User manual CACE TECHNOLOGIES TURBOCAP V1.0

[. . . ] Gigabit Ethernet Packet Capture User's Guide Copyrights Copyright © 2008 CACE Technologies, Inc. This document may not, in whole or part, be: copied; photocopied; reproduced; translated; reduced; or transferred to any electronic medium or machine-readable form without prior consent in writing from CACE Technologies, Inc. TurboCap Gigabit Ethernet Packet Capture User's Guide Document Version: Document Revision: 1. 0 June 2008 CACE Technologies, Inc. Davis, CA 95616 (530) 758-2790 (530) 758-2781 (fax) support@cacetech. com http://www. cacetech. com Contents and Figures Contents TurboCap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Overview of TurboCap. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Different boards on the same PC can have different Dual Port Pass-thru settings. When Dual Port Pass-thru is ON, the packets received on port A are transmitted out on port B and the packets received on port B are transmitted out on port A. It's not possible to selectively enable and disable the pass-thru functionality in a single direction (i. e. it's not possible to have A B enabled and B A disabled). Dual Port Pass-thru is not available on ports belonging to different boards. When Dual Port Pass-thru is ON, TurboCap does not support traffic injection on the pass-thru'ed ports. 6 TurboCap User's Guide The Dual Port Pass-thru acts as a Network Tap, but from the network point of view it acts as a bridge, not as repeater (i. e. it works at L2). Multiple Port Aggregation Each board exposes a virtual port that aggregates the traffic received on the two ports of a board into one single capture stream of packets. This virtual port is called Board Aggregating Port (BAP). Each board on a PC exposes a different BAP with its own settings. TurboCap also exposes a virtual port that aggregates the traffic received from all the ports of all the boards on the system into a single capture stream of packets. This virtual port is called TurboCap Aggregating Port (TcAP). There is one single TcAP per machine mounting at least one TurboCap board. When capturing from a BAP or TcAP virtual port, the TurboCap based application will receive the packets captured from all the ports of a board (in the case of BAP) or from all the ports in the system (in the case of TcAP) on a single open instance. TurboCap does not support traffic injection on the BAPs and TcAPs. Packet injection scheduling Injection TurboCap is able to inject packets with a best-effort approach, i. e. The setting is called snaplen, Snapshot Length. TurboCap allows to set the snaplen and to retrieve the current snaplen. Filtering Capture The first version of TurboCap does not have any built-in hardware (i. e. in the TurboCap driver) packet filtering capability. BPF packet filters are applied at user level in the WinPcap libraries when interfaced with the TurboCap user API. The only available built-in hardware filter is related to error vs. correct packets. FCS Capture TurboCap returns the Frame Check Sequence of every captured packet, even if the FCS is wrong. TurboCap captures packets with both correct and wrong frame check sequence. TurboCap allows capturing all the packets (correct and with wrong FCS) as well as filtering out the wrong ones. TurboCap User's Guide 9 Injection TurboCap allows injecting packets with correct FCS and wrong FCS. [. . . ] It includes the Control Panel executable, the developer's pack directory, the TurboCap driver directory, the Guides directory (contains the Installation Guide and this Guide), and two dump-to-disk executables (TcDump. exe and TxDump_ng. exe), and finally, the Uninstall executable. Also shown in Figure 6 is the "help" output of TcDump when run without arguments. Finally, TcDump is run with "DumpFile" as the name of the dump file. We see that TcDump lists the TurboCap capture ports and asks for a number to identify the port. [. . . ]