static void
init(void)
{
struct hostent *addr;
char *eth_addr;
if ((addr=gethostbyname(host)) == NULL) {
perror("bad hostname");
exit(1);
}
memcpy((char*)&ip_dstaddr, addr->h_addr, addr->h_length);
if ((addr=gethostbyname(myhost)) == NULL) {
perror("bad local hostname");
exit(1);
}
memcpy((char*)&ip_myaddr, addr->h_addr, addr->h_length);
eth_addr = get_ether_from_ip((char *)&ip_dstaddr, 1);
memcpy(ð_dstaddr, eth_addr, 6);
eth_addr = get_ether_from_ip((char *)&ip_myaddr, 1);
memcpy(ð_myaddr, eth_addr, 6);
printf("me: %x ", ip_myaddr);
ip_print((char *)&ip_myaddr);
eth_print((char *)ð_myaddr);
printf("dst: %x ", ip_dstaddr);
ip_print((char *)&ip_dstaddr);
eth_print((char *)ð_dstaddr);
fflush(stdout);
}
u_int
juniper_mfr_print(netdissect_options *ndo,
const struct pcap_pkthdr *h, register const u_char *p)
{
struct juniper_l2info_t l2info;
l2info.pictype = DLT_JUNIPER_MFR;
if (juniper_parse_header(ndo, p, h, &l2info) == 0)
return l2info.header_len;
p+=l2info.header_len;
/* child-link ? */
if (l2info.cookie_len == 0) {
mfr_print(ndo, p, l2info.length);
return l2info.header_len;
}
/* first try the LSQ protos */
if (l2info.cookie_len == AS_PIC_COOKIE_LEN) {
switch(l2info.proto) {
case JUNIPER_LSQ_L3_PROTO_IPV4:
ip_print(ndo, p, l2info.length);
return l2info.header_len;
#ifdef INET6
case JUNIPER_LSQ_L3_PROTO_IPV6:
ip6_print(ndo, p,l2info.length);
return l2info.header_len;
#endif
case JUNIPER_LSQ_L3_PROTO_MPLS:
mpls_print(ndo, p, l2info.length);
return l2info.header_len;
case JUNIPER_LSQ_L3_PROTO_ISO:
isoclns_print(ndo, p, l2info.length, l2info.caplen);
return l2info.header_len;
default:
break;
}
return l2info.header_len;
}
/* suppress Bundle-ID if frame was captured on a child-link */
if (ndo->ndo_eflag && EXTRACT_32BITS(l2info.cookie) != 1)
ND_PRINT((ndo, "Bundle-ID %u, ", l2info.bundle));
switch (l2info.proto) {
case (LLCSAP_ISONS<<8 | LLCSAP_ISONS):
isoclns_print(ndo, p + 1, l2info.length - 1, l2info.caplen - 1);
break;
case (LLC_UI<<8 | NLPID_Q933):
case (LLC_UI<<8 | NLPID_IP):
case (LLC_UI<<8 | NLPID_IP6):
/* pass IP{4,6} to the OSI layer for proper link-layer printing */
isoclns_print(ndo, p - 1, l2info.length + 1, l2info.caplen + 1);
break;
default:
ND_PRINT((ndo, "unknown protocol 0x%04x, length %u", l2info.proto, l2info.length));
}
return l2info.header_len;
}
u_int
sl_if_print(const struct pcap_pkthdr *h, const u_char *p)
{
register u_int caplen = h->caplen;
register u_int length = h->len;
register const struct ip *ip;
if (caplen < SLIP_HDRLEN) {
printf("[|slip]");
return (caplen);
}
length -= SLIP_HDRLEN;
ip = (struct ip *)(p + SLIP_HDRLEN);
if (eflag)
sliplink_print(p, ip, length);
switch (IP_V(ip)) {
case 4:
ip_print(gndo, (u_char *)ip, length);
break;
#ifdef INET6
case 6:
ip6_print((u_char *)ip, length);
break;
#endif
default:
printf ("ip v%d", IP_V(ip));
}
return (SLIP_HDRLEN);
}
void
raw_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
{
u_int length = h->len;
u_int caplen = h->caplen;
ts_print(&h->ts);
/*
* Some printers want to get back at the link level addresses,
* and/or check that they're not walking off the end of the packet.
