TSP Lab	GyTapperG − Packet Capture Software	GyTapperG

Packet Capture Software for Sga-Gplanar and Sga-10GED cards
`("GyTapperG")`

Features

Captures Ethernet frames from SGA interface cards (GPlanar, 10GED)
Handles capture filters (done by cards' firmware)
Uses ClockCard to provide NTP based time stamping or uses the cards internal clock
Can connect to the Sga-7N Monitor Poller module
Distributes captured packets amongst monitors based on distribution rules
Provides a web-interface to access the log file, the INI file, the status window, IP address names, and collected IP address pairs remotely

Connections of the `GyTapperG` module

User interface

The main menu

Menu	Menuitem	Shortcut(s)	Meaning
[Log]
	Find line containing...	(Ctrl-F)	Finds text in log window
	Find next matching line	(F3)	Finds next occurrence of text in log window
	Details		Detail level of logging (Off, Normal, Detailed, or Debug)
	Flush status line counters now!		The status line counters can be flushed
	Flush and zero status line counters now!		The status line counters can be flushed and cleared
[Capture]
	Start/Stop capturing	(Ctrl-S or )	Capturing can be enabled or disabled
	Zero counter of capture devices		Capture card counters can be cleared
	Reload input device list	(Ctrl-I)	Input device list can be reloaded
[Monitors]
	Zero all Rx counters		Rx counters can be cleared
	Syntax-check list		Monitor list can be syntax-checked
	Reload list		Monitor list can be reloaded
	Allow auto-connect	(Ctrl-A or )	Enables automatic connection to the monitors
	Terminate all connections gracefully		Closes connections properly
	Abort all connections immediately(!!!BRUTAL!!!)		Tears down connections immediately by breaking low layer sockets
[Options]
	Auto scroll	( )	Allow automatic scrolling of the log screen
	Show log	(Ctrl-Tab)	Shows log screen
	Show Monitors	(Ctrl-Tab)	Shows Monitors screen
	Save settings		Saves actual settings into the configuration (INI) file

Buttons

Button	Action
	Disables/enables capturing ([Capture] / Start/Stop capturing menu item)
	Disables/enables automatic connection to the monitors ([Monitors] / Allow auto-connect menu item)
	Opens the status page of the web-interface in the deafult web browser
	Disables/enables automatic scrolling of the log screen ([Options] / Auto scroll menu item)

The bottom status-line

Sga-7N Poller: Status of the connection to the Poller module (its colour is red if not connected, grey if connected, purple if not defined)
Poller connection counters:
- Not yet connected: Indicates that the Poller connection is defined but not yet established.
- Counters in case of established Poller connection:
  - Connected: Indicates the number of (re-)connections
  - Tx OK/fail: Number of messages transmitted correctly or with failure
  - Rx OK/fail: Number of messages received correctly or with failure
Monitors:
- M out of N connected: Number of monitors currently connected
- List last loaded: Date and time when monitor list was loaded last
Input devices:
- Rx: Amount of bytes / number of packets received
- Overflown/Mismatched: Number of packets overflown / mismatched
#0..3: Status of monitored interfaces (INI/[Capture]/sInputDevice#0..4)
- Status of input device:
  - green: If there is a configured interface and the capturing is working properly
  - red: If there is a configured interface but the state of the interface is down (e.g., the Ethernet cable is disconnected or the interface is disabled)
  - white: If there is no configured interface
- X Mb/s|Y Mb/s|Z Mb/s|W Mb/s: Indicates the volume of the traffic.
  - X for the 0th interface
  - Y for the 1th interface
  - Z for the 2th interface
  - W for the 3th interface
- Received frame counters (0thIF/1stIF):
  - #BadF: Number of frames with CheckSum error
  - #CapturedF: Number of frames with good CheckSum
  - #AcceptedF: Number of frames after filtering
  - #LostF: Number of frames lost between card and host application
  - #SignLost: Number of sign lost events
  - #ProcessedF: Number of frames which the application got
  - #DMAQueuE: Number of discontinuity of DMA packet orders
  - #MagicCodeE: Number of Magic Code errors
  - #DMAChksumE: Number of DMA CheckSum errors
  - #Signal[µW]: Signal level
Uptime: Time elapsed since module has been started up

Details of "Monitors" window

Con. Status: Identifier of the monitor and the status of the connection
IPaddress : TCPport: IP adress and TCP port of the monitor
Last rx'ed at (UTC): Timestamp of last received packet
Rx [bytes]: Number of received bytes
Rx [packets]: Number of received packets
O.f. [packets]: Number of packets dropped due to network problem
Buff'ed [bytes]: Status of the transmission buffer (max size: 1,000,000byte)
Will terminate: Terminated monitor connection (value during normal operation: "no")

The popup menu of the "Monitors" window

Right-click on a row on the "Monitors" window to access this menu!

