@netkitty/codec 1.0.0

package/dist/headers/LLDP.d.ts

@@ -0,0 +1,26 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * LLDP — Link Layer Discovery Protocol (IEEE 802.1AB), carried directly in an Ethernet II frame with
+ * EtherType 0x88CC (an Ethernet child — no IP/UDP). An LLDPDU is a flat sequence of TLVs; each TLV is a
+ * 2-byte header — Type (7 bits, the high bits 15..9) + Length (9 bits, bits 8..0, the value byte count) —
+ * followed by Length value bytes. The mandatory TLVs come first in order (Chassis ID = 1, Port ID = 2,
+ * Time To Live = 3), then zero or more optional TLVs, terminated by the End Of LLDPDU TLV (type 0,
+ * length 0). LLDP has no length field of its own — it runs to the end of the frame.
+ *
+ * TLVs are carried generically (type + verbatim hex value) so every TLV — including optional and
+ * organization-specific ones whose value is opaque — round-trips byte-for-byte; per-TLV semantic decoding
+ * is a later enrichment. The walk stops at the End TLV (type 0) or when the frame is exhausted; any bytes
+ * after the End TLV are Ethernet padding, kept verbatim in `padding` so the frame is reproduced exactly.
+ */
+export declare class LLDP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/LLDP.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LLDP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * LLDP — Link Layer Discovery Protocol (IEEE 802.1AB), carried directly in an Ethernet II frame with
+ * EtherType 0x88CC (an Ethernet child — no IP/UDP). An LLDPDU is a flat sequence of TLVs; each TLV is a
+ * 2-byte header — Type (7 bits, the high bits 15..9) + Length (9 bits, bits 8..0, the value byte count) —
+ * followed by Length value bytes. The mandatory TLVs come first in order (Chassis ID = 1, Port ID = 2,
+ * Time To Live = 3), then zero or more optional TLVs, terminated by the End Of LLDPDU TLV (type 0,
+ * length 0). LLDP has no length field of its own — it runs to the end of the frame.
+ *
+ * TLVs are carried generically (type + verbatim hex value) so every TLV — including optional and
+ * organization-specific ones whose value is opaque — round-trips byte-for-byte; per-TLV semantic decoding
+ * is a later enrichment. The walk stops at the End TLV (type 0) or when the frame is exhausted; any bytes
+ * after the End TLV are Ethernet padding, kept verbatim in `padding` so the frame is reproduced exactly.
+ */
+class LLDP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'lldp';
+        this.name = 'Link Layer Discovery Protocol';
+        this.nickname = 'LLDP';
+        this.matchKeys = ['ethertype:88cc'];
+        //A leaf header — nothing demuxes above LLDP.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (LLDP.#schemaCache ??= LLDP.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'LLDP ${tlvs.length} TLVs',
+            properties: {
+                tlvs: {
+                    type: 'array',
+                    label: 'TLVs',
+                    items: {
+                        type: 'object',
+                        label: 'TLV',
+                        properties: {
+                            type: { type: 'integer', label: 'Type', minimum: 0, maximum: 127 },
+                            value: { type: 'string', label: 'Value', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                        }
+                    },
+                    decode: function () {
+                        //LLDP runs to the end of the frame — there is no length field. Bound the walk by the
+                        //remaining frame bytes, reading each 2-byte TLV header as type(7)+length(9), MSB-first.
+                        const available = this.packet.length - this.startPos;
+                        const tlvs = [];
+                        let offset = 0;
+                        while (offset + 2 <= available) {
+                            const type = this.readBits(offset, 2, 0, 7);
+                            const length = this.readBits(offset, 2, 7, 9);
+                            //A value that overruns the frame (truncation) is not consumed — stop and leave the
+                            //remaining bytes to `padding`, keeping the round-trip exact.
+                            if (offset + 2 + length > available)
+                                break;
+                            const value = length > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset + 2, length)) : '';
+                            tlvs.push({ type: type, value: value });
+                            offset += 2 + length;
+                            //End Of LLDPDU (type 0): logical end of the PDU — anything after is padding.
+                            if (type === 0)
+                                break;
+                        }
+                        this.instance.tlvs.setValue(tlvs);
+                        //Trailing bytes after the End TLV (or after a truncated TLV) are Ethernet padding.
+                        this.instance.padding.setValue(offset < available ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset, available - offset)) : '');
+                    },
+                    encode: function () {
+                        const tlvs = this.instance.tlvs.getValue([]);
+                        let offset = 0;
+                        if (tlvs) {
+                            for (let i = 0; i < tlvs.length; i++) {
+                                const tlv = tlvs[i];
+                                let value = (0, HexToBuffer_1.HexToBuffer)(tlv.value ? tlv.value : '');
+                                //The TLV length is a 9-bit field (max 511 bytes). A longer value cannot be
+                                //represented, so clamp it and record the error rather than silently wrapping
+                                //the length modulo 512 (which would corrupt the following TLVs).
+                                if (value.length > 511) {
+                                    this.recordError(`tlvs[${i}].value`, 'Maximum TLV value length is 511 bytes');
+                                    value = value.subarray(0, 511);
+                                }
+                                //Pack the 2-byte header: type in the high 7 bits, the value byte count in the
+                                //low 9 bits. writeBits masks each field, so type and length never clobber.
+                                this.writeBits(offset, 2, 0, 7, tlv.type ? tlv.type : 0);
+                                this.writeBits(offset, 2, 7, 9, value.length);
+                                offset += 2;
+                                if (value.length) {
+                                    this.writeBytes(offset, value);
+                                    offset += value.length;
+                                }
+                            }
+                        }
+                        const padding = this.instance.padding.getValue('');
+                        if (padding)
+                            this.writeBytes(offset, (0, HexToBuffer_1.HexToBuffer)(padding));
+                    }
+                },
+                //Ethernet padding after the End Of LLDPDU TLV, kept verbatim. No codec of its own — it is
+                //set/read by the `tlvs` field (which owns the single offset walk); this entry is metadata
+                //so the editor sees the padding bytes.
+                padding: {
+                    type: 'string',
+                    label: 'Padding',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX
+                }
+            }
+        };
+    }
+    match() {
+        //An Ethernet child selected by EtherType 0x88CC (stored as a lowercase 4-hex string). Require the
+        //2-byte minimum for one TLV header.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'eth')
+            return false;
+        if (this.prevCodecModule.instance.etherType.getValue() !== '88cc')
+            return false;
+        return this.packet.length - this.startPos >= 2;
+    }
+}
+exports.LLDP = LLDP;

