The 'nic_dump' component is a bump-in-the-wire component for the NIC service
that does deep packet inspection for each passing packet and dumps the
gathered information to the log. This includes information about Ethernet,
ARP, IPv4, TCP, UDP, and DHCP.
Basics
~~~~~~
this is an example configuration of the component showing all attributes with
their default values (except config.uplink and config.downlink):
! <config uplink="uplink"
! downlink="downlink"
! time="no"
! default="default"
! eth="default"
! arp="default"
! ipv4="default"
! dhcp="default"
! udp="default"
! icmp="default"
! tcp="default" />
The values of the 'uplink' and 'downlink' attributes are used as log labels
for the two NIC peers. These labels are only relevant for the readability of
the log. The third attribute 'time' defines wether to print timing information
or not. Furthemore, as you can see, each supported protocol has an attribute
with the name of the protocol in the config tag. Each of these attributes
accepts one of four possible values:
* no - do not print out this protocol
* name - print only the protocol name
* default - print a short summary of the most important header values
* all - print all available header values
The 'default' attribute is useful to change the default value for protocol
attributes that are not explicitely set.
An example output snippet of the component might be:
! (olivia <- karl) ETH ... ARP ... time 4626 (15)
! (karl <- olivia) ETH ... ARP ... time 4639 (7)
! (olivia <- karl) ETH ... IPV4 ... TCP ... time 4644 (5)
! (karl <- olivia) ETH ... IPV4 ... TCP ... time 4660 (6)
After the NIC peer labels and the traffic direction, the unfolding of the
protocols and their information follows. The printing order is from the lowest
to the highest networking layer. At the end of each line there is the word
'time' followed by two numbers if you have enabled timing information. The
first number is the packet-arrival time (the milliseconds since 'nic_dump' was
started). The second number is the time from the last packet that passed till
this one (milliseconds).
A comprehensive example of how to use the NIC dump can be found in the test
script 'libports/run/nic_dump.run'.
181c78d482