erspan: add support for ERSPAN type III.

diff --git a/CHANGES b/CHANGES
index 46a68c7d32cdf63755c5b092a48fd73fed6abcd3..b78e93c294e80714f9557f2863cd4c83a85ed0e9 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,7 @@
 DayOfTheWeek, Month DD, YYYY / The Tcpdump Group
   Summary for 5.0.0 tcpdump release (so far!)
+    Add protocol decoding for:
+      ERSPAN: Add support
     Refine protocol decoding for:
       BFD: Add support for S-BFD and spell LAG in uppercase.
       BGP: Parse BGP extended message support capability

diff --git a/netdissect.h b/netdissect.h
index 990cb145c42ba3e614dc316203f6039865569e09..fde2ea4856b80c2a7b1262315b274564b8be1d36 100644 (file)
--- a/netdissect.h
+++ b/netdissect.h
@@ -642,7 +642,8 @@ extern void eap_print(netdissect_options *, const u_char *, const u_int);
 extern void eapol_print(netdissect_options *, const u_char *);
 extern void egp_print(netdissect_options *, const u_char *, u_int);
 extern void eigrp_print(netdissect_options *, const u_char *, u_int);
-extern void erspan_print(netdissect_options *, uint16_t, const u_char *, u_int);
+extern void erspan_print_i_ii(netdissect_options *, uint16_t, const u_char *, u_int);
+extern void erspan_print_iii(netdissect_options *, const u_char *, u_int);
 extern void esp_print(netdissect_options *, const u_char *, u_int, const u_char *, u_int, int, u_int);
 extern u_int ether_print(netdissect_options *, const u_char *, u_int, u_int, void (*)(netdissect_options *, const u_char *), const u_char *);
 extern u_int ether_switch_tag_print(netdissect_options *, const u_char *, u_int, u_int, void (*)(netdissect_options *, const u_char *), u_int);

diff --git a/print-erspan.c b/print-erspan.c
index 31795a5399f00b67a46292ed8ebfd40042c0f753..6d305edd36acff8c94adc2b17ffce98b1e1a471e 100644 (file)
--- a/print-erspan.c
+++ b/print-erspan.c
@@ -41,6 +41,9 @@
 #include "extract.h"
 #include "gre.h"
 
+/*
+ * ERSPAN Type II.
+ */
 #define ERSPAN2_VER_SHIFT      28
 #define ERSPAN2_VER_MASK       (0xfU << ERSPAN2_VER_SHIFT)
 #define ERSPAN2_VER            (0x1U << ERSPAN2_VER_SHIFT)
@@ -63,7 +66,7 @@
 #define ERSPAN2_INDEX_MASK     (0xfffffU << ERSPAN2_INDEX_SHIFT)
 
 void
-erspan_print(netdissect_options *ndo, uint16_t flags, const u_char *bp, u_int len)
+erspan_print_i_ii(netdissect_options *ndo, uint16_t flags, const u_char *bp, u_int len)
 {
        uint32_t hdr, ver, vlan, cos, en, sid, index;
 
@@ -71,11 +74,17 @@ erspan_print(netdissect_options *ndo, uint16_t flags, const u_char *bp, u_int le
        nd_print_protocol(ndo);
 
        if (!(flags & GRE_SP)) {
+               /*
+                * ERSPAN Type I; no header, just a raw Ethernet frame.
+                */
                ND_PRINT(" type1: ");
                ether_print(ndo, bp, len, ND_BYTES_AVAILABLE_AFTER(bp), NULL, NULL);
                return;
        }
 
+       /*
+        * ERSPAN Type II.
+        */
        ND_ICHECK_U(len, <, 4);
        hdr = GET_BE_U_4(bp);
        bp += 4;
@@ -83,6 +92,9 @@ erspan_print(netdissect_options *ndo, uint16_t flags, const u_char *bp, u_int le
 
