tc-tunnel_key man page on Kali

Man page or keyword search:  
man Server   9211 pages
apropos Keyword Search (all sections)
Output format
Kali logo
[printable version]

Tunnel metadata manipulation actioTunnelumetadata manipulation action in tc(8)

NAME
       tunnel_key - Tunnel metadata manipulation

SYNOPSIS
       tc ... action tunnel_key { unset | SET }

       SET  := set src_ip ADDRESS dst_ip ADDRESS id KEY_ID dst_port UDP_PORT [
	       csum | nocsum ]

DESCRIPTION
       The tunnel_key action combined with a shared IP tunnel  device,	allows
       to perform IP tunnel en- or decapsulation on a packet, reflected by the
       operation modes UNSET and SET.  The UNSET mode is optional - even with‐
       out  using  it, the metadata information will be released automatically
       when packet processing will be finished.	 UNSET function could be  used
       in cases when traffic is forwarded between two tunnels, where the meta‐
       data from the first tunnel will be used for encapsulation done  by  the
       second tunnel.  SET mode requires the source and destination ip ADDRESS
       and the tunnel key id KEY_ID which will be used by the ip tunnel shared
       device  to  create  the	tunnel header. The tunnel_key action is useful
       only in combination with a mirred redirect action to a shared IP tunnel
       device  which  will  use the metadata (for SET ) and unset the metadata
       created by it (for UNSET ).

OPTIONS
       unset  Unset the tunnel metadata created by the IP tunnel device.  This
	      function	is  not	 mandatory and might be used only in some spe‐
	      cific use cases (as explained above).

       set    Set tunnel metadata to be used by the IP tunnel device. Requires
	      id , src_ip and dst_ip options.  dst_port is optional.

	      id     Tunnel ID (for example VNI in VXLAN tunnel)

	      src_ip Outer header source IP address (IPv4 or IPv6)

	      dst_ip Outer header destination IP address (IPv4 or IPv6)

	      dst_port
		     Outer header destination UDP port

	      [no]csum
		     Controlls	outer UDP checksum. When set to csum (which is
		     default),	the  outer  UDP	 checksum  is  calculated  and
		     included  in  the	packets. When set to nocsum, outer UDP
		     checksum is zero. Note that when using zero UDP checksums
		     with  IPv6,  the other tunnel endpoint must be configured
		     to accept such packets.  In  Linux,  this	would  be  the
		     udp6zerocsumrx option for the VXLAN tunnel interface.

		     If	 using nocsum with IPv6, be sure you know what you are
		     doing.  Zero  UDP	checksums  provide  weaker  protection
		     against corrupted packets. See RFC6935 for details.

EXAMPLES
       The following example encapsulates incoming ICMP packets on eth0 into a
       vxlan tunnel, by setting metadata to VNI 11, source  IP	11.11.0.1  and
       destination  IP 11.11.0.2, and by redirecting the packet with the meta‐
       data to device vxlan0, which will do the actual encapsulation using the
       metadata:

	      #tc qdisc add dev eth0 handle ffff: ingress
	      #tc filter add dev eth0 protocol ip parent ffff: \
		flower \
		  ip_proto icmp \
		action tunnel_key set \
		  src_ip 11.11.0.1 \
		  dst_ip 11.11.0.2 \
		  id 11 \
		action mirred egress redirect dev vxlan0

       Here  is	 an example of the unset function: Incoming VXLAN traffic with
       outer IP's and VNI 11 is decapsulated by vxlan0 and metadata  is	 unset
       before redirecting to tunl1 device:

	      #tc qdisc add dev eth0 handle ffff: ingress
	      #tc filter add dev vxlan0 protocol ip parent ffff:   flower \
		     enc_src_ip 11.11.0.2 enc_dst_ip 11.11.0.1 enc_key_id 11   action tunnel_key unset	action mirred egress redirect dev tunl1

SEE ALSO
       tc(8)

iproute2			  Tunnel metadata manipulation action in tc(8)
[top]

List of man pages available for Kali

Copyright (c) for man pages and the logo by the respective OS vendor.

For those who want to learn more, the polarhome community provides shell access and support.

[legal] [privacy] [GNU] [policy] [cookies] [netiquette] [sponsors] [FAQ]
Tweet
Polarhome, production since 1999.
Member of Polarhome portal.
Based on Fawad Halim's script.
....................................................................
Vote for polarhome
Free Shell Accounts :: the biggest list on the net