Data Tests

Reference Documentation

Platform
Intel® PAC
Napatech SmartNIC
Content Type
Reference Information
Capture Software Version
Link™ Capture Software 12.10
Napatech Software Suite: Data Tests

This section specifies the syntax and semantics for the data tests.

Supported Options Per Feature Set

Supported Feature Sets
N-ANL4
N-ANL5
N-ANL6
N-ANL7
N-ANL8
N-ANL9
N-ANL10
  X
Options DynamicOffset   X
DynamicOffset
Tunnels
  X

The syntax for the data tests is shown below.

<DataTest>              ::= 'Data' '[' <DataTestOptionSpec> ']'
                            ( ( <CompareOperator> <SimpleValue> ) |
                              ( <EqualNotEqualTest> <DataValueSpec> ) )
<DataTestOptionSpec>    ::= <DataTestOption> [';' <DataTestOptionSpec>]
<DataTestOption>        ::= ( 'ProtOffset' '=' <ProtocolLocation11> ) | ( 'DataType' '=' <DataSpec> ) |
                            ( 'DataMask' '=' <DataMaskSpec> )
<DataSpec>              ::= 'ByteStr1' | 'ByteStr2' | 'ByteStr4' | 'MacAddr' | 'IPv4Addr' | 'IPv6Addr'
<DataMaskSpec>          ::= '[' <BitStartOffset> ':' <BitEndOffset> ']'
<BitStartOffset>        ::= <BitOffset>
<BitEndOffset>          ::= <BitOffset>
<BitOffset>             ::= '0' | '1' | '2' | ... | '31' | '0x0' | '0x1' | '0x2' | ... | '0x1f'
<DataValueSpec>         ::= <DataValueList> | <DataValueRange> | <DataValueMask>
<DataValueList>         ::= <DataValue> { ',' <DataValue> }
<DataValueRange>        ::= '(' <DataValue> '..' <DataValue> ')'
<DataValueMask>         ::= '{' <DataMask> ':' <DataValue> '}'
<DataValue>             ::= <SimpleValue> | <IPv4AddrValue> | <IPv6AddrValue> | <MacAddrValue>
<MacAddrValue>          ::= '[' <8-bit hex value> ':' <8-bit hex value> ':'
                                <8-bit hex value> ':' <8-bit hex value> ':'
                                <8-bit hex value> ':' <8-bit hex value> ']'
<SimpleValue>           ::= <8-bit value> | <16-bit value> | <32-bit value>
<DataMask>              ::= <8-bit hex value> | <8-bit hex value without 0x> |
                            <16-bit hex value> | <16-bit hex value without 0x> |
                            <32-bit hex value> | <32-bit hex value without 0x> |
                            <MacAddrValue> | <IPv4AddrMask> | <IPv6AddrMask>

A data test can be a test on one-byte, two-byte or four-byte values at any combination of static and dynamic offsets. This data can be compared to:

  • Specific values
  • Ranges of values
  • Lists of up to 32 values

In addition, wider values such as MAC and IPv6 addresses are also supported.

For a given data value specification (<DataValueSpec>), all data values specified must be of the same type. For instance, if a ByteStr1 range is specified, all specified values must be byte values (0..255).

For a given range specification (<DataValueRange>) with simple values (<SimpleValue>), all values are considered to be of the same size (equal to the largest number of bytes), that is either 1, 2, or 4 bytes. Example: (0xF .. 0x1FF) is interpreted as (0x000F .. 0x01FF).

The offset is specified with the 'ProtOffset' option. This option takes a <ProtocolLocation11> which incorporates both a static and dynamic part. The static offset can range from -1023 to 1024 minus the size of the target data value. There are no implicitly configured protocol filters for the 'ProtOffset' option, so to ensure that only packet types matching the option are considered, it is recommended to setup protocol filters (e.g. when TCP packets are expected, a 'Layer4Protocol <EqualNotEqualTest> TCP' filter should be configured).

The data mask specification F0:0x50 can be specified as one of the following:

  • [0xF0:0x50]
  • [F0:0x50]

This means that the data mask specification bytes are always interpreted as hexadecimal values.

Data Test Examples

This section describes some examples of filters for data testing.

Data Tests on Frame Types and MAC Addresses

This section describes an example of a filter for data testing. The example illustrates how to set up a filter that captures IP and ARP frames that are sent by the device with this MAC address: 00:0F:3D:53:48:2D.

The filter NTPL example is shown below.

Assign[StreamId=1] = (Data[ProtOffset=Layer2Header[6]; DataType=MacAddr] == [00:0F:3D:53:48:2D] AND (Data[ProtOffset=FirstMPLS[-2]; DataType=ByteStr2] == 0x0800, 0x0806))

Data Tests on IPv4 Subnets and Port Numbers

This example shows a filter that matches frames originating from the 172.16.0.0/16 subnet, destined for the 192.168.1.0/24 subnet and where one of the TCP ports is 80:

Assign[StreamId=1] = Layer3Protocol == IPv4 AND Layer4Protocol == TCP AND Data[ProtOffset=Layer3Header[12]; DataType=IPv4Addr] == {[FF.FF.00.00]:[172.16.0.0]} AND Data[ProtOffset=Layer3Header[16]; DataType=IPv4Addr] == {[FF.FF.FF.00]:[192.168.1.0]} AND (Data[ProtOffset=Layer4Header[0]; DataType=ByteStr4; DataMask=[31:16]] == 80 OR Data[ProtOffset=Layer4Header[0]; DataType=ByteStr4; DataMask=[15:0]] == 80)