        ver = hdr & ERSPAN2_VER_MASK;
        if (ver != ERSPAN2_VER) {
+               /*
+                * Not Type II.
+                */
                ver >>= ERSPAN2_VER_SHIFT;
                ND_PRINT(" erspan-unknown-version-%x", ver);
                return;
@@ -135,3 +147,121 @@ erspan_print(netdissect_options *ndo, uint16_t flags, const u_char *bp, u_int le
 invalid:
        nd_print_invalid(ndo);
 }
+
+/*
+ * ERSPAN Type III.
+ */
+#define ERSPAN3_VER_SHIFT              28
+#define ERSPAN3_VER_MASK               (0xfU << ERSPAN3_VER_SHIFT)
+#define ERSPAN3_VER                    (0x2U << ERSPAN3_VER_SHIFT)
+#define ERSPAN3_VLAN_SHIFT             16
+#define ERSPAN3_VLAN_MASK              (0xfffU << ERSPAN3_VLAN_SHIFT)
+#define ERSPAN3_COS_SHIFT              13
+#define ERSPAN3_COS_MASK               (0x7U << ERSPAN3_COS_SHIFT)
+#define ERSPAN3_BSO_SHIFT              11
+#define ERSPAN3_BSO_MASK               (0x3U << ERSPAN3_BSO_SHIFT)
+#define ERSPAN3_BSO_GOOD_UNKNOWN       0x0U
+#define ERSPAN3_BSO_BAD                        0x3U
+#define ERSPAN3_BSO_SHORT              0x1U
+#define ERSPAN3_BSO_OVERSIZED          0x2U
+#define ERSPAN3_T_SHIFT                        10
+#define ERSPAN3_T_MASK                 (0x1U << ERSPAN3_T_SHIFT)
+#define ERSPAN3_SID_SHIFT              0
+#define ERSPAN3_SID_MASK               (0x3ffU << ERSPAN3_SID_SHIFT)
+#define ERSPAN3_P_SHIFT                        15
+#define ERSPAN3_P_MASK                 (0x1U << ERSPAN3_P_MASK)
+#define ERSPAN3_FT_SHIFT               10
+#define ERSPAN3_FT_MASK                        (0x1fU << ERSPAN3_FT_MASK)
+#define ERSPAN3_HW_ID_SHIFT            4
+#define ERSPAN3_HW_ID_MASK             (0x3fU << ERSPAN3_HW_ID_MASK)
+#define ERSPAN3_D_SHIFT                        3
+#define ERSPAN3_D_MASK                 (0x1U << ERSPAN3_D_SHIFT)
+#define ERSPAN3_GRA_SHIFT              1
+#define ERSPAN3_GRA_MASK               (0x3U << ERSPAN3_GRA_MASK)
+#define ERSPAN3_O_SHIFT                        0
+#define ERSPAN3_O_MASK                 (0x1U << ERSPAN3_O_SHIFT)
+
+static const struct tok erspan3_bso_values[] = {
+       { ERSPAN3_BSO_GOOD_UNKNOWN, "Good/unknown" },
+       { ERSPAN3_BSO_BAD,          "Bad" },
+       { ERSPAN3_BSO_SHORT,        "Short" },
+       { ERSPAN3_BSO_OVERSIZED,    "Oversized" },
+       { 0, NULL }
+};
+
+void
+erspan_print_iii(netdissect_options *ndo, const u_char *bp, u_int len)
+{
+       uint32_t hdr, hdr2, ver, cos, sid;
+
+       ndo->ndo_protocol = "erspan";
+       nd_print_protocol(ndo);
+
+       /*
+        * We do not check the GRE flags; ERSPAN Type III always
+        * has an ERSPAN header.
+        */
+       ND_ICHECK_U(len, <, 4);
+       hdr = GET_BE_U_4(bp);
+       bp += 4;
+       len -= 4;
+
+       ver = hdr & ERSPAN3_VER_MASK;
+       if (ver != ERSPAN3_VER) {
+               /*
+                * Not Type III.
+                */
+               ver >>= ERSPAN3_VER_SHIFT;
+               ND_PRINT(" erspan-unknown-version-%x", ver);
+               return;
+       }
+
+       if (ndo->ndo_vflag)
+               ND_PRINT(" type3");
+
+       sid = (hdr & ERSPAN3_SID_MASK) >> ERSPAN3_SID_SHIFT;
+       ND_PRINT(" session %u", sid);
+
+       ND_PRINT(" bso %s",
+                tok2str(erspan3_bso_values, "unknown %x",
+                        (hdr & ERSPAN3_BSO_MASK) >> ERSPAN3_BSO_SHIFT));
+
+       if (ndo->ndo_vflag) {
+               cos = (hdr & ERSPAN3_COS_MASK) >> ERSPAN3_COS_SHIFT;
+               ND_PRINT(" cos %u", cos);
+
+               if (hdr & ERSPAN3_T_MASK)
+                       ND_PRINT(" truncated");
+       }
+
+       /* Skip timestamp */
+       ND_ICHECK_U(len, <, 4);
+       bp += 4;
+       len -= 4;
+
+       /* Skip SGT */
+       ND_ICHECK_U(len, <, 2);
+       bp += 2;
+       len -= 2;
+
+       /* Additional fields */
+       ND_ICHECK_U(len, <, 2);
+       hdr2 = GET_BE_U_2(bp);
+       bp += 2;
+       len -= 2;
+
+       /* Do we have the platform-specific header? */
+       if (hdr2 & ERSPAN3_O_MASK) {
+               /* Yes.  Skip it. */
+               ND_ICHECK_U(len, <, 8);
+               bp += 8;
+               len -= 8;
+       }
+
+       ND_PRINT(": ");
+       ether_print(ndo, bp, len, ND_BYTES_AVAILABLE_AFTER(bp), NULL, NULL);
+       return;
+
+invalid:
+       nd_print_invalid(ndo);
+}

