3

I'm playing around with the TUN/TAP device on Linux. I've created a simple program that creates a TAP interface and prints anything that is sent through it. When I bring the interface up with

ip link set tap1 up

six frames are sent through it. What are these frames?

I've pasted them here

Improve this question
2
  • How are you dumping that data? I can't make any sense of it when importing to Wireshark. I'd guess it might be IPv6 Neighbor Discovery though.
    – derobert
    Commented Dec 7, 2011 at 21:51
  • OK, check out my answer—I got the IPv6 part imported at least. There is 36-bytes of other headers before it, not sure what those are (yet). Part should be Ethernet, I guess...
    – derobert
    Commented Dec 7, 2011 at 22:16

1 Answer 1

Reset to default
1

OK, I can't get the packet imported into Wireshark (there must be some headers extra or missing, not bothering to figure that out) but, this is IPv6. From your first frame, you see ff 02 00 00 00 00 00 00 00 00 00 00 00 00 00 16. That's the IPv6 address ff02::16, used for MLDv2.

Edit: from your first frame, here is the IPv6 part in a format Wireshark can understand when you select "File->Import" and pick Encapsulation type of Raw IP or Raw IPv6 (this starts after 36 octets of other headers):

0000   60 00 00 00 00 24 00 01 00 00 00 00 00 00 00 00
0010   00 00 00 00 00 00 00 00 ff 02 00 00 00 00 00 00
0020   00 00 00 00 00 00 00 16 3a 00 05 02 00 00 01 00
0030   8f 00 d1 ff 00 00 00 01 04 00 00 00 ff 02 00 00
0040   00 00 00 00 00 00 00 01 ff ea 9c a0 00 00

Edit(2): If you trim off the leading 4 octets 00 00 86 dd, then it decodes properly as an Ethernet frame.

Edit(3): Here is your whole capture, with those 4 octets removed from each packet and massaged so Wireshark can import it (encapsulation Ethernet): http://pastebin.com/sUfCfPC4

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .