dist/tcpdump/print-eigrp.c

   1 /*      $NetBSD$        */
   2
   3 /*
   4  * Copyright (c) 1998-2004  Hannes Gredler <hannes@tcpdump.org>
   5  *      The TCPDUMP project
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that: (1) source code
   9  * distributions retain the above copyright notice and this paragraph
  10  * in its entirety, and (2) distributions including binary code include
  11  * the above copyright notice and this paragraph in its entirety in
  12  * the documentation or other materials provided with the distribution.
  13  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
  14  * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
  15  * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  16  * FOR A PARTICULAR PURPOSE.
  17  */
  18
  19 #include <sys/cdefs.h>
  20 #ifndef lint
  21 #if 0
  22 static const char rcsid[] _U_ =
  23     "@(#) Header: /tcpdump/master/tcpdump/print-eigrp.c,v 1.5.2.2 2005/05/06 02:53:41 guy Exp";
  24 #else
  25 __RCSID("$NetBSD: tcpdump2rcsid.ex,v 1.1 2001/06/25 20:09:58 itojun Exp $");
  26 #endif
  27 #endif
  28
  29 #ifdef HAVE_CONFIG_H
  30 #include "config.h"
  31 #endif
  32
  33 #include <tcpdump-stdinc.h>
  34
  35 #include <stdio.h>
  36 #include <stdlib.h>
  37 #include <string.h>
  38
  39 #include "interface.h"
  40 #include "extract.h"
  41 #include "addrtoname.h"
  42
  43 /*
  44  * packet format documented at
  45  * http://www.rhyshaden.com/eigrp.htm
  46  */
  47
  48 struct eigrp_common_header {
  49     u_int8_t version;
  50     u_int8_t opcode;
  51     u_int8_t checksum[2];
  52     u_int8_t flags[4];
  53     u_int8_t seq[4];
  54     u_int8_t ack[4];
  55     u_int8_t asn[4];
  56 };
  57
  58 #define EIGRP_VERSION                        2
  59
  60 #define EIGRP_OPCODE_UPDATE                  1
  61 #define EIGRP_OPCODE_QUERY                   3
  62 #define EIGRP_OPCODE_REPLY                   4
  63 #define EIGRP_OPCODE_HELLO                   5
  64 #define EIGRP_OPCODE_IPXSAP                  6
  65 #define EIGRP_OPCODE_PROBE                   7
  66
  67 static const struct tok eigrp_opcode_values[] = {
  68     { EIGRP_OPCODE_UPDATE, "Update" },
  69     { EIGRP_OPCODE_QUERY, "Query" },
  70     { EIGRP_OPCODE_REPLY, "Reply" },
  71     { EIGRP_OPCODE_HELLO, "Hello" },
  72     { EIGRP_OPCODE_IPXSAP, "IPX SAP" },
  73     { EIGRP_OPCODE_PROBE, "Probe" },
  74     { 0, NULL}
  75 };
  76
  77 static const struct tok eigrp_common_header_flag_values[] = {
  78     { 0x01, "Init" },
  79     { 0x02, "Conditionally Received" },
  80     { 0, NULL}
  81 };
  82
  83 struct eigrp_tlv_header {
  84     u_int8_t type[2];
  85     u_int8_t length[2];
  86 };
  87
  88 #define EIGRP_TLV_GENERAL_PARM   0x0001
  89 #define EIGRP_TLV_AUTH           0x0002
  90 #define EIGRP_TLV_SEQ            0x0003
  91 #define EIGRP_TLV_SW_VERSION     0x0004
  92 #define EIGRP_TLV_MCAST_SEQ      0x0005
  93 #define EIGRP_TLV_IP_INT         0x0102
  94 #define EIGRP_TLV_IP_EXT         0x0103
  95 #define EIGRP_TLV_AT_INT         0x0202
