IEEE 1394 (FireWire) Testing?

Cadre asks: "Can a regular COTS FireWire card be used for monitoring data (kind of like a regular COTS ethernet card can be put into promiscuous mode and the data can be monitored with libpcap)? I work for an organization that does a lot of databus monitoring and hardware-in-the-loop testing of large systems. Firewire has become popular (Ethernet too, but we've solved that problem with libpcap) and we're looking for a solution to monitor and simulate data. There are a couple manufactures that sell specialized equipment for FireWire testing that include onboard FPGAs but they seem more geared towards testing the FireWire bus than testing the overall systems on the bus."

Study the spec, then look at the chipsets.

[stienman]

It's been awhile since I've studied firewire, but as far as I recall it's a relatively simple packet based protocol.

I don't see why a common firewire card couldn't be used to snoop on the traffic on a bus. Because of the way endpoints and bus controllers are determined, and how data flows you may have to be careful about the placement of the snooping computer on the bus.

The real trick is getting the chipset datasheet from the manufacturer.

Good luck!

-Adam

Re:Study the spec, then look at the chipsets.

[__david__]

Because of the way endpoints and bus controllers are determined, and how data flows you may have to be careful about the placement of the snooping computer on the bus.

Wrong. FireWire is a broadcast protocol and the Phys are like ethernet hubs not ethernet switches. So every device on the bus gets all data delivered to it.

The real trick is getting the chipset datasheet from the manufacturer.

99% of all 1394 cards follow the OHCI spec (hence no need to get data from the manufacturer). The OHCI spec does no

COTS

[zhiwenchong]

Before anyone asks, COTS = Commercial Off the Shelf

At least that's what Google says [google.com].

tee

[BoneMarrow]

The external tee command is used to write to the standard output and to a file simultaneously. You place the tee command anywhere in a pipe command to divert a copy of the standard input (of tee) to disk and another copy to your terminal. Thus its name is from the world of plumbing; it allows one input and two outputs. The tee command actually allows multiple file copies. For example, sort unsorted | tee sorted | cut -c-20,41- | tee cutup | lp from: http://www.softpanorama.org/Tools/tee.shtml [softpanorama.org]

The short answer: No.

[__david__]

For some moronic reason (I've heard it was bowing to pressure from content providers to make the firewire bus hard to sniff for the commoner--take that with a grain of salt), the OHCI spec (which 99% of all cards adhere to) does not include a way to enter promiscuous mode. So if you buy a cheap card you will not be able to monitor the bus.

TI used to make a non-OHCI chip called the PCI Lynx that had a sniffing mode. Apple has a nice FireWire protocol analyzer called FireBug that works with the Lynx chip. I believe I may have seen Linux software at some point that does similar packet sniffing. But these PCI Lynx based cards can be hard to find. At my old job (where we did lots of Firewire stuff) we bought a big bulk purchase of Cardbus Lynx cards and converted a bunch of cheap old powerbooks into mobile firewire analyzers.

-David

USB ?

[RGRistroph]

Is there a particular USB card I can buy, that will allow me to put it into either "host" or "periphial" (or whatever they are called) modes, so that I could make a USB snooper ?

Snooping

[Cadre]

Thanks for the info! Very interesting...

After googling around for info on the PCI Lynx chipset I found Nosy - A Snoop-Mode Driver [bitplanet.net] (apparently promiscious mode is more commonly referred to as "snoop-mode" when dealing with FireWire) for Linux. It hasn't been updated for awhile though.

With the PCI Lynx card being a bit hard to find (FireWire Depot did appear to have some in stock) and the drivers being a bit sketchy I think we'll probably end up going with specialized equipement like the FireSpy 3850 [dapdesign.com]. I at

Re:Snooping

[Cadre]

Ah, just that I haven't found many cases of people using it which makes it hard to get a sense of the maturity of the project. Though to see that you the author are indeed alive :-) and have updated the web page I may still pursue it as an option for an inexpensive monitor.

Re:The short answer: No.

[stunted]

But wouldn't it be possible to pipe the input of one 1394 port to the output of another and vice versa putting them through one of the Tee commands mentions up ^^ there? If this was possible the devices at each end would just see each other with out the need for a snoop - promiscuous mode.

Re:The short answer: No.

[__david__]

But wouldn't it be possible to pipe the input of one 1394 port to the output of another and vice versa putting them through one of the Tee commands mentions up ^^ there?

It doesn't work that way. If packets are received by the ohci card but are addressed to other nodes on the bus then they get thrown away in hardware before the software gets a chance to get a hold of them.

The repeater function of firewire is also completely handled by hardware so when a packet comes in one port and gets put out to another

You work for...

[bergeron76]

If I didn't know any better, I'd think you worked for a Cable company.

Firewine tasting?

[Woldry]

Swear to God, that's what I thought I read.

I think it's time for bed now.