This package implements a packer dumper. It collects NDN packets matching certain name prefixes as they enter or leave NDN-DPDK, and writes to a pcapng file.

Writer type represents a packet dump writer thread that runs in an LCore of "PDUMP" role. It receives packets from packet dump sources via a ring buffer, and writes them to a PCAP Next Generation (pcapng) file.

Three pcapng block types may appear in the output file:

• Section Header Block (SHB)
• Interface Description Block (IDB)
• Enhanced Packet Block (EPB)

SHB and IDB are prepared in Go code using GoPacket library, and then passed to C code via the ring buffer. EPB is crafted directly in C code.

FaceSource type defines a packet dump source attached to a face, on either incoming or outgoing direction. It is referenced by FaceImpl in RCU protected pointers. If assigned, every packet received or sent by a face is processed through PdumpFace_Process function.

The configuration contains one or more name prefixes under which the packet should be captured, and the probability of capturing a packet that matches the prefix. It is possible to capture every packet by setting a / prefix with probability 1.0. Otherwise, the packet is parsed to extract its name, which is then compared to the list of prefixes. If a packet is chosen to be captured, it is copied into a new mbuf, and sent to the PdumpWriter.

The packet parser for extracting name is greatly simplified compared to the regular parser. It understands both NDNLPv2 and NDN 0.3 packet format, but does not perform NDNLPv2 reassembly. The parser can extract a portion of name that appears in the first fragment, but cannot process subsequent fragments. The only way to capture non-first fragments is setting a / prefix as the only name filter entry, which disables the parser.

In the output file, each NDN-DPDK face appears as a separate network interface. Packets are written as Linux cooked-mode capture (SLL) link type. SLL is chosen instead of Ethernet because:

• By the time faceID is determined, the Ethernet header is already removed.
• In addition to Ethernet-based faces, NDN-DPDK also supports socket faces where no Ethernet headers exist.

EthPortSource type defines a packet dump source attached to an Ethernet port, at a specific grab opportunity. Currently, the only supported grab opportunity is RxUnmatched: it captures incoming packets on an Ethernet port that does not match any face. This is supported on RxTable receive path, as well as RxFlow receive path when not in flow isolation mode.

In the output file, each Ethernet port appears as a network interface. Packets are written as Ethernet link type, with the original Ethernet headers.