Layer 2 Switching, VLAN Trunking & Data-Link Protocols Reference (ARP, VLAN, QINQ, LLDP, STP, LACP, EAPOL, MPLS)

Testing Layer 2 edge cases—double-tagged 802.1ad QinQ trunks, Gratuitous ARP (GARP) VIP failovers, STP BPDU Guard triggers, LACP port-channel negotiations, 802.1X EAPOL NAC onboarding, or MPLS label stacks—is normally a headache because OS network stacks strip VLAN tags and physical lab switches take time to cable and configure.

With FrameAssembly, you write the Layer 2 or Layer 2.5 frame in a few lines of .fasm code, compile it to .pcap (frameassembly l2_test.fasm), and replay it onto a trunk port with tcpreplay—or convert an existing .pcap / .pcapng switch trace into .fasm code with frameassembly reverse trace.pcap. When optional fields are omitted, FrameAssembly automatically builds Ethernet II or IEEE 802.3 LLC headers, derives unicast, broadcast, and multicast MAC addresses, and populates mandatory protocol TLVs.

MAC-Only Layer 2 Hosts & Inline compile Statements

All 8 Layer 2 protocols (ARP, VLAN, QINQ, LLDP, STP, LACP, EAPOL, MPLS) support MAC-only host blocks (host sw1 { mac 00:1c:73:00:00:01 }) without requiring an ip address, and you can write packet statements directly inside compile { ... } without a separate flow block:

1host sw1 { mac 00:1c:73:00:00:01 }
2host sw2 { mac 00:1c:73:00:00:02 }
3
4compile {
5    sw1 -> sw2 lldp chassis_id "00:1c:73:00:00:01" port_id "Ethernet1/1" ttl 120 sysname "spine-01" wait 2ms
6    sw1 <- sw2 stp rstp root_id "4096/00:1c:73:00:00:02" bridge_id "4096/00:1c:73:00:00:02" port_id 0x8001 cost 0 flags 0x3c wait 2ms
7    sw1 -> sw2 lacp actor_sys 00:1c:73:00:00:01 actor_key 10 actor_port 1 actor_state 0x3f partner_sys 00:1c:73:00:00:02 partner_key 10 partner_port 1 partner_state 0x3f
8}

Universal Ethernet II Header Overrides & Automatic MAC Derivation

Every statement in FrameAssembly—whether it is a raw Layer 2 frame (ARP, LLDP, STP) or a Layer 7 application packet (HTTP, DNS, SNMP3, MODBUS)—is wrapped in an outer Ethernet frame. You can override the outer Ethernet header on any statement using three universal modifiers:

How FrameAssembly Automatically Derives MAC Addresses

When you omit SRCMAC, DSTMAC, or the optional MAC field in a HOST declaration, FrameAssembly selects the wire MAC address using the following priority order:

Why Direction-Aware Unicast Fallback Matters: When replaying a .pcap through a physical or virtual switch with tcpreplay, forward (->) and reverse (<-) packets automatically swap 00:00:00:00:00:01 and 00:00:00:00:00:02 even if you never typed a mac address in your host blocks. This prevents switch MAC-table flapping alerts.

1host sensor_a { ip 10.10.1.10 mac 00:1b:21:aa:bb:01 }
2host sensor_b { ip 10.10.1.20 mac 00:1b:21:aa:bb:02 }
3
4flow custom_ethernet_framing(a, b) {
5    // Standard unicast UDP frame using the MACs declared in the host blocks
6    a -> b udp srcport 40000 dstport 40000 payload "NORMAL_UNICAST" wait 1ms
7
8    // Spoofed source MAC, broadcast destination MAC, and custom EtherType (0x88B5 IEEE Local Experimental)
9    a -> b udp srcport 40000 dstport 40000 srcmac de:ad:be:ef:00:01 dstmac ff:ff:ff:ff:ff:ff ethertype 0x88b5 payload "CUSTOM_L2_ETHERTYPE"
10}
11
12compile {
13    custom_ethernet_framing(sensor_a, sensor_b)
14}

1. Address Resolution Protocol (ARP — RFC 826 / RFC 5227)

ARP resolves IPv4 addresses (0x0800) to 48-bit Ethernet hardware addresses (EtherType 0x0806). Network administrators use ARP captures to validate default gateway resolution, test Dynamic ARP Inspection (DAI) on access switches, simulate Gratuitous ARP (GARP) VIP failovers for HA firewalls/load balancers, and test RFC 5227 Duplicate Address Detection (DAD) probes.