* Rather than pass them all the way down, we set these globals.
*/
packetp = p;
snapend = p + caplen;
if (eflag)
printf("ip: ");
ip_print(p, length);
if (xflag)
default_print(p, caplen);
putchar('\n');
}
static int
arcnet_encap_print(netdissect_options *ndo, u_char arctype, const u_char *p,
u_int length, u_int caplen)
{
switch (arctype) {
case ARCTYPE_IP_OLD:
case ARCTYPE_IP:
ip_print(ndo, p, length);
return (1);
case ARCTYPE_INET6:
ip6_print(ndo, p, length);
return (1);
case ARCTYPE_ARP_OLD:
case ARCTYPE_ARP:
case ARCTYPE_REVARP:
arp_print(ndo, p, length, caplen);
return (1);
case ARCTYPE_ATALK: /* XXX was this ever used? */
if (ndo->ndo_vflag)
ND_PRINT("et1 ");
atalk_print(ndo, p, length);
return (1);
case ARCTYPE_IPX:
ipx_print(ndo, p, length);
return (1);
default:
return (0);
}
}
u_int
sl_if_print(netdissect_options *ndo,
const struct pcap_pkthdr *h, const u_char *p)
{
register u_int caplen = h->caplen;
register u_int length = h->len;
register const struct ip *ip;
if (caplen < SLIP_HDRLEN || length < SLIP_HDRLEN) {
ND_PRINT((ndo, "%s", tstr));
return (caplen);
}
length -= SLIP_HDRLEN;
ip = (struct ip *)(p + SLIP_HDRLEN);
if (ndo->ndo_eflag)
sliplink_print(ndo, p, ip, length);
switch (IP_V(ip)) {
case 4:
ip_print(ndo, (u_char *)ip, length);
break;
case 6:
ip6_print(ndo, (u_char *)ip, length);
break;
default:
ND_PRINT((ndo, "ip v%d", IP_V(ip)));
}
return (SLIP_HDRLEN);
}
u_int
sl_bsdos_if_print(netdissect_options *ndo,
const struct pcap_pkthdr *h, const u_char *p)
{
register u_int caplen = h->caplen;
register u_int length = h->len;
register const struct ip *ip;
if (caplen < SLIP_HDRLEN) {
ND_PRINT((ndo, "%s", tstr));
return (caplen);
}
length -= SLIP_HDRLEN;
ip = (struct ip *)(p + SLIP_HDRLEN);
#ifdef notdef
if (ndo->ndo_eflag)
sliplink_print(ndo, p, ip, length);
#endif
ip_print(ndo, (u_char *)ip, length);
return (SLIP_HDRLEN);
}
void
sl_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
{
register u_int caplen = h->caplen;
register u_int length = h->len;
register const struct ip *ip;
ts_print(&h->ts);
if (caplen < SLIP_HDRLEN) {
printf("[|slip]");
goto out;
}
/*
* Some printers want to get back at the link level addresses,
* and/or check that they're not walking off the end of the packet.
* Rather than pass them all the way down, we set these globals.
