[spp] [PATCH 0/6] Update docs of spp_pcap

[spp] [PATCH 0/6] Update docs of spp_pcap

[ogawa.yasufumi]

From: Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp>

This series of patches is to update docs of spp_pcap for typos, old
descriptions and lackness of explanations.

Yasufumi Ogawa (6):
  docs: update design and howto use of spp_pcap
  docs: update spp_pcap commands
  docs: move images of spp_pcap
  docs: update overview image of spp_pcap
  docs: rename files of usecases in spp_vf
  docs: update usecase of spp_pcap

 docs/guides/commands/secondary/spp_pcap.rst   | 109 +++++---
 .../{spp_pcap => spp_vf}/spp_pcap_design.svg  |  71 ++----
 .../spp_pcap_overview.svg                     |   0
 docs/guides/spp_vf/design.rst                 |  95 ++-----
 docs/guides/spp_vf/gsg/howto_use.rst          | 101 +++++---
 docs/guides/spp_vf/overview.rst               |   4 +-
 docs/guides/spp_vf/use_cases/index.rst        |  10 +-
 ...c_usecase_mirror.rst => mirror_simple.rst} |   0
 .../{usecase2.rst => mirror_vms.rst}          |   0
 docs/guides/spp_vf/use_cases/pcap_simple.rst  | 235 ++++++++++++++++++
 docs/guides/spp_vf/use_cases/usecase3.rst     | 164 ------------
 .../{basic_usecase_vf.rst => vf_simple.rst}   |   0
 .../{usecase1.rst => vf_ssh_login.rst}        |   0
 13 files changed, 409 insertions(+), 380 deletions(-)
 rename docs/guides/images/{spp_pcap => spp_vf}/spp_pcap_design.svg (90%)
 rename docs/guides/images/{spp_pcap => spp_vf}/spp_pcap_overview.svg (100%)
 rename docs/guides/spp_vf/use_cases/{basic_usecase_mirror.rst => mirror_simple.rst} (100%)
 rename docs/guides/spp_vf/use_cases/{usecase2.rst => mirror_vms.rst} (100%)
 create mode 100644 docs/guides/spp_vf/use_cases/pcap_simple.rst
 delete mode 100644 docs/guides/spp_vf/use_cases/usecase3.rst
 rename docs/guides/spp_vf/use_cases/{basic_usecase_vf.rst => vf_simple.rst} (100%)
 rename docs/guides/spp_vf/use_cases/{usecase1.rst => vf_ssh_login.rst} (100%)

-- 
2.17.1

[spp] [PATCH 1/6] docs: update design and howto use of spp_pcap

[ogawa.yasufumi]

From: Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp>

Some of descriptions are incorrect or remained old. This patch is to
update them. It also includes revising miscs.

Signed-off-by: Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp>
---
 docs/guides/spp_vf/design.rst        |  93 ++++--------------------
 docs/guides/spp_vf/gsg/howto_use.rst | 101 ++++++++++++++++++---------
 2 files changed, 83 insertions(+), 111 deletions(-)

diff --git a/docs/guides/spp_vf/design.rst b/docs/guides/spp_vf/design.rst
index 4774ef7..89b7059 100644
--- a/docs/guides/spp_vf/design.rst
+++ b/docs/guides/spp_vf/design.rst
@@ -18,6 +18,7 @@ Both of ``spp_vf`` and ``spp_mirror`` support three types of port,
 path between them.
 ``vhost`` is used to forward packets from a VM or sent to.
 
+
 .. _spp_vf_design_spp_vf:
 
 spp_vf
@@ -63,6 +64,7 @@ equals to 0x8100 as defined in IEEE 802.1Q standard.
 Classifier does not start forwarding until when at least one rx and two tx are
 added.
 
+
 .. _spp_vf_design_spp_mirror:
 
 spp_mirror
@@ -105,39 +107,27 @@ than ``deepcopy``, but it should be used for read only for the packet.
 You should choose ``deepcopy`` if you use VLAN feature to make no change for
 original packet while copied packet is modified.
 
+
 .. _spp_vf_design_spp_pcap:
 
 spp_pcap
 --------
-``spp_pcap`` cosisits of main thread, ``receiver`` thread runs on a core of
-the second smallest ID and ``wirter`` threads on the rest of cores. You should
-have enough cores if you need to capture large amount of packets.
-
-``spp_pcap`` has 4 types of command. ``start``, ``stop``, ``exit`` and ``status``
-to control behavior of ``spp_pcap``.
-
-With ``start`` command, you can start capturing.
-Incoming packets are received by ``receiver`` thread and it is transferred to
-``writer`` thread(s) via multi-producer/multi-consumer ring.
-Multi-producer/multi-consumer ring is the ring which multiple producers
-can enqueue and multiple consumers can dequeue. When those packets are
-received by ``writer`` thread(s), it will be compressed using LZ4 library and
-then be written to storage. In case more than 1 cores are assigned,
-incoming packets are written into storage per core basis so packet capture file
-will be divided per core.
-When ``spp_pcap`` has already been started, ``start`` command cannot
-be accepted.
 
-With ``stop`` command, capture will be stopped. When spp_pcap has already
-been stopped, ``stop`` command cannot be accepted.
+``spp_pcap`` cosisits of main thread, ``receiver`` thread and one or more
+``wirter`` threads. As design policy, the number of ``receiver`` is fixed
+to 1 because to make it simple and it is enough for task of receiving.
+``spp_pcap`` requires at least three lcores, and assign to from master,
+``receiver`` and then the rest of ``writer`` threads respectively.
 
-With ``exit`` command, ``spp_pcap`` exits the program. ``exit`` command
-during started state, stops capturing and then exits the program.
+Incoming packets are received by ``receiver`` thread and transferred to
+``writer`` threads via ring buffers between threads.
 
-With ``status`` command, status related to ``spp_pcap`` is shown.
+Several ``writer`` work in parallel to store packets as files in LZ4
+format. You can capture a certain amount of heavy traffic by using much
+``writer`` threads.
 
