packet_via_dmem 0.0.2 → 0.0.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +3 -2
- data/lib/packet_via_dmem.rb +48 -19
- data/packet_via_dmem.gemspec +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: b47f13f61222ca447bf34212f1de3d08670bceaa
|
|
4
|
+
data.tar.gz: d6d328de5f66ab0375feded9d1c98b591e93a76c
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: adcfe3a75112cdecbd2ae523708f3f69dfab4a40d3835364d31d68bafb44d5a9df3fe9ca30041d45d5f8c8ba914159031837b404705db8824a872374383cb9d4
|
|
7
|
+
data.tar.gz: 9da8b106d908c403fbabb707a2f9217e3f6d45725998f8017aaec6710a037f1dc9ebbe6ae3d4efc083159fb0f8f9008b10cb2795d2dbdf80cc6a5f6bd01cb105
|
data/README.md
CHANGED
|
@@ -79,10 +79,11 @@ To capture say packets with IP address 10.11.12.13
|
|
|
79
79
|
* Second and third byte appear to tell nothing about where packet came from,
|
|
80
80
|
but more when it came from. Timing? Counter? Randomness?
|
|
81
81
|
|
|
82
|
-
* Fourth byte is 0xf0 on MX80, tendency for last nibble to be 0. Perhaps src fabric stream?
|
|
82
|
+
* Fourth byte is 0xf0 on MX80, tendency for last nibble to be 0. Perhaps src fabric stream? If it is zero, we get what seems to be trash (internal stuff?)
|
|
83
|
+
|
|
83
84
|
* Fifth byte appears to be source port?
|
|
84
85
|
|
|
85
|
-
* Sixth byte is perhaps source NPU?
|
|
86
|
+
* Sixth byte is perhaps source NPU? If it is zero, we get what seems to be trash (internal stuff)
|
|
86
87
|
|
|
87
88
|
* 00 (22) (33) (44) \<src\> (66)
|
|
88
89
|
* 10 (22) (33) (44) \<si\> \<ze\> \<src\> (66)
|
data/lib/packet_via_dmem.rb
CHANGED
|
@@ -5,7 +5,9 @@ class PacketViaDMEM
|
|
|
5
5
|
FAKE = {
|
|
6
6
|
:dmac => %w( 22 22 22 22 22 22 ),
|
|
7
7
|
:smac => %w( 66 66 66 66 66 66 ),
|
|
8
|
-
:
|
|
8
|
+
:etype_mpls => %w( 88 47 ),
|
|
9
|
+
:etype_ipv4 => %w( 08 00 ),
|
|
10
|
+
:ipv4 => %w( 45 ),
|
|
9
11
|
}
|
|
10
12
|
HEADER_SIZE = {
|
|
11
13
|
:received => 6,
|
|
@@ -49,26 +51,53 @@ class PacketViaDMEM
|
|
|
49
51
|
private
|
|
50
52
|
|
|
51
53
|
def get_pop_push type, pkt
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
case pkt.first.to_i(16)
|
|
55
|
-
when 0x00 # we're sending to fabric
|
|
56
|
-
# we may send MAC to fabric,byte 6, 7, 9, 11, 21?
|
|
57
|
-
if pkt[5].to_i(16) == 0xf0 # we don't send MAC to fabric
|
|
58
|
-
push = FAKE[:dmac] + FAKE[:smac] + FAKE[:etype]
|
|
59
|
-
24
|
|
60
|
-
else # we send MAC to fabric
|
|
61
|
-
33
|
|
62
|
-
end
|
|
63
|
-
when 0x08 then 13
|
|
64
|
-
else @sent
|
|
65
|
-
end
|
|
54
|
+
if type == :sent
|
|
55
|
+
get_pop_push_sent pkt
|
|
66
56
|
else
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
57
|
+
get_pop_push_received pkt
|
|
58
|
+
end
|
|
59
|
+
end
|
|
60
|
+
|
|
61
|
+
def get_pop_push_sent pkt
|
|
62
|
+
pop, push = nil, []
|
|
63
|
+
case pkt.first.to_i(16)
|
|
64
|
+
when 0x00 # we're sending to fabric
|
|
65
|
+
# we may send MAC to fabric,byte 6, 7, 9, 11, 21?
|
|
66
|
+
if pkt[5].to_i(16) == 0xf0 # we don't send MAC to fabric
|
|
67
|
+
push = FAKE[:dmac] + FAKE[:smac] + FAKE[:etype_mpls]
|
|
68
|
+
pop = 24
|
|
69
|
+
else # we send MAC to fabric
|
|
70
|
+
pop = 33
|
|
71
71
|
end
|
|
72
|
+
when 0x08 then pop = 13
|
|
73
|
+
else pop = @sent
|
|
74
|
+
end
|
|
75
|
+
[pop, push]
|
|
76
|
+
end
|
|
77
|
+
|
|
78
|
+
def get_pop_push_received pkt
|
|
79
|
+
pop, push = 6, []
|
|
80
|
+
offset = 0
|
|
81
|
+
case pkt.first.to_i(16)
|
|
82
|
+
when 0x00 then offset = 0 #1,2,3,4,5,6
|
|
83
|
+
when 0x10 then offset = 2 #1,2,3,4,7,8,5,6
|
|
84
|
+
else pop = @received
|
|
85
|
+
end
|
|
86
|
+
pop += offset
|
|
87
|
+
case pkt[4+offset..5+offset].join.to_i(16)
|
|
88
|
+
when 0x8000 then pop+=14
|
|
89
|
+
when 0x4220 # ae/802.1AX is special, no L2 received, but something extra
|
|
90
|
+
pop+=18
|
|
91
|
+
push = FAKE[:dmac] + FAKE[:smac] + FAKE[:etype_ipv4]
|
|
92
|
+
when 0x2000 # these were BFD packets from control-plane
|
|
93
|
+
pop+=5
|
|
94
|
+
push = FAKE[:dmac] + FAKE[:smac] + FAKE[:etype_ipv4]
|
|
95
|
+
# some BGP packets like this
|
|
96
|
+
# also SMB2 TCP Seq1 (maybe post ARP from control-plane?)
|
|
97
|
+
# they are misssing all of ipv4 headers before TTL
|
|
98
|
+
when 0x1f00
|
|
99
|
+
pop+=7
|
|
100
|
+
push = FAKE[:dmac] + FAKE[:smac] + FAKE[:etype_ipv4] + FAKE[:ipv4]
|
|
72
101
|
end
|
|
73
102
|
[pop, push]
|
|
74
103
|
end
|
data/packet_via_dmem.gemspec
CHANGED