Default Wire Behavior & Dual-Stack IPv6 Adaptation

• IPv4 Hosts (EtherType 0x0806): Builds a 28-byte ARP header (HTYPE = 1 Ethernet, PTYPE = 0x0800 IPv4, HLEN = 6, PLEN = 4).
• ARP REQUEST (default): Sets Opcode 1, outer Ethernet Destination MAC to broadcast (ff:ff:ff:ff:ff:ff), and Target Hardware Address (THA) to 00:00:00:00:00:00.
• ARP REPLY: Sets Opcode 2, outer Ethernet Destination MAC to the target host's unicast MAC, and THA to the target host's MAC.
• GRATUITOUS (or GARP): Sets Target Protocol Address (TPA) equal to Sender Protocol Address (SPA) and zeroes THA (00:00:00:00:00:00).
• IPv6 Hosts (EtherType 0x86DD, RFC 4861 Automatic Dual-Stack IPv6 Adaptation): If you run an ARP flow with IPv6 hosts inside compile { ... }, FrameAssembly automatically translates the statements into RFC 4861 ICMPv6 Neighbor Discovery packets with Hop Limit 255:
• ARP REQUEST becomes an ICMPv6 Neighbor Solicitation (Type 135, Option 1 Source Link-Layer Address) sent to the target's Solicited-Node multicast address (ff02::1:ffxx:xxxx) and Ethernet MAC (33:33:ff:xx:xx:xx).
• ARP REPLY becomes an ICMPv6 Neighbor Advertisement (Type 136, Solicited + Override flags 0x60, Option 2 Target Link-Layer Address).

ARP Modifiers

Example 1A: Gateway ARP Resolution, RFC 5227 Probe & HA VIP Failover (GARP)

1host workstation { ip 192.168.10.55  mac 00:50:56:a1:10:55 }
2host fw_active   { ip 192.168.10.1   mac 00:50:56:fe:00:01 }
3host fw_standby  { ip 192.168.10.2   mac 00:50:56:fe:00:02 }
4host lan_bcast   { ip 192.168.10.255 mac ff:ff:ff:ff:ff:ff }
5
6flow arp_resolution_and_vip_failover(client, pri, sec, bcast) {
7    // 1. Standard broadcast ARP Request from workstation asking "Who has 192.168.10.1?"
8    client -> pri arp request dstmac ff:ff:ff:ff:ff:ff tha 00:00:00:00:00:00 wait 1ms
9
10    // 2. Unicast ARP Reply from the active firewall
11    client <- pri arp reply wait 5ms
12
13    // 3. RFC 5227 Duplicate Address Detection (ARP Probe with Sender IP 0.0.0.0)
14    client -> bcast arp request sendermac 00:50:56:a1:10:55 senderip 0.0.0.0 targetmac 00:00:00:00:00:00 targetip 192.168.10.55 wait 2ms
15
16    // 4. Standby firewall takes over the 192.168.10.1 VIP and broadcasts a Gratuitous ARP
17    sec -> bcast arp reply gratuitous sendermac 00:50:56:fe:00:02 senderip 192.168.10.1 targetmac ff:ff:ff:ff:ff:ff targetip 192.168.10.1
18}
19
20compile {
21    arp_resolution_and_vip_failover(workstation, fw_active, fw_standby, lan_bcast)
22}

