u_int
cip_if_print(const struct pcap_pkthdr *h, const u_char *p)
{
u_int caplen = h->caplen;
u_int length = h->len;
u_short extracted_ethertype;
if (memcmp(rfcllc, p, sizeof(rfcllc))==0 && caplen < RFC1483LLC_LEN) {
printf("[|cip]");
return (0);
}
if (eflag)
cip_print(length);
if (memcmp(rfcllc, p, sizeof(rfcllc)) == 0) {
if (llc_print(p, length, caplen, NULL, NULL,
&extracted_ethertype) == 0) {
if (!eflag)
cip_print(length);
if (extracted_ethertype) {
printf("(LLC %s) ",
etherproto_string(htons(extracted_ethertype)));
}
if (!suppress_default_print)
default_print(p, caplen);
}
} else {
ip_print(gndo, p, length);
}
return (0);
}
void
medsa_print(netdissect_options *ndo,
const u_char *bp, u_int length, u_int caplen)
{
register const struct ether_header *ep;
const struct medsa_pkthdr *medsa;
u_short ether_type;
medsa = (const struct medsa_pkthdr *)bp;
ep = (const struct ether_header *)(bp - sizeof(*ep));
ND_TCHECK(*medsa);
if (!ndo->ndo_eflag)
ND_PRINT((ndo, "MEDSA %d.%d:%d: ",
SRC_DEV(medsa), SRC_PORT(medsa), VID(medsa)));
else
medsa_print_full(ndo, medsa, caplen);
bp += 8;
length -= 8;
caplen -= 8;
ether_type = EXTRACT_16BITS(&medsa->ether_type);
if (ether_type <= ETHERMTU) {
/* Try to print the LLC-layer header & higher layers */
if (llc_print(ndo, bp, length, caplen, ESRC(ep), EDST(ep)) < 0) {
/* packet type not known, print raw packet */
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(bp, caplen);
}
} else {
if (ndo->ndo_eflag)
ND_PRINT((ndo, "ethertype %s (0x%04x) ",
tok2str(ethertype_values, "Unknown",
ether_type),
ether_type));
if (ethertype_print(ndo, ether_type, bp, length, caplen) == 0) {
/* ether_type not known, print raw packet */
if (!ndo->ndo_eflag)
ND_PRINT((ndo, "ethertype %s (0x%04x) ",
tok2str(ethertype_values, "Unknown",
ether_type),
ether_type));
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(bp, caplen);
}
}
return;
trunc:
ND_PRINT((ndo, "%s", tstr));
}
/*
* Print an RFC 1483 LLC-encapsulated ATM frame.
*/
static u_int
atm_llc_print(netdissect_options *ndo,
const u_char *p, int length, int caplen)
{
int llc_hdrlen;
llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
if (llc_hdrlen < 0) {
/* packet not known, print raw packet */
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
llc_hdrlen = -llc_hdrlen;
}
return (llc_hdrlen);
}
/*
* Print an RFC 1483 LLC-encapsulated ATM frame.
*/
static void
atm_llc_print(const u_char *p, int length, int caplen)
{
u_short extracted_ethertype;
if (!llc_print(p, length, caplen, NULL, NULL,
&extracted_ethertype)) {
/* ether_type not known, print raw packet */
if (extracted_ethertype) {
printf("(LLC %s) ",
etherproto_string(htons(extracted_ethertype)));
}
if (!suppress_default_print)
default_print(p, caplen);
}
}
u_int
juniper_atm2_print(netdissect_options *ndo,
const struct pcap_pkthdr *h, register const u_char *p)
{
uint16_t extracted_ethertype;
struct juniper_l2info_t l2info;
l2info.pictype = DLT_JUNIPER_ATM2;
if (juniper_parse_header(ndo, p, h, &l2info) == 0)
return l2info.header_len;
p+=l2info.header_len;
if (l2info.cookie[7] & ATM2_PKT_TYPE_MASK) { /* OAM cell ? */
oam_print(ndo, p, l2info.length, ATM_OAM_NOHEC);
return l2info.header_len;
}
if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */
EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */
if (llc_print(ndo, p, l2info.length, l2info.caplen, NULL, NULL,
&extracted_ethertype) != 0)
return l2info.header_len;
}
if (l2info.direction != JUNIPER_BPF_PKT_IN && /* ether-over-1483 encaps ? */
(EXTRACT_32BITS(l2info.cookie) & ATM2_GAP_COUNT_MASK)) {
ether_print(ndo, p, l2info.length, l2info.caplen, NULL, NULL);
