2.2.4.9 QueryResp Upper-Level Header Format
A responder sends a QueryResp frame to a mapper in response to a Query request. It lists which recordable events (such as Ethernet source and Ethernet destination addresses from Probe frames that the responder has observed on the wire during a session) are available since the previous Query frame. QueryResp frames are not acknowledged but MUST set the Base header's Sequence Number field to match the Query frame to which they are generated in response.
The QueryResp frame that follows a Base header MUST have the following format.
|
|
|
|
|
|
|
|
|
|
1 |
|
|
|
|
|
|
|
|
|
2 |
|
|
|
|
|
|
|
|
|
3 |
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
M |
E |
Num_Descs |
RecveeDescs (variable) |
||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
M (1 bit): This field MUST be set if there are more RecveeDescs than will fit in this frame.
E (1 bit): This field MUST be set if the responder is unable to store a RecveeDesc record due to lack of memory.
Num_Descs (14 bits): This field specifies the count of returned RecveeDesc structures that are included in the frame.
RecveeDescs (variable): This field specifies a list of RecveeDesc items, where each Recvee item is formatted as specified in the following table. Responders that are sending this frame MUST NOT merge identical recordable events (RecveeDescs items) even if they occur multiple times. The ordering of RecveeDesc items in this frame MUST represent arrival-time ordering.
-
Each RecveeDesc item MUST have the following 20-octet structure.
-
0
1
2
3
4
5
6
7
8
91
0
1
2
3
4
5
6
7
8
92
0
1
2
3
4
5
6
7
8
93
0
1Type
Real_Source_Address
...
EthernetSource_Address
...
Ethernet_Destination_Address
...
Type (2 bytes): This field specifies the recorded protocol type. The following table shows the valid values.
-
Value
Meaning
0x00
Probe
0x01
Address Resolution Protocol (ARP), as specified in [RFC826], or Internet Message Control Protocol for the Internet Protocol Version 6 (ICMPv6) Neighbor Discovery, as specified in [RFC2461].
Real_Source_Address (6 bytes): This field specifies the real source MAC address.
For ARP, this field corresponds to the ar$sha field in an ARP response packet, as specified in [RFC826].
For ICMPv6, this corresponds to the optional target link-layer address option in a neighbor discovery packet, as specified in [RFC2461] section 4.
EthernetSource_Address (6 bytes): This field specifies the source MAC address in the Ethernet frame.
Ethernet_Destination_Address (6 bytes): This field specifies the destination MAC address in the Ethernet frame.