Example 1B: Dual-Stack ARP Flow Over Both IPv4 and IPv6

1host app_v4 { ip 10.20.0.10       mac 00:16:3e:10:00:10 }
2host gw_v4  { ip 10.20.0.1        mac 00:16:3e:10:00:01 }
3host app_v6 { ip 2001:db8:20::10  mac 00:16:3e:60:00:10 }
4host gw_v6  { ip 2001:db8:20::1   mac 00:16:3e:60:00:01 }
5
6flow neighbor_lookup(host_ep, router_ep) {
7    host_ep -> router_ep arp request wait 1ms
8    host_ep <- router_ep arp reply
9}
10
11compile {
12    // Emits RFC 826 ARP Request + Reply (EtherType 0x0806)
13    neighbor_lookup(app_v4, gw_v4)
14    // Automatically emits RFC 4861 ICMPv6 Neighbor Solicitation + Advertisement (Hop Limit 255)
15    neighbor_lookup(app_v6, gw_v6)
16}

Inspect with tshark:

$ frameassembly arp_test.fasm
$ tshark -r arp_test.pcap -Y "arp or icmpv6" -T fields -e frame.number -e eth.src -e eth.dst -e arp.opcode -e arp.src.proto_ipv4 -e arp.dst.proto_ipv4

2. Virtual LAN (VLAN — IEEE 802.1Q) & Provider Bridging (QINQ — IEEE 802.1ad)

Both VLAN and QINQ work in two ways:

1. Cross-Layer Encapsulation Modifiers: Add vlan <vid> [pcp <0..7>] [dei <0..1>] or qinq <outer_svid> inner_vlan <inner_cvid> [pcp <0..7>] [dei <0..1>] to any statement (ARP, STP, OSPF, BGP, TCP, UDP, HTTP, SIP, MODBUS, etc.) to insert 802.1Q or 802.1ad tags ahead of the inner packet.
2. Standalone Layer 2 Statements: Write a -> b vlan 100 or a -> b qinq 2000 inner_vlan 100 with no upper-layer protocol keyword to emit a tagged Ethernet frame (wrapping a valid inner IP+UDP packet by default, or raw bytes if payload / hexpayload is provided).

VLAN & QINQ Modifiers

Important Syntax Rules:

Valid VLAN Range (1..4094):* IEEE 802.1Q reserves VLAN 0 (priority-tagged frame) and 4095 (0xFFF implementation reserved). FrameAssembly rejects vlan 0 or vlan 4095 with a clear validation error pointing to the invalid VLAN ID.

Double-Tagging Rule:* For IEEE 802.1ad double-tagged frames, always write qinq <outer_svid> inner_vlan <inner_cvid>. Do not combine qinq and vlan on the same statement.

IEEE 802.1p Class of Service (PCP) Reference Table

Example 2A: Enterprise 802.1Q Trunk with Multi-CoS Traffic (PCP & DEI)

1host tor_sw_a { ip 172.16.10.1 mac 00:1c:73:10:00:01 }
2host tor_sw_b { ip 172.16.10.2 mac 00:1c:73:10:00:02 }
3
4flow enterprise_8021q_trunk(a, b) {
5    // VLAN 10: High-priority VoIP RTP audio (PCP 5 = Voice, DSCP 46 = EF)
6    a -> b vlan 10 pcp 5 dei 0 dscp 46 rtp seq 101 timestamp 16000 ssrc 0x11223344 payload "G711_PCMU_FRAME" wait 1ms
7
8    // VLAN 20: RoCEv2 lossless storage queue (PCP 3, DSCP 26 = AF31)
9    a -> b vlan 20 pcp 3 dei 0 dscp 26 udp srcport 51000 dstport 4791 payload "RDMA_WRITE_ONLY" wait 1ms
10
11    // VLAN 99: Scavenger backup traffic marked Drop-Eligible (PCP 1, DEI 1, DSCP 8 = CS1)
12    a -> b vlan 99 pcp 1 dei 1 dscp 8 tcp psh ack srcport 49152 dstport 873 payload "RSYNC_SNAPSHOT_CHUNK"
13}
14
15compile {
16    enterprise_8021q_trunk(tor_sw_a, tor_sw_b)
17}

