Pattern Compare Function

Feature Set N-ANL9

Platform
Napatech SmartNIC
Content Type
Feature Description
Capture Software Version
N-ANL9

Overview

The pattern compare function allows the application to define data patterns (with bit masks) at specified frame offsets to identify particular frames. Each pattern is compared simultaneously so that each frame can be compared against multiple data patterns.

Features

Functionality of the pattern compare function:
  • Four 32-bit pattern match extractors.
  • Compare one-byte, two-byte, or four-byte values, or on MAC, IPv4 and IPv6 addresses.
  • Compare data to specific values, ranges of values or lists of up to 32 values.
  • Each pattern match extractor can perform 8 range comparisons.
  • Each bit in a comparison can be defined to be 0, 1 or don’t care.
  • A pattern compare filter can be set up to use either a fixed offset, a dynamic offset, or a combination of a fixed and a dynamic offset.
  • Supported fixed offset values are: 0, 1, 2, ..., 1023.
    Note: The total length of the field to be tested must be less than or equal to 1024 bytes. So the maximum static offset value allowed is 1024 minus the length (in bytes) of the data field. However, the maximum static offset is independent of the dynamic offset.
  • A dynamic offset can be any of the following types (see Illustration of dynamic offsets for outer frames):

    • Start of frame
    • Layer 2 frame, layer 2 data, MAC Length/Type or EtherType
    • IPv4 packet or IPv4 data
    • IPv6 packet or IPv6 data
    • TCP packet or TCP data
    • UDP packet or UDP data
    • ICMP packet
    • IPv4 packet or IPv4 data inside a tunnel
    • IPv6 packet or IPv6 data inside a tunnel
    • TCP packet or TCP data inside a tunnel
    • UDP packet or UDP data inside a tunnel
    • ICMP packet inside a tunnel

Start offset

The start offset for the pattern compare function can be:

  • Fixed

    Example: Assign[StreamId = 0] = Data[DynOffset = DynOffRaw; Offset = 0] == 1 tests the first byte of the received frame.

  • Dynamic

    Example: Assign[StreamId = 0] = Data[DynOffset = DynOffIPv4Frame; Offset = 9] == 1 tests the IPv4 Protocol field.

  • A combination of a dynamic and a fixed offset

    Example: Assign[StreamId = 0] = Data[DynOffset = DynOffIPv4Data; Offset = 128] == 1 tests the IPv4 payload at offset 128.

Illustration of dynamic offsets for outer frames

This figures illustrates the possible dynamic offsets and the corresponding NTPL commands for outer frames.


