Ethernet frame is a OSI data link layer (layer 2) protocol data unit for Ethernet networks. In practice, many other networks and/or in-file dumps adopted the same format for encapsulation purposes.
This page hosts a formal specification of Ethernet frame (layer 2, IEEE 802.3) using Kaitai Struct. This specification can be automatically translated into a variety of programming languages to get a parsing library.
All parsing code for C++98/STL generated by Kaitai Struct depends on the C++/STL runtime library. You have to install it before you can parse data.
For C++, the easiest way is to clone the runtime library sources and build them along with your project.
Using Kaitai Struct in C++/STL usually consists of 3 steps.
std::istream). One can open local file for that, or use existing std::string or char* buffer.
#include <fstream>
std::ifstream is("path/to/local/file.bin", std::ifstream::binary);
#include <sstream>
std::istringstream is(str);
#include <sstream>
const char buf[] = { ... };
std::string str(buf, sizeof buf);
std::istringstream is(str);
#include "kaitai/kaitaistream.h"
kaitai::kstream ks(&is);
ethernet_frame_t data(&ks);
After that, one can get various attributes from the structure by invoking getter methods like:
data.dst_mac() // => Destination MAC address
data.ether_type() // => Ether type can be specied in several places in the frame. If
first location bears special marker (0x8100), then it is not the
real ether frame yet, an additional payload (`tci`) is expected
and real ether type is upcoming next.
#ifndef ETHERNET_FRAME_H_
#define ETHERNET_FRAME_H_
// This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild
#include "kaitai/kaitaistruct.h"
#include <stdint.h>
#include "ipv4_packet.h"
#include "ipv6_packet.h"
#if KAITAI_STRUCT_VERSION < 9000L
#error "Incompatible Kaitai Struct C++/STL API: version 0.9 or later is required"
#endif
class ipv4_packet_t;
class ipv6_packet_t;
/**
* Ethernet frame is a OSI data link layer (layer 2) protocol data unit
* for Ethernet networks. In practice, many other networks and/or
* in-file dumps adopted the same format for encapsulation purposes.
* \sa https://ieeexplore.ieee.org/document/7428776 Source
*/
class ethernet_frame_t : public kaitai::kstruct {
public:
class tag_control_info_t;
enum ether_type_enum_t {
ETHER_TYPE_ENUM_IPV4 = 2048,
ETHER_TYPE_ENUM_X_75_INTERNET = 2049,
ETHER_TYPE_ENUM_NBS_INTERNET = 2050,
ETHER_TYPE_ENUM_ECMA_INTERNET = 2051,
ETHER_TYPE_ENUM_CHAOSNET = 2052,
ETHER_TYPE_ENUM_X_25_LEVEL_3 = 2053,
ETHER_TYPE_ENUM_ARP = 2054,
ETHER_TYPE_ENUM_IEEE_802_1Q_TPID = 33024,
ETHER_TYPE_ENUM_IPV6 = 34525
};
ethernet_frame_t(kaitai::kstream* p__io, kaitai::kstruct* p__parent = 0, ethernet_frame_t* p__root = 0);
private:
void _read();
void _clean_up();
public:
~ethernet_frame_t();
/**
* Tag Control Information (TCI) is an extension of IEEE 802.1Q to
* support VLANs on normal IEEE 802.3 Ethernet network.
*/
class tag_control_info_t : public kaitai::kstruct {
public:
tag_control_info_t(kaitai::kstream* p__io, ethernet_frame_t* p__parent = 0, ethernet_frame_t* p__root = 0);
private:
void _read();
void _clean_up();
public:
~tag_control_info_t();
private:
uint64_t m_priority;
bool m_drop_eligible;
uint64_t m_vlan_id;
ethernet_frame_t* m__root;
ethernet_frame_t* m__parent;
public:
/**
* Priority Code Point (PCP) is used to specify priority for
* different kinds of traffic.
*/
uint64_t priority() const { return m_priority; }
/**
* Drop Eligible Indicator (DEI) specifies if frame is eligible
* to dropping while congestion is detected for certain classes
* of traffic.
*/
bool drop_eligible() const { return m_drop_eligible; }
/**
* VLAN Identifier (VID) specifies which VLAN this frame
* belongs to.
*/
uint64_t vlan_id() const { return m_vlan_id; }
ethernet_frame_t* _root() const { return m__root; }
ethernet_frame_t* _parent() const { return m__parent; }
};
private:
bool f_ether_type;
ether_type_enum_t m_ether_type;
public:
/**
* Ether type can be specied in several places in the frame. If
* first location bears special marker (0x8100), then it is not the
* real ether frame yet, an additional payload (`tci`) is expected
* and real ether type is upcoming next.
