defect.ch - Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== vlan.dat Internals ======

I wrote a Python module/utility to parse vlan.dat files: https://github.com/frei-style/vlandat

This page shows some information about the reverse engineering.

===== About the File =====
On Cisco IOS the VLAN and VTP information is stored in the VLAN database. This database is represented as the file vlan.dat.

<code>
Switch#dir flash:/vlan.dat
Directory of flash:/vlan.dat

    2  -rwx        1164  Nov 19 2016 23:15:21 +02:00  vlan.dat

27998208 bytes total (14103040 bytes free)
</code>

Some facts about the file:
  * It stores between 4 (1, 1002-1005) and 1005 VLANs. If there are more, the configuration goes to the config file.
  * If VTP mode is defined as transparent in the database and the config file and if the domain name matches, the VLAN information in the vlan.dat is ignored.
  * vlan.dat is the default name. It can be changed with //vtp file <filename>//.


Links:
  * [[http://www.cisco.com/c/en/us/support/docs/switches/catalyst-2940-series-switches/109304-manage-vlandat.html|Managing vlan.dat in Cisco Catalyst Switches Running Cisco IOS Software]]


===== Influence of VTP Configuration =====

>In VTP Server Mode, switch "saves VLAN configuration information in a file named vlan.dat in flash memory."

>In VTP Client Mode, switch saves "VLAN information in RAM only, not stored in NVRAM or FLash memory; must be repopulated from a VTP server if switch is power-cycled."

>In VTP Transparent Mode, switch saves VLAN configuration in NVRAM.

//-- SWITCH (642-813) Student Guide Volume I//

===== Structure =====

There is no guarantee that the information in the following table is correct. It's based on some information I found on the internet and was extended by my own research and experiments.


^ Offset ^ Bytes ^ Type    ^ IOS Name                 ^ Values ^ Notes                ^
| 000    | 4     | bytes   | -                        | BADB100D | Magic Number? |
| 004    | 4     | int     | VTP Version              | 2, 3 | -                    |
| 008    | 1     | char    | VTP Operating Mode ID    | 1 (client), 2 (server), 3 (transparent) | - |
| 009    | 1     | char    | -                        | 0-32 | VTP Domain Name Length |
| 00a    | 32    | string  | VTP Domain Name          | ascii, 0-32 chars | -                    |
| 02a    | 2     | :?:     | :?:                      | ? | |
| 02c    | 4     | int     | Configuration Revision   | <nowiki>0-2^31</nowiki> | <del>this may is only 4 bytes, like in the VTP network package</del> //Max revision number is 2,147,483,648then counter will reset back to zero// -- [[https://www.coursehero.com/file/p6k41no/Max-revision-number-is-2147483648-then-counter-will-reset-back-to-zero-VLAN/|source]] |
| 030    | 4     | int     | Local updater ID         |  | IP address        |
| 034    | 4     | int     | Last update on           |  | vlan interface with lowest number. :?: this may is only 2 bytes |
| 038    | 12    | string  | Configuration last modified by | yymmddhhmmss |    |
| 044    | 16    | bytes   | MD5 digest               | md5 hash | -                    |
| 054    | 1     | char    | -                        | 0-64 | VTP Password Length  |
| 055    | 64    | string  | VTP Password             | ascii, 0-64 chars | -                    |
| 095    | 1     | char    | :?:                      | ? | ? | 
| 096    | 2     | short   | Number of existing VLANs | 0-4095 | <del>this may be 2 bytes not 3. There should be enough VLANs with two bytes: <nowiki>2^(8*2)-1 = 65535</nowiki>.</del> <del>I add a 0-byte at the beginning and treat it as int</del> |
| 098    | 1     | char    | Pruning Mode             | 1 (enabled), 2 (disabled) | -                    |
| 099    | 1     | char    | V2 Mode                  | 1 (enabled), 2 (disabled) | -                    |
| 09a    | 6     | :?:     | :?:                      | | -                    |
^ Repeats for each VLAN ((for number of iterations see //Number of existing VLANs// from above)) ^^^^^^
| 0a0    | 1     | char    | - | 0-32 | Name Length |
| 0a1    | 32    | string  | Name        | ascii, 0-32 chars | |
| 0c1    | 2     | short   | Type        | 1 (enet), 2 (fddi), 3 (trcrf), 4 (fdnet), 5 (trbrf) | :?: this may is just a char, not short. would be enough, but no idea what the first byte could be |
| 0c3    | 1     | char    | State       | 1 (active), 2 (suspended) |  | 
| 0c4    | 2     | short   | MTU         | 576-18190 | | 
| 0c6    | 2     | short   | ID          | 1 to 4094 | Extended-range VLANs (VLAN IDs 1006 to 4094) are only saved in the VLAN database in VTP version 3. |
| 0c8    | 4     | int     | SAID        | 1 to 4294967294 |  |
| 0cc    | 2     | short   | Ring Number | 1-4095 | FDDI or Token Ring |
| 0ce    | 1     | char    | Bridge Number | 0-15 | FDDI Net or Token Ring Net (fd-net or trbrf) |
| 0cf    | 1     | char    | STP Type    | 0 (none), 1 (ieee), 2 (ibm) | FDDI Net or Token Ring Net (fd-net or trbrf) |
| 0d0    | 2     | short   | Parent VLAN | 0-1005 | FDDI or Token Ring |
| 0d2    | 2     | short   | First Translational VLAN | 0-1005 |  |
| 0d4    | 2     | short   | First Translational VLAN | 0-1005 |  |
| 0d6    | 1     | char    | Bridge Number | 0-15 | FDDI Net or Token Ring Net (fd-net or trbrf) |
| 0d7    | 1     | char    | ARE Hops    | 0-13 | type must be trcrf |
| 0d8    | 1     | char    | STE Hops    | 0-13 | type must be trcrf |
| 0d9    | 1     | char    | Backup CRF Mode | 0 (disabled), 1 (enabled) | type must be trcrf |
| 0da    | 1     | char    | Remote SPAN | 0 (disabled), 1 (enabled) | |
| 0db    | 1     | char    | :?:         | :?:  | :?: I have no idea. I changed the value to 1 and 2 but I didn't notice any differences on the switch with the show command. |
^ Following Stuff is yet unknown ^^^^^^
| ...    | :?:   | :?:     | :?: | :?: | :?: Looks like garbage, will be harder to figure that out. |

