Endace DAG 3.6D, User Manual

Page: 24 / 38

EDM01-14 DAG 3.6D Card User Guide
©2005 19 Version 10: May 2006
4.1 Starting Capture Session
, continued
Process
, continued
Process Description
Stopping
dagsnap
By default
dagsnap
will run forever.
dagsnap
can be stopped with a signal:
killall dagsnap
dagsnap
can also be configured to run for a
fixed number of seconds and then exit.
4.2 High Load Performance
Description As the DAG 3.6D card captures packets from the network link, it writes a
record for each packet into a large buffer in the host PC’s main memory.
Avoiding
packet loss
In order to avoid packet loss, the user application reading the record, such
as
dagsnap
, must be able to read records out of the buffer faster than they
arrive, otherwise the buffer eventually fills, and packet records are lost.
When the PC buffer fills, the message:
kernel: dagN: pbm safety net reached 0xNNNNNNNN
is displayed on the PC screen, and printed to log
/var/log/messages
.
The “Data capture” LED also goes out. This may be visibly indicated as
flashing or flickering.
Reading records
In order to avoid any potential packet loss, the user process must read
records faster than they arrive from the network.
If the user process is writing records to hard disk, it may be necessary to
use a faster disk or disk array. If records are being processed in real-time, a
faster host CPU may be required.
Detecting
packet losses
Until some data is read out of the buffer to free some space, any arriving
packets subsequently are discarded by the DAG card. Any loss is detected
in-band by observing the Loss Counter
lctr
field of the Extensible
Record Format [ERF]. The Endace ERF is detailed in Chapter 7 of this
document.
Continued on next page