Example 2B: Carrier IEEE 802.1ad QINQ Metro Ethernet Handoff

1host cpe_site_a { ip 10.100.40.1 mac 00:50:56:ce:40:01 }
2host cpe_site_b { ip 10.100.40.2 mac 00:50:56:ce:40:02 }
3
4flow metro_qinq_handoff(a, b) {
5    // Carrier S-VLAN 2500 (0x88A8) + Customer C-VLAN 40 (0x8100) carrying eBGP control plane (PCP 6)
6    a -> b qinq 2500 inner_vlan 40 pcp 6 dscp 48 tcp syn srcport 53000 dstport 179 wait 1ms
7    a <- b qinq 2500 inner_vlan 40 pcp 6 dscp 48 tcp syn ack wait 1ms
8    a -> b qinq 2500 inner_vlan 40 pcp 6 dscp 48 tcp ack wait 1ms
9    a -> b qinq 2500 inner_vlan 40 pcp 6 dscp 48 bgp open asn 65100 holdtime 90 bgpid 10.100.40.1 wait 2ms
10    a <- b qinq 2500 inner_vlan 40 pcp 6 dscp 48 bgp open asn 65200 holdtime 90 bgpid 10.100.40.2
11}
12
13compile {
14    metro_qinq_handoff(cpe_site_a, cpe_site_b)
15}

Inspect with tshark:

$ frameassembly trunk_test.fasm
$ tshark -r trunk_test.pcap -T fields -e frame.number -e eth.type -e vlan.id -e vlan.prio -e vlan.dei -e ip.src -e ip.dst

3. Link Layer Discovery Protocol (LLDP — IEEE 802.1AB)

Tracking down miscabled leaf-spine ports or testing how an inventory daemon (lldpd, NetBox, or a VoIP phone provisioning script) parses neighbor discovery frames normally requires live switches on the other end of the patch cord. With LLDP, you can script switch, router, and hypervisor advertisements—including chassis identity, port names, hold times, system hostnames, software banners, and TTL 0 port-shutdown withdrawals—directly in .fasm code.

Default Wire Behavior

• Framing: Ethernet II (EtherType = 0x88CC) addressed to the IEEE 802.1D Nearest Bridge non-TPMR multicast MAC 01:80:c2:00:00:0e.
• Mandatory TLVs (Always Emitted):

1. Chassis ID (TLV Type 1): Subtype 4 (MAC address). Defaults to the sending host's 6-byte MAC address if CHASSIS_ID is omitted, or encodes your custom string if specified.
2. Port ID (TLV Type 2): Subtype 5 (Interface Name). Defaults to "eth0" if PORT_ID is omitted.
3. Time To Live (TLV Type 3): 16-bit hold time in seconds. Defaults to 120 seconds if TTL is omitted.

• Optional TLVs & End Marker: Emits System Name (TLV Type 5) when SYSNAME is specified, System Description (TLV Type 6) when SYSDESC is specified, appends any custom PAYLOAD / HEXPAYLOAD bytes (such as IEEE 802.1 / 802.3 Organizationally Specific TLVs of Type 127), and terminates with the mandatory End Of LLDPDU (TLV Type 0, Length 0) marker.

LLDP Modifiers

Example: Leaf-Spine Data Center & Hypervisor LLDP Exchange

1host spine_01 { ip 10.255.0.1  mac 00:1c:73:a0:01:01 }
2host leaf_01  { ip 10.255.0.11 mac 00:1c:73:b0:11:49 }
3
4flow dc_lldp_discovery(spine, leaf) {
5    // Spine switch advertising 400G uplink port
6    spine -> leaf lldp chassis_id "00:1c:73:a0:01:01" port_id "Ethernet1/1" ttl 120 sysname "spine-01.dc1.example.net" sysdesc "Arista EOS 4.32.1F 7060X5" wait 5ms
7
8    // Leaf switch replying with Management/PVID Org-Specific TLV (Type 127, Len 6, OUI 00-80-C2, Subtype 1, VLAN 100)
9    spine <- leaf lldp chassis_id "00:1c:73:b0:11:49" port_id "Ethernet49/1" ttl 120 sysname "leaf-01.dc1.example.net" sysdesc "SONiC OS 202511 ToR" hexpayload "fe060080c2010064" wait 5ms
10
11    // Port administrative shutdown: TTL 0 instructs neighbor to age out entry immediately
12    spine <- leaf lldp chassis_id "00:1c:73:b0:11:49" port_id "Ethernet49/1" ttl 0
13}
14
15compile {
16    dc_lldp_discovery(spine_01, leaf_01)
17}