return l2info.header_len;
}
if (p[0] == 0x03) { /* Cisco style NLPID encaps ? */
isoclns_print(ndo, p + 1, l2info.length - 1, l2info.caplen - 1);
/* FIXME check if frame was recognized */
return l2info.header_len;
}
if(juniper_ppp_heuristic_guess(ndo, p, l2info.length) != 0) /* PPPoA vcmux encaps ? */
return l2info.header_len;
if (ip_heuristic_guess(ndo, p, l2info.length) != 0) /* last try - vcmux encaps ? */
return l2info.header_len;
return l2info.header_len;
}
u_int
juniper_atm2_print(const struct pcap_pkthdr *h, register const u_char *p)
{
u_int16_t extracted_ethertype;
struct juniper_l2info_t l2info;
l2info.pictype = DLT_JUNIPER_ATM2;
if(juniper_parse_header(p, h, &l2info) == 0)
return l2info.header_len;
p+=l2info.header_len;
if (l2info.cookie[7] & ATM2_PKT_TYPE_MASK) {
oam_print(p,l2info.length,ATM_OAM_NOHEC);
return l2info.header_len;
}
if (EXTRACT_24BITS(p) == 0xfefe03 ||
EXTRACT_24BITS(p) == 0xaaaa03) {
if (llc_print(p, l2info.length, l2info.caplen, NULL, NULL,
&extracted_ethertype) != 0)
return l2info.header_len;
}
if (l2info.direction != JUNIPER_BPF_PKT_IN &&
(EXTRACT_32BITS(l2info.cookie) & ATM2_GAP_COUNT_MASK)) {
ether_print(p, l2info.length, l2info.caplen);
return l2info.header_len;
}
if (p[0] == 0x03) {
isoclns_print(p + 1, l2info.length - 1, l2info.caplen - 1);
return l2info.header_len;
}
if(juniper_ppp_heuristic_guess(p, l2info.length) != 0)
return l2info.header_len;
if(ip_heuristic_guess(p, l2info.length) != 0)
return l2info.header_len;
return l2info.header_len;
}
/*
* This is the top level routine of the printer. 'p' points
* to the LLC/SNAP or raw header of the packet, 'h->ts' is the timestamp,
* 'h->len' is the length of the packet off the wire, and 'h->caplen'
* is the number of bytes actually captured.
*/
u_int
cip_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
{
u_int caplen = h->caplen;
u_int length = h->len;
size_t cmplen;
int llc_hdrlen;
ndo->ndo_protocol = "cip_if";
cmplen = sizeof(rfcllc);
if (cmplen > caplen)
cmplen = caplen;
if (cmplen > length)
cmplen = length;
if (ndo->ndo_eflag)
cip_print(ndo, length);
if (cmplen == 0) {
ND_PRINT("[|cip]");
return 0;
}
if (memcmp(rfcllc, p, cmplen) == 0) {
/*
* LLC header is present. Try to print it & higher layers.
*/
llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
if (llc_hdrlen < 0) {
/* packet type not known, print raw packet */
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
llc_hdrlen = -llc_hdrlen;
}
} else {
/*
* LLC header is absent; treat it as just IP.
*/
llc_hdrlen = 0;
ip_print(ndo, p, length);
}
return (llc_hdrlen);
}
/*
* This is the top level routine of the printer. 'p' points
* to the LLC/SNAP or raw header of the packet, 'h->ts' is the timestamp,
* 'h->len' is the length of the packet off the wire, and 'h->caplen'
* is the number of bytes actually captured.
*/
u_int
cip_if_print(const struct pcap_pkthdr *h, const u_char *p)
{
u_int caplen = h->caplen;
u_int length = h->len;
u_short extracted_ethertype;
if (memcmp(rfcllc, p, sizeof(rfcllc))==0 && caplen < RFC1483LLC_LEN) {
printf("[|cip]");
return (0);
}
if (eflag)
cip_print(length);
if (memcmp(rfcllc, p, sizeof(rfcllc)) == 0) {
/*
* LLC header is present. Try to print it & higher layers.
*/
if (llc_print(p, length, caplen, NULL, NULL,
&extracted_ethertype) == 0) {
/* ether_type not known, print raw packet */
if (!eflag)
cip_print(length);
if (extracted_ethertype) {
printf("(LLC %s) ",
etherproto_string(htons(extracted_ethertype)));
}
if (!suppress_default_print)
default_print(p, caplen);
}
} else {
/*
* LLC header is absent; treat it as just IP.