*/
packetp = p;
snapend = p + caplen;
length -= SLIP_HDRLEN;
ip = (struct ip *)(p + SLIP_HDRLEN);
if (eflag)
sliplink_print(p, ip, length);
ip_print((u_char *)ip, length);
if (xflag)
default_print((u_char *)ip, caplen - SLIP_HDRLEN);
out:
putchar('\n');
}
u_int
cip_if_print(const struct pcap_pkthdr *h, const u_char *p)
{
u_int caplen = h->caplen;
u_int length = h->len;
u_short extracted_ethertype;
if (memcmp(rfcllc, p, sizeof(rfcllc))==0 && caplen < RFC1483LLC_LEN) {
printf("[|cip]");
return (0);
}
if (eflag)
cip_print(length);
if (memcmp(rfcllc, p, sizeof(rfcllc)) == 0) {
if (llc_print(p, length, caplen, NULL, NULL,
&extracted_ethertype) == 0) {
if (!eflag)
cip_print(length);
if (extracted_ethertype) {
printf("(LLC %s) ",
etherproto_string(htons(extracted_ethertype)));
}
if (!suppress_default_print)
default_print(p, caplen);
}
} else {
ip_print(gndo, p, length);
}
return (0);
}
/* PPP */
static void
handle_ppp(netdissect_options *ndo,
u_int proto, const u_char *p, int length)
{
if ((proto & 0xff00) == 0x7e00) { /* is this an escape code ? */
ppp_hdlc(ndo, p - 1, length);
return;
}
switch (proto) {
case PPP_LCP: /* fall through */
case PPP_IPCP:
case PPP_OSICP:
case PPP_MPLSCP:
case PPP_IPV6CP:
case PPP_CCP:
case PPP_BACP:
handle_ctrl_proto(ndo, proto, p, length);
break;
case PPP_ML:
handle_mlppp(ndo, p, length);
break;
case PPP_CHAP:
handle_chap(ndo, p, length);
break;
case PPP_PAP:
handle_pap(ndo, p, length);
break;
case PPP_BAP: /* XXX: not yet completed */
handle_bap(ndo, p, length);
break;
case ETHERTYPE_IP: /*XXX*/
case PPP_VJNC:
case PPP_IP:
ip_print(ndo, p, length);
break;
case ETHERTYPE_IPV6: /*XXX*/
case PPP_IPV6:
ip6_print(ndo, p, length);
break;
case ETHERTYPE_IPX: /*XXX*/
case PPP_IPX:
ipx_print(ndo, p, length);
break;
case PPP_OSI:
isoclns_print(ndo, p, length, length);
break;
case PPP_MPLS_UCAST:
case PPP_MPLS_MCAST:
mpls_print(ndo, p, length);
break;
case PPP_COMP:
ND_PRINT((ndo, "compressed PPP data"));
break;
default:
ND_PRINT((ndo, "%s ", tok2str(ppptype2str, "unknown PPP protocol (0x%04x)", proto)));
print_unknown_data(ndo, p, "\n\t", length);
break;
}
}
u_int
sl_bsdos_if_print(const struct pcap_pkthdr *h, const u_char *p)
{
register u_int caplen = h->caplen;
register u_int length = h->len;
register const struct ip *ip;
if (caplen < SLIP_HDRLEN) {
printf("[|slip]");
return (caplen);
}
length -= SLIP_HDRLEN;
ip = (struct ip *)(p + SLIP_HDRLEN);
#ifdef notdef
if (eflag)
sliplink_print(p, ip, length);
#endif
ip_print(gndo, (u_char *)ip, length);
return (SLIP_HDRLEN);
}
u_int
enc_if_print(const struct pcap_pkthdr *h, register const u_char *p)
{
register u_int length = h->len;
register u_int caplen = h->caplen;
int flags;
const struct enchdr *hdr;
if (caplen < ENC_HDRLEN) {
printf("[|enc]");
goto out;
}
hdr = (struct enchdr *)p;
flags = hdr->flags;
if (flags == 0)
printf("(unprotected): ");
else
printf("(");
ENC_PRINT_TYPE(flags, M_AUTH, "authentic");
ENC_PRINT_TYPE(flags, M_CONF, "confidential");
printf("SPI 0x%08x: ", (u_int32_t)ntohl(hdr->spi));
length -= ENC_HDRLEN;
ip_print(gndo, p + ENC_HDRLEN, length);
out:
return (ENC_HDRLEN);
}
u_int
juniper_mfr_print(const struct pcap_pkthdr *h, packetbody_t p)
{
struct juniper_l2info_t l2info;
l2info.pictype = DLT_JUNIPER_MFR;
if(juniper_parse_header(p, h, &l2info) == 0)
return l2info.header_len;
p+=l2info.header_len;
/* child-link ? */
if (l2info.cookie_len == 0) {
mfr_print(p,l2info.length);
return l2info.header_len;
}
/* first try the LSQ protos */
if (l2info.cookie_len == AS_PIC_COOKIE_LEN) {
switch(l2info.proto) {
case JUNIPER_LSQ_L3_PROTO_IPV4:
ip_print(gndo, p, l2info.length);
return l2info.header_len;
#ifdef INET6
case JUNIPER_LSQ_L3_PROTO_IPV6:
ip6_print(gndo, p,l2info.length);
return l2info.header_len;
#endif
case JUNIPER_LSQ_L3_PROTO_MPLS:
mpls_print(p,l2info.length);
return l2info.header_len;
case JUNIPER_LSQ_L3_PROTO_ISO:
isoclns_print(p,l2info.length,l2info.caplen);
return l2info.header_len;
default:
break;
}
return l2info.header_len;
}
/* suppress Bundle-ID if frame was captured on a child-link */
if (eflag && EXTRACT_32BITS(cheri_ptr(l2info.cookie, 4)) != 1) printf("Bundle-ID %u, ",l2info.bundle);
switch (l2info.proto) {
case (LLCSAP_ISONS<<8 | LLCSAP_ISONS):
isoclns_print(p+1, l2info.length-1, l2info.caplen-1);
break;
case (LLC_UI<<8 | NLPID_Q933):
case (LLC_UI<<8 | NLPID_IP):
case (LLC_UI<<8 | NLPID_IP6):
/* pass IP{4,6} to the OSI layer for proper link-layer printing */
isoclns_print(PACKET_SUBTRACT(p, 1), l2info.length+1,
l2info.caplen+1);
break;
default:
printf("unknown protocol 0x%04x, length %u",l2info.proto, l2info.length);
}
return l2info.header_len;
}
u_int
juniper_mlppp_print(netdissect_options *ndo,
const struct pcap_pkthdr *h, register const u_char *p)
{
struct juniper_l2info_t l2info;
l2info.pictype = DLT_JUNIPER_MLPPP;
if (juniper_parse_header(ndo, p, h, &l2info) == 0)
return l2info.header_len;
/* suppress Bundle-ID if frame was captured on a child-link
* best indicator if the cookie looks like a proto */
if (ndo->ndo_eflag &&
EXTRACT_16BITS(&l2info.cookie) != PPP_OSI &&
EXTRACT_16BITS(&l2info.cookie) != (PPP_ADDRESS << 8 | PPP_CONTROL))
ND_PRINT((ndo, "Bundle-ID %u: ", l2info.bundle));
p+=l2info.header_len;
/* first try the LSQ protos */
switch(l2info.proto) {
case JUNIPER_LSQ_L3_PROTO_IPV4:
/* IP traffic going to the RE would not have a cookie
* -> this must be incoming IS-IS over PPP
*/
if (l2info.cookie[4] == (JUNIPER_LSQ_COOKIE_RE|JUNIPER_LSQ_COOKIE_DIR))
ppp_print(ndo, p, l2info.length);
else
ip_print(ndo, p, l2info.length);
return l2info.header_len;
#ifdef INET6
case JUNIPER_LSQ_L3_PROTO_IPV6:
ip6_print(ndo, p,l2info.length);
return l2info.header_len;
#endif
case JUNIPER_LSQ_L3_PROTO_MPLS:
mpls_print(ndo, p, l2info.length);
return l2info.header_len;
case JUNIPER_LSQ_L3_PROTO_ISO:
isoclns_print(ndo, p, l2info.length, l2info.caplen);
return l2info.header_len;
default:
break;
}
/* zero length cookie ? */
switch (EXTRACT_16BITS(&l2info.cookie)) {
case PPP_OSI:
ppp_print(ndo, p - 2, l2info.length + 2);
break;
case (PPP_ADDRESS << 8 | PPP_CONTROL): /* fall through */
default:
ppp_print(ndo, p, l2info.length);
break;
}
return l2info.header_len;
}
u_int