-In :numref:`figure_spp_pcap_design`,
-the internal structure of ``spp_pcap`` is shown.
+:numref:`figure_spp_pcap_design` shows an usecase of ``spp_pcap`` in which
+packets from ``phy:0`` are captured by using three ``writer`` threads.
 
 .. _figure_spp_pcap_design:
 
@@ -148,56 +138,3 @@ the internal structure of ``spp_pcap`` is shown.
 
 .. _spp_pcap_design_output_file_format:
 
-:numref:`figure_spp_pcap_design` shows the case when ``spp_pcap`` is connected
-with ``phy:0``.
-There is only one ``receiver`` thread and multiple ``writer`` threads.
-Each ``writer`` writes packets into file.
-Once exceeds maximum file size ,
-it creates new file so that multiple output files are created.
-
-
-Apptication option
-^^^^^^^^^^^^^^^^^^
-
-``spp_pcap`` specific options are:
-
- * -client-id: client id which can be seen as secondary ID from spp.py.
- * -s: IPv4 address and port for spp-ctl.
- * -i: port to which spp_pcap attached with.
- * --output: Output file path
-   where capture files are written.\
-   When this parameter is omitted,
-   ``/tmp`` is used.
- * --port_name: port_name which can be specified as
-   either of phy:N or \
-   ring:N.
-   When used as part of file name ``:`` is removed to avoid misconversion.
- * --limit_file_option: Maximum size of a capture file.
-   Default value is ``1GiB``.Captured files are not deleted automatically
-   because file rotation is not supported.
-
-The output file format is as following:
-
-.. code-block:: none
-
-    spp_pcap.YYYYMMDDhhmmss.[port_name].[wcore_num]
-    wcore_num is write core number which starts with 1
-
-Each ``writer`` thread has
-unique integer number which is used to determine the name of capture file.
-YYYYMMDDhhmmss is the time when ``spp_pcap`` receives ``start`` command.
-
-.. code-block:: none
-
-    /tmp/spp_pcap.20181108110600.ring0.1.2.pcap.lz4.tmp
-
-This example shows that ``receiver`` thread receives ``start`` command at
-20181108110600.  Port is ring:0, wcore_num is 1 and sequential number is 2.
-
-
-Until writing is finished, packets are stored into temporary file.
-The example is as following:
-
-.. code-block:: none
-
-    /tmp/spp_pcap.20181108110600.ring0.1.2.pcap.lz4.tmp
diff --git a/docs/guides/spp_vf/gsg/howto_use.rst b/docs/guides/spp_vf/gsg/howto_use.rst
index dc1a7bb..260527e 100644
--- a/docs/guides/spp_vf/gsg/howto_use.rst
+++ b/docs/guides/spp_vf/gsg/howto_use.rst
@@ -24,8 +24,8 @@ doing explicitly in this example to be more understandable.
 .. code-block:: console
 
     # Launch spp-ctl and spp.py
-    $ python3 ./src/spp-ctl/spp-ctl -b 127.0.0.1
-    $ python ./src/spp.py -b 127.0.0.1
+    $ python3 ./src/spp-ctl/spp-ctl -b 192.168.1.100
+    $ python ./src/spp.py -b 192.168.1.100
 
 
 SPP Primary
@@ -41,22 +41,23 @@ See `Running a Sample Application
 <http://dpdk.org/doc/guides/linux_gsg/build_sample_apps.html#running-a-sample-application>`_
 in DPDK documentation for options.
 
-Options of spp primary are:
+Application specific options of spp primary.
 
-  * -p : port mask
-  * -n : number of rings
-  * -s : IPv4 address and port for spp primary
+  * ``-p``: Port mask.
+  * ``-n``: Number of rings.
+  * ``-s``: IPv4 address and port for spp primary.
 
-Then, spp primary can be launched like this.
+This is an example of launching ``spp_primary``.
 
 .. code-block:: console
 
     $ sudo ./src/primary/x86_64-native-linuxapp-gcc/spp_primary \
-      -l 1 -n 4 --socket-mem 512,512 \
-      --huge-dir=/run/hugepages/kvm \
-      --proc-type=primary \
+      -l 0 -n 4 --socket-mem 512,512 \
+      --huge-dir /run/hugepages/kvm \
+      --proc-type primary \
       -- \
-      -p 0x03 -n 9 -s 127.0.0.1:5555
+      -p 0x03 -n 10 \
+      -s 192.168.1.100:5555
 
 
 .. _spp_vf_gsg_howto_use_spp_vf:
@@ -64,18 +65,14 @@ Then, spp primary can be launched like this.
 spp_vf
 ------
 
-``spp_vf`` can be launched with two kinds of options, like primary process.
+``spp_vf`` is a kind of secondary process, so it takes both of EAL options and
+application specific options. Here is a list of application specific options.
 
-Like primary process, ``spp_vf`` has two kinds of options. One is for
-DPDK, the other is ``spp_vf``.
+  * ``--client-id``: Client ID unique among secondary processes.
+  * ``-s``: IPv4 address and secondary port of spp-ctl.
+  * ``--vhost-client``: Enable vhost-user client mode.
 
-``spp_vf`` specific options are:
-
-  * --client-id: client id which can be seen as secondary ID from spp.py
-  * -s: IPv4 address and port for spp secondary
-  * --vhost-client: vhost-user client enable setting
-
-``spp_vf`` can be launched like this.
+This is an example of launching ``spp_vf``.
 
 .. code-block:: console
 
@@ -84,7 +81,7 @@ DPDK, the other is ``spp_vf``.
       --proc-type=secondary \
       -- \
       --client-id 1 \
-      -s 127.0.0.1:6666 \
+      -s 192.168.1.100:6666 \
       --vhost-client
 
 If ``--vhost-client`` option is specified, then ``vhost-user`` act as
@@ -100,24 +97,27 @@ See also `Vhost Sample Application
 spp_mirror
 ----------
 
-``spp_mirror`` takes the same options as ``spp_vf``. Here is an example.
+``spp_mirror`` is a kind of secondary process, and options are same as
+``spp_vf``.
 
