Software-Description

The AAL reassembly logic is customized to capture only the first cell of each frame as shown in Figure 3.14. The 48 bytes of payload from these cells typically contain the LLC/SNAP (8 bytes), IP and TCP (typically 20 bytes each) headers. Copying the 5 byte ATM header also allows the flexibility of doing ATM based analysis in the future. The SAR engine discards the rest of each AAL5 protocol data unit (PDU, equivalent to a frame or IP packet), limiting the amount of data transferred from the NICs over the PCI bus to the host. Although as yet unimplemented, one could increase the amount collected to accommodate IP options or larger packet headers as specified for IPng. Currently, however, the cards only pass the first cell of each packet, so when IP layer options push part of the TCP header into the second cell, these latter portions will not be seen by the host.

  

Figure 3.14: Which ATM Cells are Captured

Each ATM card has two 1MB buffers in host memory to hold IP header data. The cards are bus masters, able to DMA (direct memory access) header data from each AAL5 PDU into the host memory buffers with its own PCI bus transfer. This capability eliminates the need for host CPU intervention except when a buffer fills, at which point the card generates an interrupt to the host, signaling it to process that buffer up to memory while the card fills the other buffer with more header data. This design allows the host to have a long interrupt latency without risking loss of monitored data. The cards add timestamps to the header data as they prepare to transfer it to host memory. Clock granularity is 40 nanoseconds, about 1/70 of the OC3 cell transmission time.