Tunnel Type Classification

Napatech Link-Capture™ Software Features
Platform
Napatech SmartNIC
Content Type
Feature Description
Capture Software Version
Link™ Capture Software 12.15

Tunnel types

Tunnel types are classified in the basic classes shown in this table.

Table. Classification conditions of tunneled packets
Class Classification Conditions Length of Header (in bytes)
GTPv0-U The frame decoder recognizes a GTP version 0 tunnel type if all of these conditions are met:
  • The previous header was a UDP or a TCP header.
  • The TCP/UDP Destination Port field is 0xD3A.
  • The GTP Version field is 0.
  • The GTP Protocol Type field is 1.

If the Message Type field is 0xFF (G-PDU), the following header is assumed to be IPv4 or IPv6 inside the tunnel (see Inner Layer 4 Classification).

 20
GTPv1-C The frame decoder recognizes a GTP version 1 control port if all of these conditions are met:
  • The previous header was a UDP header.
  • The UDP Destination Port field is 0x84B.
  • The GTP Version field is 1.
  • The GTP Protocol Type field is 1.
Note: The GTP E flag is supported with up to 3 extension headers at a length of up to 60 bytes each.
 12 if the GTP S or PN flag is 1; 12, 16, 20 or 24 bytes if the GTP E flag is 1; otherwise 8
GTPv2-C The frame decoder recognizes a GTP version 2 control port if all of these conditions are met:
  • The previous header was a UDP header.
  • The UDP Destination Port field is 0x84B.
  • The GTP Version field is 2.
 12 if the GTP T flag is 1; otherwise 8
GTPv1-U The frame decoder recognizes a GTP version 1 user plane signaling header if all of these conditions are met:
  • The previous header was a UDP header.
  • The UDP Destination Port field is 0x868.
  • The GTP Version field is 1.
  • The GTP Protocol Type field is 1.
Note: The GTP E flag is supported with up to 3 extension headers at a length of up to 60 bytes each.

If the Message Type field is 0xFF (G-PDU), the following header is assumed to be IPv4 or IPv6 inside the tunnel (see Inner Layer 3 Classification).

 12 if the GTP S or PN flag is 1; 12, 16, 20 or 24 if the GTP E flag is 1; otherwise 8
GRE_v0 GRE (Generic Routing Encapsulation) version 0, or GREv0, is recognized and classified by the frame decoder based on specific criteria depending on whether the encapsulating packet is IPv4 or IPv6.

A packet is classified as GREv0 if all of the following conditions are met for either IPv4 or IPv6:

  • For IPv4-encapsulated GREv0 Packets:
    • The packet has been classified as an IPv4 packet.
    • The Protocol field of the IPv4 header is set to 0x2F (indicating GRE).
    • The GRE Version Number is 0.
    • The GRE Routing Present bit is 0.
  • For IPv6-encapsulated GREv0 Packets::
    • The packet has been classified as an IPv6 packet.
    • The NextHeader field of the standard IPv6 header or the last extension header is 0x2F.
    • The GRE Version Number is 0.
    • The GRE Routing Present bit is 0.
GREv0 payload decoding: Once a GREv0 packet is identified, decoding continues beyond the GREv0 header, based on the Protocol Type field (and bit 0, 2, 3) as follows.
  • 0x0800: IPv4 header is expected. See Inner Layer 3 Classification
  • 0x86DD: IPv6 header is expected. See Inner Layer 3 Classification
  • 0x6558: Layer 2 MAC addresses are expected (NVGRE).
  • 0x88BE, bit 0, 2 and 3 = 0: Layer 2 MAC addresses are expected (ERSPAN type I).
  • 0x88BE, bit 0 and 2 = 0, bit 3 = 1, ERSPAN Version = 1: Layer 2 MAC addresses are expected (ERSPAN type II).
  • 0x22EB, bit 0 and 2 = 0, bit 3 = 1, ERSPAN Version = 2: Layer 2 MAC addresses are expected (ERSPAN type III).
Note: Bit definitions:
  • Bit 0: Checksum Present
  • Bit 2: Key Present
  • Bit 3: Sequence Number Present
 4, 8, 12 or 16 depending on how many of the Checksum Present, Key Present and Sequence Number Present flags are 1.

ERSPAN type II adds an extra 8 bytes on top of the GREv0 header length, while ERSPAN type III adds 12 + 8 × O bytes, where O represents the number of optional subblocks included in the ERSPAN header.
GRE_v1 The frame decoder recognizes a GREv1 packet if all of these conditions is met:
  • The Protocol field of the IP header is 0x2F.
  • The GRE Version Number field is 1.
  • The GRE Checksum Present bit is 0.
  • The GRE Routing Present bit is 0.
  • The GRE Key Present bit is 1.
 8, 12 or 16 depending on how many of the Sequence Number Present and Acknowledgment Sequence Number Present flags are 1.
IPinIP The frame decoder recognizes an IP-in-IP tunnel type if one of these conditions are met:
  • The outer packet is an IPv4 packet and the Protocol field of the IPv4 header is 0x04 (inner packet is an IPv4 packet).
  • The outer packet is an IPv4 packet and the Protocol field of the IPv4 header is 0x29 (inner packet is an IPv6 packet).
  • The outer packet is an IPv6 packet and the NextHeader field of the IPv6 standard header or of the last extension header is 0x04 (inner packet is an IPv4 packet).
  • The outer packet is an IPv6 packet and the NextHeader field of the IPv6 standard header or of the last extension header is 0x29 (inner packet is an IPv6 packet).
Note: Decoding of the packet continues after the outer IP header, and an IPv4 or IPv6 packet is expected (see Inner Layer 3 Classification).
 0
EtherIP The frame decoder recognizes an EtherIP tunnel type if all of these conditions are met:
  • The Protocol field of the IP header is 0x61.
  • The Version field is 3.
  • The Reserved field is 0.
Note: Decoding of the packet continues after the EtherIP header, and layer 2 MAC addresses are expected.
 2
VXLAN The frame decoder recognizes a VXLAN tunnel type if both of these conditions are met:
  • The previous header was a UDP header.
  • The UDP Destination Port field is 4789 or equal to one of two user-defined VXLAN UDP destination ports determined by the VXLANAltDestinationPorts parameter in the ntservice.ini file (see ntservice.ini file in DN-0449).
Note: Decoding of the packet continues after the VXLAN header, and layer 2 MAC addresses are expected.
 8
TunnelType_Other The frame decoder recognizes a TunnelType_Other port if none of the above applies. 0
Note: When a protocol filter is defined using NTPL, these additional legacy classes can be specified:
  • GTPv1v2-C: Is treated as a combination of GTPv1-C and GTPv2-C.
  • GTPv1-U-GPDU: Is treated as GTPv1-U with Message Type equal to 0xFF.
  • GTPv1-U-Signal: Is treated as GTPv1-U with Message Type not equal to 0xFF.
Related concepts
Related information