package/dist/headers/LLMNR.d.ts

@@ -0,0 +1,23 @@
+import { DNS } from './DNS';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+/**
+ * LLMNR — Link-Local Multicast Name Resolution (RFC 4795). Like mDNS, the on-wire message is the
+ * standard DNS message format (RFC 1035): the same 12-byte header, questions, and resource records
+ * with label compression. LLMNR reinterprets two header bits that DNS already carries verbatim (the C
+ * "conflict" and T "tentative" bits inside the flags word), so the inherited DNS decode/encode
+ * round-trips every LLMNR message byte-perfect. Only the identity, the demux port (UDP 5355), the Info
+ * summary, and a tightened match() differ. Multicast group 224.0.0.252 / ff02::1:3.
+ */
+export declare class LLMNR extends DNS {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    /**
+     * LLMNR uses UDP port 5355 and never the classic DNS port 53. As UDP produces its demux keys
+     * destination-port-first, reject any packet that carries port 53 (that is DNS) and require 5355.
+     */
+    match(): boolean;
+}

package/dist/headers/LLMNR.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LLMNR = void 0;
+const DNS_1 = require("./DNS");
+/**
+ * LLMNR — Link-Local Multicast Name Resolution (RFC 4795). Like mDNS, the on-wire message is the
+ * standard DNS message format (RFC 1035): the same 12-byte header, questions, and resource records
+ * with label compression. LLMNR reinterprets two header bits that DNS already carries verbatim (the C
+ * "conflict" and T "tentative" bits inside the flags word), so the inherited DNS decode/encode
+ * round-trips every LLMNR message byte-perfect. Only the identity, the demux port (UDP 5355), the Info
+ * summary, and a tightened match() differ. Multicast group 224.0.0.252 / ff02::1:3.
+ */
+class LLMNR extends DNS_1.DNS {
+    constructor() {
+        super(...arguments);
+        this.id = 'llmnr';
+        this.name = 'Link-Local Multicast Name Resolution';
+        this.nickname = 'LLMNR';
+        this.matchKeys = ['udpport:5355'];
+    }
+    static #schemaCache;
+    //Reuse the parent DNS schema (identical wire format + closures) but relabel the Info summary.
+    get SCHEMA() {
+        return (LLMNR.#schemaCache ??= { ...super.SCHEMA, summary: 'LLMNR ${id} queries=${qdcount} answers=${ancount}' });
+    }
+    /**
+     * LLMNR uses UDP port 5355 and never the classic DNS port 53. As UDP produces its demux keys
+     * destination-port-first, reject any packet that carries port 53 (that is DNS) and require 5355.
+     */
+    match() {
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        const srcport = this.prevCodecModule.instance.srcport.getValue(0);
+        const dstport = this.prevCodecModule.instance.dstport.getValue(0);
+        if (srcport === 53 || dstport === 53)
+            return false;
+        return srcport === 5355 || dstport === 5355;
+    }
+}
+exports.LLMNR = LLMNR;

package/dist/headers/LPD.d.ts

@@ -0,0 +1,31 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * LPD / LPR — the Line Printer Daemon protocol (RFC 1179), the classic BSD print-spooling protocol
+ * carried over TCP port 515. A command message is US-ASCII text: a single 1-byte command code followed
+ * by operands (ASCII, space-separated — typically the queue name, and for some commands a user/job
+ * list) terminated by a line feed (0x0A). The daemon commands are 0x01 "Print any waiting jobs",
+ * 0x02 "Receive a printer job", 0x03/0x04 "Send queue state" (short/long), 0x05 "Remove jobs"; inside a
+ * receive-job session the same 1-byte-code framing carries the sub-commands (abort / receive control
+ * file / receive data file), followed by the transferred file bytes.
+ *
+ * Like SIP/HTTP, an LPD stream mixes a short command line with arbitrary (and, for the data-transfer
+ * sub-commands, binary) file content whose framing spans TCP segments — richer than a form needs and
+ * whitespace-significant. So the ENTIRE payload is kept verbatim as the authoritative `message` field
+ * (hex) and re-emitted untouched (byte-perfect for any LPD message); only the leading command byte and
+ * its operand line are parsed on decode into display-only metadata (command / commandName / operands),
+ * which carry no codec of their own — encode never reconstructs the message from them. The payload is
+ * bounded by the enclosing IP datagram (not the whole frame) so a short command does not swallow
+ * Ethernet padding; any trailing bytes fall through to the codec's recursion / RawData.
+ */
+export declare class LPD extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/LPD.js

