erspan: handle the Type III frame type field.

Show its value and only dissect the payload as an Ethernet frame if it's
type 0, for Ethernet.

Add a test file for frame type 0, rename the existing file to
indicate that it uses the unknown frame type 7 (which ain't Ethernet),
and regenerate that file.

diff --git a/print-erspan.c b/print-erspan.c
index 6d305edd36acff8c94adc2b17ffce98b1e1a471e..db0e9a0c6c7d705da156ff2f4595df754fe69b76 100644 (file)
--- a/print-erspan.c
+++ b/print-erspan.c
@@ -169,15 +169,17 @@ invalid:
 #define ERSPAN3_SID_SHIFT              0
 #define ERSPAN3_SID_MASK               (0x3ffU << ERSPAN3_SID_SHIFT)
 #define ERSPAN3_P_SHIFT                        15
-#define ERSPAN3_P_MASK                 (0x1U << ERSPAN3_P_MASK)
+#define ERSPAN3_P_MASK                 (0x1U << ERSPAN3_P_SHIFT)
 #define ERSPAN3_FT_SHIFT               10
-#define ERSPAN3_FT_MASK                        (0x1fU << ERSPAN3_FT_MASK)
+#define ERSPAN3_FT_MASK                        (0x1fU << ERSPAN3_FT_SHIFT)
+#define ERSPAN3_FT_ETHERNET            0
+#define ERSPAN3_FT_IP                  2
 #define ERSPAN3_HW_ID_SHIFT            4
-#define ERSPAN3_HW_ID_MASK             (0x3fU << ERSPAN3_HW_ID_MASK)
+#define ERSPAN3_HW_ID_MASK             (0x3fU << ERSPAN3_HW_ID_SHIFT)
 #define ERSPAN3_D_SHIFT                        3
 #define ERSPAN3_D_MASK                 (0x1U << ERSPAN3_D_SHIFT)
 #define ERSPAN3_GRA_SHIFT              1
-#define ERSPAN3_GRA_MASK               (0x3U << ERSPAN3_GRA_MASK)
+#define ERSPAN3_GRA_MASK               (0x3U << ERSPAN3_GRA_SHIFT)
 #define ERSPAN3_O_SHIFT                        0
 #define ERSPAN3_O_MASK                 (0x1U << ERSPAN3_O_SHIFT)
 
@@ -189,10 +191,16 @@ static const struct tok erspan3_bso_values[] = {
        { 0, NULL }
 };
 
+static const struct tok erspan3_ft_values[] = {
+       { ERSPAN3_FT_ETHERNET, "Ethernet" },
+       { ERSPAN3_FT_IP, "IP" },
+       { 0, NULL }
+};
+
 void
 erspan_print_iii(netdissect_options *ndo, const u_char *bp, u_int len)
 {
-       uint32_t hdr, hdr2, ver, cos, sid;
+       uint32_t hdr, hdr2, ver, cos, sid, ft;
 
        ndo->ndo_protocol = "erspan";
        nd_print_protocol(ndo);
@@ -250,6 +258,11 @@ erspan_print_iii(netdissect_options *ndo, const u_char *bp, u_int len)
        bp += 2;
        len -= 2;
 
+       ft = (hdr2 & ERSPAN3_FT_MASK) >> ERSPAN3_FT_SHIFT;
+       ND_PRINT(" ft %s",
+                tok2str(erspan3_ft_values, "unknown %x", ft));
+
+
        /* Do we have the platform-specific header? */
        if (hdr2 & ERSPAN3_O_MASK) {
                /* Yes.  Skip it. */
@@ -259,7 +272,17 @@ erspan_print_iii(netdissect_options *ndo, const u_char *bp, u_int len)
        }
 
