FlyScript Glossary
- Shark
- Short for Riverbed Cascade Shark Appliance
A physical appliance or virtual machine that provides
continuous, high-speed packet capture and includes sophisticated
analytics (using the concept of a view)
for extracting many different kinds of data and statistics
from the captured traffic.
- Pilot
- Short for Riverbed Cascade Pilot
A desktop application for interacting with a Shark appliance.
- view
- The object used within Shark for all packet analysis.
A view consists of a packet source, optional filters to limit
which packets are analyzed, and a set of statistics to extract
along with rules for how to organize those statistics.
Described in A brief introduction to the Shark architecture
and in the
reference manual.
- extractor
- A software component that can extract information
(fields)
about some protocol from packets.
Each extractor is identified by a short name.
E.g., the
tcp
extractor parses the headers in TCP
packets and extracts fields such as port numbers, flags, etc.
- extractor field
- An individual piece of information that can be computed by
an extractor.
Each field has a short descriptive name and is
usually identified by the name of the extractor followed
by a doubled colon, and the field name.
For example,
tcp::source_port
or http::uri
.
- packet source
- An object used as the input for a view.
Can be a capture port, capture job,
trace clip, or trace file.
- capture port
- A physical network interface on a Shark appliancbe.
Typically connected to a mirrored (SPAN) port on a switch.
- capture job
- A long-running background task on a Shark appliance that
records some or all of the packets arriving on a
capture port to disk.
Recorded packets are stored in an efficient indexed structure
for efficient retrieval during view processing.
The term "capture job" is mildly overloaded -- it can refer
abstractly to the ongoing process of indexing and saving packets,
or it can refer specifically to the set of packets stored on
disk as part of a job.
- trace clip
- A filtered subset of the packets that have been stored as part
of a capture job.
A trace clip typically includes a time-based filter to limit
the clip to only those packets that fall within a specific
time interval.
Trace clips may be locked, in which case the packets in the
clip will not be deleted from disk even as ongoing capture jobs
need to delete old packets to reclaim space for new packets.
- filter
- A predicate applied to a stream of packets to select a subset
of the packets.
Used to limit which packets from a source should be processed
by a view or to limit which packets from a
capture job should be included in a
trace clip.