*/
ip_print(gndo, p, length);
}
return (0);
}
u_int
juniper_atm1_print(const struct pcap_pkthdr *h, register const u_char *p)
{
u_int16_t extracted_ethertype;
struct juniper_l2info_t l2info;
l2info.pictype = DLT_JUNIPER_ATM1;
if(juniper_parse_header(p, h, &l2info) == 0)
return l2info.header_len;
p+=l2info.header_len;
if (l2info.cookie[0] == 0x80) {
oam_print(p,l2info.length,ATM_OAM_NOHEC);
return l2info.header_len;
}
if (EXTRACT_24BITS(p) == 0xfefe03 ||
EXTRACT_24BITS(p) == 0xaaaa03) {
if (llc_print(p, l2info.length, l2info.caplen, NULL, NULL,
&extracted_ethertype) != 0)
return l2info.header_len;
}
if (p[0] == 0x03) {
isoclns_print(p + 1, l2info.length - 1, l2info.caplen - 1);
return l2info.header_len;
}
if(ip_heuristic_guess(p, l2info.length) != 0)
return l2info.header_len;
return l2info.header_len;
}
u_int
juniper_atm1_print(const struct pcap_pkthdr *h, register const u_char *p)
{
u_int16_t extracted_ethertype;
struct juniper_l2info_t l2info;
l2info.pictype = DLT_JUNIPER_ATM1;
if(juniper_parse_header(p, h, &l2info) == 0)
return l2info.header_len;
p+=l2info.header_len;
if (l2info.cookie[0] == 0x80) { /* OAM cell ? */
oam_print(p,l2info.length,ATM_OAM_NOHEC);
return l2info.header_len;
}
if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */
EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */
if (llc_print(p, l2info.length, l2info.caplen, NULL, NULL,
&extracted_ethertype) != 0)
return l2info.header_len;
}
if (p[0] == 0x03) { /* Cisco style NLPID encaps ? */
isoclns_print(p + 1, l2info.length - 1, l2info.caplen - 1);
/* FIXME check if frame was recognized */
return l2info.header_len;
}
if(ip_heuristic_guess(p, l2info.length) != 0) /* last try - vcmux encaps ? */
return l2info.header_len;
return l2info.header_len;
}
u_int
token_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen)
{
const struct token_header *trp;
int llc_hdrlen;
nd_mac_addr srcmac, dstmac;
struct lladdr_info src, dst;
u_int route_len = 0, hdr_len = TOKEN_HDRLEN;
int seg;
ndo->ndo_protocol = "token";
trp = (const struct token_header *)p;
if (caplen < TOKEN_HDRLEN) {
nd_print_trunc(ndo);
return hdr_len;
}
/*
* Get the TR addresses into a canonical form
*/
extract_token_addrs(trp, (char*)srcmac, (char*)dstmac);
/* Adjust for source routing information in the MAC header */
if (IS_SOURCE_ROUTED(trp)) {
/* Clear source-routed bit */
srcmac[0] &= 0x7f;
if (ndo->ndo_eflag)
token_hdr_print(ndo, trp, length, srcmac, dstmac);
if (caplen < TOKEN_HDRLEN + 2) {
nd_print_trunc(ndo);
return hdr_len;
}
route_len = RIF_LENGTH(trp);
hdr_len += route_len;
if (caplen < hdr_len) {
nd_print_trunc(ndo);
return hdr_len;
}
if (ndo->ndo_vflag) {
ND_PRINT("%s ", broadcast_indicator[BROADCAST(trp)]);
ND_PRINT("%s", direction[DIRECTION(trp)]);
for (seg = 0; seg < SEGMENT_COUNT(trp); seg++)
ND_PRINT(" [%u:%u]", RING_NUMBER(trp, seg),
BRIDGE_NUMBER(trp, seg));
} else {
ND_PRINT("rt = %x", EXTRACT_BE_U_2(trp->token_rcf));
for (seg = 0; seg < SEGMENT_COUNT(trp); seg++)
ND_PRINT(":%x", EXTRACT_BE_U_2(trp->token_rseg[seg]));
}
ND_PRINT(" (%s) ", largest_frame[LARGEST_FRAME(trp)]);
} else {
if (ndo->ndo_eflag)
token_hdr_print(ndo, trp, length, srcmac, dstmac);
}
src.addr = srcmac;
src.addr_string = etheraddr_string;
dst.addr = dstmac;
dst.addr_string = etheraddr_string;
/* Skip over token ring MAC header and routing information */
length -= hdr_len;
p += hdr_len;
caplen -= hdr_len;
/* Frame Control field determines interpretation of packet */
if (FRAME_TYPE(trp) == TOKEN_FC_LLC) {
/* Try to print the LLC-layer header & higher layers */
llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst);
if (llc_hdrlen < 0) {
/* packet type not known, print raw packet */
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
llc_hdrlen = -llc_hdrlen;
}
hdr_len += llc_hdrlen;
} else {
/* Some kinds of TR packet we cannot handle intelligently */
/* XXX - dissect MAC packets if frame type is 0 */
if (!ndo->ndo_eflag)
token_hdr_print(ndo, trp, length + TOKEN_HDRLEN + route_len,
srcmac, dstmac);
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
}
return (hdr_len);
}
/*
* Print an Ethernet frame.
* This might be encapsulated within another frame; we might be passed
* a pointer to a function that can print header information for that
* frame's protocol, and an argument to pass to that function.
