void
gre_print_0(const u_char *bp, u_int length)
{
u_int len = length;
u_int16_t flags, prot;
flags = EXTRACT_16BITS(bp);
if (vflag)
printf(", Flags [%s]",
bittok2str(gre_flag_values,"none",flags));
len -= 2;
bp += 2;
if (len < 2)
goto trunc;
prot = EXTRACT_16BITS(bp);
len -= 2;
bp += 2;
if ((flags & GRE_CP) | (flags & GRE_RP)) {
if (len < 2)
goto trunc;
if (vflag)
printf(", sum 0x%x", EXTRACT_16BITS(bp));
bp += 2;
len -= 2;
if (len < 2)
goto trunc;
printf(", off 0x%x", EXTRACT_16BITS(bp));
bp += 2;
len -= 2;
}
if (flags & GRE_KP) {
if (len < 4)
goto trunc;
printf(", key=0x%x", EXTRACT_32BITS(bp));
bp += 4;
len -= 4;
}
if (flags & GRE_SP) {
if (len < 4)
goto trunc;
printf(", seq %u", EXTRACT_32BITS(bp));
bp += 4;
len -= 4;
}
if (flags & GRE_RP) {
for (;;) {
u_int16_t af;
u_int8_t sreoff;
u_int8_t srelen;
if (len < 4)
goto trunc;
af = EXTRACT_16BITS(bp);
sreoff = *(bp + 2);
srelen = *(bp + 3);
bp += 4;
len -= 4;
if (af == 0 && srelen == 0)
break;
gre_sre_print(af, sreoff, srelen, bp, len);
if (len < srelen)
goto trunc;
bp += srelen;
len -= srelen;
}
}
if (eflag)
printf(", proto %s (0x%04x)",
tok2str(ethertype_values,"unknown",prot),
prot);
printf(", length %u",length);
if (vflag < 1)
printf(": "); /* put in a colon as protocol demarc */
else
printf("\n\t"); /* if verbose go multiline */
switch (prot) {
case ETHERTYPE_IP:
ip_print(gndo, bp, len);
break;
#ifdef INET6
case ETHERTYPE_IPV6:
ip6_print(bp, len);
break;
#endif
case ETHERTYPE_MPLS:
mpls_print(bp, len);
break;
case ETHERTYPE_IPX:
ipx_print(bp, len);
break;
case ETHERTYPE_ATALK:
atalk_print(bp, len);
break;
case ETHERTYPE_GRE_ISO:
isoclns_print(bp, len, len);
break;
case ETHERTYPE_TEB:
ether_print(bp, len, len, NULL, NULL);
break;
default:
printf("gre-proto-0x%x", prot);
}
return;
trunc:
printf("[|gre]");
}
/*
* RFC3032: MPLS label stack encoding
*/
void
mpls_print(netdissect_options *ndo, const u_char *bp, u_int length)
{
const u_char *p;
uint32_t label_entry;
uint16_t label_stack_depth = 0;
enum mpls_packet_type pt = PT_UNKNOWN;
p = bp;
ND_PRINT((ndo, "MPLS"));
do {
ND_TCHECK2(*p, sizeof(label_entry));
label_entry = EXTRACT_32BITS(p);
ND_PRINT((ndo, "%s(label %u",
(label_stack_depth && ndo->ndo_vflag) ? "\n\t" : " ",
MPLS_LABEL(label_entry)));
label_stack_depth++;
if (ndo->ndo_vflag &&
MPLS_LABEL(label_entry) < sizeof(mpls_labelname) / sizeof(mpls_labelname[0]))
ND_PRINT((ndo, " (%s)", mpls_labelname[MPLS_LABEL(label_entry)]));
ND_PRINT((ndo, ", exp %u", MPLS_EXP(label_entry)));
if (MPLS_STACK(label_entry))
ND_PRINT((ndo, ", [S]"));
ND_PRINT((ndo, ", ttl %u)", MPLS_TTL(label_entry)));
p += sizeof(label_entry);
} while (!MPLS_STACK(label_entry));
/*
* Try to figure out the packet type.
*/
switch (MPLS_LABEL(label_entry)) {
case 0: /* IPv4 explicit NULL label */
case 3: /* IPv4 implicit NULL label */
pt = PT_IPV4;
break;
case 2: /* IPv6 explicit NULL label */
pt = PT_IPV6;
break;
default:
/*
* Generally there's no indication of protocol in MPLS label
* encoding.
*
* However, draft-hsmit-isis-aal5mux-00.txt describes a
* technique for encapsulating IS-IS and IP traffic on the
* same ATM virtual circuit; you look at the first payload
* byte to determine the network layer protocol, based on
* the fact that
*
* 1) the first byte of an IP header is 0x45-0x4f
* for IPv4 and 0x60-0x6f for IPv6;
*
* 2) the first byte of an OSI CLNP packet is 0x81,
* the first byte of an OSI ES-IS packet is 0x82,
* and the first byte of an OSI IS-IS packet is
* 0x83;
*
* so the network layer protocol can be inferred from the
* first byte of the packet, if the protocol is one of the
* ones listed above.
*
* Cisco sends control-plane traffic MPLS-encapsulated in
* this fashion.
