2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 static const char rcsid
[] _U_
=
23 "@(#) $Header: /tcpdump/master/tcpdump/print-ether.c,v 1.106 2008-02-06 10:47:53 guy Exp $ (LBL)";
26 #define NETDISSECT_REWORKED
31 #include <tcpdump-stdinc.h>
36 #include "interface.h"
38 #include "addrtoname.h"
39 #include "ethertype.h"
42 const struct tok ethertype_values
[] = {
43 { ETHERTYPE_IP
, "IPv4" },
44 { ETHERTYPE_MPLS
, "MPLS unicast" },
45 { ETHERTYPE_MPLS_MULTI
, "MPLS multicast" },
46 { ETHERTYPE_IPV6
, "IPv6" },
47 { ETHERTYPE_8021Q
, "802.1Q" },
48 { ETHERTYPE_8021Q9100
, "802.1Q-9100" },
49 { ETHERTYPE_8021QinQ
, "802.1Q-QinQ" },
50 { ETHERTYPE_8021Q9200
, "802.1Q-9200" },
51 { ETHERTYPE_VMAN
, "VMAN" },
52 { ETHERTYPE_PUP
, "PUP" },
53 { ETHERTYPE_ARP
, "ARP"},
54 { ETHERTYPE_REVARP
, "Reverse ARP"},
55 { ETHERTYPE_NS
, "NS" },
56 { ETHERTYPE_SPRITE
, "Sprite" },
57 { ETHERTYPE_TRAIL
, "Trail" },
58 { ETHERTYPE_MOPDL
, "MOP DL" },
59 { ETHERTYPE_MOPRC
, "MOP RC" },
60 { ETHERTYPE_DN
, "DN" },
61 { ETHERTYPE_LAT
, "LAT" },
62 { ETHERTYPE_SCA
, "SCA" },
63 { ETHERTYPE_TEB
, "TEB" },
64 { ETHERTYPE_LANBRIDGE
, "Lanbridge" },
65 { ETHERTYPE_DECDNS
, "DEC DNS" },
66 { ETHERTYPE_DECDTS
, "DEC DTS" },
67 { ETHERTYPE_VEXP
, "VEXP" },
68 { ETHERTYPE_VPROD
, "VPROD" },
69 { ETHERTYPE_ATALK
, "Appletalk" },
70 { ETHERTYPE_AARP
, "Appletalk ARP" },
71 { ETHERTYPE_IPX
, "IPX" },
72 { ETHERTYPE_PPP
, "PPP" },
73 { ETHERTYPE_MPCP
, "MPCP" },
74 { ETHERTYPE_SLOW
, "Slow Protocols" },
75 { ETHERTYPE_PPPOED
, "PPPoE D" },
76 { ETHERTYPE_PPPOES
, "PPPoE S" },
77 { ETHERTYPE_EAPOL
, "EAPOL" },
78 { ETHERTYPE_RRCP
, "RRCP" },
79 { ETHERTYPE_JUMBO
, "Jumbo" },
80 { ETHERTYPE_LOOPBACK
, "Loopback" },
81 { ETHERTYPE_ISO
, "OSI" },
82 { ETHERTYPE_GRE_ISO
, "GRE-OSI" },
83 { ETHERTYPE_CFM_OLD
, "CFM (old)" },
84 { ETHERTYPE_CFM
, "CFM" },
85 { ETHERTYPE_LLDP
, "LLDP" },
86 { ETHERTYPE_TIPC
, "TIPC"},
91 ether_hdr_print(netdissect_options
*ndo
,
92 const u_char
*bp
, u_int length
)
94 register const struct ether_header
*ep
;
97 ep
= (const struct ether_header
*)bp
;
99 (void)ND_PRINT((ndo
, "%s > %s",
100 etheraddr_string(ESRC(ep
)),
101 etheraddr_string(EDST(ep
))));
103 ether_type
= EXTRACT_16BITS(&ep
->ether_type
);
104 if (!ndo
->ndo_qflag
) {
105 if (ether_type
<= ETHERMTU
)
106 (void)ND_PRINT((ndo
, ", 802.3"));
108 (void)ND_PRINT((ndo
, ", ethertype %s (0x%04x)",
109 tok2str(ethertype_values
,"Unknown", ether_type
),
112 if (ether_type
<= ETHERMTU
)
113 (void)ND_PRINT((ndo
, ", 802.3"));
115 (void)ND_PRINT((ndo
, ", %s", tok2str(ethertype_values
,"Unknown Ethertype (0x%04x)", ether_type
)));
118 (void)ND_PRINT((ndo
, ", length %u: ", length
));
122 * Print an Ethernet frame.
