xref: /freebsd/contrib/libpcap/pcap-sita.html (revision afdbf109c6a661a729938f68211054a0a50d38ac)
1a8e07101SRui Paulo<HTML><HEAD>
2a8e07101SRui Paulo<STYLE type="text/css">
3a8e07101SRui Paulo<!--
4a8e07101SRui PauloA { text-decoration:none }
5a8e07101SRui Paulo-->
6a8e07101SRui Paulo</STYLE>
7a8e07101SRui Paulo</HEAD>
8a8e07101SRui Paulo<BODY>
9a8e07101SRui Paulo
10a8e07101SRui Paulo<TABLE WIDTH=100%><TR>
11a8e07101SRui Paulo	<TD ALIGN=LEFT VALIGN=TOP>
12a8e07101SRui Paulo		<FONT SIZE=+0 FACE="COURIER"><B>A "Distributed Pcap" for<BR>Remote Monitoring LANs & WANs</B><BR>
13a8e07101SRui Paulo										(Design Notes for the SITA ACN device)</FONT>
14a8e07101SRui Paulo	</TD>
15a8e07101SRui Paulo	<TD ALIGN=RIGHT VALIGN=TOP>
16a8e07101SRui Paulo		Fulko Hew<BR>SITA INC Canada, Inc.<BR>Revised: October 2, 2007
17a8e07101SRui Paulo	</TD>
18a8e07101SRui Paulo</TR></TABLE>
19a8e07101SRui Paulo
20a8e07101SRui Paulo
21a8e07101SRui Paulo<H3>SUMMARY</H3>
22a8e07101SRui Paulo<UL>
23a0ee43a1SRui Paulo	<STRONG>Note:</STRONG> This document is part of the libpcap Git and was derived from 'pcap.3' (circa Aug/07).
24a8e07101SRui Paulo	<P>
256f9cba8fSJoseph Mingrone	The ACN provides a customized/distributed version of this library that allows SMPs to
26a8e07101SRui Paulo	interact with the various IOPs within the site providing a standard mechanism
27a8e07101SRui Paulo	to capture LAN and WAN message traffic.
28a8e07101SRui Paulo	<P>
29a8e07101SRui Paulo	<CENTER>
30a8e07101SRui Paulo		<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3 WIDTH=75%>
31a8e07101SRui Paulo			<TR>
32a8e07101SRui Paulo				<TH VALIGN=TOP>SMP</TH>
33a8e07101SRui Paulo				<TD VALIGN=TOP>The Supervisory Management Processor where Wireshark (or equivalent)
346f9cba8fSJoseph Mingrone								runs in conjunction with a libpcap front-end.</TD>
35a8e07101SRui Paulo			</TR>
36a8e07101SRui Paulo			<TR>
37a8e07101SRui Paulo				<TH VALIGN=TOP>IOP</TH>
38a8e07101SRui Paulo				<TD VALIGN=TOP>I/O Processors where the monitored ports exist in conjunction
39a8e07101SRui Paulo								with a custom device driver/libpcap back-end.</TD>
40a8e07101SRui Paulo			</TR>
41a8e07101SRui Paulo		</TABLE>
42a8e07101SRui Paulo	</CENTER>
43a8e07101SRui Paulo	<P>
44a8e07101SRui Paulo	Each IOP will be capable of supporting multiple connections from an SMP
45a8e07101SRui Paulo	enabling monitoring of more than one interface at a time, each through
466f9cba8fSJoseph Mingrone	its own separate connection.  The IOP is responsible to ensure and report
47a8e07101SRui Paulo	an error if any attempt is made to monitor the same interface more than once.
48a8e07101SRui Paulo	<P>
49a8e07101SRui Paulo	There are three applications that will be supported by the ACN version of libpcap.
50a8e07101SRui Paulo	They each use a slightly different mode for looping/capturing and termination
51a8e07101SRui Paulo	as summarized in the following table:
52a8e07101SRui Paulo	<P>
53a8e07101SRui Paulo	<CENTER>
54a8e07101SRui Paulo	<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
55a8e07101SRui Paulo	<TR><TH>Application</TH>	<TH>Capture</TH>	<TH>Termination</TH></TR>
56a8e07101SRui Paulo	<TR><TH VALIGN=TOP NOWRAP>wireshark</TH>
57a8e07101SRui Paulo			<TD VALIGN=TOP>pcap_dispatch(all packets in one buffer of capture only)</TD>
58a8e07101SRui Paulo			<TD VALIGN=TOP>pcap_breakloop()</TD>
59a8e07101SRui Paulo		</TR>
60a8e07101SRui Paulo	<TR><TH VALIGN=TOP NOWRAP>tshark</TH>
61a8e07101SRui Paulo			<TD VALIGN=TOP>pcap_dispatch(one buffer of capture only)</TD>
62a8e07101SRui Paulo			<TD VALIGN=TOP>Since a CTRL-C was used to terminate the application, pcap_breakloop() is never called.</TD>
63a8e07101SRui Paulo		</TR>
64a8e07101SRui Paulo	<TR><TH VALIGN=TOP NOWRAP>tcpdump</TH>
65a8e07101SRui Paulo			<TD VALIGN=TOP>pcap_loop(all packets in the next buffer, and loop forever)</TD>
66a8e07101SRui Paulo			<TD VALIGN=TOP>pcap_breakloop()</TD>
67a8e07101SRui Paulo		</TR>
68a8e07101SRui Paulo	</TABLE>
69a8e07101SRui Paulo	</CENTER>
70a8e07101SRui Paulo	<P>
71a8e07101SRui Paulo	<B>Note: </B>In all cases, the termination of capturing is always (apparently) followed by
72a8e07101SRui Paulo	pcap_close().  Pcap_breakloop() is only used to stop/suspend looping/processing,
73a8e07101SRui Paulo	and upon close interpretation of the function definitions, it is possible to resume
74a8e07101SRui Paulo	capturing following a pcap_breakloop() without any re-initialization.
75a8e07101SRui Paulo	<P>
76a8e07101SRui Paulo	<H4>ACN Limitations</H4>
77a8e07101SRui Paulo	<OL>
78a8e07101SRui Paulo		<LI>Monitoring of backup IOPs is not currently supported.
79a8e07101SRui Paulo		<LI>Ethernet interfaces cannot be monitored in promiscuous mode.
80a8e07101SRui Paulo	</OL>
81a8e07101SRui Paulo
82a8e07101SRui Paulo</UL>
83a8e07101SRui Paulo
84a8e07101SRui Paulo<H3>ROUTINES</H3>
85a8e07101SRui Paulo<UL>
86a8e07101SRui Paulo		The following list of functions is the sub-set of Pcap functions that have been
87a8e07101SRui Paulo		altered/enhanced to support the ACN remote monitoring facility.  The remainder of the Pcap
88a8e07101SRui Paulo		functions continue to perform their duties un-altered.  Libpcap only supports this
89a8e07101SRui Paulo		mode of operation if it has been configured/compiled for SITA/ACN support.
90a8e07101SRui Paulo		<P>
91a8e07101SRui Paulo		<UL><FONT FACE=COURIER>
92a8e07101SRui Paulo			pcap_findalldevs<BR>
93a8e07101SRui Paulo			pcap_freealldevs<BR>
94a8e07101SRui Paulo			pcap_open_live<BR>
95a8e07101SRui Paulo			pcap_close<BR>
96a8e07101SRui Paulo			pcap_setfilter<BR>
97a8e07101SRui Paulo			pcap_dispatch<BR>
98a8e07101SRui Paulo			pcap_loop<BR>
99a8e07101SRui Paulo			pcap_next<BR>
100a8e07101SRui Paulo			pcap_next_ex<BR>
101a8e07101SRui Paulo			pcap_stats<BR>
102a8e07101SRui Paulo		</FONT></UL>
103a8e07101SRui Paulo
104a8e07101SRui Paulo	These subroutines have been modified for the ACN specific distributed and remote monitoring
105a8e07101SRui Paulo	ability perform the following basic functions.  More detail is provided in the
106a8e07101SRui Paulo	"SMP/IOP Inter-Process Communication Protocol" section.