*/
void
ether_print(netdissect_options *ndo,
const u_char *p, u_int length, u_int caplen,
void (*print_encap_header)(netdissect_options *ndo, const u_char *), const u_char *encap_header_arg)
{
struct ether_header *ep;
u_int orig_length;
u_short ether_type;
u_short extracted_ether_type;
if (caplen < ETHER_HDRLEN || length < ETHER_HDRLEN) {
ND_PRINT((ndo, "[|ether]"));
return;
}
if (ndo->ndo_eflag) {
if (print_encap_header != NULL)
(*print_encap_header)(ndo, encap_header_arg);
ether_hdr_print(ndo, p, length);
}
orig_length = length;
length -= ETHER_HDRLEN;
caplen -= ETHER_HDRLEN;
ep = (struct ether_header *)p;
p += ETHER_HDRLEN;
ether_type = EXTRACT_16BITS(&ep->ether_type);
recurse:
/*
* Is it (gag) an 802.3 encapsulation?
*/
if (ether_type <= ETHERMTU) {
/* Try to print the LLC-layer header & higher layers */
if (llc_print(p, length, caplen, ESRC(ep), EDST(ep),
&extracted_ether_type) == 0) {
/* ether_type not known, print raw packet */
if (!ndo->ndo_eflag) {
if (print_encap_header != NULL)
(*print_encap_header)(ndo, encap_header_arg);
ether_hdr_print(ndo, (u_char *)ep, orig_length);
}
if (!ndo->ndo_suppress_default_print)
ndo->ndo_default_print(ndo, p, caplen);
}
} else if (ether_type == ETHERTYPE_8021Q ||
ether_type == ETHERTYPE_8021Q9100 ||
ether_type == ETHERTYPE_8021Q9200 ||
ether_type == ETHERTYPE_8021QinQ) {
/*
* Print VLAN information, and then go back and process
* the enclosed type field.
*/
if (caplen < 4 || length < 4) {
ND_PRINT((ndo, "[|vlan]"));
return;
}
if (ndo->ndo_eflag) {
u_int16_t tag = EXTRACT_16BITS(p);
ND_PRINT((ndo, "vlan %u, p %u%s, ",
tag & 0xfff,
tag >> 13,
(tag & 0x1000) ? ", CFI" : ""));
}
ether_type = EXTRACT_16BITS(p + 2);
if (ndo->ndo_eflag && ether_type > ETHERMTU)
ND_PRINT((ndo, "ethertype %s, ", tok2str(ethertype_values,"0x%04x", ether_type)));
p += 4;
length -= 4;
caplen -= 4;
goto recurse;
} else if (ether_type == ETHERTYPE_JUMBO) {
/*
* This is the top level routine of the printer. 'p' is the points
* to the ether header of the packet, 'tvp' is the timestamp,
* 'length' is the length of the packet off the wire, and 'caplen'
* is the number of bytes actually captured.
*/
void
ether_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
{
u_int caplen = h->caplen;
u_int length = h->len;
struct ether_header *ep;
u_short ether_type;
extern u_short extracted_ethertype;
ts_print(&h->ts);
if (caplen < sizeof(struct ether_header)) {
printf("[|ether]");
goto out;
}
if (eflag)
ether_print(p, length);
/*
* Some printers want to get back at the ethernet addresses,
* and/or check that they're not walking off the end of the packet.
* Rather than pass them all the way down, we set these globals.
*/
packetp = p;
snapend = p + caplen;
length -= sizeof(struct ether_header);
caplen -= sizeof(struct ether_header);
ep = (struct ether_header *)p;
p += sizeof(struct ether_header);
ether_type = ntohs(ep->ether_type);
/*
* Is it (gag) an 802.3 encapsulation?
