Tutorial: L2/3 Flow Aggregation Modes

L2/3 Flow Aggregation Modes

As already introduced in the basics tutorial, we like to explore the different flow aggregation modes of T2.

So the five tuple: (srcIP, srcPort, dstIP, dstPort, l4Proto) aggregation is commonly used, right? But that is far from reality, which is more complex, e.g. there are these ominous virtual LANs, aka VLANs.

The flows gets messed up if different VLANs using the same five tuple. Yes, I know who gets traffic from an LNS or a trunk…

So a six tuple. Aehm, what about SCTP? Right, so that has to be integrated into the definition of a flow as well, as discussed in the SCTP tutorial. Seven tuple. There are several L2 protocols, oups! So we need to add the ether type and the Ethernet addresses as well. Now we are ending up with a 10 tuple. The configuration of these different modes will be the topic of the following tutorial.

Preparation

Before we start we need to prepare T2. If you did not complete the tutorials before just follow the procedure described below.

First I recommend to set T2 into a pristine state by removing all unnecessary or older plugins from the plugin folder ~/.tranalyzer/plugins and compile the standard plugins. Just as a precaution if you have some old plugins or files there. Then build the plugins listed in the command line below:

$ t2build -e
Are you sure you want to empty the plugin folder '/home/wurst/.tranalyzer/plugins' (y/N)? y
Plugin folder emptied
$ t2build tranalyzer2 basicFlow basicStats tcpStates connStat txtSink
...
$

If you did not create a separate data and results directory yet, please do it now in another cmd window, that facilitates your workflow:

$ mkdir ~/data
$ mkdir ~/results
$ cd data

Download the sample pcaps if did not do it already: annoloc2.pcap and 802.1Q_tunneling.cap.

Now you’re all set.

T2 protocol Flow Aggregation

The constants controlling the flow aggregation are residing in networkHeaders.h. Open the file and search for user defines as being shown below:

By default T2 operates in dual IP mode, so IPv4/6 flows are produced, even IPv4 in IPv6 or vise versa, any combination you can have with any L2 encapsulation protocols including fragmentation and all crap you can imagine. Search for Protocol stack in tranalyzer.h as shown below:

...
// Protocol stack
#define AYIYA           1 // AYIYA processing on: 1, off: 0
#define GENEVE          1 // GENEVE processing on: 1, off: 0
#define TEREDO          1 // TEREDO processing on: 1, off: 0
#define L2TP            1 // L2TP processing on: 1, off: 0
#define GRE             1 // GRE processing on: 1, off: 0
#define GTP             1 // GTP processing on: 1, off: 0
#define VXLAN           1 // VXLAN processing on: 1, off: 0
#define IPIP            1 // IPv4/6 in IPv4/6 processing on: 1, off: 0
#define ETHIP           1 // Ethernet over IP on: 1, off: 0
#define CAPWAP          1 // CAPWAP processing on: 1, off: 0
#define LWAPP           1 // LWAPP processing on: 1, off: 0
...

It is a legacy that you cannot switch off IPv4, we will change it to independent switches in a later version. The SCTP constants are discussed in detail in the SCTP tutorial, so we will skip that here.

If you got traffic from a monitor port of a switch where somebody forgot to suppress either the port egress or ingress traffic, essentially the resulting pcap contains all duplicate packets. No big deal, switch on MULTIPKTSUP, t2build tranalyzer2 and that mishap is gone. This mode only works with IPv4, as these IETF guys defining IPv6 forgot the IPID in the IPv6 main header. Morons!!

If you want the header description being created by the core leave T2_PRI_HDRDESC on, unless you want to gain performance. T2_HDRDESC_AGGR aggregates multiple header descriptions, a good choice if you want to reduce the length of the header description column in the flow/packet file. Also the T2_HDRDESC_LEN limits the length of the column. In the basics tutorial, the form and effect of the header description config was already demonstrated.

Let’s focus here on the IP and Ethernet aggregation modes first.

IP Modes

You should know by now that the annoloc2.pcap contains L2, IPv4 and IPv6 flows. Let us switch to L4 mode only, as all plugins implement the aggregation mode the core and all plugins loaded have to be recompiled:

$ t2conf tranalyzer2 -D IPV6_ACTIVATE=0 -D ETH_ACTIVATE=0
$ t2build -R
...
$ t2 -r ~/data/annoloc2.pcap -w ~/results/
================================================================================
Tranalyzer 0.8.7 (Anteater), Tarantula. PID: 3785
================================================================================
[INF] Creating flows for IPv4
Active plugins:
    01: basicFlow, 0.8.7
    02: basicStats, 0.8.7
    03: tcpStates, 0.8.7
    04: connStat, 0.8.7
    05: txtSink, 0.8.7
[INF] basicFlow: IPv4 Ver: 4, Rev: 01102019, Range Mode: 0, subnet ranges loaded: 312985 (312.99 K)
Processing file: /home/wurst/data/annoloc2.pcap
Link layer type: Ethernet [EN10MB/1]
Dump start: 1022171701.691172 sec (Thu 23 May 2002 16:35:01 GMT)
[WRN] snapL2Length: 54 - snapL3Length: 40 - IP length in header: 1500
Dump stop : 1022171726.640398 sec (Thu 23 May 2002 16:35:26 GMT)
Total dump duration: 24.949226 sec
Finished processing. Elapsed time: 0.686487 sec
Finished unloading flow memory. Time: 0.877711 sec
Percentage completed: 100.00%
Number of processed packets: 1219015 (1.22 M)
Number of processed bytes: 64082726 (64.08 M)
Number of raw bytes: 844642686 (844.64 M)
Number of pcap bytes: 83586990 (83.59 M)
Number of IPv4 packets: 1218588 (1.22 M) [99.96%]
Number of IPv6 packets: 180 [0.01%]
Number of packets without flow: 407 [0.03%]
Number of A packets: 563906 (563.91 K) [46.27%]
Number of B packets: 654702 (654.70 K) [53.73%]
Number of A bytes: 29432312 (29.43 M) [45.94%]
Number of B bytes: 34629524 (34.63 M) [54.06%]
Average A packet load: 52.19
Average B packet load: 52.89
--------------------------------------------------------------------------------
basicStats: Biggest L3 Talker: 138.212.189.38 (JP): 23601 (23.60 K) [1.94%] packets
basicStats: Biggest L3 Talker: 138.212.189.38 (JP): 35005508 (35.01 M) [54.64%] bytes
tcpStates: Aggregated anomaly flags: 0xdf
connStat: Number of unique source IPs: 4383 (4.38 K)
connStat: Number of unique destination IPs: 3173 (3.17 K)
connStat: Number of unique source/destination IPs connections: 182
connStat: Max unique number of source IP / destination port connections: 413
connStat: IP prtcon/sdcon, prtcon/scon: 2.269231, 0.094228
connStat: Source IP with max connections: 138.212.189.66 (JP): 366 connections
connStat: Destination IP with max connections: 138.212.184.235 (JP): 402 connections
--------------------------------------------------------------------------------
Headers count: min: 2, max: 4, average: 3.01
Number of GRE packets: 20 [0.00%]
Number of IGMP packets: 12 [0.00%]
Number of ICMP packets: 3059 (3.06 K) [0.25%]
Number of TCP packets: 948594 (948.59 K) [77.82%]
Number of TCP bytes: 52633712 (52.63 M) [82.13%]
Number of UDP packets: 266900 (266.90 K) [21.89%]
Number of UDP bytes: 11234272 (11.23 M) [17.53%]
Number of IPv4 fragmented packets: 2284 (2.28 K) [0.19%]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of processed   flows: 17446 (17.45 K)
Number of processed A flows: 9868 (9.87 K) [56.56%]
Number of processed B flows: 7578 (7.58 K) [43.44%]
Number of request     flows: 9821 (9.82 K) [56.29%]
Number of reply       flows: 7625 (7.62 K) [43.71%]
Total   A/B    flow asymmetry: 0.13
Total req/rply flow asymmetry: 0.13
Number of processed   packets/flows: 69.85
Number of processed A packets/flows: 57.14
Number of processed B packets/flows: 86.40
Number of processed total packets/s: 48859.83 (48.86 K)
Number of processed A+B packets/s: 48843.52 (48.84 K)
Number of processed A   packets/s: 22602.14 (22.60 K)
Number of processed   B packets/s: 26241.37 (26.24 K)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of average processed flows/s: 699.26
Average full raw bandwidth: 270835712 b/s (270.84 Mb/s)
Average snapped bandwidth : 20548206 b/s (20.55 Mb/s)
Average full bandwidth : 270269472 b/s (270.27 Mb/s)
Max number of flows in memory: 15063 (15.06 K) [5.75%]
Memory usage: 0.10 GB [0.15%]
Aggregate flow status: 0x000018fa0202d044
[WRN] L3 SnapLength < Length in IP header
[WRN] L4 header snapped
[WRN] Consecutive duplicate IP ID
[WRN] IPv4/6 fragmentation header packet missing
[WRN] IPv4/6 packet fragmentation sequence not finished
[INF] IPv4
[INF] IPv6
[INF] IPv4/6 fragmentation
[INF] IPv4/6 in IPv4/6
[INF] GRE encapsulation
[INF] SSDP/UPnP flows
[INF] Ethernet flows
[INF] ARP flows
$

Now we see only IPv4 flows, but we still receive statistics about all other protocols such as IPv6 or ARP. So even when filtering out traffic in the core you have the full overview of the traffic. Really useful, because somebody might promise you IPv4 traffic only, you switch T2 to IPv4 mode and then you discover that there is still IPv6 traffic in it without even looking into a single flow file. So you can show it to the guy, and make him eat furniture.

At the beginning of the report you see: Number of packets without flow: 407 [0.03%]

These are the 0.03% IPv6 + L2 packets T2 does not dissect. So the statistics is marginally different from dual mode. To prove that the core filtering works, select either the IPv4/6 flowStat bits and aggregate them or aggregate hdrDesc. Here I chose the latter, because it is human readable:

$ cd ~/results
$ tawk 'aggrrep($hdrDesc)' annoloc2_flows.txt | tcol
drDesc                   Flows
eth:ipv4:tcp              10442
eth:ipv4:udp              5989
eth:ipv4:icmp             561
eth:ipv4:udp:ssdp         420
eth:ipv4:igmp             11
eth:ipv4:ipv4:tcp         8
eth:ipv4:ipv6             6
eth:ipv4:pim              3
eth:ipv4:gre:UNK(0xe805)  1
eth:ipv4:gre:UNK(0xe6ef)  1
eth:ipv4:gre:UNK(0xc309)  1
eth:ipv4:gre:UNK(0xb30d)  1
eth:ipv4:gre:UNK(0xaa18)  1
eth:ipv4:gre:UNK(0xa808)  1
eth:ipv4:gre:UNK(0x98c0)  1
eth:ipv4:gre:UNK(0x9604)  1
eth:ipv4:gre:UNK(0x900a)  1
eth:ipv4:gre:UNK(0x8b00)  1
eth:ipv4:gre:UNK(0x7d69)  1
eth:ipv4:gre:UNK(0x6f6d)  1
eth:ipv4:gre:UNK(0x5100)  1
eth:ipv4:gre:UNK(0x386d)  1
eth:ipv4:gre:UNK(0x1fa1)  1
eth:ipv4:gre:UNK(0x1d11)  1
eth:ipv4:gre:UNK(0x1400)  1
eth:ipv4:gre:UNK(0x0e0f)  1
eth:ipv4:gre:UNK(0x0104)  1
$

The UNK() is a complaint from the core that these flows contain snapped packets.

Now switch on only IPv6, still L2 flows off.