juniper_mfr_print(const struct pcap_pkthdr *h, register const u_char *p)
{
struct juniper_l2info_t l2info;
l2info.pictype = DLT_JUNIPER_MFR;
if(juniper_parse_header(p, h, &l2info) == 0)
return l2info.header_len;
p+=l2info.header_len;
if (l2info.cookie_len == 0) {
mfr_print(p,l2info.length);
return l2info.header_len;
}
if (l2info.cookie_len == AS_PIC_COOKIE_LEN) {
switch(l2info.proto) {
case JUNIPER_LSQ_L3_PROTO_IPV4:
ip_print(gndo, p, l2info.length);
return l2info.header_len;
#ifdef INET6
case JUNIPER_LSQ_L3_PROTO_IPV6:
ip6_print(p,l2info.length);
return l2info.header_len;
#endif
case JUNIPER_LSQ_L3_PROTO_MPLS:
mpls_print(p,l2info.length);
return l2info.header_len;
case JUNIPER_LSQ_L3_PROTO_ISO:
isoclns_print(p,l2info.length,l2info.caplen);
return l2info.header_len;
default:
break;
}
return l2info.header_len;
}
if (eflag && EXTRACT_32BITS(l2info.cookie) != 1) printf("Bundle-ID %u, ",l2info.bundle);
switch (l2info.proto) {
case (LLCSAP_ISONS<<8 | LLCSAP_ISONS):
isoclns_print(p+1, l2info.length-1, l2info.caplen-1);
break;
case (LLC_UI<<8 | NLPID_Q933):
case (LLC_UI<<8 | NLPID_IP):
case (LLC_UI<<8 | NLPID_IP6):
isoclns_print(p-1, l2info.length+1, l2info.caplen+1);
break;
default:
printf("unknown protocol 0x%04x, length %u",l2info.proto, l2info.length);
}
return l2info.header_len;
}
void icmps_time_exceeded(TCPIPS* tcpips, uint8_t code, IO* original, const IP* dst)
{
#if (ICMP_DEBUG)
printf("ICMP: Time exceeded(%d) to ", code);
ip_print(dst);
printf("\n");
#endif
icmps_control_prepare(tcpips, ICMP_CMD_TIME_EXCEEDED, code, original);
icmps_tx(tcpips, original, dst);
}
u_int
chdlc_print(register const u_char *p, u_int length) {
u_int proto;
proto = EXTRACT_16BITS(&p[2]);
if (eflag) {
printf("%s, ethertype %s (0x%04x), length %u: ",
tok2str(chdlc_cast_values, "0x%02x", p[0]),
tok2str(ethertype_values, "Unknown", proto),
proto,
length);
}
length -= CHDLC_HDRLEN;
p += CHDLC_HDRLEN;
switch (proto) {
case ETHERTYPE_IP:
ip_print(gndo, p, length);
break;
#ifdef INET6
case ETHERTYPE_IPV6:
ip6_print(p, length);
break;
#endif
case CHDLC_TYPE_SLARP:
chdlc_slarp_print(p, length);
break;
#if 0
case CHDLC_TYPE_CDP:
chdlc_cdp_print(p, length);
break;
#endif
case ETHERTYPE_MPLS:
case ETHERTYPE_MPLS_MULTI:
mpls_print(p, length);
break;
case ETHERTYPE_ISO:
/* is the fudge byte set ? lets verify by spotting ISO headers */
if (*(p+1) == 0x81 ||
*(p+1) == 0x82 ||
*(p+1) == 0x83)
isoclns_print(p+1, length-1, length-1);
else
isoclns_print(p, length, length);
break;
default:
if (!eflag)
printf("unknown CHDLC protocol (0x%04x)", proto);
break;
}
return (CHDLC_HDRLEN);
}
void icmps_parameter_problem(TCPIPS* tcpips, uint8_t offset, IO* original, const IP* dst)
{
#if (ICMP_DEBUG)
printf("ICMP: Parameter problem(%d) to ", offset);
ip_print(dst);
printf("\n");
#endif
icmps_control_prepare(tcpips, ICMP_CMD_PARAMETER_PROBLEM, 0, original);
((uint8_t*)io_data(original))[4] = offset;
icmps_tx(tcpips, original, dst);
}
static inline void icmps_rx_echo(TCPIPS* tcpips, IO* io, IP* src)
{
ICMP_HEADER_ID_SEQ* icmp = io_data(io);
#if (ICMP_DEBUG)
printf("ICMP: ECHO from ");
ip_print(src);
printf("\n");
#endif