 .. code-block:: console
 
     $ sudo ./src/mirror/x86_64-native-linuxapp-gcc/spp_mirror \
-      -l 2 -n 4 \
+      -l 1,2 -n 4 \
       --proc-type=secondary \
       -- \
       --client-id 1 \
-      -s 127.0.0.1:6666 \
+      -s 192.168.1.100:6666 \
       -vhost-client
 
+
 .. _spp_vf_gsg_howto_use_spp_pcap:
 
 spp_pcap
 --------
 
-After run ``spp_primary`` is launched, run secondary process ``spp_pcap``.
+``spp_pcap`` is a kind of secondary process, so it takes both of EAL options
+and application specific options.
 
 .. code-block:: console
 
@@ -126,15 +126,50 @@ After run ``spp_primary`` is launched, run secondary process ``spp_pcap``.
       --proc-type=secondary \
       -- \
       --client-id 1 \
-      -s 127.0.0.1:6666 \
-      -i phy:0 \
-      --output /mnt/pcap \
-      --limit_file_size 107374182
+      -s 192.168.1.100:6666 \
+      -c phy:0 \
+      --out-dir /path/to/dir \
+      --fsize 107374182
+
+Here is a list of ``spp_pcap`` specific options.
+
+ * ``-c``: Captured port, e.g. ``phy:0``, ``ring:1`` or so.
+ * ``--out-dir``: Optional. Path of dir for captured file. Default is ``/tmp``.
+ * ``--fsize``: Optional. Maximum size of a capture file. Default is ``1GiB``.
+
+Captured file of LZ4 is generated in ``/tmp`` by default.
+The name of file is consists of timestamp, resource ID of captured port,
+ID of ``writer`` threads and sequential number.
+Timestamp is decided when capturing is started and formatted as
+``YYYYMMDDhhmmss``.
+Both of ``writer`` thread ID and sequential number are started from ``1``.
+Sequential number is required for the case if the size of
+captured file is reached to the maximum and another file is generated to
+continue capturing.
+
+This is an example of captured file. It consists of timestamp,
+``20190214154925``, port ``phy0``, thread ID ``1`` and sequential number
+``1``.
+
+.. code-block:: none
+
+    /tmp/spp_pcap.20190214154925.phy0.1.1.pcap.lz4
+
+``spp_pcap`` also generates temporary files which are owned by each of
+``writer`` threads until capturing is finished or the size of captured file
+is reached to the maximum.
+This temporary file has additional extension ``tmp`` at the end of file
+name.
+
+.. code-block:: none
+
+    /tmp/spp_pcap.20190214154925.phy0.1.1.pcap.lz4.tmp
+
 
-VM
---
+Using VM with virsh
+-------------------
 
-VM is launched with ``virsh`` command.
+In this section, VM is launched with ``virsh`` command.
 
 .. code-block:: console
 
-- 
2.17.1

[spp] [PATCH 2/6] docs: update spp_pcap commands

[ogawa.yasufumi]

From: Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp>

* Update old example of `status` command.

* Add descriptions for worker threads and its status.

Signed-off-by: Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp>
---
 docs/guides/commands/secondary/spp_pcap.rst | 109 ++++++++++++--------
 1 file changed, 68 insertions(+), 41 deletions(-)

diff --git a/docs/guides/commands/secondary/spp_pcap.rst b/docs/guides/commands/secondary/spp_pcap.rst
index 33882f0..b7f04de 100644
--- a/docs/guides/commands/secondary/spp_pcap.rst
+++ b/docs/guides/commands/secondary/spp_pcap.rst
@@ -1,6 +1,7 @@
 ..  SPDX-License-Identifier: BSD-3-Clause
     Copyright(c) 2010-2014 Intel Corporation
 
+
 .. _commands_spp_pcap:
 
 spp_pcap
@@ -21,7 +22,7 @@ processes including ``spp_nfv``, ``spp_vm`` and others.
 and sub command should be separated with delimiter ``;``, or failed to a
 command error.
 
-.. code-block:: console
+.. code-block:: none
 
     spp > pcap SEC_ID; SUB_CMD
 
@@ -29,23 +30,23 @@ In this example, ``SEC_ID`` is a secondary ID and ``SUB_CMD`` is one of the
 following sub commands. Details of each of sub commands are described in the
 next sections.
 
-* exit
-* start
 * status
+* start
 * stop
+* exit
 
 ``spp_pcap`` supports TAB completion. You can complete all of the name
 of commands and its arguments. For instance, you find all of sub commands
 by pressing TAB after ``pcap SEC_ID;``.
 
-.. code-block:: console
+.. code-block:: none
 
     spp > pcap 1;  # press TAB key
     exit  start      status        stop
 
 It tries to complete all of possible arguments.
 
-.. code-block:: console
+.. code-block:: none
 
     spp > pcap 1; component st  # press TAB key to show args starting 'st'
     start  status  stop
@@ -54,14 +55,15 @@ If you are reached to the end of arguments, no candidate keyword is displayed.
 It is a completed statement of ``start`` command, and TAB
 completion does not work after ``start`` because it is ready to run.
 
-.. code-block:: console
+.. code-block:: none
 
     spp > pcap 1; start
     Succeeded to start capture
 
-It is also completed secondary IDs of ``spp_pcap`` and it is helpful if you run several ``spp_pcap`` processes.
+It is also completed secondary IDs of ``spp_pcap`` and it is helpful if you
+run several ``spp_pcap`` processes.
 
-.. code-block:: console
+.. code-block:: none
 
     spp > pcap  # press TAB after space following 'pcap'
     1;  3;    # you find two spp_pcap processes of sec ID 1, 3
@@ -70,7 +72,7 @@ By the way, it is also a case of no candidate keyword is displayed if your
 command statement is wrong. You might be encountered an error if you run the
 wrong command. Please take care.
 
-.. code-block:: console
+.. code-block:: none
 
     spp > pcap 1; ste  # no candidate shown for wrong command
     Invalid command "ste".
@@ -81,70 +83,95 @@ wrong command. Please take care.
 status
 ------
 
-Show the information of worker threads and its resources. Status information
-consists of three parts.
+Show the information of worker threads of ``receiver`` and ``writer`` threads
+and its resources.
 
