proto.dph

@1.0.0
#packed 'true'

struct ethernet {
  dst:48
  src:48
  type:16
}

state ethernet {
  switch $ethernet.type {
    case 0x0800 {
      next proto::ip
    }
    case 0x8100 {
      next proto::dot1q
    }
    case * {
      goto EOP
    }
  }
}


struct dot1q {
  pri:3
  cfi:1
  vlanid:12
  type:16
}

state dot1q {
  switch $dot1q.type {
    case 0x0800 {
      next proto::ip
    }
    case * {
      goto EOP
    }
  }
}


struct ip {
  ver:4
  hlen:4
  tos:8
  tlen:16
  identification:16
  ffo_unused:1
  df:1
  mf:1
  foffset:13
  ttl:8
  nextp:8
  hchecksum:16
  src:32
  dst:32
}

state ip {
  switch $ip.nextp {
    case 6 {
      next proto::tcp
    }
    case 17 {
      next proto::udp
    }
    case 47 {
      next proto::gre
    }
    case * {
      goto EOP
    }
  }
}


struct udp {
  sport:16
  dport:16
  length:16
  crc:16
}

state udp {
  switch $udp.dport {
    case 8472 {
      next proto::vxlan
    }
    case * {
      goto EOP
    }
  }
}

struct tcp {
  src_port:16
  dst_port:16
  seq_num:32
  ack_num:32
  offset:4
  reserved:4
  flag_cwr:1
  flag_ece:1
  flag_urg:1
  flag_ack:1
  flag_psh:1
  flag_rst:1
  flag_syn:1
  flag_fin:1
  rcv_wnd:16
  cksum:16
  urg_ptr:16
}

state tcp {
  goto EOP
}

struct vxlan {
  rsv1:4
  iflag:1
  rsv2:3
  rsv3:24
  key:24
  rsv4:8
}

state vxlan {
  goto EOP
}


struct gre {
  cflag:1
  rflag:1
  kflag:1
  snflag:1
  srflag:1
  recurflag:3
  reserved:5
  vflag:3
  protocol:16
  key:32
}

state gre {
  switch $gre.protocol {
    case * {
      goto EOP
    }
  }
}