*/
switch(*p) {
case 0x45:
case 0x46:
case 0x47:
case 0x48:
case 0x49:
case 0x4a:
case 0x4b:
case 0x4c:
case 0x4d:
case 0x4e:
case 0x4f:
pt = PT_IPV4;
break;
case 0x60:
case 0x61:
case 0x62:
case 0x63:
case 0x64:
case 0x65:
case 0x66:
case 0x67:
case 0x68:
case 0x69:
case 0x6a:
case 0x6b:
case 0x6c:
case 0x6d:
case 0x6e:
case 0x6f:
pt = PT_IPV6;
break;
case 0x81:
case 0x82:
case 0x83:
pt = PT_OSI;
break;
default:
/* ok bail out - we did not figure out what it is*/
break;
}
}
/*
* Print the payload.
*/
if (pt == PT_UNKNOWN) {
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, length - (p - bp));
return;
}
ND_PRINT((ndo, ndo->ndo_vflag ? "\n\t" : " "));
switch (pt) {
case PT_IPV4:
ip_print(ndo, p, length - (p - bp));
break;
case PT_IPV6:
ip6_print(ndo, p, length - (p - bp));
break;
case PT_OSI:
isoclns_print(ndo, p, length - (p - bp), length - (p - bp));
break;
default:
break;
}
return;
trunc:
ND_PRINT((ndo, "[|MPLS]"));
}
/*
* Returns non-zero IFF it succeeds in printing the header
*/
int
llc_print(const u_char *p, u_int length, u_int caplen,
const u_char *esrc, const u_char *edst, u_short *extracted_ethertype)
{
u_int8_t dsap_field, dsap, ssap_field, ssap;
u_int16_t control;
int is_u;
register int ret;
*extracted_ethertype = 0;
if (caplen < 3) {
(void)printf("[|llc]");
default_print((u_char *)p, caplen);
return(0);
}
dsap_field = *p;
ssap_field = *(p + 1);
/*
* OK, what type of LLC frame is this? The length
* of the control field depends on that - I frames
* have a two-byte control field, and U frames have
* a one-byte control field.
*/
control = *(p + 2);
if ((control & LLC_U_FMT) == LLC_U_FMT) {
/*
* U frame.
*/
is_u = 1;
} else {
/*
* The control field in I and S frames is
* 2 bytes...
*/
if (caplen < 4) {
(void)printf("[|llc]");
default_print((u_char *)p, caplen);
return(0);
}
/*
* ...and is little-endian.
*/
control = EXTRACT_LE_16BITS(p + 2);
is_u = 0;
}
if (ssap_field == LLCSAP_GLOBAL && dsap_field == LLCSAP_GLOBAL) {
/*
* This is an Ethernet_802.3 IPX frame; it has an
* 802.3 header (i.e., an Ethernet header where the
* type/length field is <= ETHERMTU, i.e. it's a length
* field, not a type field), but has no 802.2 header -
* the IPX packet starts right after the Ethernet header,
* with a signature of two bytes of 0xFF (which is
* LLCSAP_GLOBAL).
*
* (It might also have been an Ethernet_802.3 IPX at
* one time, but got bridged onto another network,
* such as an 802.11 network; this has appeared in at
* least one capture file.)
*/
if (eflag)
printf("IPX 802.3: ");
ipx_print(p, length);
return (1);
}
dsap = dsap_field & ~LLC_IG;
ssap = ssap_field & ~LLC_GSAP;
if (eflag) {
printf("LLC, dsap %s (0x%02x) %s, ssap %s (0x%02x) %s",
tok2str(llc_values, "Unknown", dsap),
dsap,
tok2str(llc_ig_flag_values, "Unknown", dsap_field & LLC_IG),
tok2str(llc_values, "Unknown", ssap),
ssap,
tok2str(llc_flag_values, "Unknown", ssap_field & LLC_GSAP));
if (is_u) {
printf(", ctrl 0x%02x: ", control);
} else {
printf(", ctrl 0x%04x: ", control);
}
}
if (ssap == LLCSAP_8021D && dsap == LLCSAP_8021D &&
control == LLC_UI) {
stp_print(p+3, length-3);
return (1);
}
if (ssap == LLCSAP_IP && dsap == LLCSAP_IP &&
control == LLC_UI) {
ip_print(gndo, p+4, length-4);
return (1);
}
if (ssap == LLCSAP_IPX && dsap == LLCSAP_IPX &&
control == LLC_UI) {
/*
* This is an Ethernet_802.2 IPX frame, with an 802.3
* header and an 802.2 LLC header with the source and
* destination SAPs being the IPX SAP.
*
* Skip DSAP, LSAP, and control field.
*/
if (eflag)
printf("IPX 802.2: ");
ipx_print(p+3, length-3);
return (1);
}
#ifdef TCPDUMP_DO_SMB
if (ssap == LLCSAP_NETBEUI && dsap == LLCSAP_NETBEUI
&& (!(control & LLC_S_FMT) || control == LLC_U_FMT)) {
/*
* we don't actually have a full netbeui parser yet, but the
* smb parser can handle many smb-in-netbeui packets, which
* is very useful, so we call that
*
* We don't call it for S frames, however, just I frames
* (which are frames that don't have the low-order bit,
* LLC_S_FMT, set in the first byte of the control field)
* and UI frames (whose control field is just 3, LLC_U_FMT).
*/
/*
* Skip the LLC header.