	Menuitem	Shortcut(s)	Meaning
	Zero Rx counters		Rx counters can be cleared
	Terminate this connection gracefully		Closes this connection properly
	Abort this connection immediately (!!!BRUTAL!!!)		Tears down this connection immediately by breaking low layer sockets

Logging

Available on a separate page.

The web-interface

Available on a separate page.

Distribution filtering rules

Available on a separate page.

Stats and events

Available on a separate page.

IP address names

Available on a separate page.

Capture filters

Hardware level filters implemented in the cards can be used through GyTapperG module. Each packet the card captured is supplied with a timestamp and checked against these filters. (A 'packet' means the whole Ethernet frame with its full content.) When a packet fits to a filter then the card passes it to the GyTapperG module through its PCI-Express interface. GyTapperG module gets the packet and based on the distribution rules sends it to the proper monitor with a three-character LinkID.

The following parameters can be filtered:

Source IP address (IPaddrSrc) – Defines the source IP address value for which filtering will be done. Exact vules or ranges can be specified.
- 'IPaddrSrc=(10.123.133.143..10.123.133.143)' – Messages from the given IP address are allowed
- 'IPaddrSrc=(10.123.133.100..10.123.133.120)' – Defines an IP address range
Destination IP address (IPaddrDst) – Definition is similar to IPaddrSrc.
IP address (IPaddr) – Definition is similar to IPaddrSrc.

Source IPv6 address (IPv6addrSrc) – Defines the source IPv6 address value for which filtering will be done. Exact vules or ranges can be specified.
- 'IPv6addrSrc=(2001.4c48.102.16f.0.7.bff2.bd01/128)' – Messages from the given IPv6 address are allowed
- 'IPv6addrSrc=(ffa8..0/13)' – Defines an IPv6 address range
Destination IPv6 address (IPv6addrDst) – Definition is similar to IPv6addrSrc.
IPv6 address (IPv6addr) – Definition is similar to IPv6addrSrc.

Source port (PortSrc) – Defines the source port value for which filtering will be done
- 'PortSrc=2123' – Messages from port=2123 (typical setting for GTP-C messages) are allowed
- 'PortSrc=2905' – Messages from port=2905 (typical setting for Sigtran messages) are allowed
Destination port (PortDst) – Definition is similar to PortSrc
Port (Port) – Defines a port value for both source and destination sources.
- 'Port=23' – Messages from port=23 are allowed

Protocol (IPproto) – IP protocol to be filtered (numerical values are expected)
- 'IPproto=6' – Only TCP packets will be forwarded
- 'IPproto=132' – Only SCTP packets will be forwarded

Truncation (Trunc) – Long packets can be truncated to a predefined value when the remaining part is not necessary for the further processing, this truncation is done by the NIC hardware on the whole layer2 packet, before the layer 2 headers are removed by the software. So the captured size is not equal to the truncate parameter, the captured size will be n bytes shorter, where n is the length of the MAC+VLAN headers. Due to technical constraints the minimum truncate length is 64 bytes, smaller than 64 values are accepted by the software, but the truncation will be done to a 64 byte size.
- 'Trunc=248' – Messages longer than 248 bytes will be truncated to 248 byte
- 'Trunc=30' – Messages longer than 64 bytes will be truncated to 64 byte

VLAN ID (Vlan) – If the packet contains VLAN tag then it is possible to filter for its value
- 'Vlan=(200..200)' – Packets with VLAN ID=200 will be forwarded
- 'Vlan=(200..299)' – Packets whose VLAN ID is between 200 and 299 will be forwarded

Filter definition rules

A filter must have PASS or DROP type at the beginning of the filter.
- PASS – Packets match the filters will be passed for distribution.
- DROP – Packets match the filters will be dropped.
A filter can have any combination of the above mentioned parameters. They are applied with logical AND relation.
When there is no any filter defined then all packets is treated according to the type (passed or dropped).
PASS type filters can be named to be referred in the Distribution filtering rules under the Monitor sections. Filter names must be placed at the end of the filter with a beginning '#'. More filters can have the same name.

Filter groups

A group of filters can be assigned to an interface of a capture card. Assignement is specified within the name of the section defining the order of the card and the interface on that card. It is possible to assign the same filter to more interfaces and cards. Different filter groups can not be assigned to the same interface.

Syntax:

	[CaptureFilters Input#N/M]

CaptureFilters – Defines a filter group section.
Input#N – Specifies the card.
- N – Value of N from [Capture]/Input#N above.
- * – Specifies all defined cards.
M – Specifies the interface of the card.
- 0 – Specifies the 0th interface.
- 1 – Specifies the 1st interface.
- * – Specifies both interfaces. The same filters are applied for both ones.
- x – Specifies both interfaces. The filters are applied for the 0th interface and applied for the 1st interface with a source–destionation swap.