@@ -0,0 +1,159 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LPD = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/** Human-readable names for the LPD command codes (RFC 1179 §5 daemon commands + §6 receive-job subcommands). */
+const LPD_COMMANDS = {
+    0x01: 'Print any waiting jobs',
+    0x02: 'Receive a printer job',
+    0x03: 'Send queue state (short)',
+    0x04: 'Send queue state (long)',
+    0x05: 'Remove jobs'
+};
+/**
+ * LPD / LPR — the Line Printer Daemon protocol (RFC 1179), the classic BSD print-spooling protocol
+ * carried over TCP port 515. A command message is US-ASCII text: a single 1-byte command code followed
+ * by operands (ASCII, space-separated — typically the queue name, and for some commands a user/job
+ * list) terminated by a line feed (0x0A). The daemon commands are 0x01 "Print any waiting jobs",
+ * 0x02 "Receive a printer job", 0x03/0x04 "Send queue state" (short/long), 0x05 "Remove jobs"; inside a
+ * receive-job session the same 1-byte-code framing carries the sub-commands (abort / receive control
+ * file / receive data file), followed by the transferred file bytes.
+ *
+ * Like SIP/HTTP, an LPD stream mixes a short command line with arbitrary (and, for the data-transfer
+ * sub-commands, binary) file content whose framing spans TCP segments — richer than a form needs and
+ * whitespace-significant. So the ENTIRE payload is kept verbatim as the authoritative `message` field
+ * (hex) and re-emitted untouched (byte-perfect for any LPD message); only the leading command byte and
+ * its operand line are parsed on decode into display-only metadata (command / commandName / operands),
+ * which carry no codec of their own — encode never reconstructs the message from them. The payload is
+ * bounded by the enclosing IP datagram (not the whole frame) so a short command does not swallow
+ * Ethernet padding; any trailing bytes fall through to the codec's recursion / RawData.
+ */
+class LPD extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'lpd';
+        this.name = 'Line Printer Daemon Protocol';
+        this.nickname = 'LPD';
+        this.matchKeys = ['tcpport:515'];
+        //A leaf header — the transferred control/data file bytes of a receive-job session are kept verbatim.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (LPD.#schemaCache ??= LPD.#buildSchema());
+    }
+    /**
+     * Bytes of this LPD layer: LPD rides on TCP (no per-message length), so the payload is the rest of
+     * the segment — but bounded by the enclosing IPv4/IPv6 datagram so a small command line does not
+     * absorb Ethernet padding (min-frame zero padding after a short IP packet). The TCP payload =
+     * IP payload − TCP header length; trailing bytes past that are left to the codec's recursion.
+     */
+    #payloadLength() {
+        let available = this.packet.length - this.startPos;
+        const tcp = this.prevCodecModule;
+        if (tcp) {
+            //Walk back to the enclosing IP layer (skip the TCP module itself at the tail).
+            const modules = this.prevCodecModules;
+            for (let i = modules.length - 2; i >= 0; i--) {
+                const module = modules[i];
+                if (module.id === 'ipv4') {
+                    const tcpPayload = (module.instance.length.getValue(0) - module.length) - tcp.length;
+                    if (tcpPayload >= 0 && tcpPayload < available)
+                        available = tcpPayload;
+                    break;
+                }
+                if (module.id === 'ipv6') {
+                    const tcpPayload = module.instance.plen.getValue(0) - tcp.length;
+                    if (tcpPayload >= 0 && tcpPayload < available)
+                        available = tcpPayload;
+                    break;
+                }
+            }
+        }
+        return available < 0 ? 0 : available;
+    }
+    /**
+     * Parse the display-only metadata from the payload: the leading command byte, its human-readable
+     * name, and the operand text (the ASCII bytes after the command byte up to the first line feed).
+     * Populated on decode only — these fields have no encode, so they never affect the re-emitted bytes.
+     * Never throws: an empty payload yields command 0 / empty operands.
+     */
+    #parseCommand(raw) {
+        const command = raw.length > 0 ? raw[0] : 0;
+        this.instance.command.setValue(command);
+        this.instance.commandName.setValue(LPD_COMMANDS[command] ? LPD_COMMANDS[command] : '');
+        let end = raw.indexOf(0x0a, 1);
+        if (end < 0)
+            end = raw.length;
+        this.instance.operands.setValue(raw.length > 1 ? raw.subarray(1, end).toString('latin1') : '');
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'LPD command=${command}',
+            properties: {
+                //The whole raw payload is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any LPD message). The command byte + operand line
+                //are parsed into the display-only metadata below, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseCommand(Buffer.alloc(0));
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseCommand(raw);
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative payload verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed from the payload on decode (no encode — populated by the
+                //message field above, never read back). command is the 1-byte code, commandName its
+                //RFC 1179 label, operands the ASCII operand line up to the first line feed.
+                command: { type: 'integer', label: 'Command', minimum: 0, maximum: 255 },
+                commandName: { type: 'string', label: 'Command Name' },
+                operands: { type: 'string', label: 'Operands' }
+            }
+        };
+    }
+    match() {
+        //LPD rides on TCP port 515 (selected via the tcpport:515 bucket). This stays a port-bucket
+        //protocol: matchKeys only, NO heuristicFallback — a leading 1-byte command code is far too weak
+        //a signature to claim LPD off port 515, and non-LPD traffic on 515 must fall through to raw. Guard
+        //on port + a valid command code (0x01..0x05) followed by an ASCII operand line ending in a line
+        //feed (LF), so binary/garbage on 515 is not claimed. Bounded by the transport payload (not the
+        //whole frame) so Ethernet padding is not mistaken for the command line.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        const available = this.#payloadLength();
+        if (available < 2)
+            return false;
+        const scan = available < 256 ? available : 256;
+        const lead = this.readBytes(0, scan, true);
+        const command = lead[0];
+        if (command < 0x01 || command > 0x05)
+            return false;
+        //The operand bytes (after the command code, up to the first LF) must be printable ASCII, and a
+        //terminating LF must be present within the scanned window.
+        for (let i = 1; i < lead.length; i++) {
+            const byte = lead[i];
+            if (byte === 0x0a)
+                return true;
+            if (byte < 0x20 || byte > 0x7e)
+                return false;
+        }
+        return false;
+    }
+}
+exports.LPD = LPD;

