2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 static const char rcsid
[] _U_
=
24 "@(#) $Header: /tcpdump/master/tcpdump/print-tcp.c,v 1.107.2.3 2003/11/19 00:17:02 guy Exp $ (LBL)";
31 #include <tcpdump-stdinc.h>
39 #include "interface.h"
40 #include "addrtoname.h"
53 static void print_tcp_rst_data(register const u_char
*sp
, u_int length
);
55 #define MAX_RST_DATA_LEN 30
70 struct tcp_seq_hash
*nxt
;
76 #define TSEQ_HASHSIZE 919
78 /* These tcp optinos do not have the size octet */
79 #define ZEROLENOPT(o) ((o) == TCPOPT_EOL || (o) == TCPOPT_NOP)
81 static struct tcp_seq_hash tcp_seq_hash
[TSEQ_HASHSIZE
];
85 #define TELNET_PORT 23
90 #define NETBIOS_SSN_PORT 139
92 #define PPTP_PORT 1723
94 #define BEEP_PORT 10288
101 static int tcp_cksum(register const struct ip
*ip
,
102 register const struct tcphdr
*tp
,
117 /* pseudo-header.. */
118 phu
.ph
.len
= htons((u_int16_t
)len
);
120 phu
.ph
.proto
= IPPROTO_TCP
;
121 memcpy(&phu
.ph
.src
, &ip
->ip_src
.s_addr
, sizeof(u_int32_t
));
123 memcpy(&phu
.ph
.dst
, &ip
->ip_dst
.s_addr
, sizeof(u_int32_t
));
125 phu
.ph
.dst
= ip_finddst(ip
);
128 return in_cksum((u_short
*)tp
, len
,
129 sp
[0]+sp
[1]+sp
[2]+sp
[3]+sp
[4]+sp
[5]);
133 static int tcp6_cksum(const struct ip6_hdr
*ip6
, const struct tcphdr
*tp
,
137 register const u_int16_t
*sp
;
141 struct in6_addr ph_src
;
142 struct in6_addr ph_dst
;
151 memset(&phu
, 0, sizeof(phu
));
152 phu
.ph
.ph_src
= ip6
->ip6_src
;
153 phu
.ph
.ph_dst
= ip6
->ip6_dst
;
154 phu
.ph
.ph_len
= htonl(len
);
155 phu
.ph
.ph_nxt
= IPPROTO_TCP
;
158 for (i
= 0; i
< sizeof(phu
.pa
) / sizeof(phu
.pa
[0]); i
++)
161 sp
= (const u_int16_t
*)tp
;
163 for (i
= 0; i
< (len
& ~1); i
+= 2)
167 sum
+= htons((*(const u_int8_t
*)sp
) << 8);
170 sum
= (sum
& 0xffff) + (sum
>> 16);
178 tcp_print(register const u_char
*bp
, register u_int length
,
179 register const u_char
*bp2
, int fragmented
)
181 register const struct tcphdr
*tp
;
182 register const struct ip
*ip
;
183 register u_char flags
;
186 u_int16_t sport
, dport
, win
, urp
;
187 u_int32_t seq
, ack
, thseq
, thack
;
190 register const struct ip6_hdr
*ip6
;
193 tp
= (struct tcphdr
*)bp
;
194 ip
= (struct ip
*)bp2
;
197 ip6
= (struct ip6_hdr
*)bp2
;
202 if (!TTEST(tp
->th_dport
)) {
203 (void)printf("%s > %s: [|tcp]",
204 ipaddr_string(&ip
->ip_src
),
205 ipaddr_string(&ip
->ip_dst
));
209 sport
= EXTRACT_16BITS(&tp
->th_sport
);
210 dport
= EXTRACT_16BITS(&tp
->th_dport
);
212 hlen
= TH_OFF(tp
) * 4;
215 * If data present and NFS port used, assume NFS.
216 * Pass offset of data plus 4 bytes for RPC TCP msg length
217 * to NFS print routines.
