etherip

Documentation

Overview

Package etherip decodes EtherIP (RFC 3378) — the protocol that tunnels a whole Ethernet frame inside an IP packet (IP protocol 97). It completes the project's tunnel-decap decoder family alongside internal/gre, internal/geneve, internal/vxlan, internal/mpls and internal/sflow: a captured EtherIP packet is an L2-over-IP tunnel (used for transparent bridging / L2 VPNs, and as a data-exfiltration / pivot encapsulation), so decoding it surfaces the tunnelled inner Ethernet frame — the MAC addresses, the EtherType, and (when the inner payload is IP) the encapsulated flow's addresses / protocol / ports via internal/ipdecode.

Wrap-vs-native judgement

Native. An EtherIP packet is a 2-byte header (a 4-bit version + 12-bit
reserved) followed by an Ethernet frame. A byte-field read + the
existing inner-IP decode path; stdlib only, no new go.mod dep. The
same chain-to-ipdecode pattern as gre / sflow.

Verifiable / no confidently-wrong output

The 2-byte header and the inner Ethernet header were verified
field-for-field against scapy's EtherIP layer (scapy.contrib.etherip).
The version is required to be 3 (RFC 3378) — a non-EtherIP packet is
rejected, not mis-decoded. When the inner EtherType is IPv4 / IPv6 the
L3 payload is decoded in place via internal/ipdecode (degrading to an
inner_decode_error + raw payload on a parse failure); a non-IP
EtherType leaves the inner frame surfaced as raw hex.

Index

• type Result
  • func Decode(input string) (*Result, error)

Types

type Result

type Result struct {
	Version  int `json:"version"`
	Reserved int `json:"reserved"`

	InnerDstMAC   string `json:"inner_dst_mac"`
	InnerSrcMAC   string `json:"inner_src_mac"`
	EtherType     int    `json:"ether_type"`
	EtherTypeHex  string `json:"ether_type_hex"`
	EtherTypeName string `json:"ether_type_name"`

	InnerFrameHex    string           `json:"inner_frame_hex,omitempty"`
	InnerPacket      *ipdecode.Packet `json:"inner_packet,omitempty"`
	InnerDecodeError string           `json:"inner_decode_error,omitempty"`

	Notes []string `json:"notes,omitempty"`
}

Result is the decoded view of an EtherIP packet.

func Decode

func Decode(input string) (*Result, error)

Decode parses an EtherIP packet (the IP-protocol-97 payload) from hex (whitespace / ':' / '-' / '_' separators and a '0x' prefix tolerated).