output: Log ethernet type

Issue 7129 When configured with the existing "ethernet" switch, include the ether type in the output. This is most useful with anomaly records indicating unknown ethertypes.
jlucovsky · Oct 1, 2024 · b73296c · b73296c
1 parent 80687cc
commit b73296c
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/etc/schema.json b/etc/schema.json
@@ -1732,6 +1732,10 @@
                 "src_mac": {
                     "type": "string"
                 },
+                "ether_type": {
+                    "type": "integer",
+                    "description": "Ethernet type value "
+                },
                 "dest_macs": {
                     "type": "array",
                     "minItems": 1,

diff --git a/src/output-json.c b/src/output-json.c
@@ -744,6 +744,7 @@ static int CreateJSONEther(
         if (PacketIsEthernet(p)) {
             const EthernetHdr *ethh = PacketGetEthernet(p);
             jb_open_object(js, "ether");
+            jb_set_uint(js, "ether_type", ethh->eth_type);
             const uint8_t *src;
             const uint8_t *dst;
             switch (dir) {