Page-1 Sheet.1 ISL ISL Sheet.2 VLANs (0, 1, 2 or 3) VLANs(0, 1, 2 or 3) Sheet.3 MPLS labels (0, 1, ..., 7) MPLS labels (0, 1, ..., 7) Sheet.4 MAC MAC Sheet.5 IP IP Sheet.6 UDP/TCP UDP/TCP Sheet.7 Payload data Payload data Sheet.8 MAC CRC MAC CRC Sheet.9 Sheet.10 ISL CRC ISL CRC Sheet.11 Sheet.12 Sheet.13 Sheet.14 Sheet.15 Sheet.16 Sheet.17 Sheet.18 Sheet.19 Sheet.20 Sheet.21 Set offset to start of frame DynOffset = DynOffRaw Set offset to start of frameDynOffset = DynOffRaw Sheet.22 Sheet.23 Set offset to start of MAC header DynOffset = DynOffLayer2Frame Set offset to start of MAC headerDynOffset = DynOffLayer2Frame Sheet.24 Set offset to start of MAC Length/Type field DynOffset = DynO... Set offset to start of MAC Length/Type fieldDynOffset = DynOffEtherTypeLen Sheet.25 Sheet.26 Sheet.27 Set offset to start of MAC Length/Type field DynOffset = DynO... Set offset to start of MAC Length/Type fieldDynOffset = DynOffEtherType Sheet.28 Set offset to start of MAC data DynOffset = DynOffLayer2Data Set offset to start of MAC dataDynOffset = DynOffLayer2Data Sheet.31 Set offset to start of IPv6 packet DynOffset = DynOffIPv6Frame Set offset to start of IPv6 packetDynOffset = DynOffIPv6Frame Sheet.32 Sheet.33 Set offset to start of IPv4 packet DynOffset = DynOffIPv4Frame Set offset to start of IPv4 packetDynOffset = DynOffIPv4Frame Sheet.34 Sheet.35 Set offset to start of TCP packet DynOffset = DynOffTcpFrame Set offset to start of TCP packetDynOffset = DynOffTcpFrame Sheet.36 Sheet.37 Set offset to start of UDP packet DynOffset = DynOffUdpFrame Set offset to start of UDP packetDynOffset = DynOffUdpFrame Sheet.38 Sheet.39 Set offset to start of IPv6 data DynOffset = DynOffIPv6Data Set offset to start of IPv6 dataDynOffset = DynOffIPv6Data Sheet.40 Sheet.41 Set offset to start of IPv4 data DynOffset = DynOffIPv4Data Set offset to start of IPv4 dataDynOffset = DynOffIPv4Data Sheet.42 Sheet.43 Set offset to start of TCP data DynOffset = DynOffTcpData Set offset to start of TCP dataDynOffset = DynOffTcpData Sheet.44 Sheet.45 Set offset to start of UDP data DynOffset = DynOffUdpData Set offset to start of UDP dataDynOffset = DynOffUdpData Sheet.46 Sheet.47 Set offset to start of ICMP packet DynOffset = DynOffICMPFrame Set offset to start of ICMP packetDynOffset = DynOffICMPFrame Sheet.48

Illustration of dynamic offsets for inner frames

This figures illustrates the possible dynamic offsets and the corresponding NTPL commands for inner frames.


Inner dynamic offsets Sheet.1 ISL ISL Sheet.2 VLANs VLANs Sheet.3 MPLS MPLS Sheet.4 MAC MAC Sheet.5 IP IP Sheet.6 UDP/TCP UDP/TCP Sheet.7 Payload data Payload data Sheet.8 MAC CRC MAC CRC Sheet.9 Sheet.10 ISL CRC ISL CRC Sheet.13 Sheet.14 Sheet.22 Sheet.31 Set offset to start of inner IPv6 packet DynOffset = DynOffIn... Set offset to start of inner IPv6 packetDynOffset = DynOffInnerIPv6Frame Sheet.32 Sheet.33 Set offset to start of inner IPv4 packet DynOffset = DynOffIn... Set offset to start of inner IPv4 packetDynOffset = DynOffInnerIPv4Frame Sheet.34 Sheet.35 Set offset to start of inner TCP packet DynOffset = DynOffInn... Set offset to start of inner TCP packetDynOffset = DynOffInnerTcpFrame Sheet.36 Sheet.37 Set offset to start of inner UDP packet DynOffset = DynOffInn... Set offset to start of inner UDP packetDynOffset = DynOffInnerUdpFrame Sheet.38 Sheet.39 Set offset to start of inner IPv6 data DynOffset = DynOffInne... Set offset to start of inner IPv6 dataDynOffset = DynOffInnerIPv6Data Sheet.40 Sheet.41 Set offset to start of inner IPv4 data DynOffset = DynOffInne... Set offset to start of inner IPv4 dataDynOffset = DynOffInnerIPv4Data Sheet.42 Sheet.43 Set offset to start of inner TCP data DynOffset = DynOffInner... Set offset to start of inner TCP dataDynOffset = DynOffInnerTcpData Sheet.44 Sheet.45 Set offset to start of inner UDP data DynOffset = DynOffInner... Set offset to start of inner UDP dataDynOffset = DynOffInnerUdpData Sheet.46 Sheet.47 Set offset to start of inner ICMP packet DynOffset = DynOffIn... Set offset to start of inner ICMP packetDynOffset = DynOffInnerICMPFrame Sheet.48 Sheet.11 UDP UDP Sheet.12 GTPv1 GTPv1 Sheet.15 Inner IP Inner IP Side brace.16 Sheet.17 Only for GTP tunnels and not for IP-in-IP tunnels Only for GTP tunnels and not for IP-in-IP tunnels

Explanation of dynamic offsets

This table explains the exact location of each dynamic offset as well as when the offset is valid.