icmp->type = ICMP_CMD_ECHO_REPLY;
icmps_tx(tcpips, io, src);
}
void
vxlan_gpe_print(netdissect_options *ndo, const u_char *bp, u_int len)
{
uint8_t flags;
uint8_t next_protocol;
uint32_t vni;
if (len < VXLAN_GPE_HDR_LEN)
goto trunc;
ND_TCHECK2(*bp, VXLAN_GPE_HDR_LEN);
flags = *bp;
bp += 3;
next_protocol = *bp;
bp += 1;
vni = EXTRACT_24BITS(bp);
bp += 4;
ND_PRINT((ndo, "VXLAN-GPE, "));
ND_PRINT((ndo, "flags [%s], ",
bittok2str_nosep(vxlan_gpe_flags, "none", flags)));
ND_PRINT((ndo, "vni %u", vni));
ND_PRINT((ndo, ndo->ndo_vflag ? "\n " : ": "));
switch (next_protocol) {
case 0x1:
ip_print(ndo, bp, len - 8);
break;
case 0x2:
ip6_print(ndo, bp, len - 8);
break;
case 0x3:
ether_print(ndo, bp, len - 8, len - 8, NULL, NULL);
break;
case 0x4:
nsh_print(ndo, bp, len - 8);
break;
case 0x5:
mpls_print(ndo, bp, len - 8);
break;
default:
ND_PRINT((ndo, "ERROR: unknown-next-protocol"));
return;
}
return;
trunc:
ND_PRINT((ndo, "%s", tstr));
}
u_int
juniper_mlppp_print(const struct pcap_pkthdr *h, register const u_char *p)
{
struct juniper_l2info_t l2info;
l2info.pictype = DLT_JUNIPER_MLPPP;
if(juniper_parse_header(p, h, &l2info) == 0)
return l2info.header_len;
if (eflag &&
EXTRACT_16BITS(&l2info.cookie) != PPP_OSI &&
EXTRACT_16BITS(&l2info.cookie) != (PPP_ADDRESS << 8 | PPP_CONTROL))
printf("Bundle-ID %u: ",l2info.bundle);
p+=l2info.header_len;
switch(l2info.proto) {
case JUNIPER_LSQ_L3_PROTO_IPV4:
if (l2info.cookie[4] == (JUNIPER_LSQ_COOKIE_RE|JUNIPER_LSQ_COOKIE_DIR))
ppp_print(p, l2info.length);
else
ip_print(gndo, p, l2info.length);
return l2info.header_len;
#ifdef INET6
case JUNIPER_LSQ_L3_PROTO_IPV6:
ip6_print(p,l2info.length);
return l2info.header_len;
#endif
case JUNIPER_LSQ_L3_PROTO_MPLS:
mpls_print(p,l2info.length);
return l2info.header_len;
case JUNIPER_LSQ_L3_PROTO_ISO:
isoclns_print(p,l2info.length,l2info.caplen);
return l2info.header_len;
default:
break;
}
switch (EXTRACT_16BITS(&l2info.cookie)) {
case PPP_OSI:
ppp_print(p-2,l2info.length+2);
break;
case (PPP_ADDRESS << 8 | PPP_CONTROL):
default:
ppp_print(p,l2info.length);
break;
}
return l2info.header_len;
}
/*
* Decoding routines for GTP version 0.
*/
void
gtp_v0_print(const u_char *cp, u_int length, u_short sport, u_short dport)
{
struct gtp_v0_hdr *gh = (struct gtp_v0_hdr *)cp;
int len, version;
u_int64_t tid;
gtp_proto = GTP_V0_PROTO;
/* Check if this is GTP prime. */
TCHECK(gh->flags);
if ((gh->flags & GTPV0_HDR_PROTO_TYPE) == 0) {
gtp_proto = GTP_V0_PRIME_PROTO;
gtp_v0_print_prime(cp);
return;
}
/* Print GTP header. */
TCHECK(*gh);
cp += sizeof(struct gtp_v0_hdr);
len = ntohs(gh->length);
bcopy(&gh->tid, &tid, sizeof(tid));
printf(" GTPv0 (len %u, seqno %u, flow %u, N-PDU %u, tid 0x%llx) ",
ntohs(gh->length), ntohs(gh->seqno), ntohs(gh->flow),
ntohs(gh->npduno), betoh64(tid));
/* Decode GTP message. */
printf("%s", tok2str(gtp_v0_msgtype, "Message Type %u", gh->msgtype));
if (!vflag)
return;
if (gh->msgtype == GTPV0_T_PDU) {
TCHECK(cp[0]);
version = cp[0] >> 4;
printf(" { ");
if (version == 4)
ip_print(cp, len);
#ifdef INET6
else if (version == 6)
ip6_print(cp, len);
#endif
else