        ND_PRINT(": ");
-       ether_print(ndo, bp, len, ND_BYTES_AVAILABLE_AFTER(bp), NULL, NULL);
+
+       switch (ft) {
+
+       case ERSPAN3_FT_ETHERNET:
+               ether_print(ndo, bp, len, ND_BYTES_AVAILABLE_AFTER(bp), NULL, NULL);
+               break;
+
+       default:
+               ND_PRINT("Frame type unknown");
+               break;
+       }
        return;
 
 invalid:

diff --git a/tests/TESTLIST b/tests/TESTLIST
index cc4dc30a818b42cdb39715f1280bc05d7f208d25..fcb725c985c9dcc35ca2aaa77ba901f925df3200 100644 (file)
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -582,7 +582,8 @@ erspan-type-i-4             erspan-type-i-4.pcap    erspan-type-i-4.out     -v
 erspan-type-ii-1       erspan-type-ii-1.pcap   erspan-type-ii-1.out    -v
 erspan-type-ii-2       erspan-type-ii-2.pcap   erspan-type-ii-2.out    -v
 erspan-type-ii-3       erspan-type-ii-3.pcap   erspan-type-ii-3.out    -v
-erspan-type-iii-1      erspan-type-iii-1.pcap  erspan-type-iii-1.out   -v
+erspan-type-iii-ft-0   erspan-type-iii-ft-0.pcap       erspan-type-iii-ft-0.out        -v
+erspan-type-iii-ft-7   erspan-type-iii-ft-7.pcap       erspan-type-iii-ft-7.out        -v
 
 # bad packets from Hanno Böck
 # heap-overflow-1 is in non-bsd.tests

diff --git a/tests/erspan-type-iii-ft-0.out b/tests/erspan-type-iii-ft-0.out
new file mode 100644 (file)
index 0000000..86b8896
--- /dev/null
+++ b/tests/erspan-type-iii-ft-0.out
@@ -0,0 +1,36 @@
+    1  2019-09-29 07:58:26.661437 IP (tos 0x0, ttl 63, id 0, offset 0, flags [none], proto GRE (47), length 138)
+    10.29.30.104 > 10.29.11.13: GREv0, Flags [none], length 118
+       erspan type3 session 0 bso Good/unknown cos 0 ft Ethernet: IP (tos 0x0, ttl 63, id 40210, offset 0, flags [DF], proto ICMP (1), length 84)
+    10.29.11.1 > 10.29.20.21: ICMP echo request, id 16331, seq 226, length 64
+    2  2019-09-29 07:58:27.685531 IP (tos 0x0, ttl 63, id 0, offset 0, flags [none], proto GRE (47), length 138)
+    10.29.30.104 > 10.29.11.13: GREv0, Flags [none], length 118
+       erspan type3 session 0 bso Good/unknown cos 0 ft Ethernet: IP (tos 0x0, ttl 63, id 40434, offset 0, flags [DF], proto ICMP (1), length 84)
+    10.29.11.1 > 10.29.20.21: ICMP echo request, id 16331, seq 227, length 64
+    3  2019-09-29 07:58:28.709480 IP (tos 0x0, ttl 63, id 0, offset 0, flags [none], proto GRE (47), length 138)
+    10.29.30.104 > 10.29.11.13: GREv0, Flags [none], length 118
+       erspan type3 session 0 bso Good/unknown cos 0 ft Ethernet: IP (tos 0x0, ttl 63, id 40562, offset 0, flags [DF], proto ICMP (1), length 84)