When there is any error in the capture filter definitions then it is logged and indicated by changing the color of the interface to red on the GUI.

Examples

Filter definition	Meaning
`[CaptureFilters Input#0/0 Input#1/* Input#3/x]`	Filters are applied: for the 0th interface of the 0th card and for both interfaces of the 1st card and for the 0th interface and for the 1st interface with a source–destionation swap of the 3rd card.
`PASS Vlan=(5..5)`	Packets with VlanID=5 are passed.
`DROP Vlan=(789..4321) IPproto=132`	Packets with VlanID between 789 and 4321 (borders are included) and IP protocol 132 are dropped.
`DROP PortSrc=5001 IPaddrSrc=(10.0.0.1..10.0.0.9) PortDst=5002`	Packets with source port 5001 from IP address between 10.0.0.1 and 10.0.0.9 (borders are included) and with destination port 5002 are dropped.
`PASS Port=23 Trunc=199 #MyNamedFilter_01`	Packets with source or destination port 23 are passed with a truncation to 199 bytes. This filter can be referred by the name "MyNamedFilter_01".

Configuration (GyTapperG.ini) file settings

Limitation: modifying clocking or VLAN filtering requires now a restart of the module.

Section	Entry	Example	Meaning
[Position]
	iLeft	4	Position of the program module on the display screen
	iTop	4	Position of the program module on the display screen
	iWidth	1032	Position of the program module on the display screen
	iHeight	776	Position of the program module on the display screen
[Options]
	bAutoScroll	True	Scrolls automatically the log window
[Capture]
	dwAutoStartWithDelay	4	Start of capturing is delayed with this value, given in seconds
	sInput#N/sCard	sga10gd0	Capture card name and ID should be defined: sga10gd[id]. The "id" can be: 0..3 - to identify a card based on the PCIe slot number 10..99 - to identify a card based on its serial number Note: at most four cards can be defined
	sInput#N/sLinkID	LN1	Input device link ID used in statistics about the traffic of the interface sent to `Monitor Poller`
	sInput#N/bInternalClock	True	If 'True' then internal clock is used instead of ClockCard
	sInput#N/bCutCRC32	False	If 'True' CRC32 bytes are cut from the tail of captured frames
	sInput#N/bLoopBack	True	If 'True' then frames seen on the Rx connector are transmitted on the Tx connector
*[CaptureFilters Input#0/0 Input#1/ Input#3/x]**			Detailed explanation of filtering can be found in the Capture filters section.
	PASS Vlan=(5..5)
	DROP Vlan=(789..4321) IPproto=132
	DROP PortSrc=5001 IPaddrSrc=(10.0.0.1..10.0.0.9) PortDst=5002
	PASS Port=23 Trunc=199 #MyNamedFilter_01
[ClockCard]
	byMasterInput	0	Value of N from [Capture]/Input#N above
	dwRefreshIntervalSec	5	NTP time snyc interval
	sClockCardIPaddress	1.2.3.9	IP address of ClockCard
	sNtpServerIPaddress	1.2.3.200	NTP server address
	sGatewayIPaddress	1.2.3.1	Gateway address of the network which the 'ClockCardAddress' belongs to
	sSubnetMask	255.255.255.0	Mask of the subnet of 'ClockCardAddress'
[Monitors]
	bAllowAutoConnect	True	Enables automatic connections to the monitors
	wAutoConnectIntervalSec	3	Period of automatic (re-)connection
	dwMonitorMaxCount	25	Number of available monitor connections can be limited; default value is 50
[Sga-7N Poller]
	sLocalIPAddress	10.111.0.110	This local IP address is used as local address during the Poller connection
	sRemoteIPAddress	10.112.0.103	IP address of the Poller machine
	sRemoteTCPPort	7001	TCP port of the Poller machine
	wConnectRetryDelaySec	5	Retrial period for establishing the Poller connection
	sSendThisTapperName	TAP	Tapper optionally sends a 3-character ID when connecting to the Poller (default is empty, which means not to send an ID)
[Web Interface]
	byDebug	1	If "1" then the HTTP requests are logged at Debug log level
	wLocalTCPPort	8069	TCP port number where the web-interface accepts the connection
	sURLForLogs	http://$$:8080/LogFiles	URL where "LogFiles" folder is available. "$$" will be replaced with IP address of the machine. "8080" is the TCP port of the FTP server. "LogFiles" is the log file folder defined in the FTP server.
[Advanced]
	wLogDetailLevel	3	Detail level of logging (Off, Normal, Detailed, or Debug)
	dwMaxLinesInLogWindow	1000	Number of lines in the log window on screen
	sCaption	Tapper1	Alternative caption text for easy distinguishing amongst multiple instances of this module
	sLogFilesPath	c:\LogFiles	Path for the log files
	sIPAddrNames2file	IPAddrNames2.csv	Data file that contains IP address and name assignments
[Monitor 'MN1']
	sRemoteIPAddress	10.113.0.75	IP address of the Monitor
	wRemoteTCPPort	7001	TCP port of the Monitor
	sLocalIPAddress	10.111.0.99	Alternative local IP address assignment for the Monitor connection
	bTCPKeepAlive	False	If 'True' then TCP KeepAlive feature is activated for this monitor connection
	bEncryptAllTraffic	True	Encryption (256-bit key AES in CBC mode) in the direction of the connected Monitor (default is False)
	sSendThisTapperName	TP0	Tapper optionally sends a 3-character ID when connecting to a Monitor (or TapperPoller) (default is empty, which means not to send an ID)
	iTrickyTruncateRTP	22	Truncation and header compression settings for RTP media packets. x0 = Off, x1 = Truncate, x2 = {Truncate+Compress} 1x = only if (PortSrc^PortDst)mod4=0or1, 2x = only if (PortSrc^PortDst)mod4=2or3
	L52	10.123.133.143 --- 10.134.133.156 : 9876 --- *	Defines the source and destination IP addresses and port values for which filtering will be done and the result will be forwarded with LinkID="L52". Detailed explanation of filtering can be found in the Distribution filtering rules section.
[Monitor 'NUL' 1]
	OTX	219.239.59.104 --- 10.255.28.230	Packets fit in this rule are simple dropped.

