Frame Recognizers
Before protocol data can be decoded, it must be split up into frames and then layers. A decoder, remember, is designed to process one frame at a time. If we look at one side of a communication session, we see a succession of frames like this:
| Frame | Frame | Frame | Frame | Frame |
The question we examine in this chapter is: how are the boundaries between frames determined?
In some cases, such as with Ethernet, the hardware sends complete frames. In other cases, such as with bit-synchronous protocols (HDLC, SDLC, etc.) the hardware detects the beginnings and end of frames and hands notifications of these events to the protocol analyzer interspersed with byte-at-a-time data. Then there are cases where the data are received as an unstructured byte stream; this is typical of asynchronous protocols such as SLIP and PPP. In this last situation, the protocol analyzer must depend on software to figure out where frames begin and end. Such a piece of software is called a Frame Recognizer. If your protocol needs a Frame Recognizer you might be lucky enough to be able to use one of the standard recognizers supplied with the protocol analyzer, but most likely you will need to develop a custom one.
No matter how frames are recognized, start-of-frame and end-of-frame events will be inserted into the captured data to mark the boundaries. When a Frame Recognizer is used, data is normally fed through it right after being captured so that it can be decoded and displayed in real time. It is also possible to reframe such captured data at a later stage by selecting "Reframe…" from the File menu of the Frame Display. This process removes existing start- and end-of-frame events and feeds the data through the Frame Recognizer again. This is very handy when you are debugging a Frame Recognizer and also serves when you capture data without knowing or specifying what protocol is in use.
In a nutshell, a Frame Recognizer is called for each event in sequence. Its job is to spot where frames begin and end, and for each byte, to return an indicator of frame state.