Support of double vlan tagging

rick....@digitalwerk.net

unread,

Jul 11, 2020, 4:23:10 AM7/11/20

to PcapPlusPlus support

Hi,

does the PCapPlusPlus library support double vlan tagging?

see: https://en.wikipedia.org/wiki/IEEE_802.1Q#Double_tagging

see: https://en.wikipedia.org/wiki/IEEE_802.1ad#Frame_format

I created a raw buffer with two vlan tags before the ether type == 0x86DD == IPv6. The payload is irrelevant in this example, but the extraction of the ether type is crucial.

    static const unsigned char pkt0[] = {
        0x01, 0x02, 0x03, 0x04, 0x05, 0x06, // dst mac
        0x06, 0x05, 0x04, 0x03, 0x02, 0x01, // src mac
        0x88, 0xA8, 0x00, 0x03, // 0x88A8, 0x0002 (PCP: 0, DEI: 0, VID: 3)
        0x81, 0x00, 0x00, 0x02, // 0x8100, 0x0003 (PCP: 0, DEI: 0, VID: 2)
        0x86, 0xdd, // TPID, TCI, ETHERTYPE (IPv6 == 0x86DD)
        0xf8, 0xfe, 0x02, 0x03, 0x00, 0x80, 0x00, 0x00, 
        0x00, 0x0f, 0x01, 0xb0, 0x00, 0x11, 0x00, 0x00, 
        0x00, 0x07, 0xcd, 0xb9, 0x6c, 0xd0, 0x00, 0x56, 
        0x00, 0x00, 0x33, 0x33, 0x00, 0x00, 0x00, 0x61, 
        0x00, 0x50, 0xc2, 0xa9, 0xc0, 0x6b, 0x81, 0x00, 
        0x00, 0x02, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 
        0x00, 0x18, 0x11, 0x01, 0xfd, 0x53, 0x7c, 0xb8, 
        0x03, 0x83, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 
        0x00, 0x00, 0x01, 0x0f, 0xff, 0x14, 0x00, 0x00, 
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
        0x00, 0x00, 0x00, 0x61, 0xa6, 0x3d, 0xa6, 0x3d, 
        0x00, 0x18, 0x01, 0xfd, 0x00, 0x00, 0x03, 0xa3, 
        0x00, 0x00, 0x00, 0x08, 0xd9, 0xe4, 0xff, 0xaf, 
        0x55, 0xf0, 0xff, 0xff, 0xaa, 0xf1, 0x22, 0x31 
    };

    RawPacket oRawPacket(pkt0, sizeof pkt0, {0, 0}, false, LINKTYPE_ETHERNET);
    Packet oPacket(&oRawPacket, false, VLAN);

Accessing the ether type via the vlan layer:

    // optional VLAN
    uint16_t ethertype = 0x86DD;
    const auto* const vlanLayer = packet.getLayerOfType<VlanLayer>();
    if (vlanLayer)
    {
        const auto etherType = ntohs(vlanLayer->getVlanHeader()->etherType);        
        REQUIRE(etherType == ethertype);
    }
    else
    {
        const auto etherType = ntohs(etherHeader->etherType);
        REQUIRE(etherType == ethertype);
    }

The assertion returns the following:

  REQUIRE( etherType == ethertype )
with expansion:
  34984 == 34525

Thank you for your support.

Greetings, Rick

PcapPlusPlus Support

unread,

Jul 13, 2020, 3:18:32 AM7/13/20

to rick....@digitalwerk.net, PcapPlusPlus support

Hi Rick,

Double tagging should be supported. Are you trying to access the first or second vlan layer?

Thanks,

PcapPlusPlus maintainer

--
You received this message because you are subscribed to the Google Groups "PcapPlusPlus support" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pcapplusplus-sup...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/pcapplusplus-support/7db2d124-a8ff-445e-934b-0c81e805e65fo%40googlegroups.com.

Rick Vogel

unread,

Jul 13, 2020, 4:23:08 AM7/13/20

to PcapPlusPlus support

Hi PcapPlusPlus maintainer,

primarily the effective ether type is important for me (0x86dd == IPv6 is this scenario), which is being moved by the insertion of one or two VLAN tags.

