Layer 4 Classification

Napatech Link-Capture™ Software Features
Platform
Napatech SmartNIC
Content Type
Feature Description
Capture Software Version
Link™ Capture Software 12.14

Layer 4 packets

Layer 4 packets are classified in the basic classes shown in this table.

Class Classification Conditions Length of Header (in bytes)
TCP The frame decoder recognizes a TCP packet if the value of the Data Offset field of is larger than or equal to 0x5, and one of these conditions is met:
  • The packet has been classified as an IPv4 packet and the Protocol field of the IPv4 header is 0x06.
  • The packet has been classified as an IPv6 packet and the NextHeader field of the IPv6 standard header or of the last extension header is 0x06.
 20, 24, 28, ..., 60 (fetched from the Offset field in the TCP header)
UDP The frame decoder recognizes a UDP packet if one of these conditions is met:
  • The packet has been classified as an IPv4 packet and the Protocol field of the IPv4 header is 0x11.
  • The packet has been classified as an IPv6 packet and the NextHeader field of the IPv6 standard header or of the last extension header is 0x11.
 8
ICMP The frame decoder recognizes an ICMP packet if one of these conditions is met:
  • The packet has been classified as an IPv4 packet and the Protocol field of the IPv4 header is 0x01.
  • The packet has been classified as an IPv6 packet and the NextHeader field of the IPv6 standard header or of the last extension header is 0x3A.
 8
SCTP The frame decoder recognizes an SCTP packet if one of these conditions is met:
  • The packet has been classified as an IPv4 packet and the Protocol field of the IPv4 header is 0x84.
  • The packet has been classified as an IPv6 packet and the NextHeader field of the IPv6 standard header or of the last extension header is 0x84.
 12
L4_Other The frame decoder recognizes an L4_Other packet if none of the above applies. 0
Note: For classification of layer 4 protocols, the corresponding protocol header must be present in a frame. For example, a frame can only be classified as UDP if it includes the UDP header. As a result, if a fragmented IP packet lacks the UDP header – even if the Protocol field in the IPv4 header is 0x11 – it will not be classified as UDP.