Traffic receiver using parallel capture engines
View Patent ↗There is disclosed a method of capturing packets and packet receivers to capture packets. A timestamp may be attached to each packet received from a network. Each timestamped packet may be routed to a capture engine of a plurality of capture engines. Each of the plurality of capture engines may save at least some packets determined to match one or more of a plurality of predetermined capture criteria. A list of contiguously captured packets in time-stamp order may be prepared.
1. A method of capturing packets, comprising:
receiving packets from a network
attaching a timestamp to each received packet
distributing the received packets between a plurality of capture engines, each capture engine including a respective one of a plurality of capture memories
capturing packets using the plurality of capture engines, wherein the plurality of capture engines collectively perform actions including
determining if each received packet matches one or more of a plurality of predetermined capture criteria
storing at least some of the received packets that match one or more of the plurality of capture criteria, each of the capture engines storing packets in the respective capture memory
discontinuing storing received packets in accordance with a predetermined completion criteria
after discontinuing storing received packets, eliminating non-contiguous packets from the packets stored in the plurality of capture memories and preparing a list in timestamp order of contiguous packets stored in the plurality of capture memories
wherein eliminating non-contiguous stored packets comprises:
determining, for each of the plurality of capture engines, if the respective capture memory wrapped while storing received packets
when one or more of the plurality of capture memories wrapped
determining the latest timestamp among the earliest packet stored in each capture memory that wrapped
discarding all stored packets having timestamp values less than the latest timestamp among the earliest packet stored in each capture memory that wrapped.
2. The method of claim 1 , wherein
the plurality of predetermined capture criteria includes a trigger criteria, a pre-trigger criteria, and post-trigger criteria
wherein a first time any one of the plurality of capture engines determines that a received packet matches the trigger criteria is considered a trigger event and the received packet that causes the trigger event is considered a trigger packet.
3. The method of claim 2 , wherein storing at least some of the packets further comprises:
when the trigger event has not yet occurred, storing only received packets that match the pre-trigger criteria
when the trigger event has occurred
storing received packets that match one or more of the pre-trigger criteria, the trigger criteria, and the post-trigger criteria during a predetermined delay time after the trigger event
after the predetermined delay time has elapsed, storing only received packets that match the post-trigger criteria.
4. The method of claim 3 , wherein each of the capture engines storing packets further comprises:
storing the packets in a first portion of the respective capture memory
storing packet information related to the packets in a second portion of the respective capture memory
wherein the packet information includes the timestamp associated with each packet, a pointer to a location where each packet is stored in the first portion of the memory, and flags indicating if each packet matches one or more of the pre-trigger criteria, the trigger criteria, and the post-trigger criteria.
5. The method of claim 4 , where the list in timestamp order of contiguous packets comprises:
a table in a memory including, for each listed packet, the packet timestamp and a pointer to the associated packet information.
6. The method of claim 3 , wherein preparing a list in timestamp order of contiguous packets includes:
discarding each stored packet that meets only the pre-trigger criteria and has a timestamp value greater than the timestamp value of the trigger packet
discarding each stored packet that meets only the post-trigger criteria and has a timestamp value less than the timestamp value of the trigger packet.
7. The method of claim 1 , further comprising:
temporarily holding each timestamped received packet in a FIFO queue of a plurality of FIFO queues each coupled to a corresponding one of the plurality of capture engines.
8. A traffic receiver, comprising:
a plurality of capture engines to capture packets, each capture engine including a respective one of a plurality of capture memories
a network interface unit to receive packets from a network
a timestamper that attaches a timestamp to each received packet
a packet distribution engine to distribute timestamped packets between the plurality of capture engines
wherein each of the plurality of capture engines is configured to capture packets by performing actions including
determining if each received packet distributed to the capture engine matches one or more of a plurality of predetermined capture criteria
storing in the respective capture memory at least some of the received packets distributed to the capture engine that match one or more of the plurality of capture criteria
wherein the plurality of capture engines are configured to collectively perform actions including
discontinuing storing received packets in accordance with a predetermined finish criteria
after discontinuing storing received packets, preparing a list of contiguously captured packets in timestamp order
wherein preparing a list of contiguously captured packets further comprises:
determining, for each of the plurality of capture engines, if the respective capture memory wrapped while storing received packets
when none of the plurality of capture memories wrapped, preparing a list of all stored packets in timestamp order
when one or more of the plurality of capture memories wrapped
determining the latest timestamp among the earliest packet stored in each wrapped capture memory
discarding all stored packets having timestamp values less than the latest timestamp among the earliest packet stored in each wrapped capture memory
preparing a list of the remaining stored packets in timestamp order.
9. The traffic receiver of claim 8 , wherein
the plurality of predetermined capture criteria includes a trigger criteria, a pre-trigger criteria, and post-trigger criteria
wherein a first time any one of the plurality of capture engines determines that a received packet matches the trigger criteria is considered a trigger event.
10. The traffic receiver of claim 9 , wherein storing at least some of the packets further comprises:
when the trigger event has not yet occurred, storing only received packets that match the pre-trigger criteria
when the trigger event has occurred
storing received packets that match one or more of the pre-trigger criteria, the trigger criteria, and the post-trigger criteria during a predetermined delay time after the trigger event
after the predetermined delay time has elapsed, storing only received packets that match the post-trigger criteria.
11. The traffic receiver of claim 10 , wherein the actions performed by each capture engine further include:
storing each packet to be captured in a first portion of the respective capture memory
storing packet information related to each packet in a second portion of the respective capture memory
wherein the packet information includes the timestamp associated with packet, a pointer to a location where the packet is stored in the first portion of the capture memory, and flags indicating if the packet matches one or more of the pre-trigger criteria, the trigger criteria, and the post-trigger criteria.