-.. code-block:: console
+.. code-block:: none
 
     spp > pcap 1; status
-    Basic Information:
-      - client-id: 3
+      - client-id: 1
+      - status: idling
+      - core:2 receive
+        - rx: phy:0
+      - core:3 write
+        - filename:
+      - core:4 write
+        - filename:
+      - core:5 write
+        - filename:
+      - core:6 write
+        - filename:
+
+``client-id`` is a secondary ID of the process and ``status`` shows
+running status.
+
+Each of lcore has a role of ``receive`` or ``write``.
+``receiver`` has capture port as input and ``write`` has a capture file
+as output, but the ``filename`` is empty while ``idling`` status
+because capturing is not started yet.
+
+If you start capturing, you can find each of ``writer`` threads has a
+capture file. After capturing is stopped, ``filename`` is returned to
+be empty again.
+
+.. code-block:: none
+
+    spp > pcap 2; status
+      - client-id: 2
       - status: running
-      - core:2 'receive'
+      - core:2 receive
         - rx: phy:0
-      - core:3 'write'
-        - file:/tmp/spp_pcap.20181108110600.phy0.1.1.pcap
-      - core:4 'write'
-        - file:/tmp/spp_pcap.20181108110600.phy0.2.1.pcap
-      - core:5 'write'
-        - file:/tmp/spp_pcap.20181108110600.phy0.3.1.pcap
-
-``Basic Information`` is for describing attributes of ``spp_pcap`` itself.
-``client-id`` is a secondary ID of the process and ``status`` shows the
-status of the process.
-
-Then lists of core IDs and its role is shown. There are two types of the role
-``receive`` and ``write``. If the role is ``receive``, port which ``spp_pcap``
-is attached to is shown. Else if the role iw ``write``, file name in absolute
-path is shown.
+      - core:3 write
+        - filename: /tmp/spp_pcap.20190214161550.phy0.1.1.pcap.lz4
+      - core:4 write
+        - filename: /tmp/spp_pcap.20190214161550.phy0.2.1.pcap.lz4
+      - core:5 write
+        - filename: /tmp/spp_pcap.20190214161550.phy0.3.1.pcap.lz4
+      - core:6 write
+        - filename: /tmp/spp_pcap.20190214161550.phy0.4.1.pcap.lz4
+
 
 .. _commands_spp_pcap_start:
 
 start
 -----
 
-Start packet capture. No additional arguments are taken.
+Start packet capture.
 
-.. code-block:: console
+.. code-block:: none
 
     # start capture
     spp > pcap SEC_ID; start
 
-Here is a example of starting capture with ``start`` command.
+Here is a example of starting capture.
 
-.. code-block:: console
+.. code-block:: none
 
     # start capture
-    spp > pcap 2; start
+    spp > pcap 1; start
+    Start packet capture.
+
 
 .. _commands_spp_pcap_stop:
 
 stop
 ----
 
-Stop packet capture. No additional arguments are taken.
+Stop packet capture.
 
-.. code-block:: console
+.. code-block:: none
 
-   # start capture
+   # stop capture
    spp > pcap SEC_ID; stop
 
-Here is a example of stopping capture with ``stop`` command.
+Here is a example of stopping capture.
 
-.. code-block:: console
+.. code-block:: none
 
     # stop capture
     spp > pcap 2; stop
+    Start packet capture.
+
 
 .. _commands_spp_pcap_exit:
 
@@ -153,6 +180,6 @@ exit
 
 Terminate the ``spp_pcap``.
 
-.. code-block:: console
+.. code-block:: none
 
     spp > pcap 1; exit
-- 
2.17.1

[spp] [PATCH 3/6] docs: move images of spp_pcap

[ogawa.yasufumi]

From: Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp>

Correct path of images of spp_pcap placed in `images/spp_pcap` but
should be in `images/spp_vf` conventionally.

Signed-off-by: Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp>
---
 docs/guides/images/{spp_pcap => spp_vf}/spp_pcap_design.svg   | 0
 docs/guides/images/{spp_pcap => spp_vf}/spp_pcap_overview.svg | 0
 docs/guides/spp_vf/design.rst                                 | 2 +-
 docs/guides/spp_vf/overview.rst                               | 4 ++--
 docs/guides/spp_vf/use_cases/usecase3.rst                     | 4 ++--
 5 files changed, 5 insertions(+), 5 deletions(-)
 rename docs/guides/images/{spp_pcap => spp_vf}/spp_pcap_design.svg (100%)
 rename docs/guides/images/{spp_pcap => spp_vf}/spp_pcap_overview.svg (100%)

diff --git a/docs/guides/images/spp_pcap/spp_pcap_design.svg b/docs/guides/images/spp_vf/spp_pcap_design.svg
similarity index 100%
rename from docs/guides/images/spp_pcap/spp_pcap_design.svg
rename to docs/guides/images/spp_vf/spp_pcap_design.svg
diff --git a/docs/guides/images/spp_pcap/spp_pcap_overview.svg b/docs/guides/images/spp_vf/spp_pcap_overview.svg
similarity index 100%
rename from docs/guides/images/spp_pcap/spp_pcap_overview.svg
rename to docs/guides/images/spp_vf/spp_pcap_overview.svg
diff --git a/docs/guides/spp_vf/design.rst b/docs/guides/spp_vf/design.rst
index 89b7059..b1e864a 100644
--- a/docs/guides/spp_vf/design.rst
+++ b/docs/guides/spp_vf/design.rst
@@ -131,7 +131,7 @@ packets from ``phy:0`` are captured by using three ``writer`` threads.
 
 .. _figure_spp_pcap_design:
 
-.. figure:: ../images/spp_pcap/spp_pcap_design.*
+.. figure:: ../images/spp_vf/spp_pcap_design.*
     :width: 55%
 
     spp_pcap internal structure
diff --git a/docs/guides/spp_vf/overview.rst b/docs/guides/spp_vf/overview.rst
index 09c21af..adaced6 100644
--- a/docs/guides/spp_vf/overview.rst
+++ b/docs/guides/spp_vf/overview.rst
@@ -101,7 +101,7 @@ threads unlike spp_vf.
 