*/
if (is_u) {
p += 3;
length -= 3;
caplen -= 3;
} else {
p += 4;
length -= 4;
caplen -= 4;
}
netbeui_print(control, p, length);
return (1);
}
#endif
if (ssap == LLCSAP_ISONS && dsap == LLCSAP_ISONS
&& control == LLC_UI) {
isoclns_print(p + 3, length - 3, caplen - 3);
return (1);
}
if (ssap == LLCSAP_SNAP && dsap == LLCSAP_SNAP
&& control == LLC_UI) {
/*
* XXX - what *is* the right bridge pad value here?
* Does anybody ever bridge one form of LAN traffic
* over a networking type that uses 802.2 LLC?
*/
ret = snap_print(p+3, length-3, caplen-3, 2);
if (ret)
return (ret);
}
if (!eflag) {
if (ssap == dsap) {
if (esrc == NULL || edst == NULL)
(void)printf("%s ", tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
else
(void)printf("%s > %s %s ",
etheraddr_string(esrc),
etheraddr_string(edst),
tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
} else {
if (esrc == NULL || edst == NULL)
(void)printf("%s > %s ",
tok2str(llc_values, "Unknown SSAP 0x%02x", ssap),
tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
else
(void)printf("%s %s > %s %s ",
etheraddr_string(esrc),
tok2str(llc_values, "Unknown SSAP 0x%02x", ssap),
etheraddr_string(edst),
tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
}
}
if (is_u) {
printf("Unnumbered, %s, Flags [%s], length %u",
tok2str(llc_cmd_values, "%02x", LLC_U_CMD(control)),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_U_POLL)),
length);
p += 3;
length -= 3;
caplen -= 3;
if ((control & ~LLC_U_POLL) == LLC_XID) {
if (*p == LLC_XID_FI) {
printf(": %02x %02x", p[1], p[2]);
p += 3;
length -= 3;
caplen -= 3;
}
}
} else {
if ((control & LLC_S_FMT) == LLC_S_FMT) {
(void)printf("Supervisory, %s, rcv seq %u, Flags [%s], length %u",
tok2str(llc_supervisory_values,"?",LLC_S_CMD(control)),
LLC_IS_NR(control),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)),
length);
} else {
(void)printf("Information, send seq %u, rcv seq %u, Flags [%s], length %u",
LLC_I_NS(control),
LLC_IS_NR(control),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)),
length);
}
p += 4;
length -= 4;
caplen -= 4;
}
return(1);
}
/*
* Returns non-zero IFF it succeeds in printing the header
*/
int
llc_print(const u_char *p, u_int length, u_int caplen,
const u_char *esrc, const u_char *edst, u_short *extracted_ethertype)
{
u_int8_t dsap, ssap;
u_int16_t control;
int is_u;
register int ret;
if (caplen < 3) {
(void)printf("[|llc]");
default_print((u_char *)p, caplen);
return(0);
}
dsap = *p;
ssap = *(p + 1);
/*
* OK, what type of LLC frame is this? The length
* of the control field depends on that - I frames
* have a two-byte control field, and U frames have
* a one-byte control field.
*/
control = *(p + 2);
if ((control & LLC_U_FMT) == LLC_U_FMT) {
/*
* U frame.
*/
is_u = 1;
} else {
/*
* The control field in I and S frames is
* 2 bytes...
*/
if (caplen < 4) {
(void)printf("[|llc]");
default_print((u_char *)p, caplen);
return(0);
}
/*
* ...and is little-endian.
*/
control = EXTRACT_LE_16BITS(p + 2);
is_u = 0;
}
#if !defined(EMBED) || defined(CONFIG_IPX) || defined(CONFIG_IPX_MODULE)
if (ssap == LLCSAP_GLOBAL && dsap == LLCSAP_GLOBAL) {
/*
* This is an Ethernet_802.3 IPX frame; it has an
* 802.3 header (i.e., an Ethernet header where the
* type/length field is <= ETHERMTU, i.e. it's a length
* field, not a type field), but has no 802.2 header -
* the IPX packet starts right after the Ethernet header,
* with a signature of two bytes of 0xFF (which is
* LLCSAP_GLOBAL).
*
* (It might also have been an Ethernet_802.3 IPX at
* one time, but got bridged onto another network,
* such as an 802.11 network; this has appeared in at
* least one capture file.)
*/
if (eflag)
printf("IPX-802.3: ");
ipx_print(p, length);
return (1);
}
#endif
if (eflag) {
if (is_u) {
printf("LLC, dsap %s (0x%02x), ssap %s (0x%02x), cmd 0x%02x: ",
tok2str(llc_values, "Unknown", dsap),
dsap,
tok2str(llc_values, "Unknown", ssap),
ssap,
control);
} else {
printf("LLC, dsap %s (0x%02x), ssap %s (0x%02x), cmd 0x%04x: ",
tok2str(llc_values, "Unknown", dsap),
dsap,
tok2str(llc_values, "Unknown", ssap),
ssap,
control);
}
}
#if !defined(EMBED) || defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
if (ssap == LLCSAP_8021D && dsap == LLCSAP_8021D &&
control == LLC_UI) {
stp_print(p+3, length-3);
return (1);
}
#endif
if (ssap == LLCSAP_IP && dsap == LLCSAP_IP &&
control == LLC_UI) {
ip_print(gndo, p+4, length-4);
return (1);
}
#if !defined(EMBED) || defined(CONFIG_IPX) || defined(CONFIG_IPX_MODULE)
if (ssap == LLCSAP_IPX && dsap == LLCSAP_IPX &&
control == LLC_UI) {
/*
* This is an Ethernet_802.2 IPX frame, with an 802.3
* header and an 802.2 LLC header with the source and
* destination SAPs being the IPX SAP.
