Fix parsing of pcaps with nested VLAN tags (q-in-q) - #564
Open
rsmck wants to merge 2 commits into
Open
Conversation
Member
|
Hi! Can you provide a sample pcap file to test this change? Thanks! |
Author
|
Unfortunately not, as the only time I've seen it are in pcaps provided to me by a third party and they contain personal data. I could perhaps attempt to construct one based on these but replacing URIs and IDs with anonymised data, but that would take some time. From a regression test point of view, however, can we not confirm this doesn't affect opening any other pcaps which you'll presumably have many of? :) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently sngrep will fail to parse pcap files where multiple 802.1Q tags are present, e.g. the below sample pcap will decode with just 7 packets as it skips any with two tags and also corrupts some of the others I assume when parsing so it ends up missing more than just the packets with two tags.
This fix adds new
capture_packet_skip_vlanwhich loops through and skips all the VLAN tags if present.Have tested with multiple pcaps following this change and no negative impact to any other pcaps, but the test that contained the multiple tags is now decoded correctly.
tshark -r /tmp/sample.pcap -T fields -e frame.number -e frame.protocols
1 eth:ethertype:vlan:ethertype:ip:udp:sip:sdp
2 eth:ethertype:vlan:ethertype:vlan:ethertype:ip:udp:sip
3 eth:ethertype:vlan:ethertype:vlan:ethertype:ip:udp:sip:sdp
4 eth:ethertype:vlan:ethertype:ip:udp:sip
5 eth:ethertype:vlan:ethertype:ip:udp:sip
6 eth:ethertype:vlan:ethertype:vlan:ethertype:ip:udp:sip
7 eth:ethertype:vlan:ethertype:ip:udp:sip:sdp
8 eth:ethertype:vlan:ethertype:vlan:ethertype:ip:udp:sip:sdp
9 eth:ethertype:vlan:ethertype:vlan:ethertype:ip:udp:sip
10 eth:ethertype:vlan:ethertype:ip:udp:sip
11 eth:ethertype:vlan:ethertype:ip:udp:sip
12 eth:ethertype:vlan:ethertype:vlan:ethertype:ip:udp:sip
13 eth:ethertype:vlan:ethertype:vlan:ethertype:ip:udp:sip
14 eth:ethertype:vlan:ethertype:ip:udp:sip:sdp
15 eth:ethertype:vlan:ethertype:vlan:ethertype:ip:udp:sip:sdp
16 eth:ethertype:vlan:ethertype:ip:udp:sip
17 eth:ethertype:vlan:ethertype:vlan:ethertype:ip:udp:sip
18 eth:ethertype:vlan:ethertype:vlan:ethertype:ip:udp:sip
19 eth:ethertype:vlan:ethertype:ip:udp:sip
20 eth:ethertype:vlan:ethertype:ip:udp:sip