12. The traffic receiver of claim 8 , wherein the list of contiguously captured packets comprises:
a table in a memory, the table including, for each listed packet, the packet timestamp and a pointer to the associated packet information.
13. The traffic receiver of claim 8 , further comprising:
a plurality of FIFO queues to temporarily hold timestamped received packets, each of the plurality of FIFO queues coupled to a corresponding one of the plurality of capture engines.
14. A traffic receiver, comprising:
a plurality of capture engines, each including a respective one of a plurality of capture memories
a network interface unit to receive packets from a network
a timestamper that attaches a timestamp to each received packet
a packet distribution engine that distributes timestamped packets between the plurality of capture engines
wherein each of the plurality of capture engines further comprises:
a plurality of filters, each filter associated with a corresponding one of a plurality of predetermined capture criteria, each filter effective to determine if a received packet matches the associated capture criteria
a delay buffer which delays packets that match at least one of the capture criteria for a predetermined delay time
a memory controller coupled to receive packets from the delay buffer, the memory controller effective to store at least some of the packets received from the delay buffer in the respective capture memory
wherein the memory controllers within each of the plurality of capture engines are further adapted to collectively:
discontinue storing received packets in accordance with a predetermined finish criteria
after discontinuing storing received packets, determine, for each of the plurality of capture engines, if the respective capture memory wrapped while storing received packets
when none of the plurality of capture memories wrapped, prepare a list of all stored packets in timestamp order
when one or more of the plurality of capture memories wrapped
determine the latest timestamp among the earliest packet stored in each wrapped capture memory
discard all stored packets having timestamp values less than the latest timestamp among the earliest packet stored in each wrapped capture memory
prepare a list of the remaining stored packets in timestamp order.
15. The traffic receiver of claim 14 , wherein
the plurality of predetermined capture criteria includes a trigger criteria, a pre-trigger criteria, and post-trigger criteria, wherein a first time any one of the plurality of capture engines determines that a received packet matches the trigger criteria is considered a trigger event.
16. The traffic receiver of claim 15 , wherein the memory controllers within each capture engine are adapted to performs actions including:
when the trigger event has not yet occurred, storing only received packets that match the pre-trigger criteria
when the trigger event has occurred
storing received packets that match one or more of the pre-trigger criteria, the trigger criteria, and the post-trigger criteria during a predetermined delay time after the trigger event
after the predetermined delay time has elapsed, storing only received packets that match the post-trigger criteria.
17. The traffic receiver of claim 16 , wherein the memory controller within each capture engine is further adapted to:
store each packet to be captured in a first portion of the respective capture memory
store packet information related to each packet in a second portion of the respective capture memory
wherein the packet information includes the timestamp associated with packet, a pointer to a location where the packet is stored in the first portion of the respective capture memory, and flags indicating if the packet matches one or more of the pre-trigger criteria, the trigger criteria, and the post-trigger criteria.
18. The traffic receiver of claim 14 , wherein the list of the remaining packets in timestamp order comprises:
a table in a memory, the table including, for each listed packet, the packet timestamp and a pointer to the associated packet information.
19. The traffic receiver of claim 14 further comprising:
a plurality of FIFO queues to temporarily hold timestamped received packets, each of the plurality of FIFO queues coupled to a corresponding one of the plurality of capture engines.
20. A method of capturing packets, comprising:
receiving packets from a network
attaching a timestamp to each received packet
distributing the received packets between a plurality of capture engines, each capture engine including a respective one of a plurality of capture memories
capturing packets using the plurality of capture engines, each of the capture engines storing captured packets in the respective capture memory, wherein capturing packets further comprises:
determining if each received packet matches one or more of a plurality of predetermined capture criteria including a trigger criteria, a pre-trigger criteria, and a post-trigger criteria, wherein a first time any one of the plurality of capture engines determines that a received packet matches the trigger criteria is considered a trigger event and the received packet that causes the trigger event is considered a trigger packet
before the trigger event, storing only received packets that match the pre-trigger criteria
storing received packets that match one or more of the pre-trigger criteria, the trigger criteria, and the post-trigger criteria during a predetermined delay time after the trigger event
after the predetermined delay time has elapsed, storing only received packets that match the post-trigger criteria
discontinuing storing received packets in accordance with a predetermined completion criteria
after discontinuing storing received packets, eliminating non-contiguous packets from the packets stored in the plurality of capture memories and preparing a list in timestamp order of contiguous packets stored in the plurality of capture memories, wherein preparing a list in timestamp order of contiguous packets further comprises:
discarding each stored packet that meets only the pre-trigger criteria and has a timestamp value greater than the timestamp value of the trigger packet
discarding each stored packet that meets only the post-trigger criteria and has a timestamp value less than the timestamp value of the trigger packet.
21. The method of claim 20 , wherein each of the capture engines storing packets further comprises:
storing the packets in a first portion of the respective capture memory
storing packet information related to the packets in a second portion of the respective capture memory
wherein the packet information includes the timestamp associated with each packet, a pointer to a location where each packet is stored in the first portion of the memory, and flags indicating if each packet matches one or more of the pre-trigger criteria, the trigger criteria, and the post-trigger criteria.
22. The method of claim 21 , where the list in timestamp order of contiguous packets comprises:
a table in a memory including, for each listed packet, the packet timestamp and a pointer to the associated packet information.
23. The method of claim 20 , wherein eliminating non-contiguous stored packets comprises:
determining, for each of the plurality of capture engines, if the respective capture memory wrapped while storing received packets
when one or more of the plurality of capture memories wrapped
determining the latest timestamp among the earliest packet stored in each capture memory that wrapped
discarding all stored packets having timestamp values less than the latest timestamp among the earliest packet stored in each capture memory that wrapped.