*
* Skip DSAP, LSAP, and control field.
*/
printf("(NOV-802.2) ");
ipx_print(p+3, length-3);
return (1);
}
#endif
#ifdef TCPDUMP_DO_SMB
if (ssap == LLCSAP_NETBEUI && dsap == LLCSAP_NETBEUI
&& (!(control & LLC_S_FMT) || control == LLC_U_FMT)) {
/*
* we don't actually have a full netbeui parser yet, but the
* smb parser can handle many smb-in-netbeui packets, which
* is very useful, so we call that
*
* We don't call it for S frames, however, just I frames
* (which are frames that don't have the low-order bit,
* LLC_S_FMT, set in the first byte of the control field)
* and UI frames (whose control field is just 3, LLC_U_FMT).
*/
/*
* Skip the LLC header.
*/
if (is_u) {
p += 3;
length -= 3;
caplen -= 3;
} else {
p += 4;
length -= 4;
caplen -= 4;
}
netbeui_print(control, p, length);
return (1);
}
#endif
#if !defined(EMBED)
if (ssap == LLCSAP_ISONS && dsap == LLCSAP_ISONS
&& control == LLC_UI) {
isoclns_print(p + 3, length - 3, caplen - 3);
return (1);
}
#endif
if (ssap == LLCSAP_SNAP && dsap == LLCSAP_SNAP
&& control == LLC_UI) {
/*
* XXX - what *is* the right bridge pad value here?
* Does anybody ever bridge one form of LAN traffic
* over a networking type that uses 802.2 LLC?
*/
ret = snap_print(p+3, length-3, caplen-3, extracted_ethertype,
2);
if (ret)
return (ret);
}
if (!eflag) {
if ((ssap & ~LLC_GSAP) == dsap) {
if (esrc == NULL || edst == NULL)
(void)printf("%s ", llcsap_string(dsap));
else
(void)printf("%s > %s %s ",
etheraddr_string(esrc),
etheraddr_string(edst),
llcsap_string(dsap));
} else {
if (esrc == NULL || edst == NULL)
(void)printf("%s > %s ",
llcsap_string(ssap & ~LLC_GSAP),
llcsap_string(dsap));
else
(void)printf("%s %s > %s %s ",
etheraddr_string(esrc),
llcsap_string(ssap & ~LLC_GSAP),
etheraddr_string(edst),
llcsap_string(dsap));
}
}
if (is_u) {
const char *m;
char f;
m = tok2str(cmd2str, "%02x", LLC_U_CMD(control));
switch ((ssap & LLC_GSAP) | (control & LLC_U_POLL)) {
case 0: f = 'C'; break;
case LLC_GSAP: f = 'R'; break;
case LLC_U_POLL: f = 'P'; break;
case LLC_GSAP|LLC_U_POLL: f = 'F'; break;
default: f = '?'; break;
}
printf("%s/%c", m, f);
p += 3;
length -= 3;
caplen -= 3;
if ((control & ~LLC_U_POLL) == LLC_XID) {
if (*p == LLC_XID_FI) {
printf(": %02x %02x", p[1], p[2]);
p += 3;
length -= 3;
caplen -= 3;
}
}
} else {
char f;
switch ((ssap & LLC_GSAP) | (control & LLC_IS_POLL)) {
case 0: f = 'C'; break;
case LLC_GSAP: f = 'R'; break;
case LLC_IS_POLL: f = 'P'; break;
case LLC_GSAP|LLC_IS_POLL: f = 'F'; break;
default: f = '?'; break;
}
if ((control & LLC_S_FMT) == LLC_S_FMT) {
static const char *llc_s[] = { "rr", "rej", "rnr", "03" };
(void)printf("%s (r=%d,%c)",
llc_s[LLC_S_CMD(control)],
LLC_IS_NR(control),
f);
} else {
(void)printf("I (s=%d,r=%d,%c)",
LLC_I_NS(control),
LLC_IS_NR(control),
f);
}
p += 4;
length -= 4;
caplen -= 4;
}
return(1);
}
u_int
chdlc_print(netdissect_options *ndo, const u_char *p, u_int length)
{
u_int proto;
const u_char *bp = p;
ndo->ndo_protocol = "chdlc";
if (length < CHDLC_HDRLEN)
goto trunc;
ND_TCHECK_LEN(p, CHDLC_HDRLEN);
proto = GET_BE_U_2(p + 2);
if (ndo->ndo_eflag) {
ND_PRINT("%s, ethertype %s (0x%04x), length %u: ",
tok2str(chdlc_cast_values, "0x%02x", GET_U_1(p)),
tok2str(ethertype_values, "Unknown", proto),
proto,
length);
}
length -= CHDLC_HDRLEN;
p += CHDLC_HDRLEN;
switch (proto) {
case ETHERTYPE_IP:
ip_print(ndo, p, length);
break;
case ETHERTYPE_IPV6:
ip6_print(ndo, p, length);
break;
case CHDLC_TYPE_SLARP:
chdlc_slarp_print(ndo, p, length);
break;
#if 0
case CHDLC_TYPE_CDP:
chdlc_cdp_print(p, length);
