Documentation
¶
Overview ¶
Package macsec decodes the IEEE 802.1AE (MACsec) Security TAG — the per-frame header that prefixes a MACsec-protected Ethernet frame (EtherType 0x88E5). MACsec provides hop-by-hop L2 confidentiality and integrity on a wired LAN, typically keyed by 802.1X / MKA; the SecTAG is transmitted in the clear, so decoding it from a capture exposes the secure-channel identifier, the association number, the replay- protection packet number, and whether the user data is encrypted — the visibility a network-access-control / MACsec-deployment audit needs. It complements the project's other wired-L2 decoders (internal/vlan, lldp, cdp, stp, lacp), which already name 0x88E5 but do not body it out.
Wrap-vs-native judgement ¶
Native. The SecTAG is a fixed, fully-public bit/byte layout (IEEE 802.1AE-2006 §9.3): a one-octet TCI/AN, a one-octet Short Length, a 32-bit Packet Number, and an optional 64-bit Secure Channel Identifier. Decoding is byte-field extraction + bit-masking — a dependency is not justified. stdlib only, no new go.mod dep.
What this package covers ¶
- The SecTAG: the TCI flags (Version, End-Station, SCI-present, Single-Copy-Broadcast, Encryption, Changed-text) and the Association Number; the Short Length; the Packet Number (replay protection / GCM IV input); and, when SC is set, the Secure Channel Identifier split into its 48-bit system identifier (a MAC address) and 16-bit port identifier.
- Optionally the outer Ethernet header (destination / source MAC) when a full frame whose EtherType is 0x88E5 is passed.
- The trailing user data is split into the Secure Data (encrypted when E=1, authenticated cleartext when E=0) and the 16-octet ICV.
What this package does NOT cover (deliberately out of scope) ¶
- Decryption / ICV verification — both need the Secure Association Key (SAK), which is derived by MKA and never on the wire, so the Secure Data is surfaced opaque and the ICV is not verified (the same reason the lorawan / wmbus decoders surface their encrypted payloads raw).
- Cipher suites with a non-16-octet ICV — the mandatory-to- implement GCM-AES-128/256 default of 16 octets is assumed for the Secure-Data / ICV split, and that assumption is noted.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Result ¶
type Result struct {
DestMAC string `json:"dest_mac,omitempty"`
SrcMAC string `json:"src_mac,omitempty"`
Version int `json:"version"`
EndStation bool `json:"end_station"`
SCIPresent bool `json:"sci_present"`
SingleCopyBcast bool `json:"single_copy_broadcast"`
Encrypted bool `json:"encrypted"` // E: user data is encrypted
Changed bool `json:"changed_text"` // C: secure data differs from original
AssociationNum int `json:"association_number"`
ShortLength int `json:"short_length"`
PacketNumber uint32 `json:"packet_number"`
SCI string `json:"sci,omitempty"`
SystemIdentifier string `json:"system_identifier,omitempty"` // 48-bit MAC inside the SCI
PortIdentifier int `json:"port_identifier,omitempty"`
SecureDataHex string `json:"secure_data_hex,omitempty"`
ICVHex string `json:"icv_hex,omitempty"`
Notes []string `json:"notes,omitempty"`
}
Result is the decoded view of a MACsec frame.
Source Files