107a8e07101SRui Paulo	<P>
108a8e07101SRui Paulo<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
109a8e07101SRui Paulo	<TR>
110a8e07101SRui Paulo		<TD VALIGN=TOP ROWSPAN=2><B>pcap_open_live()</B></TD>
111a8e07101SRui Paulo		<TD VALIGN=TOP>Used to obtain a packet capture descriptor to look at packets on the network.</TD>
112a8e07101SRui Paulo	</TR>
113a8e07101SRui Paulo	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
114a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
115a8e07101SRui Paulo			<TD>
116a8e07101SRui Paulo			The SMP will open a connection to the selected IOP on its 'sniffer' port
117a8e07101SRui Paulo			to ensure it is available.  It sends a null terminated string identifying
118a8e07101SRui Paulo			the interface to be monitored.
119a8e07101SRui Paulo			</TD>
120a8e07101SRui Paulo		</TR>
121a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
122a8e07101SRui Paulo			<TD>
123a8e07101SRui Paulo			After any required processing is complete, the IOP will return a
1246f9cba8fSJoseph Mingrone			null terminated string containing an error message if one occurred.
1256f9cba8fSJoseph Mingrone			If no error occurred, a empty string is still returned.
126a8e07101SRui Paulo			Errors are:
127a8e07101SRui Paulo			<UL>
128a8e07101SRui Paulo			<LI>"Interface (xxx) does not exist."
129a8e07101SRui Paulo			<LI>"Interface (xxx) not configured."
130a8e07101SRui Paulo			<LI>"Interface (xxx) already being monitored."
131a8e07101SRui Paulo			</UL>
132a8e07101SRui Paulo			</TD>
133a8e07101SRui Paulo		</TR>
134a8e07101SRui Paulo	</TABLE></TD></TR>
135a8e07101SRui Paulo
136a8e07101SRui Paulo	<TR>
137a8e07101SRui Paulo		<TD VALIGN=TOP ROWSPAN=2><B>pcap_findalldevs()</B></TD>
138a8e07101SRui Paulo		<TD VALIGN=TOP>It constructs a list of network devices that can be opened with pcap_open_live().</TD>
139a8e07101SRui Paulo	</TR>
140a8e07101SRui Paulo	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
141a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
142a8e07101SRui Paulo			<TD>
143a8e07101SRui Paulo			It obtains a list of IOPs currently available (via /etc/hosts).
144a8e07101SRui Paulo			</TD>
145a8e07101SRui Paulo		</TR>
146a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
147a8e07101SRui Paulo			<TD>
148a8e07101SRui Paulo			The SMP will sequentially open a connection to each IOP on its 'sniffer' port to ensure
149a8e07101SRui Paulo			the IOP is available.
150a8e07101SRui Paulo			It sends a null terminated empty interface ID followed by the query request command.
151a8e07101SRui Paulo			</TD>
152a8e07101SRui Paulo		</TR>
153a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
154a8e07101SRui Paulo			<TD>The IOP returns an error response and its list of devices.
155a8e07101SRui Paulo			</TD>
156a8e07101SRui Paulo		</TR>
157a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
158a8e07101SRui Paulo			<TD>
159a8e07101SRui Paulo			The SMP closes the TCP connection with each IOP.
160a8e07101SRui Paulo			</TD>
161a8e07101SRui Paulo		</TR>
162a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
163a8e07101SRui Paulo			<TD>
164a8e07101SRui Paulo			The SMP adds the received information to its internal structure.
165a8e07101SRui Paulo			</TD>
166a8e07101SRui Paulo		</TR>
167a8e07101SRui Paulo	</TABLE></TD></TR>
168a8e07101SRui Paulo
169a8e07101SRui Paulo	<TR>
170a8e07101SRui Paulo		<TD VALIGN=TOP ROWSPAN=2><B>pcap_freealldevs()</B></TD>
171a8e07101SRui Paulo		<TD VALIGN=TOP>Used to free a list allocated by pcap_findalldevs().</TD>
172a8e07101SRui Paulo	</TR>
173a8e07101SRui Paulo	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
174a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
175a8e07101SRui Paulo			<TD>
176a8e07101SRui Paulo			The SMP frees the structure it built as a result of the previous
177a8e07101SRui Paulo			invocation of pcap_findalldevs().
178a8e07101SRui Paulo			</TD>
179a8e07101SRui Paulo		</TR>
180a8e07101SRui Paulo	</TABLE></TD></TR>
181a8e07101SRui Paulo
182a8e07101SRui Paulo	<TR>
183a8e07101SRui Paulo		<TD VALIGN=TOP ROWSPAN=2><B>pcap_dispatch()</B></TD>
184a8e07101SRui Paulo		<TD VALIGN=TOP>Used to collect and process packets.</TD>
185a8e07101SRui Paulo	</TR>
186a8e07101SRui Paulo	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
187a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
188a8e07101SRui Paulo			<TD>
189a8e07101SRui Paulo			On the first invocation of pcap_dispatch(), pcap_loop(), or pcap_next(), or pcap_next_ex() following a pcap_open_live(),
190a8e07101SRui Paulo			the SMP will pass down the monitor start command and various parameters the IOP should use.
191a8e07101SRui Paulo			</TD>
192a8e07101SRui Paulo		</TR>
193a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
194a8e07101SRui Paulo			<TD>
195a8e07101SRui Paulo			The IOP now sends a stream of captured data.
196a8e07101SRui Paulo			</TD>
197a8e07101SRui Paulo		</TR>
198a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
199a8e07101SRui Paulo			<TD>
200a8e07101SRui Paulo			The SMP will read the reverse channel of the connection between the SMP and the
201a8e07101SRui Paulo			IOP that provides the captured data (via 'p->read_op' which is 'pcap_read_linux()'
202a8e07101SRui Paulo			until the select() call returns a 'no more data' indication.
203a8e07101SRui Paulo			It will the process (at most) the next 'cnt' packets and invoke the specified
204a8e07101SRui Paulo			callback function for each packet processed.
205a8e07101SRui Paulo			</TD>
206a8e07101SRui Paulo		</TR>
207a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>IOP</TH>
208a8e07101SRui Paulo			<TD>
209a8e07101SRui Paulo			The IOP continues to listen for additional commands as well as capturing and forwarding data to the SMP.
210a8e07101SRui Paulo			</TD>
211a8e07101SRui Paulo		</TR>
212a8e07101SRui Paulo	</TABLE></TD></TR>
213a8e07101SRui Paulo
214a8e07101SRui Paulo	<TR>
215a8e07101SRui Paulo		<TD VALIGN=TOP ROWSPAN=2><B>pcap_loop()</B></TD>
216a8e07101SRui Paulo		<TD VALIGN=TOP>
217a8e07101SRui Paulo				Is similar to pcap_dispatch() except it keeps reading packets until
218a8e07101SRui Paulo				the requested number of packets are processed or an error occurs.
219a8e07101SRui Paulo		</TD>
220a8e07101SRui Paulo	</TR>
221a8e07101SRui Paulo	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
222a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
223a8e07101SRui Paulo			<TD>
224a8e07101SRui Paulo			On the first invocation of pcap_dispatch(), pcap_loop(), or pcap_next(), or pcap_next_ex() following a pcap_open_live(),
225a8e07101SRui Paulo			the SMP will pass down the monitor start command and various parameters the IOP should use.
226a8e07101SRui Paulo			</TD>
227a8e07101SRui Paulo		</TR>
228a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
229a8e07101SRui Paulo			<TD>
230a8e07101SRui Paulo			The IOP now sends a stream of captured data.
231a8e07101SRui Paulo			</TD>
232a8e07101SRui Paulo		</TR>
233a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
234a8e07101SRui Paulo			<TD>
235a8e07101SRui Paulo			The SMP continuously reads the next packet from the reverse channel of the connection
236a8e07101SRui Paulo			between the SMP and the IOP that provides the captured data (via 'p->read_op'
237a8e07101SRui Paulo			which is 'pcap_read_linux()' until 'cnt' packets have been received.
238a8e07101SRui Paulo			The specified callback function will be invoked for each packet received.
