Documentation
¶
Overview ¶
Package vlan decodes IEEE 802.1Q (C-tag) and 802.1ad (S-tag, QinQ) VLAN tags per IEEE 802.1Q-2018.
Wrap-vs-native judgement
Native. IEEE 802.1Q is fully public; each VLAN tag is a tight 32-bit field (16-bit TPID + 16-bit TCI) inserted between the source MAC and the EtherType in an Ethernet frame. The tag walker is trivial bit-twiddling — no crypto, no compression, no length prefixes. Operators paste the tag bytes (just the 4 bytes per tag plus the 2-byte EtherType that follows) from a `tcpdump -i ethX -X` line, a Wireshark Follow-Frame view, or any VLAN-emitting tool and get the documented PCP / DEI / VID + double-tag (QinQ) structure plus inner EtherType identification.
What this package covers
**Tag walker** — starts at the first TPID and consumes 4-byte tags until it encounters a non-tag EtherType (anything that isn't 0x8100 / 0x88A8 / 0x9100 / 0x9200 / 0x9300). The remaining 2 bytes are surfaced as the inner EtherType.
**TPID table** (5 entries):
0x8100 — IEEE 802.1Q C-tag (Customer VLAN)
0x88A8 — IEEE 802.1ad S-tag (Service VLAN, QinQ)
0x9100 — Legacy QinQ TPID (pre-standardisation)
0x9200 — Legacy QinQ TPID
0x9300 — Legacy QinQ TPID
**TCI bit breakdown** (16 bits BE):
PCP (Priority Code Point, 3 bits) — 802.1p priority 0-7 with an **8-entry name table**:
0 Background (Best Effort default)
1 Background (Lowest)
2 Excellent Effort
3 Critical Applications
4 Video (<100ms latency)
5 Voice (<10ms latency)
6 Internetwork Control
7 Network Control (Highest)
DEI (Drop Eligible Indicator, 1 bit) — formerly CFI (Canonical Format Indicator); when 1, the frame may be dropped under congestion.
VID (VLAN Identifier, 12 bits) — 0-4095:
0: priority-tagged frame (no VLAN; only PCP/DEI matter)
1: default native VLAN (often Cisco "VLAN 1")
4095: reserved
**Double-tag (QinQ) detection** — when the first tag's TPID is 0x88A8 (or a legacy QinQ TPID) and the second tag's TPID is 0x8100, the frame is service-provider tagged: the outer S-tag identifies the customer, the inner C-tag identifies the customer's internal VLAN.
**Inner EtherType identification** — **10-entry name table** for the post-tag EtherType:
0x0800 IPv4
0x0806 ARP
0x86DD IPv6
0x8035 RARP
0x8847 MPLS unicast
0x8848 MPLS multicast
0x8863 PPPoE Discovery
0x8864 PPPoE Session
0x888E EAPOL (802.1X)
0x88CC LLDP
What this package does NOT cover (deliberately out of scope)
Ethernet header (dst MAC + src MAC) — feed the bytes starting at the first TPID.
VLAN translation / TPID rewriting — common in carrier networks but a separate L2-config concern.
Inner payload dissection — the inner EtherType is surfaced; operators pipe the post-tag bytes to the appropriate decoder (`ip_packet_decode`, `arp_decode`, `lldp_decode`, etc.).
MAC-in-MAC (IEEE 802.1ah, PBB) — different encapsulation (24-byte header), a separate Spec.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Result ¶
type Result struct {
Tags []Tag `json:"tags"`
TagCount int `json:"tag_count"`
IsQinQ bool `json:"is_qinq"`
InnerEtherType int `json:"inner_ether_type,omitempty"`
InnerEtherHex string `json:"inner_ether_type_hex,omitempty"`
InnerEtherName string `json:"inner_ether_type_name,omitempty"`
TotalTagBytes int `json:"total_tag_bytes"`
TotalBytes int `json:"total_bytes"`
Notes []string `json:"notes,omitempty"`
}
Result is the top-level decoded view.
Source Files