220 if ((u_char
*)tp
+ 4 + sizeof(struct rpc_msg
) <= snapend
&&
222 nfsreq_print((u_char
*)tp
+ hlen
+ 4, length
- hlen
,
225 } else if ((u_char
*)tp
+ 4 + sizeof(struct rpc_msg
)
228 nfsreply_print((u_char
*)tp
+ hlen
+ 4, length
- hlen
,
235 if (ip6
->ip6_nxt
== IPPROTO_TCP
) {
236 (void)printf("%s.%s > %s.%s: ",
237 ip6addr_string(&ip6
->ip6_src
),
238 tcpport_string(sport
),
239 ip6addr_string(&ip6
->ip6_dst
),
240 tcpport_string(dport
));
242 (void)printf("%s > %s: ",
243 tcpport_string(sport
), tcpport_string(dport
));
248 if (ip
->ip_p
== IPPROTO_TCP
) {
249 (void)printf("%s.%s > %s.%s: ",
250 ipaddr_string(&ip
->ip_src
),
251 tcpport_string(sport
),
252 ipaddr_string(&ip
->ip_dst
),
253 tcpport_string(dport
));
255 (void)printf("%s > %s: ",
256 tcpport_string(sport
), tcpport_string(dport
));
262 seq
= EXTRACT_32BITS(&tp
->th_seq
);
263 ack
= EXTRACT_32BITS(&tp
->th_ack
);
264 win
= EXTRACT_16BITS(&tp
->th_win
);
265 urp
= EXTRACT_16BITS(&tp
->th_urp
);
268 (void)printf("tcp %d", length
- TH_OFF(tp
) * 4);
271 if ((flags
= tp
->th_flags
) & (TH_SYN
|TH_FIN
|TH_RST
|TH_PUSH
|
272 TH_ECNECHO
|TH_CWR
)) {
282 putchar('W'); /* congestion _W_indow reduced (ECN) */
283 if (flags
& TH_ECNECHO
)
284 putchar('E'); /* ecn _E_cho sent (ECN) */
288 if (!Sflag
&& (flags
& TH_ACK
)) {
289 register struct tcp_seq_hash
*th
;
290 const void *src
, *dst
;
294 * Find (or record) the initial sequence numbers for
295 * this conversation. (we pick an arbitrary
296 * collating order so there's only one entry for
300 memset(&tha
, 0, sizeof(tha
));
307 else if (sport
== dport
) {
308 if (memcmp(src
, dst
, sizeof ip6
->ip6_dst
) > 0)
312 memcpy(&tha
.src
, dst
, sizeof ip6
->ip6_dst
);
313 memcpy(&tha
.dst
, src
, sizeof ip6
->ip6_src
);
314 tha
.port
= dport
<< 16 | sport
;
316 memcpy(&tha
.dst
, dst
, sizeof ip6
->ip6_dst
);
317 memcpy(&tha
.src
, src
, sizeof ip6
->ip6_src
);
318 tha
.port
= sport
<< 16 | dport
;
325 else if (sport
== dport
) {
326 if (memcmp(src
, dst
, sizeof ip
->ip_dst
) > 0)
330 memcpy(&tha
.src
, dst
, sizeof ip
->ip_dst
);
331 memcpy(&tha
.dst
, src
, sizeof ip
->ip_src
);
332 tha
.port
= dport
<< 16 | sport
;
334 memcpy(&tha
.dst
, dst
, sizeof ip
->ip_dst
);
335 memcpy(&tha
.src
, src
, sizeof ip
->ip_src
);
336 tha
.port
= sport
<< 16 | dport
;
345 else if (sport
== dport
) {
346 if (memcmp(src
, dst
, sizeof ip
->ip_dst
) > 0)
350 memcpy(&tha
.src
, dst
, sizeof ip
->ip_dst
);
351 memcpy(&tha
.dst
, src
, sizeof ip
->ip_src
);
352 tha
.port
= dport
<< 16 | sport
;
354 memcpy(&tha
.dst
, dst
, sizeof ip
->ip_dst
);
355 memcpy(&tha
.src
, src
, sizeof ip
->ip_src
);
356 tha
.port
= sport
<< 16 | dport
;
361 for (th
= &tcp_seq_hash
[tha
.port
% TSEQ_HASHSIZE
];
362 th
->nxt
; th
= th
->nxt
)
363 if (memcmp((char *)&tha
, (char *)&th
->addr
,
364 sizeof(th
->addr
)) == 0)
367 if (!th
->nxt
|| (flags
& TH_SYN
)) {
368 /* didn't find it or new conversation */
369 if (th
->nxt
== NULL
) {
370 th
->nxt
= (struct tcp_seq_hash
*)
371 calloc(1, sizeof(*th
));
373 error("tcp_print: calloc");
377 th
->ack
= seq
, th
->seq
= ack
- 1;
379 th
->seq
= seq
, th
->ack
= ack
- 1;
382 seq
-= th
->ack
, ack
-= th
->seq
;
384 seq
-= th
->seq
, ack
-= th
->ack
;
391 thseq
= thack
= threv
= 0;
394 (void)printf(" [bad hdr length]");
398 if (IP_V(ip
) == 4 && vflag
&& !fragmented
) {
399 u_int16_t sum
, tcp_sum
;
400 if (TTEST2(tp
->th_sport
, length
)) {
401 sum
= tcp_cksum(ip
, tp
, length
);
403 tcp_sum
= EXTRACT_16BITS(&tp
->th_sum
);
404 (void)printf(" [bad tcp cksum %x (->%x)!]",
405 tcp_sum
, in_cksum_shouldbe(tcp_sum
, sum
));
407 (void)printf(" [tcp sum ok]");
411 if (IP_V(ip
) == 6 && ip6
->ip6_plen
&& vflag
&& !fragmented
) {
413 if (TTEST2(tp
->th_sport
, length
)) {
414 sum
= tcp6_cksum(ip6
, tp
, length
);
416 (void)printf(" [bad tcp cksum %x!]", sum
);
418 (void)printf(" [tcp sum ok]");
424 if (vflag
> 1 || length
> 0 || flags
& (TH_SYN
| TH_FIN
| TH_RST
))
425 (void)printf(" %u:%u(%u)", seq
, seq
+ length
, length
);
427 (void)printf(" ack %u", ack
);
429 (void)printf(" win %d", win
);
432 (void)printf(" urg %d", urp
);
434 * Handle any options.