Inspect with tshark:

$ frameassembly lldp_test.fasm
$ tshark -r lldp_test.pcap -Y "lldp" -V

4. Spanning Tree Protocol (STP / RSTP — IEEE 802.1D / 802.1w)

STP emits classic IEEE 802.1D Configuration BPDUs or IEEE 802.1w Rapid Spanning Tree (RSTP) BPDUs. Use STP to validate Root Bridge elections, test RSTP Proposal/Agreement rapid convergence, or verify that access ports configured with BPDU Guard (spanning-tree bpduguard enable) or Root Guard immediately err-disable when a rogue switch injects a superior BPDU.

Default Wire Behavior

• Framing: IEEE 802.3 length-framed Ethernet addressed to the Bridge Group multicast MAC 01:80:c2:00:00:00, carrying a 3-byte IEEE 802.2 LLC header (DSAP = 0x42, SSAP = 0x42, Control = 0x03).
• BPDU Packet Format:
• Without RSTP: 35-byte IEEE 802.1D Configuration BPDU (Protocol ID = 0x0000, Version = 0, BPDU Type = 0x00).
• With RSTP: 36-byte IEEE 802.1w Rapid Spanning Tree BPDU (Protocol ID = 0x0000, Version = 2, BPDU Type = 0x02, plus trailing Version 1 Length = 0x00).
• Timers (MAX_AGE, HELLO_TIME, FORWARD_DELAY) are automatically scaled into IEEE 802.1D 1/256-second wire units (seconds << 8).

STP Modifiers

Syntax Note: Always include the underscore in ROOT_ID and BRIDGE_ID. Both fields accept "<priority>/<mac>" (such as "4096/00:1c:73:00:00:01" or "0x1000/00:1c:73:00:00:01"), a bare MAC address string ("00:1c:73:00:00:01" with default priority 32768), or a 16-character hex string.

STP / RSTP FLAGS Bitmask Reference

Example: RSTP Proposal/Agreement & Rogue Superior BPDU Test

1host core_root  { ip 10.0.1.1  mac 00:1c:73:00:00:01 }
2host dist_sw    { ip 10.0.1.2  mac 00:1c:73:00:00:02 }
3host rogue_sw   { ip 10.0.1.99 mac 00:e0:4c:99:99:99 }
4
5flow rstp_convergence_and_bpduguard(root, dist, rogue) {
6    // 1. Root bridge (Priority 4096) sends RSTP Proposal (0x0e = Proposal + Designated Role)
7    root -> dist stp rstp root_id "4096/00:1c:73:00:00:01" bridge_id "4096/00:1c:73:00:00:01" port_id 0x8001 cost 0 max_age 20 hello_time 2 forward_delay 15 flags 0x0e wait 2ms
8
9    // 2. Distribution switch (Priority 32768) replies with RSTP Agreement (0x7c = Agreement + Fwd + Learn + Root Role)
10    root <- dist stp rstp root_id "4096/00:1c:73:00:00:01" bridge_id "32768/00:1c:73:00:00:02" port_id 0x8001 cost 2000 max_age 20 hello_time 2 forward_delay 15 flags 0x7c wait 5ms
11
12    // 3. Steady-state Designated Forwarding BPDU (0x3c)
13    root -> dist stp rstp root_id "4096/00:1c:73:00:00:01" bridge_id "4096/00:1c:73:00:00:01" port_id 0x8001 cost 0 max_age 20 hello_time 2 forward_delay 15 flags 0x3c wait 5ms
14
15    // 4. Rogue switch on an access port injects a Priority 0 Superior BPDU (triggers Root Guard / BPDU Guard)
16    rogue -> dist stp rstp root_id "0/00:e0:4c:99:99:99" bridge_id "0/00:e0:4c:99:99:99" port_id 0x8001 cost 0 flags 0x3c
17}
18
19compile {
20    rstp_convergence_and_bpduguard(core_root, dist_sw, rogue_sw)
21}

