1/*
2 * Copyright (c) 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * Code by Matt Thomas, Digital Equipment Corporation
22 * with an awful lot of hacking by Jeffrey Mogul, DECWRL
23 *
| 1/*
2 * Copyright (c) 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * Code by Matt Thomas, Digital Equipment Corporation
22 * with an awful lot of hacking by Jeffrey Mogul, DECWRL
23 *
|
24 * $FreeBSD: head/contrib/tcpdump/print-llc.c 127675 2004-03-31 14:57:24Z bms $
| 24 * $FreeBSD: head/contrib/tcpdump/print-llc.c 146778 2005-05-29 19:09:28Z sam $
|
25 */
26
27#ifndef lint
28static const char rcsid[] _U_ =
| 25 */
26
27#ifndef lint
28static const char rcsid[] _U_ =
|
29 "@(#) $Header: /tcpdump/master/tcpdump/print-llc.c,v 1.53.2.3 2003/12/29 22:33:18 hannes Exp $";
| 29 "@(#) $Header: /tcpdump/master/tcpdump/print-llc.c,v 1.61 2005/04/06 21:32:41 mcr Exp $";
|
30#endif
31
32#ifdef HAVE_CONFIG_H
33#include "config.h"
34#endif
35
36#include <tcpdump-stdinc.h>
37
38#include <stdio.h>
39#include <string.h>
40
41#include "interface.h"
42#include "addrtoname.h"
43#include "extract.h" /* must come after interface.h */
44
45#include "llc.h"
46#include "ethertype.h"
| 30#endif
31
32#ifdef HAVE_CONFIG_H
33#include "config.h"
34#endif
35
36#include <tcpdump-stdinc.h>
37
38#include <stdio.h>
39#include <string.h>
40
41#include "interface.h"
42#include "addrtoname.h"
43#include "extract.h" /* must come after interface.h */
44
45#include "llc.h"
46#include "ethertype.h"
|
| 47#include "oui.h"
|
47
48static struct tok llc_values[] = {
49 { LLCSAP_NULL, "Null" },
50 { LLCSAP_GLOBAL, "Global" },
51 { LLCSAP_8021B_I, "802.1B I" },
52 { LLCSAP_8021B_G, "802.1B G" },
53 { LLCSAP_IP, "IP" },
54 { LLCSAP_PROWAYNM, "ProWay NM" },
55 { LLCSAP_8021D, "STP" },
56 { LLCSAP_RS511, "RS511" },
57 { LLCSAP_ISO8208, "ISO8208" },
58 { LLCSAP_PROWAY, "ProWay" },
59 { LLCSAP_SNAP, "SNAP" },
60 { LLCSAP_IPX, "IPX" },
61 { LLCSAP_NETBEUI, "NetBeui" },
62 { LLCSAP_ISONS, "OSI" },
63};
64
65static struct tok cmd2str[] = {
66 { LLC_UI, "ui" },
67 { LLC_TEST, "test" },
68 { LLC_XID, "xid" },
69 { LLC_UA, "ua" },
70 { LLC_DISC, "disc" },
71 { LLC_DM, "dm" },
72 { LLC_SABME, "sabme" },
73 { LLC_FRMR, "frmr" },
74 { 0, NULL }
75};
76
77/*
78 * Returns non-zero IFF it succeeds in printing the header
79 */
80int
81llc_print(const u_char *p, u_int length, u_int caplen,
82 const u_char *esrc, const u_char *edst, u_short *extracted_ethertype)
83{
84 struct llc llc;
85 register u_short et;
86 u_int16_t control;
87 register int ret;
88
89 if (caplen < 3) {
90 (void)printf("[|llc]");
91 default_print((u_char *)p, caplen);
92 return(0);
93 }
94
95 /* Watch out for possible alignment problems */
96 memcpy((char *)&llc, (char *)p, min(caplen, sizeof(llc)));
97
98 if (eflag)
| 48
49static struct tok llc_values[] = {
50 { LLCSAP_NULL, "Null" },
51 { LLCSAP_GLOBAL, "Global" },