//The initial data for this table is from a blog post of Chris Welsh ([[https://rednectar.net/2010/12/06/decoding-vlan-dat/|decoding vlan.dat]]).//



===== Information in IOS =====

Here will be shown, how the information in the VLAN database can be displayed with IOS commands.

==== VLAN Information ====

<code>
affe#sh vl

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi1/0/1, Gi1/0/2, Gi1/0/3, Gi1/0/4, 
                                                Gi1/0/22, Gi1/0/23, Gi1/0/25, Gi1/0/26
3    VLAN0003                         active
5    VLAN0005                         active
50   Affe                             active
52   Banane                           active    Gi1/0/13, Gi1/0/14
915  Entensuppe                       active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
3    enet  100003     1500  -      -      -        -    -        0      0
5    enet  100005     1500  -      -      -        -    -        0      0
50   enet  100050     1500  -      -      -        -    -        0      0
52   enet  100052     1500  -      -      -        -    -        0      0
915  enet  100915     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 tr    101003     1500  -      -      -        -    srb      0      0
1004 fdnet 101004     1500  -      -      1        ieee -        0      0
1005 trnet 101005     1500  -      -      1        ibm  -        0      0


Remote SPAN VLANs
------------------------------------------------------------------------------


Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------


</code>

==== VTP Configuration / Status ====

<code>
affe#sh vtp status
VTP Version capable             : 1 to 3
VTP version running             : 1
VTP Domain Name                 : ENTENSUPPE
VTP Pruning Mode                : Disabled
VTP Traps Generation            : Disabled
Device ID                       : a2a3.2b63.ef21
Configuration last modified by 192.168.2.230 at 10-21-16 16:41:50
Local updater ID is 192.168.1.200 on interface Vl1 (lowest numbered VLAN interface found)

Feature VLAN:
--------------
VTP Operating Mode                : Server
Maximum VLANs supported locally   : 255
Number of existing VLANs          : 42
Configuration Revision            : 321
MD5 digest                        : 0x00 0x11 0x22 0x33 0x44 0x55 0xE4 0x66
                                    0x77 0x88 0x99 0xAA 0xBB 0xCC 0xDD 0xEE
</code>

----
----
----
----

==== Notes About Missing Parts ====

=== Garbage ===

There is some garbage at the end of the file. Marco Rizzi ([[http://rizzitech.blogspot.ch/2010_08_01_archive.html|Playing with vlan.dat]], the blog post was deleted unfortunately. It's available via Web Archive: [[https://web.archive.org/web/20150115040419/http://rizzitech.blogspot.com/2010/08/playing-with-vlandat.html|WebArchive]]) assumes, that it's additional information about FDDI/Token Ring vlans. I think he's right.

