Add LLDP AF_PACKET example #341

sneaky-potato · 2025-12-22T08:19:51Z

This PR add a minimal LLDP example implemented as a Lunatik Lua script. The example uses an AF_PACKET socket to receive and filter LLDP (EtherType 0x88cc) frames and demonstrates raw Ethernet access.

Addresses #126

lneto · 2025-12-22T11:57:20Z

This PR add a minimal LLDP example implemented as a Lunatik Lua script. The example uses an AF_PACKET socket to receive and filter LLDP (EtherType 0x88cc) frames and demonstrates raw Ethernet access.

Addresses #126

sorry, it's not clear to me what you want to implement here. The referred issue is for implementing a proper LLDP parser, not only to match it's ether type. If you want to extend this implementing a patch, I will be glad to merge; but please, keep this PR as draft while it's not intended to be merged.

sneaky-potato · 2025-12-22T13:31:34Z

Thanks for the clarification.

I’ve now updated the example to include a minimal LLDP TLV parser (Chassis ID, Port ID, TTL, System Name, plus generic TLV handling).

I’ll keep the PR as draft for now, please let me know if this level of parsing aligns with what you had in mind, or if you’d prefer additional TLVs or structure before merging.

(Tested this script via a veth pair: lldpd was running on one interface to emit frames)

lneto · 2025-12-22T13:53:31Z

examples/lldp.lua

+        if tlv_type == 1 then
+            table.insert(out, "chassis id")
+        elseif tlv_type == 2 then
+            table.insert(out, "port id")
+        elseif tlv_type == 3 then
+            local ttl = string.unpack(">I2", value)
+            table.insert(out, "ttl: " .. ttl)
+        elseif tlv_type == 5 then


instead of having this long if-then-else block, you can have a table indexed by tlv_type

lneto · 2025-12-22T13:58:59Z

Thanks for the clarification.

I’ve now updated the example to include a minimal LLDP TLV parser (Chassis ID, Port ID, TTL, System Name, plus generic TLV handling).

I’ll keep the PR as draft for now, please let me know if this level of parsing aligns with what you had in mind, or if you’d prefer additional TLVs or structure before merging.

(Tested this script via a veth pair: lldpd was running on one interface to emit frames)

indeed it's more aligned now, you're on the right path.. but, we try to have self-contained examples.. in the sense they should be "useful" apps with a specific purpose.. I think to make this example useful, we should have a actual LLDP client or server.. or having a netfilter filter, for instance.. to block or scrap some info..

sneaky-potato · 2025-12-22T15:11:05Z

I understand what you mean by making a lldp server client pair but could you clarify what a netfilter filter would do? Do we want to block certain tlv? The client receives lldp frames, inspects them, and then decides whether to allow or drop them. Please tell me in what direction I should drive this PR.

lneto · 2025-12-22T15:33:19Z

I understand what you mean by making a lldp server client pair but could you clarify what a netfilter filter would do? Do we want to block certain tlv? The client receives lldp frames, inspects them, and then decides whether to allow or drop them. Please tell me in what direction I should drive this PR.

I see three different paths to make it a useful app:

basic LLDP server, using sockets. I think this is the more useful one.
basic LLDP client, also using sockets.
LLDP filter, using netfilter, blocking, modifying or monitoring LLDP responses. You could for instance, keep a RCU table with the known neighbors and retrieve it from the userspace using your driver.

It's actually up to you to decide what to implement =). I found a LLDP server more useful perhaps. However, my only requirement is to make it a "full" example. A useful app ;-).

You are equally free to choose another path. I just don't find the current approach of having another sniffer that useful. You could also extend the sniffer example we already have with a LLDP parser, enriching it. It's up to you =).

sneaky-potato · 2025-12-23T07:48:07Z

Hi @lneto I did a little bit of tinkering with netfilter hooks to filter LLDP frames and put them on a shared RCU table. Right now the reader prints nothing, where can I find good documentation on netfilter? I think the parameters passed in netfilter hook need to be tweaked

Regarding the server, just to confirm, did you mean a thread emitting LLDP frames on a specified interface (will need to get source MAC of the interface somehow to do this)?

lneto · 2025-12-23T12:05:44Z

examples/lldp/monitor.lua

+local lunatik = require("lunatik")
+local rcu     = require("rcu")
+local linux   = require("linux")
+local string  = require("string")


lneto · 2025-12-23T12:11:06Z

examples/lldp/monitor.lua

+end
+
+local function lldp_hook(skb)
+


Suggested change

please, mind our code style.

lneto · 2025-12-23T12:11:22Z

examples/lldp/monitor.lua

+	pf       = family.BRIDGE,
+	hooknum  = hooks.PRE_ROUTING,
+	priority = pri.FILTER,
+}


Suggested change

}

}

lneto · 2025-12-23T12:11:29Z

examples/lldp/reader.lua

+	return table.concat(out, "\n") .. "\n"
+end
+
+device.new(lldp)


Suggested change

device.new(lldp)

device.new(lldp)

lneto · 2025-12-23T12:17:56Z

Hi @lneto I did a little bit of tinkering with netfilter hooks to filter LLDP frames and put them on a shared RCU table. Right now the reader prints nothing, where can I find good documentation on netfilter? I think the parameters passed in netfilter hook need to be tweaked

did you try to put some prints on your hook? are you generating LLDP traffic? are you are running the daemon locally? if so, you probably need to use LOCAL_IN. did you take a look at this https://luainkernel.github.io/lunatik/modules/netfilter.html? or are you referring to general netfilter doc? if so, I think it's a good place to get started https://thermalcircle.de/doku.php?id=blog:linux:nftables_packet_flow_netfilter_hooks_detail.

