing 765a8e07101SRui Paulo and WAN protocol support. 766a8e07101SRui Paulo <P> 767a8e07101SRui Paulo 768a8e07101SRui Paulo Although a libpcap file begins with a global header followed by zero or 769a8e07101SRui Paulo more records for each captured packet, trace data sent to the SMP does NOT begin with a global header. 770a8e07101SRui Paulo A trace sequence looks like this: 771a8e07101SRui Paulo <P> 772a8e07101SRui Paulo <TABLE> 773a8e07101SRui Paulo <TR> 774a8e07101SRui Paulo <TD STYLE="background-color: #c0FFc0"> [Packet Header] </TD> 775a8e07101SRui Paulo <TD STYLE="background-color: #c0FFc0"> [Packet Data] </TD> 776a8e07101SRui Paulo <TD STYLE="background-color: #c0c0FF"> [Packet Header] </TD> 777a8e07101SRui Paulo <TD STYLE="background-color: #c0c0FF"> [Packet Data] </TD> 778a8e07101SRui Paulo <TD STYLE="background-color: #e0c0c0"> [Packet Header] </TD> 779a8e07101SRui Paulo <TD STYLE="background-color: #e0c0c0"> [Packet Data] </TD> 780a8e07101SRui Paulo <TD>...</TD> 781a8e07101SRui Paulo </TR> 782a8e07101SRui Paulo </TABLE> 783a8e07101SRui Paulo 784a8e07101SRui Paulo<H4>Packet Header</H4> 785a8e07101SRui Paulo <UL> 786a8e07101SRui Paulo Each captured packet starts with a header that contains the following values 787a8e07101SRui Paulo (in network neutral order): 788a8e07101SRui Paulo 789a8e07101SRui Paulo <FONT SIZE=-1> 790a8e07101SRui Paulo <PRE> 791a8e07101SRui Paulo uint32 tv_sec; /* timestamp seconds */ 792a8e07101SRui Paulo uint32 tv_usec; /* timestamp microseconds */ 793a8e07101SRui Paulo uint32 caplen; /* number of octets in the following packet */ 794a8e07101SRui Paulo uint32 len; /* original length of packet on the wire */ 795a8e07101SRui Paulo </PRE> 796a8e07101SRui Paulo </FONT> 797a8e07101SRui Paulo 798a8e07101SRui Paulo <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3> 799a8e07101SRui Paulo <TR> 800a8e07101SRui Paulo <TD VALIGN=TOP>tv_sec</TD> 801a8e07101SRui Paulo <TD>The date and time when this packet was captured. 802a8e07101SRui Paulo This value is in seconds since January 1, 1970 00:00:00 GMT; 803a8e07101SRui Paulo this is also known as a UN*X time_t. You can use the ANSI C 804a8e07101SRui Paulo <em>time()</em> function from <em>time.h</em> to get this value, 805a8e07101SRui Paulo but you might use a more optimized way to get this timestamp value. 806a8e07101SRui Paulo </TR> 807a8e07101SRui Paulo <TR> 808a8e07101SRui Paulo <TD VALIGN=TOP>tv_usec</TD> 809a8e07101SRui Paulo <TD>The microseconds when this packet was captured, as an offset to <em>ts_sec</em>. 810a8e07101SRui Paulo <B>Beware: </B>this value must never reach 1 second (1,000,000), 811a8e07101SRui Paulo in this case <em>ts_sec</em> must be increased instead!</TD> 812a8e07101SRui Paulo </TR> 813a8e07101SRui Paulo <TR> 814a8e07101SRui Paulo <TD VALIGN=TOP>caplen</TD> 815a8e07101SRui Paulo <TD>The number of bytes actually provided in the capture record. 816a8e07101SRui Paulo This value should never become larger than <em>len</em> or the 817a8e07101SRui Paulo <em>snaplen</em> value specified during the capture.</TD> 818a8e07101SRui Paulo </TR> 819a8e07101SRui Paulo <TR> 820a8e07101SRui Paulo <TD VALIGN=TOP>len</TD> 821a8e07101SRui Paulo <TD>The length of the packet "on the wire" when it was captured. 822a8e07101SRui Paulo If <em>caplen</em> and <em>len</em> differ, the actually 823a8e07101SRui Paulo saved packet size was limited by the value of <em>snaplen</em> specified 824a8e07101SRui Paulo during one of the capture directives such as pcap_dispatch().</TD> 825a8e07101SRui Paulo </TR> 826a8e07101SRui Paulo </TABLE> 827a8e07101SRui Paulo </UL> 828a8e07101SRui Paulo 829a8e07101SRui Paulo<H4>Packet Data</H4> 830a8e07101SRui Paulo <UL> 831a8e07101SRui Paulo The actual packet data will immediately follow the packet header as a sequence of <em>caplen</em> octets. 832a8e07101SRui Paulo Depending on the DLT encoding number assigned to the interface, the packet data will contain an additional 833a8e07101SRui Paulo custom header used to convey WAN port related information. 