Spirent TestCenter

Capture

www.spirentcampus.com
Topic Overview
„ Capture Overview and Data Flow
„ Capture Settings
„ Pattern Matching and Event filters
„ Starting and Stopping Capture
„ Viewing and Saving Captured Frames
„ Copying Capture Configuration to Other Ports
„ ClearSight™ Application and Features
„ Installing and Enabling Real-time Aspects (aka the Spirent Adapter)
„ Timestamp Resolution
„ Decoding Spirent TestCenter’s Signature
„ Decoding the Preamble
„ Ladder Diagrams of Routing Protocols
„ Using your PCs Adaptor to Capture Instead
2
Spirent TestCenter Capture
Capture Overview
„ Capture Features „ Saving and Viewing Captured Frames
‹ Real-time operation supported ‹ User can choose any decode program to
examine frames
‹ Numerous and easy-to-use pattern matching
filters (triggers) ‹ *.pcap is supported
‹ No requirement to have or use Clearsight
‹ Numerous event filters
‹ Robust decoding tools
„ Real-time Capture/Decode (aka ClearSight)
‹ Frames pulled from capture buffer and
displayed on user’s PC while the test is
running for Real-time decodes
‹ Full resolution of the Spirent TestCenter
timestamp
‹ Decoded Signature field (*.scap file)
‹ Decoded Ethernet Preamble
‹ Routing protocol ladder diagrams
‹ Detailed and interactive troubleshooting /
analysis while the test is running
‹ No need to stop, save the capture to the
local PC & display

3
Spirent TestCenter Capture
Capture Data Flow
Tx Control Plane Traffic
Note: No filtering capability
Real-Time Decode and Display

ClearSight
ClearSight
Pattern Real
Capture Pattern
Matching Time
Buffer Matching
and Event Decode
And Event
Filters And
Rx Traffic (both Filters
control and data Display
plane)

Post-
Capture
Decode .SCAP File
With Your -or-
Favorite .PCAP File
Decode
Program
4
Spirent TestCenter Capture
General Settings
„ Settings for Capture Engine Modes, Slice, Buffer Action,
Statistics and Expression view

5
Spirent TestCenter Capture
General Settings – Capture Engine Modes

„ Capture Mode
‹ Regular Mode captures the entire frame
‹ Signature Mode captures only the signature tags
„ Capture Source
‹ Tx Mode only captures transmitted frames [control plane traffic only]
‹ Rx Mode captures all received traffic [control and data plane]
‹ Tx/Rx Mode capture both transmitted frames [control plane traffic only] and
receive frames [control and data plane traffic]
„ Real-Time Mode
‹ Enabled to open the ClearSight Networks™ Analyzer application for real-
time capture
‹ A license check is performed to ensure a valid decoder is installed.
‹ Real-time capture supports a maximum of 4 ports and only up to 100 fps
total; therefore use Pattern Matching and Event filters.

6
Spirent TestCenter Capture
General Settings – Slice and Buffer Action
„ In non Real-time Mode, the hardware can capture 8 or 16
Mega Bytes of data per port (10GigE and GigE respectively)
„ Slice Mode Enabled captures the first n bytes (Slice Size) of
a frame instead of the entire frame.
„ Obviously this allow you to capture more fames.
„ The Buffer Action allows you to specify what happens when
the buffer is full (Wrap = FIFO).

7
Spirent TestCenter Capture
General Settings – Statistics and
Expression view
„ Statistics displays the Current state of the capture engine
‹ Ready (ready for use)
‹ Pending (transitioning from Ready to Running [Start Capture] or
Running to Ready [Stop Capture])
‹ Running (capture engine is capturing data)
‹ Number of frames captured
‹ Elapsed time since the capture started

„ Expression displays the expressions for the active patterns

‹ Patterns; Qualify, Start, and Stop Events

8
Spirent TestCenter Capture
Capture Settings

„ Sets the path post capture and/or real-time viewers

9
Spirent TestCenter Capture
Pattern Definition
„ 8 32-bit filters for determining what to capture (Qualify Events), and when
to start and stop the capture (Triggers)
„ Placing a filter on some fields will consume more than one filter (for
example MAC source uses 2 filters)
„ Includes AND/OR/NOT Logic
„ Clicking “Add” brings up PDU editor-like interface for defining the filters
„ Copt to Ports is also highlighted here

10
Spirent TestCenter Capture
Pattern Definition – Add Filter

„ A PDU like editor interface for defining the capture filters

11
Spirent TestCenter Capture
Qualify Events
„ Shown are the events the user can choose to capture
„ Only frames matching those events will be captured
„ The events are combined using OR logic (also with the defined patterns)
„ The same events are allowed for starting and stopping the capture

