This source file is an example of how to do realtime analysis of packets using NTAPI.
The following NTAPI functions are used:
- This example does not work with the NT4E-STD accelerator
A Napatech capture accelerator is needed to run this example. The ntservice.ini must have at least one HostBuffersRx defined. Below is an example of a minimum ini-file. It will create a 32MB RX hostbuffer from NUMA node 0.
The following is required to perform real-time analysis on packets:
- #include/nt.h - Applications/Tools only need to include nt.h to obtain prototypes, macros etc. from NTAPI.
- NT_Init(NTAPI_VERSION) - Initialize the NTAPI library. NTAPI_VERSION is a define that describes the version of the API described in the header files included by nt.h. NT_Init() will ask the NTAPI library to convert return data to the NTAPI_VERSION if possible. This will ensure that applications can run on NTAPI libraries of newer versions.
- NT_ConfigOpen() - Open a config stream in order to setup filter using the NT_NTPL() command.
- NT_NetRxOpen() - Open a stream. The stream ID must match the one used when creating the filter using the NT_NTPL() command. A stream does not return data until traffic is assigned to it by creating a filter. Stream IDs might be shared between other streams and it is possible to make several filters to one stream ID. Each filter can have a unique color in the ASSIGN. The "color" of the ASSIGN can be used to mark packets making it possible for the stream to determine if the packets it receives via NT_NetRxGet() as based on its assign or if the packet belongs to the other streams that also share the hostbuffer.
- NT_NTPL() - Assign traffic to a stream by creating a filter using a manually chosen stream ID. The stream ID must match the one used NT_NetRxOpen().
- Optional step. Wait until we start seeing packets that are hit by the NTPL assign command. This is done to avoid getting packets that are not fully classified by the stream. NT_NetRxGet() is called with a timeout of 1000ms and will return NT_STATUS_TIMEOUT in case nothing is received within 1000ms and will return NT_SUCCESS if something is returned. Return values different from that is an indication of an error. Packets that are prior to the expected time are released via NT_NetRxRelease().
- NT_NetRxGet() and NT_NetRxRelease() - Receive and release packets. Each received packet is printed with help of the Packet macros
- NT_NET_GET_PKT_DESCRIPTOR_TYPE() - Get the descriptor type (NT_PACKET_DESCRIPTOR_TYPE_PCAP, NT_PACKET_DESCRIPTOR_TYPE_NT, NT_PACKET_DESCRIPTOR_TYPE_NT_EXTENDED).
- NT_NET_GET_PKT_TIMESTAMP() - Get the timestamp of the packet.
- NT_NET_GET_PKT_WIRE_LENGTH() - Get the wire length of the packet.
- NT_NET_GET_PKT_L2_PTR() - Get a pointer to the L2 part of the packet, which is where SW decoding would start.
- NT_NetRxClose() - Close the stream when terminating. This will close the stream and release the NTPL assignment made on the hostbuffer.