 .. _figure_spp_pcap_overview:
 
-.. figure:: ../images/spp_pcap/spp_pcap_overview.*
-   :width: 55%
+.. figure:: ../images/spp_vf/spp_pcap_overview.*
+   :width: 50%
 
    Overview of spp_pcap
diff --git a/docs/guides/spp_vf/use_cases/usecase3.rst b/docs/guides/spp_vf/use_cases/usecase3.rst
index 146ef06..c31324e 100644
--- a/docs/guides/spp_vf/use_cases/usecase3.rst
+++ b/docs/guides/spp_vf/use_cases/usecase3.rst
@@ -13,8 +13,8 @@ Incoming packets received by ``phy:0`` is captured by ``spp_pcap``.
 
 .. _figure_simple_capture:
 
-.. figure:: ../../images/spp_pcap/spp_pcap_overview.*
-    :width: 40%
+.. figure:: ../../images/spp_vf/spp_pcap_overview.*
+    :width: 50%
 
     Simple Packet Capture
 
-- 
2.17.1

[spp] [PATCH 4/6] docs: update overview image of spp_pcap

[ogawa.yasufumi]

From: Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp>

Update old design of spp_pcap for which ring PMDs between receiver and
writers are replaced with ring buffers. This ring buffers are no need
to be depicted explicitly.

Signed-off-by: Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp>
---
 docs/guides/images/spp_vf/spp_pcap_design.svg | 71 ++++---------------
 1 file changed, 15 insertions(+), 56 deletions(-)

diff --git a/docs/guides/images/spp_vf/spp_pcap_design.svg b/docs/guides/images/spp_vf/spp_pcap_design.svg
index 4132ad3..5f44431 100644
--- a/docs/guides/images/spp_vf/spp_pcap_design.svg
+++ b/docs/guides/images/spp_vf/spp_pcap_design.svg
@@ -111,22 +111,6 @@
          transform="matrix(-1.1,0,0,-1.1,-1.1,0)"
          inkscape:connector-curvature="0" />
     </marker>
-    <marker
-       inkscape:isstock="true"
-       style="overflow:visible"
-       id="marker7263"
-       refX="0"
-       refY="0"
-       orient="auto"
-       inkscape:stockid="Arrow2Lend"
-       inkscape:collect="always">
-      <path
-         transform="matrix(-1.1,0,0,-1.1,-1.1,0)"
-         d="M 8.7185878,4.0337352 -2.2072895,0.01601326 8.7185884,-4.0017078 c -1.7454984,2.3720609 -1.7354408,5.6174519 -6e-7,8.035443 z"
-         style="fill:#000000;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:0.625;stroke-linejoin:round;stroke-opacity:1"
-         id="path7265"
-         inkscape:connector-curvature="0" />
-    </marker>
     <marker
        inkscape:stockid="Arrow2Lend"
        orient="auto"
@@ -264,15 +248,15 @@
      inkscape:pageopacity="0.0"
      inkscape:pageshadow="2"
      inkscape:zoom="0.76531459"
-     inkscape:cx="271.83531"
+     inkscape:cx="164.12939"
      inkscape:cy="362.20796"
      inkscape:document-units="mm"
-     inkscape:current-layer="layer4"
+     inkscape:current-layer="layer5"
      showgrid="false"
      inkscape:window-width="1426"
      inkscape:window-height="818"
-     inkscape:window-x="311"
-     inkscape:window-y="125"
+     inkscape:window-x="249"
+     inkscape:window-y="77"
      inkscape:window-maximized="0"
      inkscape:snap-bbox="true"
      showguides="false" />
@@ -284,7 +268,7 @@
         <dc:format>image/svg+xml</dc:format>
         <dc:type
            rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title></dc:title>
+        <dc:title />
       </cc:Work>
     </rdf:RDF>
   </metadata>
@@ -328,8 +312,8 @@
        id="rect4534-6"
        width="34.694183"
        height="11.69418"
-       x="21.933159"
-       y="252.36502"
+       x="27.577595"
+       y="230.91638"
        ry="5.8470902" />
     <rect
        style="display:inline;opacity:1;fill:#fffdc4;fill-opacity:1;stroke:#000000;stroke-width:0.30582079;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
@@ -355,13 +339,6 @@
        x="73.103943"
        y="245.7545"
        ry="5.8470902" />
-    <ellipse
-       style="opacity:1;fill:#ecffe7;fill-opacity:1;stroke:#000000;stroke-width:0.31809619;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
-       id="path4591-7"
-       cx="50.028481"
-       cy="236.70683"
-       rx="12.399846"
-       ry="8.30762" />
   </g>
   <g
      inkscape:groupmode="layer"
@@ -419,20 +396,13 @@
      transform="translate(0,-42.000003)">
     <path
        style="display:inline;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.28200001;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#Arrow2Lend)"
-       d="M 58.091979,136.62018 C 58.678404,123.93418 42.742918,135.2661 40.022432,117.1054"
+       d="M 59.161449,136.41559 C 59.596546,110.39133 47.773237,133.63781 45.754776,96.382652"
        id="path4870"
        inkscape:connector-curvature="0"
        sodipodi:nodetypes="cc" />
-    <path
-       transform="translate(0,-147)"
-       style="display:inline;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.28222224px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#marker7263)"
-       d="m 38.351688,252.37928 c -0.04844,-5.4068 1.862363,-10.26219 1.862363,-10.26219"
-       id="path4872"
-       inkscape:connector-curvature="0"
-       sodipodi:nodetypes="cc" />
     <path
        style="display:inline;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.28222224px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#marker7421)"
-       d="m 62.690261,89.153976 9.593075,0"
+       d="m 61.952727,89.154577 10.273387,0"
        id="path4874"
        inkscape:connector-curvature="0" />
     <path
@@ -510,25 +480,25 @@
     <text
        xml:space="preserve"
        style="font-style:normal;font-weight:normal;font-size:6.3499999px;line-height:125%;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
-       x="49.098038"
+       x="50.226929"
        y="203.49767"
        id="text4709"
        sodipodi:linespacing="125%"><tspan
          sodipodi:role="line"
          id="tspan4711"
-         x="49.098038"
+         x="50.226929"
          y="203.49767">phy:0</tspan></text>
     <text
        xml:space="preserve"
        style="font-style:normal;font-weight:normal;font-size:6.3499999px;line-height:125%;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
-       x="26.065516"
-       y="172.97249"
+       x="31.709951"
+       y="151.52385"
        id="text4713"
        sodipodi:linespacing="125%"><tspan
          sodipodi:role="line"
          id="tspan4715"
-         x="26.065516"
-         y="172.97249">receiver</tspan></text>
+         x="31.709951"
+         y="151.52385">receiver</tspan></text>
     <text
        xml:space="preserve"
        style="font-style:normal;font-weight:normal;font-size:6.3499999px;line-height:125%;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
@@ -562,16 +532,5 @@
          id="tspan4719-1-6"
          x="78.404999"
          y="135.33348">writer3</tspan></text>
-    <text
-       xml:space="preserve"
-       style="font-style:normal;font-weight:normal;font-size:6.35000038px;line-height:125%;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
-       x="40.917755"
-       y="151.19307"
-       id="text4866"
-       sodipodi:linespacing="125%"><tspan
-         sodipodi:role="line"
-         id="tspan4868"
-         x="40.917755"
-         y="151.19307">ring:0</tspan></text>
   </g>
 </svg>
-- 
2.17.1

