Pattern Compare Function

Overview

The pattern compare function allows the application to define data patterns (with bit masks) at specified frame offsets to identify particular frames. Each pattern is compared simultaneously so that each frame can be compared against multiple data patterns.

Features

Functionality of the pattern compare function:

Four 32-bit pattern match extractors.
Compare one-byte, two-byte, or four-byte values, or on MAC, IPv4 and IPv6 addresses.
Compare data to specific values, ranges of values or lists of up to 32 values.
Each pattern match extractor can perform 8 range comparisons.
Each bit in a comparison can be defined to be 0, 1 or don’t care.
A pattern compare filter can be set up to use either a fixed offset, a dynamic offset, or a combination of a fixed and a dynamic offset.
Supported fixed offset values are: 0, 1, 2, ..., 1023.
Note: The total length of the field to be tested must be less than or equal to 1024 bytes. So the maximum static offset value allowed is 1024 minus the length (in bytes) of the data field. However, the maximum static offset is independent of the dynamic offset.
A dynamic offset can be any of the following types (see Illustration of dynamic offsets for outer frames):
- Start of frame
- Layer 2 frame, layer 2 data, MAC Length/Type or EtherType
- IPv4 packet or IPv4 data
- IPv6 packet or IPv6 data
- TCP packet or TCP data
- UDP packet or UDP data
- ICMP packet
- IPv4 packet or IPv4 data inside a tunnel
- IPv6 packet or IPv6 data inside a tunnel
- TCP packet or TCP data inside a tunnel
- UDP packet or UDP data inside a tunnel
- ICMP packet inside a tunnel

Start offset

The start offset for the pattern compare function can be:

Fixed

Example: Assign[StreamId = 0] = Data[DynOffset = DynOffRaw; Offset = 0] == 1 tests the first byte of the received frame.
Dynamic

Example: Assign[StreamId = 0] = Data[DynOffset = DynOffIPv4Frame; Offset = 9] == 1 tests the IPv4 Protocol field.
A combination of a dynamic and a fixed offset

Example: Assign[StreamId = 0] = Data[DynOffset = DynOffIPv4Data; Offset = 128] == 1 tests the IPv4 payload at offset 128.

Illustration of dynamic offsets for outer frames

This figures illustrates the possible dynamic offsets and the corresponding NTPL commands for outer frames.

Illustration of dynamic offsets for inner frames

This figures illustrates the possible dynamic offsets and the corresponding NTPL commands for inner frames.

Explanation of dynamic offsets

This table explains the exact location of each dynamic offset as well as when the offset is valid.

NTPL Command	Validity	Offset Location
Outer Frames
`DynOffUdpData`	Valid for UDP frames	Offset to the first byte of the UDP data.
`DynOffTcpData`	Valid for TCP frames	Offset to the first byte of the TCP data.
`DynOffIPv4Data`	Valid for IPv4 frames	Offset to the first byte of the IPv4 data.
`DynOffIPv6Data`	Valid for IPv6 frames	Offset to the first byte of the IPv6 data.
`DynOffUdpFrame`	Valid for UDP frames	Offset to the first byte of the UDP protocol header.
`DynOffTcpFrame`	Valid for TCP frames	Offset to the first byte of the TCP protocol header.
`DynOffIcmpFrame`	Valid for ICMP frames	Offset to the first byte of the ICMP protocol header.
`DynOffIPv4Frame`	Valid for IPv4 frames	Offset to the first byte of the IPv4 protocol header.
`DynOffIPv6Frame`	Valid for IPv6 frames	Offset to the first byte of the IPv6 protocol header.
`DynOffLayer2Data`	Valid for all Ethernet frames	Offset to the first protocol byte after the Ethernet header and optionally VLAN tags and/or MPLS labels.
`DynOffEtherType`	Valid for Ethernet frames where the Length/Type field is used to specify a type	Offset to the Ethernet Length/Type field. If the frame is VLAN-encapsulated, the offset is to the Length/Type field in the last VLAN tag.
`DynOffEtherTypeLen`	Valid for all Ethernet frames	Offset to the Length/Type field of the MAC header.
`DynOffLayer2Frame`	Valid for all Ethernet frames	Offset to start of MAC header.
`DynOffRaw`	Valid for all frames	Offset to the start of the frame.
Inner Frames
`DynOffInnerUdpData`	Valid for tunneled IPv4/IPv6 UDP frames	Offset to the first byte of the UDP data inside a tunnel.
`DynOffInnerTcpData`	Valid for tunneled IPv4/IPv6 TCP frames	Offset to the first byte of the TCP data inside a tunnel.
`DynOffInnerIPv4Data`	Valid for tunneled IPv4 frames	Offset to the first byte of the IPv4 data inside a tunnel.
`DynOffInnerIPv6Data`	Valid for tunneled IPv6 frames	Offset to the first byte of the IPv6 data inside a tunnel.
`DynOffInnerUdpFrame`	Valid for tunneled IPv4/IPv6 UDP frames	Offset to the first byte of the UDP protocol header inside a tunnel.
`DynOffInnerTcpFrame`	Valid for tunneled IPv4/IPv6 TCP frames	Offset to the first byte of the TCP protocol header inside a tunnel.
`DynOffInnerIcmpFrame`	Valid for tunneled IPv4/IPv6 ICMP frames	Offset to the first byte of the ICMP protocol header inside a tunnel.
`DynOffInnerIPv4Frame`	Valid for tunneled IPv4 frames	Offset to the first byte of the IPv4 protocol header inside a tunnel.
`DynOffInnerIPv6Frame`	Valid for tunneled IPv6 frames	Offset to the first byte of the IPv6 protocol header inside a tunnel.

Effect of filters using dynamic offsets

A filter using a dynamic offset only captures frames for which the dynamic offset is valid. If, for instance, a dynamic offset to the start of the UDP data is used, the filter is only applied to UDP frames. Thus these two filters work in the same way:

Assign[StreamId = 0] = (Data[DynOffset = DynOffUdpData; Offset = 2] == 1 AND Layer4Protocol == UDP)
Assign[StreamId = 0] = Data[DynOffset = DynOffUdpData; Offset = 2] == 1

Frames with decode errors

For data filters using a dynamic offset, the pattern compare function is disabled in case of decode errors, because the information that the dynamic offset is based on, is potentially erroneous. Data filters using only a fixed offset work as expected in case of decode errors.