printf("Unknown IP version %u", version);
printf(" }");
} else
static inline void icmps_rx_echo_reply(TCPIPS* tcpips, IO* io, IP* src)
{
ICMP_HEADER_ID_SEQ* icmp = io_data(io);
#if (ICMP_DEBUG)
printf("ICMP: ECHO REPLY from ");
ip_print(src);
printf("\n");
#endif
//compare src, sequence, id and data. Maybe asynchronous response from failed request
if ((tcpips->icmps.echo_ip.u32.ip != src->u32.ip) || (tcpips->icmps.id != be2short(icmp->id_be)) || (tcpips->icmps.seq != be2short(icmp->seq_be)))
{
ips_release_io(tcpips, io);
return;
}
icmps_echo_complete(tcpips, (memcmp(((uint8_t*)io_data(io)) + sizeof(ICMP_HEADER), __ICMP_DATA_MAGIC, ICMP_DATA_MAGIC_SIZE)) ? ERROR_CRC : ERROR_OK);
}
u_int
juniper_ggsn_print(netdissect_options *ndo,
const struct pcap_pkthdr *h, register const u_char *p)
{
struct juniper_l2info_t l2info;
struct juniper_ggsn_header {
uint8_t svc_id;
uint8_t flags_len;
uint8_t proto;
uint8_t flags;
uint8_t vlan_id[2];
uint8_t res[2];
};
const struct juniper_ggsn_header *gh;
l2info.pictype = DLT_JUNIPER_GGSN;
if (juniper_parse_header(ndo, p, h, &l2info) == 0)
return l2info.header_len;
p+=l2info.header_len;
gh = (struct juniper_ggsn_header *)&l2info.cookie;
if (ndo->ndo_eflag) {
ND_PRINT((ndo, "proto %s (%u), vlan %u: ",
tok2str(juniper_protocol_values,"Unknown",gh->proto),
gh->proto,
EXTRACT_16BITS(&gh->vlan_id[0])));
}
switch (gh->proto) {
case JUNIPER_PROTO_IPV4:
ip_print(ndo, p, l2info.length);
break;
#ifdef INET6
case JUNIPER_PROTO_IPV6:
ip6_print(ndo, p, l2info.length);
break;
#endif /* INET6 */
default:
if (!ndo->ndo_eflag)
ND_PRINT((ndo, "unknown GGSN proto (%u)", gh->proto));
}
return l2info.header_len;
}
void icmps_rx(TCPIPS* tcpips, IO *io, IP* src)
{
ICMP_HEADER* icmp = io_data(io);
//drop broken ICMP without control, because ICMP is control protocol itself
if (io->data_size < sizeof(ICMP_HEADER))
{
ips_release_io(tcpips, io);
return;
}
if (ip_checksum(io_data(io), io->data_size))
{
ips_release_io(tcpips, io);
return;
}
switch (icmp->type)
{
case ICMP_CMD_ECHO_REPLY:
icmps_rx_echo_reply(tcpips, io, src);
break;
#if (ICMP_ECHO)
case ICMP_CMD_ECHO:
icmps_rx_echo(tcpips, io, src);
break;
#endif
case ICMP_CMD_DESTINATION_UNREACHABLE:
icmps_rx_destination_unreachable(tcpips, io);
break;
case ICMP_CMD_TIME_EXCEEDED:
icmps_rx_time_exceeded(tcpips, io);
break;
case ICMP_CMD_PARAMETER_PROBLEM:
icmps_rx_parameter_problem(tcpips, io);
break;
default:
#if (ICMP_DEBUG)
printf("ICMP: unhandled type %d from ", icmp->type);
ip_print(src);
printf("\n");
#endif
ips_release_io(tcpips, io);
break;
}
}
u_int
juniper_ggsn_print(const struct pcap_pkthdr *h, packetbody_t p)
{
struct juniper_l2info_t l2info;
struct juniper_ggsn_header {
u_int8_t svc_id;
u_int8_t flags_len;
u_int8_t proto;
u_int8_t flags;
u_int8_t vlan_id[2];
u_int8_t res[2];
};
__capability const struct juniper_ggsn_header *gh;
l2info.pictype = DLT_JUNIPER_GGSN;
if(juniper_parse_header(p, h, &l2info) == 0)
return l2info.header_len;
p+=l2info.header_len;
gh = (__capability const struct juniper_ggsn_header *)&l2info.cookie;
if (eflag) {
printf("proto %s (%u), vlan %u: ",
