Filters control how frames are processed and captured.
The frame processing pipeline
This figure shows the functional blocks in the frame processing pipeline.
The frame passes through a number of functional blocks. Each block is controlled by a recipe. For example, the Color block can contribute to the "color" value of the frame, the Slicing block can cut out parts of the frame, and the Packet Descriptor block will attach a packet descriptor with relevant information about the frame. The last functional block, the Queue Manager, decides which stream will receive the frame.
The recipes are specified by filters, described below. If no filters are defined, all functional blocks will execute their default recipe. For example, the default recipe for the Queue Manager will drop the frames.
Each filter consists of a filter expression and a number of recipes.
A filter expression is a combination of protocol, IP match, port and various other tests.
- Color assignment
- Hash key calculation
- Correlation key calculation
- IP fragment handling
- Local retransmission
- Packet descriptor building
- Distribution to streams (queue management)
When a frame is received, all functional blocks are reset to their default recipe.
The frame is then presented to each filter in reverse priority order (the filter with the lowest priority is consulted first). If the frame matches the filter expression, the associated recipes are copied to the relevant functional blocks, replacing the recipes already there. This way, a higher priority filter overrules the behavior specified by a lower priority filter.
When all filters have been consulted, the frame is run through the functional blocks.
In effect, each resulting function recipe (including distribution to streams) can be picked from a different filter.
Filters are specified using the Assign NTPL command. Each Assign command specifies a new filter. Recipes are specified as options to the Assign commands.
In the following example, frames with length greater than or equal to 1000 bytes are processed using recipes from two different filters.
Assign[StreamId = 1; Priority = 20; Slice = Layer4Header] = Length >= 300 Assign[StreamId = 2; Priority = 10] = Length >= 1000
Filter 1 matches all frames with length greater than or equal to 300 bytes. Filter 2 matches all frames with length greater than or equal to 1000 bytes. Suppose a frame with a length of 1000 bytes is received. Both filters will match with filter 2 having the highest priority. Because filter 2 has the highest priority and it defines a StreamId recipe, the frame will be sent to stream 2. Filter 2 does not define a Slice recipe; however filter 1 does, and because it is the next highest priority filter that also matches the frame, the frame is sliced according to filter 1's Slice recipe.