Home | History | Annotate | Download | only in tcpdump 
      1 /*
      2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
      3  *	The Regents of the University of California.  All rights reserved.
      4  *
      5  * Redistribution and use in source and binary forms, with or without
      6  * modification, are permitted provided that: (1) source code distributions
      7  * retain the above copyright notice and this paragraph in its entirety, (2)
      8  * distributions including binary code include the above copyright notice and
      9  * this paragraph in its entirety in the documentation or other materials
     10  * provided with the distribution, and (3) all advertising materials mentioning
     11  * features or use of this software display the following acknowledgement:
     12  * ``This product includes software developed by the University of California,
     13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
     14  * the University nor the names of its contributors may be used to endorse
     15  * or promote products derived from this software without specific prior
     16  * written permission.
     17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
     18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
     19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
     20  */
     21 #ifndef lint
     22 static const char rcsid[] _U_ =
     23     "@(#) $Header: /tcpdump/master/tcpdump/print-ether.c,v 1.106 2008-02-06 10:47:53 guy Exp $ (LBL)";
     24 #endif
     25 
     26 #define NETDISSECT_REWORKED
     27 #ifdef HAVE_CONFIG_H
     28 #include "config.h"
     29 #endif
     30 
     31 #include <tcpdump-stdinc.h>
     32 
     33 #include <stdio.h>
     34 #include <pcap.h>
     35 
     36 #include "interface.h"
     37 #include "extract.h"
     38 #include "addrtoname.h"
     39 #include "ethertype.h"
     40 #include "ether.h"
     41 
     42 const struct tok ethertype_values[] = {
     43     { ETHERTYPE_IP,		"IPv4" },
     44     { ETHERTYPE_MPLS,		"MPLS unicast" },
     45     { ETHERTYPE_MPLS_MULTI,	"MPLS multicast" },
     46     { ETHERTYPE_IPV6,		"IPv6" },
     47     { ETHERTYPE_8021Q,		"802.1Q" },
     48     { ETHERTYPE_8021Q9100,	"802.1Q-9100" },
     49     { ETHERTYPE_8021QinQ,	"802.1Q-QinQ" },
     50     { ETHERTYPE_8021Q9200,	"802.1Q-9200" },
     51     { ETHERTYPE_VMAN,		"VMAN" },
     52     { ETHERTYPE_PUP,            "PUP" },
     53     { ETHERTYPE_ARP,            "ARP"},
     54     { ETHERTYPE_REVARP,         "Reverse ARP"},
     55     { ETHERTYPE_NS,             "NS" },
     56     { ETHERTYPE_SPRITE,         "Sprite" },
     57     { ETHERTYPE_TRAIL,          "Trail" },
     58     { ETHERTYPE_MOPDL,          "MOP DL" },
     59     { ETHERTYPE_MOPRC,          "MOP RC" },
     60     { ETHERTYPE_DN,             "DN" },
     61     { ETHERTYPE_LAT,            "LAT" },
     62     { ETHERTYPE_SCA,            "SCA" },
     63     { ETHERTYPE_TEB,            "TEB" },
     64     { ETHERTYPE_LANBRIDGE,      "Lanbridge" },
     65     { ETHERTYPE_DECDNS,         "DEC DNS" },
     66     { ETHERTYPE_DECDTS,         "DEC DTS" },
     67     { ETHERTYPE_VEXP,           "VEXP" },
     68     { ETHERTYPE_VPROD,          "VPROD" },
     69     { ETHERTYPE_ATALK,          "Appletalk" },
     70     { ETHERTYPE_AARP,           "Appletalk ARP" },
     71     { ETHERTYPE_IPX,            "IPX" },
     72     { ETHERTYPE_PPP,            "PPP" },
     73     { ETHERTYPE_MPCP,           "MPCP" },
     74     { ETHERTYPE_SLOW,           "Slow Protocols" },
     75     { ETHERTYPE_PPPOED,         "PPPoE D" },
     76     { ETHERTYPE_PPPOES,         "PPPoE S" },
     77     { ETHERTYPE_EAPOL,          "EAPOL" },
     78     { ETHERTYPE_RRCP,           "RRCP" },
     79     { ETHERTYPE_MS_NLB_HB,      "MS NLB heartbeat" },
     80     { ETHERTYPE_JUMBO,          "Jumbo" },
     81     { ETHERTYPE_LOOPBACK,       "Loopback" },
     82     { ETHERTYPE_ISO,            "OSI" },
