DNSSnooper: error decoding packet: No decoder for layer type Dot1Q

[tomwilkie]

[12:48 PM]  
carlpett So, first feedback :slightly_smiling_face: We get a lot of this:
`<probe> ERRO: 2017/01/26 12:46:27.282902 DNSSnooper: error decoding packet: No decoder for layer type Dot1Q`

[12:48 PM]  
Problem related to running on physical hardware?

[1:27 PM]  
tom googles Dot1Q...

[1:27 PM]  
tom
> Dot1Q is an IEEE's open standard, which be used to create trunk connection between switches of different vendors. In ISL the original ethernet frame is not modified, it is encapsulated between an ISL header and an FCS.

[tomwilkie]

We should at least rate limit the error messages

[2opremio]

We should at least rate limit the error messages

Yep

[rade]

If the condition isn't causing any problems, then it shouldn't be reported as an error at all.

[2opremio]

If the condition isn't causing any problems, then it shouldn't be reported as an error at all.

I believe it may be causing problems (i.e. AFAIU, if the link layer doesn't use plain Ethernet or LinuxSLL, the snooper won't work). Gopacket supports Dot1Q, so incorporating it to the decoder should be trivial.

BTW, wouldn't Weave Net have the same problem in Sleeve mode?

[rade]

BTW, wouldn't Weave Net have the same problem in Sleeve mode?

cc @bboreham

[bboreham]

Weave Net generally only needs the source and destination MAC addresses. There is one case where an unexpected frame type would disrupt operation: an IPV4 packet which has DF set and is too big would not get a correct ICMP response.

However, as far as I know the kernel does not allow sending tagged packets via a virtual ethernet device, so this cannot happen.