  96 #define EIGRP_TLV_AT_EXT         0x0203
  97 #define EIGRP_TLV_AT_CABLE_SETUP 0x0204
  98 #define EIGRP_TLV_IPX_INT        0x0302
  99 #define EIGRP_TLV_IPX_EXT        0x0303
 100
 101 static const struct tok eigrp_tlv_values[] = {
 102     { EIGRP_TLV_GENERAL_PARM, "General Parameters"},
 103     { EIGRP_TLV_AUTH, "Authentication"},
 104     { EIGRP_TLV_SEQ, "Sequence"},
 105     { EIGRP_TLV_SW_VERSION, "Software Version"},
 106     { EIGRP_TLV_MCAST_SEQ, "Next Multicast Sequence"},
 107     { EIGRP_TLV_IP_INT, "IP Internal routes"},
 108     { EIGRP_TLV_IP_EXT, "IP External routes"},
 109     { EIGRP_TLV_AT_INT, "AppleTalk Internal routes"},
 110     { EIGRP_TLV_AT_EXT, "AppleTalk External routes"},
 111     { EIGRP_TLV_AT_CABLE_SETUP, "AppleTalk Cable setup"},
 112     { EIGRP_TLV_IPX_INT, "IPX Internal routes"},
 113     { EIGRP_TLV_IPX_EXT, "IPX External routes"},
 114     { 0, NULL}
 115 };
 116
 117 struct eigrp_tlv_general_parm_t {
 118     u_int8_t k1;
 119     u_int8_t k2;
 120     u_int8_t k3;
 121     u_int8_t k4;
 122     u_int8_t k5;
 123     u_int8_t res;
 124     u_int8_t holdtime[2];
 125 };
 126
 127 struct eigrp_tlv_sw_version_t {
 128     u_int8_t ios_major;
 129     u_int8_t ios_minor;
 130     u_int8_t eigrp_major;
 131     u_int8_t eigrp_minor;
 132 };
 133
 134 struct eigrp_tlv_ip_int_t {
 135     u_int8_t nexthop[4];
 136     u_int8_t delay[4];
 137     u_int8_t bandwidth[4];
 138     u_int8_t mtu[3];
 139     u_int8_t hopcount;
 140     u_int8_t reliability;
 141     u_int8_t load;
 142     u_int8_t reserved[2];
 143     u_int8_t plen;
 144     u_int8_t destination; /* variable length [1-4] bytes encoding */
 145 };
 146
 147 struct eigrp_tlv_ip_ext_t {
 148     u_int8_t nexthop[4];
 149     u_int8_t origin_router[4];
 150     u_int8_t origin_as[4];
 151     u_int8_t tag[4];
 152     u_int8_t metric[4];
 153     u_int8_t reserved[2];
 154     u_int8_t proto_id;
 155     u_int8_t flags;
 156     u_int8_t delay[4];
 157     u_int8_t bandwidth[4];
 158     u_int8_t mtu[3];
 159     u_int8_t hopcount;
 160     u_int8_t reliability;
 161     u_int8_t load;
 162     u_int8_t reserved2[2];
 163     u_int8_t plen;
 164     u_int8_t destination; /* variable length [1-4] bytes encoding */
 165 };
 166
 167 struct eigrp_tlv_at_cable_setup_t {
 168     u_int8_t cable_start[2];
 169     u_int8_t cable_end[2];
 170     u_int8_t router_id[4];
 171 };
 172
 173 struct eigrp_tlv_at_int_t {
 174     u_int8_t nexthop[4];
 175     u_int8_t delay[4];
 176     u_int8_t bandwidth[4];
 177     u_int8_t mtu[3];
 178     u_int8_t hopcount;
 179     u_int8_t reliability;
 180     u_int8_t load;
 181     u_int8_t reserved[2];
 182     u_int8_t cable_start[2];
 183     u_int8_t cable_end[2];
 184 };
 185
 186 struct eigrp_tlv_at_ext_t {
 187     u_int8_t nexthop[4];
 188     u_int8_t origin_router[4];
 189     u_int8_t origin_as[4];
 190     u_int8_t tag[4];
 191     u_int8_t proto_id;
 192     u_int8_t flags;
 193     u_int8_t metric[2];
 194     u_int8_t delay[4];
 195     u_int8_t bandwidth[4];
 196     u_int8_t mtu[3];
