Forwarding packets

Discussion in 'Wireless & RF Design' started by satcom, May 3, 2015.

  1. satcom

    Thread Starter New Member

    Apr 1, 2015
    24
    0
    Consider the following block diagram of a microcontroller-based device.
    I want capture and forward docsis packets to an additional test LAN port for connecting Wireshark packet analyzer. What's point where the signal source can be taken from and forwarded to that LAN port? Is that possible?
    [​IMG]
     
  2. Brownout

    Well-Known Member

    Jan 10, 2012
    2,375
    998
    Use the four port switch, labeled "EPHY SWITCH" in the block diagram.
     
  3. satcom

    Thread Starter New Member

    Apr 1, 2015
    24
    0
    EPHY SWITCH output is connected to LAN ports. It is the same if we connect Wireshark analyzer to regular LAN port. But data on the LAN ports does not contains a full Docsis packets.
     
  4. Brownout

    Well-Known Member

    Jan 10, 2012
    2,375
    998
    If you want to use a LAN port to capture DOCSIS packets, then you'll need to encapsulate the DOCSIS packets within LAN packets. That will require a re-programming of your router.
     
  5. satcom

    Thread Starter New Member

    Apr 1, 2015
    24
    0
    What if use extra test LAN port attached to circuitry before EPHY SWITCH, not existing LAN ports?
     
  6. Brownout

    Well-Known Member

    Jan 10, 2012
    2,375
    998
    The only place you'll be able to tap off DOCSIS is between the tuner and the MAC/PHY chip, the signals labeled US and DS. You won't be able to connect a LAN port, however, because LAN uses Ethernet protocol, not DOCSIS. If you want to sniff DOCSIS packets, you'll need a port that speaks DOCSIS protocol.
     
  7. satcom

    Thread Starter New Member

    Apr 1, 2015
    24
    0
    I understand we need encapsulate raw DOCSIS packets in Ethernet framing, where "Ethernet framing" refers to the very low-level framing that marks the start and end of an Ethernet frame, not to Ethernet link-layer headers. The question is how to implement this encapsulation.
    Cisco enterprise routers, like uBR7200 series with Cisco IOS software, provide this option with cable monitor command, that forward copies of full DOCSIS packets to an external LAN analyzer attached to another Ethernet port on Cisco router. Or it can strip the DOCSIS headers and forward only the Ethernet frames. Very handy in troubleshooting network and application problems.
    Wireshark understand DOCSIS Frames if it configured for "packet-type data docsis" under the interface configuration command. To tell Wireshark to interpret the frames as DOCSIS frames: Edit - Preference - Frame - "Treat DOCSIS Frames as..."
    If implement encapsulation is problematic, it is possible dump full Docsis packets and save it in a capture file, for offline analysis?
     
  8. Brownout

    Well-Known Member

    Jan 10, 2012
    2,375
    998
    Negative. You would need all the Data Link information to be included.

    You would need an Ethernet MAC/Phy chip to connect to your DOCSIS data. Most likely, you'd need to do some processing between the chip and your modem. Exactly what processing, I don't know at this time.


    If you have that facility, then just use it. If not, you might be out of luck.

    It's possible. Only your device's documentation or a call to tech support will tell.
     
    Last edited: May 7, 2015
  9. satcom

    Thread Starter New Member

    Apr 1, 2015
    24
    0
    Unfortunately I have no cisco enterprise router, I noted that only as example. So I want to try to save Docsis streams (DS and US) to file. Can you advice methods that can be used for this?
     
    Last edited: May 7, 2015
Loading...