diff --git a/print-gre.c b/print-gre.c
index 1935494ec7454470e01e8941ba2fff07275a3f73..18c81a85561710483d3ab4203c83d998575e7a63 100644 (file)
--- a/print-gre.c
+++ b/print-gre.c
@@ -303,7 +303,10 @@ gre_print_0(netdissect_options *ndo, const u_char *bp, u_int length)
                nsh_print(ndo, bp, len);
                break;
        case GRE_ERSPAN_I_II:
-               erspan_print(ndo, flags, bp, len);
+               erspan_print_i_ii(ndo, flags, bp, len);
+               break;
+       case GRE_ERSPAN_III:
+               erspan_print_iii(ndo, bp, len);
                break;
        case GRE_CDP:
                cdp_print(ndo, bp, len);

diff --git a/tests/TESTLIST b/tests/TESTLIST
index 0e82ebcdfa22aab3b0f3195482ec075167c6706b..cc4dc30a818b42cdb39715f1280bc05d7f208d25 100644 (file)
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -582,6 +582,7 @@ erspan-type-i-4             erspan-type-i-4.pcap    erspan-type-i-4.out     -v
 erspan-type-ii-1       erspan-type-ii-1.pcap   erspan-type-ii-1.out    -v
 erspan-type-ii-2       erspan-type-ii-2.pcap   erspan-type-ii-2.out    -v
 erspan-type-ii-3       erspan-type-ii-3.pcap   erspan-type-ii-3.out    -v
+erspan-type-iii-1      erspan-type-iii-1.pcap  erspan-type-iii-1.out   -v
 