52 { LLCSAP_8021B_I, "802.1B I" },
53 { LLCSAP_8021B_G, "802.1B G" },
54 { LLCSAP_IP, "IP" },
55 { LLCSAP_PROWAYNM, "ProWay NM" },
56 { LLCSAP_8021D, "STP" },
57 { LLCSAP_RS511, "RS511" },
58 { LLCSAP_ISO8208, "ISO8208" },
59 { LLCSAP_PROWAY, "ProWay" },
60 { LLCSAP_SNAP, "SNAP" },
61 { LLCSAP_IPX, "IPX" },
62 { LLCSAP_NETBEUI, "NetBeui" },
63 { LLCSAP_ISONS, "OSI" },
64};
65
66static struct tok cmd2str[] = {
67 { LLC_UI, "ui" },
68 { LLC_TEST, "test" },
69 { LLC_XID, "xid" },
70 { LLC_UA, "ua" },
71 { LLC_DISC, "disc" },
72 { LLC_DM, "dm" },
73 { LLC_SABME, "sabme" },
74 { LLC_FRMR, "frmr" },
75 { 0, NULL }
76};
77
78/*
79 * Returns non-zero IFF it succeeds in printing the header
80 */
81int
82llc_print(const u_char *p, u_int length, u_int caplen,
83 const u_char *esrc, const u_char *edst, u_short *extracted_ethertype)
84{
85 struct llc llc;
86 register u_short et;
87 u_int16_t control;
88 register int ret;
89
90 if (caplen < 3) {
91 (void)printf("[|llc]");
92 default_print((u_char *)p, caplen);
93 return(0);
94 }
95
96 /* Watch out for possible alignment problems */
97 memcpy((char *)&llc, (char *)p, min(caplen, sizeof(llc)));
98
99 if (eflag)
|
99 printf("LLC, dsap %s (0x%02x), ssap %s (0x%02x), cmd 0x%02x, ",
| 100 printf("LLC, dsap %s (0x%02x), ssap %s (0x%02x), cmd 0x%02x: ",
|
100 tok2str(llc_values,"Unknown",llc.dsap),
101 llc.dsap,
102 tok2str(llc_values,"Unknown",llc.ssap),
103 llc.ssap,
104 llc.llcu);
105
106 if (llc.ssap == LLCSAP_GLOBAL && llc.dsap == LLCSAP_GLOBAL) {
107 /*
108 * This is an Ethernet_802.3 IPX frame; it has an
109 * 802.3 header (i.e., an Ethernet header where the
110 * type/length field is <= ETHERMTU, i.e. it's a length
111 * field, not a type field), but has no 802.2 header -
112 * the IPX packet starts right after the Ethernet header,
113 * with a signature of two bytes of 0xFF (which is
114 * LLCSAP_GLOBAL).
115 *
116 * (It might also have been an Ethernet_802.3 IPX at
117 * one time, but got bridged onto another network,
118 * such as an 802.11 network; this has appeared in at
119 * least one capture file.)
120 */
| 101 tok2str(llc_values,"Unknown",llc.dsap),
102 llc.dsap,
103 tok2str(llc_values,"Unknown",llc.ssap),
104 llc.ssap,
105 llc.llcu);
106
107 if (llc.ssap == LLCSAP_GLOBAL && llc.dsap == LLCSAP_GLOBAL) {
108 /*
109 * This is an Ethernet_802.3 IPX frame; it has an
110 * 802.3 header (i.e., an Ethernet header where the
111 * type/length field is <= ETHERMTU, i.e. it's a length
112 * field, not a type field), but has no 802.2 header -
113 * the IPX packet starts right after the Ethernet header,
114 * with a signature of two bytes of 0xFF (which is
115 * LLCSAP_GLOBAL).
116 *
117 * (It might also have been an Ethernet_802.3 IPX at
118 * one time, but got bridged onto another network,
119 * such as an 802.11 network; this has appeared in at
120 * least one capture file.)
