Documentation
¶
Overview ¶
Package vxlan decodes Virtual Extensible LAN packets per RFC 7348, plus per-vendor variants: Cisco's Group-Based Policy (VXLAN-GBP, draft-smith-vxlan-group-policy) and the Generic Protocol Extension (VXLAN-GPE, draft-ietf-nvo3- vxlan-gpe).
Wrap-vs-native judgement
Native. RFC 7348 is fully public; the VXLAN header is a tight 8-byte field plus the encapsulated original Ethernet frame. No crypto, no compression, no varints. Operators paste UDP-payload bytes (standard UDP dest port 4789) from a Wireshark Follow-UDP-Stream view, a `tcpdump -X udp port 4789` line, or any VXLAN-emitting tool and get the documented header plus the inner Ethernet header peek for routing into a downstream decoder.
What this package covers
**8-byte VXLAN header** (RFC 7348 §5):
byte 0: Flags. Bit 3 (I-flag, mask 0x08) MUST be 1 in standard VXLAN to indicate the VNI is valid; the other 7 bits are reserved and MUST be 0. VXLAN-GBP (Cisco extension) overloads bit 0 as G (Group Policy Applied) and bit 4 as D (Don't Learn).
bytes 1-3: Reserved 1 (24 bits, must be 0 in standard VXLAN). VXLAN-GBP overloads as 16-bit Group Policy ID (with 8 reserved bits).
bytes 4-6: VNI (24-bit VXLAN Network Identifier; like a 24-bit VLAN ID, 16M possible).
byte 7: Reserved 2 (must be 0 in standard VXLAN). VXLAN-GPE overloads as Next Protocol (1 IPv4 / 2 IPv6 / 3 Ethernet / 4 NSH / 5 MPLS).
**RFC 7348 conformance check**: surfaces a Note when the I-flag is not set or when reserved bits are non-zero (which the operator can investigate as middlebox abuse / non-standard variant / corrupt frame).
**Variant detection**: if the I-flag is set AND any reserved bits are non-zero, attempt to interpret as VXLAN-GBP or VXLAN-GPE based on the pattern.
**Inner Ethernet**: the bytes after the VXLAN header are the encapsulated original Ethernet frame. We surface the dst MAC, src MAC, and EtherType (with name lookup against the same 10-entry table used by `vlan_decode`). When the EtherType is IPv4 (0x0800) or IPv6 (0x86DD) the inner L3 packet is decoded in place via internal/ipdecode, so the overlaid flow's addresses / protocol / ports surface directly; a payload that does not parse as IP is reported with an error and left as hex. Non-IP EtherTypes (ARP, 802.1Q, MPLS, …) are left for their own decoders.
What this package does NOT cover (deliberately out of scope)
UDP / IP framing — feed the UDP payload bytes after the outer IP+UDP headers (standard outer UDP dest port 4789).
Inner Ethernet payloads other than IP (802.1Q VLAN tags, ARP, MPLS, …) — left for `vlan_decode` / their own decoders; only IPv4 / IPv6 inner frames are decoded here.
VXLAN-GPE Next Protocol body dissection — only the Next Protocol byte is decoded; the body is the encapsulated IPv4 / IPv6 / Ethernet payload.
Geneve (RFC 8926) — a different overlay with a TLV options block; a future Spec.
VXLAN flooding / BUM (Broadcast / Unknown unicast / Multicast) replication semantics — this is a per- packet decoder, not a session tracker.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type GBPFields ¶
type GBPFields struct {
GroupPolicyApplied bool `json:"group_policy_applied"`
DontLearn bool `json:"dont_learn"`
GroupPolicyID int `json:"group_policy_id"`
GroupPolicyIDHex string `json:"group_policy_id_hex"`
}
GBPFields is the Cisco Group-Based Policy extension overlay.
type GPEFields ¶
type GPEFields struct {
NextProtocol int `json:"next_protocol"`
NextProtocolName string `json:"next_protocol_name"`
}
GPEFields is the Generic Protocol Extension overlay.
type InnerEthernet ¶
type InnerEthernet struct {
DstMAC string `json:"dst_mac"`
SrcMAC string `json:"src_mac"`
EtherType int `json:"ether_type"`
EtherTypeHex string `json:"ether_type_hex"`
EtherTypeName string `json:"ether_type_name"`
PayloadOffset int `json:"payload_offset"`
RemainingBytes int `json:"remaining_bytes"`
InnerPacket *ipdecode.Packet `json:"inner_packet,omitempty"`
InnerDecodeError string `json:"inner_decode_error,omitempty"`
}
InnerEthernet is the peek at the encapsulated Ethernet frame's header (dst MAC + src MAC + EtherType).
type Result ¶
type Result struct {
Flags int `json:"flags"`
FlagsHex string `json:"flags_hex"`
IFlag bool `json:"i_flag"`
Reserved1Hex string `json:"reserved_1_hex"`
Reserved1Zero bool `json:"reserved_1_zero"`
VNI uint32 `json:"vni"`
Reserved2 int `json:"reserved_2"`
Reserved2Zero bool `json:"reserved_2_zero"`
Variant string `json:"variant"`
InnerEthernet *InnerEthernet `json:"inner_ethernet,omitempty"`
GBP *GBPFields `json:"vxlan_gbp,omitempty"`
GPE *GPEFields `json:"vxlan_gpe,omitempty"`
TotalBytes int `json:"total_bytes"`
Notes []string `json:"notes,omitempty"`
}
Result is the top-level decoded view.
Source Files