+    10.29.11.1 > 10.29.20.21: ICMP echo request, id 16331, seq 228, length 64
+    4  2019-09-29 07:58:29.733534 IP (tos 0x0, ttl 63, id 0, offset 0, flags [none], proto GRE (47), length 138)
+    10.29.30.104 > 10.29.11.13: GREv0, Flags [none], length 118
+       erspan type3 session 0 bso Good/unknown cos 0 ft Ethernet: IP (tos 0x0, ttl 63, id 40634, offset 0, flags [DF], proto ICMP (1), length 84)
+    10.29.11.1 > 10.29.20.21: ICMP echo request, id 16331, seq 229, length 64
+    5  2019-09-29 07:58:30.757572 IP (tos 0x0, ttl 63, id 0, offset 0, flags [none], proto GRE (47), length 138)
+    10.29.30.104 > 10.29.11.13: GREv0, Flags [none], length 118
+       erspan type3 session 0 bso Good/unknown cos 0 ft Ethernet: IP (tos 0x0, ttl 63, id 40761, offset 0, flags [DF], proto ICMP (1), length 84)
+    10.29.11.1 > 10.29.20.21: ICMP echo request, id 16331, seq 230, length 64
+    6  2019-09-29 07:58:31.781502 IP (tos 0x0, ttl 63, id 0, offset 0, flags [none], proto GRE (47), length 138)
+    10.29.30.104 > 10.29.11.13: GREv0, Flags [none], length 118
+       erspan type3 session 0 bso Good/unknown cos 0 ft Ethernet: IP (tos 0x0, ttl 63, id 40946, offset 0, flags [DF], proto ICMP (1), length 84)
+    10.29.11.1 > 10.29.20.21: ICMP echo request, id 16331, seq 231, length 64
+    7  2019-09-29 07:58:32.805543 IP (tos 0x0, ttl 63, id 0, offset 0, flags [none], proto GRE (47), length 138)
+    10.29.30.104 > 10.29.11.13: GREv0, Flags [none], length 118
+       erspan type3 session 0 bso Good/unknown cos 0 ft Ethernet: IP (tos 0x0, ttl 63, id 41042, offset 0, flags [DF], proto ICMP (1), length 84)
+    10.29.11.1 > 10.29.20.21: ICMP echo request, id 16331, seq 232, length 64
+    8  2019-09-29 07:58:33.829480 IP (tos 0x0, ttl 63, id 0, offset 0, flags [none], proto GRE (47), length 138)
+    10.29.30.104 > 10.29.11.13: GREv0, Flags [none], length 118
+       erspan type3 session 0 bso Good/unknown cos 0 ft Ethernet: IP (tos 0x0, ttl 63, id 41230, offset 0, flags [DF], proto ICMP (1), length 84)
+    10.29.11.1 > 10.29.20.21: ICMP echo request, id 16331, seq 233, length 64
+    9  2019-09-29 07:58:34.853463 IP (tos 0x0, ttl 63, id 0, offset 0, flags [none], proto GRE (47), length 138)
+    10.29.30.104 > 10.29.11.13: GREv0, Flags [none], length 118
+       erspan type3 session 0 bso Good/unknown cos 0 ft Ethernet: IP (tos 0x0, ttl 63, id 41238, offset 0, flags [DF], proto ICMP (1), length 84)
+    10.29.11.1 > 10.29.20.21: ICMP echo request, id 16331, seq 234, length 64

