Endace DAG 5.2X, User Manual

Page: 42 / 66

EDM01-33v1 DAG_7.5G4_Card_User_Guide
38 ©2008 Endace Technology Ltd. Confidential - Version 1 - November 2008
Using third party applications
Once the captured data is in Pcap format you can use third party applications to examine and
process the data. The third party applications include:
•
Wireshark /Tshark (formerly Ethereal /Tethereal)
• TCPDump
• Libpcap
•
SNORT
•
Winpcap, etc.
Note: Wireshark can also read ERF formatted data.
Configuring DSM
If you wish to perform packet filtering on the data you are capturing you can do so using the
Data Stream Manager (DSM) function described in Extended Functions 6 (page ) earlier in
this user guide.
By default the DSM Lookup Table, is empty and does not contain any entries. This means it
will have no effect on packets as they pass through the DSM Coloriser and Drop (CAD)
block.
To configure DSM filtering and populate the DSM Lookup Table you must pass an XML file
containing filtering instructions to the DSM filter table using:
dsm_loader -d0 -f <filter_filename>
If you have configured DSM filtering but want to revert to normal capture mode, you will
need to bypass DSM filtering to the original null configuration using:
dsm_loader -d0 -b
For detailed information on configuring the DSM including the format of the XML file, please
refer to
EDM04-07 dsm-loader User Guide
and
EDM04-10 Data Stream Management API
Programming Guide . These documents are available from the support section of the Endace
website at http://www.endace.com
Transmitting captured data
.
Configuration
The DAG 7.5G4 card is able to transmit as well as receive packets and can capture received
traffic while transmitting. This allows you to use capture tools such as
dagsnap
,
dagconvert
,
and
dagbits
while
dagflood
is sending packets.
To configure the DAG 7.5G4 card for transmission, you must allocate some memory to a
transmit stream. By default, 16 MB of memory is allocated to the tx stream and the remainder
is allocated to the rx stream. For information on setting the Memory allocation see mem
23 (page ).
Note: You can not change the stream memory allocations while packet capture or
transmission is in progress.