tcpdump
tcpdump copied to clipboard
the-tcpdump-group
Add printing for HSR/PRP protocols
HSR and PRP are redundancy protocols that duplicates frames and then eliminates the duplicates to ensure only one copy arrives at the destination. The protocols are interoperable and can be converted between. They are defined in the standard IEC62439-3.
Though, PRP is a bit odd so I'm not sure it can even be merged. It uses a trailer at the end of the packet to store the information. So parsing the packet means when need to search from the back. The trailer also holds the packet size to help verify that it is an actual PRP packet, but there's no guarantee. It could match on data in a non-PRP packet that just happens to coincide with the protocol specification. I didn't see any good way to handle this, but if you have ideas I could give it a try. If not possible I can remove the commit.
HSR tags work similar to VLAN tags, and are always placed after any VLAN tags.
I suppose we could have some flag (new or maybe some existing that fits) for the PRP trailer (and potentially other protocols that could mismatch. Not that I can think of any, but maybe there exists more).
I also noticed that I can't filter (like tcpdump -i eth0 arp) for HSR tagged packets. I'm guessing this that needs support in libpcap?
Does
ether proto 0x892fas the filter match the packets you expect?
Yes that matches all HSR tagged packets. I meant if I want to filter on HSR tagged ARP packets I can't do that. I just realized you can't do ether proto 0x8100 for VLAN, I assume the filtering is transparent to VLAN tags (unless specified with vlan X). So should HSR tags behave the same perhaps?
I am not familiar with these protocols, and I get an impression one has to understand the matter well before implementing more code. Please have patience and do not commit too much into preparing libpcap code changes yet.