diff --git a/tests/erspan-type-iii-ft-0.pcap b/tests/erspan-type-iii-ft-0.pcap
new file mode 100644 (file)
index 0000000..2e1d282
Binary files /dev/null and b/tests/erspan-type-iii-ft-0.pcap differ

diff --git a/tests/erspan-type-iii-1.out b/tests/erspan-type-iii-ft-7.out
similarity index 54%
rename from tests/erspan-type-iii-1.out
rename to tests/erspan-type-iii-ft-7.out
index 61b25f379c6b442cb32621569b790b69f412f84c..e3ada4976f8b960aa63c8a4c1707635313a7447e 100644 (file)
--- a/tests/erspan-type-iii-1.out
+++ b/tests/erspan-type-iii-ft-7.out
@@ -1,240 +1,174 @@
     1  2017-02-12 03:55:21.583545 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47838, length 92
-       erspan type3 session 101 bso Bad cos 0: 4b:87:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
     2  2017-02-12 03:55:21.583600 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47839, length 92
-       erspan type3 session 101 bso Bad cos 0: 4b:87:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
     3  2017-02-12 03:55:22.022711 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47840, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
     4  2017-02-12 03:55:24.022653 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47841, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
     5  2017-02-12 03:55:26.022595 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47842, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
     6  2017-02-12 03:55:28.022542 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47843, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
     7  2017-02-12 03:55:30.022483 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47844, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
     8  2017-02-12 03:55:31.583262 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47845, length 92
-       erspan type3 session 101 bso Bad cos 0: 4b:9e:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
     9  2017-02-12 03:55:31.583312 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47846, length 92
-       erspan type3 session 101 bso Bad cos 0: 4b:9e:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    10  2017-02-12 03:55:32.022425 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47847, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    11  2017-02-12 03:55:34.022368 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47848, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    12  2017-02-12 03:55:36.022310 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47849, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    13  2017-02-12 03:55:38.022256 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47850, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    14  2017-02-12 03:55:40.022201 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47851, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    15  2017-02-12 03:55:41.582985 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47852, length 92
-       erspan type3 session 101 bso Bad cos 0: 4b:b5:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    16  2017-02-12 03:55:41.583029 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47853, length 92
-       erspan type3 session 101 bso Bad cos 0: 4b:b5:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    17  2017-02-12 03:55:42.022149 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47854, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    18  2017-02-12 03:55:42.048321 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47855, length 92
-       erspan type3 session 101 bso Bad cos 0: 4b:b6:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 72: 
-       0x0000:  1418 7760 aa75 8100 0361 0806 0001 0800  ..w`.u...a......
-       0x0010:  0604 0001 1418 7760 aa75 0af0 138b 0000  ......w`.u......
-       0x0020:  0000 0000 0af0 1381 0000 0000 0000 0000  ................
-       0x0030:  0000 0000 0000 0000 0000                 ..........
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    19  2017-02-12 03:55:44.022090 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47856, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    20  2017-02-12 03:55:46.022036 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47857, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    21  2017-02-12 03:55:48.021981 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47858, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    22  2017-02-12 03:55:50.021922 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47859, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    23  2017-02-12 03:55:51.582703 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47860, length 92
-       erspan type3 session 101 bso Bad cos 0: 4b:cd:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    24  2017-02-12 03:55:51.582748 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47861, length 92
-       erspan type3 session 101 bso Bad cos 0: 4b:cd:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    25  2017-02-12 03:55:52.021865 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47862, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    26  2017-02-12 03:55:54.021808 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47863, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    27  2017-02-12 03:55:56.021750 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47864, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    28  2017-02-12 03:55:58.021697 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47865, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    29  2017-02-12 03:56:00.021643 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47866, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    30  2017-02-12 03:56:01.582424 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47867, length 92