239a8e07101SRui Paulo			</TD>
240a8e07101SRui Paulo		</TR>
241a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>IOP</TH>
242a8e07101SRui Paulo			<TD>
243a8e07101SRui Paulo			The IOP continues to listen for additional commands as well as capturing and forwarding data to the SMP.
244a8e07101SRui Paulo			</TD>
245a8e07101SRui Paulo		</TR>
246a8e07101SRui Paulo	</TABLE></TD></TR>
247a8e07101SRui Paulo
248a8e07101SRui Paulo	<TR>
249a8e07101SRui Paulo		<TD VALIGN=TOP ROWSPAN=2><B>pcap_next()</B></TD>
250a8e07101SRui Paulo		<TD VALIGN=TOP>
251a8e07101SRui Paulo			It reads the next packet (by calling pcap_dispatch() with a count of 1)
252a8e07101SRui Paulo			and returns a pointer to the data in that packet.
253a8e07101SRui Paulo		</TD>
254a8e07101SRui Paulo	</TR>
255a8e07101SRui Paulo	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
256a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
257a8e07101SRui Paulo			<TD>
258a8e07101SRui Paulo			On the first invocation of pcap_dispatch(), pcap_loop(), or pcap_next(), or pcap_next_ex() following a pcap_open_live(),
259a8e07101SRui Paulo			the SMP will pass down the monitor start command and various parameters the IOP should use.
260a8e07101SRui Paulo			</TD>
261a8e07101SRui Paulo		</TR>
262a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
263a8e07101SRui Paulo			<TD>
264a8e07101SRui Paulo			The IOP now sends a stream of captured data.
265a8e07101SRui Paulo			</TD>
266a8e07101SRui Paulo		</TR>
267a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
268a8e07101SRui Paulo			<TD>
269a8e07101SRui Paulo			The SMP reads only the next packet from the reverse channel of the connection
270a8e07101SRui Paulo			between the SMP and the IOP that provides the captured data (via calling pcap_dispatch()
271a8e07101SRui Paulo			with a count of 1) and returns a pointer to that data by invoking an internal callback.
272a8e07101SRui Paulo			</TD>
273a8e07101SRui Paulo		</TR>
274a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>IOP</TH>
275a8e07101SRui Paulo			<TD>
276a8e07101SRui Paulo			The IOP continues to listen for additional commands as well as capturing and forwarding data to the SMP.
277a8e07101SRui Paulo			</TD>
278a8e07101SRui Paulo		</TR>
279a8e07101SRui Paulo	</TABLE></TD></TR>
280a8e07101SRui Paulo
281a8e07101SRui Paulo	<TR>
282a8e07101SRui Paulo		<TD VALIGN=TOP ROWSPAN=2><B>pcap_next_ex()</B></TD>
283a8e07101SRui Paulo		<TD VALIGN=TOP>Reads the next packet and returns a success/failure indication.</TD>
284a8e07101SRui Paulo	</TR>
285a8e07101SRui Paulo	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
286a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
287a8e07101SRui Paulo			<TD>
288a8e07101SRui Paulo			On the first invocation of pcap_dispatch(), pcap_loop(), or pcap_next(), or pcap_next_ex() following a pcap_open_live(),
289a8e07101SRui Paulo			the SMP will pass down the monitor start command and various parameters the IOP should use.
290a8e07101SRui Paulo			</TD>
291a8e07101SRui Paulo		</TR>
292a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
293a8e07101SRui Paulo			<TD>
294a8e07101SRui Paulo			The IOP now sends a stream of captured data.
295a8e07101SRui Paulo			</TD>
296a8e07101SRui Paulo		</TR>
297a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
298a8e07101SRui Paulo			<TD>
299a8e07101SRui Paulo			The SMP reads only the next packet from the reverse channel of the connection
300a8e07101SRui Paulo			between the SMP and the IOP that provides the captured data (via calling pcap_dispatch()
3016f9cba8fSJoseph Mingrone			with a count of 1) and returns separate pointers to both the
302a8e07101SRui Paulo			packet header and packet data by invoking an internal callback.
303a8e07101SRui Paulo			</TD>
304a8e07101SRui Paulo		</TR>
305a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>IOP</TH>
306a8e07101SRui Paulo			<TD>
307a8e07101SRui Paulo			The IOP continues to listen for additional commands as well as capturing and forwarding data to the SMP.
308a8e07101SRui Paulo			</TD>
309a8e07101SRui Paulo		</TR>
310a8e07101SRui Paulo	</TABLE></TD></TR>
311a8e07101SRui Paulo
312a8e07101SRui Paulo	<TR>
313a8e07101SRui Paulo		<TD VALIGN=TOP ROWSPAN=2><B>pcap_setfilter()</B></TD>
314a8e07101SRui Paulo        <TD VALIGN=TOP>Used to specify a filter program.</TD>
315a8e07101SRui Paulo	</TR>
316a8e07101SRui Paulo	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
317a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
318a8e07101SRui Paulo			<TD>
319a8e07101SRui Paulo			The SMP sends a 'set filter' command followed by the BPF commands.
320a8e07101SRui Paulo			</TD>
321a8e07101SRui Paulo		</TR>
322a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
323a8e07101SRui Paulo			<TD>
324a8e07101SRui Paulo			The IOP returns a null terminated error string if it failed to accept the filter.
3256f9cba8fSJoseph Mingrone			If no error occurred, then a NULL terminated empty string is returned instead.
326a8e07101SRui Paulo			Errors are:
327a8e07101SRui Paulo			<UL>
328a8e07101SRui Paulo			<LI>"Invalid BPF."
329a8e07101SRui Paulo			<LI>"Insufficient resources for BPF."
330a8e07101SRui Paulo			</UL>
331a8e07101SRui Paulo			</TD>
332a8e07101SRui Paulo		</TR>
333a8e07101SRui Paulo	</TABLE></TD></TR>
334a8e07101SRui Paulo
335a8e07101SRui Paulo	<TR>
336a8e07101SRui Paulo		<TD VALIGN=TOP ROWSPAN=2><B>pcap_stats()</B></TD>
337a8e07101SRui Paulo        <TD VALIGN=TOP>Fills in a pcap_stat struct with packet statistics.</TD>
338a8e07101SRui Paulo	</TR>
339a8e07101SRui Paulo	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
340a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
341a8e07101SRui Paulo			<TD>
342a8e07101SRui Paulo			The SMP sends a message to the IOP requesting its statistics.
343a8e07101SRui Paulo			</TD>
344a8e07101SRui Paulo		</TR>
345a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
346a8e07101SRui Paulo			<TD>
347a8e07101SRui Paulo			The IOP returns the statistics.
348a8e07101SRui Paulo			</TD>
349a8e07101SRui Paulo		</TR>
350a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
351a8e07101SRui Paulo			<TD>
352a8e07101SRui Paulo			The SMP fills in the structure provided with the information retrieved from the IOP.
353a8e07101SRui Paulo			</TD>
354a8e07101SRui Paulo		</TR>
355a8e07101SRui Paulo	</TABLE></TD></TR>
356a8e07101SRui Paulo
357a8e07101SRui Paulo	<TR>
358a8e07101SRui Paulo		<TD VALIGN=TOP ROWSPAN=2><B>pcap_close()</B></TD>
359a8e07101SRui Paulo        <TD VALIGN=TOP>Closes the file and deallocates resources.</TD>
360a8e07101SRui Paulo	</TR>
361a8e07101SRui Paulo	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
362a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
363a8e07101SRui Paulo			<TD>
364a8e07101SRui Paulo			The SMP closes the file descriptor, and if the descriptor is that of
3656f9cba8fSJoseph Mingrone			the communication session with an IOP, it too is terminated.
366a8e07101SRui Paulo			</TD>
367a8e07101SRui Paulo		</TR>
368a8e07101SRui Paulo		<TR><TH VALIGN=TOP NOWRAP>IOP</TH>
369a8e07101SRui Paulo			<TD>
370a8e07101SRui Paulo			If the IOP detects that its communication session with an SMP
371a8e07101SRui Paulo			has closed, it will terminate any monitoring in progress,
372a8e07101SRui Paulo			release any resources and close its end of the session.
