Consider the following block diagram of a microcontroller-based device.
I want capture and forward docsis packets to an additional test LAN port for connecting Wireshark packet analyzer. What's point where the signal source can be taken from and forwarded to that LAN port? Is that possible?

 

Use the four port switch, labeled "EPHY SWITCH" in the block diagram.

 

Use the four port switch, labeled "EPHY SWITCH" in the block diagram.

EPHY SWITCH output is connected to LAN ports. It is the same if we connect Wireshark analyzer to regular LAN port. But data on the LAN ports does not contains a full Docsis packets.

 

If you want to use a LAN port to capture DOCSIS packets, then you'll need to encapsulate the DOCSIS packets within LAN packets. That will require a re-programming of your router.

 

What if use extra test LAN port attached to circuitry before EPHY SWITCH, not existing LAN ports?

 

The only place you'll be able to tap off DOCSIS is between the tuner and the MAC/PHY chip, the signals labeled US and DS. You won't be able to connect a LAN port, however, because LAN uses Ethernet protocol, not DOCSIS. If you want to sniff DOCSIS packets, you'll need a port that speaks DOCSIS protocol.

 

The only place you'll be able to tap off DOCSIS is between the tuner and the MAC/PHY chip, the signals labeled US and DS. You won't be able to connect a LAN port, however, because LAN uses Ethernet protocol, not DOCSIS. If you want to sniff DOCSIS packets, you'll need a port that speaks DOCSIS protocol.

I understand we need encapsulate raw DOCSIS packets in Ethernet framing, where "Ethernet framing" refers to the very low-level framing that marks the start and end of an Ethernet frame, not to Ethernet link-layer headers. The question is how to implement this encapsulation.
Cisco enterprise routers, like uBR7200 series with Cisco IOS software, provide this option with cable monitor command, that forward copies of full DOCSIS packets to an external LAN analyzer attached to another Ethernet port on Cisco router. Or it can strip the DOCSIS headers and forward only the Ethernet frames. Very handy in troubleshooting network and application problems.
Wireshark understand DOCSIS Frames if it configured for "packet-type data docsis" under the interface configuration command. To tell Wireshark to interpret the frames as DOCSIS frames: Edit - Preference - Frame - "Treat DOCSIS Frames as..."
If implement encapsulation is problematic, it is possible dump full Docsis packets and save it in a capture file, for offline analysis?

 

I understand we need encapsulate raw DOCSIS packets in Ethernet framing, where "Ethernet framing" refers to the very low-level framing that marks the start and end of an Ethernet frame, not to Ethernet link-layer headers.

Negative. You would need all the Data Link information to be included.

The question is how to implement this encapsulation.

You would need an Ethernet MAC/Phy chip to connect to your DOCSIS data. Most likely, you'd need to do some processing between the chip and your modem. Exactly what processing, I don't know at this time.

Cisco enterprise routers, like uBR7200 series with Cisco IOS software, provide this option with cable monitor command, that forward copies of full DOCSIS packets to an external LAN analyzer attached to another Ethernet port on Cisco router. Or it can strip the DOCSIS headers and forward only the Ethernet frames. Very handy in troubleshooting network and application problems.

If you have that facility, then just use it. If not, you might be out of luck.

If implement encapsulation is problematic, it is possible dump full Docsis packets and save it in a capture file, for offline analysis?

It's possible. Only your device's documentation or a call to tech support will tell.

 

Unfortunately I have no cisco enterprise router, I noted that only as example. So I want to try to save Docsis streams (DS and US) to file. Can you advice methods that can be used for this?