$ t2conf tranalyzer2 -D IPV6_ACTIVATE=1
$ t2build -R
...
$ t2 -r ~/data/annoloc2.pcap -w ~/results/
================================================================================
Tranalyzer 0.8.7 (Anteater), Tarantula. PID: 6101
================================================================================
[INF] Creating flows for IPv6
Active plugins:
    01: basicFlow, 0.8.7
    02: basicStats, 0.8.7
    03: tcpStates, 0.8.7
    04: connStat, 0.8.7
    05: txtSink, 0.8.7
[INF] basicFlow: IPv6 Ver: 4, Rev: 01102019, Range Mode: 0, subnet ranges loaded: 21495 (21.50 K)
Processing file: /home/wurst/data/annoloc2.pcap
Link layer type: Ethernet [EN10MB/1]
Dump start: 1022171701.691172 sec (Thu 23 May 2002 16:35:01 GMT)
[WRN] snapL2Length: 66 - snapL3Length: 52 - IP length in header: 60
Dump stop : 1022171726.640398 sec (Thu 23 May 2002 16:35:26 GMT)
Total dump duration: 24.949226 sec
Finished processing. Elapsed time: 0.240539 sec
Finished unloading flow memory. Time: 0.241162 sec
Percentage completed: 100.00%
Number of processed packets: 1219015 (1.22 M)
Number of processed bytes: 64082726 (64.08 M)
Number of raw bytes: 844642686 (844.64 M)
Number of pcap bytes: 83586990 (83.59 M)
Number of IPv4 packets: 1218588 (1.22 M) [99.96%]
Number of IPv6 packets: 180 [0.01%]
Number of packets without flow: 1218855 (1.22 M) [99.99%]
Number of A packets: 90 [56.25%]
Number of B packets: 70 [43.75%]
Number of A bytes: 5908 (5.91 K) [56.18%]
Number of B bytes: 4608 (4.61 K) [43.82%]
Average A packet load: 65.64
Average B packet load: 65.83
--------------------------------------------------------------------------------
basicStats: Biggest L3 Talker: 2001:70e8:d3ce:e200:deaf:b9ff:1f0e:becf: 9 [0.00%] packets
basicStats: Biggest L3 Talker: 2001:70e8:d3ce:e200:deaf:b9ff:1f0e:becf: 781 [7.43%] bytes
tcpStates: Aggregated anomaly flags: 0x03
connStat: Number of unique source IPs: 13
connStat: Number of unique destination IPs: 17
connStat: Number of unique source/destination IPs connections: 4
connStat: Max unique number of source IP / destination port connections: 2
connStat: IP prtcon/sdcon, prtcon/scon: 0.500000, 0.153846
connStat: Source IP with max connections: 2001:70e8:d3ce:e200:deaf:b9ff:1f0e:becf: 10 connections
connStat: Destination IP with max connections: 2001:70e8:d3ce:e200:deaf:b9ff:1f0e:becf: 6 connections
--------------------------------------------------------------------------------
Headers count: min: 2, max: 4, average: 2.00
Number of GRE packets: 20 [0.00%]
Number of ICMPv6 packets: 11 [0.00%]
Number of TCP packets: 149 [0.01%]
Number of TCP bytes: 9834 (9.83 K) [0.02%]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of processed   flows: 44
Number of processed A flows: 24 [54.55%]
Number of processed B flows: 20 [45.45%]
Number of request     flows: 24 [54.55%]
Number of reply       flows: 20 [45.45%]
Total   A/B    flow asymmetry: 0.09
Total req/rply flow asymmetry: 0.09
Number of processed   packets/flows: 3.64
Number of processed A packets/flows: 3.75
Number of processed B packets/flows: 3.50
Number of processed total packets/s: 48859.83 (48.86 K)
Number of processed A+B packets/s: 6.41
Number of processed A   packets/s: 3.61
Number of processed   B packets/s: 2.81
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of average processed flows/s: 1.76
Average full raw bandwidth: 270835712 b/s (270.84 Mb/s)
Average snapped bandwidth : 20548206 b/s (20.55 Mb/s)
Average full bandwidth : 5599 b/s (5.60 Kb/s)
Max number of flows in memory: 44 [0.02%]
Memory usage: 0.03 GB [0.05%]
Aggregate flow status: 0x0000080a0002d044
[WRN] L3 SnapLength < Length in IP header
[WRN] L4 header snapped
[INF] IPv4
[INF] IPv6
[INF] IPv4/6 in IPv4/6
[INF] GRE encapsulation
[INF] Ethernet flows
[INF] ARP flows
$

Now more flows are ignored: Number of packets without flow: 1218855 (1.22 M) [99.99%]

These are the 99.9% IPv4 + L2 which are not processed by T2 core. Only 44 IPv6 Flows are listed in the flow file. To test whether the anteater does a good job, here is the proof:

$ tawk 'aggr($hdrDesc)' annoloc2_flows.txt | tcol
hdrDesc          Flows
eth:ipv6:tcp     37
eth:ipv6:icmpv6  7
$

Switching certain Protocols off in the core save time and memory. Hence, if you definitely know that on your interface or trunk port is ONLY one type of traffic, first run T2 in full Dual and L2 mode and look at the end report, then switch certain protocols off.

L2 Modes

Now we only want to see L2 flows, so no IP. If you set IPV6_ACTIVATE=0 you still have IPv4. Bummer, a legacy flaw, which we definitely will correct in a later version. So you have to add a BPF filter, which messes up the internal packet index, as not every packet reaches T2’s core. So comparing with Wireshark is then difficult. Wait, we will take care of it.

Anyway, let’s switch on pure L2 flows, and IPv4 on. Load the macRecorder, which records all mac pairs in an IP flow. We will need it i number of mac Pairs in a flow as a selection feature.

