Endace DAG 4.5G2 Card, Руководство пользователя

Страница: 39 / 46

EDM 01-18 DAG 4.5G2/G4/GF Card User Guide
Chapter 6:
Data Formats
Overview
DAG Cards produce trace files in their own native format called ERF
(Extensible Record Format). The ERF type depends upon the type of
connection you are using to capture data.
The DAG 4.5 supports the following ERF Types:
ERF
Type
Description
2
TYPE_ETH
Ethernet Variable Length Record
16
TYPE_DSM_COLOR_ETH
Ethernet Variable Length Record
The ERF file contains a series of ERF records with each record describing
one packet. An ERF file consists only of ERF records, there is no special file
header which allows concatenation and splitting to be performed arbitrarily
on ERF record boundaries.
Generic
Header
All ERF records share some common fields. Timestamps are in little-endian
(Pentium native) byte order. All other fields are in big-endian (network) byte
order. All payload data is captured as a byte stream, no byte or-ordering is
applied.
The generic ERF header is shown below:
Byte 3 Byte 2 Byte 1 Byte 0
timestamp
timestamp
type flags rlen
lctr/color wlen
(rlen - 16) bytes of record
©2005-2006 33 Version 4: August 2006