* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Protocol Spec:
- * https://tools.ietf.org/html/draft-foschiano-erspan-01
+ * https://tools.ietf.org/html/draft-foschiano-erspan-03
*
* For ERSPAN packets, the "protocol type" field value in the GRE header
- * is 0x88BE (version 1) or 0x22EB (version 2).
- * ERSPAN type II is version 1
- * ERSPAN type III is version 2
+ * is 0x88BE (types I and II) or 0x22EB (type III).
+ * ERSPAN type I has no extra gre header bytes (all flags 0), e.g. Broadcom Trident 2 ASIC
+ * ERSPAN type II has version = 1
+ * ERSPAN type III has version = 2
*/
#include "config.h"
#define PROTO_SHORT_NAME "ERSPAN"
#define PROTO_LONG_NAME "Encapsulated Remote Switch Packet ANalysis"
-/* Global ERSPAN Preference */
-static gboolean pref_fake_erspan = FALSE;
-
#define ERSPAN_DIRECTION_INCOMING 0
#define ERSPAN_DIRECTION_OUTGOING 1
static const value_string erspan_direction_vals[] = {
erspan_tree = proto_item_add_subtree(ti, ett_erspan);
}
- if(pref_fake_erspan) {
+ if(pinfo->flags.in_erspan_i) {
/* Some vendors don't include ERSPAN Header...*/
eth_tvb = tvb_new_subset_remaining(tvb, offset);
call_dissector(ethnofcs_handle, eth_tvb, pinfo, tree);
void
proto_register_erspan(void)
{
- module_t *erspan_module;
expert_module_t* expert_erspan;
static hf_register_info hf[] = {
proto_register_subtree_array(ett, array_length(ett));
expert_erspan = expert_register_protocol(proto_erspan);
expert_register_field_array(expert_erspan, ei, array_length(ei));
-
- /* register dissection preferences */
- erspan_module = prefs_register_protocol(proto_erspan, NULL);
-
- prefs_register_bool_preference(erspan_module, "fake_erspan",
- "FORCE to decode fake ERSPAN frame",
- "When set, dissector will FORCE to decode directly Ethernet Frame"
- "Some vendor use fake ERSPAN frame (with not ERSPAN Header)",
- &pref_fake_erspan);
}
void
{ GRE_CISCO_CDP, "CDP (Cisco)"},
{ GRE_NHRP, "NHRP"},
{ GRE_ERSPAN_88BE, "ERSPAN"},
- { GRE_ERSPAN_22EB, "ERSPAN"},
+ { GRE_ERSPAN_22EB, "ERSPAN III"},
{ GRE_MIKROTIK_EOIP, "MIKROTIK EoIP"},
{ GRE_AIROHIVE, "AIROHIVE AP AP"},
{ ETHERTYPE_IPX, "IPX"},
if (type == ETHERTYPE_3GPP2) {
offset = dissect_gre_3gpp2_attribs(tvb, offset, gre_tree);
}
+ if (type == GRE_ERSPAN_88BE && !(flags_and_ver & GRE_SEQUENCE)) {
+ pinfo->flags.in_erspan_i = TRUE;
+ }
proto_item_set_len(ti, offset);