User manual CACE TECHNOLOGIES TURBOCAP V1.0

[. . . ] 6 Multiple Port Aggregation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Packet injection scheduling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Link speed and auto-negotiation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Packet meta-information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Differently from the "ON (polling mode)", timestamps are generated periodically by the TurboCap using a 1ms precise timer. This timestamping mode has the following characteristics: o Less accurate timestamps are generated o Low impact on the CPU usage. Dual Port Pass-thru Each board can be configured to inject the traffic received from one port to the other port of the same board (see Figure 2). TurboCap TurboCap user API user API User mode Kernel mode TurboCap Driver TurboCap Driver TurboCap TurboCap Board TurboCap Board Gigabit Ethernet Port Gigabit Ethernet Port Switch B Switch B x Figure 2 - Dual Port Pass-thru Switch B Switch B Dual Port Pass-thru is a per-board feature. Different boards on the same PC can have different Dual Port Pass-thru settings. When Dual Port Pass-thru is ON, the packets received on port A are transmitted out on port B and the packets received on port B are transmitted out on port A. It's not possible to selectively enable and disable the pass-thru functionality in a single direction (i. e. Dual Port Pass-thru is not available on ports belonging to different boards. When Dual Port Pass-thru is ON, TurboCap does not support traffic injection on the pass-thru'ed ports. 6 TurboCap User's Guide The Dual Port Pass-thru acts as a Network Tap, but from the network point of view it acts as a bridge, not as repeater (i. e. it works at L2). Multiple Port Aggregation Each board exposes a virtual port that aggregates the traffic received on the two ports of a board into one single capture stream of packets. TurboCap also exposes a virtual port that aggregates the traffic received from all the ports of all the boards on the system into a single capture stream of packets. There is one single TcAP per machine mounting at least one TurboCap board. When capturing from a BAP or TcAP virtual port, the TurboCap based application will receive the packets captured from all the ports of a board (in the case of BAP) or from all the ports in the system (in the case of TcAP) on a single open instance. TurboCap does not support traffic injection on the BAPs and TcAPs. Packet injection scheduling Injection TurboCap is able to inject packets with a best-effort approach, i. e. TurboCap allows to set the snaplen and to retrieve the current snaplen. Filtering Capture The first version of TurboCap does not have any built-in hardware (i. e. BPF packet filters are applied at user level in the WinPcap libraries when interfaced with the TurboCap user API. correct packets. FCS Capture TurboCap returns the Frame Check Sequence of every captured packet, even if the FCS is wrong. TurboCap captures packets with both correct and wrong frame check sequence. TurboCap allows capturing all the packets (correct and with wrong FCS) as well as filtering out the wrong ones. TurboCap User's Guide 9 Injection TurboCap allows injecting packets with correct FCS and wrong FCS. The user application can choose to be responsible for computing the FCS of every injected packet, or let the TurboCap board compute the FCS for the injected packets. In case TurboCap computes the FCS, it will always compute a valid FCS (i. e. it cannot generate wrong FCS values). Support for jumbo frames Capture and Injection TurboCap supports a maximum packet size of 9234 bytes (including the trailing FCS), both for capture and injection. LED functionality Each port of a board ships with 2 multicolor LEDs (off/green/yellow/orange), that can be either controlled by the TurboCap API or connected to a board source like "link is up at 10/100/1000". Link status TurboCap can notify when the link goes up or down on a per port basis. It's also possible to query TurboCap for the link status on a per port basis directly. VLAN support Capture and Injection TurboCap fully supports reception and injection of VLAN tagged frames. Statistics TurboCap is able to return a series of statistics related to packet capture and injection. Unless otherwise noted, all the statistics are represented as 64bit unsigned integers. [. . . ] This documentation provides all of the information needed to start developing your own TurboCap applications and includes some sample TurboCap programs that can be used as starting points for your development. 18 TurboCap User's Guide Recommended HW and Software Platforms The TurboCap capture board and Windows driver are only two of the componenets that determine the overall capture performance of your system. In order to achieve maximum performance, we recommend the following minimum hardware requirements. Hardware Host Interface: The TurboCap board requires either a x4 or x8 PCIe slots with 4 lanes available for the TurboCap board CPUs: Pentium-D (dual core) processor or multiple CPUs (SMP), 2. 8 GHz Memory: minimum of 2 GB RAM Disk (Installation): 50MB free disk space on the hard drive plus additional space for capture (trace) files. Disk (Trace files): Full-rate dump-to-disk requires disk arrays that have sufficient capacity and speed to keep up with full-rate Gigabit Ethernet. [. . . ]