[spp] [PATCH 5/6] docs: rename files of usecases in spp_vf

[ogawa.yasufumi]

From: Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp>

The filenames of usecases in spp_vf is not understandable for which of
usecases, for instance, `usecase1.rst` or so. This update is to revise
the filenames and update `index.rst`.

Signed-off-by: Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp>
---
 docs/guides/spp_vf/use_cases/index.rst                 | 10 +++++-----
 .../{basic_usecase_mirror.rst => mirror_simple.rst}    |  0
 .../spp_vf/use_cases/{usecase2.rst => mirror_vms.rst}  |  0
 .../spp_vf/use_cases/{usecase3.rst => pcap_simple.rst} |  0
 .../use_cases/{basic_usecase_vf.rst => vf_simple.rst}  |  0
 .../use_cases/{usecase1.rst => vf_ssh_login.rst}       |  0
 6 files changed, 5 insertions(+), 5 deletions(-)
 rename docs/guides/spp_vf/use_cases/{basic_usecase_mirror.rst => mirror_simple.rst} (100%)
 rename docs/guides/spp_vf/use_cases/{usecase2.rst => mirror_vms.rst} (100%)
 rename docs/guides/spp_vf/use_cases/{usecase3.rst => pcap_simple.rst} (100%)
 rename docs/guides/spp_vf/use_cases/{basic_usecase_vf.rst => vf_simple.rst} (100%)
 rename docs/guides/spp_vf/use_cases/{usecase1.rst => vf_ssh_login.rst} (100%)

diff --git a/docs/guides/spp_vf/use_cases/index.rst b/docs/guides/spp_vf/use_cases/index.rst
index 2a0fadb..c9b5206 100644
--- a/docs/guides/spp_vf/use_cases/index.rst
+++ b/docs/guides/spp_vf/use_cases/index.rst
@@ -7,8 +7,8 @@ Use Cases
 .. toctree::
    :maxdepth: 2
 
-   basic_usecase_vf
-   usecase1
-   basic_usecase_mirror
-   usecase2
-   usecase3
+   vf_simple
+   vf_ssh_login
+   mirror_simple
+   mirror_vms
+   pcap_simple
diff --git a/docs/guides/spp_vf/use_cases/basic_usecase_mirror.rst b/docs/guides/spp_vf/use_cases/mirror_simple.rst
similarity index 100%
rename from docs/guides/spp_vf/use_cases/basic_usecase_mirror.rst
rename to docs/guides/spp_vf/use_cases/mirror_simple.rst
diff --git a/docs/guides/spp_vf/use_cases/usecase2.rst b/docs/guides/spp_vf/use_cases/mirror_vms.rst
similarity index 100%
rename from docs/guides/spp_vf/use_cases/usecase2.rst
rename to docs/guides/spp_vf/use_cases/mirror_vms.rst
diff --git a/docs/guides/spp_vf/use_cases/usecase3.rst b/docs/guides/spp_vf/use_cases/pcap_simple.rst
similarity index 100%
rename from docs/guides/spp_vf/use_cases/usecase3.rst
rename to docs/guides/spp_vf/use_cases/pcap_simple.rst
diff --git a/docs/guides/spp_vf/use_cases/basic_usecase_vf.rst b/docs/guides/spp_vf/use_cases/vf_simple.rst
similarity index 100%
rename from docs/guides/spp_vf/use_cases/basic_usecase_vf.rst
rename to docs/guides/spp_vf/use_cases/vf_simple.rst
diff --git a/docs/guides/spp_vf/use_cases/usecase1.rst b/docs/guides/spp_vf/use_cases/vf_ssh_login.rst
similarity index 100%
rename from docs/guides/spp_vf/use_cases/usecase1.rst
rename to docs/guides/spp_vf/use_cases/vf_ssh_login.rst
-- 
2.17.1

[spp] [PATCH 6/6] docs: update usecase of spp_pcap

[ogawa.yasufumi]

From: Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp>

This patch is to revise usecase of spp_pcap.

