How to force ignore unknown ethertype

[sheltont]

A huawei switch in my LAN broad cast packets whose ethernet type is 0x9998(39320). Then the sample sniff in epcap just crashed with the following stack. I change the field crash in the state to false but still no luck.

4> 2020-07-21T14:02:53.120415+08:00 error: State machine sniff terminating. Reason: function_clause. Stack: [{pkt_ether,type,[39320],[{file,"/Users/sheltont/bde/github/epcap/_build/default/lib/pkt/src/pkt_ether.erl"},{line,37}]},{pkt,decapsulate_next,2,[{file,"/Users/sheltont/bde/github/epcap/_build/default/lib/pkt/src/pkt.erl"},{line,120}]},{sniff,handle_info,3,[{file,"examples/sniff.erl"},{line,76}]},{gen_statem,loop_state_callback,11,[{file,"gen_statem.erl"},{line,1166}]},{proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,226}]}]. Last event: {info,{packet,1,{1595,311372,700224},60,<<255,255,255,255,255,255,160,8,111,227,46,64,153,152,0,1,0,0,0,5,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0>>}}. State: {sniffing,{state,<0.149.0>,true,[]}}.
2020-07-21T14:02:53.125811+08:00 error: crasher: initial call: sniff:init/1, pid: <0.146.0>, registered_name: sniff, error: {function_clause,[{pkt_ether,type,[39320],[{file,"/Users/sheltont/bde/github/epcap/_build/default/lib/pkt/src/pkt_ether.erl"},{line,37}]},{pkt,decapsulate_next,2,[{file,"/Users/sheltont/bde/github/epcap/_build/default/lib/pkt/src/pkt.erl"},{line,120}]},{sniff,handle_info,3,[{file,"examples/sniff.erl"},{line,76}]},{gen_statem,loop_state_callback,11,[{file,"gen_statem.erl"},{line,1166}]},{proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,226}]}]}, ancestors: [<0.139.0>], message_queue_len: 2, messages: [{packet,1,{1595,311372,938644},60,<<255,255,255,255,255,255,16,144,39,233,250,177,8,6,0,1,8,0,6,4,0,1,16,144,39,233,250,177,192,168,88,34,0,0,0,0,0,0,192,168,88,182,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0>>},{packet,1,{1595,311372,942218},60,<<255,255,255,255,255,255,16,144,39,233,250,177,8,6,0,1,8,0,6,4,0,1,16,144,39,233,250,177,192,168,88,34,0,0,0,0,0,0,192,168,88,181,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0>>}], links: [<0.149.0>], dictionary: [], trap_exit: true, status: running, heap_size: 10958, stack_size: 28, reductions: 9345; neighbours:
2020-07-21T14:02:53.126505+08:00 error: Generic server <0.149.0> terminating. Reason: {function_clause,[{pkt_ether,type,[39320],[{file,"/Users/sheltont/bde/github/epcap/_build/default/lib/pkt/src/pkt_ether.erl"},{line,37}]},{pkt,decapsulate_next,2,[{file,"/Users/sheltont/bde/github/epcap/_build/default/lib/pkt/src/pkt.erl"},{line,120}]},{sniff,handle_info,3,[{file,"examples/sniff.erl"},{line,76}]},{gen_statem,loop_state_callback,11,[{file,"gen_statem.erl"},{line,1166}]},{proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,226}]}]}. Last message: {'EXIT',<0.146.0>,{function_clause,[{pkt_ether,type,[39320],[{file,"/Users/sheltont/bde/github/epcap/_build/default/lib/pkt/src/pkt_ether.erl"},{line,37}]},{pkt,decapsulate_next,2,[{file,"/Users/sheltont/bde/github/epcap/_build/default/lib/pkt/src/pkt.erl"},{line,120}]},{sniff,handle_info,3,[{file,"examples/sniff.erl"},{line,76}]},{gen_statem,loop_state_callback,11,[{file,"gen_statem.erl"},{line,1166}]},{proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,226}]}]}}. State: {state,<0.146.0>,#Port<0.15>}.

[msantos]

Hey @sheltont , it seems the sniff example sets crash to false when the snaplen option is set:

epcap:start([{snaplen, 16#ffff}, ...])

Another option is excluding ethertype 0x9998 in the pcap expression:

# Warning: untested!
not ether proto 0x9998

According to:

https://www.iana.org/assignments/ieee-802-numbers/ieee-802-numbers.xhtml#ieee-802-numbers-1

Protocol 0x9998 isn't assigned. Feel free to open another issue if you'd like pkt to support it (anonymized packet dump and/or links to the protocol spec would be appreciated!).

If you run into any issues or have any questions, please let me know!

[manglewit]

Huawei are using Ethertype 0x9998 for their Loopback Detection Protocol (LBDT). Details can be found in their documentation, for example, here: https://support.huawei.com/enterprise/en/doc/EDOC1000047417?section=j00j
The format of the LBDT packet is given in table 16-1

Edit to add - Huawei also use ethertype 0x999a for the same purpose: https://support.huawei.com/enterprise/en/knowledge/EKB1100000936