$ t2conf tranalyzer2 -D IPV6_ACTIVATE=0 -D ETH_ACTIVATE=1
$ t2build macRecorder
$ t2build -R
...
$ t2 -r ~/data/annoloc2.pcap -w ~/results/
================================================================================
Tranalyzer 0.8.7 (Anteater), Tarantula. PID: 8466
================================================================================
[INF] Creating flows for L2, IPv4
Active plugins:
    01: basicFlow, 0.8.7
    02: macRecorder, 0.8.7
    03: basicStats, 0.8.7
    04: tcpStates, 0.8.7
    05: connStat, 0.8.7
    06: txtSink, 0.8.7
[INF] basicFlow: IPv4 Ver: 4, Rev: 01102019, Range Mode: 0, subnet ranges loaded: 312985 (312.99 K)
Processing file: /home/wurst/data/annoloc2.pcap
Link layer type: Ethernet [EN10MB/1]
Dump start: 1022171701.691172 sec (Thu 23 May 2002 16:35:01 GMT)
[WRN] snapL2Length: 54 - snapL3Length: 40 - IP length in header: 1500
Dump stop : 1022171726.640398 sec (Thu 23 May 2002 16:35:26 GMT)
Total dump duration: 24.949226 sec
Finished processing. Elapsed time: 0.581245 sec
Finished unloading flow memory. Time: 0.788201 sec
Percentage completed: 100.00%
Number of processed packets: 1219015 (1.22 M)
Number of processed bytes: 64082726 (64.08 M)
Number of raw bytes: 844642686 (844.64 M)
Number of pcap bytes: 83586990 (83.59 M)
Number of IPv4 packets: 1218588 (1.22 M) [99.96%]
Number of IPv6 packets: 180 [0.01%]
Number of packets without flow: 160 [0.01%]
Number of A packets: 564142 (564.14 K) [46.28%]
Number of B packets: 654713 (654.71 K) [53.72%]
Number of A bytes: 29442224 (29.44 M) [45.95%]
Number of B bytes: 34629986 (34.63 M) [54.05%]
Average A packet load: 52.19
Average B packet load: 52.89
--------------------------------------------------------------------------------
basicStats: Biggest L2 Talker: 00:d0:02:6d:78:00: 57 [0.00%] packets
basicStats: Biggest L2 Talker: 00:d0:02:6d:78:00: 3420 (3.42 K) [0.01%] bytes
basicStats: Biggest L3 Talker: 138.212.189.38 (JP): 23601 (23.60 K) [1.94%] packets
basicStats: Biggest L3 Talker: 138.212.189.38 (JP): 35005508 (35.01 M) [54.63%] bytes
tcpStates: Aggregated anomaly flags: 0xdf
connStat: Number of unique source IPs: 4383 (4.38 K)
connStat: Number of unique destination IPs: 3173 (3.17 K)
connStat: Number of unique source/destination IPs connections: 182
connStat: Max unique number of source IP / destination port connections: 413
connStat: IP prtcon/sdcon, prtcon/scon: 2.269231, 0.094228
connStat: Source IP with max connections: 138.212.189.66 (JP): 366 connections
connStat: Destination IP with max connections: 138.212.184.235 (JP): 402 connections
--------------------------------------------------------------------------------
Headers count: min: 2, max: 4, average: 3.01
Number of GRE packets: 20 [0.00%]
Number of IGMP packets: 12 [0.00%]
Number of ICMP packets: 3059 (3.06 K) [0.25%]
Number of TCP packets: 948594 (948.59 K) [77.82%]
Number of TCP bytes: 52633712 (52.63 M) [82.13%]
Number of UDP packets: 266900 (266.90 K) [21.89%]
Number of UDP bytes: 11234272 (11.23 M) [17.53%]
Number of IPv4 fragmented packets: 2284 (2.28 K) [0.19%]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of processed   flows: 17545 (17.55 K)
Number of processed A flows: 9956 (9.96 K) [56.75%]
Number of processed B flows: 7589 (7.59 K) [43.25%]
Number of request     flows: 9909 (9.91 K) [56.48%]
Number of reply       flows: 7636 (7.64 K) [43.52%]
Total   A/B    flow asymmetry: 0.13
Total req/rply flow asymmetry: 0.13
Number of processed   packets/flows: 69.47
Number of processed A packets/flows: 56.66
Number of processed B packets/flows: 86.27
Number of processed total packets/s: 48859.83 (48.86 K)
Number of processed A+B packets/s: 48853.42 (48.85 K)
Number of processed A   packets/s: 22611.60 (22.61 K)
Number of processed   B packets/s: 26241.82 (26.24 K)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of average processed flows/s: 703.23
Average full raw bandwidth: 270835712 b/s (270.84 Mb/s)
Average snapped bandwidth : 20548206 b/s (20.55 Mb/s)
Average full bandwidth : 270269472 b/s (270.27 Mb/s)
Max number of flows in memory: 15162 (15.16 K) [5.78%]
Memory usage: 0.17 GB [0.25%]
Aggregate flow status: 0x000018fa0202d044
[WRN] L3 SnapLength < Length in IP header
[WRN] L4 header snapped
[WRN] Consecutive duplicate IP ID
[WRN] IPv4/6 fragmentation header packet missing
[WRN] IPv4/6 packet fragmentation sequence not finished
[INF] IPv4
[INF] IPv6
[INF] IPv4/6 fragmentation
[INF] IPv4/6 in IPv4/6
[INF] GRE encapsulation
[INF] SSDP/UPnP flows
[INF] Ethernet flows
[INF] ARP flows
$

Total 17545 flows. Now search for all flows which contain more than one mac pair during the life time of the flow. We find one, a UDP broadcast.

$ cd ~/results
$ tawk '$macPairs > 1' annoloc2_flows.txt
dir  flowInd  flowStat            timeFirst          timeLast           duration  numHdrDesc  numHdrs  hdrDesc       srcMac                               dstMac             ethType  ethVlanID  srcIP    srcIPCC  srcIPWho  srcPort  dstIP            dstIPCC  dstIPWho     dstPort  l4Proto  macPairs  srcMac_dstMac_numP                                                           srcManuf_dstManuf  numPktsSnt  numPktsRcvd  numBytesSnt  numBytesRcvd  minPktSz  maxPktSz  avePktSize  stdPktSize  minIAT  maxIAT    aveIAT    stdIAT      pktps     bytps     pktAsm  bytAsm  tcpStates  connSip  connDip  connSipDip  connSipDprt  connF
A     7669     0x0000000200004000  1022171718.902437  1022171719.151404  0.248967  1           3        eth:ipv4:udp  00:00:1c:b6:17:f2;00:c1:28:01:65:77  ff:ff:ff:ff:ff:ff  0x0800              0.0.0.0  --       "--"      68       255.255.255.255  11       "Broadcast"  67       17       2         00:00:1c:b6:17:f2_ff:ff:ff:ff:ff:ff_1;00:c1:28:01:65:77_ff:ff:ff:ff:ff:ff_2  BellTech_;_        3           0            915          0             300       312       305         4.133199    0       0.227059  0.082989  0.07443081  12.04979  3675.186  1       1       0x00       1        5        1           1
$

Now instruct the core to add the ethertype and the MAC addresses to the flow hash.