*/
extracted_ethertype = 0;
if (ether_type <= ETHERMTU) {
/* Try to print the LLC-layer header & higher layers */
if (llc_print(p, length, caplen, ESRC(ep), EDST(ep)) == 0) {
/* ether_type not known, print raw packet */
if (!eflag)
ether_print((u_char *)ep, length);
if (extracted_ethertype) {
printf("(LLC %s) ",
etherproto_string(htons(extracted_ethertype)));
}
if (!xflag && !qflag)
default_print(p, caplen);
}
} else if (ether_encap_print(ether_type, p, length, caplen) == 0) {
/* ether_type not known, print raw packet */
if (!eflag)
ether_print((u_char *)ep, length + sizeof(*ep));
if (!xflag && !qflag)
default_print(p, caplen);
}
if (xflag)
default_print(p, caplen);
out:
putchar('\n');
}
int
ieee80211_data(struct ieee80211_frame *wh, u_int len)
{
u_int8_t *t = (u_int8_t *)wh;
u_int datalen;
int data = !(wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_NODATA);
int hasqos = ((wh->i_fc[0] &
(IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_QOS)) ==
(IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS));
u_char *esrc = NULL, *edst = NULL;
if (hasqos) {
struct ieee80211_qosframe *wq;
wq = (struct ieee80211_qosframe *) wh;
TCHECK(*wq);
t += sizeof(*wq);
datalen = len - sizeof(*wq);
} else {
TCHECK(*wh);
t += sizeof(*wh);
datalen = len - sizeof(*wh);
}
switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
case IEEE80211_FC1_DIR_TODS:
esrc = wh->i_addr2;
edst = wh->i_addr3;
break;
case IEEE80211_FC1_DIR_FROMDS:
esrc = wh->i_addr3;
edst = wh->i_addr1;
break;
case IEEE80211_FC1_DIR_NODS:
esrc = wh->i_addr2;
edst = wh->i_addr1;
break;
case IEEE80211_FC1_DIR_DSTODS:
if (hasqos) {
struct ieee80211_qosframe_addr4 *w4;
w4 = (struct ieee80211_qosframe_addr4 *) wh;
TCHECK(*w4);
t = (u_int8_t *) (w4 + 1);
datalen = len - sizeof(*w4);
esrc = w4->i_addr4;
edst = w4->i_addr3;
} else {
struct ieee80211_frame_addr4 *w4;
w4 = (struct ieee80211_frame_addr4 *) wh;
TCHECK(*w4);
t = (u_int8_t *) (w4 + 1);
datalen = len - sizeof(*w4);
esrc = w4->i_addr4;
edst = w4->i_addr3;
}
break;
}
if (data && esrc)
llc_print(t, datalen, datalen, esrc, edst);
else if (eflag && esrc)
printf("%s > %s",
etheraddr_string(esrc), etheraddr_string(edst));
return (0);
trunc:
/* Truncated elements in frame */
return (1);
}
/*
* This is the top level routine of the printer. 'sp' is the points
* to the FDDI header of the packet, 'tvp' is the timestamp,
* 'length' is the length of the packet off the wire, and 'caplen'
* is the number of bytes actually captured.
*/
void
fddi_if_print(u_char *pcap, const struct pcap_pkthdr *h,
register const u_char *p)
{
u_int caplen = h->caplen;
u_int length = h->len;
const struct fddi_header *fddip = (struct fddi_header *)p;
extern u_short extracted_ethertype;
struct ether_header ehdr;
ts_print(&h->ts);
if (caplen < FDDI_HDRLEN) {
printf("[|fddi]");
goto out;
}
/*
* Get the FDDI addresses into a canonical form
*/
extract_fddi_addrs(fddip, (char *)ESRC(&ehdr), (char *)EDST(&ehdr));
/*
* Some printers want to get back at the link level addresses,
* and/or check that they're not walking off the end of the packet.
* Rather than pass them all the way down, we set these globals.
*/
snapend = p + caplen;
/*
* Actually, the only printer that uses packetp is print-bootp.c,
* and it assumes that packetp points to an Ethernet header. The
* right thing to do is to fix print-bootp.c to know which link
* type is in use when it excavates. XXX
*/
packetp = (u_char *)&ehdr;
if (eflag)
fddi_print(fddip, length, ESRC(&ehdr), EDST(&ehdr));
/* Skip over FDDI MAC header */
length -= FDDI_HDRLEN;
p += FDDI_HDRLEN;
caplen -= FDDI_HDRLEN;
/* Frame Control field determines interpretation of packet */
extracted_ethertype = 0;
if ((fddip->fddi_fc & FDDIFC_CLFF) == FDDIFC_LLC_ASYNC) {
/* Try to print the LLC-layer header & higher layers */
if (llc_print(p, length, caplen, ESRC(&ehdr), EDST(&ehdr))
== 0) {
/*
* Some kinds of LLC packet we cannot
* handle intelligently
*/
if (!eflag)
fddi_print(fddip, length,
ESRC(&ehdr), EDST(&ehdr));
if (extracted_ethertype) {
printf("(LLC %s) ",
etherproto_string(htons(extracted_ethertype)));
}
if (!xflag && !qflag)
default_print(p, caplen);
}
} else if ((fddip->fddi_fc & FDDIFC_CLFF) == FDDIFC_SMT)
fddi_smt_print(p, caplen);
else {
/* Some kinds of FDDI packet we cannot handle intelligently */
if (!eflag)
fddi_print(fddip, length, ESRC(&ehdr), EDST(&ehdr));
if (!xflag && !qflag)
default_print(p, caplen);
}
if (xflag)
default_print(p, caplen);
out:
putchar('\n');
}
static u_int
ieee802_11_print(const u_char *p, u_int length, u_int caplen, int pad)
{
u_int16_t fc;
u_int hdrlen;
const u_int8_t *src, *dst;
u_short extracted_ethertype;
if (caplen < IEEE802_11_FC_LEN) {
printf("[|802.11]");
return caplen;
}
fc = EXTRACT_LE_16BITS(p);
hdrlen = extract_header_length(fc);
if (pad)
hdrlen = roundup2(hdrlen, 4);
if (caplen < hdrlen) {
printf("[|802.11]");
return hdrlen;
}
ieee_802_11_hdr_print(fc, p, &src, &dst);
/*
* Go past the 802.11 header.