3736f9cba8fSJoseph Mingrone			It will not maintain persistence of any information or prior mode of operation.
374a8e07101SRui Paulo			</TD>
375a8e07101SRui Paulo		</TR>
376a8e07101SRui Paulo	</TABLE></TD></TR>
377a8e07101SRui Paulo</TABLE>
378a8e07101SRui Paulo</UL>
379a8e07101SRui Paulo
380a8e07101SRui Paulo<P>
381a8e07101SRui Paulo<H3>SMP/IOP Inter-Process Communication Protocol</H3>
382a8e07101SRui Paulo
383a8e07101SRui Paulo<UL>
384a8e07101SRui Paulo	<LI><P>Communications between an SMP and an IOP consists of a TCP session
385a8e07101SRui Paulo			between an ephemeral port on the SMP and the well known port of 49152
386a8e07101SRui Paulo			(which is the first available port in the 'dynamic and/or private port'
387a8e07101SRui Paulo			range) on an IOP.
388a8e07101SRui Paulo	<LI><P>Following a TCP open operation the IOP receives a null terminated
389a8e07101SRui Paulo			'interface ID' string to determine the type of operation that follows:
390a8e07101SRui Paulo	<LI><P>Every command received by an IOP implies a 'stop trace/stop forwarding' operation must
391a8e07101SRui Paulo			occur before executing the received command.
392a8e07101SRui Paulo	<LI><P>A session is closed when the SMP closes the TCP session with the IOP.
393a8e07101SRui Paulo			Obviously monitoring and forwarding is also stopped at that time.
394a8e07101SRui Paulo
395a8e07101SRui Paulo	<B>Note: </B>All multi-octet entities are sent in network neutral order.
396a8e07101SRui Paulo	<P>
397a8e07101SRui Paulo
398a8e07101SRui Paulo	<TABLE BORDER=0 CELLSPACING=0 CELLPADDING=5>
399a8e07101SRui Paulo		<TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR>
400a8e07101SRui Paulo		<TR>
401a8e07101SRui Paulo			<TD VALIGN=TOP ROWSPAN=6>pcap_findalldevs()</TD>
402a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
403a8e07101SRui Paulo			<TD VALIGN=TOP>Open socket (to each IOP), and sends:
404a8e07101SRui Paulo				<P>
405a8e07101SRui Paulo				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
406a8e07101SRui Paulo					<TR>
407a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
408a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
409a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
410a8e07101SRui Paulo					</TR>
411a8e07101SRui Paulo					<TR>
412a8e07101SRui Paulo						<TD VALIGN=TOP>Interface ID</TD>
413a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
41457e22627SCy Schubert						<TD VALIGN=TOP>A NULL to indicate an empty 'interface ID'.</TD>
415a8e07101SRui Paulo					</TR>
416a8e07101SRui Paulo				</TABLE>
417a8e07101SRui Paulo			</TD>
418a8e07101SRui Paulo		</TR>
419a8e07101SRui Paulo		<TR>
420a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD>
421a8e07101SRui Paulo			<TD VALIGN=TOP>Send its (possibly empty) NULL terminated error response string.</TD>
422a8e07101SRui Paulo		</TR>
423a8e07101SRui Paulo		<TR>
424a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
425a8e07101SRui Paulo			<TD VALIGN=TOP>Sends the 'interface query request':
426a8e07101SRui Paulo				<P>
427a8e07101SRui Paulo				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
428a8e07101SRui Paulo					<TR>
429a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
430a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
431a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
432a8e07101SRui Paulo					</TR>
433a8e07101SRui Paulo					<TR>
434a8e07101SRui Paulo						<TD VALIGN=TOP>Interface ID</TD>
435a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
436a8e07101SRui Paulo						<TD VALIGN=TOP>A 'Q' (indicating 'interface query request').</TD>
437a8e07101SRui Paulo					</TR>
438a8e07101SRui Paulo				</TABLE>
439a8e07101SRui Paulo			</TD>
440a8e07101SRui Paulo		</TR>
441a8e07101SRui Paulo		<TR>
442a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD>
443a8e07101SRui Paulo			<TD VALIGN=TOP>The IOP returns a list of sequences of information as
444a8e07101SRui Paulo				defined by the return parameter of this function call (as shown in the following table).
4456f9cba8fSJoseph Mingrone				Elements are specified by providing an unsigned byte preceding the actual data that contains length information.
446a8e07101SRui Paulo				<P>
447a8e07101SRui Paulo				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
448a8e07101SRui Paulo				<TR>
449a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Notes:</TH>
450a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
451a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
452a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
453a8e07101SRui Paulo				</TR>
454a8e07101SRui Paulo				<TR>
455a8e07101SRui Paulo					<TD ROWSPAN=7>&nbsp;</TD>
456a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=RIGHT>length</TD>
457a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
458a8e07101SRui Paulo					<TD VALIGN=TOP>The number of octets in the name field that follows.</TD>
459a8e07101SRui Paulo				</TR>
460a8e07101SRui Paulo				<TR><TD VALIGN=TOP ALIGN=LEFT>Name</TD>
461a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>1-255</TD>
462a8e07101SRui Paulo					<TD VALIGN=TOP>The name of the interface. The format of the name is an alphabetic string (indicating
463a8e07101SRui Paulo									the type of interface) followed by an optional numeric string (indicating the interface's
464a8e07101SRui Paulo									sequence number).
465a8e07101SRui Paulo									Sequence numbers (if needed) will begin at zero and progress monotonically upwards.
466a8e07101SRui Paulo									(i.e. 'eth0', 'lo', 'wan0', etc.)
467a8e07101SRui Paulo									<P>
468a8e07101SRui Paulo									For an IOP, the alphabetic string will be one of: 'eth', 'wan', and 'lo'
469a8e07101SRui Paulo									for Ethernet, WAN ports and the IP loopback device respectively.
470a8e07101SRui Paulo									An IOP currently supports: 'eth0', 'eth1', 'lo', 'wan0' ... 'wan7'.
471a8e07101SRui Paulo									<P>
472a8e07101SRui Paulo						<B>Note:</B> IOPs and ACNs will not currently support the concept of 'any' interface.</TD>
473a8e07101SRui Paulo				</TR>
474a8e07101SRui Paulo				<TR><TD VALIGN=TOP ALIGN=RIGHT>length</TD>
475a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
476a8e07101SRui Paulo					<TD VALIGN=TOP>The number of octets in the interface description field that follows.</TD>
477a8e07101SRui Paulo				</TR>
478a8e07101SRui Paulo				<TR><TD VALIGN=TOP ALIGN=LEFT>Interface Description</TD>
479a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>0-255</TD>
480a8e07101SRui Paulo					<TD VALIGN=TOP>A description of the interface or it may be an empty string. (i.e. 'ALC')</TD>
481a8e07101SRui Paulo				</TR>
482a8e07101SRui Paulo				<TR><TD VALIGN=TOP ALIGN=LEFT>Interface Type</TD>
483a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>4</TD>
484a8e07101SRui Paulo					<TD VALIGN=TOP>The type of interface as defined in the description for pcap_datalink() (in network neutral order).</TD>
485a8e07101SRui Paulo				</TR>
486a8e07101SRui Paulo				<TR><TD VALIGN=TOP ALIGN=LEFT>Loopback Flag</TD>
487a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
488a8e07101SRui Paulo					<TD VALIGN=TOP>1 = if the interface is a loopback interface, zero = otherwise.</TD>
489a8e07101SRui Paulo				</TR>
490a8e07101SRui Paulo				<TR><TD VALIGN=TOP ALIGN=RIGHT>count</TD>
491a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
492a8e07101SRui Paulo					<TD VALIGN=TOP># of address entries that follow.
493a8e07101SRui Paulo						Each entry is a series of bytes in network neutral order.