$ t2conf tranalyzer2 -D IPV6_ACTIVATE=0 -D ETH_ACTIVATE=2
$ t2build -R
...
$ t2 -r ~/data/annoloc2.pcap -w ~/results/
===============================================================================
Tranalyzer 0.8.7 (Anteater), Tarantula. PID: 29514
================================================================================
[INF] Creating flows for L2, IPv4
Active plugins:
    01: basicFlow, 0.8.7
    02: macRecorder, 0.8.7
    03: basicStats, 0.8.7
    04: tcpStates, 0.8.7
    05: connStat, 0.8.7
    06: txtSink, 0.8.7
[INF] basicFlow: IPv4 Ver: 4, Rev: 01102019, Range Mode: 0, subnet ranges loaded: 312983 (312.98 K)
Processing file: /home/wurst/data/annoloc2.pcap
Link layer type: Ethernet [EN10MB/1]
Dump start: 1022171701.691172 sec (Thu 23 May 2002 16:35:01 GMT)
[WRN] snapL2Length: 54 - snapL3Length: 40 - IP length in header: 1500
Dump stop : 1022171726.640398 sec (Thu 23 May 2002 16:35:26 GMT)
Total dump duration: 24.949226 sec
Finished processing. Elapsed time: 0.584987 sec
Finished unloading flow memory. Time: 0.790083 sec
Percentage completed: 100.00%
Number of processed packets: 1219015 (1.22 M)
Number of processed bytes: 64082726 (64.08 M)
Number of raw bytes: 844642686 (844.64 M)
Number of pcap bytes: 83586990 (83.59 M)
Number of IPv4 packets: 1218588 (1.22 M) [99.96%]
Number of IPv6 packets: 180 [0.01%]
Number of packets without flow: 160 [0.01%]
Number of A packets: 564142 (564.14 K) [46.28%]
Number of B packets: 654713 (654.71 K) [53.72%]
Number of A bytes: 29442224 (29.44 M) [45.95%]
Number of B bytes: 34629986 (34.63 M) [54.05%]
Average A packet load: 52.19
Average B packet load: 52.89
--------------------------------------------------------------------------------
basicStats: Biggest L2 Talker: 00:d0:02:6d:78:00: 57 [0.00%] packets
basicStats: Biggest L2 Talker: 00:d0:02:6d:78:00: 3420 (3.42 K) [0.01%] bytes
basicStats: Biggest L3 Talker: 138.212.189.38 (JP): 23601 (23.60 K) [1.94%] packets
basicStats: Biggest L3 Talker: 138.212.189.38 (JP): 35005508 (35.01 M) [54.63%] bytes
tcpStates: Aggregated anomaly flags: 0xdf
connStat: Number of unique source IPs: 4383 (4.38 K)
connStat: Number of unique destination IPs: 3173 (3.17 K)
connStat: Number of unique source/destination IPs connections: 182
connStat: Max unique number of source IP / destination port connections: 413
connStat: IP prtcon/sdcon, prtcon/scon: 2.269231, 0.094228
connStat: Source IP with max connections: 138.212.189.66 (JP): 366 connections
connStat: Destination IP with max connections: 138.212.184.235 (JP): 402 connections
--------------------------------------------------------------------------------
Headers count: min: 2, max: 4, average: 3.01
Number of GRE packets: 20 [0.00%]
Number of IGMP packets: 12 [0.00%]
Number of ICMP packets: 3059 (3.06 K) [0.25%]
Number of TCP packets: 948594 (948.59 K) [77.82%]
Number of TCP bytes: 52633712 (52.63 M) [82.13%]
Number of UDP packets: 266900 (266.90 K) [21.89%]
Number of UDP bytes: 11234272 (11.23 M) [17.53%]
Number of IPv4 fragmented packets: 2284 (2.28 K) [0.19%]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of processed   flows: 17546 (17.55 K)
Number of processed A flows: 9957 (9.96 K) [56.75%]
Number of processed B flows: 7589 (7.59 K) [43.25%]
Number of request     flows: 9910 (9.91 K) [56.48%]
Number of reply       flows: 7636 (7.64 K) [43.52%]
Total   A/B    flow asymmetry: 0.13
Total req/rply flow asymmetry: 0.13
Number of processed   packets/flows: 69.47
Number of processed A packets/flows: 56.66
Number of processed B packets/flows: 86.27
Number of processed total packets/s: 48859.83 (48.86 K)
Number of processed A+B packets/s: 48853.42 (48.85 K)
Number of processed A   packets/s: 22611.60 (22.61 K)
Number of processed   B packets/s: 26241.82 (26.24 K)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of average processed flows/s: 703.27
Average full raw bandwidth: 270835712 b/s (270.84 Mb/s)
Average snapped bandwidth : 20548206 b/s (20.55 Mb/s)
Average full bandwidth : 270269472 b/s (270.27 Mb/s)
Max number of flows in memory: 15163 (15.16 K) [5.78%]
Memory usage: 0.17 GB [0.25%]
Aggregate flow status: 0x000018fa0202d044
[WRN] L3 SnapLength < Length in IP header
[WRN] L4 header snapped
[WRN] Consecutive duplicate IP ID
[WRN] IPv4/6 fragmentation header packet missing
[WRN] IPv4/6 packet fragmentation sequence not finished
[INF] IPv4
[INF] IPv6
[INF] IPv4/6 fragmentation
[INF] IPv4/6 in IPv4/6
[INF] GRE encapsulation
[INF] SSDP/UPnP flows
[INF] Ethernet flows
[INF] ARP flows
$

Total 17546 flows, one more. Why? Search again for all flows which contain more than one mac pair during the life time of the flow. Oups, gone. Because now the IP flow is now split into two flows.

$ cd ~/results
$ tawk '$macPairs > 1' annoloc2_flows.txt
dir  flowInd  flowStat  timeFirst  timeLast  duration  numHdrDesc  numHdrs  hdrDesc  srcMac  dstMac  ethType  ethVlanID  srcIP  srcIPCC  srcIPWho  srcPort  dstIP  dstIPCC  dstIPWho  dstPort  l4Proto  macPairs  srcMac_dstMac_numP  srcManuf_dstManuf  numPktsSnt  numPktsRcvd  numBytesSnt  numBytesRcvd  minPktSz  maxPktSz  avePktSize  stdPktSize  minIAT  maxIAT  aveIAT  stdIAT  pktps  bytps  pktAsm  bytAsm  connSip  connDip  connSipDip  connSipDprt  connF
$

As homework, produce a tawk to find the said two flows.