5. Link Aggregation Control Protocol (LACP — IEEE 802.3ad / 802.1AX)

Anyone who has stared at a switch port stuck in Individual or Suspended state knows that debugging IEEE 802.3ad Link Aggregation (LAG / Cisco & Arista Port-Channel / Linux bond0 mode 4) comes down to the 8-bit Actor and Partner state flags. FrameAssembly builds complete 110-byte LACPDUs over Ethernet Slow Protocols (EtherType = 0x8809, destination MAC 01:80:c2:00:00:02)—including Actor (Type 1, Length 20), Partner (Type 2, Length 20), Collector (Type 3, Length 16), and Terminator (Type 0, Length 0) TLVs plus the mandatory 50-byte IEEE 802.3ad zero pad—so you can replay exact bundle bring-up and timeout sequences without a second switch.

LACP Modifiers

LACP State Byte (ACTOR_STATE / PARTNER_STATE) Bitmask Breakdown

Common Operational Hex Combinations:

• 0x47 (0x01 + 0x02 + 0x04 + 0x40): Initial Unbundled Port — Active, Short Timeout, Aggregatable, Defaulted (partner unknown).
• 0x3d (0x01 + 0x04 + 0x08 + 0x10 + 0x20): Healthy Slow-Timer Bundle (Default) — Active, Long Timeout (30s), Aggregatable, In Sync, Collecting, Distributing.
• 0x3f (0x01 + 0x02 + 0x04 + 0x08 + 0x10 + 0x20): Healthy Fast-Timer Bundle — Active, Short Timeout (1s), Aggregatable, In Sync, Collecting, Distributing.

Example: LACP Port-Channel Bring-Up (Defaulted to In-Sync Collecting/Distributing)

1host tor_sw   { ip 10.0.2.1 mac 00:1c:73:11:22:33 }
2host linux_hv { ip 10.0.2.2 mac 00:50:56:88:99:aa }
3
4flow lacp_bond_negotiation(sw, hv) {
5    // 1. Switch port comes up unbundled (0x47 = Active/Short/Agg/Defaulted) with zeroed Partner info
6    sw -> hv lacp actor_sys 00:1c:73:11:22:33 actor_key 10 actor_port 1 actor_state 0x47 partner_sys 00:00:00:00:00:00 partner_key 0 partner_port 0 partner_state 0x00 wait 2ms
7
8    // 2. Linux bond0 replies acknowledging the switch's System MAC/Key/Port and advertising In-Sync (0x0f)
9    sw <- hv lacp actor_sys 00:50:56:88:99:aa actor_key 10 actor_port 1 actor_state 0x0f partner_sys 00:1c:73:11:22:33 partner_key 10 partner_port 1 partner_state 0x07 wait 2ms
10
11    // 3. Both sides transition to full Collecting + Distributing (0x3f = Active/Short/Agg/Sync/Col/Dist)
12    sw -> hv lacp actor_sys 00:1c:73:11:22:33 actor_key 10 actor_port 1 actor_state 0x3f partner_sys 00:50:56:88:99:aa partner_key 10 partner_port 1 partner_state 0x3f wait 2ms
13    sw <- hv lacp actor_sys 00:50:56:88:99:aa actor_key 10 actor_port 1 actor_state 0x3f partner_sys 00:1c:73:11:22:33 partner_key 10 partner_port 1 partner_state 0x3f
14}
15
16compile {
17    lacp_bond_negotiation(tor_sw, linux_hv)
18}