-       erspan type3 session 101 bso Bad cos 0: 4b:e4:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    31  2017-02-12 03:56:01.582469 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47868, length 92
-       erspan type3 session 101 bso Bad cos 0: 4b:e4:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    32  2017-02-12 03:56:02.021587 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47869, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    33  2017-02-12 03:56:04.021530 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47870, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    34  2017-02-12 03:56:06.021475 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47871, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    35  2017-02-12 03:56:08.021417 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47872, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    36  2017-02-12 03:56:10.021363 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47873, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    37  2017-02-12 03:56:11.582146 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47874, length 92
-       erspan type3 session 101 bso Bad cos 0: 4b:fb:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    38  2017-02-12 03:56:11.582191 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47875, length 92
-       erspan type3 session 101 bso Bad cos 0: 4b:fb:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    39  2017-02-12 03:56:12.021307 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47876, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    40  2017-02-12 03:56:12.859628 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 144)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47877, length 124
-       erspan type3 session 101 bso Bad cos 0: 4b:fe:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 104: 
-       0x0000:  1418 7760 aa75 8100 0361 0800 4500 004e  ..w`.u...a..E..N
-       0x0010:  0726 0000 8011 f60f 0af0 138b 0af0 13ff  .&..............
-       0x0020:  0089 0089 003a 933c b946 0110 0001 0000  .....:.<.F......
-       0x0030:  0000 0000 2045 4a45 4f46 4546 4345 4245  .....EJEOFEFCEBE
-       0x0040:  4846 4145 4845 4545 5043 4143 4143 4143  HFAEHEEEPCACACAC
-       0x0050:  4143 4141 4100 0020 0001                 ACAAA.....
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    41  2017-02-12 03:56:12.859864 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 122)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47878, length 102
-       erspan type3 session 101 bso Bad cos 0: 4b:fe:01:00:5e:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Unknown DSAP 0x14 Unnumbered, 67, Flags [Poll], length 68
-       0x0000:  1418 7760 aa75 8100 0361 0800 4500 0038  ..w`.u...a..E..8
-       0x0010:  1875 0000 0111 a1c9 0af0 138b e000 00fc  .u..............
-       0x0020:  ff5b 14eb 0024 e893 da3c 0000 0001 0000  .[...$...<......
-       0x0030:  0000 0000 0a69 6e74 7261 6770 6764 6f00  .....intragpgdo.
-       0x0040:  0001 0001                                ....
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    42  2017-02-12 03:56:12.860029 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 122)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47879, length 102
-       erspan type3 session 101 bso Bad cos 0: 4b:fe:01:00:5e:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Unknown DSAP 0x14 Unnumbered, 67, Flags [Poll], length 68
-       0x0000:  1418 7760 aa75 8100 0361 0800 4500 0038  ..w`.u...a..E..8
-       0x0010:  1876 0000 0111 a1c8 0af0 138b e000 00fc  .v..............
-       0x0020:  fdb4 14eb 0024 a251 220b 0000 0001 0000  .....$.Q".......
-       0x0030:  0000 0000 0a69 6e74 7261 6770 6764 6f00  .....intragpgdo.
-       0x0040:  001c 0001                                ....
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    43  2017-02-12 03:56:13.050090 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47880, length 92
-       erspan type3 session 101 bso Bad cos 0: 4b:ff:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 72: 
-       0x0000:  1418 7760 aa75 8100 0361 0806 0001 0800  ..w`.u...a......
-       0x0010:  0604 0001 1418 7760 aa75 0af0 138b 0000  ......w`.u......
-       0x0020:  0000 0000 0af0 1385 0000 0000 0000 0000  ................
-       0x0030:  0000 0000 0000 0000 0000                 ..........
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    44  2017-02-12 03:56:13.268895 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 122)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47881, length 102
-       erspan type3 session 101 bso Bad cos 0: 4b:ff:01:00:5e:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Unknown DSAP 0x14 Unnumbered, 67, Flags [Poll], length 68
-       0x0000:  1418 7760 aa75 8100 0361 0800 4500 0038  ..w`.u...a..E..8
-       0x0010:  1877 0000 0111 a1c7 0af0 138b e000 00fc  .w..............
-       0x0020:  fdb4 14eb 0024 a251 220b 0000 0001 0000  .....$.Q".......
-       0x0030:  0000 0000 0a69 6e74 7261 6770 6764 6f00  .....intragpgdo.
-       0x0040:  001c 0001                                ....
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    45  2017-02-12 03:56:13.268927 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 122)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47882, length 102
-       erspan type3 session 101 bso Bad cos 0: 4b:ff:01:00:5e:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Unknown DSAP 0x14 Unnumbered, 67, Flags [Poll], length 68
-       0x0000:  1418 7760 aa75 8100 0361 0800 4500 0038  ..w`.u...a..E..8
-       0x0010:  1878 0000 0111 a1c6 0af0 138b e000 00fc  .x..............
-       0x0020:  ff5b 14eb 0024 e893 da3c 0000 0001 0000  .[...$...<......
-       0x0030:  0000 0000 0a69 6e74 7261 6770 6764 6f00  .....intragpgdo.
-       0x0040:  0001 0001                                ....
