SPRUI30H November 2015 – May 2024 DRA745 , DRA746 , DRA750 , DRA756
The extractor module has a protocol aware state machine. It decodes the header field in the current protocol header to determine the encapsulating protocol type and extracts various parameters used for software logging. The extractor module also provides the offset to octets in the packet, where Layer 3 and Layer 4 protocol headers start, to the rule engine. These protocol headers correspond to the location of IP and TCP/UDP/ICMP headers from the beginning of the packet.
Ethernet packets with VLAN, PPPoE, IP, IP Options, and ICMP/TCP/UDP protocol are supported by the extractor. When unknown protocols are detected, the extractor skips any additional packet processing. Some examples of how packet parsing is done by the Extractor are given below.
The flow of Extractor state machine flow is as follows.
In case the packet is aborted (indicated by address 0x10 on VBUSP with request and write ready asserted), the extractor state machine flushes its current state, goes back to the idle state and waits for next packet.
The Extractor provides information to rule engine about location of Layer 3 and Layer 4 protocols. When this information is provided to rule engine, the Base Register 1 and Base register 2 are loaded with Layer 3 start offset and Layer 4 start offset respectively. Until the extractor completes decoding of these protocol headers and sends the offset values to rule engine, the rule engine does not execute any instruction that operates on fields in these protocol headers.
Extractor module extracts IP protocol, Source IP address, Destination IP address, TCP/UDP source port, TCP/UDP destination port and ICMP type/code from incoming packet and provides this information to the Host logger module for software reporting. In case IP header or TCP/UDP header does not contain the extractable fields then the corresponding field is logged as zero.
In case packet has unknown Layer 4 protocol or IP packet is fragmented such that the packet does not contain TCP/UDP/ICMP header then TCP/UDP source/destination ports or ICMP type/code fields are logged as zeros.