Pattern Compare Function

Feature Set N-ANL11

Platform
Intel® PAC
Napatech SmartNIC
Content Type
Feature Description

Overview

The pattern compare function allows the application to define data patterns (with bit masks) at specified frame offsets to identify particular frames. Each pattern is compared simultaneously so that each frame can be compared against multiple data patterns.

Features

Functionality of the pattern compare function:
  • Four 32-bit pattern match extractors.
  • Compare one-byte, two-byte, or four-byte values, or on MAC, IPv4 and IPv6 addresses.
  • Compare data to specific values, ranges of values or lists of up to 32 values.
  • Each pattern match extractor can perform 8 range comparisons.
  • Each bit in a comparison can be defined to be 0, 1 or don’t care.
  • A pattern compare filter can be set up to use either a fixed offset, a dynamic offset, or a combination of a fixed and a dynamic offset.
  • Supported fixed offset values are: 0, 1, 2, ..., 1023.
    Note: The total length of the field to be tested must be less than or equal to 1024 bytes. So the maximum static offset value allowed is 1024 minus the length (in bytes) of the data field. However, the maximum static offset is independent of the dynamic offset.
  • A dynamic offset can be any of the following types (see Illustration of dynamic offsets for outer frames):

    • Start of frame
    • Layer 2 frame, layer 2 data, MAC Length/Type or EtherType
    • IPv4 packet or IPv4 data
    • IPv6 packet or IPv6 data
    • TCP packet or TCP data
    • UDP packet or UDP data
    • ICMP packet
    • IPv4 packet or IPv4 data inside a tunnel
    • IPv6 packet or IPv6 data inside a tunnel
    • TCP packet or TCP data inside a tunnel
    • UDP packet or UDP data inside a tunnel
    • ICMP packet inside a tunnel

Start offset

The start offset for the pattern compare function can be:

  • Fixed

    Example: Assign[StreamId = 0] = Data[DynOffset = DynOffRaw; Offset = 0] == 1 tests the first byte of the received frame.

  • Dynamic

    Example: Assign[StreamId = 0] = Data[DynOffset = DynOffIPv4Frame; Offset = 9] == 1 tests the IPv4 Protocol field.

  • A combination of a dynamic and a fixed offset

    Example: Assign[StreamId = 0] = Data[DynOffset = DynOffIPv4Data; Offset = 128] == 1 tests the IPv4 payload at offset 128.

Illustration of dynamic offsets for outer frames

This figures illustrates the possible dynamic offsets and the corresponding NTPL commands for outer frames.


Possible dynamic offsets and the corresponding NTPL commands for outer frames

Illustration of dynamic offsets for inner frames

This figures illustrates the possible dynamic offsets and the corresponding NTPL commands for inner frames.


Possible dynamic offsets and the corresponding NTPL commands for inner frames

Explanation of dynamic offsets

This table explains the exact location of each dynamic offset as well as when the offset is valid.

NTPL Command Validity Offset Location
Outer Frames
DynOffUdpData Valid for UDP frames Offset to the first byte of the UDP data.
DynOffTcpData Valid for TCP frames Offset to the first byte of the TCP data.
DynOffIPv4Data Valid for IPv4 frames Offset to the first byte of the IPv4 data.
DynOffIPv6Data Valid for IPv6 frames Offset to the first byte of the IPv6 data.
DynOffUdpFrame Valid for UDP frames Offset to the first byte of the UDP protocol header.
DynOffTcpFrame Valid for TCP frames Offset to the first byte of the TCP protocol header.
DynOffIcmpFrame Valid for ICMP frames Offset to the first byte of the ICMP protocol header.
DynOffIPv4Frame Valid for IPv4 frames Offset to the first byte of the IPv4 protocol header.
DynOffIPv6Frame Valid for IPv6 frames Offset to the first byte of the IPv6 protocol header.
DynOffLayer2Data Valid for all Ethernet frames Offset to the first protocol byte after the Ethernet header and optionally VLAN tags and/or MPLS labels.
DynOffEtherType Valid for Ethernet frames where the Length/Type field is used to specify a type Offset to the Ethernet Length/Type field. If the frame is VLAN-encapsulated, the offset is to the Length/Type field in the last VLAN tag.
DynOffEtherTypeLen Valid for all Ethernet frames Offset to the Length/Type field of the MAC header.
DynOffLayer2Frame Valid for all Ethernet frames Offset to start of MAC header.
DynOffRaw Valid for all frames Offset to the start of the frame.
Inner Frames
DynOffInnerUdpData Valid for tunneled IPv4/IPv6 UDP frames Offset to the first byte of the UDP data inside a tunnel.
DynOffInnerTcpData Valid for tunneled IPv4/IPv6 TCP frames Offset to the first byte of the TCP data inside a tunnel.
DynOffInnerIPv4Data Valid for tunneled IPv4 frames Offset to the first byte of the IPv4 data inside a tunnel.
DynOffInnerIPv6Data Valid for tunneled IPv6 frames Offset to the first byte of the IPv6 data inside a tunnel.
DynOffInnerUdpFrame Valid for tunneled IPv4/IPv6 UDP frames Offset to the first byte of the UDP protocol header inside a tunnel.
DynOffInnerTcpFrame Valid for tunneled IPv4/IPv6 TCP frames Offset to the first byte of the TCP protocol header inside a tunnel.
DynOffInnerIcmpFrame Valid for tunneled IPv4/IPv6 ICMP frames Offset to the first byte of the ICMP protocol header inside a tunnel.
DynOffInnerIPv4Frame Valid for tunneled IPv4 frames Offset to the first byte of the IPv4 protocol header inside a tunnel.
DynOffInnerIPv6Frame Valid for tunneled IPv6 frames Offset to the first byte of the IPv6 protocol header inside a tunnel.

Effect of filters using dynamic offsets

A filter using a dynamic offset only captures frames for which the dynamic offset is valid. If, for instance, a dynamic offset to the start of the UDP data is used, the filter is only applied to UDP frames. Thus these two filters work in the same way:

  • Assign[StreamId = 0] = (Data[DynOffset = DynOffUdpData; Offset = 2] == 1 AND Layer4Protocol == UDP)
  • Assign[StreamId = 0] = Data[DynOffset = DynOffUdpData; Offset = 2] == 1

Frames with decode errors

For data filters using a dynamic offset, the pattern compare function is disabled in case of decode errors, because the information that the dynamic offset is based on, is potentially erroneous. Data filters using only a fixed offset work as expected in case of decode errors.