-
Notifications
You must be signed in to change notification settings - Fork 52
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
docs: add a preliminary protocol description #162
base: master
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,52 @@ | ||
Capturing and analysing tunneldigger packets | ||
############################################ | ||
|
||
Example pcap filter using tcpdump | ||
********************************* | ||
|
||
See :ref:`PDU types` | ||
|
||
capture control traffic | ||
^^^^^^^^^^^^^^^^^^^^^^^ | ||
|
||
.. code:: sh | ||
|
||
# capture all tunneldigger control traffic | ||
tcpdump -i eth0 -w /tmp/output.pcap 'udp port 8942 and udp[8] == 0x80' | ||
|
||
capture only USAGE packets | ||
^^^^^^^^^^^^^^^^^^^^^^^^^^ | ||
|
||
.. code:: sh | ||
|
||
# capture only USAGE packets | ||
tcpdump -i eth0 -w /tmp/output.pcap 'udp port 8942 and udp[8] == 0x80 and udp[12] == 0x0a' | ||
|
||
capture control packets except KEEPALIVE, PMTUD, PMTUD_ACK, PMTUD_NTFY | ||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | ||
|
||
.. code:: sh | ||
|
||
# capture control packets except KEEPALIVE, PMTUD, PMTUD_ACK, PMTUD_NTFY | ||
tcpdump -i eth0 -w /tmp/output.pcap 'udp port 8942 and udp[8] == 0x80 and (udp[12] != 5 && udp[12] != 6 && udp[12] != 7 && udp[12] != 9)' | ||
|
||
|
||
Using wireshark | ||
*************** | ||
|
||
There is a `custom dissector <https://github.com/wlanslovenija/tunneldigger/blob/master/docs/wireshark-tunneldigger.lua>`_ for tunneldigger written in lua. The dissector is registered as **TD**. | ||
|
||
To use the wireshark dissector call wireshark with: | ||
|
||
.. code:: sh | ||
|
||
cd tunneldigger/docs/ | ||
wireshark -Xlua_script:wireshark-tunneldigger.lua | ||
|
||
Wireshark might decode the user data as a different protocol (e.g. Cisco HDLC). This can be changed by: | ||
|
||
* Click on "wrong" protocol in "Packet Details" pane (usually the pane in the middle). | ||
* Right mouse click, select **Decode As** (Ctrl-Shift-U). | ||
* A new window with decodes should open | ||
* A new row should be already created. The field should be called **L2TPv3 payload type**. | ||
* Select **Ethernet** in the **Current** column. |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -25,7 +25,7 @@ | |
|
||
# Add any Sphinx extension module names here, as strings. They can be extensions | ||
# coming with Sphinx (named 'sphinx.ext.*') or your custom ones. | ||
extensions = ['sphinx.ext.intersphinx'] | ||
extensions = ['sphinx.ext.intersphinx', 'sphinxcontrib.packetdiag'] | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. What does this change do? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Allows to use packet diagrams. http://blockdiag.com/en/nwdiag/packetdiag-examples.html There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Oh, that looks neat. :) |
||
|
||
# Add any paths that contain templates here, relative to this directory. | ||
templates_path = ['_templates'] | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,60 @@ | ||
Tunneldigger protocol | ||
##################### | ||
|
||
The Tunneldigger protocol is based on L2TPv3. | ||
Tunneldigger implementing a custom control protocol, | ||
while user data is encapsulated as L2TPv3 specifies. | ||
This allows to use in kernel acceleration of the data path. | ||
|
||
The L2TPv3 is specified in `RFC3931 <https://tools.ietf.org/html/rfc3931>`_ | ||
|
||
Control packets | ||
*************** | ||
|
||
Tunneldigger is not following RFC3931 for control messages. | ||
Tunneldigger is only supporting the T bit in the first bit to | ||
mark a packet as control data. All other fields of RFC3931 | ||
are ignore and have a different meaning.. | ||
All fields are encoding with network byte order. | ||
|
||
.. packetdiag:: | ||
|
||
{ | ||
colwidth = 16 | ||
node_height = 48 | ||
|
||
0: T | ||
1-7: 0 | ||
8-23: Magic 0x73A7 | ||
24-31: Version | ||
32-39: Type | ||
40-47: Length | ||
48-63: Value | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The length of There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Because it's a packet diagraph. I would like to have a value in there. It's only an example. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The problem is that it is not at all clear this is just an example. And that makes it very confusing IMO. |
||
} | ||
|
||
|
||
* The T bit must be 1 | ||
* Version must be 1 | ||
* Type of the PDU | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. What's a "PDU"? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Tunneldigger calls these CONTROL_TYPE or msg_type; that might be more suited terminology. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Protocol data unit https://en.wikipedia.org/wiki/Protocol_data_unit There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I see. I don't think we use this term anywhere in tunneldigger though? |
||
* Length of the value | ||
|
||
.. _PDU types: | ||
|
||
PDU types | ||
^^^^^^^^^ | ||
|
||
.. csv-table:: PDU types | ||
:header: "Type", "Name", "Summary" | ||
|
||
0x00, INVALID, | ||
0x01, COOKIE, | ||
0x02, PREPARE, | ||
0x03, ERROR, | ||
0x04, TUNNEL, | ||
0x05, KEEPALIVE, | ||
0x06, PMTUD, | ||
0x07, PMTUD_ACK, | ||
0x08, REL_ACK, | ||
0x09, PMTU_NTFY, | ||
0x0a, USAGE, | ||
0x80, LIMIT, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It might be worth also explaining how to change the port; tunneldiger is often run on a port different than 8942.