Viewer Display

Decoding Assignments

The Analysis > Decoding Assignments... menu controls the decoding settings for the opened trace file. The default set of Decoding Assignments are set in the Setup > Preferences > Decoding Assignment menu (see Preferences). The decoded ports and types of traffic can be seen by selecting Analysis > Decoding Assignments in the Main Menu. If there is traffic in the trace that needs special decoding you can add port assignments and traffic types in the same window on a trace by trace basis. After the new assignments are made and the window is closed, the trace file decoding will automatically be updated to apply the new assignments.

The first option in the Analysis menu allows you to set decoding assignments by selecting Analysis > Decoding Assignments. When Decoding Assignments is selected the default Port Assignments and SCSI assignments will be displayed. You can also see the default SCSI traffic types that were decoded. You can also see the default SCSI decoding assignments. In this case all SCSI traffic used the SBC3 Command Set.

eCPRI ORAN UDP Ports: Specifies UDP port numbers for ORAN over IP/UDP.

QP Ports: Gives user the option to choose any of the following:

• User defined: Means if the software captures the connection phase, it extracts the QP port and uses it for the desired protocol, otherwise the user can add QP ports manually to “NVMe QP port” or “iSER QP Port” or “iSER QP Port”.

• NVMe: Means software considers any QP port as NVMe.

• iSER: Means software considers any QP port as iSER.

• SMB: Means software considers any QP port as SMB

There are two types of data traffic that can be associated with different Decoding Assignments:

• Port Assignments: See Port Assignments (Default Set from Preferences).

• Small Computer System Interface (SCSI) Assignments: See Default SCSI Decoding Assignments Found in Trace.

Port Assignments (Default Set from Preferences)

Initially the Net Protocol Suite software will decode all of the default port assignments set in the Preferences (see Preferences) and display them when you select Analysis > Decoding Assignments. In the captured trace the following Port Assignments and data traffic were decoded:

• SCSI TCP Ports

• VXLAN UDP Ports

• MPA TCP Ports (with Auto Detect)

• IB BTY UDP Ports

• NVMe QP Ports

• iSER QP Ports

If you know there are more ports in the system that were not decoded, you can add port numbers by typing into the appropriate Port type.

Select Analysis > Decoding Assignments to see the updated Port Number assignments.

Default SCSI Decoding Assignments Found in Trace

Initially, only SBC3 SCSI data traffic was detected.

If other types of SCSI traffic should have been decoded at specific address, you can update the types of traffic and addresses with the following decoding assignments:

• MMC—Multi-Media Commands

• SBC—Block Commands

• SMC—Medium Changer Commands

• SSC

• SCC—Controller Commands

• OSD—Object-Based Storage Devices Commands

• ADC—Automation/Drive Interface Commands

Script Column

The Script column identifies the script that will be used to decode the protocol. <Built-in> means that a built-in decoder will be used.

• Double-click in the cell to specify the path to a user-defined script (.udd).

See the Net Protocol Suite User-DeMMC: Multi-Media Commandsfined Decoding manual for details on how to write a decoding script.

• To select traffic types and apply a custom decoding script, double-click the far right tab , then select the script you have written.

An example has been placed in the directory shown below.

SMB Session Assignment

To decrypt SMB frames, Net Protocol Suite tries to detect the session key from a recorded trace. If it cannot be found, you must enter the session key manually.

TLS Decoding Assignment

If the key log file is not specified in the preferences during recording, or if it does not contain the secrets for the recorded trace, it can be added to the trace file.

IPSec Decoding Assignment

If the decryption information is not specified in the preferences before start recording, the appropriate decryption information can be added to the trace file later.

IKEv2 Columns

• SPI: Security Parameter Index

• Peer SPI: Peer Security Parameter Index

• Encryption: Encryption Algorithm type

• Encryption Key: Encryption Key related to the specified algorithm

• Integrity Algorithm: Integrity Algorithm type used to specify ICV size

ESP Columns

• Src IP: Source IP related to the SPI

• Dest IP: Destination IP related to the SPI

• SPI: Security Parameter Index

• Encryption: Encryption Algorithm type

• Encryption Key: Encryption Key related to the specified algorithm

• Integrity Algorithm: Integrity Algorithm type used to specified ICV size

• SN Length: Sequence Number Length. Can be 32 or 64 bits.

• ESN High Bit: Extended Sequence Number upper 32 bits when SN length is 64 bits.

Functionalities

• Import Wireshark ESP or IKEv2 log file: Users can import Wireshark csv log files for both ESP and IKEv2, and it will create new sessions based on the entry items or update existing ones.

• ESP log file: at least 8 comma-separated values as below orders:

  1. Protocol (IPv4 vs IPv6): It is used to detect ESP from IKEv2 files

  2. Src IP

  3. Dest IP

  4. SPI

  5. Encryption

  6. Encryption Key

  7. Authentication

  8. Authentication key

  9. SN (Optional): if it is not specified, it is considered as 32-bit

  10. ESN High Bits (Optional): if it is not specified, it is considered as zero.

• oIKEv2 log file: 8 comma-separated values as below orders:

  1. Initiator's SPI

  2. Responder's SPI

  3. SK_ei

  4. SK_er

  5. Encryption Algorithm

  6. SK_ai

  7. SK_ar

  8. Integrity Algorithm

• Add a new session

• Remove selected session

• Remove all sessions