issue with tunnel interface

[secmask]

Is gopacket support tunnel network inteface (example LVS virtual inteface)?, I use httpassembly on tunnel inteface and it report "Unable to decode packet with linkType 12"

[gconnell]

We don't currently have support for it, but I expect adding support would
not be too difficult. Do you know what protocol the packets appear in on
those interfaces?

On Fri, Jul 24, 2015 at 3:31 AM, secmask notifications@github.com wrote:

Is gopacket support tunnel network inteface (example LVS virtual
inteface)?, I use httpassembly on tunnel inteface and it report "Unable to
decode packet with linkType 12"

—
Reply to this email directly or view it on GitHub
#99.

[secmask]

What do you mean "protocol the packets appear in on those interfaces" ? , It's a tunnel inteface use by LVS, and I use LVS-Tun mode, so I guess the packets are in ipip protocol.

[mattes]

It should work. Please remember that if you use a TUN interface, the first layer to decode is an IP layer.

[djadala]

it works only if i manually check LinkType and set decoder:

var decoder gopacket.Decoder

if handle.LinkType() == 12 {
    decoder = layers.LayerTypeIPv4
} else {
    decoder = handle.LinkType()
}

packetSource := gopacket.NewPacketSource(handle, decoder)

but i prefer this also to work:

packetSource := gopacket.NewPacketSource(handle,  handle.LinkType())

-  DecodeFailure
Error decoding some part of the packet: Packet decoding error: Unable to decode link type 12

ifconfig, uname:

tun-priv  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:192.168.5.54  P-t-P:192.168.5.54  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:198395 errors:0 dropped:0 overruns:0 frame:0
          TX packets:379741 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:23306285 (22.2 MiB)  TX bytes:119093284 (113.5 MiB)

Linux bee 4.3.0-0.bpo.1-amd64 #1 SMP Debian 4.3.5-1~bpo8+1 (2016-02-23) x86_64 GNU/Linux

Regards,

[djadala]

just to mention that link type 12 can be registered manually in user application as:

layers.LinkTypeMetadata[12] = layers.EnumMetadata{
        DecodeWith: layers.LayerTypeIPv4, 
        Name: "tun",
}

and everything works afterward.

If it is always IPv4 layer, then link type 12 can be added to:

gopacket/layers/enums.go

Line 497 in 8e484f3

LinkTypeMetadata[LinkTypeEthernet] = EnumMetadata{DecodeWith: gopacket.DecodeFunc(decodeEthernet), Name: "Ethernet"}

and this issue closed ?

[tianon]

Ran into this same issue; I tried adjusting layers.LayerTypeIPv4 to be layers.LinkTypeIPv4 (because LayerTypeIPv4 doesn't exist), but it still errored out trying to decode packets. When I used layers.LinkTypeRaw in place of 12 instead, everything worked (and I'm getting decoded IPv6 packets from the tunnel too). 👍

[notti]

I ran into a smiliar issue, but I had this in a pcap file (don't know how those were captured). In this case packets were IPv4 or IPv6, like the raw type.

[benitogf]

I had a simmilar issue with a usb pcap
DecodeFailure Packet decoding error: Unable to decode LinkType 249

solved using the usb decoder instead of LinkType()

packetSource := gopacket.NewPacketSource(handle, layers.USBTransportTypeBulk)
for packet := range packetSource.Packets() {
	log.Println(packet.Data()) // Do something with a packet here.
}