HOME

NAME

eth_dissect - an ethernet dissect function

SYNOPSIS

data,offset=eth_dissect(pkt,offset)

ETH_IP = 0x0800
ETH_IPV6 = 0x86dd
ETH_ARP = 0x0806
ETH_RARP = 0x8035
ETH_PPPOE_DISCOVERY = 0x8863
ETH_PPPOE_SESSION = 0x8864

DESCRIPTION

dissect ethernet frames

    0                   1
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                               |
   +                               +
   |        Target Address         |
   +                               +
   |                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                               |
   +                               +
   |        Sender Address         |
   +                               +
   |                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |           Protocol            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

funtion accepts two arguments:
    pkt is a packet reference containing the whole packet to be dissect
    offset is the position inside packet to start dissection

funtion return two values:
    data is a 3 long tuple

target_address
sender_address
protocol

    offset is the original offset plus 14 that is the packet lenght