121 */
|
121 printf("(NOV-802.3) ");
122 ipx_print(p, length);
123 return (1);
| 122
123 if (eflag)
124 printf("IPX-802.3: ");
125
126 ipx_print(p, length);
127 return (1);
|
124 }
125
126 if (llc.ssap == LLCSAP_8021D && llc.dsap == LLCSAP_8021D) {
127 stp_print(p, length);
128 return (1);
129 }
130
131 if (llc.ssap == LLCSAP_IP && llc.dsap == LLCSAP_IP) {
| 128 }
129
130 if (llc.ssap == LLCSAP_8021D && llc.dsap == LLCSAP_8021D) {
131 stp_print(p, length);
132 return (1);
133 }
134
135 if (llc.ssap == LLCSAP_IP && llc.dsap == LLCSAP_IP) {
|
132 ip_print(p+4, length-4);
| 136 ip_print(gndo, p+4, length-4);
|
133 return (1);
134 }
135
136 if (llc.ssap == LLCSAP_IPX && llc.dsap == LLCSAP_IPX &&
137 llc.llcui == LLC_UI) {
138 /*
139 * This is an Ethernet_802.2 IPX frame, with an 802.3
140 * header and an 802.2 LLC header with the source and
141 * destination SAPs being the IPX SAP.
142 *
143 * Skip DSAP, LSAP, and control field.
144 */
145 printf("(NOV-802.2) ");
146 p += 3;
147 length -= 3;
148 caplen -= 3;
149 ipx_print(p, length);
150 return (1);
151 }
152
153#ifdef TCPDUMP_DO_SMB
154 if (llc.ssap == LLCSAP_NETBEUI && llc.dsap == LLCSAP_NETBEUI
155 && (!(llc.llcu & LLC_S_FMT) || llc.llcu == LLC_U_FMT)) {
156 /*
157 * we don't actually have a full netbeui parser yet, but the
158 * smb parser can handle many smb-in-netbeui packets, which
159 * is very useful, so we call that
160 *
161 * We don't call it for S frames, however, just I frames
162 * (which are frames that don't have the low-order bit,
163 * LLC_S_FMT, set in the first byte of the control field)
164 * and UI frames (whose control field is just 3, LLC_U_FMT).
165 */
166
167 /*
168 * Skip the DSAP and LSAP.
169 */
170 p += 2;
171 length -= 2;
172 caplen -= 2;
173
174 /*
175 * OK, what type of LLC frame is this? The length
176 * of the control field depends on that - I frames
177 * have a two-byte control field, and U frames have
178 * a one-byte control field.
179 */
180 if (llc.llcu == LLC_U_FMT) {
181 control = llc.llcu;
182 p += 1;
183 length -= 1;
184 caplen -= 1;
185 } else {
186 /*
187 * The control field in I and S frames is
188 * little-endian.
189 */
190 control = EXTRACT_LE_16BITS(&llc.llcu);
191 p += 2;
192 length -= 2;
193 caplen -= 2;
194 }
195 netbeui_print(control, p, length);
196 return (1);
197 }
198#endif
199 if (llc.ssap == LLCSAP_ISONS && llc.dsap == LLCSAP_ISONS
200 && llc.llcui == LLC_UI) {
201 isoclns_print(p + 3, length - 3, caplen - 3);
202 return (1);
203 }
204
205 if (llc.ssap == LLCSAP_SNAP && llc.dsap == LLCSAP_SNAP
206 && llc.llcui == LLC_UI) {
207 u_int32_t orgcode;
208
209 if (caplen < sizeof(llc)) {
210 (void)printf("[|llc-snap]");
211 default_print((u_char *)p, caplen);
212 return (0);
213 }
214
215 caplen -= sizeof(llc);
216 length -= sizeof(llc);
217 p += sizeof(llc);
218
219 orgcode = EXTRACT_24BITS(&llc.llc_orgcode[0]);
220 et = EXTRACT_16BITS(&llc.llc_ethertype[0]);
| 137 return (1);
138 }
139
140 if (llc.ssap == LLCSAP_IPX && llc.dsap == LLCSAP_IPX &&
141 llc.llcui == LLC_UI) {
142 /*
143 * This is an Ethernet_802.2 IPX frame, with an 802.3
144 * header and an 802.2 LLC header with the source and
145 * destination SAPs being the IPX SAP.
146 *
147 * Skip DSAP, LSAP, and control field.