494a8e07101SRui Paulo						See the parameter definition above for more details.</TD>
495a8e07101SRui Paulo				</TR>
496a8e07101SRui Paulo				<TR>
497a8e07101SRui Paulo					<TD ALIGN=CENTER ROWSPAN=8 WIDTH=1%>Repeated 'count' number of times.</TD>
498a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=RIGHT>length</TD>
499a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
500a8e07101SRui Paulo					<TD VALIGN=TOP>The number of octets in the address field that follows.</TD>
501a8e07101SRui Paulo				</TR>
502a8e07101SRui Paulo				<TR><TD VALIGN=TOP ALIGN=LEFT>Address</TD>
503a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>1-255</TD>
504a8e07101SRui Paulo					<TD VALIGN=TOP>The address of this interface (in network neutral order).</TD>
505a8e07101SRui Paulo				</TR>
506a8e07101SRui Paulo				<TR><TD VALIGN=TOP ALIGN=RIGHT>length</TD>
507a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
508a8e07101SRui Paulo					<TD VALIGN=TOP>The number of octets in the netmask field that follows.</TD>
509a8e07101SRui Paulo				</TR>
510a8e07101SRui Paulo				<TR><TD VALIGN=TOP ALIGN=LEFT>Network Mask</TD>
511a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>0-255</TD>
512a8e07101SRui Paulo					<TD VALIGN=TOP>The network mask used on this interface (if applicable) (in network neutral order).</TD>
513a8e07101SRui Paulo				</TR>
514a8e07101SRui Paulo				<TR><TD VALIGN=TOP ALIGN=RIGHT>length</TD>
515a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
516a8e07101SRui Paulo					<TD VALIGN=TOP>The number of octets in the broadcast address field that follows.</TD>
517a8e07101SRui Paulo				</TR>
518a8e07101SRui Paulo				<TR><TD VALIGN=TOP ALIGN=LEFT>Broadcast Address</TD>
519a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>0-255</TD>
520a8e07101SRui Paulo					<TD VALIGN=TOP>The broadcast address of this interface (if applicable) (in network neutral order).</TD>
521a8e07101SRui Paulo				</TR>
522a8e07101SRui Paulo				<TR><TD VALIGN=TOP ALIGN=RIGHT>length</TD>
523a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
524a8e07101SRui Paulo					<TD VALIGN=TOP>The number of octets in the destination address field that follows.</TD>
525a8e07101SRui Paulo				</TR>
526a8e07101SRui Paulo				<TR><TD VALIGN=TOP ALIGN=LEFT>Destination Address</TD>
527a8e07101SRui Paulo					<TD VALIGN=TOP ALIGN=CENTER>0-255</TD>
528a8e07101SRui Paulo					<TD VALIGN=TOP>The destination address of this interface (if applicable) (in network neutral order).</TD>
529a8e07101SRui Paulo				</TR>
530a8e07101SRui Paulo				</TABLE>
531a8e07101SRui Paulo		</TR>
532a8e07101SRui Paulo		<TR>
533a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
534a8e07101SRui Paulo			<TD VALIGN=TOP>Close the socket.</TD>
535a8e07101SRui Paulo		</TR>
536a8e07101SRui Paulo		<TR>
537a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD>
538a8e07101SRui Paulo			<TD VALIGN=TOP>Close the socket.</TD>
539a8e07101SRui Paulo		</TR>
540a8e07101SRui Paulo		<TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR>
541a8e07101SRui Paulo		<TR>
542a8e07101SRui Paulo			<TD VALIGN=TOP ROWSPAN=2>pcap_open_live()</TD>
543a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
544a8e07101SRui Paulo			<TD VALIGN=TOP>Open socket, and sends:
545a8e07101SRui Paulo				<P>
546a8e07101SRui Paulo				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
547a8e07101SRui Paulo					<TR>
548a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
549a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
550a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
551a8e07101SRui Paulo					</TR>
552a8e07101SRui Paulo					<TR>
553a8e07101SRui Paulo						<TD VALIGN=TOP>Interface ID</TD>
554a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>'n'</TD>
555a8e07101SRui Paulo						<TD VALIGN=TOP>'n' octets containing a NULL terminated interface name string.</TD>
556a8e07101SRui Paulo					</TR>
557a8e07101SRui Paulo				</TABLE>
558a8e07101SRui Paulo			</TD>
559a8e07101SRui Paulo		</TR>
560a8e07101SRui Paulo		<TR>
561a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD>
562a8e07101SRui Paulo			<TD VALIGN=TOP>Send its NULL terminated error response string.</TD>
563a8e07101SRui Paulo		</TR>
564a8e07101SRui Paulo		<TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR>
565a8e07101SRui Paulo		<TR>
566a8e07101SRui Paulo			<TD VALIGN=TOP NOWRAP ROWSPAN=2>pcap_dispatch()<BR>pcap_loop()<BR>pcap_next()<BR>pcap_next_ex()</TD>
567a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
568a8e07101SRui Paulo			<TD VALIGN=TOP>On the first invocation following a pcap_open_live() or pcap_breakloop() additional information is sent:
569a8e07101SRui Paulo				<P>
570a8e07101SRui Paulo				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
571a8e07101SRui Paulo					<TR>
572a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
573a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
574a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
575a8e07101SRui Paulo					</TR>
576a8e07101SRui Paulo					<TR>
577a8e07101SRui Paulo						<TD VALIGN=TOP>command</TD>
578a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
579a8e07101SRui Paulo						<TD VALIGN=TOP>'M' (indicating 'monitor start')</TD>
580a8e07101SRui Paulo					</TR>
581a8e07101SRui Paulo					<TR>
582a8e07101SRui Paulo						<TD VALIGN=TOP>snaplen</TD>
583a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>4</TD>
584a8e07101SRui Paulo						<TD VALIGN=TOP>snaplen</TD>
585a8e07101SRui Paulo					</TR>
586a8e07101SRui Paulo					<TR>
587a8e07101SRui Paulo						<TD VALIGN=TOP>timeout</TD>
588a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
589a8e07101SRui Paulo						<TD VALIGN=TOP>timeout value (in milliseconds)</TD>
590a8e07101SRui Paulo					</TR>
591a8e07101SRui Paulo					<TR>
592a8e07101SRui Paulo						<TD VALIGN=TOP>promiscuous</TD>
593a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
594a8e07101SRui Paulo						<TD VALIGN=TOP>A flag indicating that the interface being monitored show operate
595a8e07101SRui Paulo							in promiscuous mode. [off(0) / on(NZ)]</TD>
596a8e07101SRui Paulo					</TR>
597a8e07101SRui Paulo					<TR>
598a8e07101SRui Paulo						<TD VALIGN=TOP>direction</TD>
599a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
600*afdbf109SJoseph Mingrone						<TD VALIGN=TOP>A flag indicating the direction of traffic that should be captured [both(0) / in(1) / out(2)]</TD>
601a8e07101SRui Paulo					</TR>
602a8e07101SRui Paulo				</TABLE>
603a8e07101SRui Paulo			</TD>
604a8e07101SRui Paulo		</TR>
605a8e07101SRui Paulo		<TR>
606a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD>
607a8e07101SRui Paulo			<TD VALIGN=TOP>Sends captured packets.</TD>
608a8e07101SRui Paulo		</TR>
609a8e07101SRui Paulo		<TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR>
610a8e07101SRui Paulo		<TR>
611a8e07101SRui Paulo			<TD VALIGN=TOP ROWSPAN=2>pcap_setfilter()</TD>
612a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
613a8e07101SRui Paulo			<TD VALIGN=TOP>At any time, the SMP can issue a set filter command which contains
614a8e07101SRui Paulo							an indicator, a count of the number of statements in the filter,
615a8e07101SRui Paulo							followed by the sequence of filter commands represented as a sequence
616a8e07101SRui Paulo							of C-style structures.