SCTP Modes

Already covered in the SCTP tutorial

Header description

Now let’s switch off the header description, very convenient but a performance factor. Note that you need to rebuild also basicFlow, as it implements also the T2_PRI_HDRDESC switch. So safest is to rebuild all plugins + core.

$ t2conf tranalyzer2 -D T2_PRI_HDRDESC=0
$ t2build -R
...
$ t2 -r ~/data/802.1Q_tunneling.cap -w ~/results/
================================================================================
Tranalyzer 0.8.7 (Anteater), Tarantula. PID: 12276
================================================================================
[INF] Creating flows for L2, IPv4
Active plugins:
    01: basicFlow, 0.8.7
    02: macRecorder, 0.8.7
    03: basicStats, 0.8.7
    04: tcpStates, 0.8.7
    05: connStat, 0.8.7
    06: txtSink, 0.8.7
[INF] basicFlow: IPv4 Ver: 4, Rev: 01102019, Range Mode: 0, subnet ranges loaded: 312985 (312.99 K)
Processing file: /home/wurst/data/802.1Q_tunneling.cap
Link layer type: Ethernet [EN10MB/1]
Dump start: 1277840495.135052 sec (Tue 29 Jun 2010 19:41:35 GMT)
Dump stop : 1277840530.538713 sec (Tue 29 Jun 2010 19:42:10 GMT)
Total dump duration: 35.403661 sec
Finished processing. Elapsed time: 0.000128 sec
Finished unloading flow memory. Time: 0.000285 sec
Percentage completed: 100.00%
Number of processed packets: 26
Number of processed bytes: 4686 (4.69 K)
Number of raw bytes: 4686 (4.69 K)
Number of pcap bytes: 5126 (5.13 K)
Number of IPv4 packets: 20 [76.92%]
Number of A packets: 16 [61.54%]
Number of B packets: 10 [38.46%]
Number of A bytes: 3466 (3.47 K) [73.97%]
Number of B bytes: 1220 (1.22 K) [26.03%]
Average A packet load: 216.62
Average B packet load: 122.00
--------------------------------------------------------------------------------
basicStats: Biggest L2 Talker: 00:13:c3:df:ae:18: 1 [3.85%] packets
basicStats: Biggest L2 Talker: 00:13:c3:df:ae:18: 375 [8.00%] bytes
basicStats: Biggest L3 Talker: 10.118.10.1: 5 [19.23%] packets
basicStats: Biggest L3 Talker: 10.118.10.1: 610 [13.02%] bytes
connStat: Number of unique source IPs: 2
connStat: Number of unique destination IPs: 2
connStat: Number of unique source/destination IPs connections: 2
connStat: Max unique number of source IP / destination port connections: 2
connStat: IP prtcon/sdcon, prtcon/scon: 1.000000, 1.000000
connStat: Source IP with max connections: 10.118.10.1: 1 connections
connStat: Destination IP with max connections: 10.118.10.2: 1 connections
--------------------------------------------------------------------------------
Max VLAN header count: 2
Number of LLC packets: 6 [23.08%]
Number of ICMP packets: 20 [76.92%]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of processed   flows: 10
Number of processed A flows: 8 [80.00%]
Number of processed B flows: 2 [20.00%]
Number of request     flows: 8 [80.00%]
Number of reply       flows: 2 [20.00%]
Total   A/B    flow asymmetry: 0.60
Total req/rply flow asymmetry: 0.60
Number of processed   packets/flows: 2.60
Number of processed A packets/flows: 2.00
Number of processed B packets/flows: 5.00
Number of processed total packets/s: 0.73
Number of processed A+B packets/s: 0.73
Number of processed A   packets/s: 0.45
Number of processed   B packets/s: 0.28
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of average processed flows/s: 0.28
Average full raw bandwidth: 1059 b/s (1.06 Kb/s)
Average full bandwidth : 551 b/s
Max number of flows in memory: 10 [0.00%]
Memory usage: 0.13 GB [0.19%]
Aggregate flow status: 0x0000000000004104
[INF] IPv4
[INF] VLAN encapsulation
[INF] Ethernet flows
$

In the end report the header count with min, max, ave is gone. In the flow file the description of the headers is also gone, but you still have the flowStat bit encoding.