Regarding the server, just to confirm, did you mean a thread emitting LLDP frames on a specified interface (will need to get source MAC of the interface somehow to do this)?

Yes, I meant to implement an lldpd on Lunatik ;-). You can get the MAC address from the frames, right? What's missing?

sneaky-potato · 2025-12-23T13:43:57Z

For the netfilter filter, which family should we use for capturing LLDP frames? I think NETDEV should be used but my kernel seem to not support it (arch linux kernel v6.12.63-1-lts) by default (cant see CONFIG_NETFILTER_NETDEV=y). What do you think should be done? Is NETDEV included in kernel binaries by default? I tried with BRIDGE family but that will require a bridge setup for the interfaces.

Yes, I meant to implement an lldpd on Lunatik ;-). You can get the MAC address from the frames, right? What's missing?

Nothing, I'll add the server implementation soon after I figure out the netfilter part

lneto · 2025-12-23T14:56:42Z

For the netfilter filter, which family should we use for capturing LLDP frames? I think NETDEV should be used but my kernel seem to not support it (arch linux kernel v6.12.63-1-lts) by default (cant see CONFIG_NETFILTER_NETDEV=y). What do you think should be done? Is NETDEV included in kernel binaries by default? I tried with BRIDGE family but that will require a bridge setup for the interfaces.

I don't see why you can't run on BRIDGE.

Yes, I meant to implement an lldpd on Lunatik ;-). You can get the MAC address from the frames, right? What's missing?

Nothing, I'll add the server implementation soon after I figure out the netfilter part

I think we are mixing up things here; my suggestion to implement a server here was by using raw sockets as you were doing before. I suggested 3 different paths, not a mix of them ;-).

A minimal LLDP example implemented as a Lunatik Lua script. The example uses a thread to emit LLDP (EtherType 0x88cc) frames and send them on a specified network interface. Signed-off-by: Ashwani Kumar Kamal <ashwanikamal.im421@gmail.com>

sneaky-potato · 2025-12-24T07:32:20Z

I think we are mixing up things here; my suggestion to implement a server #341 (comment) was by using raw sockets as you were doing before. I suggested 3 different paths, not a mix of them ;-).

You are right. A server makes the most sense here. I have added a simple daemon which emits LLDP frames every 30 seconds.

sneaky-potato force-pushed the lldp-example branch from 989e2bc to 60b940c Compare December 22, 2025 13:27

sneaky-potato marked this pull request as draft December 22, 2025 13:31

lneto reviewed Dec 22, 2025

View reviewed changes

sneaky-potato force-pushed the lldp-example branch from 60b940c to 759f44c Compare December 23, 2025 07:42

sneaky-potato force-pushed the lldp-example branch from 759f44c to 95bc004 Compare December 23, 2025 08:32

lneto reviewed Dec 23, 2025

View reviewed changes

examples/lldp/monitor.lua Outdated

end

local function lldp_hook(skb)

Copy link

Contributor

lneto Dec 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

please, mind our code style.

lneto reviewed Dec 23, 2025

View reviewed changes

Add LLDP monitor example

debcd26

A minimal LLDP example implemented as a Lunatik Lua script. The example uses a thread to emit LLDP (EtherType 0x88cc) frames and send them on a specified network interface. Signed-off-by: Ashwani Kumar Kamal <ashwanikamal.im421@gmail.com>

sneaky-potato force-pushed the lldp-example branch from 95bc004 to debcd26 Compare December 24, 2025 07:29

Add LLDP AF_PACKET example #341

Are you sure you want to change the base?

Add LLDP AF_PACKET example #341

Uh oh!

Conversation

sneaky-potato commented Dec 22, 2025

Uh oh!

lneto commented Dec 22, 2025

Uh oh!

sneaky-potato commented Dec 22, 2025

Uh oh!

lneto Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

lneto commented Dec 22, 2025

Uh oh!

sneaky-potato commented Dec 22, 2025

Uh oh!

lneto commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sneaky-potato commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lneto Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

lneto Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

lneto Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

lneto Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

lneto commented Dec 23, 2025

Uh oh!

sneaky-potato commented Dec 23, 2025

Uh oh!

lneto commented Dec 23, 2025

Uh oh!

sneaky-potato commented Dec 24, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

lneto commented Dec 22, 2025 •

edited

Loading

sneaky-potato commented Dec 23, 2025 •

edited

Loading