 # bad packets from Hanno Böck
 # heap-overflow-1 is in non-bsd.tests

diff --git a/tests/erspan-type-iii-1.out b/tests/erspan-type-iii-1.out
new file mode 100644 (file)
index 0000000..61b25f3
--- /dev/null
+++ b/tests/erspan-type-iii-1.out
@@ -0,0 +1,240 @@
+    1  2017-02-12 03:55:21.583545 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47838, length 92
+       erspan type3 session 101 bso Bad cos 0: 4b:87:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+    2  2017-02-12 03:55:21.583600 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47839, length 92
+       erspan type3 session 101 bso Bad cos 0: 4b:87:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+    3  2017-02-12 03:55:22.022711 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47840, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+    4  2017-02-12 03:55:24.022653 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47841, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+    5  2017-02-12 03:55:26.022595 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47842, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+    6  2017-02-12 03:55:28.022542 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47843, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+    7  2017-02-12 03:55:30.022483 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47844, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+    8  2017-02-12 03:55:31.583262 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47845, length 92
+       erspan type3 session 101 bso Bad cos 0: 4b:9e:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+    9  2017-02-12 03:55:31.583312 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47846, length 92
+       erspan type3 session 101 bso Bad cos 0: 4b:9e:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+   10  2017-02-12 03:55:32.022425 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47847, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   11  2017-02-12 03:55:34.022368 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47848, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   12  2017-02-12 03:55:36.022310 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47849, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   13  2017-02-12 03:55:38.022256 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47850, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   14  2017-02-12 03:55:40.022201 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47851, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   15  2017-02-12 03:55:41.582985 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47852, length 92
+       erspan type3 session 101 bso Bad cos 0: 4b:b5:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+   16  2017-02-12 03:55:41.583029 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47853, length 92
+       erspan type3 session 101 bso Bad cos 0: 4b:b5:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+   17  2017-02-12 03:55:42.022149 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47854, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   18  2017-02-12 03:55:42.048321 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47855, length 92
+       erspan type3 session 101 bso Bad cos 0: 4b:b6:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 72: 
+       0x0000:  1418 7760 aa75 8100 0361 0806 0001 0800  ..w`.u...a......
+       0x0010:  0604 0001 1418 7760 aa75 0af0 138b 0000  ......w`.u......
+       0x0020:  0000 0000 0af0 1381 0000 0000 0000 0000  ................
+       0x0030:  0000 0000 0000 0000 0000                 ..........
+   19  2017-02-12 03:55:44.022090 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47856, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   20  2017-02-12 03:55:46.022036 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47857, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   21  2017-02-12 03:55:48.021981 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47858, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   22  2017-02-12 03:55:50.021922 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47859, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   23  2017-02-12 03:55:51.582703 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47860, length 92
+       erspan type3 session 101 bso Bad cos 0: 4b:cd:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+   24  2017-02-12 03:55:51.582748 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47861, length 92
+       erspan type3 session 101 bso Bad cos 0: 4b:cd:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+   25  2017-02-12 03:55:52.021865 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47862, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   26  2017-02-12 03:55:54.021808 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47863, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   27  2017-02-12 03:55:56.021750 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47864, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   28  2017-02-12 03:55:58.021697 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47865, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   29  2017-02-12 03:56:00.021643 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47866, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   30  2017-02-12 03:56:01.582424 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47867, length 92