*/
length -= hdrlen;
caplen -= hdrlen;
p += hdrlen;
switch (FC_TYPE(fc)) {
case T_MGMT:
if (!mgmt_body_print(fc,
(const struct mgmt_header_t *)(p - hdrlen), p)) {
printf("[|802.11]");
return hdrlen;
}
break;
case T_CTRL:
if (!ctrl_body_print(fc, p - hdrlen)) {
printf("[|802.11]");
return hdrlen;
}
break;
case T_DATA:
if (DATA_FRAME_IS_NULL(FC_SUBTYPE(fc)))
return hdrlen; /* no-data frame */
/* There may be a problem w/ AP not having this bit set */
if (FC_WEP(fc)) {
if (!wep_print(p)) {
printf("[|802.11]");
return hdrlen;
}
} else if (llc_print(p, length, caplen, dst, src,
&extracted_ethertype) == 0) {
/*
* Some kinds of LLC packet we cannot
* handle intelligently
*/
if (!eflag)
ieee_802_11_hdr_print(fc, p - hdrlen, NULL,
NULL);
if (extracted_ethertype)
printf("(LLC %s) ",
etherproto_string(
htons(extracted_ethertype)));
if (!suppress_default_print)
default_print(p, caplen);
}
break;
default:
printf("unknown 802.11 frame type (%d)", FC_TYPE(fc));
break;
}
return hdrlen;
}
u_int
_token_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen)
{
const struct token_header *trp;
u_short extracted_ethertype;
struct ether_header ehdr;
u_int route_len = 0, hdr_len = TOKEN_HDRLEN;
int seg;
trp = (const struct token_header *)p;
if (caplen < TOKEN_HDRLEN) {
ND_PRINT((ndo, "%s", tstr));
return hdr_len;
}
/*
* Get the TR addresses into a canonical form
*/
extract_token_addrs(trp, (char*)ESRC(&ehdr), (char*)EDST(&ehdr));
/* Adjust for source routing information in the MAC header */
if (IS_SOURCE_ROUTED(trp)) {
/* Clear source-routed bit */
*ESRC(&ehdr) &= 0x7f;
if (ndo->ndo_eflag)
token_hdr_print(ndo, trp, length, ESRC(&ehdr), EDST(&ehdr));
if (caplen < TOKEN_HDRLEN + 2) {
ND_PRINT((ndo, "%s", tstr));
return hdr_len;
}
route_len = RIF_LENGTH(trp);
hdr_len += route_len;
if (caplen < hdr_len) {
ND_PRINT((ndo, "%s", tstr));
return hdr_len;
}
if (ndo->ndo_vflag) {
ND_PRINT((ndo, "%s ", broadcast_indicator[BROADCAST(trp)]));
ND_PRINT((ndo, "%s", direction[DIRECTION(trp)]));
for (seg = 0; seg < SEGMENT_COUNT(trp); seg++)
ND_PRINT((ndo, " [%d:%d]", RING_NUMBER(trp, seg),
BRIDGE_NUMBER(trp, seg)));
} else {
ND_PRINT((ndo, "rt = %x", EXTRACT_16BITS(&trp->token_rcf)));
for (seg = 0; seg < SEGMENT_COUNT(trp); seg++)
ND_PRINT((ndo, ":%x", EXTRACT_16BITS(&trp->token_rseg[seg])));
}
ND_PRINT((ndo, " (%s) ", largest_frame[LARGEST_FRAME(trp)]));
} else {
if (ndo->ndo_eflag)
token_hdr_print(ndo, trp, length, ESRC(&ehdr), EDST(&ehdr));
}
/* Skip over token ring MAC header and routing information */
length -= hdr_len;
p += hdr_len;
caplen -= hdr_len;
/* Frame Control field determines interpretation of packet */
if (FRAME_TYPE(trp) == TOKEN_FC_LLC) {
/* Try to print the LLC-layer header & higher layers */
if (llc_print(ndo, p, length, caplen, ESRC(&ehdr), EDST(&ehdr),
&extracted_ethertype) == 0) {
/* ether_type not known, print raw packet */
if (!ndo->ndo_eflag)
token_hdr_print(ndo, trp,
length + TOKEN_HDRLEN + route_len,
ESRC(&ehdr), EDST(&ehdr));
if (extracted_ethertype) {
ND_PRINT((ndo, "(LLC %s) ",
etherproto_string(htons(extracted_ethertype))));
}
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
}
} else {
/* Some kinds of TR packet we cannot handle intelligently */
/* XXX - dissect MAC packets if frame type is 0 */
if (!ndo->ndo_eflag)
token_hdr_print(ndo, trp, length + TOKEN_HDRLEN + route_len,
ESRC(&ehdr), EDST(&ehdr));
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
}
return (hdr_len);
}
/*
* Print an Ethernet frame.