break;
#endif
case ETHERTYPE_MPLS:
case ETHERTYPE_MPLS_MULTI:
mpls_print(ndo, p, length);
break;
case ETHERTYPE_ISO:
/* is the fudge byte set ? lets verify by spotting ISO headers */
if (length < 2)
goto trunc;
ND_TCHECK_2(p);
if (GET_U_1(p + 1) == NLPID_CLNP ||
GET_U_1(p + 1) == NLPID_ESIS ||
GET_U_1(p + 1) == NLPID_ISIS)
isoclns_print(ndo, p + 1, length - 1);
else
isoclns_print(ndo, p, length);
break;
default:
if (!ndo->ndo_eflag)
ND_PRINT("unknown CHDLC protocol (0x%04x)", proto);
break;
}
return (CHDLC_HDRLEN);
trunc:
nd_print_trunc(ndo);
return (ND_BYTES_AVAILABLE_AFTER(bp));
}
/*
* RFC3032: MPLS label stack encoding
*/
void
mpls_print(const u_char *bp, u_int length)
{
const u_char *p;
u_int32_t label_entry;
u_int16_t label_stack_depth = 0;
p = bp;
printf("MPLS");
do {
TCHECK2(*p, sizeof(label_entry));
label_entry = EXTRACT_32BITS(p);
printf("%s(label %u",
label_stack_depth ? "\n\t" : " ",
MPLS_LABEL(label_entry));
label_stack_depth++;
if (vflag &&
MPLS_LABEL(label_entry) < sizeof(mpls_labelname) / sizeof(mpls_labelname[0]))
printf(" (%s)", mpls_labelname[MPLS_LABEL(label_entry)]);
printf(", exp %u", MPLS_EXP(label_entry));
if (MPLS_STACK(label_entry))
printf(", [S]");
printf(", ttl %u)", MPLS_TTL(label_entry));
p += sizeof(label_entry);
} while (!MPLS_STACK(label_entry));
switch (MPLS_LABEL(label_entry)) {
case 0: /* IPv4 explicit NULL label */
case 3: /* IPv4 implicit NULL label */
if (vflag>0) {
printf("\n\t");
ip_print(gndo, p, length - (p - bp));
}
else printf(", IP, length: %u",length);
break;
#ifdef INET6
case 2: /* IPv6 explicit NULL label */
if (vflag>0) {
printf("\n\t");
ip6_print(p, length - (p - bp));
}
else printf(", IPv6, length: %u",length);
break;
#endif
default:
/*
* Generally there's no indication of protocol in MPLS label
* encoding, however draft-hsmit-isis-aal5mux-00.txt describes
* a technique that looks at the first payload byte if the BOS (bottom of stack)
* bit is set and tries to determine the network layer protocol
* 0x45-0x4f is IPv4
* 0x60-0x6f is IPv6
* 0x81-0x83 is OSI (CLNP,ES-IS,IS-IS)
* this technique is sometimes known as NULL encapsulation
* and decoding is particularly useful for control-plane traffic [BGP]
* which cisco by default sends MPLS encapsulated
*/
if (MPLS_STACK(label_entry)) { /* only do this if the stack bit is set */
switch(*p) {
case 0x45:
case 0x46:
case 0x47:
case 0x48:
case 0x49:
case 0x4a:
case 0x4b:
case 0x4c:
case 0x4d:
case 0x4e:
case 0x4f:
if (vflag>0) {
printf("\n\t");
ip_print(gndo, p, length - (p - bp));
}
else printf(", IP, length: %u",length);
break;
#ifdef INET6
case 0x60:
case 0x61:
case 0x62:
case 0x63:
case 0x64:
case 0x65:
case 0x66:
case 0x67:
case 0x68:
case 0x69:
case 0x6a:
case 0x6b:
case 0x6c:
case 0x6d:
case 0x6e:
case 0x6f:
if (vflag>0) {
printf("\n\t");
ip6_print(p, length - (p - bp));
}
else printf(", IPv6, length: %u",length);
break;
#endif
case 0x81:
case 0x82:
case 0x83:
if (vflag>0) {
printf("\n\t");
isoclns_print(p, length - (p - bp), length - (p - bp));
}
else printf(", OSI, length: %u",length);
break;
default:
/* ok bail out - we did not figure out what it is*/
break;
}
}
return;
}
trunc:
printf("[|MPLS]");
}
int
ethertype_print(netdissect_options *ndo,
u_short ether_type, const u_char *p,
u_int length, u_int caplen,
const struct lladdr_info *src, const struct lladdr_info *dst)
{
switch (ether_type) {
case ETHERTYPE_IP:
ip_print(ndo, p, length);
return (1);
case ETHERTYPE_IPV6:
ip6_print(ndo, p, length);
return (1);
case ETHERTYPE_ARP:
case ETHERTYPE_REVARP:
arp_print(ndo, p, length, caplen);
return (1);
case ETHERTYPE_DN:
decnet_print(ndo, p, length, caplen);
return (1);
case ETHERTYPE_ATALK:
if (ndo->ndo_vflag)
ND_PRINT((ndo, "et1 "));
atalk_print(ndo, p, length);
return (1);
case ETHERTYPE_AARP:
aarp_print(ndo, p, length);
return (1);
case ETHERTYPE_IPX:
ND_PRINT((ndo, "(NOV-ETHII) "));
ipx_print(ndo, p, length);
return (1);
case ETHERTYPE_ISO:
if (length == 0 || caplen == 0) {
ND_PRINT((ndo, " [|osi]"));
return (1);
}
isoclns_print(ndo, p + 1, length - 1, caplen - 1);
return(1);
case ETHERTYPE_PPPOED:
case ETHERTYPE_PPPOES:
case ETHERTYPE_PPPOED2:
case ETHERTYPE_PPPOES2:
pppoe_print(ndo, p, length);
return (1);
case ETHERTYPE_EAPOL:
eap_print(ndo, p, length);
return (1);
case ETHERTYPE_RRCP:
rrcp_print(ndo, p, length, src, dst);
return (1);
case ETHERTYPE_PPP:
if (length) {
ND_PRINT((ndo, ": "));
ppp_print(ndo, p, length);
}
return (1);
case ETHERTYPE_MPCP:
mpcp_print(ndo, p, length);
return (1);
case ETHERTYPE_SLOW:
slow_print(ndo, p, length);
return (1);
case ETHERTYPE_CFM:
case ETHERTYPE_CFM_OLD:
cfm_print(ndo, p, length);
return (1);
case ETHERTYPE_LLDP:
lldp_print(ndo, p, length);
return (1);
case ETHERTYPE_NSH:
nsh_print(ndo, p, length);
return (1);
case ETHERTYPE_LOOPBACK:
loopback_print(ndo, p, length);
return (1);
case ETHERTYPE_MPLS:
case ETHERTYPE_MPLS_MULTI:
mpls_print(ndo, p, length);
return (1);
case ETHERTYPE_TIPC:
tipc_print(ndo, p, length, caplen);
return (1);
case ETHERTYPE_MS_NLB_HB:
msnlb_print(ndo, p);
return (1);
case ETHERTYPE_GEONET_OLD:
case ETHERTYPE_GEONET:
geonet_print(ndo, p, length, src);
return (1);
case ETHERTYPE_CALM_FAST:
calm_fast_print(ndo, p, length, src);
return (1);
case ETHERTYPE_AOE:
aoe_print(ndo, p, length);
return (1);
case ETHERTYPE_MEDSA:
medsa_print(ndo, p, length, caplen, src, dst);
return (1);
case ETHERTYPE_LAT:
case ETHERTYPE_SCA:
case ETHERTYPE_MOPRC:
case ETHERTYPE_MOPDL:
case ETHERTYPE_IEEE1905_1:
/* default_print for now */
default:
return (0);
}
}
/*
* This is the top level routine of the printer. 'p' points
* to the LLC/SNAP header of the packet, 'h->ts' is the timestamp,
* 'h->len' is the length of the packet off the wire, and 'h->caplen'
* is the number of bytes actually captured.
*/
u_int
atm_if_print(const struct pcap_pkthdr *h, const u_char *p)
{
u_int caplen = h->caplen;
u_int length = h->len;
u_int32_t llchdr;
u_int hdrlen = 0;
if (caplen < 8) {
printf("[|atm]");
return (caplen);
}
/* Cisco Style NLPID ? */
if (*p == LLC_UI) {
if (eflag)
printf("CNLPID ");
isoclns_print(p+1, length-1, caplen-1);
return hdrlen;
}
/*
* Extract the presumed LLC header into a variable, for quick
* testing.
* Then check for a header that's neither a header for a SNAP
* packet nor an RFC 2684 routed NLPID-formatted PDU nor
* an 802.2-but-no-SNAP IP packet.
*/
llchdr = EXTRACT_24BITS(p);
if (llchdr != LLC_UI_HDR(LLCSAP_SNAP) &&
llchdr != LLC_UI_HDR(LLCSAP_ISONS) &&
llchdr != LLC_UI_HDR(LLCSAP_IP)) {
/*
* XXX - assume 802.6 MAC header from Fore driver.
*
* Unfortunately, the above list doesn't check for
* all known SAPs, doesn't check for headers where
* the source and destination SAP aren't the same,
* and doesn't check for non-UI frames. It also
* runs the risk of an 802.6 MAC header that happens
* to begin with one of those values being
* incorrectly treated as an 802.2 header.
*
* So is that Fore driver still around? And, if so,
* is it still putting 802.6 MAC headers on ATM
* packets? If so, could it be changed to use a
* new DLT_IEEE802_6 value if we added it?