148 */
149 printf("(NOV-802.2) ");
150 p += 3;
151 length -= 3;
152 caplen -= 3;
153 ipx_print(p, length);
154 return (1);
155 }
156
157#ifdef TCPDUMP_DO_SMB
158 if (llc.ssap == LLCSAP_NETBEUI && llc.dsap == LLCSAP_NETBEUI
159 && (!(llc.llcu & LLC_S_FMT) || llc.llcu == LLC_U_FMT)) {
160 /*
161 * we don't actually have a full netbeui parser yet, but the
162 * smb parser can handle many smb-in-netbeui packets, which
163 * is very useful, so we call that
164 *
165 * We don't call it for S frames, however, just I frames
166 * (which are frames that don't have the low-order bit,
167 * LLC_S_FMT, set in the first byte of the control field)
168 * and UI frames (whose control field is just 3, LLC_U_FMT).
169 */
170
171 /*
172 * Skip the DSAP and LSAP.
173 */
174 p += 2;
175 length -= 2;
176 caplen -= 2;
177
178 /*
179 * OK, what type of LLC frame is this? The length
180 * of the control field depends on that - I frames
181 * have a two-byte control field, and U frames have
182 * a one-byte control field.
183 */
184 if (llc.llcu == LLC_U_FMT) {
185 control = llc.llcu;
186 p += 1;
187 length -= 1;
188 caplen -= 1;
189 } else {
190 /*
191 * The control field in I and S frames is
192 * little-endian.
193 */
194 control = EXTRACT_LE_16BITS(&llc.llcu);
195 p += 2;
196 length -= 2;
197 caplen -= 2;
198 }
199 netbeui_print(control, p, length);
200 return (1);
201 }
202#endif
203 if (llc.ssap == LLCSAP_ISONS && llc.dsap == LLCSAP_ISONS
204 && llc.llcui == LLC_UI) {
205 isoclns_print(p + 3, length - 3, caplen - 3);
206 return (1);
207 }
208
209 if (llc.ssap == LLCSAP_SNAP && llc.dsap == LLCSAP_SNAP
210 && llc.llcui == LLC_UI) {
211 u_int32_t orgcode;
212
213 if (caplen < sizeof(llc)) {
214 (void)printf("[|llc-snap]");
215 default_print((u_char *)p, caplen);
216 return (0);
217 }
218
219 caplen -= sizeof(llc);
220 length -= sizeof(llc);
221 p += sizeof(llc);
222
223 orgcode = EXTRACT_24BITS(&llc.llc_orgcode[0]);
224 et = EXTRACT_16BITS(&llc.llc_ethertype[0]);
|
| 225
226 if (eflag)
227 (void)printf("oui %s (0x%06x), ethertype %s (0x%04x): ",
228 tok2str(oui_values,"Unknown",orgcode),
229 orgcode,
230 tok2str(ethertype_values,"Unknown", et),
231 et);
232
|
221 /*
222 * XXX - what *is* the right bridge pad value here?
223 * Does anybody ever bridge one form of LAN traffic
224 * over a networking type that uses 802.2 LLC?