834a8e07101SRui Paulo </UL> 835a8e07101SRui Paulo 836a8e07101SRui Paulo<H4>ACN Custom Packet Header</H4> 837a8e07101SRui Paulo <UL> 838a8e07101SRui Paulo PCAP, Wireshark and Tcpdump enhancements have been added to the ACN to support 839a8e07101SRui Paulo monitoring of its ports, however each of these facilities were focused on capturing 8406f9cba8fSJoseph Mingrone and displaying traffic from LAN interfaces. The SITA extensions to these facilities 841a8e07101SRui Paulo are used to also provide the ability to capture, filter, and display information from 842a8e07101SRui Paulo an ACN's WAN ports. 843a8e07101SRui Paulo <P> 844a8e07101SRui Paulo Although each packet follows the standard libpcap format, since there are 845a8e07101SRui Paulo two types of interfaces that can be monitored, the format of the data 846a8e07101SRui Paulo packet varies slightly. 847a8e07101SRui Paulo <P> 848a8e07101SRui Paulo <UL TYPE=DISC> 849a8e07101SRui Paulo <LI>For Ethernet (like) devices, the packet format is unchanged from the standard Pcap format. 8506f9cba8fSJoseph Mingrone <LI>For WAN devices, the packet contains a 5 byte header that precedes the actual captured data 851a8e07101SRui Paulo described by the following table: 852a8e07101SRui Paulo </UL> 853a8e07101SRui Paulo <P> 854a8e07101SRui Paulo <CENTER> 855a8e07101SRui Paulo <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3> 856a8e07101SRui Paulo <TR> <TH>Octet</TH> 857a8e07101SRui Paulo <TH>Name</TH> 858a8e07101SRui Paulo <TH>Mask/Value</TH> 859a8e07101SRui Paulo <TH COLSPAN=2>Definition</TH> </TR> 860a8e07101SRui Paulo 861a8e07101SRui Paulo <TR> <TH VALIGN=TOP ALIGN=CENTER ROWSPAN=3>0</TH> 862a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER ROWSPAN=3>Control / Status</TH> 863a8e07101SRui Paulo 864a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx0</FONT></TD> 865a8e07101SRui Paulo <TD>Transmitted by capture device</TD> 866a8e07101SRui Paulo <TD ROWSPAN=2 ALIGN=CENTER>(see 'Errors' octets)</TD> </TR> 867a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx1</FONT></TD> 868a8e07101SRui Paulo <TD>Received by capture device</TD> </TR> 869a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">1xxxxxxx</FONT></TD> 870a8e07101SRui Paulo <TD COLSPAN=2>No buffer was available during capture of previous packet.</TD> </TR> 871a8e07101SRui Paulo 872a8e07101SRui Paulo <TR> <TH VALIGN=TOP ALIGN=CENTER ROWSPAN=8>1</TH> 873a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER ROWSPAN=8>Signals</TH> 874a8e07101SRui Paulo 875a8e07101SRui Paulo <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx1</FONT></TD> <TD COLSPAN=2>DSR asserted</TD> </TR> 876a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxx1x</FONT></TD> <TD COLSPAN=2>DTR asserted</TD> </TR> 877a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxx1xx</FONT></TD> <TD COLSPAN=2>CTS asserted</TD> </TR> 878a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxx1xxx</FONT></TD> <TD COLSPAN=2>RTS asserted</TD> </TR> 879a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxx1xxxx</FONT></TD> <TD COLSPAN=2>DCD asserted</TD> </TR> 880a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xx1xxxxx</FONT></TD> <TD COLSPAN=2>Undefined</TD> </TR> 881a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">x1xxxxxx</FONT></TD> <TD COLSPAN=2>Undefined</TD> </TR> 882a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">1xxxxxxx</FONT></TD> <TD COLSPAN=2>Undefined</TD> </TR> 883a8e07101SRui Paulo 884a8e07101SRui Paulo <TR> <TH VALIGN=TOP ALIGN=CENTER ROWSPAN=9>2</TH> 885a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER ROWSPAN=9>Errors<BR>(octet 1)</TH> 886a8e07101SRui Paulo 887a8e07101SRui Paulo <TH> </TH> <TH>Tx</TH> <TH>Rx</TH> </TR> 888a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx1</FONT></TD> <TD>Underrun</TD> <TD>Framing</TD> </TR> 889a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxx1x</FONT></TD> <TD>CTS Lost</TD> <TD>Parity</TD> </TR> 890a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxx1xx</FONT></TD> <TD>UART Error</TD> <TD>Collision</TD> </TR> 891a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxx1xxx</FONT></TD> <TD>Re-Tx Limit Reached</TD> <TD>Long Frame</TD> </TR> 892a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxx1xxxx</FONT></TD> <TD>Undefined</TD> <TD>Short Frame</TD> </TR> 