     83     { ETHERTYPE_GRE_ISO,        "GRE-OSI" },
     84     { ETHERTYPE_CFM_OLD,        "CFM (old)" },
     85     { ETHERTYPE_CFM,            "CFM" },
     86     { ETHERTYPE_LLDP,           "LLDP" },
     87     { ETHERTYPE_TIPC,           "TIPC"},
     88     { ETHERTYPE_GEONET_OLD,     "GeoNet (old)"},
     89     { ETHERTYPE_GEONET,         "GeoNet"},
     90     { ETHERTYPE_CALM_FAST,      "CALM FAST"},
     91     { 0, NULL}
     92 };
     93 
     94 static inline void
     95 ether_hdr_print(netdissect_options *ndo,
     96                 const u_char *bp, u_int length)
     97 {
     98 	register const struct ether_header *ep;
     99 	u_int16_t ether_type;
    100 
    101 	ep = (const struct ether_header *)bp;
    102 
    103 	(void)ND_PRINT((ndo, "%s > %s",
    104 		     etheraddr_string(ESRC(ep)),
    105 		     etheraddr_string(EDST(ep))));
    106 
    107 	ether_type = EXTRACT_16BITS(&ep->ether_type);
    108 	if (!ndo->ndo_qflag) {
    109 	        if (ether_type <= ETHERMTU)
    110 		          (void)ND_PRINT((ndo, ", 802.3"));
    111                 else
    112 		          (void)ND_PRINT((ndo, ", ethertype %s (0x%04x)",
    113 				       tok2str(ethertype_values,"Unknown", ether_type),
    114                                        ether_type));
    115         } else {
    116                 if (ether_type <= ETHERMTU)
    117                           (void)ND_PRINT((ndo, ", 802.3"));
    118                 else
    119                           (void)ND_PRINT((ndo, ", %s", tok2str(ethertype_values,"Unknown Ethertype (0x%04x)", ether_type)));
    120         }
    121 
    122 	(void)ND_PRINT((ndo, ", length %u: ", length));
    123 }
    124 
    125 /*
    126  * Print an Ethernet frame.
    127  * This might be encapsulated within another frame; we might be passed
    128  * a pointer to a function that can print header information for that
    129  * frame's protocol, and an argument to pass to that function.
    130  */
    131 void
    132 ether_print(netdissect_options *ndo,
    133             const u_char *p, u_int length, u_int caplen,
    134             void (*print_encap_header)(netdissect_options *ndo, const u_char *), const u_char *encap_header_arg)
    135 {
    136 	struct ether_header *ep;
    137 	u_int orig_length;
    138 	u_short ether_type;
    139 	u_short extracted_ether_type;
    140 
    141 	if (caplen < ETHER_HDRLEN || length < ETHER_HDRLEN) {
    142 		ND_PRINT((ndo, "[|ether]"));
    143 		return;
    144 	}
    145 
    146 	if (ndo->ndo_eflag) {
    147 		if (print_encap_header != NULL)
    148 			(*print_encap_header)(ndo, encap_header_arg);
    149 		ether_hdr_print(ndo, p, length);
    150 	}
    151 	orig_length = length;
    152 
    153 	length -= ETHER_HDRLEN;
    154 	caplen -= ETHER_HDRLEN;
    155 	ep = (struct ether_header *)p;
    156 	p += ETHER_HDRLEN;
    157 
    158 	ether_type = EXTRACT_16BITS(&ep->ether_type);
    159 
    160 recurse:
    161 	/*
    162 	 * Is it (gag) an 802.3 encapsulation?
    163 	 */
    164 	if (ether_type <= ETHERMTU) {
    165 		/* Try to print the LLC-layer header & higher layers */
    166 		if (llc_print(p, length, caplen, ESRC(ep), EDST(ep),
    167 		    &extracted_ether_type) == 0) {
    168 			/* ether_type not known, print raw packet */
    169 			if (!ndo->ndo_eflag) {
    170 				if (print_encap_header != NULL)
    171 					(*print_encap_header)(ndo, encap_header_arg);
    172 				ether_hdr_print(ndo, (u_char *)ep, orig_length);
    173 			}
    174 
    175 			if (!ndo->ndo_suppress_default_print)
    176 				ndo->ndo_default_print(ndo, p, caplen);
    177 		}
    178 	} else if (ether_type == ETHERTYPE_8021Q  ||
    179                 ether_type == ETHERTYPE_8021Q9100 ||
    180                 ether_type == ETHERTYPE_8021Q9200 ||
    181                 ether_type == ETHERTYPE_8021QinQ) {
    182 		/*
    183 		 * Print VLAN information, and then go back and process
    184 		 * the enclosed type field.