225 */
226 ret = snap_print(p, length, caplen, extracted_ethertype,
227 orgcode, et, 2);
228 if (ret)
229 return (ret);
230 }
231
232 if ((llc.ssap & ~LLC_GSAP) == llc.dsap) {
233 if (eflag || esrc == NULL || edst == NULL)
234 (void)printf("%s ", llcsap_string(llc.dsap));
235 else
236 (void)printf("%s > %s %s ",
237 etheraddr_string(esrc),
238 etheraddr_string(edst),
239 llcsap_string(llc.dsap));
240 } else {
241 if (eflag || esrc == NULL || edst == NULL)
242 (void)printf("%s > %s ",
243 llcsap_string(llc.ssap & ~LLC_GSAP),
244 llcsap_string(llc.dsap));
245 else
246 (void)printf("%s %s > %s %s ",
247 etheraddr_string(esrc),
248 llcsap_string(llc.ssap & ~LLC_GSAP),
249 etheraddr_string(edst),
250 llcsap_string(llc.dsap));
251 }
252
253 if ((llc.llcu & LLC_U_FMT) == LLC_U_FMT) {
254 u_int16_t cmd;
255 const char *m;
256 char f;
257
258 cmd = LLC_U_CMD(llc.llcu);
259 m = tok2str(cmd2str, "%02x", cmd);
260 switch ((llc.ssap & LLC_GSAP) | (llc.llcu & LLC_U_POLL)) {
261 case 0: f = 'C'; break;
262 case LLC_GSAP: f = 'R'; break;
263 case LLC_U_POLL: f = 'P'; break;
264 case LLC_GSAP|LLC_U_POLL: f = 'F'; break;
265 default: f = '?'; break;
266 }
267
268 printf("%s/%c", m, f);
269
270 p += 3;
271 length -= 3;
272 caplen -= 3;
273
274 if ((llc.llcu & ~LLC_U_POLL) == LLC_XID) {
275 if (*p == LLC_XID_FI) {
276 printf(": %02x %02x", p[1], p[2]);
277 p += 3;
278 length -= 3;
279 caplen -= 3;
280 }
281 }
282 } else {
283 char f;
284
285 /*
286 * The control field in I and S frames is little-endian.
287 */
288 control = EXTRACT_LE_16BITS(&llc.llcu);
289 switch ((llc.ssap & LLC_GSAP) | (control & LLC_IS_POLL)) {
290 case 0: f = 'C'; break;
291 case LLC_GSAP: f = 'R'; break;
292 case LLC_IS_POLL: f = 'P'; break;
293 case LLC_GSAP|LLC_IS_POLL: f = 'F'; break;
294 default: f = '?'; break;
295 }
296
297 if ((control & LLC_S_FMT) == LLC_S_FMT) {
298 static const char *llc_s[] = { "rr", "rej", "rnr", "03" };
299 (void)printf("%s (r=%d,%c)",
300 llc_s[LLC_S_CMD(control)],
301 LLC_IS_NR(control),
302 f);
303 } else {
304 (void)printf("I (s=%d,r=%d,%c)",
305 LLC_I_NS(control),
306 LLC_IS_NR(control),
307 f);
308 }
309 p += 4;
310 length -= 4;
311 caplen -= 4;
312 }
| 233 /*
234 * XXX - what *is* the right bridge pad value here?
235 * Does anybody ever bridge one form of LAN traffic
236 * over a networking type that uses 802.2 LLC?
237 */
238 ret = snap_print(p, length, caplen, extracted_ethertype,
239 orgcode, et, 2);
240 if (ret)
241 return (ret);
242 }
243
244 if ((llc.ssap & ~LLC_GSAP) == llc.dsap) {
245 if (eflag || esrc == NULL || edst == NULL)
246 (void)printf("%s ", llcsap_string(llc.dsap));
247 else
248 (void)printf("%s > %s %s ",
249 etheraddr_string(esrc),
250 etheraddr_string(edst),
251 llcsap_string(llc.dsap));
252 } else {
253 if (eflag || esrc == NULL || edst == NULL)
254 (void)printf("%s > %s ",
255 llcsap_string(llc.ssap & ~LLC_GSAP),
256 llcsap_string(llc.dsap));
257 else
258 (void)printf("%s %s > %s %s ",
259 etheraddr_string(esrc),
260 llcsap_string(llc.ssap & ~LLC_GSAP),
261 etheraddr_string(edst),
262 llcsap_string(llc.dsap));
263 }
264
265 if ((llc.llcu & LLC_U_FMT) == LLC_U_FMT) {
266 u_int16_t cmd;
267 const char *m;
268 char f;
269
270 cmd = LLC_U_CMD(llc.llcu);
271 m = tok2str(cmd2str, "%02x", cmd);
272 switch ((llc.ssap & LLC_GSAP) | (llc.llcu & LLC_U_POLL)) {
273 case 0: f = 'C'; break;
274 case LLC_GSAP: f = 'R'; break;
275 case LLC_U_POLL: f = 'P'; break;
276 case LLC_GSAP|LLC_U_POLL: f = 'F'; break;
277 default: f = '?'; break;
278 }
279
280 printf("%s/%c", m, f);
281
282 p += 3;
283 length -= 3;
284 caplen -= 3;
285
286 if ((llc.llcu & ~LLC_U_POLL) == LLC_XID) {
287 if (*p == LLC_XID_FI) {
288 printf(": %02x %02x", p[1], p[2]);
289 p += 3;
290 length -= 3;
291 caplen -= 3;
292 }
293 }
294 } else {
295 char f;
296
297 /*
298 * The control field in I and S frames is little-endian.