12
Spirent TestCenter Capture
Starting and Stopping Capture

One set of controls

to start/stop
capture on all
ports

One set of
controls to
start/stop
capture on this
port

No ability to
select a group of
ports and tell the
application to
start/stop capture
on the group…yet

13
Spirent TestCenter Capture
Viewing / Saving Captured Frames
Users can View
or Save frames
in the capture
buffer using any
decoder they
want

Can save in
.scap or .pcap
format

Can save the

packets already
downloaded
and discard the
rest by clicking
Cancel
14
Spirent TestCenter Capture
Start Events

„ Events for starting the capture

Or Just Start Manually

15
Spirent TestCenter Capture
Stop Events

„ Events for stopping the capture

Or Just Stop Manually

16
Spirent TestCenter Capture
Copying Capture Configuration to
Other Ports

A small wizard helps

users copy their
capture configuration
from one port to many.

The user can choose

to copy all capture
attributes or to select
specific attributes to
copy.

17
Spirent TestCenter Capture
Copying Capture Configuration to
Other Ports continued
Select attributes you want to copy

Then select target ports

18
Spirent TestCenter Capture
ClearSight™ Application
List of
frames
pulled from
capture
buffer. User
can select
one for
detailed view

Selected
frame is
decoded

Hex and
ASCII view
of selected
frame

19
Spirent TestCenter Capture
 Installing and Enabling Real-time
Aspects (aka ClearSight™)
„ Downloading and installing code
‹ Must download from Spirent Web
Support sight

„ License Requirements
‹ Chassis-based Enhanced Capture/
Decode Base Package (BPK-1029A)

„ Provisioning
‹ Set the path to clearsight.exe
in Spirent TestCenter

20
Spirent TestCenter Capture
ClearSight™ Features
„ Full Integration with Spirent TestCenter
„ Real-Time Capture support (pushes data from the test port to your PC)
„ Decoded signature field (full resolution of the Spirent TestCenter
timestamp)
„ Works with Pattern Matching and Event filters
„ Application, Network and Physical Layer-based views
„ Ladder diagrams of network “conversations”
„ Post-capture filters
„ Decoded Preamble and FCS
„ Routing protocol ladder diagrams
„ Can view/save real-time capture files as .pcap or .scap
„ 10M to 10G hardware support
„ Real-time capture supports a maximum of 4 ports and only up to 100 fps
total; therefore use Pattern Matching and Event filters.
21
Spirent TestCenter Capture
ClearSight / Spirent TestCenter
Features
„ Uses the Spirent Adaptor (not your PCs adaptor)
„ Real-time decodes
‹ Control and data plane traffic
‹ Data captured from multiple ports viewed in a single instance
of the decode software

„ Full resolution of the Spirent TestCenter timestamp

(10ns)
„ Decode of Spirent signature
„ Capture and display of the preamble
„ Ladder diagrams of captured BGP, BGPv4, OSPF,
OSPFv3, RIP and RIPng sessions.
22
Spirent TestCenter Capture
Timestamp Resolution
„ Spirent TestCenter timestamp has 10ns resolution
„ None of the popular file formats (for example *.pcap) can accommodate
enough digits to display the timestamp’s resolution (PCAP gives the
timestamp in microseconds)
„ With ClearSight testers can see the full timestamp and take advantage of
the system’s high accuracy

23
Spirent TestCenter Capture
 Decoding Spirent TestCenter’s Signature
„ Spirent TestCenter signatures are scrambled and can’t be
decoded by any of the popular decode engines
„ With ClearSight users can view the decoded signature which
contains valuable troubleshooting information such as stream
ID, sequence number, timestamps, etc.

24
Spirent TestCenter Capture
Decoding the Preamble
Preambles are captured
and displayed

25
Spirent TestCenter Capture
Ladder Diagrams of Routing Protocols
„ This example shows a ladder diagram showing the OSPF
exchange of Database Description packets
‹ BGP, OSPF and RIP are supported

26
Spirent TestCenter Capture
 Using your PCs Adaptor
„ BPK-1029 also allows you to use ClearSight with ONE additional “PC
Adapter” (i.e., capture with your PCs NIC not Spirent TestCenter).
„ For that, ClearSight, and the ClearSight license that is generated, will be
locked to that ONE PC’s MAC address.

Full version for use with your PCs adaptor only

Can be used with the Spirent Adaptor

or your PCs adaptor

NOTE: Do not install

both on the same PC!

27
Spirent TestCenter Capture
End of Topic

www.spirentcampus.com
28
Spirent TestCenter Capture