Slashdot Mirror

← Back to Stories (view on slashdot.org)

IEEE 1394 (FireWire) Testing?

Posted by ryuzaki0 on from the creative-benchmarking dept.

Cadre asks: "Can a regular COTS FireWire card be used for monitoring data (kind of like a regular COTS ethernet card can be put into promiscuous mode and the data can be monitored with libpcap)? I work for an organization that does a lot of databus monitoring and hardware-in-the-loop testing of large systems. Firewire has become popular (Ethernet too, but we've solved that problem with libpcap) and we're looking for a solution to monitor and simulate data. There are a couple manufactures that sell specialized equipment for FireWire testing that include onboard FPGAs but they seem more geared towards testing the FireWire bus than testing the overall systems on the bus."

15 comments

  1. Study the spec, then look at the chipsets. by stienman · · Score: 0, Redundant


    It's been awhile since I've studied firewire, but as far as I recall it's a relatively simple packet based protocol.

    I don't see why a common firewire card couldn't be used to snoop on the traffic on a bus. Because of the way endpoints and bus controllers are determined, and how data flows you may have to be careful about the placement of the snooping computer on the bus.

    The real trick is getting the chipset datasheet from the manufacturer.

    Good luck!

    -Adam

    1. Re:Study the spec, then look at the chipsets. by __david__ · · Score: 2, Informative
      Because of the way endpoints and bus controllers are determined, and how data flows you may have to be careful about the placement of the snooping computer on the bus.
      Wrong. FireWire is a broadcast protocol and the Phys are like ethernet hubs not ethernet switches. So every device on the bus gets all data delivered to it.

      The real trick is getting the chipset datasheet from the manufacturer.
      99% of all 1394 cards follow the OHCI spec (hence no need to get data from the manufacturer). The OHCI spec does not allow snoop mode. Annoying, eh?

      -David
      --
      There. Now go play some cool javascript games!
  2. COTS by zhiwenchong · · Score: 3, Informative

    Before anyone asks, COTS = Commercial Off the Shelf

    At least that's what Google says.

  3. Hm by PunkOfLinux · · Score: 0, Redundant

    Something you might want to look into is finding (or writing) a way to grab every bit that passes through the firewire port. I remember once i found a way to split the output from /dev/hda to go to both it's intended location along with /dev/dsp. Interesting result, and doing something similar might be useful for you.

    --
    Show this to your friends and family that don't know what a real hacker is
  4. tee by BoneMarrow · · Score: 1, Insightful

    The external tee command is used to write to the standard output and to a file simultaneously. You place the tee command anywhere in a pipe command to divert a copy of the standard input (of tee) to disk and another copy to your terminal. Thus its name is from the world of plumbing; it allows one input and two outputs. The tee command actually allows multiple file copies. For example, sort unsorted | tee sorted | cut -c-20,41- | tee cutup | lp from: http://www.softpanorama.org/Tools/tee.shtml

    --
    Unfortunately, no one can be told what my sig is...
  5. The short answer: No. by __david__ · · Score: 5, Informative

    For some moronic reason (I've heard it was bowing to pressure from content providers to make the firewire bus hard to sniff for the commoner--take that with a grain of salt), the OHCI spec (which 99% of all cards adhere to) does not include a way to enter promiscuous mode. So if you buy a cheap card you will not be able to monitor the bus.

    TI used to make a non-OHCI chip called the PCI Lynx that had a sniffing mode. Apple has a nice FireWire protocol analyzer called FireBug that works with the Lynx chip. I believe I may have seen Linux software at some point that does similar packet sniffing. But these PCI Lynx based cards can be hard to find. At my old job (where we did lots of Firewire stuff) we bought a big bulk purchase of Cardbus Lynx cards and converted a bunch of cheap old powerbooks into mobile firewire analyzers.

    -David

    --
    There. Now go play some cool javascript games!
    1. Re:The short answer: No. by stunted · · Score: 1

      But wouldn't it be possible to pipe the input of one 1394 port to the output of another and vice versa putting them through one of the Tee commands mentions up ^^ there? If this was possible the devices at each end would just see each other with out the need for a snoop - promiscuous mode.

      --
      In order to save our freedom it was necessary to destroy it.
    2. Re:The short answer: No. by __david__ · · Score: 1
      But wouldn't it be possible to pipe the input of one 1394 port to the output of another and vice versa putting them through one of the Tee commands mentions up ^^ there?
      It doesn't work that way. If packets are received by the ohci card but are addressed to other nodes on the bus then they get thrown away in hardware before the software gets a chance to get a hold of them.

      The repeater function of firewire is also completely handled by hardware so when a packet comes in one port and gets put out to another port it's still completely isolated from software.

      Besides, "tee" is in a completely different realm than firewire packets.

      -David

      Also, I'm talking about asynch bus packets here. Isoch packets (and asynch stream packets) have no destination address (just a channel number) and so any node can listen in on them.
      --
      There. Now go play some cool javascript games!
  6. You work for... by bergeron76 · · Score: 1

    If I didn't know any better, I'd think you worked for a Cable company.

    --
    Don't think that a small group of dedicated individuals can't change the world. It's the only thing that ever has.
  7. USB ? by RGRistroph · · Score: 1

    Is there a particular USB card I can buy, that will allow me to put it into either "host" or "periphial" (or whatever they are called) modes, so that I could make a USB snooper ?

  8. Firewine tasting? by Woldry · · Score: 1

    Swear to God, that's what I thought I read.

    I think it's time for bed now.

    --
    How can a post be modded "overrated" or "underrated" when it hasn't been rated yet?
  9. Snooping by Cadre · · Score: 1

    Thanks for the info! Very interesting...

    After googling around for info on the PCI Lynx chipset I found Nosy - A Snoop-Mode Driver (apparently promiscious mode is more commonly referred to as "snoop-mode" when dealing with FireWire) for Linux. It hasn't been updated for awhile though.

    With the PCI Lynx card being a bit hard to find (FireWire Depot did appear to have some in stock) and the drivers being a bit sketchy I think we'll probably end up going with specialized equipement like the FireSpy 3850. I at least tried to find a way to do it on the cheap. :-)

    --
    All editorial writers ever do is come down from the hill after the battle is over and shoot the wounded.
    1. Re:Snooping by Anonymous Coward · · Score: 0

      Ugh... sketchy drivers? How so? I'm the author; I use it regularly and it works for me. Granted, solutions such as dapdesigns sniffers is a more complete and userfriendly tool, but for simple traffic monitoring, nosy gets the job done. Also, nosy is a very small source package, and it's free software so it's easy to extend or customize.

      Kristian

    2. Re:Snooping by Cadre · · Score: 1

      Ah, just that I haven't found many cases of people using it which makes it hard to get a sense of the maturity of the project. Though to see that you the author are indeed alive :-) and have updated the web page I may still pursue it as an option for an inexpensive monitor.

      --
      All editorial writers ever do is come down from the hill after the battle is over and shoot the wounded.