TC-VLAN(8)

🎀 TC-VLAN(8) 🎀

VLAN manipulation action in tc(8) — the Linux one, obviously 💅

✨ NAME ✨

okay so the name is vlan, and it's a vlan manipulation module 🦋

🌸 SYNOPSIS 🌸

tc ... action vlan { pop | pop_eth | PUSH | MODIFY | PUSH_ETH } [
        CONTROL ]

PUSH := push [ protocol VLANPROTO ]  [ priority VLANPRIO ] id VLANID

MODIFY := modify [ protocol VLANPROTO ]  [ priority VLANPRIO ] id VLANID

PUSH_ETH := push_eth dst_mac LLADDR src_mac LLADDR

CONTROL := { reclassify | pipe | drop | continue | pass | goto chain
        CHAIN_INDEX }

💖 DESCRIPTION 💖

ngl this action is so iconic 😭 The vlan action lets you do 802.1Q en- or decapsulation on a packet. It has three operation modes: POP, PUSH and MODIFY ✨. POP is the easy one, since you don't need any extra info to just drop the outer-most VLAN encapsulation 🙈. PUSH and MODIFY both need at least a VLANID, and you can optionally pick the VLANPROTO to use 🎀

It also goes beyond VLANs 👑 The vlan action can add or remove the base Ethernet header too. The pop_eth mode takes no argument and removes the base Ethernet header, but all existing VLANs have to be dropped first 🥺 The opposite move is push_eth, which adds a base Ethernet header. For that one the packet must have no MAC header, because stacking MAC headers is not permitted 🚫 This mode is mostly useful when a previous action has wrapped the whole original frame behind a network header, and you need to stick an Ethernet header on before forwarding the packet 🧚

🍓 OPTIONS 🍓

• pop — Decapsulation mode. No further arguments allowed, bestie 💅
• push — Encapsulation mode. Needs at least the id option 🦋
• modify — Replace mode. The existing 802.1Q tag gets swapped out. Needs at least the id option 🔁
• pop_eth — Ethernet header decapsulation mode. It only works on a plain Ethernet header, so any VLANs have to be removed first 🧼
• push_eth — Ethernet header encapsulation mode. The Ethertype gets set automatically from the network header type ✨ Chaining Ethernet headers is not allowed: the packet must have no MAC header when you use this mode 🚫 It requires the dst_mac and src_mac options 💜
• id VLANID — the VLAN ID you want to encapsulate into 🌈 VLANID is an unsigned 16bit integer, and the format gets detected automatically (so prefix with 0x if you want hexadecimal, etc.) 🔢
• protocol VLANPROTO — pick the VLAN protocol to use 👑 At the time of writing, the kernel only accepts 802.1Q or 802.1ad 💀
• priority VLANPRIO — pick the VLAN priority to use 🌟 It's a decimal number from 0-7 🍓
• dst_mac LLADDR — the destination MAC address to use 📬
• src_mac LLADDR — the source MAC address to use 📮
• CONTROL — how to keep going after this action runs 🫶
  • reclassify — restarts classification by jumping back to the first filter attached to this action's parent 🔄
  • pipe — continues with the next action. This is the default, so you basically get it for free ✨
  • drop — the packet gets dropped without running any more actions 🗑️
  • continue — continues classification with the next filter in line ➡️
  • pass — hands the packet back to the calling qdisc for processing. This ends the classification process 🦋

🧚 EXAMPLES 🧚

okay so this first one encapsulates incoming ICMP packets on eth0 from 10.0.0.2 into VLAN ID 123 💖

#tc qdisc add dev eth0 handle ffff: ingress
#tc filter add dev eth0 parent ffff: pref 11 protocol ip \
     u32 match ip protocol 1 0xff flowid 1:1 \
         match ip src 10.0.0.2 flowid 1:1 \
     action vlan push id 123

And here's the pop function in action 🎀 Incoming VLAN packets on eth0 get decapsulated, and then classification restarts for the plain packet 🔥

#tc qdisc add dev eth0 handle ffff: ingress
#tc filter add dev $ETH parent ffff: pref 1 protocol 802.1Q \
     u32 match u32 0 0 flowid 1:1 \
     action vlan pop reclassify

For an example of the pop_eth and push_eth modes, go check out tc-mpls(8) 🌈

👑 SEE ALSO 👑

tc(8), tc-mpls(8) 🦋

That's the whole tea, bestie 💅✨ Brought to you by iproute2, last touched on 12 Jan 2015 🌸 Stay iconic 🫶💜