+       erspan type3 session 101 bso Bad cos 0: 4b:e4:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+   31  2017-02-12 03:56:01.582469 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47868, length 92
+       erspan type3 session 101 bso Bad cos 0: 4b:e4:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+   32  2017-02-12 03:56:02.021587 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47869, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   33  2017-02-12 03:56:04.021530 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47870, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   34  2017-02-12 03:56:06.021475 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47871, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   35  2017-02-12 03:56:08.021417 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47872, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   36  2017-02-12 03:56:10.021363 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47873, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   37  2017-02-12 03:56:11.582146 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47874, length 92
+       erspan type3 session 101 bso Bad cos 0: 4b:fb:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+   38  2017-02-12 03:56:11.582191 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47875, length 92
+       erspan type3 session 101 bso Bad cos 0: 4b:fb:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+   39  2017-02-12 03:56:12.021307 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47876, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   40  2017-02-12 03:56:12.859628 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 144)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47877, length 124
+       erspan type3 session 101 bso Bad cos 0: 4b:fe:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 104: 
+       0x0000:  1418 7760 aa75 8100 0361 0800 4500 004e  ..w`.u...a..E..N
+       0x0010:  0726 0000 8011 f60f 0af0 138b 0af0 13ff  .&..............
+       0x0020:  0089 0089 003a 933c b946 0110 0001 0000  .....:.<.F......
+       0x0030:  0000 0000 2045 4a45 4f46 4546 4345 4245  .....EJEOFEFCEBE
+       0x0040:  4846 4145 4845 4545 5043 4143 4143 4143  HFAEHEEEPCACACAC
+       0x0050:  4143 4141 4100 0020 0001                 ACAAA.....
+   41  2017-02-12 03:56:12.859864 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 122)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47878, length 102
+       erspan type3 session 101 bso Bad cos 0: 4b:fe:01:00:5e:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Unknown DSAP 0x14 Unnumbered, 67, Flags [Poll], length 68
+       0x0000:  1418 7760 aa75 8100 0361 0800 4500 0038  ..w`.u...a..E..8
+       0x0010:  1875 0000 0111 a1c9 0af0 138b e000 00fc  .u..............
+       0x0020:  ff5b 14eb 0024 e893 da3c 0000 0001 0000  .[...$...<......
+       0x0030:  0000 0000 0a69 6e74 7261 6770 6764 6f00  .....intragpgdo.
+       0x0040:  0001 0001                                ....
+   42  2017-02-12 03:56:12.860029 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 122)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47879, length 102
+       erspan type3 session 101 bso Bad cos 0: 4b:fe:01:00:5e:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Unknown DSAP 0x14 Unnumbered, 67, Flags [Poll], length 68
+       0x0000:  1418 7760 aa75 8100 0361 0800 4500 0038  ..w`.u...a..E..8
+       0x0010:  1876 0000 0111 a1c8 0af0 138b e000 00fc  .v..............
+       0x0020:  fdb4 14eb 0024 a251 220b 0000 0001 0000  .....$.Q".......
+       0x0030:  0000 0000 0a69 6e74 7261 6770 6764 6f00  .....intragpgdo.
+       0x0040:  001c 0001                                ....
+   43  2017-02-12 03:56:13.050090 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47880, length 92
+       erspan type3 session 101 bso Bad cos 0: 4b:ff:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 72: 
+       0x0000:  1418 7760 aa75 8100 0361 0806 0001 0800  ..w`.u...a......
+       0x0010:  0604 0001 1418 7760 aa75 0af0 138b 0000  ......w`.u......
+       0x0020:  0000 0000 0af0 1385 0000 0000 0000 0000  ................
+       0x0030:  0000 0000 0000 0000 0000                 ..........
+   44  2017-02-12 03:56:13.268895 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 122)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47881, length 102
+       erspan type3 session 101 bso Bad cos 0: 4b:ff:01:00:5e:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Unknown DSAP 0x14 Unnumbered, 67, Flags [Poll], length 68
+       0x0000:  1418 7760 aa75 8100 0361 0800 4500 0038  ..w`.u...a..E..8
+       0x0010:  1877 0000 0111 a1c7 0af0 138b e000 00fc  .w..............
+       0x0020:  fdb4 14eb 0024 a251 220b 0000 0001 0000  .....$.Q".......
+       0x0030:  0000 0000 0a69 6e74 7261 6770 6764 6f00  .....intragpgdo.
+       0x0040:  001c 0001                                ....
+   45  2017-02-12 03:56:13.268927 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 122)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47882, length 102
+       erspan type3 session 101 bso Bad cos 0: 4b:ff:01:00:5e:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Unknown DSAP 0x14 Unnumbered, 67, Flags [Poll], length 68
+       0x0000:  1418 7760 aa75 8100 0361 0800 4500 0038  ..w`.u...a..E..8
+       0x0010:  1878 0000 0111 a1c6 0af0 138b e000 00fc  .x..............
