group_id and interfaces

[ashworthpayne]

Hi
I'm a little dense. Sorry for being a time-suck.
Are group_id's similar to VLAN tags? If I have two interfaces and I want similar traffic to traverse them, do they both need the group_id assigned? If so does this mean that 'untagged' packets are dropped?
Thank you

[markqvist]

Yes, the group_id option allows creating several separate virtual networks on the same shared physical medium, and packets not belonging to that group_id are dropped. But importantly, this specific option is only relevant for AutoInterface!

If you want something more generic, that provides the same functionality, use the IFAC system, which works on all interface types.

From the Interface Access Codes section of the manual:

Reticulum can create named virtual networks, and networks that are only accessible by knowing a preshared passphrase. The configuration of this is detailed in the Common Interface Options section. To implement these feature, Reticulum uses the concept of Interface Access Codes, that are calculated and verified per packet.

An interface with a named virtual network or passphrase authentication enabled will derive a shared Ed25519 signing identity, and for every outbound packet generate a signature of the entire packet. This signature is then inserted into the packet as an Interface Access Code before transmission.

Upon receipt, the interface will check that the signature matches the expected value, and drop the packet if it does not. This ensures that only packets sent with the correct naming and/or passphrase parameters are allowed to pass onto the network.

An additional point of note, and the manual currently doesn't mention this, is that when IFAC is enabled, a unique per-packet OTP mask is generated and applied to each packet, masking the full packet contents. This means that the entire packet (including headers and destination hashes) is completely masked and unreadable to any observer that does not have the IFAC network_name and/or passphrase parameters for the interface.

[ashworthpayne]

Thanks again for your time and patience!

So if I understand correctly...

• The AutoInterface group_id is akin to a VLAN tag. All interfaces in that grouping (Bundle? Aggregate? What is the correct term for multiple physical interfaces in an AutoInterface interface?) will send this group_id and drop packets that don't have the group_id.

• Sitting above that layer is IFAC, which acts as a VPN and by its nature, a method for narrowing broadcast scope as well. I'm purposely ignoring the VPN qualities in an attempt to not get distracted by the new shiny toy you just gave me :)

Let me know if I've gone off the rails, please. I want to grok this body work and hopefully someday be able to contribute to it.