Signed-off-by: Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp>
---
 docs/guides/spp_vf/use_cases/pcap_simple.rst | 253 ++++++++++++-------
 1 file changed, 162 insertions(+), 91 deletions(-)

diff --git a/docs/guides/spp_vf/use_cases/pcap_simple.rst b/docs/guides/spp_vf/use_cases/pcap_simple.rst
index c31324e..34efce3 100644
--- a/docs/guides/spp_vf/use_cases/pcap_simple.rst
+++ b/docs/guides/spp_vf/use_cases/pcap_simple.rst
@@ -1,164 +1,235 @@
 ..  SPDX-License-Identifier: BSD-3-Clause
     Copyright(c) 2019 Nippon Telegraph and Telephone Corporation
 
-.. _spp_pcap_use_case:
-
-Packet Capture
-==============
 
+.. _spp_pcap_use_case:
 
-This section describes a usecase for Packet Capture through ``spp_pcap``.
+Packet Capture with spp_pcap
+============================
 
-Incoming packets received by ``phy:0`` is captured by ``spp_pcap``.
+This section describes a usecase for capturing packets with ``spp_pcap``
+and seeing inside of the captured file with ``tcpdump`` command.
+:numref:`figure_simple_capture` shows the overview of scenario in which
+incoming packets via ``phy:0`` are dumped as compressed pcap files by using
+``spp_pcap``.
 
 .. _figure_simple_capture:
 
 .. figure:: ../../images/spp_vf/spp_pcap_overview.*
     :width: 50%
 
-    Simple Packet Capture
+    Packet capture with spp_pcap
+
+
+.. _spp_pcap_use_case_launch_pcap:
 
 Launch spp_pcap
 ~~~~~~~~~~~~~~~
 
-Change directory to spp and confirm that it is already compiled.
+Change directory if you are not in SPP's directory,
+and compile if not done yet.
 
 .. code-block:: console
 
     $ cd /path/to/spp
 
-As spp, launch spp-ctl and spp.py first.
+Launch spp-ctl and SPP CLI in different terminals.
 
 .. code-block:: console
 
-    # Launch spp-ctl and spp.py
-    $ python3 ./src/spp-ctl/spp-ctl -b 127.0.0.1
-    $ python ./src/spp.py -b 127.0.0.1
+    # terminal 1
+    $ python3 ./src/spp-ctl/spp-ctl -b 192.168.1.100
+
+.. code-block:: console
+
+    # terminal 2
+    $ python3 ./src/spp.py -b 192.168.1.100
 
 
-Then, run ``spp_primary``.
+Then, run ``spp_primary`` with one physical port.
 
 .. code-block:: console
 
+    # terminal 3
     $ sudo ./src/primary/x86_64-native-linuxapp-gcc/spp_primary \
-        -c 0x02 -n 4 \
+        -l 0 -n 4 \
         --socket-mem 512,512 \
-        --huge-dir=/run/hugepages/kvm \
-        --proc-type=primary \
+        --huge-dir /run/hugepages/kvm \
+        --proc-type primary \
         -- \
-        -p 0x03 -n 8 -s 127.0.0.1:5555
+        -p 0x01 \
+        -n 8 -s 192.168.1.100:5555
 
-After ``spp_primary`` is launched, run secondary process ``spp_pcap``.
-If not ``--output`` directory is not created, please create it first.
+After ``spp_primary`` is launched successfully, run ``spp_pcap`` in other
+terminal. In this usecase, you use default values for optional arguments.
+Output directory of captured file is ``/tmp`` and the size of file is
+``1GiB``.
+You notice that six lcores are assigned with ``-l 1-6``.
+It means that you use one locre for master, one for receiver, and four for
+writer threads.
 
 .. code-block:: console
 
-    $ sudo mkdir /mnt/pcap
+    # terminal 4
     $ sudo ./src/pcap/x86_64-native-linuxapp-gcc/spp_pcap \
-       -l 0-4 -n 4 --proc-type=secondary \
+       -l 1-6 -n 4 --proc-type=secondary \
        -- \
-       --client-id 1 -s 127.0.0.1:6666 \
-       -i phy:0 --output /mnt/pcap --limit_file_size 1073741824
+       --client-id 1 -s 192.168.1.100:6666 \
+       -c phy:0
 
-Start capturing
-~~~~~~~~~~~~~~~
-When you want to start capture, then type the following command.
+You can confirm lcores and worker threads running on from ``status`` command.
 
-.. code-block:: console
+.. code-block:: none
 
-    spp > pcap SEC_ID; start
+    # terminal 2
+    spp > pcap 1; status
+      - client-id: 1
+      - status: idle
+      - core:2 receive
+        - rx: phy:0
+      - core:3 write
+        - filename:
+      - core:4 write
+        - filename:
+      - core:5 write
+        - filename:
+      - core:6 write
+        - filename:
 
-In this usecase, spp_pcap is launched with ID=1. Let's start capturing.
 
-.. code-block:: console
+.. _spp_pcap_use_case_start_capture:
 
-    # Start packet capture
-    spp > pcap 1;start
+Start Capture
+~~~~~~~~~~~~~
 
-Stop capturing
-~~~~~~~~~~~~~~
+If you already started to send packets to ``phy:0`` from outside,
+you are ready to start capturing packets.
 
-When you want to stop capture, then type the following command.
+.. code-block:: none
 
-.. code-block:: console
+    # terminal 2
+    spp > pcap 1; start
+    Start packet capture.
 
-    spp > pcap SEC_ID; stop
+As you run ``start`` command, PCAP files are generated for each of
+``writer`` threads for capturing.
 
-In this usecase, spp_pcap is launched with ID=1. Let's stop capturing.
+.. code-block:: none
 
-.. code-block:: console
+    # terminal 2
+    spp > pcap 1; status
+      - client-id: 1
+      - status: running
+      - core:2 receive
+        - rx: phy:0
+      - core:3 write
+        - filename: /tmp/spp_pcap.20190214161550.phy0.1.1.pcap.lz4
+      - core:4 write
+        - filename: /tmp/spp_pcap.20190214161550.phy0.2.1.pcap.lz4
+      - core:5 write
+        - filename: /tmp/spp_pcap.20190214161550.phy0.3.1.pcap.lz4
+      - core:6 write
+        - filename: /tmp/spp_pcap.20190214161550.phy0.4.1.pcap.lz4
 
-    # Stop packet capture
-    spp > pcap 1;stop
 
+.. _spp_pcap_use_case_stop_capture:
 
-Now, you can see capture file written in specified directory.
+Stop Capture
+~~~~~~~~~~~~
 
-.. code-block:: console
+Stop capturing and confirm that compressed PCAP files are generated.
 
-    # show the content of directry
-    $ cd /mnt/pcap
-    $ ls
-      spp_pcap.20181108110600.phy0.1.1.pcap.lz4
-      spp_pcap.20181108110600.phy0.2.1.pcap.lz4
-      spp_pcap.20181108110600.phy0.3.1.pcap.lz4
+.. code-block:: none
 
-Each files are compressed using LZ4, so that to uncompress it,
-use lz4 utils.
+    # terminal 2
+    spp > pcap 1; stop
+    spp > ls /tmp
+    ....
+    spp_pcap.20190214175446.phy0.1.1.pcap.lz4
+    spp_pcap.20190214175446.phy0.1.2.pcap.lz4
+    spp_pcap.20190214175446.phy0.1.3.pcap.lz4
+    spp_pcap.20190214175446.phy0.2.1.pcap.lz4
+    spp_pcap.20190214175446.phy0.2.2.pcap.lz4
+    spp_pcap.20190214175446.phy0.2.3.pcap.lz4
+    ....
 
-.. code-block:: console
-
-    # uncompress lz4 files
-    $ sudo lz4 -d -m spp_pcap.20181108110600.phy0.*
-    $ ls
-      spp_pcap.20181108110600.phy0.1.1.pcap
-      spp_pcap.20181108110600.phy0.2.1.pcap
-      spp_pcap.20181108110600.phy0.3.1.pcap
-      spp_pcap.20181108110600.phy0.1.1.pcap.lz4
-      spp_pcap.20181108110600.phy0.2.1.pcap.lz4
-      spp_pcap.20181108110600.phy0.3.1.pcap.lz4
-
-To combine those divided pcap files using mergecap utility.
-
-.. code-block:: console
+Index in the filename, such as ``1.1`` or ``1.2``, is a combination of
+``writer`` thread ID and sequenceal number.
+In this case, it means each of four threads generate three files.
 
-    # merge pcap files
-    $ sudo mergecap spp_pcap.20181108110600.phy0.1.1.pcap \
-      spp_pcap.20181108110600.phy0.2.1.pcap \
-      spp_pcap.20181108110600.phy0.3.1.pcap \
-      -w test.pcap
-    $ ls
-      spp_pcap.20181108110600.phy0.1.1.pcap
-      spp_pcap.20181108110600.phy0.2.1.pcap
-      spp_pcap.20181108110600.phy0.3.1.pcap
-      spp_pcap.20181108110600.phy0.1.1.pcap.lz4
-      spp_pcap.20181108110600.phy0.2.1.pcap.lz4
-      spp_pcap.20181108110600.phy0.3.1.pcap.lz4
-      test.pcap
 
 .. _spp_pcap_use_case_shutdown:
 
 Shutdown spp_pcap
 ~~~~~~~~~~~~~~~~~
 
