BPDU packet parsing

johnny_jiang

                                                                                                                                Condition:
a. Cisco running PVST+ b. Native VLAN on trunk port is VLAN 4c. 802.1q trunkingd. port-channel1 is combination of f1/13 and f1/15 (trunk port)e. f1/14 is the other trunk port on switch
*****************************************************************
SW2#sh spanning-tree root brief                                       Root Hello Max  FwdVlan                   Root ID         Cost Time  Age Delay  Root Port---------------- -------------------- ----- ---- ---- -----  ----------------VLAN1            32768 cc00.0740.0001    12    2   40    15  Port-channel1VLAN2            32768 cc00.0740.0000    12    2   20    15  Port-channel1VLAN3            32768 cc00.0740.0002    12    2   20    15  Port-channel1VLAN4            32768 cc00.0740.0003    12    2   20    15  Port-channel1VLAN5            32768 cc00.0740.0004    12    2   20    15  Port-channel1VLAN6            32768 cc00.0740.0005    12    2   20    15  Port-channel1
CST (Common Spanning Tree) BPDU sent on Native VLAN (VLAN 4)
*Mar  1 00:53:49.483: STP SW: TX: opt ieee: 0180.c200.0000*Mar  1 00:53:49.483:     encap SAP linktype ieee-st vlan 4 len 60 on v4 Fa1/15*Mar  1 00:53:49.483:     42 42 03 SPAN*Mar  1 00:53:49.483:     CFG P:0000 V:00 T:00 F:00 R:8000 cc00.0740.0001 0000000C*Mar  1 00:53:49.483:     B:8000 cc01.0740.0001 80.38 A:0100 M:2800 H:0200 F:0F00
0180.c200.0000
This can tell us it's a cst bpdu.
encap SAP linktype ieee-st vlan 4 len 60 on v4 Fa1/15
ieee spanning tree protocol encap, it's on vlan 4 from fa1/15
->
42 42 03 SPAN
LLC field
Mar  1 00:53:49.483:     CFG P:0000 V:00 T:00 F:00 R:8000 cc00.0740.0001 0000000C
*Mar  1 00:53:49.483:     B:8000 cc01.0740.0001 80.38 A:0100 M:2800 H:0200 F:0F00
cst bpdu packetR:8000 cc00.0740.0001 -> Root bridge id (vlan 1 root id)B:8000 cc01.0740.0001 -> Designated bridge id (vlan 1 bridge id)
->
Next, we will see another format
*Mar  1 00:53:49.483: STP: VLAN1: config protocol = ieee, packet from Port-channel1  , linktype IEEE_SPANNING , enctype 2, encsize 17*Mar  1 00:53:49.483: STP: enc 01 80 C2 00 00 00 CC 00 07 40 F1 0D 00 26 42 42 03*Mar  1 00:53:49.483: STP: Data     00000000008000CC0007400001000000008000CC000740000181410000280002000F00*Mar  1 00:53:49.483: STP: VLAN1 Po1:0000 00 00 00 8000CC0007400001 00000000 8000CC0007400001 8141 0000 2800 0200 0F00
Again, let's take a look at bpdu sent on port in access mode
*Mar  1 00:53:49.467: STP SW: TX: opt ieee: 0180.c200.0000*Mar  1 00:53:49.467:     encap SAP linktype ieee-st vlan 2 len 60 on v2 Fa1/1*Mar  1 00:53:49.467:     42 42 03 SPAN*Mar  1 00:53:49.467:     CFG P:0000 V:00 T:00 F:00 R:8000 cc00.0740.0000 0000000C*Mar  1 00:53:49.467:     B:8000 cc01.0740.0000 80.2A A:0100 M:1400 H:0200 F:0F00
fa1/1 is in vlan 2 and access mode, since it's using pvst+, every vlan should have its own spanning tree, bpdu is sent to ieee address 0180.c200.0000; meanwhile, root id and designated bridge id are all based on vlan 2.
At last, we will see tunneled bpdu packet on 802.1q trunk link
SW1#35.311: STP SW: TX: opt sstp: 0100.0ccc.cccd*Mar  1 00:12:35.311:     encap SNAP linktype sstp vlan 5 len 64 on v5 Fa1/14*Mar  1 00:12:35.311:     AA AA 03 00000C 010B SSTP*Mar  1 00:12:35.311:     CFG P:0000 V:00 T:00 F:00 R:8000 cc00.0740.0004 00000000*Mar  1 00:12:35.311:     B:8000 cc00.0740.0004 80.37 A:0000 M:1400 H:0200 F:0F00*Mar  1 00:12:35.311:      T:0000 L:0002 D:0005
STP SW: TX: opt sstp: 0100.0ccc.cccd1. This is sstp addressed bpdu2. These bpdus will be sent thru 802.1q trunk link without processing. 3. dst mac address is 0100.0ccc.cccd. they just take mst zone as a tunnel.4. Three fields (tag/length/value) are tailing after bpdu in order to check pvid (native vlan) consistency.5. SNAP encapsulation
6. In addition, cst bpdu also will be sent to sstp address for consistency check. However, this packet will be dropped by receiving pvst+ router.
->
->
               
               
               
               
               
               
               
               
               
               

本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u1/42903/showart_422447.html