d6e1c462cc
The 'default' attribute is useful to change the default value for those protocol attributes that are not explicitely set in the configuration of the component. Issue #2738
57 lines
2.2 KiB
Plaintext
57 lines
2.2 KiB
Plaintext
The 'nic_dump' component is a bump-in-the-wire component for the NIC service
|
|
that does deep packet inspection for each passing packet and dumps the
|
|
gathered information to the log. This includes information about Ethernet,
|
|
ARP, IPv4, TCP, UDP, and DHCP.
|
|
|
|
|
|
Basics
|
|
~~~~~~
|
|
|
|
this is an example configuration of the component showing all attributes with
|
|
their default values (except config.uplink and config.downlink):
|
|
|
|
! <config uplink="uplink"
|
|
! downlink="downlink"
|
|
! time="no"
|
|
! default="default"
|
|
! eth="default"
|
|
! arp="default"
|
|
! ipv4="default"
|
|
! dhcp="default"
|
|
! udp="default"
|
|
! icmp="default"
|
|
! tcp="default" />
|
|
|
|
The values of the 'uplink' and 'downlink' attributes are used as log labels
|
|
for the two NIC peers. These labels are only relevant for the readability of
|
|
the log. The third attribute 'time' defines wether to print timing information
|
|
or not. Furthemore, as you can see, each supported protocol has an attribute
|
|
with the name of the protocol in the config tag. Each of these attributes
|
|
accepts one of four possible values:
|
|
|
|
* no - do not print out this protocol
|
|
* name - print only the protocol name
|
|
* default - print a short summary of the most important header values
|
|
* all - print all available header values
|
|
|
|
The 'default' attribute is useful to change the default value for protocol
|
|
attributes that are not explicitely set.
|
|
|
|
An example output snippet of the component might be:
|
|
|
|
! (olivia <- karl) ETH ... ARP ... time 4626 (15)
|
|
! (karl <- olivia) ETH ... ARP ... time 4639 (7)
|
|
! (olivia <- karl) ETH ... IPV4 ... TCP ... time 4644 (5)
|
|
! (karl <- olivia) ETH ... IPV4 ... TCP ... time 4660 (6)
|
|
|
|
After the NIC peer labels and the traffic direction, the unfolding of the
|
|
protocols and their information follows. The printing order is from the lowest
|
|
to the highest networking layer. At the end of each line there is the word
|
|
'time' followed by two numbers if you have enabled timing information. The
|
|
first number is the packet-arrival time (the milliseconds since 'nic_dump' was
|
|
started). The second number is the time from the last packet that passed till
|
|
this one (milliseconds).
|
|
|
|
A comprehensive example of how to use the NIC dump can be found in the test
|
|
script 'libports/run/nic_dump.run'.
|