Endace DAG 9.2X2 - Viewing Captured Data; Dagbits

EDM01-36v10 DAG_9.2X2_Card_User_Guide - Using your DAG card
40 ©2010 - 2012 Endace Technology Ltd. Confidential - Version 10 - May 2012
Viewing captured data
Data captured in ERF format can be viewed with dagbits.
Notes:
• dagbits decodes and displays ERF header fields and packet contents are displayed as a Hex dump
only. To decode higher level protocols, Endace recommends using a third party application, see
Using third party applications (page 47).
• dagbits is also able to run a number of tests, including monotonic time-stamp increment and frame
checksum (FCS, aka CRC) validation.
Examples
Test live traffic on dag0, stream 0 for 60 seconds running the lctr, flags and fcs tests:
dagbits -vvc -d0:0 -s60 lctr flags fcs
To read a trace log file using dagbits:
dagbits -vvc print -f logname.log | less
To check for errors in the trace:
dagbits -vvc ltcr flags fcs -f logname.log
For simple decoding of packets:
dagbits -vvc -d0:0 decode | less
If
dagbits reaches the end of the traffic and prints its report then the ERF records were valid.
dagbits
The following table lists all available options in dagbits.
Options Description
-0, --stripcrc
ERF records contain no Link-Layer CRCs.
-1, --crc16
ERF records contain 16 bit Link-Layer CRCs (PoS).
-3, --crc32
ERF records contain 32 bit Link-Layer CRCs (PoS and Ethernet).
-a, --atmformat
Set legacy format to ATM (this is the default).
-A, --align <n>
Check the ERF record lengths are multiples of n-bits. To be used with align test
-b, --bigendian
Treat ERF timestamps as big-endian.
-c, --count
Print real-time progress reports as dagbits captures traffic. This is a useful indicator that a
test is running correctly.
-C
--crcfactor <n>
Sets CRC correction factor for BTX test (0, 16 or 32 bits).
-d
--device <device>
Use the DAG device referred to by <device>. Supported syntax includes 0, dag1, and
/dev/dag3 to refer to DAG cards, and 0:2, dag1:1, and /dev/dag2:0 to refer to specific
streams on DAG cards.
-D,
--delay <n>
Introduces a <n> nanosecond delay between processing each record.
-e, --ethformat
Set legacy format to Ethernet (default: ATM).
-E,
--haltmax <n>
Halt operation after a maximum of <n> errors. This option prevents dagbits from creating
extremely large output files when being redirected to a file.
-f,
--fname <fname>
Read captured data from <fname>.
-g, --global
Global, causes mono to test for globally increasing rather than per-port timestamps
-H, --steer <n>
Steering control number for steering test, DAG 4.3 and DAG 4.3GE:
• 0: stream0 force
• 1: test parity
• 2: test CRC
• 3: iface
-h, -?
--help, --usage
Display usage (help) information.