*/
ether_type_enum_t ether_type();
private:
std::string m_dst_mac;
std::string m_src_mac;
ether_type_enum_t m_ether_type_1;
tag_control_info_t* m_tci;
bool n_tci;
public:
bool _is_null_tci() { tci(); return n_tci; };
private:
ether_type_enum_t m_ether_type_2;
bool n_ether_type_2;
public:
bool _is_null_ether_type_2() { ether_type_2(); return n_ether_type_2; };
private:
kaitai::kstruct* m_body;
bool n_body;
public:
bool _is_null_body() { body(); return n_body; };
private:
ethernet_frame_t* m__root;
kaitai::kstruct* m__parent;
std::string m__raw_body;
kaitai::kstream* m__io__raw_body;
public:
/**
* Destination MAC address
*/
std::string dst_mac() const { return m_dst_mac; }
/**
* Source MAC address
*/
std::string src_mac() const { return m_src_mac; }
/**
* Either ether type or TPID if it is a IEEE 802.1Q frame
*/
ether_type_enum_t ether_type_1() const { return m_ether_type_1; }
tag_control_info_t* tci() const { return m_tci; }
ether_type_enum_t ether_type_2() const { return m_ether_type_2; }
kaitai::kstruct* body() const { return m_body; }
ethernet_frame_t* _root() const { return m__root; }
kaitai::kstruct* _parent() const { return m__parent; }
std::string _raw_body() const { return m__raw_body; }
kaitai::kstream* _io__raw_body() const { return m__io__raw_body; }
};
#endif // ETHERNET_FRAME_H_
// This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild
#include "ethernet_frame.h"
ethernet_frame_t::ethernet_frame_t(kaitai::kstream* p__io, kaitai::kstruct* p__parent, ethernet_frame_t* p__root) : kaitai::kstruct(p__io) {
m__parent = p__parent;
m__root = this;
m_tci = 0;
m__io__raw_body = 0;
f_ether_type = false;
try {
_read();
} catch(...) {
_clean_up();
throw;
}
}
void ethernet_frame_t::_read() {
m_dst_mac = m__io->read_bytes(6);
m_src_mac = m__io->read_bytes(6);
m_ether_type_1 = static_cast<ethernet_frame_t::ether_type_enum_t>(m__io->read_u2be());
n_tci = true;
if (ether_type_1() == ethernet_frame_t::ETHER_TYPE_ENUM_IEEE_802_1Q_TPID) {
n_tci = false;
m_tci = new tag_control_info_t(m__io, this, m__root);
}
n_ether_type_2 = true;
if (ether_type_1() == ethernet_frame_t::ETHER_TYPE_ENUM_IEEE_802_1Q_TPID) {
n_ether_type_2 = false;
m_ether_type_2 = static_cast<ethernet_frame_t::ether_type_enum_t>(m__io->read_u2be());
}
n_body = true;
switch (ether_type()) {
case ethernet_frame_t::ETHER_TYPE_ENUM_IPV4: {
n_body = false;
m__raw_body = m__io->read_bytes_full();
m__io__raw_body = new kaitai::kstream(m__raw_body);
m_body = new ipv4_packet_t(m__io__raw_body);
break;
}
case ethernet_frame_t::ETHER_TYPE_ENUM_IPV6: {
n_body = false;
m__raw_body = m__io->read_bytes_full();
m__io__raw_body = new kaitai::kstream(m__raw_body);
m_body = new ipv6_packet_t(m__io__raw_body);
break;
}
default: {
m__raw_body = m__io->read_bytes_full();
break;
}
}
}
ethernet_frame_t::~ethernet_frame_t() {
_clean_up();
}
void ethernet_frame_t::_clean_up() {
if (!n_tci) {
if (m_tci) {
delete m_tci; m_tci = 0;
}
}
if (!n_ether_type_2) {
}
if (!n_body) {
if (m__io__raw_body) {
delete m__io__raw_body; m__io__raw_body = 0;
}
if (m_body) {
delete m_body; m_body = 0;
}
}
}
ethernet_frame_t::tag_control_info_t::tag_control_info_t(kaitai::kstream* p__io, ethernet_frame_t* p__parent, ethernet_frame_t* p__root) : kaitai::kstruct(p__io) {
m__parent = p__parent;
m__root = p__root;
try {
_read();
} catch(...) {
_clean_up();
throw;
}
}
void ethernet_frame_t::tag_control_info_t::_read() {
m_priority = m__io->read_bits_int_be(3);
m_drop_eligible = m__io->read_bits_int_be(1);
m_vlan_id = m__io->read_bits_int_be(12);
}
ethernet_frame_t::tag_control_info_t::~tag_control_info_t() {
_clean_up();
}
void ethernet_frame_t::tag_control_info_t::_clean_up() {
}
ethernet_frame_t::ether_type_enum_t ethernet_frame_t::ether_type() {
if (f_ether_type)
return m_ether_type;
m_ether_type = ((ether_type_1() == ethernet_frame_t::ETHER_TYPE_ENUM_IEEE_802_1Q_TPID) ? (ether_type_2()) : (ether_type_1()));
f_ether_type = true;
return m_ether_type;
}