I deleted the vlan.dat and reloaded the switch to get this clean config:

<code>
switch>sh vl

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/1, Gi0/2, Gi0/3, Gi0/4
                                                Gi0/5, Gi0/6, Gi0/7, Gi0/8
1002 fddi-default                     act/unsup 
1003 token-ring-default               act/unsup 
1004 fddinet-default                  act/unsup 
1005 trnet-default                    act/unsup 

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
          

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1002 fddi  101002     1500  -      -      -        -    -        0      0   
1003 tr    101003     1500  -      -      -        -    -        0      0   
1004 fdnet 101004     1500  -      -      -        ieee -        0      0   
1005 trnet 101005     1500  -      -      -        ibm  -        0      0   

Remote SPAN VLANs
------------------------------------------------------------------------------


Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------

</code>

I extracted the garbage at the end of the fresh config and also after some changes. It looks like this are 24 byte blocks, so i splitted them up. I also looked at an old config which I played too much with it, which hasn't the length of a multiple of 24 bytes (this config isn't trustworthy anymore but I should keep this in mind. Maybe there are additional data or there is a variable field).

**initial config**
<code>
02 23 c4 90 00 00 03 ea 00 00 00 08 02 23 ca 04 01 01 00 00 04 01 00 00 # vl 1002
02 23 c5 18 00 00 03 eb 00 00 00 08 02 23 c4 d4 01 01 00 00 04 01 00 00 # vl 1003
02 23 c5 a0 00 00 03 ec 00 00 00 08 02 23 c5 5c 02 01 00 00 03 01 00 01 # vl 1004
00 00 00 00 00 00 03 ed 00 00 00 08 02 23 c5 e4 02 01 00 00 03 01 00 02 # vl 1005
                  ## ##
                 vlan id
</code>

**1. change**
<code>
vl 777
media tokenring
</code>

<code>
02 23 eb 10 00 00 03 09 00 00 00 08 02 23 ea cc 01 01 00 00 04 01 00 00 # vl 777
02 23 fc 7c 00 00 03 ea 00 00 00 08 02 23 fc 38 01 01 00 00 04 01 00 00 # vl 1002
02 23 fd 04 00 00 03 eb 00 00 00 08 02 23 fc c0 01 01 00 00 04 01 00 00 # vl 1003
02 23 fd 8c 00 00 03 ec 00 00 00 08 02 23 fd 48 02 01 00 00 03 01 00 01 # vl 1004
00 00 00 00 00 00 03 ed 00 00 00 08 02 23 fd d0 02 01 00 00 03 01 00 02 # vl 1005
                  ## ##
                 vlan id
</code>

I did a small change (just add something) and some random portions of the whole data got changed. I have no idea, yet.

**2. change**
<code>
vl 777
ring 1002
</code>

<code>
02 07 4b bc 00 00 03 09 00 00 00 08 02 07 45 74 01 01 03 ea 04 01 00 00 # vl 777
02 23 fc 38 00 00 03 ea 00 00 00 08 02 23 e8 a8 01 01 00 00 04 01 00 00 # vl 1002
02 23 fc c0 00 00 03 eb 00 00 00 08 02 23 fc 7c 01 01 00 00 04 01 00 00 # vl 1003
02 23 fd 48 00 00 03 ec 00 00 00 08 02 23 fd 04 02 01 00 00 03 01 00 01 # vl 1004
00 00 00 00 00 00 03 ed 00 00 00 08 02 23 fd 8c 02 01 00 00 03 01 00 02 # vl 1005
</code>

**3. change**
<code>
vl 777
are 1
ste 1
</code>

<code>
02 1e 61 d8 00 00 03 09 00 00 00 08 02 1e 43 64 01 01 03 ea 04 01 00 00 # vl 777
02 24 14 40 00 00 03 ea 00 00 00 08 02 23 c9 8c 01 01 00 00 04 01 00 00 # vl 1002
02 24 09 24 00 00 03 eb 00 00 00 08 02 07 41 cc 01 01 00 00 04 01 00 00 # vl 1003
01 ed b0 64 00 00 03 ec 00 00 00 08 01 b0 75 d4 02 01 00 00 03 01 00 01 # vl 1004
00 00 00 00 00 00 03 ed 00 00 00 08 01 ea a0 34 02 01 00 00 03 01 00 02 # vl 1005
</code>

=== VLAN ===

[[http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/vlan/configuration_guide/b_vlan_152ex_2960-x_cg/b_vlan_152ex_2960-x_cg_chapter_011.html]]