$ tcol ~/results/802.1Q_tunneling_flows.txt
%dir  flowInd  flowStat            timeFirst          timeLast           duration  srcMac             dstMac             ethType  ethVlanID  srcIP        srcIPCC  srcIPWho           srcPort  dstIP        dstIPCC  dstIPWho           dstPort  l4Proto  macPairs  srcMac_dstMac_numP                     srcManuf_dstManuf  numPktsSnt  numPktsRcvd  numBytesSnt  numBytesRcvd  minPktSz  maxPktSz  avePktSize  stdPktSize  minIAT  maxIAT    aveIAT     stdIAT        pktps     bytps     pktAsm  bytAsm  connSip  connDip  connSipDip  connSipDprt  connF
A     1        0x0000000000004100  1277840495.135052  1277840495.141708  0.006656  00:13:c3:df:ae:18  00:1b:d4:1b:a4:d8  0x0800   118;10     10.118.10.1  04       "Private network"  0        10.118.10.2  04       "Private network"  0        1        1         00:13:c3:df:ae:18_00:1b:d4:1b:a4:d8_5  Cisco_Cisco        5           5            360          360           72        72        72          0           0       0.00188   0.0013312  0.0004990491  751.2019  54086.54  0       0       1        1        2           2            2
B     1        0x0000000000004101  1277840495.135910  1277840495.142543  0.006633  00:1b:d4:1b:a4:d8  00:13:c3:df:ae:18  0x0800   118;10     10.118.10.2  04       "Private network"  0        10.118.10.1  04       "Private network"  0        1        1         00:1b:d4:1b:a4:d8_00:13:c3:df:ae:18_5  Cisco_Cisco        5           5            360          360           72        72        72          0           0       0.001721  0.0013266  0.0005040318  753.8067  54274.09  0       0       1        1        1           1            1
A     2        0x0000000000004100  1277840503.708352  1277840503.714432  0.006080  00:19:aa:7d:e6:88  00:21:55:c8:f1:3c  0x0800   209;20     10.209.20.3  04       "Private network"  0        10.209.20.4  04       "Private network"  0        1        1         00:19:aa:7d:e6:88_00:21:55:c8:f1:3c_5  Cisco_Cisco        5           5            360          360           72        72        72          0           0       0.001733  0.001216   0.0004763269  822.3684  59210.52  0       0       1        1        2           2            2
B     2        0x0000000000004101  1277840503.709181  1277840503.715133  0.005952  00:21:55:c8:f1:3c  00:19:aa:7d:e6:88  0x0800   209;20     10.209.20.4  04       "Private network"  0        10.209.20.3  04       "Private network"  0        1        1         00:21:55:c8:f1:3c_00:19:aa:7d:e6:88_5  Cisco_Cisco        5           5            360          360           72        72        72          0           0       0.001666  0.0011904  0.0004731365  840.0538  60483.87  0       0       1        1        1           1            1
A     3        0x0000000000000104  1277840510.969363  1277840510.969363  0.000000  00:13:c3:df:ae:18  01:00:0c:cd:cd:d0  0x2000   118        0.0.0.0      --       "--"               0        0.0.0.0      --       "--"               0        0        1         00:13:c3:df:ae:18_01:00:0c:cd:cd:d0_1  Cisco_             1           0            349          0             349       349       349         0           0       0         0          0             0         0         1       1       0        0        0           0            0
A     4        0x0000000000000104  1277840511.384783  1277840511.384783  0.000000  00:19:aa:7d:e6:88  01:00:0c:cd:cd:d0  0x2000   209        0.0.0.0      --       "--"               0        0.0.0.0      --       "--"               0        0        1         00:19:aa:7d:e6:88_01:00:0c:cd:cd:d0_1  Cisco_             1           0            347          0             347       347       347         0           0       0         0          0             0         0         1       1       0        0        0           0            0
A     5        0x0000000000000004  1277840525.369320  1277840525.369320  0.000000  00:0f:34:5f:16:8d  01:00:0c:cc:cc:cc  0x2000              0.0.0.0      --       "--"               0        0.0.0.0      --       "--"               0        0        1         00:0f:34:5f:16:8d_01:00:0c:cc:cc:cc_1  Cisco_             1           0            353          0             353       353       353         0           0       0         0          0             0         0         1       1       0        0        0           0            0
A     6        0x0000000000000004  1277840525.404193  1277840525.404193  0.000000  00:13:c4:12:0f:0d  01:00:0c:cc:cc:cc  0x2000              0.0.0.0      --       "--"               0        0.0.0.0      --       "--"               0        0        1         00:13:c4:12:0f:0d_01:00:0c:cc:cc:cc_1  Cisco_             1           0            353          0             353       353       353         0           0       0         0          0             0         0         1       1       0        0        0           0            0
A     7        0x0000000000000104  1277840528.106320  1277840528.106320  0.000000  00:1b:d4:1b:a4:d8  01:00:0c:cd:cd:d0  0x2000   118        0.0.0.0      --       "--"               0        0.0.0.0      --       "--"               0        0        1         00:1b:d4:1b:a4:d8_01:00:0c:cd:cd:d0_1  Cisco_             1           0            349          0             349       349       349         0           0       0         0          0             0         0         1       1       0        0        0           0            0
A     8        0x0000000000000104  1277840530.538713  1277840530.538713  0.000000  00:21:55:c8:f1:3c  01:00:0c:cd:cd:d0  0x2000   209        0.0.0.0      --       "--"               0        0.0.0.0      --       "--"               0        0        1         00:21:55:c8:f1:3c_01:00:0c:cd:cd:d0_1  Cisco_             1           0            347          0             347       347       347         0           0       0         0          0             0         0         1       1       0        0        0           0            0
$

Now switch on the header description but switch off the header aggregation, so unlike the default config now each header is printed, instead of an aggregated count.

$ t2conf tranalyzer2 -D T2_PRI_HDRDESC=1 -D T2_HDRDESC_AGGR=0
$ t2build -R
...
$ t2 -r ~/data/802.1Q_tunneling.cap -w ~/results/
...
--------------------------------------------------------------------------------
basicStats: Biggest L2 Talker: 00:13:c3:df:ae:18: 1 [3.85%] packets
basicStats: Biggest L2 Talker: 00:13:c3:df:ae:18: 375 [8.00%] bytes
basicStats: Biggest L3 Talker: 10.118.10.1: 5 [19.23%] packets
basicStats: Biggest L3 Talker: 10.118.10.1: 610 [13.02%] bytes
connStat: Number of unique source IPs: 2
connStat: Number of unique destination IPs: 2
connStat: Number of unique source/destination IPs connections: 2
connStat: Max unique number of source IP / destination port connections: 2
connStat: IP prtcon/sdcon, prtcon/scon: 1.000000, 1.000000
connStat: Source IP with max connections: 10.118.10.1: 1 connections
connStat: Destination IP with max connections: 10.118.10.2: 1 connections
--------------------------------------------------------------------------------
Headers count: min: 3, max: 5, average: 4.69
Max VLAN header count: 2
Number of LLC packets: 6 [23.08%]
Number of ICMP packets: 20 [76.92%]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
...
$

The headers count is back and note the vlan:vlan instead of vlan{2} in the flow file below.