* This might be encapsulated within another frame; we might be passed
* a pointer to a function that can print header information for that
* frame's protocol, and an argument to pass to that function.
*/
void
ether_print(netdissect_options *ndo,
const u_char *p, u_int length, u_int caplen,
void (*print_encap_header)(netdissect_options *ndo, const u_char *), const u_char *encap_header_arg)
{
struct ether_header *ep;
u_int orig_length;
u_short ether_type;
u_short extracted_ether_type;
if (caplen < ETHER_HDRLEN || length < ETHER_HDRLEN) {
ND_PRINT((ndo, "[|ether]"));
return;
}
if (ndo->ndo_eflag) {
if (print_encap_header != NULL)
(*print_encap_header)(ndo, encap_header_arg);
ether_hdr_print(ndo, p, length);
}
orig_length = length;
length -= ETHER_HDRLEN;
caplen -= ETHER_HDRLEN;
ep = (struct ether_header *)p;
p += ETHER_HDRLEN;
ether_type = EXTRACT_16BITS(&ep->ether_type);
recurse:
/*
* Is it (gag) an 802.3 encapsulation?
*/
if (ether_type <= ETHERMTU) {
/* Try to print the LLC-layer header & higher layers */
if (llc_print(ndo, p, length, caplen, ESRC(ep), EDST(ep),
&extracted_ether_type) == 0) {
/* ether_type not known, print raw packet */
if (!ndo->ndo_eflag) {
if (print_encap_header != NULL)
(*print_encap_header)(ndo, encap_header_arg);
ether_hdr_print(ndo, (u_char *)ep, orig_length);
}
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
}
} else if (ether_type == ETHERTYPE_8021Q ||
ether_type == ETHERTYPE_8021Q9100 ||
ether_type == ETHERTYPE_8021Q9200 ||
ether_type == ETHERTYPE_8021QinQ) {
/*
* Print VLAN information, and then go back and process
* the enclosed type field.
*/
if (caplen < 4 || length < 4) {
ND_PRINT((ndo, "[|vlan]"));
return;
}
if (ndo->ndo_eflag) {
uint16_t tag = EXTRACT_16BITS(p);
ND_PRINT((ndo, "%s, ", ieee8021q_tci_string(tag)));
}
ether_type = EXTRACT_16BITS(p + 2);
if (ndo->ndo_eflag && ether_type > ETHERMTU)
ND_PRINT((ndo, "ethertype %s, ", tok2str(ethertype_values,"0x%04x", ether_type)));
p += 4;
length -= 4;
caplen -= 4;
goto recurse;
} else if (ether_type == ETHERTYPE_JUMBO) {
/*
* Alteon jumbo frames.
* See
*
* http://tools.ietf.org/html/draft-ietf-isis-ext-eth-01
*
* which indicates that, following the type field,
* there's an LLC header and payload.
*/
/* Try to print the LLC-layer header & higher layers */
if (llc_print(ndo, p, length, caplen, ESRC(ep), EDST(ep),
&extracted_ether_type) == 0) {
/* ether_type not known, print raw packet */
if (!ndo->ndo_eflag) {
if (print_encap_header != NULL)
(*print_encap_header)(ndo, encap_header_arg);
ether_hdr_print(ndo, (u_char *)ep, orig_length);
}
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
}
} else {
if (ethertype_print(ndo, ether_type, p, length, caplen) == 0) {
/* ether_type not known, print raw packet */
if (!ndo->ndo_eflag) {
if (print_encap_header != NULL)
(*print_encap_header)(ndo, encap_header_arg);
ether_hdr_print(ndo, (u_char *)ep, orig_length);
}
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
}
}
}
/*
* This is the top level routine of the printer. 'p' points to the
* Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
* 'h->len' is the length of the packet off the wire, and 'h->caplen'
* is the number of bytes actually captured.
*/
u_int
sll_if_print(const struct pcap_pkthdr *h, const u_char *p)
{
u_int caplen = h->caplen;
u_int length = h->len;
register const struct sll_header *sllp;
u_short ether_type;
u_short extracted_ethertype;
if (caplen < SLL_HDR_LEN) {
/*
* XXX - this "can't happen" because "pcap-linux.c" always
* adds this many bytes of header to every packet in a
* cooked socket capture.
*/
printf("[|sll]");
return (caplen);
}
sllp = (const struct sll_header *)p;
if (eflag)
sll_print(sllp, length);
/*
* Go past the cooked-mode header.
*/
length -= SLL_HDR_LEN;
caplen -= SLL_HDR_LEN;
p += SLL_HDR_LEN;
ether_type = EXTRACT_16BITS(&sllp->sll_protocol);
recurse:
/*
* Is it (gag) an 802.3 encapsulation, or some non-Ethernet
* packet type?
*/
if (ether_type <= ETHERMTU) {
/*
* Yes - what type is it?
