Requesting DLT_* values for Ethernet switches proprietary tagging protocol

[Florian Fainelli <f.fainelli () gmail com>]

Hi,

(Guy, I wrote you a separate email about that nearly 2 years ago and got
side tracked for that long on other stuff).

A number of Ethernet switches from Broadcom, Marvell, Microchip,
Qualcomm, Lantiq/Intel, etc. utilize proprietary tags that are processed
by these switches in-line with the Ethernet frame being sent/received.

These tags are inserted by the Ethernet switch's management interface
for packets egressing the switch to a management port, and are created
by a software agent (or specialized Ethernet adapter, typically from the
same vendor) then sent to the management port for frames ingressing the
switch. These tags serve as the foundation for Linux's Distributed
Switch Architecture framework. As of Linux 4.19, there is now a way for
user-space to find out which type of protocol is being
configured on that management network interface.

These tags all have a slightly different format, which makes it really
difficult to create a reliable heuristic. Things are made largely more
complicated with some tag formats having a different length for ingress
and egress.

DSA currently supports the following tagging protocols (details can be
found under net/dsa/tag_*.c in Linux source for exactly length and offset
within the Ethernet frame):

        DSA_TAG_PROTO_NONE = 0,
        DSA_TAG_PROTO_BRCM,
        DSA_TAG_PROTO_BRCM_PREPEND,
        DSA_TAG_PROTO_DSA,
        DSA_TAG_PROTO_EDSA,
        DSA_TAG_PROTO_GSWIP,
        DSA_TAG_PROTO_KSZ9477,
        DSA_TAG_PROTO_LAN9303,
        DSA_TAG_PROTO_MTK,
        DSA_TAG_PROTO_QCA,
        DSA_TAG_PROTO_TRAILER,

I would therefore would like to add all, for a total of 10 of these to
an upcoming release of libpcap, and then update tcpdump to parse those
tags and pretty print these Ethernet switch tags.

Please let me know if this is an appropriate request, and if you want me
to elaborate in case that request does not constitute a reasonable DLT
candidate.

Here is a pull request to tcpdump that shows what/where the 4byte
Broadcom tag format is, and how the heuristic currently works, which is
IMHO non ideal:

https://github.com/the-tcpdump-group/tcpdump/pull/728

and here is what the libpcap changes might look like:

https://github.com/ffainelli/libpcap/commit/4a97aaee7cfa19d96ad3769e0ce7953fdf33825d

Thank you!
-- 
Florian
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers