How to prevent VLAN tag from being stripped from packets received by socket?

Question

I'm writing a simple python script to parse the headers of raw data packets received via socket. The script runs on a VM and another VM is generating packets and sending them in. (Both VMs are running linux). This is part of a setup in which custom headers are made for the packets before sending them off, and the entire purpose of the script is to receive the packets completely unblemished via the socket, and verify their content.

The first header is a standard Ethernet header, with 6 bytes each for the DMAC and SMAC, four bytes for VLAN related fields (TPID, PCP and ID), and two bytes for Ethertype.

The problem I'm encountering is that the VLAN fields (four bytes) are stripped from the packets before I receive them (all the rest of the packet is present). I am not very familiar with the various elements of virtual HW along the network path between the two VMs, though I suspect that the stripping is being done there.

Here is the method I use to open the socket:

def openSocketToInterface(nicInterface):
    ETH_P_ALL = 3 # To receive all Ethernet protocols
    socketToInterface = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 
        socket.htons(ETH_P_ALL))
    socketToInterface.bind((nicInterface, 0))
    subprocess.check_call('ifconfig %s promisc' % (nicInterface), 
        shell=True)
    return socketToInterface

Is there a way I can prevent the VLAN fields from being stripped?

The packet is the payload of the layer-2 frame. It does not include any ethernet (layer-2) information. If you are trying to capture the frame intact, then you must bridge between interfaces using a trunk connection. — Ron Maupin

Zac67 Zac67 · Accepted Answer · 2017-07-06T19:07:26

vSwitches and vNIC do not use tagging. The purpose of tags is to mark physical frames on the wire. Virtual frames don't need that, the vSwitch knows which port group they belong to.

Even when you set up a mirror port group on ESXi with all VLANs (promiscuous mode allowed, VID 4095), none of the frames are tagged.

A way to work around it is to use multiple vNICs. Alternatively, you can try mapping the the physical NIC into the VM (PCI passthrough or DirectPath).

How to prevent VLAN tag from being stripped from packets received by socket?

1 Answers