Skip to content

EtherType Probe

Module Status

MVP

Each Ethernet frame contains a two-byte field that stores which protocol is encapsulated in this packet. This information is then used by applications to parse the incoming Ethernet frames. As an operator of an IX, you usually only want IP and IEEE802.1 traffic, other EtherTypes usually indicate a misconfiguration.

Functionality

This IXpect probe checks the EtherType field in the captured Ethernet frames and provides metrics for each EtherType. An event will be triggered if a unexpected EtherType has been received.

Events

ETHER_TYPES_MONITOR_VIOLATION
An Ethernet frames with an non-whitelisted EtherType has been received.

Exported Metrics

ixpect_ether_type_monitor_violation_count{ether_type="0x8137"} 42
number of observed EtherType violations

Configuration

probes:
 ethertype:
   enable: true
   allowed_ether_types:
     - 0x0800 # IPv4
     - 0x0806 # ARP
     - 0x86DD # IPv6
probes.ether_type_monitor.enable
bool whether this probe is enabled
probes.allowed_ether_types
[int] list of valid EtherType values

See Also