    185 		 */
    186 		if (caplen < 4 || length < 4) {
    187 			ND_PRINT((ndo, "[|vlan]"));
    188 			return;
    189 		}
    190 	        if (ndo->ndo_eflag) {
    191 	        	u_int16_t tag = EXTRACT_16BITS(p);
    192 
    193 			ND_PRINT((ndo, "vlan %u, p %u%s, ",
    194 			    tag & 0xfff,
    195 			    tag >> 13,
    196 			    (tag & 0x1000) ? ", CFI" : ""));
    197 		}
    198 
    199 		ether_type = EXTRACT_16BITS(p + 2);
    200 		if (ndo->ndo_eflag && ether_type > ETHERMTU)
    201 			ND_PRINT((ndo, "ethertype %s, ", tok2str(ethertype_values,"0x%04x", ether_type)));
    202 		p += 4;
    203 		length -= 4;
    204 		caplen -= 4;
    205 		goto recurse;
    206 	} else if (ether_type == ETHERTYPE_JUMBO) {
    207 		/*
    208 		 * Alteon jumbo frames.
    209 		 * See
    210 		 *
    211 		 *	http://tools.ietf.org/html/draft-ietf-isis-ext-eth-01
    212 		 *
    213 		 * which indicates that, following the type field,
    214 		 * there's an LLC header and payload.
    215 		 */
    216 		/* Try to print the LLC-layer header & higher layers */
    217 		if (llc_print(p, length, caplen, ESRC(ep), EDST(ep),
    218 		    &extracted_ether_type) == 0) {
    219 			/* ether_type not known, print raw packet */
    220 			if (!ndo->ndo_eflag) {
    221 				if (print_encap_header != NULL)
    222 					(*print_encap_header)(ndo, encap_header_arg);
    223 				ether_hdr_print(ndo, (u_char *)ep, orig_length);
    224 			}
    225 
    226 			if (!ndo->ndo_suppress_default_print)
    227 				ndo->ndo_default_print(ndo, p, caplen);
    228 		}
    229 	} else {
    230 		if (ethertype_print(ndo, ether_type, p, length, caplen) == 0) {
    231 			/* ether_type not known, print raw packet */
    232 			if (!ndo->ndo_eflag) {
    233 				if (print_encap_header != NULL)
    234 					(*print_encap_header)(ndo, encap_header_arg);
    235 				ether_hdr_print(ndo, (u_char *)ep, orig_length);
    236 			}
    237 
    238 			if (!ndo->ndo_suppress_default_print)
    239 				ndo->ndo_default_print(ndo, p, caplen);
    240 		}
    241 	}
    242 }
    243 
    244 /*
    245  * This is the top level routine of the printer.  'p' points
    246  * to the ether header of the packet, 'h->ts' is the timestamp,
    247  * 'h->len' is the length of the packet off the wire, and 'h->caplen'
    248  * is the number of bytes actually captured.
    249  */
    250 u_int
    251 ether_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
    252                const u_char *p)
    253 {
    254 	ether_print(ndo, p, h->len, h->caplen, NULL, NULL);
    255 
    256 	return (ETHER_HDRLEN);
    257 }
    258 
    259 /*
    260  * This is the top level routine of the printer.  'p' points
    261  * to the ether header of the packet, 'h->ts' is the timestamp,
    262  * 'h->len' is the length of the packet off the wire, and 'h->caplen'
    263  * is the number of bytes actually captured.
    264  *
    265  * This is for DLT_NETANALYZER, which has a 4-byte pseudo-header
    266  * before the Ethernet header.
    267  */
    268 u_int
    269 netanalyzer_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
    270                      const u_char *p)
    271 {
    272 	/*
    273 	 * Fail if we don't have enough data for the Hilscher pseudo-header.
    274 	 */
    275 	if (h->len < 4 || h->caplen < 4) {
    276 		printf("[|netanalyzer]");
    277 		return (h->caplen);
    278 	}
    279 
    280 	/* Skip the pseudo-header. */
    281 	ether_print(ndo, p + 4, h->len - 4, h->caplen - 4, NULL, NULL);
    282 
    283 	return (4 + ETHER_HDRLEN);
    284 }
    285 
    286 /*
    287  * This is the top level routine of the printer.  'p' points
    288  * to the ether header of the packet, 'h->ts' is the timestamp,
    289  * 'h->len' is the length of the packet off the wire, and 'h->caplen'
    290  * is the number of bytes actually captured.
    291  *
    292  * This is for DLT_NETANALYZER_TRANSPARENT, which has a 4-byte
    293  * pseudo-header, a 7-byte Ethernet preamble, and a 1-byte Ethernet SOF
    294  * before the Ethernet header.
    295  */
    296 u_int
    297 netanalyzer_transparent_if_print(netdissect_options *ndo,
    298                                  const struct pcap_pkthdr *h,
    299                                  const u_char *p)
    300 {
    301 	/*
    302 	 * Fail if we don't have enough data for the Hilscher pseudo-header,
    303 	 * preamble, and SOF.
    304 	 */
    305 	if (h->len < 12 || h->caplen < 12) {
    306 		printf("[|netanalyzer-transparent]");
    307 		return (h->caplen);
    308 	}
    309 
    310 	/* Skip the pseudo-header, preamble, and SOF. */
    311 	ether_print(ndo, p + 12, h->len - 12, h->caplen - 12, NULL, NULL);
    312 
    313 	return (12 + ETHER_HDRLEN);
    314 }
    315 
    316 /*
    317  * Prints the packet payload, given an Ethernet type code for the payload's
    318  * protocol.