-Basically, you can shutdown all of SPP processes with ``bye all``
-command.
+Run ``exit`` or ``bye sec`` command to terminate ``spp_pcap``.
 
-This section describes graceful shutting down for ``spp_pcap``.
+.. code-block:: none
 
-First, stop capturing using the following command if it is not
-already stopped.
+    # terminal 2
+    spp > pcap 1; exit
+
+
+.. _spp_pcap_use_case_inspect_file:
+
+Inspect PCAP Files
+~~~~~~~~~~~~~~~~~~
+
+You can inspect captured PCAP files by using utilities.
+
+Merge PCAP Files
+^^^^^^^^^^^^^^^^
+
+Extract and merge compressed PCAP files.
+
+For extract several LZ4 files at once, use ``-d`` and ``-m`` options.
+``-d`` is for decompression and ``-m`` is for multiple files.
+
+You had better not to merge divided files into single file, but still
+several files because the size of merged file might be huge.
+Each of extracted PCAP file is 1GiB in default, so total size of extracted
+files is 12GiB in this case. To avoid the situation, merge files for each of
+threads and generate four PCAP files of 3GiB.
+
+First, extract LZ4 files of writer thread ID 1.
 
 .. code-block:: console
 
-    # Stop packet capture
-    spp > pcap 1;stop
+    # terminal 4
+    $ lz4 -d -m /tmp/spp_pcap.20190214175446.phy0.1.*
+
+And confirm that the files are extracted.
+
+.. code-block:: console
+
+    # terminal 4
+    $ ls /tmp | grep pcap$
+    spp_pcap.20190214175446.phy0.1.1.pcap
+    spp_pcap.20190214175446.phy0.1.2.pcap
+    spp_pcap.20190214175446.phy0.1.3.pcap
+
+Run ``mergecap`` command to merge extracted files to current directory
+as ``spp_pcap1.pcap``.
+
+.. code-block:: console
+
+    # terminal 4
+    $ mergecap /tmp/spp_pcap.20190214175446.phy0.1.*.pcap -w spp_pcap1.pcap
+
+Inspect PCAP file
+^^^^^^^^^^^^^^^^^
 
-If you want to start capture again then use ``start`` command again.
-Else if you want to quit ``spp_pcap`` itself, type the following command
-and quit application.
+You can use any of applications, for instance ``wireshark`` or ``tcpdump``,
+for inspecting PCAP file.
+To inspect the merged PCAP file, read packet data from ``tcpdump`` command
+in this usecase. ``-r`` option is to dump packet data in human readable format.
 
 .. code-block:: console
 
-    # Exit packet capture
-    spp > pcap 1;exit
+    # terminal 4
+    $ tcpdump -r spp_pcap1.pcap | less
+    17:54:52.559783 IP 192.168.0.100.1234 > 192.168.1.1.5678: Flags [.], ...
+    17:54:52.559784 IP 192.168.0.100.1234 > 192.168.1.1.5678: Flags [.], ...
+    17:54:52.559785 IP 192.168.0.100.1234 > 192.168.1.1.5678: Flags [.], ...
+    17:54:52.559785 IP 192.168.0.100.1234 > 192.168.1.1.5678: Flags [.], ...
-- 
2.17.1