+       0x0020:  ff5b 14eb 0024 e893 da3c 0000 0001 0000  .[...$...<......
+       0x0030:  0000 0000 0a69 6e74 7261 6770 6764 6f00  .....intragpgdo.
+       0x0040:  0001 0001                                ....
+   46  2017-02-12 03:56:13.643869 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 144)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47883, length 124
+       erspan type3 session 101 bso Bad cos 0: 4c:00:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 104: 
+       0x0000:  1418 7760 aa75 8100 0361 0800 4500 004e  ..w`.u...a..E..N
+       0x0010:  0728 0000 8011 f60d 0af0 138b 0af0 13ff  .(..............
+       0x0020:  0089 0089 003a 933c b946 0110 0001 0000  .....:.<.F......
+       0x0030:  0000 0000 2045 4a45 4f46 4546 4345 4245  .....EJEOFEFCEBE
+       0x0040:  4846 4145 4845 4545 5043 4143 4143 4143  HFAEHEEEPCACACAC
+       0x0050:  4143 4141 4100 0020 0001                 ACAAA.....
+   47  2017-02-12 03:56:14.021252 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47884, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   48  2017-02-12 03:56:14.445047 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 144)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47885, length 124
+       erspan type3 session 101 bso Bad cos 0: 4c:02:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 104: 
+       0x0000:  1418 7760 aa75 8100 0361 0800 4500 004e  ..w`.u...a..E..N
+       0x0010:  072a 0000 8011 f60b 0af0 138b 0af0 13ff  .*..............
+       0x0020:  0089 0089 003a 933c b946 0110 0001 0000  .....:.<.F......
+       0x0030:  0000 0000 2045 4a45 4f46 4546 4345 4245  .....EJEOFEFCEBE
+       0x0040:  4846 4145 4845 4545 5043 4143 4143 4143  HFAEHEEEPCACACAC
+       0x0050:  4143 4141 4100 0020 0001                 ACAAA.....
+   49  2017-02-12 03:56:14.852333 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47886, length 92
+       erspan type3 session 101 bso Bad cos 0: 4c:03:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 72: 
+       0x0000:  1418 7760 aa75 8100 0361 0806 0001 0800  ..w`.u...a......
+       0x0010:  0604 0001 1418 7760 aa75 0af0 138b 0000  ......w`.u......
+       0x0020:  0000 0000 0af0 1385 0000 0000 0000 0000  ................
+       0x0030:  0000 0000 0000 0000 0000                 ..........
+   50  2017-02-12 03:56:15.549506 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47887, length 92
+       erspan type3 session 101 bso Bad cos 0: 4c:04:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 72: 
+       0x0000:  1418 7760 aa75 8100 0361 0806 0001 0800  ..w`.u...a......
+       0x0010:  0604 0001 1418 7760 aa75 0af0 138b 0000  ......w`.u......
+       0x0020:  0000 0000 0af0 1385 0000 0000 0000 0000  ................
+       0x0030:  0000 0000 0000 0000 0000                 ..........
+   51  2017-02-12 03:56:16.021193 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47888, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   52  2017-02-12 03:56:16.547213 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47889, length 92
+       erspan type3 session 101 bso Bad cos 0: 4c:07:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 72: 
+       0x0000:  1418 7760 aa75 8100 0361 0806 0001 0800  ..w`.u...a......
+       0x0010:  0604 0001 1418 7760 aa75 0af0 138b 0000  ......w`.u......
+       0x0020:  0000 0000 0af0 1385 0000 0000 0000 0000  ................
+       0x0030:  0000 0000 0000 0000 0000                 ..........
+   53  2017-02-12 03:56:18.021131 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47890, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   54  2017-02-12 03:56:20.021084 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47891, length 88
+       erspan type3 session 101 bso Bad cos 0:  [|llc]
+   55  2017-02-12 03:56:20.859987 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47892, length 92
+       erspan type3 session 101 bso Bad cos 0: 4c:11:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 72: 
+       0x0000:  1418 7760 aa75 8100 0361 0806 0001 0800  ..w`.u...a......
+       0x0010:  0604 0001 1418 7760 aa75 0af0 138b 0000  ......w`.u......
+       0x0020:  0000 0000 0af0 1385 0000 0000 0000 0000  ................
+       0x0030:  0000 0000 0000 0000 0000                 ..........
+   56  2017-02-12 03:56:21.547457 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47893, length 92
+       erspan type3 session 101 bso Bad cos 0: 4c:12:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 72: 
+       0x0000:  1418 7760 aa75 8100 0361 0806 0001 0800  ..w`.u...a......
+       0x0010:  0604 0001 1418 7760 aa75 0af0 138b 0000  ......w`.u......
+       0x0020:  0000 0000 0af0 1385 0000 0000 0000 0000  ................
+       0x0030:  0000 0000 0000 0000 0000                 ..........
+   57  2017-02-12 03:56:21.581865 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47894, length 92
+       erspan type3 session 101 bso Bad cos 0: 4c:12:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+   58  2017-02-12 03:56:21.581909 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
+    192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47895, length 92
+       erspan type3 session 101 bso Bad cos 0: 4c:12:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58

diff --git a/tests/erspan-type-iii-1.pcap b/tests/erspan-type-iii-1.pcap
new file mode 100644 (file)
index 0000000..c101b15
Binary files /dev/null and b/tests/erspan-type-iii-1.pcap differ