NTPL Command Validity Offset Location
Outer Frames
DynOffUdpData Valid for UDP frames Offset to the first byte of the UDP data.
DynOffTcpData Valid for TCP frames Offset to the first byte of the TCP data.
DynOffIPv4Data Valid for IPv4 frames Offset to the first byte of the IPv4 data.
DynOffIPv6Data Valid for IPv6 frames Offset to the first byte of the IPv6 data.
DynOffUdpFrame Valid for UDP frames Offset to the first byte of the UDP protocol header.
DynOffTcpFrame Valid for TCP frames Offset to the first byte of the TCP protocol header.
DynOffIcmpFrame Valid for ICMP frames Offset to the first byte of the ICMP protocol header.
DynOffIPv4Frame Valid for IPv4 frames Offset to the first byte of the IPv4 protocol header.
DynOffIPv6Frame Valid for IPv6 frames Offset to the first byte of the IPv6 protocol header.
DynOffLayer2Data Valid for all Ethernet frames Offset to the first protocol byte after the Ethernet header and optionally VLAN tags and/or MPLS labels.
DynOffEtherType Valid for Ethernet frames where the Length/Type field is used to specify a type Offset to the Ethernet Length/Type field. If the frame is VLAN-encapsulated, the offset is to the Length/Type field in the last VLAN tag.
DynOffEtherTypeLen Valid for all Ethernet frames Offset to the Length/Type field of the MAC header.
DynOffLayer2Frame Valid for all Ethernet frames Offset to start of MAC header.
DynOffRaw Valid for all frames Offset to the start of the frame.
Inner Frames
DynOffInnerUdpData Valid for tunneled IPv4/IPv6 UDP frames Offset to the first byte of the UDP data inside a tunnel.
DynOffInnerTcpData Valid for tunneled IPv4/IPv6 TCP frames Offset to the first byte of the TCP data inside a tunnel.
DynOffInnerIPv4Data Valid for tunneled IPv4 frames Offset to the first byte of the IPv4 data inside a tunnel.
DynOffInnerIPv6Data Valid for tunneled IPv6 frames Offset to the first byte of the IPv6 data inside a tunnel.
DynOffInnerUdpFrame Valid for tunneled IPv4/IPv6 UDP frames Offset to the first byte of the UDP protocol header inside a tunnel.
DynOffInnerTcpFrame Valid for tunneled IPv4/IPv6 TCP frames Offset to the first byte of the TCP protocol header inside a tunnel.
DynOffInnerIcmpFrame Valid for tunneled IPv4/IPv6 ICMP frames Offset to the first byte of the ICMP protocol header inside a tunnel.
DynOffInnerIPv4Frame Valid for tunneled IPv4 frames Offset to the first byte of the IPv4 protocol header inside a tunnel.
DynOffInnerIPv6Frame Valid for tunneled IPv6 frames Offset to the first byte of the IPv6 protocol header inside a tunnel.

Effect of filters using dynamic offsets

A filter using a dynamic offset only captures frames for which the dynamic offset is valid. If, for instance, a dynamic offset to the start of the UDP data is used, the filter is only applied to UDP frames. Thus these two filters work in the same way:

  • Assign[StreamId = 0] = (Data[DynOffset = DynOffUdpData; Offset = 2] == 1 AND Layer4Protocol == UDP)
  • Assign[StreamId = 0] = Data[DynOffset = DynOffUdpData; Offset = 2] == 1

Frames with decode errors

For data filters using a dynamic offset, the pattern compare function is disabled in case of decode errors, because the information that the dynamic offset is based on, is potentially erroneous. Data filters using only a fixed offset work as expected in case of decode errors.