package/dist/headers/MACsec.d.ts

@@ -0,0 +1,34 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * MACsec — MAC Security (IEEE 802.1AE), carried directly in an Ethernet II frame with EtherType 0x88E5
+ * (an Ethernet child — no IP/UDP). Each frame carries a Security TAG (SecTAG) followed by the secured
+ * user data and a trailing Integrity Check Value (ICV).
+ *
+ * The SecTAG is 6 or 14 octets:
+ *   - byte 0: TCI (TAG Control Information, high 6 bits) + AN (Association Number, low 2 bits). The TCI
+ *     bits, MSB-first, are V (Version), ES (End Station), SC (SCI present), SCB (Single Copy Broadcast),
+ *     E (Encryption), C (Changed text).
+ *   - byte 1: SL (Short Length) — the secured-data octet count when it is < 48, else 0. Informational
+ *     here; it does not bound the secured data (the ICV does).
+ *   - bytes 2..5: PN (Packet Number) — big-endian 32-bit anti-replay counter.
+ *   - bytes 6..13: SCI (Secure Channel Identifier) — 8 octets, present only when the SC bit is set.
+ *
+ * After the SecTAG comes the secured data (the original frame's user data — encrypted when the E bit is
+ * set, otherwise authenticated cleartext) and a fixed 16-octet ICV at the very end of the frame. Without
+ * the SA keys the secured region cannot be split, so — like ESP — MACsec is a leaf: the SecTAG fields are
+ * surfaced and the secured data + ICV are kept verbatim as hex. The secured data spans from the end of
+ * the SecTAG to the last 16 octets (the ICV); nothing is recomputed on encode (a faithful executor
+ * carries the ciphertext and ICV as-is), so a well-formed MACsec frame round-trips byte-for-byte.
+ */
+export declare class MACsec extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/MACsec.js