299 */
300 control = EXTRACT_LE_16BITS(&llc.llcu);
301 switch ((llc.ssap & LLC_GSAP) | (control & LLC_IS_POLL)) {
302 case 0: f = 'C'; break;
303 case LLC_GSAP: f = 'R'; break;
304 case LLC_IS_POLL: f = 'P'; break;
305 case LLC_GSAP|LLC_IS_POLL: f = 'F'; break;
306 default: f = '?'; break;
307 }
308
309 if ((control & LLC_S_FMT) == LLC_S_FMT) {
310 static const char *llc_s[] = { "rr", "rej", "rnr", "03" };
311 (void)printf("%s (r=%d,%c)",
312 llc_s[LLC_S_CMD(control)],
313 LLC_IS_NR(control),
314 f);
315 } else {
316 (void)printf("I (s=%d,r=%d,%c)",
317 LLC_I_NS(control),
318 LLC_IS_NR(control),
319 f);
320 }
321 p += 4;
322 length -= 4;
323 caplen -= 4;
324 }
|
313 (void)printf(" len=%d", length);
| |
314 return(1);
315}
316
317int
318snap_print(const u_char *p, u_int length, u_int caplen,
319 u_short *extracted_ethertype, u_int32_t orgcode, u_short et,
320 u_int bridge_pad)
321{
322 register int ret;
323
324 switch (orgcode) {
325 case OUI_ENCAP_ETHER:
326 case OUI_CISCO_90:
327 /*
328 * This is an encapsulated Ethernet packet,
329 * or a packet bridged by some piece of
330 * Cisco hardware; the protocol ID is
331 * an Ethernet protocol type.
332 */
333 ret = ether_encap_print(et, p, length, caplen,
334 extracted_ethertype);
335 if (ret)
336 return (ret);
337 break;
338
339 case OUI_APPLETALK:
340 if (et == ETHERTYPE_ATALK) {
341 /*
342 * No, I have no idea why Apple used one
343 * of their own OUIs, rather than
344 * 0x000000, and an Ethernet packet
345 * type, for Appletalk data packets,
346 * but used 0x000000 and an Ethernet
347 * packet type for AARP packets.
348 */
349 ret = ether_encap_print(et, p, length, caplen,
350 extracted_ethertype);
351 if (ret)
352 return (ret);
353 }
354 break;
355
356 case OUI_CISCO:
357 if (et == PID_CISCO_CDP) {
358 cdp_print(p, length, caplen);
359 return (1);
360 }
361 break;
362
363 case OUI_RFC2684:
364 switch (et) {
365
366 case PID_RFC2684_ETH_FCS:
367 case PID_RFC2684_ETH_NOFCS:
368 /*
369 * XXX - remove the last two bytes for
370 * PID_RFC2684_ETH_FCS?
371 */
372 /*
373 * Skip the padding.
374 */
375 caplen -= bridge_pad;
376 length -= bridge_pad;
377 p += bridge_pad;
378
379 /*
380 * What remains is an Ethernet packet.
381 */
382 ether_print(p, length, caplen);
383 return (1);
384
385 case PID_RFC2684_802_5_FCS:
386 case PID_RFC2684_802_5_NOFCS:
387 /*
388 * XXX - remove the last two bytes for
389 * PID_RFC2684_ETH_FCS?
390 */
391 /*
392 * Skip the padding, but not the Access
393 * Control field.
394 */
395 caplen -= bridge_pad;
396 length -= bridge_pad;
397 p += bridge_pad;
398
399 /*
400 * What remains is an 802.5 Token Ring
401 * packet.