893a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xx1xxxxx</FONT></TD> <TD>Undefined</TD> <TD>Undefined</TD> </TR> 894a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">x1xxxxxx</FONT></TD> <TD>Undefined</TD> <TD>Undefined</TD> </TR> 895a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">1xxxxxxx</FONT></TD> <TD>Undefined</TD> <TD>Undefined</TD> </TR> 896a8e07101SRui Paulo 897a8e07101SRui Paulo <TR> <TH VALIGN=TOP ALIGN=CENTER ROWSPAN=9>3</TH> 898a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER ROWSPAN=9>Errors<BR>(octet 2)</TH> 899a8e07101SRui Paulo 900a8e07101SRui Paulo <TH> </TH> <TH>Tx</TH> <TH>Rx</TH> </TR> 901a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx1</FONT></TD> <TD>Undefined</TD> <TD>Non-Octet Aligned</TD> </TR> 902a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxx1x</FONT></TD> <TD>Undefined</TD> <TD>Abort Received</TD> </TR> 903a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxx1xx</FONT></TD> <TD>Undefined</TD> <TD>CD Lost</TD> </TR> 904a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxx1xxx</FONT></TD> <TD>Undefined</TD> <TD>Digital PLL Error</TD> </TR> 905a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxx1xxxx</FONT></TD> <TD>Undefined</TD> <TD>Overrun</TD> </TR> 906a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xx1xxxxx</FONT></TD> <TD>Undefined</TD> <TD>Frame Length Violation</TD> </TR> 907a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">x1xxxxxx</FONT></TD> <TD>Undefined</TD> <TD>CRC Error</TD> </TR> 908a8e07101SRui Paulo <TR> <TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">1xxxxxxx</FONT></TD> <TD>Undefined</TD> <TD>Break Received</TD> </TR> 909a8e07101SRui Paulo 910a8e07101SRui Paulo <TR> <TH VALIGN=TOP ALIGN=CENTER ROWSPAN=12>4</TH> 911a8e07101SRui Paulo <TH VALIGN=TOP ALIGN=CENTER>Protocol</TH> 912a8e07101SRui Paulo 913a8e07101SRui Paulo <TD COLSPAN=3> 914a8e07101SRui Paulo <CENTER> 915a8e07101SRui Paulo <TABLE BORDER=0 CELLPADDING=0 CELLSPACING=0> 916a8e07101SRui Paulo <TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x01</TD> <TD>-</TD> <TD>LAPB (BOP) <SUP> </SUP> </TD> </TR> 917a8e07101SRui Paulo <TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x02</TD> <TD>-</TD> <TD>Ethernet <SUP>1</SUP> </TD> </TR> 918a8e07101SRui Paulo <TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x03</TD> <TD>-</TD> <TD>Async (Interrupt IO) <SUP> </SUP> </TD> </TR> 919a8e07101SRui Paulo <TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x04</TD> <TD>-</TD> <TD>Async (Block IO) <SUP> </SUP> </TD> </TR> 920a8e07101SRui Paulo <TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x05</TD> <TD>-</TD> <TD>IPARS <SUP> </SUP> </TD> </TR> 921a8e07101SRui Paulo <TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x06</TD> <TD>-</TD> <TD>UTS <SUP> </SUP> </TD> </TR> 922a8e07101SRui Paulo <TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x07</TD> <TD>-</TD> <TD>PPP (HDLC) <SUP> </SUP> </TD> </TR> 923a8e07101SRui Paulo <TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x08</TD> <TD>-</TD> <TD>SDLC <SUP> </SUP> </TD> </TR> 924a8e07101SRui Paulo <TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x09</TD> <TD>-</TD> <TD>Token Ring <SUP>1</SUP> </TD> </TR> 925a8e07101SRui Paulo <TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x10</TD> <TD>-</TD> <TD>I2C <SUP> </SUP> </TD> </TR> 926a8e07101SRui Paulo <TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x11</TD> <TD>-</TD> <TD>DPM Link <SUP> </SUP> </TD> </TR> 927a8e07101SRui Paulo <TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x12</TD> <TD>-</TD> <TD>Frame Relay (BOP) <SUP> </SUP> </TD> </TR> 928a8e07101SRui Paulo </TABLE> 929a8e07101SRui Paulo </CENTER> 930a8e07101SRui Paulo <P> 931a8e07101SRui Paulo <STRONG>Note 1:</STRONG> 932a8e07101SRui Paulo Ethernet and Token Ring frames will never be sent as DLT_SITA (with the 5 octet header), 933a8e07101SRui Paulo but will be sent as their corresponding DLT types instead. 934a8e07101SRui Paulo </TD> 935a8e07101SRui Paulo </TR> 936a8e07101SRui Paulo </TABLE> 937a8e07101SRui Paulo </CENTER> 938a8e07101SRui Paulo</UL> 939a8e07101SRui Paulo<P> 940a8e07101SRui Paulo</UL> 941a8e07101SRui Paulo</UL> 942