    319  *
    320  * Returns non-zero if it can do so, zero if the ethertype is unknown.
    321  */
    322 
    323 int
    324 ethertype_print(netdissect_options *ndo,
    325                 u_short ether_type, const u_char *p,
    326                 u_int length, u_int caplen)
    327 {
    328 	switch (ether_type) {
    329 
    330 	case ETHERTYPE_IP:
    331 	        ip_print(ndo, p, length);
    332 		return (1);
    333 
    334 #ifdef INET6
    335 	case ETHERTYPE_IPV6:
    336 		ip6_print(ndo, p, length);
    337 		return (1);
    338 #endif /*INET6*/
    339 
    340 	case ETHERTYPE_ARP:
    341 	case ETHERTYPE_REVARP:
    342   	        arp_print(ndo, p, length, caplen);
    343 		return (1);
    344 
    345 	case ETHERTYPE_DN:
    346 		decnet_print(/*ndo,*/p, length, caplen);
    347 		return (1);
    348 
    349 	case ETHERTYPE_ATALK:
    350 		if (ndo->ndo_vflag)
    351 			fputs("et1 ", stdout);
    352 		atalk_print(/*ndo,*/p, length);
    353 		return (1);
    354 
    355 	case ETHERTYPE_AARP:
    356 		aarp_print(/*ndo,*/p, length);
    357 		return (1);
    358 
    359 	case ETHERTYPE_IPX:
    360 		ND_PRINT((ndo, "(NOV-ETHII) "));
    361 		ipx_print(/*ndo,*/p, length);
    362 		return (1);
    363 
    364         case ETHERTYPE_ISO:
    365                 isoclns_print(/*ndo,*/p+1, length-1, length-1);
    366                 return(1);
    367 
    368 	case ETHERTYPE_PPPOED:
    369 	case ETHERTYPE_PPPOES:
    370 	case ETHERTYPE_PPPOED2:
    371 	case ETHERTYPE_PPPOES2:
    372 		pppoe_print(/*ndo,*/p, length);
    373 		return (1);
    374 
    375 	case ETHERTYPE_EAPOL:
    376 	        eap_print(ndo, p, length);
    377 		return (1);
    378 
    379 	case ETHERTYPE_RRCP:
    380 	        rrcp_print(ndo, p - 14 , length + 14);
    381 		return (1);
    382 
    383 	case ETHERTYPE_PPP:
    384 		if (length) {
    385 			printf(": ");
    386 			ppp_print(/*ndo,*/p, length);
    387 		}
    388 		return (1);
    389 
    390 	case ETHERTYPE_MPCP:
    391 	        mpcp_print(/*ndo,*/p, length);
    392 		return (1);
    393 
    394 	case ETHERTYPE_SLOW:
    395 	        slow_print(/*ndo,*/p, length);
    396 		return (1);
    397 
    398 	case ETHERTYPE_CFM:
    399 	case ETHERTYPE_CFM_OLD:
    400 	        cfm_print(/*ndo,*/p, length);
    401 		return (1);
    402 
    403 	case ETHERTYPE_LLDP:
    404 	        lldp_print(/*ndo,*/p, length);
    405 		return (1);
    406 
    407         case ETHERTYPE_LOOPBACK:
    408                 return (1);
    409 
    410 	case ETHERTYPE_MPLS:
    411 	case ETHERTYPE_MPLS_MULTI:
    412 		mpls_print(/*ndo,*/p, length);
    413 		return (1);
    414 
    415 	case ETHERTYPE_TIPC:
    416 		tipc_print(ndo, p, length, caplen);
    417 		return (1);
    418 
    419 	case ETHERTYPE_MS_NLB_HB:
    420 		msnlb_print(ndo, p);
    421 		return (1);
    422 
    423         case ETHERTYPE_GEONET_OLD:
    424         case ETHERTYPE_GEONET:
    425                 geonet_print(ndo, p-14, p, length);
    426                 return (1);
    427 
    428         case ETHERTYPE_CALM_FAST:
    429                 calm_fast_print(ndo, p-14, p, length);
    430                 return (1);
    431 
    432 	case ETHERTYPE_LAT:
    433 	case ETHERTYPE_SCA:
    434 	case ETHERTYPE_MOPRC:
    435 	case ETHERTYPE_MOPDL:
    436 		/* default_print for now */
    437 	default:
    438 		return (0);
    439 	}
    440 }
    441 
    442 
    443 /*
    444  * Local Variables:
    445  * c-style: whitesmith
    446  * c-basic-offset: 8
    447  * End:
    448  */
    449 
    450