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    46  2017-02-12 03:56:13.643869 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 144)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47883, length 124
-       erspan type3 session 101 bso Bad cos 0: 4c:00:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 104: 
-       0x0000:  1418 7760 aa75 8100 0361 0800 4500 004e  ..w`.u...a..E..N
-       0x0010:  0728 0000 8011 f60d 0af0 138b 0af0 13ff  .(..............
-       0x0020:  0089 0089 003a 933c b946 0110 0001 0000  .....:.<.F......
-       0x0030:  0000 0000 2045 4a45 4f46 4546 4345 4245  .....EJEOFEFCEBE
-       0x0040:  4846 4145 4845 4545 5043 4143 4143 4143  HFAEHEEEPCACACAC
-       0x0050:  4143 4141 4100 0020 0001                 ACAAA.....
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    47  2017-02-12 03:56:14.021252 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47884, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    48  2017-02-12 03:56:14.445047 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 144)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47885, length 124
-       erspan type3 session 101 bso Bad cos 0: 4c:02:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 104: 
-       0x0000:  1418 7760 aa75 8100 0361 0800 4500 004e  ..w`.u...a..E..N
-       0x0010:  072a 0000 8011 f60b 0af0 138b 0af0 13ff  .*..............
-       0x0020:  0089 0089 003a 933c b946 0110 0001 0000  .....:.<.F......
-       0x0030:  0000 0000 2045 4a45 4f46 4546 4345 4245  .....EJEOFEFCEBE
-       0x0040:  4846 4145 4845 4545 5043 4143 4143 4143  HFAEHEEEPCACACAC
-       0x0050:  4143 4141 4100 0020 0001                 ACAAA.....
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    49  2017-02-12 03:56:14.852333 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47886, length 92
-       erspan type3 session 101 bso Bad cos 0: 4c:03:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 72: 
-       0x0000:  1418 7760 aa75 8100 0361 0806 0001 0800  ..w`.u...a......
-       0x0010:  0604 0001 1418 7760 aa75 0af0 138b 0000  ......w`.u......
-       0x0020:  0000 0000 0af0 1385 0000 0000 0000 0000  ................
-       0x0030:  0000 0000 0000 0000 0000                 ..........
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    50  2017-02-12 03:56:15.549506 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47887, length 92
-       erspan type3 session 101 bso Bad cos 0: 4c:04:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 72: 
-       0x0000:  1418 7760 aa75 8100 0361 0806 0001 0800  ..w`.u...a......
-       0x0010:  0604 0001 1418 7760 aa75 0af0 138b 0000  ......w`.u......
-       0x0020:  0000 0000 0af0 1385 0000 0000 0000 0000  ................
-       0x0030:  0000 0000 0000 0000 0000                 ..........
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    51  2017-02-12 03:56:16.021193 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47888, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    52  2017-02-12 03:56:16.547213 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47889, length 92
-       erspan type3 session 101 bso Bad cos 0: 4c:07:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 72: 
-       0x0000:  1418 7760 aa75 8100 0361 0806 0001 0800  ..w`.u...a......
-       0x0010:  0604 0001 1418 7760 aa75 0af0 138b 0000  ......w`.u......
-       0x0020:  0000 0000 0af0 1385 0000 0000 0000 0000  ................
-       0x0030:  0000 0000 0000 0000 0000                 ..........
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    53  2017-02-12 03:56:18.021131 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47890, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    54  2017-02-12 03:56:20.021084 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 108)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47891, length 88
-       erspan type3 session 101 bso Bad cos 0:  [|llc]
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    55  2017-02-12 03:56:20.859987 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47892, length 92
-       erspan type3 session 101 bso Bad cos 0: 4c:11:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 72: 
-       0x0000:  1418 7760 aa75 8100 0361 0806 0001 0800  ..w`.u...a......
-       0x0010:  0604 0001 1418 7760 aa75 0af0 138b 0000  ......w`.u......
-       0x0020:  0000 0000 0af0 1385 0000 0000 0000 0000  ................
-       0x0030:  0000 0000 0000 0000 0000                 ..........
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    56  2017-02-12 03:56:21.547457 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47893, length 92
-       erspan type3 session 101 bso Bad cos 0: 4c:12:ff:ff:ff:ff > 00:00:ab:c5:00:00, ethertype Unknown (0xffff), length 72: 
-       0x0000:  1418 7760 aa75 8100 0361 0806 0001 0800  ..w`.u...a......
-       0x0010:  0604 0001 1418 7760 aa75 0af0 138b 0000  ......w`.u......
-       0x0020:  0000 0000 0af0 1385 0000 0000 0000 0000  ................
-       0x0030:  0000 0000 0000 0000 0000                 ..........
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    57  2017-02-12 03:56:21.581865 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47894, length 92
-       erspan type3 session 101 bso Bad cos 0: 4c:12:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown
    58  2017-02-12 03:56:21.581909 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto GRE (47), length 112)
     192.168.1.172 > 192.168.1.249: GREv0, Flags [sequence# present], seq 47895, length 92
-       erspan type3 session 101 bso Bad cos 0: 4c:12:01:00:81:00 Unknown SSAP 0x18 > 00:00:ab:c5:00:00 Null Supervisory, Reject, rcv seq 111, Flags [Final], length 58
+       erspan type3 session 101 bso Bad cos 0 ft unknown 7: Frame type unknown

diff --git a/tests/erspan-type-iii-1.pcap b/tests/erspan-type-iii-ft-7.pcap
similarity index 100%
rename from tests/erspan-type-iii-1.pcap
rename to tests/erspan-type-iii-ft-7.pcap