*/
if (eflag)
printf("%08x%08x %08x%08x ",
EXTRACT_32BITS(p),
EXTRACT_32BITS(p+4),
EXTRACT_32BITS(p+8),
EXTRACT_32BITS(p+12));
p += 20;
length -= 20;
caplen -= 20;
hdrlen += 20;
}
atm_llc_print(p, length, caplen);
return (hdrlen);
}
/*
* Returns non-zero IFF it succeeds in printing the header
*/
int
llc_print(const u_char *p, u_int length, u_int caplen,
const u_char *esrc, const u_char *edst)
{
struct llc llc;
register u_short et;
register int ret;
if (caplen < 3) {
(void)printf("[|llc]");
default_print((u_char *)p, caplen);
return(0);
}
/* Watch out for possible alignment problems */
memcpy((char *)&llc, (char *)p, min(caplen, sizeof(llc)));
if (llc.ssap == LLCSAP_GLOBAL && llc.dsap == LLCSAP_GLOBAL) {
ipx_print(p, length);
return (1);
}
#ifdef notyet
else if (p[0] == 0xf0 && p[1] == 0xf0)
netbios_print(p, length);
#endif
if (llc.ssap == LLCSAP_ISONS && llc.dsap == LLCSAP_ISONS
&& llc.llcui == LLC_UI) {
isoclns_print(p + 3, length - 3, caplen - 3, esrc, edst);
return (1);
}
if (llc.ssap == LLCSAP_SNAP && llc.dsap == LLCSAP_SNAP
&& llc.llcui == LLC_UI) {
if (caplen < sizeof(llc)) {
(void)printf("[|llc-snap]");
default_print((u_char *)p, caplen);
return (0);
}
if (vflag)
(void)printf("snap %s ", protoid_string(llc.llcpi));
caplen -= sizeof(llc);
length -= sizeof(llc);
p += sizeof(llc);
/* This is an encapsulated Ethernet packet */
et = EXTRACT_16BITS(&llc.ethertype[0]);
ret = ether_encap_print(et, p, length, caplen);
if (ret)
return (ret);
}
if ((llc.ssap & ~LLC_GSAP) == llc.dsap) {
if (eflag)
(void)printf("%s ", llcsap_string(llc.dsap));
else
(void)printf("%s > %s %s ",
etheraddr_string(esrc),
etheraddr_string(edst),
llcsap_string(llc.dsap));
} else {
if (eflag)
(void)printf("%s > %s ",
llcsap_string(llc.ssap & ~LLC_GSAP),
llcsap_string(llc.dsap));
else
(void)printf("%s %s > %s %s ",
etheraddr_string(esrc),
llcsap_string(llc.ssap & ~LLC_GSAP),
etheraddr_string(edst),
llcsap_string(llc.dsap));
}
if ((llc.llcu & LLC_U_FMT) == LLC_U_FMT) {
const char *m;
char f;
m = tok2str(cmd2str, "%02x", LLC_U_CMD(llc.llcu));
switch ((llc.ssap & LLC_GSAP) | (llc.llcu & LLC_U_POLL)) {
case 0: f = 'C'; break;
case LLC_GSAP: f = 'R'; break;
case LLC_U_POLL: f = 'P'; break;
case LLC_GSAP|LLC_U_POLL: f = 'F'; break;
default: f = '?'; break;
}
printf("%s/%c", m, f);
p += 3;
length -= 3;
caplen -= 3;
if ((llc.llcu & ~LLC_U_POLL) == LLC_XID) {
if (*p == LLC_XID_FI) {
printf(": %02x %02x", p[1], p[2]);
p += 3;
length -= 3;
caplen -= 3;
}
}
} else {
char f;
llc.llcis = ntohs(llc.llcis);
switch ((llc.ssap & LLC_GSAP) | (llc.llcu & LLC_U_POLL)) {
case 0: f = 'C'; break;
case LLC_GSAP: f = 'R'; break;
case LLC_U_POLL: f = 'P'; break;
case LLC_GSAP|LLC_U_POLL: f = 'F'; break;
default: f = '?'; break;
}
if ((llc.llcu & LLC_S_FMT) == LLC_S_FMT) {
static char *llc_s[] = { "rr", "rej", "rnr", "03" };
(void)printf("%s (r=%d,%c)",
llc_s[LLC_S_CMD(llc.llcis)],
LLC_IS_NR(llc.llcis),
f);
} else {
(void)printf("I (s=%d,r=%d,%c)",
LLC_I_NS(llc.llcis),
LLC_IS_NR(llc.llcis),
f);
}
p += 4;
length -= 4;
caplen -= 4;
}
(void)printf(" len=%d", length);
if (caplen > 0) {
default_print_unaligned(p, caplen);
}
return(1);
}
/*
* This is the top level routine of the printer. 'p' points
* to the ether header of the packet, 'h->ts' is the timestamp,
* 'h->len' is the length of the packet off the wire, and 'h->caplen'
* is the number of bytes actually captured.
*/
u_int
null_if_print(const struct pcap_pkthdr *h, const u_char *p)
{
u_int length = h->len;
u_int caplen = h->caplen;
u_int family;
if (caplen < NULL_HDRLEN) {
printf("[|null]");
return (NULL_HDRLEN);
}
memcpy((char *)&family, (char *)p, sizeof(family));
/*
* This isn't necessarily in our host byte order; if this is
* a DLT_LOOP capture, it's in network byte order, and if
* this is a DLT_NULL capture from a machine with the opposite
* byte-order, it's in the opposite byte order from ours.
*
* If the upper 16 bits aren't all zero, assume it's byte-swapped.
*/
if ((family & 0xFFFF0000) != 0)
family = SWAPLONG(family);
if (eflag)
null_hdr_print(family, length);
length -= NULL_HDRLEN;
caplen -= NULL_HDRLEN;
p += NULL_HDRLEN;
switch (family) {
case BSD_AFNUM_INET:
ip_print(gndo, p, length);
break;
#ifdef INET6
case BSD_AFNUM_INET6_BSD:
case BSD_AFNUM_INET6_FREEBSD:
case BSD_AFNUM_INET6_DARWIN:
ip6_print(gndo, p, length);
break;
#endif
case BSD_AFNUM_ISO:
isoclns_print(p, length, caplen);
break;
case BSD_AFNUM_APPLETALK:
atalk_print(p, length);
break;
case BSD_AFNUM_IPX:
ipx_print(p, length);
break;
default:
/* unknown AF_ value */
if (!eflag)
null_hdr_print(family, length + NULL_HDRLEN);
if (!suppress_default_print)
default_print(p, caplen);
}
return (NULL_HDRLEN);
}
/*
* This is the top level routine of the printer. 'p' points
* to the ether header of the packet, 'h->ts' is the timestamp,
* 'h->len' is the length of the packet off the wire, and 'h->caplen'
* is the number of bytes actually captured.