 197     u_int8_t hopcount;
 198     u_int8_t reliability;
 199     u_int8_t load;
 200     u_int8_t reserved2[2];
 201     u_int8_t cable_start[2];
 202     u_int8_t cable_end[2];
 203 };
 204
 205 static const struct tok eigrp_ext_proto_id_values[] = {
 206     { 0x01, "IGRP" },
 207     { 0x02, "EIGRP" },
 208     { 0x03, "Static" },
 209     { 0x04, "RIP" },
 210     { 0x05, "Hello" },
 211     { 0x06, "OSPF" },
 212     { 0x07, "IS-IS" },
 213     { 0x08, "EGP" },
 214     { 0x09, "BGP" },
 215     { 0x0a, "IDRP" },
 216     { 0x0b, "Connected" },
 217     { 0, NULL}
 218 };
 219
 220 void
 221 eigrp_print(register const u_char *pptr, register u_int len) {
 222
 223     const struct eigrp_common_header *eigrp_com_header;
 224     const struct eigrp_tlv_header *eigrp_tlv_header;
 225     const u_char *tptr,*tlv_tptr;
 226     u_int tlen,eigrp_tlv_len,eigrp_tlv_type,tlv_tlen, byte_length, bit_length;
 227     u_int8_t prefix[4];
 228
 229     union {
 230         const struct eigrp_tlv_general_parm_t *eigrp_tlv_general_parm;
 231         const struct eigrp_tlv_sw_version_t *eigrp_tlv_sw_version;
 232         const struct eigrp_tlv_ip_int_t *eigrp_tlv_ip_int;
 233         const struct eigrp_tlv_ip_ext_t *eigrp_tlv_ip_ext;
 234         const struct eigrp_tlv_at_cable_setup_t *eigrp_tlv_at_cable_setup;
 235         const struct eigrp_tlv_at_int_t *eigrp_tlv_at_int;
 236         const struct eigrp_tlv_at_ext_t *eigrp_tlv_at_ext;
 237     } tlv_ptr;
 238
 239     tptr=pptr;
 240     eigrp_com_header = (const struct eigrp_common_header *)pptr;
 241     TCHECK(*eigrp_com_header);
 242
 243     /*
 244      * Sanity checking of the header.
 245      */
 246     if (eigrp_com_header->version != EIGRP_VERSION) {
 247         printf("EIGRP version %u packet not supported",eigrp_com_header->version);
 248         return;
 249     }
 250
 251     /* in non-verbose mode just lets print the basic Message Type*/
 252     if (vflag < 1) {
 253         printf("EIGRP %s, length: %u",
 254                tok2str(eigrp_opcode_values, "unknown (%u)",eigrp_com_header->opcode),
 255                len);
 256         return;
 257     }
 258
 259     /* ok they seem to want to know everything - lets fully decode it */
 260
 261     tlen=len-sizeof(struct eigrp_common_header);
 262
 263     /* FIXME print other header info */
 264     printf("\n\tEIGRP v%u, opcode: %s (%u), chksum: 0x%04x, Flags: [%s]\n\tseq: 0x%08x, ack: 0x%08x, AS: %u, length: %u",
 265            eigrp_com_header->version,
 266            tok2str(eigrp_opcode_values, "unknown, type: %u",eigrp_com_header->opcode),
 267            eigrp_com_header->opcode,
 268            EXTRACT_16BITS(&eigrp_com_header->checksum),
 269            tok2str(eigrp_common_header_flag_values,
 270                    "none",
 271                    EXTRACT_32BITS(&eigrp_com_header->flags)),
 272            EXTRACT_32BITS(&eigrp_com_header->seq),
 273            EXTRACT_32BITS(&eigrp_com_header->ack),
 274            EXTRACT_32BITS(&eigrp_com_header->asn),
 275            tlen);
 276
