| Lower layer | Selector | Value |
|---|
ethernet2 | ethertype | 35045 (0x88e5) |
dot1q | ethertype | 35045 (0x88e5) |
| Field | Type | Default | Auto | Description |
|---|
v | uint(1) | 0 | | TCI V bit: version (0). |
es | uint(1) | 0 | | TCI ES bit: End Station (the SCI is the source MAC address with port 1). |
sc | uint(1) | | Number of items of sci | TCI SC bit: an explicit SCI is present (Auto: set when the SCI is given). |
scb | uint(1) | 0 | | TCI SCB bit: EPON single copy broadcast. |
e | uint(1) | 1 | | TCI E bit: the secure data is encrypted. |
c | uint(1) | 1 | | TCI C bit: the user data was changed (always with E for the default cipher suites). |
an | uint(2) | 0 | | Association number (0-3): the secure association within the channel. |
reserved | uint(2) | 0 | | |
sl | uint(6) | 0 | | Short length: the secure data length when it is below 48 octets, otherwise 0 (Manual). |
pn | uint(32) | 1 | | Packet number (32 bits, the low half with XPN). |
sci | list<struct> — sc items | 1 items | | Secure Channel Identifier: system identifier (MAC address) and port identifier; present when SC is set. |
secure_data | bytes — rest of the PDU except its last 16 octets | 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f | | Secure data: the encrypted (or integrity-only) user data as opaque octets; nothing is encrypted. |
icv | bytes(16) | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | | Integrity Check Value (16 octets), opaque: it is not computed. |
Each item is a group of the fields below.
| Field | Type | Default | Auto | Description |
|---|
system_identifier | mac | 02:00:00:00:00:01 | | |
port_identifier | uint(16) | 1 | | |
| Level | Rule |
|---|
| warning | v = 0 |
| warning | pn ≠ 0 |
- macsec —
templates/protocols/l2/macsec.wpg.yaml