Endace DAG 3.7D, User Manual

Page: 31 / 33

EDM01-06: DAG 3.7D Card User Guide
©2006 25 Version 1: March 2006
Chapter 6:
Data Formats
Overview The DAG card produces trace files in the Endace Extensible Record
Format (ERF). The ERF consists of a series records. Each record describes
one packet.
An ERF file consists only of ERF records. There is no special file header.
This allows concatenation and splitting to be performed arbitrarily on ERF
record boundaries.
Generic
Header
All ERF records share some common fields. Timestamps are in little-
endian [Pentium native] byte order. All other fields are in big-endian
[network] byte order. All payload data is captured as a byte stream, no byte
re-ordering is applied.
The generic ERF header is shown below.
timestamp
timestamp
type flags rlen
lctr wlen
(rlen - 16) bytes of record
timestamp The time of arrival of the cell, an ERF 64-bit timestamp.
type
1: TYPE_HDLC_POS
(PoS w/HDLC framing), or
3: TYPE_ATM
(ATM cell) .
flags This byte is divided into 2 parts, the interface identifier and
the capture offset.
rlen Record length. Total length of the record transferred over
PCI bus to storage.
lctr Loss counter. A 16 bit counter recording the number of
packets lost since the previous record. Records can be lost
between the DAG card and memory hole due to
overloading on the PCI bus. The counter starts at 0 and
sticks as 0xffff.
wlen
Wire length. Packet length including some protocol
overhead. The exact interpretation of this quantity depends
on physical medium.
offset Number of bytes not captured form start of frame.
Typically used to skip link layer headers when not required
to save bandwidth and space. This is not currently
implemented, contents can be disregarded.