Skip to content

Add Parse Ethernet frame Operation, allow Parse IPv4 Header to cascade#1722

Merged
GCHQDeveloper581 merged 14 commits intogchq:masterfrom
Kalkran:parse-ethernet-frame
Mar 21, 2026
Merged

Add Parse Ethernet frame Operation, allow Parse IPv4 Header to cascade#1722
GCHQDeveloper581 merged 14 commits intogchq:masterfrom
Kalkran:parse-ethernet-frame

Conversation

@Kalkran
Copy link
Copy Markdown
Contributor

@Kalkran Kalkran commented Feb 18, 2024

This adds a new operation+tests that parses Ethernet frames.
Recently, I've been provided with Base64-encoded single packets which are annoying to decode manually, or even to strip the Ethernet header off.
This operation adds a basic information output and a 'packet data'-only which allows cascading to other Networking-related parsers (ie IPv4). I am still playing with the idea of updating those to allow the return of encapsulated data as well - allowing a quick/basic packet analysis through a recipe.

Comment thread src/core/operations/ParseEthernetFrame.mjs Outdated
Comment thread src/core/operations/ParseEthernetFrame.mjs
@Kalkran Kalkran changed the title Add Parse Ethernet frame Operation Add Parse Ethernet frame Operation, allow Parse IPv4 Header to cascade Apr 6, 2024
@Kalkran
Copy link
Copy Markdown
Contributor Author

Kalkran commented Apr 6, 2024

An accidental push before switching branches broke UI tests. These are now fixed.
The last few commits also allow the pre-existing "Parse IPv4 Header" to cascade its data down the line instead of only presenting a HTML table. Together with the Ethernet frame operation and the other IP-related parsers this allows analysis and decoding of IP packets (for example as logged by Suricata) and their contents.

@Kalkran Kalkran requested a review from a3957273 May 1, 2024 08:46
@Kalkran
Copy link
Copy Markdown
Contributor Author

Kalkran commented Jun 24, 2024

@a3957273 Could you take another look at this before it disappears into page 2?

@GCHQDeveloper581 GCHQDeveloper581 dismissed a3957273’s stale review March 21, 2026 17:51

Review comments have been addressed and original reviewer is no longer active on the project.

Copy link
Copy Markdown
Contributor

@GCHQDeveloper581 GCHQDeveloper581 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! Thanks for your contribution, and sorry it has taken so long to process.

@GCHQDeveloper581 GCHQDeveloper581 merged commit 78d40ea into gchq:master Mar 21, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants