Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: add a preliminary protocol description #162

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 52 additions & 0 deletions docs/capture_analyse_packets.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
Capturing and analysing tunneldigger packets
############################################

Example pcap filter using tcpdump
*********************************

See :ref:`PDU types`

capture control traffic
^^^^^^^^^^^^^^^^^^^^^^^

.. code:: sh

# capture all tunneldigger control traffic
tcpdump -i eth0 -w /tmp/output.pcap 'udp port 8942 and udp[8] == 0x80'

capture only USAGE packets
^^^^^^^^^^^^^^^^^^^^^^^^^^

.. code:: sh

# capture only USAGE packets
tcpdump -i eth0 -w /tmp/output.pcap 'udp port 8942 and udp[8] == 0x80 and udp[12] == 0x0a'

capture control packets except KEEPALIVE, PMTUD, PMTUD_ACK, PMTUD_NTFY
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

.. code:: sh

# capture control packets except KEEPALIVE, PMTUD, PMTUD_ACK, PMTUD_NTFY
tcpdump -i eth0 -w /tmp/output.pcap 'udp port 8942 and udp[8] == 0x80 and (udp[12] != 5 && udp[12] != 6 && udp[12] != 7 && udp[12] != 9)'


Using wireshark
***************

There is a `custom dissector <https://github.com/wlanslovenija/tunneldigger/blob/master/docs/wireshark-tunneldigger.lua>`_ for tunneldigger written in lua. The dissector is registered as **TD**.

To use the wireshark dissector call wireshark with:

.. code:: sh

cd tunneldigger/docs/
wireshark -Xlua_script:wireshark-tunneldigger.lua

Wireshark might decode the user data as a different protocol (e.g. Cisco HDLC). This can be changed by:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might be worth also explaining how to change the port; tunneldiger is often run on a port different than 8942.


* Click on "wrong" protocol in "Packet Details" pane (usually the pane in the middle).
* Right mouse click, select **Decode As** (Ctrl-Shift-U).
* A new window with decodes should open
* A new row should be already created. The field should be called **L2TPv3 payload type**.
* Select **Ethernet** in the **Current** column.
2 changes: 1 addition & 1 deletion docs/conf.py
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@

# Add any Sphinx extension module names here, as strings. They can be extensions
# coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
extensions = ['sphinx.ext.intersphinx']
extensions = ['sphinx.ext.intersphinx', 'sphinxcontrib.packetdiag']
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does this change do?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, that looks neat. :)


# Add any paths that contain templates here, relative to this directory.
templates_path = ['_templates']
Expand Down
2 changes: 2 additions & 0 deletions docs/index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ Contents

server
client
protocol
capture_analyse_packets

Source Code and Issue Tracker
-----------------------------
Expand Down
60 changes: 60 additions & 0 deletions docs/protocol.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
Tunneldigger protocol
#####################

The Tunneldigger protocol is based on L2TPv3.
Tunneldigger implementing a custom control protocol,
while user data is encapsulated as L2TPv3 specifies.
This allows to use in kernel acceleration of the data path.

The L2TPv3 is specified in `RFC3931 <https://tools.ietf.org/html/rfc3931>`_

Control packets
***************

Tunneldigger is not following RFC3931 for control messages.
Tunneldigger is only supporting the T bit in the first bit to
mark a packet as control data. All other fields of RFC3931
are ignore and have a different meaning..
All fields are encoding with network byte order.

.. packetdiag::

{
colwidth = 16
node_height = 48

0: T
1-7: 0
8-23: Magic 0x73A7
24-31: Version
32-39: Type
40-47: Length
48-63: Value
Copy link
Member

@RalfJung RalfJung Mar 21, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The length of Value is given by Length; why do you write 48-63 here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because it's a packet diagraph. I would like to have a value in there. It's only an example.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The problem is that it is not at all clear this is just an example. And that makes it very confusing IMO.

}


* The T bit must be 1
* Version must be 1
* Type of the PDU
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's a "PDU"?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tunneldigger calls these CONTROL_TYPE or msg_type; that might be more suited terminology.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see. I don't think we use this term anywhere in tunneldigger though?

* Length of the value

.. _PDU types:

PDU types
^^^^^^^^^

.. csv-table:: PDU types
:header: "Type", "Name", "Summary"

0x00, INVALID,
0x01, COOKIE,
0x02, PREPARE,
0x03, ERROR,
0x04, TUNNEL,
0x05, KEEPALIVE,
0x06, PMTUD,
0x07, PMTUD_ACK,
0x08, REL_ACK,
0x09, PMTU_NTFY,
0x0a, USAGE,
0x80, LIMIT,