Version history

v1.37

(n) IP fragment handling introduced
(n) New filter parameter: FRAGMENTS

v3.36

(c) Can send ID not only to the Monitor machines, but also to the 7N-Poller (optionally)
(n) INI/[Sga-7N Poller]/sSendThisTapperName

v3.35

(c) More effective timing strategy for data sending on monitor unit connections
(c) Limit for the number of named machines (listed in INI/[Advanced]/sIPaddrNames2file) increased from 3200 to 5200
(c) "?Gy" query on the WebInterface now works with IPv6 addresses, as well
(c) The INI/[Monitor 'xxx']/sSendThisTapperName field ID is displayed on the WebInterface
(c) Limit for the monitor units increased 50 from 25.
(n) Dynamic buffer allocation for monitor connections: 50*10MB memory is allocated for buffers and this amount of memory is shared amongst the maximum count of monitors (INI/[Monitors]/dwMonitorMaxCount < 50) (the default buffer size is still 10MB for each monitor)
(n) Buffer memory allocated for the monitor connections is logged
(n) INI/[Monitors]/dwMonitorMaxCount; default: 50
(n) Tricky cut of RTP media packets + header compression applied
(n) Sharing of RTP traffic based on UDP ports (using XOR of lower second bits of source and destination UDP port numbers)
(n) INI/[[Monitor 'xxx']/iTrickyTruncateRTP for RTP trancation and header compression
(c) Size of status line counters increased to 8 byte from 4 byte to avoid overflow
(c) Modification of temperature display for 10GED cards
(n) Checks whether log path exists (INI/[Advanced]/sLogFilesPath)

v3.30

(n) IPv6addr, IPv6addrSrc and IPv6addrDst are introduced for capture filters
(n) 10GEQ card support

v3.23

(f) Fixes a bug with named capture filters.
(n) Logs ClockCard settings.
(f) Web interface used to list capture filters for not-used interfaces as well.

v3.22

(n) Capture filters introduced.

v3.21

(n) Number of IP address names was increased from the previous maximum of 2000 to a new maximum of 3200.
(n) Web interface "GET /?IPAddrNames" displays the number of result rows (IP address names) as well.
(f) Link statistics might have been sent about obsolete links, i.e., after the definition of the signaling link was removed.

v3.11

First official release.

Packet Capture Software for Sga-Gplanar and Sga-10GED cards("GyTapperG")

Table of Contents

Features

Connections of the GyTapperG module

User interface

The main menu

Buttons

The bottom status-line

Details of "Monitors" window

The popup menu of the "Monitors" window

Logging

The web-interface

Distribution filtering rules

Stats and events

IP address names

Capture filters

The following parameters can be filtered:

Filter definition rules

Filter groups

Examples

Configuration (GyTapperG.ini) file settings

Version history

Packet Capture Software for Sga-Gplanar and Sga-10GED cards
`("GyTapperG")`

Connections of the `GyTapperG` module