1)
  * Remote SPAN (enabled, disabled) => char (1)
  * VLAN state (active, suspend) => char (1)
  * Translational bridge 1 (0 to 1005) => short (2)
  * Translational bridge 2 (0 to 1005) => short (2)
or:
2)
  * Parent (Parent VLAN, if one exists.)
  * RingNo (Ring number for the VLAN, if applicable.)
  * BridgeNo (Bridge number for the VLAN, if applicable.)
  * Stp (Spanning-Tree Protocol type used on the VLAN.)
  * BrdgMode (Bridging mode for this VLAN—Possible values are source-route bridging (SRB) and source-route transparent bridging (SRT); the default is SRB.)
  * Trans1 (see below)
  * Trans2 (see below)

trans1 & trans2:
> Types of translational bridges that the VLAN in the VLAN column is configured to translate to. Translational bridge VLANs must be a VLAN media type different from the affected VLAN; if two VLANs are specified, each one must be a different type.
> Common VLAN types include Ethernet (enet), FDDI (fdnet), and Token Ring (tnet). The numbers in the Trans1 and Trans2 columns refer to the VLAN ID numbers of the translational bridge VLANs.
> **Note** The term VLAN translation is also used in Cisco configuration guides for mapping specific VLANs in a given trunk to another VLAN that is of the same media type. In this context the term VLAN translation refers to a form of VLAN mapping that is using the term VLAN translation to describe it.
-- [[http://www.cisco.com/c/en/us/td/docs/ios/lanswitch/command/reference/lsw_book/lsw_s2.html]]


:!: it looks like this is Token Ring information... so, rather 2) than 1). [[http://www.cisco.com/c/en/us/td/docs/ios/12_2/ibm/configuration/guide/fibm_c/bcftrrsm.html]]

Script output - known fields:
<code>
1003 token-ring-default               trcrf 1500 101003
1004 fddinet-default                  fdnet 1500 101004
1005 trnet-default                    trbrf 1500 101005
</code>

Script output - unknown fields:
<code>
b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x07\x00\x00\x00'
b'\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
b'\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
</code>

show vlan output:
<code>
1003 tr    101003     1500  -      -      -        -    srb      0      0
1004 fdnet 101004     1500  -      -      1        ieee -        0      0
1005 trnet 101005     1500  -      -      1        ibm  -        0      0
</code>


===== Cisco Docs input =====

==== show vlan fields ====

> You can set these parameters when you create a new normal-range VLAN or modify an existing VLAN in the VLAN database:

  * VLAN ID
  * VLAN name
  * VLAN type
    * Ethernet
    * Fiber Distributed Data Interface [FDDI]
    * FDDI network entity title [NET]
    * TrBRF or TrCRF
    * Token Ring
    * Token Ring-Net
  * VLAN state (active or suspended)
  * Maximum transmission unit (MTU) for the VLAN
  * Security Association Identifier (SAID)
  * Bridge identification number for TrBRF VLANs
  * Ring number for FDDI and TrCRF VLANs
  * Parent VLAN number for TrCRF VLANs
  * Spanning Tree Protocol (STP) type for TrCRF VLANs
  * VLAN number to use when translating from one VLAN type to another

-- [[http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/vlan/configuration_guide/b_vlan_152ex_2960-x_cg/b_vlan_152ex_2960-x_cg_chapter_011.html#task_87763697237543969FD3A444933A282E]]




===== Abbreviations =====

^ Abbreviation ^ written-out ^
| BRF   | Bridge Relay Function |
| ISL   | Cisco Inter-Switch Link |
| STE   | Spanning Tree Explorer |
| TrCRF | Token Ring Concentrator Relay Function |
| TrBRF | Token Ring Bridge Relay Function |


==== Links ====

  * [[http://rizzitech.blogspot.ch/2010/08/playing-with-vlandat.html|Marco Rizzi Blog: Playing with vlan.dat]]
  * [[https://rednectar.net/2010/12/06/decoding-vlan-dat/|RedNectar's Blog: decoding vlan.dat]]
  * Description of VLAN fields[[http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/vlan/configuration_guide/b_vlan_152ex_2960-x_cg/b_vlan_152ex_2960-x_cg_chapter_011.html|Catalyst 2960-X Switch VLAN Configuration Guide, Cisco IOS Release 15.0(2)EX]]
  * [[http://www.cisco.com/c/en/us/td/docs/ios/lanswitch/command/reference/lsw_book/lsw_s2.html|Cisco: Chapter: show vlan through spanning-tree vlan]]
  * [[https://www.wireshark.org/docs/dfref/v/vtp.html|Wireshark VTP Info]]
  * [[http://www.cisco.com/c/en/us/support/docs/lan-switching/vtp/10558-21.html|Cisco: Understanding VLAN Trunk Protocol (VTP)]]