6. IEEE 802.1X Port-Based Network Access Control (EAPOL — IEEE 802.1X / RFC 3748)

Testing campus 802.1X Network Access Control (NAC) policies or debugging why an IoT supplicant failed EAP-TLS onboarding usually means wrestling with wpa_supplicant certificates and a live RADIUS/ISE lab. FrameAssembly lets you script the entire EAPOL conversation (EtherType = 0x888E, destination MAC 01:80:c2:00:00:03) between the Supplicant (client workstation or IoT endpoint) and the Authenticator (campus switch port or wireless AP)—from EAPOL-Start and Identity requests through EAP-TLS challenges, EAP-Success, and EAPOL-Logoff.

Default Wire Behavior

• 4-Byte EAPOL Header: Protocol Version (default 1), Packet Type (0 = EAP_PACKET, 1 = START, 2 = LOGOFF, 3 = KEY), and 16-bit Body Length.
• Nested RFC 3748 EAP Frame (when EAP_PACKET is selected):
• For EAP_CODE 1 (Request) and EAP_CODE 2 (Response): Emits Code (1B) | Identifier (1B) | Length (2B) | Method/Type (1B) followed by IDENTITY string bytes and any PAYLOAD / HEXPAYLOAD.
• For EAP_CODE 3 (Success) and EAP_CODE 4 (Failure) with no payload: Emits a strict 4-byte RFC 3748 §4.2 packet (Code | Identifier | Length = 0x0004) with no Method field.

EAPOL Modifiers

Example: Complete 802.1X Supplicant Onboarding, EAP-TLS & Logoff

1host workstation { ip 10.50.10.25 mac 00:24:d7:11:22:33 }
2host campus_sw   { ip 10.50.10.1  mac 00:1c:73:80:21:10 }
3
4flow dot1x_port_authentication(supp, auth_sw) {
5    // 1. Supplicant sends EAPOL-Start to 01:80:c2:00:00:03
6    supp -> auth_sw eapol version 2 type start wait 2ms
7
8    // 2. Switch requests EAP Identity (Code 1 = Request, Method 1 = Identity)
9    supp <- auth_sw eapol version 2 type eap_packet eap_code 1 eap_id 1 eap_method 1 wait 2ms
10
11    // 3. Supplicant responds with machine certificate identity (Code 2 = Response, Method 1 = Identity)
12    supp -> auth_sw eapol version 2 type eap_packet eap_code 2 eap_id 1 eap_method 1 identity "host/wkstn-25.corp.internal" wait 5ms
13
14    // 4. Switch initiates EAP-TLS (Method 13) challenge and Supplicant replies with TLS ClientHello fragment
15    supp <- auth_sw eapol version 2 type eap_packet eap_code 1 eap_id 2 eap_method 13 hexpayload "20" wait 2ms
16    supp -> auth_sw eapol version 2 type eap_packet eap_code 2 eap_id 2 eap_method 13 payload "EAP_TLS_CLIENT_CERT_VERIFY" wait 5ms
17
18    // 5. Switch sends 4-byte EAP-Success (Code 3) and EAPOL-Key descriptor
19    supp <- auth_sw eapol version 2 type eap_packet eap_code 3 eap_id 2 wait 2ms
20    supp <- auth_sw eapol version 2 type key hexpayload "02008a00100000000000000001" wait 10ms
21
22    // 6. Supplicant disconnects cleanly with EAPOL-Logoff
23    supp -> auth_sw eapol version 2 type logoff
24}
25
26compile {
27    dot1x_port_authentication(workstation, campus_sw)
28}

7. Multiprotocol Label Switching (MPLS — RFC 3032 / RFC 5462)

Capturing real MPLS L3VPN or Segment Routing (SR-MPLS) packets normally requires a multi-router provider-edge (PE) lab with BGP label distribution and full core routing configured just to put a 4-byte shim header on the wire. In FrameAssembly, adding an MPLS label (EtherType = 0x8847)—complete with 20-bit Label ID, 3-bit QoS Traffic Class (EXP/TC), Bottom-of-Stack (BOS) bit, and independent MPLS_TTL—takes a single modifier on any packet statement:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                Label                  | EXP |S|       TTL     |
|               (20 bits)               |(3b) |1|    (8 bits)   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Like VLAN, MPLS can be used both as a standalone statement (a -> b mpls 16001) and as a cross-layer modifier wrapping any L3/L4/L7 protocol (ICMP, OSPF, BGP, TCP, UDP, HTTP, SNMP3, etc.), optionally combined with outer VLAN or QINQ tags.

