Examining network packets

1
Examining network packets

• Information about the RTL8139 needed for
  understanding our watch235.c pseudo driver

2
Harney-235

• The Kudlick Classrooms workstations are equipped
  with network interface adapters designed by
  RealTek (model 8139)
• The Linux network device-driver for these NICs is
  configured on our workstations to use 32KB of
  memory as a receive buffer
• Each device interrupt identification number is
  calculated by adding 0x20 to the IRQ

3
RTL8139 registers

• The RTL8139 has a number of hardware registers
  which control its operations and provide
  information about its current state
• The Linux driver programs these registers
• Our driver will need to read three of them
• Interrupt Status register
• Receive Buffer Start Address register
• Current Address of Packet Read register

4
The Receive Buffer
32KB RAM
packet data
packet-header
packet-checksum
RBSTART
CAPR
ISR
CBR
16-bits
16-bits
16-bits
32-bits
5
Rx Buffer Operation

• When a new packet is received, the 8139 stores it
  into the Receive Buffer area, at the offset
  specified in the CBA register (Current Buffer
  Address), automatically advances the CBA value to
  the offset of the end of the packet, and
  generates an interrupt (with ISR equal to 0x0001)

6
Interrupt Service Routine

• The CAPR register points to an offset that is
  16-bytes ahead of the newly received packets
  packet-header
• The packet-header is always aligned on a 32-bit
  address-boundary
• The packet-header consists of two fields
• The packet status (16-bits)
• The packet length (16-bits)

7
Packet Length

• The packet-length field contains a count of the
  number of bytes of packet-data, plus 4 (for the
  length of the packets checksum)
• The maximum length of a network packet is set by
  an ethernet standard 1514 bytes (not including
  the 4-byte CRC checksum)
• The minimum length of a network packet is
  normally required to be 60 bytes (CRC)

8
Packet Status
M A R
P A M
B A R
I S E
R U N T
LONG
C R C
F A E
R O K
Legend ROK Receive OK FAE Frame
Alignment Error CRC Checksum Error LONG
Long Packet ( gt 4K bytes) RUNT Data CRC lt
64 bytes ISE Invalid Symbol Error BAR
Broadcast Address Received PAM Physical
Addfess Matched MAR Multicast Address Received
9
Demo trywatch.cpp

• After you download and then compile our
  watch235.c driver module, you can try running
  this demo-program to see a dump (in hex and ascii
  formats) of a packet that is received in our
  classroom (Harney-235)

10
In-Class exercise

• Modify the trywatch.cpp program so that it
  continuously dumps received packets, until the
  user terminates the endless loop by typing
  ltCONTROLgt-C.
• For a graceful termination, you should use a
  signal-handler to break out of your loop, so that
  you can close the pseudo-file and remove the
  watch235 driver module