aboutsummaryrefslogtreecommitdiffstats
path: root/docs/gettingstarted
diff options
context:
space:
mode:
authorDave Barach <dave@barachs.net>2019-01-06 15:06:06 -0500
committerDave Barach <openvpp@barachs.net>2019-01-07 15:55:53 +0000
commit8dc146e00098f1c5846d44a3ca5f8db6fbfaff0f (patch)
treefce209247c71d2b9d579b8908f02f73fd87178da /docs/gettingstarted
parent78d62422e1d213e301a887eaab2983791a6d0078 (diff)
Update tcpdump / wireshark packet format writeup
Change-Id: I8195bae1421f68a823b86e12373840f5292ac0df Signed-off-by: Dave Barach <dave@barachs.net>
Diffstat (limited to 'docs/gettingstarted')
-rw-r--r--docs/gettingstarted/developers/vnet.md20
1 files changed, 14 insertions, 6 deletions
diff --git a/docs/gettingstarted/developers/vnet.md b/docs/gettingstarted/developers/vnet.md
index 532eeeae67c..092da1a28a6 100644
--- a/docs/gettingstarted/developers/vnet.md
+++ b/docs/gettingstarted/developers/vnet.md
@@ -325,8 +325,16 @@ packet data, and a protocol hint.
The buffer index is an opaque 32-bit cookie which allows consumers of
these data to easily filter/track single packets as they traverse the
-forwarding graph. Multiple records per packet are normal, and to be
-expected.
+forwarding graph.
+
+Multiple records per packet are normal, and to be expected. Packets
+will appear multipe times as they traverse the vpp forwarding
+graph. In this way, vpp graph dispatch traces are significantly
+different from regular network packet captures from an end-station.
+This property complicates stateful packet analysis.
+
+Restricting stateful analysis to records from a single vpp graph node
+such as "ethernet-input" seems likely to improve the situation.
As of this writing: major version = 1, minor version = 0. Nstrings
SHOULD be 4 or 5. Consumers SHOULD be wary values less than 4 or
@@ -352,7 +360,7 @@ Example: VLIB_NODE_PROTO_HINT_IP6 means that the first octet of packet
data SHOULD be 0x60, and should begin an ipv6 packet header.
Downstream consumers of these data SHOULD pay attention to the
-protocol hint. They MUST tolerate inaccurate hints, which WILL occur
+protocol hint. They MUST tolerate inaccurate hints, which MAY occur
from time to time.
### Dispatch Pcap Trace Debug CLI
@@ -381,9 +389,9 @@ It almost goes without saying that we built a companion wireshark
dissector to display these traces. As of this writing, we're in the
process of trying to upstream the wireshark dissector.
-Until various games of "fetch me a rock" involved are finished, please
-see the "How to build a vpp dispatch trace aware Wireshark" page
-for build info, and/or take a look at .../extras/wireshark.
+Until we manage to upstream the wireshark dissector, please see the
+"How to build a vpp dispatch trace aware Wireshark" page for build
+info, and/or take a look at .../extras/wireshark.
Here is a sample packet dissection, with some fields omitted for
clarity. The point is that the wireshark dissector accurately