After refining the test case I noticed that

        const auto* const outerVlan = static_cast<VlanLayer*>(oPacket.getLayerOfType(VLAN, 0));
        const auto* const outerVlan2 = static_cast<VlanLayer*>(oPacket.getLayerOfType<VlanLayer>());

both return NULL, therefore the following assertions are failing.

static const unsigned char pkt0[] = {
            0x01, 0x02, 0x03, 0x04, 0x05, 0x06, // dst mac
            0x06, 0x05, 0x04, 0x03, 0x02, 0x01, // src mac

            0x88, 0xA8, 0x61, 0x23, // outer { TPID: 0x88A8, TCI: 0x6123 (PCP: 3, DEI: 0, VID: 291) }
            0x81, 0x00, 0xA4, 0x56, // inner { TPID: 0x8100, TCI: 0xA456 (PCP: 5, DEI: 0, VID: 1110) }

            0x86, 0xdd, // TPID, TCI, ETHERTYPE (IPv6 == 0x86DD)
            0xf8, 0xfe, 0x02, 0x03, 0x00, 0x80, 0x00, 0x00,
            0x00, 0x0f, 0x01, 0xb0, 0x00, 0x11, 0x00, 0x00,
            0x00, 0x07, 0xcd, 0xb9, 0x6c, 0xd0, 0x00, 0x56,
            0x00, 0x00, 0x33, 0x33, 0x00, 0x00, 0x00, 0x61,
            0x00, 0x50, 0xc2, 0xa9, 0xc0, 0x6b, 0x81, 0x00,
            0x00, 0x02, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00,
            0x00, 0x18, 0x11, 0x01, 0xfd, 0x53, 0x7c, 0xb8,
            0x03, 0x83, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
            0x00, 0x00, 0x01, 0x0f, 0xff, 0x14, 0x00, 0x00,
            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
            0x00, 0x00, 0x00, 0x61, 0xa6, 0x3d, 0xa6, 0x3d,
            0x00, 0x18, 0x01, 0xfd, 0x00, 0x00, 0x03, 0xa3,
            0x00, 0x00, 0x00, 0x08, 0xd9, 0xe4, 0xff, 0xaf,
            0x55, 0xf0, 0xff, 0xff, 0xaa, 0xf1, 0x22, 0x31};

        RawPacket oRawPacket(pkt0, sizeof pkt0, {0, 0}, false, LINKTYPE_ETHERNET);
        Packet oPacket(&oRawPacket, false, VLAN);

        const auto* const ethernetLayer = static_cast<EthLayer*>(oPacket.getLayerOfType(Ethernet));
        REQUIRE(ethernetLayer);
        const auto* const outerVlan = static_cast<VlanLayer*>(oPacket.getLayerOfType(VLAN, 0));
        const auto* const outerVlan2 = static_cast<VlanLayer*>(oPacket.getLayerOfType<VlanLayer>());
        REQUIRE(outerVlan);
        REQUIRE(outerVlan2);
        const auto* const innerVlan = static_cast<VlanLayer*>(oPacket.getLayerOfType(VLAN, 1));
        REQUIRE(innerVlan);

        REQUIRE(ethernetLayer->getEthHeader()->etherType == htons(0x88A8)); // double VLAN
        REQUIRE(outerVlan->getVlanHeader()->etherType == htons(0x8100)); // single VLAN
        REQUIRE(innerVlan->getVlanHeader()->etherType == htons(0x86dd)); // IPv6

Additionally I crawled the API header and found:

#define	PCPP_ETHERTYPE_VLAN		0x8100

but no constant for 0x88A8

Thank your for your support.

Greetings, Rick

Am Montag, 13. Juli 2020 09:18:32 UTC+2 schrieb PcapPlusPlus Support:

Hi Rick,

Double tagging should be supported. Are you trying to access the first or second vlan layer?

Thanks,
PcapPlusPlus maintainer

To unsubscribe from this group and stop receiving emails from it, send an email to pcapplusplus-support+unsub...@googlegroups.com.

PcapPlusPlus Support

unread,

Jul 13, 2020, 4:37:22 AM7/13/20

to Rick Vogel, PcapPlusPlus support

Hi Rick,

The method getLayerOfType() has an overload that takes an index. By default this index is 0 which means the first layer of this type. If you want to get the second one you should use index=1.

You can read more about it in the API documentation: https://pcapplusplus.github.io/api-docs/classpcpp_1_1_packet.html#a8db6d1f014dc0827c8cef731e8090d5e

You can also use getNextLayerOfType() and set the first vlan layer as it parameter.

Please let me know if that makes sense.

Thanks,

PcapPlusPlus maintainer

To unsubscribe from this group and stop receiving emails from it, send an email to pcapplusplus-sup...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/pcapplusplus-support/7db2d124-a8ff-445e-934b-0c81e805e65fo%40googlegroups.com.

--

You received this message because you are subscribed to the Google Groups "PcapPlusPlus support" group.

To unsubscribe from this group and stop receiving emails from it, send an email to pcapplusplus-sup...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/pcapplusplus-support/051c1556-ad83-49e0-a347-46b4c9d5b721o%40googlegroups.com.

Reply all

Reply to author

Forward