* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- */
-
-/*
- * TODO:
- * Find out the Unknown values
- *
- * Specs:
- * No real specs exist. Some general description can be found at:
- * http://www.cisco.com/en/US/products/hw/routers/ps368/products_configuration_guide_chapter09186a008069952a.html
- *
- * Some information on ERSPAN type III can be found at:
- * http://www.cisco.com/en/US/docs/switches/datacenter/nexus1000/sw/4_0_4_s_v_1_3/system_management/configuration/guide/n1000v_system_9span.html
- *
- * For ERSPAN packets, the "protocol type" field value in the GRE header
- * is 0x88BE (version 1) or 0x22EB (version 2).
- *
- * ERSPAN type II is version 1
- * ERSPAN type III is version 2
- *
- * 0000000: d4c3 b2a1 0200 0400 0000 0000 0000 0000 <-- pcap header
- * 0000010: ffff 0000
- * 0000010: 7100 0000 <-- 0x71 (DLT_TYPE) = linux_cooked_capture (of course not)
- * 0000010: 7507 f845 11d1 0500 <-- pcap record header
- * 0000020: 7a00 0000 7a00 0000
- * 0000020: 0000 030a 0000 0000 <-- unknown
- * 0000030: 0000 0000
- * 0000030: 0000 88be <-- GRE header (version 1)
- * 0000030: 1002 0001 0000 0380 <-- ERSPAN header (01: erspan-id)
- * 0000040: 00d0 b7a7 7480 0015 c721 75c0 0800 4500 <-- Ethernet packet
- * ...
*
+ * Protocol Spec:
+ * https://tools.ietf.org/html/draft-foschiano-erspan-01
*
+ * For ERSPAN packets, the "protocol type" field value in the GRE header
+ * is 0x88BE (version 1) or 0x22EB (version 2).
+ * ERSPAN type II is version 1
+ * ERSPAN type III is version 2
*/
#include "config.h"
version = tvb_get_ntohs(tvb, offset) >> 12;
- if (tree) {
- ti_ver = proto_tree_add_item(erspan_tree, hf_erspan_version, tvb, offset, 2,
- ENC_BIG_ENDIAN);
- if ((version != 1) && (version != 2 )) {
- expert_add_info(pinfo, ti_ver, &ei_erspan_version_unknown);
- return 2;
- }
- proto_tree_add_item(erspan_tree, hf_erspan_vlan, tvb, offset, 2,
- ENC_BIG_ENDIAN);
- offset += 2;
- proto_tree_add_item(erspan_tree, hf_erspan_priority, tvb, offset, 2,
+ ti_ver = proto_tree_add_item(erspan_tree, hf_erspan_version, tvb, offset, 2,
+ ENC_BIG_ENDIAN);
+ if ((version != 1) && (version != 2 )) {
+ expert_add_info(pinfo, ti_ver, &ei_erspan_version_unknown);
+ return 2;
+ }
+ proto_tree_add_item(erspan_tree, hf_erspan_vlan, tvb, offset, 2,
+ ENC_BIG_ENDIAN);
+ offset += 2;
+
+ proto_tree_add_item(erspan_tree, hf_erspan_priority, tvb, offset, 2,
+ ENC_BIG_ENDIAN);
+
+ if (version == 1)
+ proto_tree_add_item(erspan_tree, hf_erspan_encap, tvb,
+ offset, 2, ENC_BIG_ENDIAN);
+ else
+ proto_tree_add_item(erspan_tree, hf_erspan_bso, tvb, offset, 2,
ENC_BIG_ENDIAN);
- if (version == 1)
- proto_tree_add_item(erspan_tree, hf_erspan_encap, tvb,
- offset, 2, ENC_BIG_ENDIAN);
- else
- proto_tree_add_item(erspan_tree, hf_erspan_bso, tvb, offset, 2,
- ENC_BIG_ENDIAN);
-
-
- proto_tree_add_item(erspan_tree, hf_erspan_truncated, tvb, offset, 2,
- ENC_BIG_ENDIAN);
- proto_tree_add_item(erspan_tree, hf_erspan_spanid, tvb, offset, 2,
- ENC_BIG_ENDIAN);
- offset += 2;
- if (version == 1) {
- proto_tree_add_item(erspan_tree, hf_erspan_index, tvb,
- offset, 4, ENC_BIG_ENDIAN);
- offset += 4;
- }
- else {
- proto_tree_add_item(erspan_tree, hf_erspan_timestamp, tvb,
- offset, 4, ENC_BIG_ENDIAN);
- offset += 4;
+ proto_tree_add_item(erspan_tree, hf_erspan_truncated, tvb, offset, 2,
+ ENC_BIG_ENDIAN);
+ proto_tree_add_item(erspan_tree, hf_erspan_spanid, tvb, offset, 2,
+ ENC_BIG_ENDIAN);
+ offset += 2;
- proto_tree_add_item(erspan_tree, hf_erspan_sgt, tvb,
- offset, 2, ENC_BIG_ENDIAN);
- offset += 2;
+ if (version == 1) {
+ proto_tree_add_item(erspan_tree, hf_erspan_index, tvb,
+ offset, 4, ENC_BIG_ENDIAN);
+ offset += 4;
+ }
+ else {
+ proto_tree_add_item(erspan_tree, hf_erspan_timestamp, tvb,
+ offset, 4, ENC_BIG_ENDIAN);
+ offset += 4;
- proto_tree_add_item(erspan_tree, hf_erspan_p, tvb,
- offset, 2, ENC_BIG_ENDIAN);
+ proto_tree_add_item(erspan_tree, hf_erspan_sgt, tvb,
+ offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
- proto_tree_add_item(erspan_tree, hf_erspan_ft, tvb,
- offset, 2, ENC_BIG_ENDIAN);
+ proto_tree_add_item(erspan_tree, hf_erspan_p, tvb,
+ offset, 2, ENC_BIG_ENDIAN);
- proto_tree_add_item(erspan_tree, hf_erspan_hw, tvb,
- offset, 2, ENC_BIG_ENDIAN);
+ proto_tree_add_item(erspan_tree, hf_erspan_ft, tvb,
+ offset, 2, ENC_BIG_ENDIAN);
- proto_tree_add_item(erspan_tree, hf_erspan_direction2, tvb,
- offset, 2, ENC_BIG_ENDIAN);
+ proto_tree_add_item(erspan_tree, hf_erspan_hw, tvb,
+ offset, 2, ENC_BIG_ENDIAN);
- proto_tree_add_item(erspan_tree, hf_erspan_gra, tvb,
- offset, 2, ENC_BIG_ENDIAN);
+ proto_tree_add_item(erspan_tree, hf_erspan_direction2, tvb,
+ offset, 2, ENC_BIG_ENDIAN);
- proto_tree_add_item(erspan_tree, hf_erspan_o, tvb,
- offset, 2, ENC_BIG_ENDIAN);
- offset += 2;
- }
+ proto_tree_add_item(erspan_tree, hf_erspan_gra, tvb,
+ offset, 2, ENC_BIG_ENDIAN);
- }
- else {
- offset += 8;
- if (version == 2)
- offset += 12;
+ proto_tree_add_item(erspan_tree, hf_erspan_o, tvb,
+ offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
}
eth_tvb = tvb_new_subset_remaining(tvb, offset);