123 * This might be encapsulated within another frame; we might be passed
124 * a pointer to a function that can print header information for that
125 * frame's protocol, and an argument to pass to that function.
128 ether_print(netdissect_options
*ndo
,
129 const u_char
*p
, u_int length
, u_int caplen
,
130 void (*print_encap_header
)(netdissect_options
*ndo
, const u_char
*), const u_char
*encap_header_arg
)
132 struct ether_header
*ep
;
135 u_short extracted_ether_type
;
137 if (caplen
< ETHER_HDRLEN
|| length
< ETHER_HDRLEN
) {
138 ND_PRINT((ndo
, "[|ether]"));
142 if (ndo
->ndo_eflag
) {
143 if (print_encap_header
!= NULL
)
144 (*print_encap_header
)(ndo
, encap_header_arg
);
145 ether_hdr_print(ndo
, p
, length
);
147 orig_length
= length
;
149 length
-= ETHER_HDRLEN
;
150 caplen
-= ETHER_HDRLEN
;
151 ep
= (struct ether_header
*)p
;
154 ether_type
= EXTRACT_16BITS(&ep
->ether_type
);
158 * Is it (gag) an 802.3 encapsulation?
160 if (ether_type
<= ETHERMTU
) {
161 /* Try to print the LLC-layer header & higher layers */
162 if (llc_print(p
, length
, caplen
, ESRC(ep
), EDST(ep
),
163 &extracted_ether_type
) == 0) {
164 /* ether_type not known, print raw packet */
165 if (!ndo
->ndo_eflag
) {
166 if (print_encap_header
!= NULL
)
167 (*print_encap_header
)(ndo
, encap_header_arg
);
168 ether_hdr_print(ndo
, (u_char
*)ep
, orig_length
);
171 if (!ndo
->ndo_suppress_default_print
)
172 ndo
->ndo_default_print(ndo
, p
, caplen
);
174 } else if (ether_type
== ETHERTYPE_8021Q
||
175 ether_type
== ETHERTYPE_8021Q9100
||
176 ether_type
== ETHERTYPE_8021Q9200
||
177 ether_type
== ETHERTYPE_8021QinQ
) {
179 * Print VLAN information, and then go back and process
180 * the enclosed type field.
182 if (caplen
< 4 || length
< 4) {
183 ND_PRINT((ndo
, "[|vlan]"));
186 if (ndo
->ndo_eflag
) {
187 u_int16_t tag
= EXTRACT_16BITS(p
);
189 ND_PRINT((ndo
, "vlan %u, p %u%s, ",
192 (tag
& 0x1000) ? ", CFI" : ""));
195 ether_type
= EXTRACT_16BITS(p
+ 2);
196 if (ndo
->ndo_eflag
&& ether_type
> ETHERMTU
)
197 ND_PRINT((ndo
, "ethertype %s, ", tok2str(ethertype_values
,"0x%04x", ether_type
)));
202 } else if (ether_type
== ETHERTYPE_JUMBO
) {
204 * Alteon jumbo frames.
207 * http://tools.ietf.org/html/draft-ietf-isis-ext-eth-01
209 * which indicates that, following the type field,
210 * there's an LLC header and payload.
212 /* Try to print the LLC-layer header & higher layers */
213 if (llc_print(p
, length
, caplen
, ESRC(ep
), EDST(ep
),
214 &extracted_ether_type
) == 0) {
215 /* ether_type not known, print raw packet */
216 if (!ndo
->ndo_eflag
) {
217 if (print_encap_header
!= NULL
)
218 (*print_encap_header
)(ndo
, encap_header_arg
);
219 ether_hdr_print(ndo
, (u_char
*)ep
, orig_length
);
222 if (!ndo
->ndo_suppress_default_print
)
223 ndo
->ndo_default_print(ndo
, p
, caplen
);
226 if (ethertype_print(ndo
, ether_type
, p
, length
, caplen
) == 0) {
227 /* ether_type not known, print raw packet */
228 if (!ndo
->ndo_eflag
) {
229 if (print_encap_header
!= NULL
)
230 (*print_encap_header
)(ndo
, encap_header_arg
);
231 ether_hdr_print(ndo
, (u_char
*)ep
, orig_length
);
234 if (!ndo
->ndo_suppress_default_print
)
235 ndo
->ndo_default_print(ndo
, p
, caplen
);
241 * This is the top level routine of the printer. 'p' points
242 * to the ether header of the packet, 'h->ts' is the timestamp,
243 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
244 * is the number of bytes actually captured.
