Endace DAG 5.2X, Руководство пользователя

Страница: 58 / 66

EDM01-33v1 DAG_7.5G4_Card_User_Guide
54 ©2008 Endace Technology Ltd. Confidential - Version 1 - November 2008
Generic ERF Header
All ERF records share some common fields. Timestamps are in little-endian (Pentium
®
native)
byte order. All other fields are in big-endian (network) byte order. All payload data is
captured as a byte stream in network order, no byte or re-ordering is applied.
The generic ERF header is shown below:
The fields are described below:
timestamp The time of arrival of the cell, an ERF 64-bit timestamp.
type Bit 7 Extension header present.
Bit 6:0 Extension header type. See table below:
flags This byte is divided into several fields as follows:
Bits Description
1-0: Binary enumeration of capture interface:
11
Interface 3 or D
10 Interface 2 or C
01 Interface 1 or B
00 Interface 0 or A
Cards with more than four interfaces typically use Multichannel ERF types
(type 5 to 9, 12 and 17) which provide a separate larger interface field.
2: Varying length record. When set, packets shorter than the snap length are not
padded and rlen resembles wlen.
When clear, longer packets are snapped off at snap length and shorter packets
are padded up to the snap length. rlen resembles snap length. Setting novarlen
and slen greater than 256 bytes is wasteful of bandwidth
3: Truncated record - insufficient buffer space.
•
wlen
is still correct for the packet on the wire.
•
rlen
is still correct for the resulting record. But, rlen is shorter than
expected from snap length or wlen values.
Note:
truncation is depreciated and this bit is unlikely to be set in an ERF
record.
4: RX error. An error in the received data. Present on the wire
5: DS error. An internal error generated inside the card annotator. Not present on
the wire.
6: Reserved
7: Reserved
rlen Record length in bytes. Total length of the record transferred over the PCIe bus to storage.
The timestamp of the next ERF record starts exactly rlen bytes after the start of the timestamp
of the current ERF record.
lctr Depending upon the ERF type this 16 bit field is either a loss counter of color field. The loss
counter records the number of packets lost between the DAG card and the stream buffer due
to overloading on the PCIe bus. The loss is recorded between the current record and the
previous record captured on the same stream/interface. The color field is explained under
the appropriate type details.