MACsec Intel® FPGA IP User Guide

ID 736108
Date 3/31/2024
Document Table of Contents Packet Discard

There are a few conditions where packets are discarded and errors are logged into CSR.

If VALIDATEFRAMES = STRICT or SecTAG's C bit is set and unknown SCI or no valid SA is in use from SADB after lookup, error are logged into InPktsNoSAError CSR.

If VALIDATEFRAMES = STRICT and packets enter through decryption lane without MACsec header, error are logged into InPktsNoTag CSR.

If packets are received with the SecTAG E bit set and C bit clear, packets are discarded and not delivered to the Controlled port.

If VALIDATEFRAMES = STRICT or C bit is set and SC is unknown, received packets are discarded.

If VALIDATEFRAMES = STRICT or C bit is set and SA is unused, received packets are discarded.

If REPLAYPROTECT = ENABLE and the received packets PN is less than MIN_PN from the SA entry, received packets are discarded.

If protectFrames = 1 and there is no valid SA for transmit SC, packets to be protected are discarded.

If the transmitted packets size including SecTAG and ICV is > TX_MAX_PCKT_BYTES CSR, the packet is discarded.

When a packet is discarded, the TVALID of the packet is suppressed for every data byte until the cycle where TLAST is observed. The port/stream ID (TID) of the discarded packet is matched against the incoming packet data byte to avoid dropping packets from a different port/stream.