*/
switch (ether_type) {
case LINUX_SLL_P_802_3:
/*
* Ethernet_802.3 IPX frame.
*/
ipx_print(p, length);
break;
case LINUX_SLL_P_802_2:
/*
* 802.2.
* Try to print the LLC-layer header & higher layers.
*/
if (llc_print(p, length, caplen, NULL, NULL,
&extracted_ethertype) == 0)
goto unknown; /* unknown LLC type */
break;
default:
extracted_ethertype = 0;
/*FALLTHROUGH*/
unknown:
/* ether_type not known, print raw packet */
if (!eflag)
sll_print(sllp, length + SLL_HDR_LEN);
if (extracted_ethertype) {
printf("(LLC %s) ",
etherproto_string(htons(extracted_ethertype)));
}
if (!suppress_default_print)
default_print(p, caplen);
break;
}
} else if (ether_type == ETHERTYPE_8021Q) {
/*
* Print VLAN information, and then go back and process
* the enclosed type field.
*/
if (caplen < 4 || length < 4) {
printf("[|vlan]");
return (SLL_HDR_LEN);
}
if (eflag) {
u_int16_t tag = EXTRACT_16BITS(p);
printf("vlan %u, p %u%s, ",
tag & 0xfff,
tag >> 13,
(tag & 0x1000) ? ", CFI" : "");
}
ether_type = EXTRACT_16BITS(p + 2);
if (ether_type <= ETHERMTU)
ether_type = LINUX_SLL_P_802_2;
if (!qflag) {
(void)printf("ethertype %s, ",
tok2str(ethertype_values, "Unknown", ether_type));
}
p += 4;
length -= 4;
caplen -= 4;
goto recurse;
} else {
if (ethertype_print(gndo, ether_type, p, length, caplen) == 0) {
/*
* This is the top level routine of the printer. 'p' points to the
* Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
* 'h->len' is the length of the packet off the wire, and 'h->caplen'
* is the number of bytes actually captured.
*/
u_int
sll_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
{
u_int caplen = h->caplen;
u_int length = h->len;
register const struct sll_header *sllp;
u_short ether_type;
int llc_hdrlen;
u_int hdrlen;
if (caplen < SLL_HDR_LEN) {
/*
* XXX - this "can't happen" because "pcap-linux.c" always
* adds this many bytes of header to every packet in a
* cooked socket capture.
*/
ND_PRINT((ndo, "[|sll]"));
return (caplen);
}
sllp = (const struct sll_header *)p;
if (ndo->ndo_eflag)
sll_print(ndo, sllp, length);
/*
* Go past the cooked-mode header.
*/
length -= SLL_HDR_LEN;
caplen -= SLL_HDR_LEN;
p += SLL_HDR_LEN;
hdrlen = SLL_HDR_LEN;
ether_type = EXTRACT_16BITS(&sllp->sll_protocol);
recurse:
/*
* Is it (gag) an 802.3 encapsulation, or some non-Ethernet
* packet type?
*/
if (ether_type <= ETHERMTU) {
/*
* Yes - what type is it?
*/
switch (ether_type) {
case LINUX_SLL_P_802_3:
/*
* Ethernet_802.3 IPX frame.
*/
ipx_print(ndo, p, length);
break;
case LINUX_SLL_P_802_2:
/*
* 802.2.
* Try to print the LLC-layer header & higher layers.
*/
llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
if (llc_hdrlen < 0)
goto unknown; /* unknown LLC type */
hdrlen += llc_hdrlen;
break;
default:
/*FALLTHROUGH*/
unknown:
/* packet type not known, print raw packet */
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
break;
}
} else if (ether_type == ETHERTYPE_8021Q) {
/*
* Print VLAN information, and then go back and process
* the enclosed type field.
*/
if (caplen < 4) {
ND_PRINT((ndo, "[|vlan]"));
return (hdrlen + caplen);
}
if (length < 4) {
ND_PRINT((ndo, "[|vlan]"));
return (hdrlen + length);
}
if (ndo->ndo_eflag) {
uint16_t tag = EXTRACT_16BITS(p);
ND_PRINT((ndo, "%s, ", ieee8021q_tci_string(tag)));
}
ether_type = EXTRACT_16BITS(p + 2);
if (ether_type <= ETHERMTU)
ether_type = LINUX_SLL_P_802_2;
if (!ndo->ndo_qflag) {
ND_PRINT((ndo, "ethertype %s, ",
tok2str(ethertype_values, "Unknown", ether_type)));
}
p += 4;
length -= 4;
caplen -= 4;
hdrlen += 4;
goto recurse;
} else {
if (ethertype_print(ndo, ether_type, p, length, caplen) == 0) {
/* ether_type not known, print raw packet */
if (!ndo->ndo_eflag)
sll_print(ndo, sllp, length + SLL_HDR_LEN);
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
}
}
return (hdrlen);
}