*/
u_int
null_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
{
u_int length = h->len;
u_int caplen = h->caplen;
uint32_t family;
ndo->ndo_protocol = "null_if";
if (caplen < NULL_HDRLEN)
goto trunc;
ND_TCHECK_4(p);
family = GET_HE_U_4(p);
/*
* This isn't necessarily in our host byte order; if this is
* a DLT_LOOP capture, it's in network byte order, and if
* this is a DLT_NULL capture from a machine with the opposite
* byte-order, it's in the opposite byte order from ours.
*
* If the upper 16 bits aren't all zero, assume it's byte-swapped.
*/
if ((family & 0xFFFF0000) != 0)
family = SWAPLONG(family);
if (ndo->ndo_eflag)
null_hdr_print(ndo, family, length);
length -= NULL_HDRLEN;
caplen -= NULL_HDRLEN;
p += NULL_HDRLEN;
switch (family) {
case BSD_AFNUM_INET:
ip_print(ndo, p, length);
break;
case BSD_AFNUM_INET6_BSD:
case BSD_AFNUM_INET6_FREEBSD:
case BSD_AFNUM_INET6_DARWIN:
ip6_print(ndo, p, length);
break;
case BSD_AFNUM_ISO:
isoclns_print(ndo, p, length);
break;
case BSD_AFNUM_APPLETALK:
atalk_print(ndo, p, length);
break;
case BSD_AFNUM_IPX:
ipx_print(ndo, p, length);
break;
default:
/* unknown AF_ value */
if (!ndo->ndo_eflag)
null_hdr_print(ndo, family, length + NULL_HDRLEN);
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
}
return (NULL_HDRLEN);
trunc:
nd_print_trunc(ndo);
return (NULL_HDRLEN);
}
static void
gre_print_0(netdissect_options *ndo, const u_char *bp, u_int length)
{
u_int len = length;
uint16_t flags, prot;
/* 16 bits ND_TCHECKed in gre_print() */
flags = EXTRACT_BE_U_2(bp);
if (ndo->ndo_vflag)
ND_PRINT(", Flags [%s]",
bittok2str(gre_flag_values,"none",flags));
len -= 2;
bp += 2;
ND_TCHECK_2(bp);
if (len < 2)
goto trunc;
prot = EXTRACT_BE_U_2(bp);
len -= 2;
bp += 2;
if ((flags & GRE_CP) | (flags & GRE_RP)) {
ND_TCHECK_2(bp);
if (len < 2)
goto trunc;
if (ndo->ndo_vflag)
ND_PRINT(", sum 0x%x", EXTRACT_BE_U_2(bp));
bp += 2;
len -= 2;
ND_TCHECK_2(bp);
if (len < 2)
goto trunc;
ND_PRINT(", off 0x%x", EXTRACT_BE_U_2(bp));
bp += 2;
len -= 2;
}
if (flags & GRE_KP) {
ND_TCHECK_4(bp);
if (len < 4)
goto trunc;
ND_PRINT(", key=0x%x", EXTRACT_BE_U_4(bp));
bp += 4;
len -= 4;
}
if (flags & GRE_SP) {
ND_TCHECK_4(bp);
if (len < 4)
goto trunc;
ND_PRINT(", seq %u", EXTRACT_BE_U_4(bp));
bp += 4;
len -= 4;
}
if (flags & GRE_RP) {
for (;;) {
uint16_t af;
uint8_t sreoff;
uint8_t srelen;
ND_TCHECK_4(bp);
if (len < 4)
goto trunc;
af = EXTRACT_BE_U_2(bp);
sreoff = EXTRACT_U_1(bp + 2);
srelen = EXTRACT_U_1(bp + 3);
bp += 4;
len -= 4;
if (af == 0 && srelen == 0)
break;
if (!gre_sre_print(ndo, af, sreoff, srelen, bp, len))
goto trunc;
if (len < srelen)
goto trunc;
bp += srelen;
len -= srelen;
}
}
if (ndo->ndo_eflag)
ND_PRINT(", proto %s (0x%04x)",
tok2str(ethertype_values,"unknown",prot),
prot);
ND_PRINT(", length %u",length);
if (ndo->ndo_vflag < 1)
ND_PRINT(": "); /* put in a colon as protocol demarc */
else
ND_PRINT("\n\t"); /* if verbose go multiline */
switch (prot) {
case ETHERTYPE_IP:
ip_print(ndo, bp, len);
break;
case ETHERTYPE_IPV6:
ip6_print(ndo, bp, len);
break;
case ETHERTYPE_MPLS:
mpls_print(ndo, bp, len);
break;
case ETHERTYPE_IPX:
ipx_print(ndo, bp, len);
break;
case ETHERTYPE_ATALK:
atalk_print(ndo, bp, len);
break;
case ETHERTYPE_GRE_ISO:
isoclns_print(ndo, bp, len);
break;
case ETHERTYPE_TEB:
ether_print(ndo, bp, len, ndo->ndo_snapend - bp, NULL, NULL);
break;
default:
ND_PRINT("gre-proto-0x%x", prot);
}
return;
trunc:
nd_print_trunc(ndo);
}
