etherparse

A zero allocation supporting library for parsing & writing a bunch of packet based protocols (EthernetII, IPv4, IPv6, UDP, TCP ...).

Currently supported are: * Ethernet II * IEEE 802.1Q VLAN Tagging Header * MACsec (IEEE 802.1AE) * ARP * IPv4 * IPv6 (supporting the most common extension headers, but not all) * UDP * TCP * ICMP & ICMPv6 (not all message types are supported)

Reconstruction of fragmented IP packets is also supported, but requires allocations.

Usage

Add the following to your Cargo.toml:

[dependencies]
etherparse = "0.20.3"

What is etherparse?

Etherparse is intended to provide the basic network parsing functions that allow for easy analysis, transformation or generation of recorded network data.

Some key points are:

• It is completely written in Rust and thoroughly tested.
• Special attention has been paid to not use allocations or syscalls except in the "defragmentation" code.
• The package is still in development and can & will still change.
• The current focus of development is on the most popular protocols in the internet & transport layer.

How to parse network packages?

Etherparse gives you two options for parsing network packages automatically:

Slicing the packet

Here the different components in a packet are separated without parsing all their fields. For each header a slice is generated that allows access to the fields of a header.

match SlicedPacket::from_ethernet(&packet) {
    Err(value) => println!("Err {:?}", value),
    Ok(value) => {
        println!("link: {:?}", value.link);
        println!("link_exts: {:?}", value.link_exts); // contains vlan & macsec
        println!("net: {:?}", value.net); // contains ip & arp
        println!("transport: {:?}", value.transport);
    }
};

This is the faster option if your code is not interested in all fields of all the headers. It is a good choice if you just want filter or find packets based on a subset of the headers and/or their fields.

Depending from which point downward you want to slice a package check out the functions:

• SlicedPacket::from_ethernet for parsing from an Ethernet II header downwards
• SlicedPacket::from_linux_sll for parsing from a Linux Cooked Capture v1 (SLL) downwards
• SlicedPacket::from_ether_type for parsing a slice starting after an Ethernet II header
• SlicedPacket::from_ip for parsing from an IPv4 or IPv6 downwards

In case you want to parse cut off packets (e.g. packets returned in in ICMP message) you can use the "lax" parsing methods:

• LaxSlicedPacket::from_ethernet for parsing from an Ethernet II header downwards
• LaxSlicedPacket::from_ether_type for parsing a slice starting after an Ethernet II header
• LaxSlicedPacket::from_ip for parsing from an IPv4 or IPv6 downwards

Deserializing all headers into structs

This option deserializes all known headers and transfers their contents to header structs.

match PacketHeaders::from_ethernet_slice(&packet) {
    Err(value) => println!("Err {:?}", value),
    Ok(value) => {
        println!("link: {:?}", value.link);
        println!("link_exts: {:?}", value.link_exts); // contains vlan & macsec
        println!("net: {:?}", value.net); // contains ip & arp
        println!("transport: {:?}", value.transport);
    }
};

This option is slower then slicing when only few fields are accessed. But it can be the faster option or useful if you are interested in most fields anyways or if you want to re-serialize the headers with modified values.

Depending from which point downward you want to unpack a package check out the functions

• PacketHeaders::from_ethernet_slice for parsing from an Ethernet II header downwards
• PacketHeaders::from_ether_type for parsing a slice starting after an Ethernet II header
• PacketHeaders::from_ip_slice for parsing from an IPv4 or IPv6 downwards

In case you want to parse cut off packets (e.g. packets returned in in ICMP message) you can use the "lax" parsing methods:

• LaxPacketHeaders::from_ethernet for parsing from an Ethernet II header downwards
• LaxPacketHeaders::from_linux_sll for parsing from a Linux Cooked Capture v1 (SLL) downwards
• LaxPacketHeaders::from_ether_type for parsing a slice starting after an Ethernet II header
• LaxPacketHeaders::from_ip for parsing from an IPv4 or IPv6 downwards

Manually slicing only one packet layer

It is also possible to only slice one packet layer:

• Ethernet2Slice::from_slice_without_fcs & Ethernet2Slice::from_slice_with_crc32_fcs
• LinuxSllSlice::from_slice
• SingleVlanSlice::from_slice
• MacsecSlice::from_slice
• ArpPacketSlice::from_slice
• IpSlice::from_slice & LaxIpSlice::from_slice
• Ipv4Slice::from_slice & LaxIpv4Slice::from_slice
• Ipv6Slice::from_slice & LaxIpv6Slice::from_slice
• UdpSlice::from_slice & UdpSlice::from_slice_lax
• TcpSlice::from_slice
• Icmpv4Slice::from_slice
• Icmpv6Slice::from_slice

The resulting data types allow access to both the header(s) and the payload of the layer and will automatically limit the length of payload if the layer has a length field limiting the payload (e.g. the payload of IPv6 packets will be limited by the "payload length" field in an IPv6 header).

Manually slicing & parsing only headers

It is also possible just to parse headers. Have a look at the documentation for the following [NAME]HeaderSlice.from_slice methods, if you want to just slice the header:

• Ethernet2HeaderSlice::from_slice
• LinuxSllHeaderSlice::from_slice
• SingleVlanHeaderSlice::from_slice
• MacsecHeaderSlice::from_slice
• Ipv4HeaderSlice::from_slice
• Ipv4ExtensionsSlice::from_slice
• Ipv6HeaderSlice::from_slice
• Ipv6ExtensionsSlice::from_slice
• Ipv6RawExtHeaderSlice::from_slice
• IpAuthHeaderSlice::from_slice
• Ipv6FragmentHeaderSlice::from_slice
• UdpHeaderSlice::from_slice
• TcpHeaderSlice::from_slice

And for deserialization into the corresponding header structs have a look at:

• Ethernet2Header::read & Ethernet2Header::from_slice
• LinuxSllHeader::read & LinuxSllHeader::from_slice
• SingleVlanHeader::read & SingleVlanHeader::from_slice
• MacsecHeader::read & MacsecHeader::from_slice
• ArpPacket::read & ArpPacket::from_slice
• IpHeaders::read & IpHeaders::from_slice
• Ipv4Header::read & Ipv4Header::from_slice
• Ipv4Extensions::read & Ipv4Extensions::from_slice
• Ipv6Header::read & Ipv6Header::from_slice
• Ipv6Extensions::read & Ipv6Extensions::from_slice
• Ipv6RawExtHeader::read & Ipv6RawExtHeader::from_slice
• IpAuthHeader::read & IpAuthHeader::from_slice
• Ipv6FragmentHeader::read & Ipv6FragmentHeader::from_slice
• UdpHeader::read & UdpHeader::from_slice
• [TcpHeader::read](https://docs.rs/etherparse/0.20.3/etherparse/str