247 ether_if_print(netdissect_options
*ndo
, const struct pcap_pkthdr
*h
,
250 ether_print(ndo
, p
, h
->len
, h
->caplen
, NULL
, NULL
);
252 return (ETHER_HDRLEN
);
256 * This is the top level routine of the printer. 'p' points
257 * to the ether header of the packet, 'h->ts' is the timestamp,
258 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
259 * is the number of bytes actually captured.
261 * This is for DLT_NETANALYZER, which has a 4-byte pseudo-header
262 * before the Ethernet header.
265 netanalyzer_if_print(netdissect_options
*ndo
, const struct pcap_pkthdr
*h
,
269 * Fail if we don't have enough data for the Hilscher pseudo-header.
271 if (h
->len
< 4 || h
->caplen
< 4) {
272 printf("[|netanalyzer]");
276 /* Skip the pseudo-header. */
277 ether_print(ndo
, p
+ 4, h
->len
- 4, h
->caplen
- 4, NULL
, NULL
);
279 return (4 + ETHER_HDRLEN
);
283 * This is the top level routine of the printer. 'p' points
284 * to the ether header of the packet, 'h->ts' is the timestamp,
285 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
286 * is the number of bytes actually captured.
288 * This is for DLT_NETANALYZER_TRANSPARENT, which has a 4-byte
289 * pseudo-header, a 7-byte Ethernet preamble, and a 1-byte Ethernet SOF
290 * before the Ethernet header.
293 netanalyzer_transparent_if_print(netdissect_options
*ndo
,
294 const struct pcap_pkthdr
*h
,
298 * Fail if we don't have enough data for the Hilscher pseudo-header,
301 if (h
->len
< 12 || h
->caplen
< 12) {
302 printf("[|netanalyzer-transparent]");
306 /* Skip the pseudo-header, preamble, and SOF. */
307 ether_print(ndo
, p
+ 12, h
->len
- 12, h
->caplen
- 12, NULL
, NULL
);
309 return (12 + ETHER_HDRLEN
);
313 * Prints the packet payload, given an Ethernet type code for the payload's
316 * Returns non-zero if it can do so, zero if the ethertype is unknown.
320 ethertype_print(netdissect_options
*ndo
,
321 u_short ether_type
, const u_char
*p
,
322 u_int length
, u_int caplen
)
324 switch (ether_type
) {
327 ip_print(ndo
, p
, length
);
332 ip6_print(ndo
, p
, length
);
337 case ETHERTYPE_REVARP
:
338 arp_print(ndo
, p
, length
, caplen
);
342 decnet_print(/*ndo,*/p
, length
, caplen
);
345 case ETHERTYPE_ATALK
:
347 fputs("et1 ", stdout
);
348 atalk_print(/*ndo,*/p
, length
);
352 aarp_print(/*ndo,*/p
, length
);
356 ND_PRINT((ndo
, "(NOV-ETHII) "));
357 ipx_print(/*ndo,*/p
, length
);
361 isoclns_print(/*ndo,*/p
+1, length
-1, length
-1);
364 case ETHERTYPE_PPPOED
:
365 case ETHERTYPE_PPPOES
:
366 case ETHERTYPE_PPPOED2
:
367 case ETHERTYPE_PPPOES2
:
368 pppoe_print(/*ndo,*/p
, length
);
371 case ETHERTYPE_EAPOL
:
372 eap_print(ndo
, p
, length
);
376 rrcp_print(ndo
, p
- 14 , length
+ 14);
382 ppp_print(/*ndo,*/p
, length
);
387 mpcp_print(/*ndo,*/p
, length
);
391 slow_print(/*ndo,*/p
, length
);
395 case ETHERTYPE_CFM_OLD
:
396 cfm_print(/*ndo,*/p
, length
);
400 lldp_print(/*ndo,*/p
, length
);
403 case ETHERTYPE_LOOPBACK
:
407 case ETHERTYPE_MPLS_MULTI
:
408 mpls_print(/*ndo,*/p
, length
);
412 tipc_print(ndo
, p
, length
, caplen
);
417 case ETHERTYPE_MOPRC
:
418 case ETHERTYPE_MOPDL
:
419 /* default_print for now */
428 * c-style: whitesmith