@@ -0,0 +1,178 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MACsec = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * MACsec — MAC Security (IEEE 802.1AE), carried directly in an Ethernet II frame with EtherType 0x88E5
+ * (an Ethernet child — no IP/UDP). Each frame carries a Security TAG (SecTAG) followed by the secured
+ * user data and a trailing Integrity Check Value (ICV).
+ *
+ * The SecTAG is 6 or 14 octets:
+ *   - byte 0: TCI (TAG Control Information, high 6 bits) + AN (Association Number, low 2 bits). The TCI
+ *     bits, MSB-first, are V (Version), ES (End Station), SC (SCI present), SCB (Single Copy Broadcast),
+ *     E (Encryption), C (Changed text).
+ *   - byte 1: SL (Short Length) — the secured-data octet count when it is < 48, else 0. Informational
+ *     here; it does not bound the secured data (the ICV does).
+ *   - bytes 2..5: PN (Packet Number) — big-endian 32-bit anti-replay counter.
+ *   - bytes 6..13: SCI (Secure Channel Identifier) — 8 octets, present only when the SC bit is set.
+ *
+ * After the SecTAG comes the secured data (the original frame's user data — encrypted when the E bit is
+ * set, otherwise authenticated cleartext) and a fixed 16-octet ICV at the very end of the frame. Without
+ * the SA keys the secured region cannot be split, so — like ESP — MACsec is a leaf: the SecTAG fields are
+ * surfaced and the secured data + ICV are kept verbatim as hex. The secured data spans from the end of
+ * the SecTAG to the last 16 octets (the ICV); nothing is recomputed on encode (a faithful executor
+ * carries the ciphertext and ICV as-is), so a well-formed MACsec frame round-trips byte-for-byte.
+ */
+class MACsec extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'macsec';
+        this.name = 'MAC Security';
+        this.nickname = 'MACsec';
+        this.matchKeys = ['ethertype:88e5'];
+        //A leaf header — the secured data is opaque without the SA keys and cannot be dissected further.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (MACsec.#schemaCache ??= MACsec.#buildSchema());
+    }
+    /** SecTAG length: 6 octets, plus the 8-octet SCI when the SC bit (byte 0, bit 5 MSB-first) is set. */
+    #sectagLength() {
+        return this.instance.sc.getValue(0) ? 14 : 6;
+    }
+    /**
+     * A field packed into the first SecTAG octet (byte 0): `bitLength` bits at `bitOffset` (MSB-first).
+     * Decode reads it into `name`; encode clamps to the field's range (recording an error, never
+     * throwing) and overlays it via writeBits — each sub-field masks its own bits so they never clobber.
+     */
+    static #fieldBits(name, bitOffset, bitLength, label) {
+        const maximum = (1 << bitLength) - 1;
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: maximum,
+            decode: function () {
+                this.instance[name].setValue(this.readBits(0, 1, bitOffset, bitLength));
+            },
+            encode: function () {
+                const node = this.instance[name];
+                let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > maximum) {
+                    this.recordError(node.getPath(), `Maximum value is ${maximum}`);
+                    value = maximum;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBits(0, 1, bitOffset, bitLength, value);
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'MACsec an=${an} pn=${packetNumber}',
+            properties: {
+                //TCI (TAG Control Information) — the high 6 bits of SecTAG byte 0, MSB-first, then AN.
+                version: this.#fieldBits('version', 0, 1, 'Version (V)'),
+                es: this.#fieldBits('es', 1, 1, 'End Station (ES)'),
+                sc: this.#fieldBits('sc', 2, 1, 'SCI Present (SC)'),
+                scb: this.#fieldBits('scb', 3, 1, 'Single Copy Broadcast (SCB)'),
+                encryption: this.#fieldBits('encryption', 4, 1, 'Encryption (E)'),
+                changed: this.#fieldBits('changed', 5, 1, 'Changed Text (C)'),
+                //Association Number — the low 2 bits of SecTAG byte 0.
+                an: this.#fieldBits('an', 6, 2, 'Association Number (AN)'),
+                //Short Length — secured-data octet count when < 48, else 0. Informational; honored verbatim.
+                shortLength: this.fieldUInt('shortLength', 1, 1, 'Short Length (SL)'),
+                //Packet Number — big-endian 32-bit anti-replay counter.
+                packetNumber: this.fieldUInt('packetNumber', 2, 4, 'Packet Number'),