MPLS Modifiers & Reserved Labels

Example: Service Provider MPLS L3VPN & VLAN-Subinterface Forwarding

1host pe_west { ip 10.100.1.1 mac 00:1c:73:ce:00:01 }
2host pe_east { ip 10.100.1.2 mac 00:1c:73:ce:00:02 }
3
4flow mpls_l3vpn_and_sr_forwarding(west, east) {
5    // 1. MPLS-labeled ICMPv4 echo across an L3VPN (Label 24010, EXP/TC 5 for Voice/EF, MPLS TTL 64, Inner IP TTL 63)
6    west -> east mpls 24010 exp 5 bos 1 mpls_ttl 64 ttl 63 dscp 46 icmp echo_request id 501 seq 1 payload "L3VPN_PING" wait 1ms
7    west <- east mpls 24020 tc 5 bos 1 mpls_ttl 63 ttl 62 dscp 46 icmp echo_reply id 501 seq 1 payload "L3VPN_PONG" wait 2ms
8
9    // 2. 802.1Q VLAN 400 subinterface carrying an SR-MPLS labeled HTTPS flow
10    west -> east vlan 400 pcp 5 mpls 16005 exp 5 bos 1 mpls_ttl 255 tcp syn srcport 51200 dstport 443 wait 1ms
11    west <- east vlan 400 pcp 5 mpls 16001 exp 5 bos 1 mpls_ttl 254 tcp syn ack
12}
13
14compile {
15    mpls_l3vpn_and_sr_forwarding(pe_west, pe_east)
16}

Inspect with tshark:

$ frameassembly mpls_test.fasm
$ tshark -r mpls_test.pcap -Y "mpls" -T fields -e frame.number -e vlan.id -e mpls.label -e mpls.exp -e mpls.bottom -e mpls.ttl -e ip.ttl

Related Documentation

• Getting Started Guide (getting_started.md) — .fasm file anatomy, automatic defaults vs. explicit overrides, and step-by-step Wireshark workflows.
• Practical Use-Case Cookbook (use_cases.md) — End-to-end recipes for VLAN/QinQ/MPLS/QoS verification, firewall ACL testing, and network troubleshooting.
• Layer 3 Control, Tunneling, VPN & Routing Protocols (l3_protocols.md) — Universal IPv4/IPv6 headers (TTL, DSCP, ECN, FLOWLABEL, DF, MF), ICMP, NDP, IGMP, MLD, GRE, VXLAN, GENEVE, IKEV2, IPSEC/ESP/AH, WIREGUARD, OSPF, BGP, RIP, PIM, VRRP, HSRP, BFD, and OPENFLOW.
• Layer 4 Transport Protocols (l4_transports.md) — TCP, UDP, and SCTP 4-tuple state tracking, RFC 7323 TCP options, and SCTP multi-chunk signaling.
• Layer 7 Infrastructure, Time, AAA & Flow Telemetry (l7_infra_and_telemetry.md) — Pair 802.1X EAPOL with RADIUS, DHCP, DNS, SYSLOG, NETFLOW, IPFIX, and SFLOW.
• Multi-Host Topologies & Dual-Stack Scenarios (topologies_and_dual_stack.md) — Complete EVPN-VXLAN leaf-spine fabric, Campus 802.1X NAC, and WAN QinQ/MPLS failover topologies.
• .fasm File Format & Media Type Specification (fasm-specification.md) — Normative text/vnd.frameassembly media type specification, lexical rules, and .fasm extension disambiguation.