617a8e07101SRui Paulo				<P>
618a8e07101SRui Paulo				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
619a8e07101SRui Paulo					<TR>
620a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
621a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
622a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
623a8e07101SRui Paulo					</TR>
624a8e07101SRui Paulo					<TR>
625a8e07101SRui Paulo						<TD VALIGN=TOP>command</TD>
626a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
627a8e07101SRui Paulo						<TD VALIGN=TOP>'F' (indicating 'filter')</TD>
628a8e07101SRui Paulo					</TR>
629a8e07101SRui Paulo					<TR>
630a8e07101SRui Paulo						<TD VALIGN=TOP>count</TD>
631a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>4</TD>
632a8e07101SRui Paulo						<TD VALIGN=TOP>The number of command in the Berkeley Packet Filter that follow.</TD>
633a8e07101SRui Paulo					</TR>
634a8e07101SRui Paulo					<TR>
635a8e07101SRui Paulo						<TD VALIGN=TOP>BPF program</TD>
636a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>'n'</TD>
637a8e07101SRui Paulo						<TD VALIGN=TOP>8 bytes of each command (repeated 'n' times).<BR>
638a8e07101SRui Paulo									Each command consists of that C-style structure which contains:
639a8e07101SRui Paulo							<P>
640a8e07101SRui Paulo							<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
641a8e07101SRui Paulo								<TR>
642a8e07101SRui Paulo								<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
643a8e07101SRui Paulo								<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
644a8e07101SRui Paulo								<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
645a8e07101SRui Paulo								</TR>
646a8e07101SRui Paulo								<TR>
647a8e07101SRui Paulo									<TD VALIGN=TOP>opcode</TD>
648a8e07101SRui Paulo									<TD VALIGN=TOP ALIGN=CENTER>2</TD>
649a8e07101SRui Paulo									<TD VALIGN=TOP>The command's opcode.</TD>
650a8e07101SRui Paulo								</TR>
651a8e07101SRui Paulo								<TR>
652a8e07101SRui Paulo									<TD VALIGN=TOP>'jt'</TD>
653a8e07101SRui Paulo									<TD VALIGN=TOP ALIGN=CENTER>1</TD>
654a8e07101SRui Paulo									<TD VALIGN=TOP>The 'jump if true' program counter offset.</TD>
655a8e07101SRui Paulo								</TR>
656a8e07101SRui Paulo								<TR>
657a8e07101SRui Paulo									<TD VALIGN=TOP>'jf'</TD>
658a8e07101SRui Paulo									<TD VALIGN=TOP ALIGN=CENTER>1</TD>
659a8e07101SRui Paulo									<TD VALIGN=TOP>The 'jump if false' program counter offset.</TD>
660a8e07101SRui Paulo								</TR>
661a8e07101SRui Paulo								<TR>
662a8e07101SRui Paulo									<TD VALIGN=TOP>'k'</TD>
663a8e07101SRui Paulo									<TD VALIGN=TOP ALIGN=CENTER>4</TD>
664a8e07101SRui Paulo									<TD VALIGN=TOP>The 'other' data field.</TD>
665a8e07101SRui Paulo								</TR>
666a8e07101SRui Paulo							</TABLE>
667a8e07101SRui Paulo							<P>
668a8e07101SRui Paulo							Refer to the bpf(4) man page for more details.
669a8e07101SRui Paulo						</TD>
670a8e07101SRui Paulo					</TR>
671a8e07101SRui Paulo				</TABLE>
672a8e07101SRui Paulo			</TD>
673a8e07101SRui Paulo		</TR>
674a8e07101SRui Paulo		<TR>
675a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD>
676a8e07101SRui Paulo			<TD VALIGN=TOP>In return the IOP will send its (possibly empty) NULL terminated error response string.</TD>
677a8e07101SRui Paulo		</TR>
678a8e07101SRui Paulo		<TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR>
679a8e07101SRui Paulo		<TR>
680a8e07101SRui Paulo			<TD VALIGN=TOP ROWSPAN=2>pcap_stats()</TD>
681a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
682a8e07101SRui Paulo			<TD VALIGN=TOP>At any time, the SMP can issue a 'retrieve statistics' command which contains:<BR>
683a8e07101SRui Paulo				<P>
684a8e07101SRui Paulo				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
685a8e07101SRui Paulo					<TR>
686a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
687a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
688a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
689a8e07101SRui Paulo					</TR>
690a8e07101SRui Paulo					<TR>
691a8e07101SRui Paulo						<TD VALIGN=TOP>command</TD>
692a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
693a8e07101SRui Paulo						<TD VALIGN=TOP>'S' (indicating 'request statistics')</TD>
694a8e07101SRui Paulo					</TR>
695a8e07101SRui Paulo				</TABLE>
696a8e07101SRui Paulo			</TD>
697a8e07101SRui Paulo		</TR>
698a8e07101SRui Paulo		<TR>
699a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD>
700a8e07101SRui Paulo			<TD VALIGN=TOP>In return the IOP will send:
701a8e07101SRui Paulo				<P>
702a8e07101SRui Paulo				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
703a8e07101SRui Paulo					<TR>
704a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
705a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
706a8e07101SRui Paulo					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
707a8e07101SRui Paulo					</TR>
708a8e07101SRui Paulo					<TR>
709a8e07101SRui Paulo						<TD VALIGN=TOP>ps_recv</TD>
710a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>4</TD>
711a8e07101SRui Paulo						<TD VALIGN=TOP>The number of packets that passed the filter.</TD>
712a8e07101SRui Paulo					</TR>
713a8e07101SRui Paulo					<TR>
714a8e07101SRui Paulo						<TD VALIGN=TOP>ps_drop</TD>
715a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>4</TD>
716a8e07101SRui Paulo						<TD VALIGN=TOP>The number of packets that were dropped because the input queue was full,
717a8e07101SRui Paulo							regardless of whether they passed the filter.</TD>
718a8e07101SRui Paulo					</TR>
719a8e07101SRui Paulo					<TR>
720a8e07101SRui Paulo						<TD VALIGN=TOP>ps_ifdrop</TD>
721a8e07101SRui Paulo						<TD VALIGN=TOP ALIGN=CENTER>4</TD>
7226f9cba8fSJoseph Mingrone						<TD VALIGN=TOP>The number of packets dropped by the network interface
723a8e07101SRui Paulo							(regardless of whether they would have passed the input filter).</TD>
724a8e07101SRui Paulo					</TR>
725a8e07101SRui Paulo				</TABLE>
726a8e07101SRui Paulo			</TD>
727a8e07101SRui Paulo		</TR>
728a8e07101SRui Paulo		<TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR>
729a8e07101SRui Paulo		<TR>
730a8e07101SRui Paulo			<TD VALIGN=TOP ROWSPAN=1>pcap_close()</TD>
731a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
732a8e07101SRui Paulo			<TD VALIGN=TOP>At any time, the SMP can close the TCP session with the IOP.</TD>
733a8e07101SRui Paulo		</TR>
734a8e07101SRui Paulo		<TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR>
735a8e07101SRui Paulo	</TABLE>
736a8e07101SRui Paulo</UL>
737a8e07101SRui Paulo
738a8e07101SRui Paulo<H3>Interface ID Naming Convention</H3>
739a8e07101SRui Paulo<UL>
740a8e07101SRui Paulo	Each interface within an IOP will be referred to uniquely.  Since an currently contains
741a8e07101SRui Paulo	8 monitorable WAN ports and a monitorable Ethernet port, the naming convention is:
742a8e07101SRui Paulo	<P>
743a8e07101SRui Paulo	<CENTER>
744a8e07101SRui Paulo	<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
745a8e07101SRui Paulo		<TR><TH>Interface #</TH>		<TH>Type</TH>					<TH>Name</TH></TR>
746a8e07101SRui Paulo		<TR><TD ALIGN=CENTER>1</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan0</TD></TR>
747a8e07101SRui Paulo		<TR><TD ALIGN=CENTER>2</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan1</TD></TR>
748a8e07101SRui Paulo		<TR><TD ALIGN=CENTER>3</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan2</TD></TR>
749a8e07101SRui Paulo		<TR><TD ALIGN=CENTER>4</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan3</TD></TR>
750a8e07101SRui Paulo		<TR><TD ALIGN=CENTER>5</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan4</TD></TR>
751a8e07101SRui Paulo		<TR><TD ALIGN=CENTER>6</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan5</TD></TR>
752a8e07101SRui Paulo		<TR><TD ALIGN=CENTER>7</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan6</TD></TR>
753a8e07101SRui Paulo		<TR><TD ALIGN=CENTER>8</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan7</TD></TR>
754a8e07101SRui Paulo		<TR><TD ALIGN=CENTER>9</TD>		<TD ALIGN=CENTER>Ethernet</TD>	<TD ALIGN=CENTER>eth0</TD></TR>
755a8e07101SRui Paulo		<TR><TD ALIGN=CENTER>10</TD>	<TD ALIGN=CENTER>Ethernet</TD>	<TD ALIGN=CENTER>eth1</TD></TR>
756a8e07101SRui Paulo	</TABLE>
757a8e07101SRui Paulo	</CENTER>
758a8e07101SRui Paulo</UL>
759a8e07101SRui Paulo
760a8e07101SRui Paulo<H3>Packet Trace Data Format</H3>
761a8e07101SRui Paulo<UL>
762a8e07101SRui Paulo	The format of the trace data that is sent to the SMP follows a portion of the libpcap file format
763a8e07101SRui Paulo	and is summarized here.  This format specifies the generic requirements needed to
764a8e07101SRui Paulo	be able to decode packets, but does not cover ACN specifics such as custom MAC addressing
765a8e07101SRui Paulo	and WAN protocol support.
