FromDAGDump Element Documentation
- NAME
- SYNOPSIS
- DESCRIPTION
- NOTES
- ELEMENT HANDLERS
- SEE ALSO
- COMMENTS

This is automatically generated documentation. Edit after the "COMMENTS" heading; changes to the main body will be lost.

FromDAGDump Element Documentation

NAME

FromDAGDump -- Click element; reads packets from a DAG/ERF file

SYNOPSIS

FromDAGDump(FILENAME [, KEYWORDS])

Ports: no inputs, 1-2 outputs
Processing: agnostic, but output 1 is push
Drivers: userlevel
Package: analysis (core)

Reads packets from a file in ERF format, produced by the University of Waikato's DAG tools. Pushes them out the output, and optionally stops the driver when there are no more packets. FromDAGDump also transparently reads gzip- and bzip2-compressed files, if you have zcat(1) and bzcat(1) installed. Keyword arguments are:

STOP: Boolean. If true, then FromDAGDump will ask the router to stop when it is done reading its file (or the END time is reached). Default is false.

ACTIVE: Boolean. If false, then FromDAGDump will not emit packets (until the `active' handler is written). Default is true.

FORCE_IP: Boolean. If true, then FromDAGDump will emit only IP packets with their IP header annotations correctly set. (If FromDAGDump has two outputs, non-IP packets are pushed out on output 1; otherwise, they are dropped.) Default is false.

START: Absolute time in seconds since the epoch. FromDAGDump will output packets with timestamps after that time.

START_AFTER: Argument is relative time in seconds (or supply a suffix like `min', `h'). FromDAGDump will skip the first T seconds in the log.

END: Absolute time in seconds since the epoch. FromDAGDump will stop when encountering a packet with timestamp at or after that time.

END_AFTER: Argument is relative time in seconds (or supply a suffix like `min', `h'). FromDAGDump will stop at the first packet whose timestamp is at least T seconds after the first timestamp in the log.

INTERVAL: Argument is relative time in seconds (or supply a suffix like `min', `h'). FromDAGDump will stop at the first packet whose timestamp is at least T seconds after the first packet output.

END_CALL: Specify a handler to call once the end time is reached, or the dump runs out of packets. This defaults to 'FromDAGDump.active false'. END_CALL and STOP are mutually exclusive.

SAMPLE: Unsigned real number between 0 and 1. FromDAGDump will output each packet with probability SAMPLE. Default is 1. FromDAGDump uses fixed-point arithmetic, so the actual sampling probability may differ substantially from the requested sampling probability. Use the sampling_prob handler to find out the actual probability.

TIMING: Boolean. If true, then FromDAGDump tries to maintain the inter-packet timing of the original packet stream. False by default.

ENCAP: Legacy encapsulation type ("IP", "ATM", "SUNATM", "ETHER", "PPP", or "PPP_HDLC"). New-style ERF dumps contain an explicit encapsulation type on each packet; you should not provide an ENCAP option for new-style ERF dumps. Legacy-format dumps don't contain any encapsulation information, however, so you should supply an encapsulation type explicitly (or FromDAGDump will assume ENCAP type "ATM").

MMAP: Boolean. If true, then FromDAGDump will use mmap to access the tcpdump file. This can result in slightly better performance on some machines. FromDAGDump's regular file discipline is pretty optimized, so the difference is often small in practice. Default is true on most operating systems, but false on Linux. You can supply at most one of START and START_AFTER, and at most one of END, END_AFTER, and INTERVAL. Only available in user-level processes.

NOTES

FromDAGDump sets packets' extra length annotations to any additional length recorded in the dump.

ELEMENT HANDLERS

sampling_prob (read-only): Returns the sampling probability (see the SAMPLE keyword argument).

active (read/write): Value is a Boolean.

encap (read-only): Returns the previous packet's encapsulation type.

filename (read-only): Returns the filename supplied to FromDAGDump.

filesize (read-only): Returns the length of the FromDAGDump file, in bytes, or "-" if that length cannot be determined (because the file was compressed, for example).

filepos (read-only): Returns FromDAGDump's position in the (uncompressed) file, in bytes.

extend_interval (write-only): Text is a time interval. If END_TIME or one of its cousins was specified, then writing to this handler extends END_TIME by that many seconds. Also, ACTIVE is set to true.