3.5.1 Traffic Monitoring Software

Simics provides several commands to dump the traffic on one or several Ethernet links. These commands use existing file formats and network monitoring tools to present the results:

pcap-dump

The <ethernet_link>.pcap-dump command dumps the traffic of a specific Ethernet link to a file that can be read by tcpdump or any compatible program like Wireshark (https://www.wireshark.org). A global pcap-dump also exists to dump the traffic of all Ethernet links of the simulation in the same file.

tcpdump

The tcpdump command works as pcap-dump, but the traffic is redirected to a tcpdump instance running in a separate window (for Linux only).

wireshark

The wireshark command works as tcpdump, but redirects the traffic to an instance of Wireshark instead.

Note that there can only be one traffic dumping tool active on the link. Simics will automatically stop the current traffic dump and start a new one as necessary. The pcap-dump-stop, tcpdump-stop, and wireshark-stop commands can be used to stop the traffic dumping.

These commands can also be activated for a specific device on the link by associating them with an existing Ethernet probe. This is described in the Ethernet Probe section below.