$ tcol ~/results/802.1Q_tunneling_flows.txt
%dir  flowInd  flowStat            timeFirst          timeLast           duration  numHdrDesc  numHdrs  hdrDesc                  srcMac             dstMac             ethType  ethVlanID  srcIP        srcIPCC  srcIPWho           srcPort  dstIP        dstIPCC  dstIPWho           dstPort  l4Proto  macPairs  srcMac_dstMac_numP                     srcManuf_dstManuf  numPktsSnt  numPktsRcvd  numBytesSnt  numBytesRcvd  minPktSz  maxPktSz  avePktSize  stdPktSize  minIAT  maxIAT    aveIAT     stdIAT        pktps     bytps     pktAsm  bytAsm  connSip  connDip  connSipDip  connSipDprt  connF
A     1        0x0000000000004100  1277840495.135052  1277840495.141708  0.006656  1           5        eth:vlan:vlan:ipv4:icmp  00:13:c3:df:ae:18  00:1b:d4:1b:a4:d8  0x0800   118;10     10.118.10.1  04       "Private network"  0        10.118.10.2  04       "Private network"  0        1        1         00:13:c3:df:ae:18_00:1b:d4:1b:a4:d8_5  Cisco_Cisco        5           5            360          360           72        72        72          0           0       0.00188   0.0013312  0.0004990491  751.2019  54086.54  0       0       1        1        2           2            2
B     1        0x0000000000004101  1277840495.135910  1277840495.142543  0.006633  1           5        eth:vlan:vlan:ipv4:icmp  00:1b:d4:1b:a4:d8  00:13:c3:df:ae:18  0x0800   118;10     10.118.10.2  04       "Private network"  0        10.118.10.1  04       "Private network"  0        1        1         00:1b:d4:1b:a4:d8_00:13:c3:df:ae:18_5  Cisco_Cisco        5           5            360          360           72        72        72          0           0       0.001721  0.0013266  0.0005040318  753.8067  54274.09  0       0       1        1        1           1            1
A     2        0x0000000000004100  1277840503.708352  1277840503.714432  0.006080  1           5        eth:vlan:vlan:ipv4:icmp  00:19:aa:7d:e6:88  00:21:55:c8:f1:3c  0x0800   209;20     10.209.20.3  04       "Private network"  0        10.209.20.4  04       "Private network"  0        1        1         00:19:aa:7d:e6:88_00:21:55:c8:f1:3c_5  Cisco_Cisco        5           5            360          360           72        72        72          0           0       0.001733  0.001216   0.0004763269  822.3684  59210.52  0       0       1        1        2           2            2
B     2        0x0000000000004101  1277840503.709181  1277840503.715133  0.005952  1           5        eth:vlan:vlan:ipv4:icmp  00:21:55:c8:f1:3c  00:19:aa:7d:e6:88  0x0800   209;20     10.209.20.4  04       "Private network"  0        10.209.20.3  04       "Private network"  0        1        1         00:21:55:c8:f1:3c_00:19:aa:7d:e6:88_5  Cisco_Cisco        5           5            360          360           72        72        72          0           0       0.001666  0.0011904  0.0004731365  840.0538  60483.87  0       0       1        1        1           1            1
A     3        0x0000000000000104  1277840510.969363  1277840510.969363  0.000000  1           4        eth:vlan:llc:cdp         00:13:c3:df:ae:18  01:00:0c:cd:cd:d0  0x2000   118        0.0.0.0      --       "--"               0        0.0.0.0      --       "--"               0        0        1         00:13:c3:df:ae:18_01:00:0c:cd:cd:d0_1  Cisco_             1           0            349          0             349       349       349         0           0       0         0          0             0         0         1       1       0        0        0           0            0
A     4        0x0000000000000104  1277840511.384783  1277840511.384783  0.000000  1           4        eth:vlan:llc:cdp         00:19:aa:7d:e6:88  01:00:0c:cd:cd:d0  0x2000   209        0.0.0.0      --       "--"               0        0.0.0.0      --       "--"               0        0        1         00:19:aa:7d:e6:88_01:00:0c:cd:cd:d0_1  Cisco_             1           0            347          0             347       347       347         0           0       0         0          0             0         0         1       1       0        0        0           0            0
A     5        0x0000000000000004  1277840525.369320  1277840525.369320  0.000000  1           3        eth:llc:cdp              00:0f:34:5f:16:8d  01:00:0c:cc:cc:cc  0x2000              0.0.0.0      --       "--"               0        0.0.0.0      --       "--"               0        0        1         00:0f:34:5f:16:8d_01:00:0c:cc:cc:cc_1  Cisco_             1           0            353          0             353       353       353         0           0       0         0          0             0         0         1       1       0        0        0           0            0
A     6        0x0000000000000004  1277840525.404193  1277840525.404193  0.000000  1           3        eth:llc:cdp              00:13:c4:12:0f:0d  01:00:0c:cc:cc:cc  0x2000              0.0.0.0      --       "--"               0        0.0.0.0      --       "--"               0        0        1         00:13:c4:12:0f:0d_01:00:0c:cc:cc:cc_1  Cisco_             1           0            353          0             353       353       353         0           0       0         0          0             0         0         1       1       0        0        0           0            0
A     7        0x0000000000000104  1277840528.106320  1277840528.106320  0.000000  1           4        eth:vlan:llc:cdp         00:1b:d4:1b:a4:d8  01:00:0c:cd:cd:d0  0x2000   118        0.0.0.0      --       "--"               0        0.0.0.0      --       "--"               0        0        1         00:1b:d4:1b:a4:d8_01:00:0c:cd:cd:d0_1  Cisco_             1           0            349          0             349       349       349         0           0       0         0          0             0         0         1       1       0        0        0           0            0
A     8        0x0000000000000104  1277840530.538713  1277840530.538713  0.000000  1           4        eth:vlan:llc:cdp         00:21:55:c8:f1:3c  01:00:0c:cd:cd:d0  0x2000   209        0.0.0.0      --       "--"               0        0.0.0.0      --       "--"               0        0        1         00:21:55:c8:f1:3c_01:00:0c:cd:cd:d0_1  Cisco_             1           0            347          0             347       347       347         0           0       0         0          0             0         0         1       1       0        0        0           0            0
$

Play around a bit with the different modes applied to other pcaps and do not forget to reset the core for the other tutorials to the default mode and recompile the loaded plugins, as they also implement the IPV6__ACTIVATE and ETH_ACTIVATE constant.

$ t2conf tranalyzer2 -D IPV6_ACTIVATE=2 -D ETH_ACTIVATE=1 -D T2_PRI_HDRDESC=1 -D T2_HDRDESC_AGGR=1
$ t2build -R
...
$

Have fun!