766a8e07101SRui Paulo	<P>
767a8e07101SRui Paulo
768a8e07101SRui Paulo	Although a libpcap file begins with a global header followed by zero or
769a8e07101SRui Paulo	more records for each captured packet, trace data sent to the SMP does NOT begin with a global header.
770a8e07101SRui Paulo	A trace sequence looks like this:
771a8e07101SRui Paulo	<P>
772a8e07101SRui Paulo	<TABLE>
773a8e07101SRui Paulo		<TR>
774a8e07101SRui Paulo			<TD STYLE="background-color: #c0FFc0">&nbsp;[Packet Header]&nbsp;</TD>
775a8e07101SRui Paulo			<TD STYLE="background-color: #c0FFc0">&nbsp;[Packet Data]&nbsp;</TD>
776a8e07101SRui Paulo			<TD STYLE="background-color: #c0c0FF">&nbsp;[Packet Header]&nbsp;</TD>
777a8e07101SRui Paulo			<TD STYLE="background-color: #c0c0FF">&nbsp;[Packet Data]&nbsp;</TD>
778a8e07101SRui Paulo			<TD STYLE="background-color: #e0c0c0">&nbsp;[Packet Header]&nbsp;</TD>
779a8e07101SRui Paulo			<TD STYLE="background-color: #e0c0c0">&nbsp;[Packet Data]&nbsp;</TD>
780a8e07101SRui Paulo			<TD>...</TD>
781a8e07101SRui Paulo		</TR>
782a8e07101SRui Paulo	</TABLE>
783a8e07101SRui Paulo
784a8e07101SRui Paulo<H4>Packet Header</H4>
785a8e07101SRui Paulo	<UL>
786a8e07101SRui Paulo		Each captured packet starts with a header that contains the following values
787a8e07101SRui Paulo		(in network neutral order):
788a8e07101SRui Paulo
789a8e07101SRui Paulo		<FONT SIZE=-1>
790a8e07101SRui Paulo		<PRE>
791a8e07101SRui Paulo uint32 tv_sec;  /* timestamp seconds */
792a8e07101SRui Paulo uint32 tv_usec; /* timestamp microseconds */
793a8e07101SRui Paulo uint32 caplen;  /* number of octets in the following packet */
794a8e07101SRui Paulo uint32 len;     /* original length of packet on the wire */
795a8e07101SRui Paulo		</PRE>
796a8e07101SRui Paulo		</FONT>
797a8e07101SRui Paulo
798a8e07101SRui Paulo		<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
799a8e07101SRui Paulo			<TR>
800a8e07101SRui Paulo				<TD VALIGN=TOP>tv_sec</TD>
801a8e07101SRui Paulo				<TD>The date and time when this packet was captured.
802a8e07101SRui Paulo					This value is in seconds since January 1, 1970 00:00:00 GMT;
803a8e07101SRui Paulo					this is also known as a UN*X time_t. You can use the ANSI C
804a8e07101SRui Paulo					<em>time()</em> function from <em>time.h</em> to get this value,
805a8e07101SRui Paulo					but you might use a more optimized way to get this timestamp value.
806a8e07101SRui Paulo			</TR>
807a8e07101SRui Paulo			<TR>
808a8e07101SRui Paulo				<TD VALIGN=TOP>tv_usec</TD>
809a8e07101SRui Paulo				<TD>The microseconds when this packet was captured, as an offset to <em>ts_sec</em>.
810a8e07101SRui Paulo					<B>Beware: </B>this value must never reach 1 second (1,000,000),
811a8e07101SRui Paulo					in this case <em>ts_sec</em> must be increased instead!</TD>
812a8e07101SRui Paulo			</TR>
813a8e07101SRui Paulo			<TR>
814a8e07101SRui Paulo				<TD VALIGN=TOP>caplen</TD>
815a8e07101SRui Paulo				<TD>The number of bytes actually provided in the capture record.
816a8e07101SRui Paulo					This value should never become larger than <em>len</em> or the
817a8e07101SRui Paulo					<em>snaplen</em> value specified during the capture.</TD>
818a8e07101SRui Paulo			</TR>
819a8e07101SRui Paulo			<TR>
820a8e07101SRui Paulo				<TD VALIGN=TOP>len</TD>
821a8e07101SRui Paulo				<TD>The length of the packet "on the wire" when it was captured.
822a8e07101SRui Paulo					If <em>caplen</em> and <em>len</em> differ, the actually
823a8e07101SRui Paulo					saved packet size was limited by the value of <em>snaplen</em> specified
824a8e07101SRui Paulo					during one of the capture directives such as pcap_dispatch().</TD>
825a8e07101SRui Paulo			</TR>
826a8e07101SRui Paulo		</TABLE>
827a8e07101SRui Paulo	</UL>
828a8e07101SRui Paulo
829a8e07101SRui Paulo<H4>Packet Data</H4>
830a8e07101SRui Paulo	<UL>
831a8e07101SRui Paulo	The actual packet data will immediately follow the packet header as a sequence of <em>caplen</em> octets.
832a8e07101SRui Paulo	Depending on the DLT encoding number assigned to the interface, the packet data will contain an additional
833a8e07101SRui Paulo	custom header used to convey WAN port related information.
834a8e07101SRui Paulo	</UL>
835a8e07101SRui Paulo
836a8e07101SRui Paulo<H4>ACN Custom Packet Header</H4>
837a8e07101SRui Paulo	<UL>
838a8e07101SRui Paulo	PCAP, Wireshark and Tcpdump enhancements have been added to the ACN to support
839a8e07101SRui Paulo	monitoring of its ports, however each of these facilities were focused on capturing
8406f9cba8fSJoseph Mingrone	and displaying traffic from LAN interfaces.  The SITA extensions to these facilities
841a8e07101SRui Paulo	are used to also provide the ability to capture, filter, and display information from
842a8e07101SRui Paulo	an ACN's WAN ports.
843a8e07101SRui Paulo	<P>
844a8e07101SRui Paulo	Although each packet follows the standard libpcap format, since there are
845a8e07101SRui Paulo	two types of interfaces that can be monitored, the format of the data
846a8e07101SRui Paulo	packet varies slightly.
847a8e07101SRui Paulo	<P>
848a8e07101SRui Paulo	<UL TYPE=DISC>
849a8e07101SRui Paulo		<LI>For Ethernet (like) devices, the packet format is unchanged from the standard Pcap format.