+                //Secure Channel Identifier — 8 octets, present only when the SC bit is set. Its presence
+                //shifts the secured data / ICV by 8 octets (see #sectagLength). Normalised to 8 octets on
+                //encode so the SecTAG length stays consistent with the SC bit.
+                sci: {
+                    type: 'string',
+                    label: 'SCI',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        this.instance.sci.setValue(this.instance.sc.getValue(0) ? (0, BufferToHex_1.BufferToHex)(this.readBytes(6, 8)) : '');
+                    },
+                    encode: function () {
+                        if (!this.instance.sc.getValue(0)) {
+                            this.instance.sci.setValue('');
+                            return;
+                        }
+                        let buffer = (0, HexToBuffer_1.HexToBuffer)(this.instance.sci.getValue('0000000000000000'));
+                        if (buffer.length !== 8) {
+                            this.recordError(this.instance.sci.getPath(), 'SCI must be 8 octets when the SC bit is set');
+                            const fixed = Buffer.alloc(8, 0);
+                            buffer.copy(fixed, 0, 0, Math.min(8, buffer.length));
+                            buffer = fixed;
+                        }
+                        this.instance.sci.setValue((0, BufferToHex_1.BufferToHex)(buffer));
+                        this.writeBytes(6, buffer);
+                    }
+                },
+                //The secured user data (encrypted when the E bit is set, else authenticated cleartext),
+                //kept verbatim. Spans from the end of the SecTAG to the last 16 octets (the ICV); bounded
+                //so the trailing ICV is never pulled in.
+                securedData: {
+                    type: 'string',
+                    label: 'Secured Data',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.packet.length - this.startPos;
+                        const sectag = this.#sectagLength();
+                        let icvStart = available - 16;
+                        if (icvStart < sectag)
+                            icvStart = sectag;
+                        this.instance.securedData.setValue(icvStart > sectag ? (0, BufferToHex_1.BufferToHex)(this.readBytes(sectag, icvStart - sectag)) : '');
+                    },
+                    encode: function () {
+                        const data = this.instance.securedData.getValue('');
+                        if (data)
+                            this.writeBytes(this.#sectagLength(), (0, HexToBuffer_1.HexToBuffer)(data));
+                    }
+                },
+                //The Integrity Check Value — the trailing 16 octets of the frame, kept verbatim (never
+                //recomputed; the SA key is out of band). Placed immediately after the secured data.
+                icv: {
+                    type: 'string',
+                    label: 'ICV',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.packet.length - this.startPos;
+                        const sectag = this.#sectagLength();
+                        let icvStart = available - 16;
+                        if (icvStart < sectag)
+                            icvStart = sectag;
+                        this.instance.icv.setValue(available > icvStart ? (0, BufferToHex_1.BufferToHex)(this.readBytes(icvStart, available - icvStart)) : '');
+                    },
+                    encode: function () {
+                        const icv = this.instance.icv.getValue('');
+                        if (icv) {
+                            const dataBytes = (0, HexToBuffer_1.HexToBuffer)(this.instance.securedData.getValue('')).length;
+                            this.writeBytes(this.#sectagLength() + dataBytes, (0, HexToBuffer_1.HexToBuffer)(icv));
+                        }
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //An Ethernet child selected by EtherType 0x88E5 (stored as a lowercase 4-hex string). Require the
+        //6-octet minimum SecTAG (TCI/AN + SL + PN, no SCI) so the fixed header fields have room.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'eth')
+            return false;
+        if (this.prevCodecModule.instance.etherType.getValue() !== '88e5')
+            return false;
+        return this.packet.length - this.startPos >= 6;
+    }
+}
+exports.MACsec = MACsec;

