Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm playing around with the TUN/TAP device on Linux. I've created a simple program that creates a TAP interface and prints anything that is sent through it. When I bring the interface up with

ip link set tap1 up

six frames are sent through it. What are these frames?

I've pasted them here

share|improve this question
    
How are you dumping that data? I can't make any sense of it when importing to Wireshark. I'd guess it might be IPv6 Neighbor Discovery though. –  derobert Dec 7 '11 at 21:51
    
OK, check out my answer—I got the IPv6 part imported at least. There is 36-bytes of other headers before it, not sure what those are (yet). Part should be Ethernet, I guess... –  derobert Dec 7 '11 at 22:16
add comment

1 Answer

up vote 1 down vote accepted

OK, I can't get the packet imported into Wireshark (there must be some headers extra or missing, not bothering to figure that out) but, this is IPv6. From your first frame, you see ff 02 00 00 00 00 00 00 00 00 00 00 00 00 00 16. That's the IPv6 address ff02::16, used for MLDv2.

Edit: from your first frame, here is the IPv6 part in a format Wireshark can understand when you select "File->Import" and pick Encapsulation type of Raw IP or Raw IPv6 (this starts after 36 octets of other headers):

0000   60 00 00 00 00 24 00 01 00 00 00 00 00 00 00 00
0010   00 00 00 00 00 00 00 00 ff 02 00 00 00 00 00 00
0020   00 00 00 00 00 00 00 16 3a 00 05 02 00 00 01 00
0030   8f 00 d1 ff 00 00 00 01 04 00 00 00 ff 02 00 00
0040   00 00 00 00 00 00 00 01 ff ea 9c a0 00 00 

Edit(2): If you trim off the leading 4 octets 00 00 86 dd, then it decodes properly as an Ethernet frame.

Edit(3): Here is your whole capture, with those 4 octets removed from each packet and massaged so Wireshark can import it (encapsulation Ethernet): http://pastebin.com/sUfCfPC4

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.