tzsp

Documentation

Overview

Package tzsp decodes the TaZmen Sniffer Protocol (TZSP) — the UDP encapsulation (default port 0x9090 / 37008) that MikroTik RouterOS, Aruba and other gear use to **stream sniffed wireless frames to a remote analyser**. A captured TZSP stream is a remote packet-capture feed: each datagram wraps one sniffed frame (802.11 / Ethernet / Prism / AVS) together with the radio metadata the sensor observed — the RX **channel**, **RSSI**, SNR, link rate and FCS-error flag — so decoding it surfaces both the wireless-recon metadata (what channel / how strong / which sensor) and the encapsulated frame itself. It joins the project's wireless tooling (ieee80211, marauder) and the tunnel-decap decoders (gre, geneve, vxlan, mpls).

Wrap-vs-native judgement

Native. TZSP is a 4-byte header (version / type / encapsulated
protocol) followed by a list of type[/len/value] tags terminated by
an END tag, after which the raw encapsulated frame follows. A
byte-field read + a tag walk; stdlib only, no new go.mod dep.

Verifiable / no confidently-wrong output

The header, the tag layout and every standard tag (RAW_RSSI, SNR,
DATA_RATE, TIMESTAMP, CONTENTION_FREE, DECRYPTED, FCS_ERROR,
RX_CHANNEL, PACKET_COUNT, RX_FRAME_LENGTH, WLAN_RADIO_HDR_SERIAL)
were verified field-for-field against scapy's TZSP layer
(scapy.contrib.tzsp). The encapsulated frame is surfaced as raw hex
with its protocol named rather than partially decoded here — it is a
complete inner packet best handed to the matching decoder
(ieee80211 / an Ethernet/IP dissector). Unknown tags are surfaced as
raw hex.

Index

• type Result
  • func Decode(input string) (*Result, error)
• type Tag

Types

type Result

type Result struct {
	Version           int    `json:"version"`
	PacketType        int    `json:"packet_type"`
	PacketTypeName    string `json:"packet_type_name"`
	EncapProtocol     int    `json:"encapsulated_protocol"`
	EncapProtocolName string `json:"encapsulated_protocol_name"`

	// Convenience copies of the most recon-relevant tags, when present.
	RawRSSI   *int   `json:"raw_rssi,omitempty"`
	SNR       *int   `json:"snr,omitempty"`
	DataRate  string `json:"data_rate,omitempty"`
	RXChannel *int   `json:"rx_channel,omitempty"`
	FCSError  *bool  `json:"fcs_error,omitempty"`

	Tags                 []Tag    `json:"tags"`
	EncapsulatedFrameHex string   `json:"encapsulated_frame_hex,omitempty"`
	Notes                []string `json:"notes,omitempty"`
}

Result is the decoded view of a TZSP datagram.

func Decode

func Decode(input string) (*Result, error)

Decode parses a TZSP datagram (the UDP-37008 payload) from hex (whitespace / ':' / '-' / '_' separators and a '0x' prefix tolerated).

type Tag

type Tag struct {
	Type    int    `json:"type"`
	Name    string `json:"name"`
	Value   string `json:"value,omitempty"`
	HexData string `json:"hex_data,omitempty"`
}

Tag is one decoded TZSP tagged field.