402 */
403 token_print(p, length, caplen);
404 return (1);
405
406 case PID_RFC2684_FDDI_FCS:
407 case PID_RFC2684_FDDI_NOFCS:
408 /*
409 * XXX - remove the last two bytes for
410 * PID_RFC2684_ETH_FCS?
411 */
412 /*
413 * Skip the padding.
414 */
415 caplen -= bridge_pad + 1;
416 length -= bridge_pad + 1;
417 p += bridge_pad + 1;
418
419 /*
420 * What remains is an FDDI packet.
421 */
422 fddi_print(p, length, caplen);
423 return (1);
424
425 case PID_RFC2684_BPDU:
426 stp_print(p, length);
427 return (1);
428 }
429 }
430 return (0);
431}
| 325 return(1);
326}
327
328int
329snap_print(const u_char *p, u_int length, u_int caplen,
330 u_short *extracted_ethertype, u_int32_t orgcode, u_short et,
331 u_int bridge_pad)
332{
333 register int ret;
334
335 switch (orgcode) {
336 case OUI_ENCAP_ETHER:
337 case OUI_CISCO_90:
338 /*
339 * This is an encapsulated Ethernet packet,
340 * or a packet bridged by some piece of
341 * Cisco hardware; the protocol ID is
342 * an Ethernet protocol type.
343 */
344 ret = ether_encap_print(et, p, length, caplen,
345 extracted_ethertype);
346 if (ret)
347 return (ret);
348 break;
349
350 case OUI_APPLETALK:
351 if (et == ETHERTYPE_ATALK) {
352 /*
353 * No, I have no idea why Apple used one
354 * of their own OUIs, rather than
355 * 0x000000, and an Ethernet packet
356 * type, for Appletalk data packets,
357 * but used 0x000000 and an Ethernet
358 * packet type for AARP packets.
359 */
360 ret = ether_encap_print(et, p, length, caplen,
361 extracted_ethertype);
362 if (ret)
363 return (ret);
364 }
365 break;
366
367 case OUI_CISCO:
368 if (et == PID_CISCO_CDP) {
369 cdp_print(p, length, caplen);
370 return (1);
371 }
372 break;
373
374 case OUI_RFC2684:
375 switch (et) {
376
377 case PID_RFC2684_ETH_FCS:
378 case PID_RFC2684_ETH_NOFCS:
379 /*
380 * XXX - remove the last two bytes for
381 * PID_RFC2684_ETH_FCS?
382 */
383 /*
384 * Skip the padding.
385 */
386 caplen -= bridge_pad;
387 length -= bridge_pad;
388 p += bridge_pad;
389
390 /*
391 * What remains is an Ethernet packet.
392 */
393 ether_print(p, length, caplen);
394 return (1);
395
396 case PID_RFC2684_802_5_FCS:
397 case PID_RFC2684_802_5_NOFCS:
398 /*
399 * XXX - remove the last two bytes for
400 * PID_RFC2684_ETH_FCS?
401 */
402 /*
403 * Skip the padding, but not the Access
404 * Control field.
405 */
406 caplen -= bridge_pad;
407 length -= bridge_pad;
408 p += bridge_pad;
409
410 /*
411 * What remains is an 802.5 Token Ring
412 * packet.
413 */
414 token_print(p, length, caplen);
415 return (1);
416
417 case PID_RFC2684_FDDI_FCS:
418 case PID_RFC2684_FDDI_NOFCS:
419 /*
420 * XXX - remove the last two bytes for
421 * PID_RFC2684_ETH_FCS?
422 */
423 /*
424 * Skip the padding.
425 */
426 caplen -= bridge_pad + 1;
427 length -= bridge_pad + 1;
428 p += bridge_pad + 1;
429
430 /*
431 * What remains is an FDDI packet.
432 */
433 fddi_print(p, length, caplen);
434 return (1);
435
436 case PID_RFC2684_BPDU:
437 stp_print(p, length);
438 return (1);
439 }
440 }
441 return (0);
442}
|
| 443
444
445/*
446 * Local Variables:
447 * c-style: whitesmith
448 * c-basic-offset: 8
449 * End:
450 */
|
| |