Endace DAG 7.1S, User Manual

Page: 45 / 51

EDM 01-17 DAG 7.1S Card User Guide
Chapter 6:
Data Formats
Overview
DAG Cards produce trace files in their own native format called ERF
(Extensible Record Format). The ERF type depends upon the type of
connection you are using to capture data.
The DAG 7.1S supports the following ERF Types:
ERF Type Description
1
TYPE_HDLC_POS
PoS with HDLC Framing
3
TYPE_ATM
ATM Cell
TYPE_AAAL5
Reassembled AAL5 Frame
4
5
TYPE_MC_HDLC:
Multi-channel HDLC Frame Record
7
TYPE_MC_ATM
Multi-Channel ATM Cell Record
9
TYPE_MC-AAL5
Multi Channel AAL5 Frame Record
TYPE_MC-AAL2
Multi Channel AAL2 Frame Record
12
TYPE_AAL2
Reassembled AAL2 Frame
18
The ERF file contains a series of ERF records with each record describing
one packet.An ERF file consists only of ERF records, there is no special file
header which allows concatenation and splitting to be performed arbitrarily
on ERF record boundaries.
Generic
Header
All ERF records share some common fields. Timestamps are in little-endian
(Pentium native) byte order. All other fields are in big-endian [network] byte
order. All payload data is captured as a byte stream, no byte re-ordering is
applied.
The generic ERF header for concatenated (clear) links is shown below.
Byte 3 Byte 2 Byte 1 Byte 0
timestamp
timestamp
type flags rlen
lctr wlen
(rlen - 16) bytes of record
©2006 39 Version 2: May 2006