package/dist/headers/MDNS.d.ts

@@ -0,0 +1,26 @@
+import { DNS } from './DNS';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+/**
+ * mDNS — Multicast DNS (RFC 6762). The on-wire message format is byte-for-byte the standard DNS message
+ * (RFC 1035): the same 12-byte header, questions, and resource records with label compression. mDNS
+ * only reinterprets bits that DNS already carries verbatim — the top bit of a question's QCLASS is the
+ * unicast-response (QU) bit, and the top bit of a record's CLASS is the cache-flush bit — so storing
+ * QCLASS/CLASS as their full 16-bit values (as the DNS codec does) preserves them automatically and the
+ * whole message round-trips byte-perfect through the inherited DNS decode/encode. The only differences
+ * here are the protocol identity, the demux port (UDP 5353), the Info summary, and a tightened match().
+ */
+export declare class MDNS extends DNS {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    /**
+     * mDNS lives on UDP port 5353 and never uses the classic DNS port 53. Because UDP produces its demux
+     * keys destination-port-first, a DNS *response* (srcport 53) sent to a client that happens to use
+     * ephemeral port 5353 would otherwise hit the mDNS bucket first and be mislabeled. Reject any packet
+     * that carries port 53 (that is DNS, matched by the udpport:53 bucket), and require 5353 to be present.
+     */
+    match(): boolean;
+}