unsupported DSA tag: qca

[ErwanMAS]

Hi , What we need todo to solve this error ?

root@OpenWrt:~# tcpdump -nei eth1
tcpdump: unsupported DSA tag: qca

root@OpenWrt:~# tcpdump --version
tcpdump version 4.99.5
libpcap version 1.10.5 (with TPACKET_V3)
32-bit build, 64-bit time_t

[infrastation]

What does tcpdump -L -i eth1 print?

[ErwanMAS]

same error

root@OpenWrt:~#  tcpdump -L -i eth1
tcpdump: unsupported DSA tag: qca

[infrastation]

It seems you have hardware that uses the QCA tagging for DSA, which the Linux kernel supports (seemingly since 2015), but libpcap does not.

[infrastation]

Which specific hardware is this, and which OpenWrt release?

[ErwanMAS]

Which specific hardware is this, and which OpenWrt release?

so i have 2 dsa tag that are no supported qca / mtk

Linksys EA7500 V1

cat /etc/openwrt_release ; cat /etc/board.json | jq .model ; tcpdump -nei eth0
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='24.10.0-rc2'
DISTRIB_REVISION='r28161-ea17e958b9'
DISTRIB_TARGET='ipq806x/generic'
DISTRIB_ARCH='arm_cortex-a15_neon-vfpv4'
DISTRIB_DESCRIPTION='OpenWrt 24.10.0-rc2 r28161-ea17e958b9'
DISTRIB_TAINTS=''
{
  "id": "linksys,ea7500-v1",
  "name": "Linksys EA7500 V1 WiFi Router"
}
tcpdump: unsupported DSA tag: qca

Linksys EA7500 V2

cat /etc/openwrt_release ; cat /etc/board.json | jq .model ; tcpdump -nei eth0
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='24.10.0-rc2'
DISTRIB_REVISION='r28161-ea17e958b9'
DISTRIB_TARGET='ramips/mt7621'
DISTRIB_ARCH='mipsel_24kc'
DISTRIB_DESCRIPTION='OpenWrt 24.10.0-rc2 r28161-ea17e958b9'
DISTRIB_TAINTS=''
{
  "id": "linksys,ea7500-v2",
  "name": "Linksys EA7500 v2"
}
tcpdump: unsupported DSA tag: mtk
root@ramir:~#

[0xKira]

Same problem here with OpenWrt 24.10.0-rc3

tcpdump: unsupported DSA tag: mtk

[piyushgarg]

arp-scan --localnet
pcap_activate: unsupported DSA tag: mtk

[vladimiroltean]

For the record, this is a regression, for which I've opened this pull request: https://github.com/the-tcpdump-group/libpcap/pull/1451. Testers welcome.

[infrastation]

Arguably, this is not a regression, but a missing feature. Reopening because at some point it became apparent that the earlier change did not solve this problem correctly, and a better solution is a work in progress. Please note which improvements and where to expect from it:

• tcpdump: unsupported DSA tag: qca (the original problem statement) will change to something like the following:

  tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
  listening on eth1, link-type LINUX_DSA_UNKNOWN (Linux DSA unknown tag type, for manual debugging only), snapshot length 262144 bytes
  11:13:26.719331 UNSUPPORTED
  

  Initially only the hex dump of each packet will be printed, and there will be no support for packet filtering. Based on a description of the qca DSA tag, it should not be difficult to implement these features if the tag works exactly as I think it works. However, I do not have any live or canned traffic of this type to confirm that, so if anybody has such hardware and needs this support implemented, they would have to provide some assistance, possibly more than once (cross-compiling and running, on the device, draft source code and capturing some packets to be made into tests of tcpdump and libpcap — beware that your MAC and IP addresses and any other data in the packets will become public!).
• tcpdump: unsupported DSA tag: mtk — this is similar to the above, but possibly a bit more practicable if my test hardware arrives and works as expected.
• pcap_activate: unsupported DSA tag: mtk — from the source code of arp-scan it seems this fatal error initially is going to be replaced with a non-fatal warning ("WARNING: Unsupported datalink type") followed by a fatal error ("pcap_compile: link-layer type filtering not implemented for DLT_LINUX_DSA_UNKNOWN (Linux DSA unknown tag type, for manual debugging only)"), which would be a reasonable failure because arp-scan tries to compile a filter expression that includes a primitive (arp) that cannot be compiled for a DLT that has no structure:

     filter_string=make_message("ether dst %.2x:%.2x:%.2x:%.2x:%.2x:%.2x and "
                                "(arp or (ether[14:4]=0xaaaa0300 and "
                                "ether[20:2]=0x0806) or (ether[12:2]=0x8100 "
                                "and ether[16:2]=0x0806) or "
                                "(ether[12:2]=0x8100 and "
                                "ether[18:4]=0xaaaa0300 and "
                                "ether[24:2]=0x0806))",
                                arp_sha[0], arp_sha[1],
                                arp_sha[2], arp_sha[3],
                                arp_sha[4], arp_sha[5]);
  

  Then if the mtk DSA tag support gets implemented as discussed above, the fatal error will stop occurring, but from the looks of the expression it seems it will just quietly not work as intended: the correct usage would require either strictly requiring DLT_EN10MB or using primitives that say what needs to match without saying where exactly in the packet to look, or both, and the current implementation in arp-scan does neither. Some of this problem space may be easier to fix than the other, but let's sort at least some DSA tag support in libpcap first and then see what problem space remains at the arp-scan side of the fence.

[infrastation]

"mtk" is not going to be supported in near future because captured frames can appear in more than one format and it is either impossible or difficult to define a reliable DLT format for this DSA tag. To implement support for "qca" it would be necessary to collect some testing material, as discussed earlier, and to define the DLT.

[infrastation]

Alright, I now have a test device with OpenWrt and qca:

# grep . /sys/class/net/*/dsa/tagging 
/sys/class/net/eth0/dsa/tagging:qca
/sys/class/net/eth1/dsa/tagging:qca

This is going to be progressed after the next stable release (that is, not necessarily in 2025).