8506f9cba8fSJoseph Mingrone		<LI>For WAN devices, the packet contains a 5 byte header that precedes the actual captured data
851a8e07101SRui Paulo			described by the following table:
852a8e07101SRui Paulo	</UL>
853a8e07101SRui Paulo	<P>
854a8e07101SRui Paulo	<CENTER>
855a8e07101SRui Paulo	<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
856a8e07101SRui Paulo	<TR>	<TH>Octet</TH>
857a8e07101SRui Paulo			<TH>Name</TH>
858a8e07101SRui Paulo			<TH>Mask/Value</TH>
859a8e07101SRui Paulo			<TH COLSPAN=2>Definition</TH>		</TR>
860a8e07101SRui Paulo
861a8e07101SRui Paulo	<TR>	<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=3>0</TH>
862a8e07101SRui Paulo			<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=3>Control / Status</TH>
863a8e07101SRui Paulo
864a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx0</FONT></TD>
865a8e07101SRui Paulo			<TD>Transmitted by capture device</TD>
866a8e07101SRui Paulo			<TD ROWSPAN=2 ALIGN=CENTER>(see 'Errors' octets)</TD>							</TR>
867a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx1</FONT></TD>
868a8e07101SRui Paulo			<TD>Received by capture device</TD>												</TR>
869a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">1xxxxxxx</FONT></TD>
870a8e07101SRui Paulo			<TD COLSPAN=2>No buffer was available during capture of previous packet.</TD>	</TR>
871a8e07101SRui Paulo
872a8e07101SRui Paulo	<TR>	<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=8>1</TH>
873a8e07101SRui Paulo			<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=8>Signals</TH>
874a8e07101SRui Paulo
875a8e07101SRui Paulo			<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx1</FONT></TD>	<TD COLSPAN=2>DSR asserted</TD>		</TR>
876a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxx1x</FONT></TD>	<TD COLSPAN=2>DTR asserted</TD>		</TR>
877a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxx1xx</FONT></TD>	<TD COLSPAN=2>CTS asserted</TD>		</TR>
878a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxx1xxx</FONT></TD>	<TD COLSPAN=2>RTS asserted</TD>		</TR>
879a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxx1xxxx</FONT></TD>	<TD COLSPAN=2>DCD asserted</TD>		</TR>
880a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xx1xxxxx</FONT></TD>	<TD COLSPAN=2>Undefined</TD>		</TR>
881a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">x1xxxxxx</FONT></TD>	<TD COLSPAN=2>Undefined</TD>		</TR>
882a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">1xxxxxxx</FONT></TD>	<TD COLSPAN=2>Undefined</TD>		</TR>
883a8e07101SRui Paulo
884a8e07101SRui Paulo	<TR>	<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=9>2</TH>
885a8e07101SRui Paulo			<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=9>Errors<BR>(octet 1)</TH>
886a8e07101SRui Paulo
887a8e07101SRui Paulo			<TH>&nbsp;</TH>															<TH>Tx</TH>						<TH>Rx</TH>				</TR>
888a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx1</FONT></TD>	<TD>Underrun</TD>				<TD>Framing</TD>		</TR>
889a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxx1x</FONT></TD>	<TD>CTS Lost</TD>				<TD>Parity</TD>			</TR>
890a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxx1xx</FONT></TD>	<TD>UART Error</TD>				<TD>Collision</TD>		</TR>
891a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxx1xxx</FONT></TD>	<TD>Re-Tx Limit Reached</TD>	<TD>Long Frame</TD>		</TR>
892a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxx1xxxx</FONT></TD>	<TD>Undefined</TD>				<TD>Short Frame</TD>	</TR>
893a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xx1xxxxx</FONT></TD>	<TD>Undefined</TD>				<TD>Undefined</TD>		</TR>
894a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">x1xxxxxx</FONT></TD>	<TD>Undefined</TD>				<TD>Undefined</TD>		</TR>
895a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">1xxxxxxx</FONT></TD>	<TD>Undefined</TD>				<TD>Undefined</TD>		</TR>
896a8e07101SRui Paulo
897a8e07101SRui Paulo	<TR>	<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=9>3</TH>
898a8e07101SRui Paulo			<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=9>Errors<BR>(octet 2)</TH>
899a8e07101SRui Paulo
900a8e07101SRui Paulo			<TH>&nbsp;</TH>															<TH>Tx</TH>			<TH>Rx</TH>						</TR>
901a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx1</FONT></TD>	<TD>Undefined</TD>	<TD>Non-Octet Aligned</TD>		</TR>
902a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxx1x</FONT></TD>	<TD>Undefined</TD>	<TD>Abort Received</TD>			</TR>
903a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxx1xx</FONT></TD>	<TD>Undefined</TD>	<TD>CD Lost</TD>				</TR>
904a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxx1xxx</FONT></TD>	<TD>Undefined</TD>	<TD>Digital PLL Error</TD>		</TR>
905a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxx1xxxx</FONT></TD>	<TD>Undefined</TD>	<TD>Overrun</TD>				</TR>
906a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xx1xxxxx</FONT></TD>	<TD>Undefined</TD>	<TD>Frame Length Violation</TD>	</TR>
907a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">x1xxxxxx</FONT></TD>	<TD>Undefined</TD>	<TD>CRC Error</TD>				</TR>
908a8e07101SRui Paulo	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">1xxxxxxx</FONT></TD>	<TD>Undefined</TD>	<TD>Break Received</TD>			</TR>
909a8e07101SRui Paulo
910a8e07101SRui Paulo	<TR>	<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=12>4</TH>
911a8e07101SRui Paulo			<TH VALIGN=TOP ALIGN=CENTER>Protocol</TH>
912a8e07101SRui Paulo
913a8e07101SRui Paulo			<TD COLSPAN=3>
914a8e07101SRui Paulo				<CENTER>
915a8e07101SRui Paulo				<TABLE BORDER=0 CELLPADDING=0 CELLSPACING=0>
916a8e07101SRui Paulo					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x01</TD>	<TD>-</TD>	<TD>LAPB (BOP)				<SUP>&nbsp;</SUP>	</TD>	</TR>
917a8e07101SRui Paulo					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x02</TD>	<TD>-</TD>	<TD>Ethernet				<SUP>1</SUP>		</TD>	</TR>
918a8e07101SRui Paulo					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x03</TD>	<TD>-</TD>	<TD>Async (Interrupt IO)	<SUP>&nbsp;</SUP>	</TD>	</TR>
919a8e07101SRui Paulo					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x04</TD>	<TD>-</TD>	<TD>Async (Block IO)		<SUP>&nbsp;</SUP>	</TD>	</TR>
920a8e07101SRui Paulo					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x05</TD>	<TD>-</TD>	<TD>IPARS					<SUP>&nbsp;</SUP>	</TD>	</TR>
921a8e07101SRui Paulo					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x06</TD>	<TD>-</TD>	<TD>UTS						<SUP>&nbsp;</SUP>	</TD>	</TR>
922a8e07101SRui Paulo					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x07</TD>	<TD>-</TD>	<TD>PPP (HDLC)				<SUP>&nbsp;</SUP>	</TD>	</TR>
923a8e07101SRui Paulo					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x08</TD>	<TD>-</TD>	<TD>SDLC					<SUP>&nbsp;</SUP>	</TD>	</TR>
924a8e07101SRui Paulo					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x09</TD>	<TD>-</TD>	<TD>Token Ring				<SUP>1</SUP>		</TD>	</TR>
925a8e07101SRui Paulo					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x10</TD>	<TD>-</TD>	<TD>I2C						<SUP>&nbsp;</SUP>	</TD>	</TR>
926a8e07101SRui Paulo					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x11</TD>	<TD>-</TD>	<TD>DPM Link				<SUP>&nbsp;</SUP>	</TD>	</TR>
927a8e07101SRui Paulo					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x12</TD>	<TD>-</TD>	<TD>Frame Relay (BOP)		<SUP>&nbsp;</SUP>	</TD>	</TR>
928a8e07101SRui Paulo				</TABLE>
929a8e07101SRui Paulo				</CENTER>
930a8e07101SRui Paulo				<P>
931a8e07101SRui Paulo				<STRONG>Note 1:</STRONG>
932a8e07101SRui Paulo				Ethernet and Token Ring frames will never be sent as DLT_SITA (with the 5 octet header),
933a8e07101SRui Paulo				but will be sent as their corresponding DLT types instead.
934a8e07101SRui Paulo			</TD>
935a8e07101SRui Paulo	</TR>
936a8e07101SRui Paulo	</TABLE>
937a8e07101SRui Paulo	</CENTER>
938a8e07101SRui Paulo</UL>
939a8e07101SRui Paulo<P>
940a8e07101SRui Paulo</UL>
941a8e07101SRui Paulo</UL>
942