tok2str(juniper_protocol_values,"Unknown",gh->proto),
gh->proto,
EXTRACT_16BITS(&gh->vlan_id[0]));
}
switch (gh->proto) {
case JUNIPER_PROTO_IPV4:
ip_print(gndo, p, l2info.length);
break;
#ifdef INET6
case JUNIPER_PROTO_IPV6:
ip6_print(gndo, p, l2info.length);
break;
#endif /* INET6 */
default:
if (!eflag)
printf("unknown GGSN proto (%u)", gh->proto);
}
return l2info.header_len;
}
static int
ip_heuristic_guess(netdissect_options *ndo,
register const u_char *p, u_int length) {
switch(p[0]) {
case 0x45:
case 0x46:
case 0x47:
case 0x48:
case 0x49:
case 0x4a:
case 0x4b:
case 0x4c:
case 0x4d:
case 0x4e:
case 0x4f:
ip_print(ndo, p, length);
break;
#ifdef INET6
case 0x60:
case 0x61:
case 0x62:
case 0x63:
case 0x64:
case 0x65:
case 0x66:
case 0x67:
case 0x68:
case 0x69:
case 0x6a:
case 0x6b:
case 0x6c:
case 0x6d:
case 0x6e:
case 0x6f:
ip6_print(ndo, p, length);
break;
#endif
default:
return 0; /* did not find a ip header */
break;
}
return 1; /* we printed an v4/v6 packet */
}
/*
* This is the top level routine of the printer. 'p' points
* to the LLC/SNAP or raw header of the packet, 'h->ts' is the timestamp,
* 'h->len' is the length of the packet off the wire, and 'h->caplen'
* is the number of bytes actually captured.
*/
u_int
cip_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
{
u_int caplen = h->caplen;
u_int length = h->len;
size_t cmplen;
int llc_hdrlen;
ndo->ndo_protocol = "cip_if";
cmplen = sizeof(rfcllc);
if (cmplen > caplen)
cmplen = caplen;
if (cmplen > length)
cmplen = length;
if (ndo->ndo_eflag)
cip_print(ndo, length);
if (cmplen == 0) {
ND_PRINT("[|cip]");
return 0;
}
if (memcmp(rfcllc, p, cmplen) == 0) {
/*
* LLC header is present. Try to print it & higher layers.
*/
llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
if (llc_hdrlen < 0) {
/* packet type not known, print raw packet */
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
llc_hdrlen = -llc_hdrlen;
}
} else {
/*
* LLC header is absent; treat it as just IP.
*/
llc_hdrlen = 0;
ip_print(ndo, p, length);
}
return (llc_hdrlen);
}
int
ip_heuristic_guess(register const u_char *p, u_int length) {
switch(p[0]) {
case 0x45:
case 0x46:
case 0x47:
case 0x48:
case 0x49:
case 0x4a:
case 0x4b:
case 0x4c:
case 0x4d:
case 0x4e:
case 0x4f:
ip_print(gndo, p, length);
break;
#ifdef INET6
case 0x60:
case 0x61:
case 0x62:
case 0x63:
case 0x64:
case 0x65:
case 0x66:
case 0x67:
case 0x68:
case 0x69:
case 0x6a:
case 0x6b:
case 0x6c:
case 0x6d:
case 0x6e:
case 0x6f:
ip6_print(p, length);
break;
#endif
default:
return 0;
break;
}
return 1;
}
int
ip_heuristic_guess(packetbody_t p, u_int length) {
switch(p[0]) {
case 0x45:
case 0x46:
case 0x47:
case 0x48:
case 0x49:
case 0x4a:
case 0x4b:
case 0x4c:
case 0x4d:
case 0x4e:
case 0x4f:
ip_print(gndo, p, length);
break;
#ifdef INET6
case 0x60:
case 0x61:
case 0x62:
case 0x63:
case 0x64:
case 0x65:
case 0x66:
case 0x67:
case 0x68:
case 0x69:
case 0x6a:
case 0x6b:
case 0x6c:
case 0x6d:
case 0x6e:
case 0x6f:
ip6_print(gndo, p, length);
break;
#endif
default:
return 0; /* did not find a ip header */
break;
}
return 1; /* we printed an v4/v6 packet */
}