436 if (hlen
> sizeof(*tp
)) {
437 register const u_char
*cp
;
438 register u_int i
, opt
, datalen
;
442 cp
= (const u_char
*)tp
+ sizeof(*tp
);
453 len
= *cp
++; /* total including type, len */
454 if (len
< 2 || len
> hlen
)
456 --hlen
; /* account for length byte */
458 --hlen
; /* account for type byte */
461 /* Bail if "l" bytes of data are not left or were not captured */
462 #define LENCHECK(l) { if ((l) > hlen) goto bad; TCHECK2(*cp, l); }
470 (void)printf(" %u", EXTRACT_16BITS(cp
));
483 (void)printf("wscale");
486 (void)printf(" %u", *cp
);
490 (void)printf("sackOK");
494 (void)printf("sack");
496 if (datalen
% 8 != 0) {
497 (void)printf(" malformed sack ");
501 (void)printf(" sack %d ", datalen
/ 8);
502 for (i
= 0; i
< datalen
; i
+= 8) {
504 s
= EXTRACT_32BITS(cp
+ i
);
506 e
= EXTRACT_32BITS(cp
+ i
+ 4);
514 (void)printf("{%u:%u}", s
, e
);
521 (void)printf("echo");
524 (void)printf(" %u", EXTRACT_32BITS(cp
));
527 case TCPOPT_ECHOREPLY
:
528 (void)printf("echoreply");
531 (void)printf(" %u", EXTRACT_32BITS(cp
));
534 case TCPOPT_TIMESTAMP
:
535 (void)printf("timestamp");
538 (void)printf(" %u", EXTRACT_32BITS(cp
));
540 (void)printf(" %u", EXTRACT_32BITS(cp
+ 4));
547 (void)printf(" %u", EXTRACT_32BITS(cp
));
551 (void)printf("ccnew");
554 (void)printf(" %u", EXTRACT_32BITS(cp
));
558 (void)printf("ccecho");
561 (void)printf(" %u", EXTRACT_32BITS(cp
));
565 (void)printf("opt-%u:", opt
);
567 for (i
= 0; i
< datalen
; ++i
) {
569 (void)printf("%02x", cp
[i
]);
574 /* Account for data printed */
578 /* Check specification against observed length */
579 ++datalen
; /* option octet */
580 if (!ZEROLENOPT(opt
))
581 ++datalen
; /* size octet */
583 (void)printf("[len %d]", len
);
585 if (opt
== TCPOPT_EOL
)
595 * Decode payload if necessary.
597 bp
+= TH_OFF(tp
) * 4;
598 if (flags
& TH_RST
) {
600 print_tcp_rst_data(bp
, length
);
602 if (sport
== TELNET_PORT
|| dport
== TELNET_PORT
) {
604 telnet_print(bp
, length
);
605 } else if (sport
== BGP_PORT
|| dport
== BGP_PORT
)
606 bgp_print(bp
, length
);
607 else if (sport
== PPTP_PORT
|| dport
== PPTP_PORT
)
609 #ifdef TCPDUMP_DO_SMB
610 else if (sport
== NETBIOS_SSN_PORT
|| dport
== NETBIOS_SSN_PORT
)
611 nbt_tcp_print(bp
, length
);
613 else if (sport
== BEEP_PORT
|| dport
== BEEP_PORT
)
614 beep_print(bp
, length
);
615 else if (length
> 2 &&
616 (sport
== NAMESERVER_PORT
|| dport
== NAMESERVER_PORT
||
617 sport
== MULTICASTDNS_PORT
|| dport
== MULTICASTDNS_PORT
)) {
619 * TCP DNS query has 2byte length at the head.
620 * XXX packet could be unaligned, it can go strange
622 ns_print(bp
+ 2, length
- 2, 0);
623 } else if (sport
== MSDP_PORT
|| dport
== MSDP_PORT
) {
624 msdp_print(bp
, length
);
626 else if (sport
== LDP_PORT
|| dport
== LDP_PORT
)
627 printf(": LDP, length: %u", length
);
631 fputs("[bad opt]", stdout
);
636 fputs("[|tcp]", stdout
);
642 * RFC1122 says the following on data in RST segments:
644 * 4.2.2.12 RST Segment: RFC-793 Section 3.4
646 * A TCP SHOULD allow a received RST segment to include data.
649 * It has been suggested that a RST segment could contain
650 * ASCII text that encoded and explained the cause of the
651 * RST. No standard has yet been established for such
657 print_tcp_rst_data(register const u_char
*sp
, u_int length
)
661 if (TTEST2(*sp
, length
))
665 if (length
> MAX_RST_DATA_LEN
) {
666 length
= MAX_RST_DATA_LEN
; /* can use -X for longer */
667 putchar('+'); /* indicate we truncate */
670 while (length
-- && sp
<= snapend
) {