 277     tptr+=sizeof(const struct eigrp_common_header);
 278
 279     while(tlen>0) {
 280         /* did we capture enough for fully decoding the object header ? */
 281         TCHECK2(*tptr, sizeof(struct eigrp_tlv_header));
 282
 283         eigrp_tlv_header = (const struct eigrp_tlv_header *)tptr;
 284         eigrp_tlv_len=EXTRACT_16BITS(&eigrp_tlv_header->length);
 285         eigrp_tlv_type=EXTRACT_16BITS(&eigrp_tlv_header->type);
 286
 287
 288         if (eigrp_tlv_len < sizeof(struct eigrp_tlv_header) ||
 289             eigrp_tlv_len > tlen) {
 290             print_unknown_data(tptr+sizeof(sizeof(struct eigrp_tlv_header)),"\n\t    ",tlen);
 291             return;
 292         }
 293
 294         printf("\n\t  %s TLV (0x%04x), length: %u",
 295                tok2str(eigrp_tlv_values,
 296                        "Unknown",
 297                        eigrp_tlv_type),
 298                eigrp_tlv_type,
 299                eigrp_tlv_len);
 300
 301         tlv_tptr=tptr+sizeof(struct eigrp_tlv_header);
 302         tlv_tlen=eigrp_tlv_len-sizeof(struct eigrp_tlv_header);
 303
 304         /* did we capture enough for fully decoding the object ? */
 305         TCHECK2(*tptr, eigrp_tlv_len);
 306
 307         switch(eigrp_tlv_type) {
 308
 309         case EIGRP_TLV_GENERAL_PARM:
 310             tlv_ptr.eigrp_tlv_general_parm = (const struct eigrp_tlv_general_parm_t *)tlv_tptr;
 311
 312             printf("\n\t    holdtime: %us, k1 %u, k2 %u, k3 %u, k4 %u, k5 %u",
 313                    EXTRACT_16BITS(tlv_ptr.eigrp_tlv_general_parm->holdtime),
 314                    tlv_ptr.eigrp_tlv_general_parm->k1,
 315                    tlv_ptr.eigrp_tlv_general_parm->k2,
 316                    tlv_ptr.eigrp_tlv_general_parm->k3,
 317                    tlv_ptr.eigrp_tlv_general_parm->k4,
 318                    tlv_ptr.eigrp_tlv_general_parm->k5);
 319             break;
 320
 321         case EIGRP_TLV_SW_VERSION:
 322             tlv_ptr.eigrp_tlv_sw_version = (const struct eigrp_tlv_sw_version_t *)tlv_tptr;
 323
 324             printf("\n\t    IOS version: %u.%u, EIGRP version %u.%u",
 325                    tlv_ptr.eigrp_tlv_sw_version->ios_major,
 326                    tlv_ptr.eigrp_tlv_sw_version->ios_minor,
 327                    tlv_ptr.eigrp_tlv_sw_version->eigrp_major,
 328                    tlv_ptr.eigrp_tlv_sw_version->eigrp_minor);
 329             break;
 330
 331         case EIGRP_TLV_IP_INT:
 332             tlv_ptr.eigrp_tlv_ip_int = (const struct eigrp_tlv_ip_int_t *)tlv_tptr;
 333
 334             bit_length = tlv_ptr.eigrp_tlv_ip_int->plen;
 335             if (bit_length > 32) {
 336                 printf("\n\t    illegal prefix length %u",bit_length);
 337                 break;
 338             }
 339             byte_length = (bit_length + 7) / 8; /* variable length encoding */
 340             memset(prefix, 0, 4);
 341             memcpy(prefix,&tlv_ptr.eigrp_tlv_ip_int->destination,byte_length);
 342
 343             printf("\n\t    IPv4 prefix: %15s/%u, nexthop: ",
 344                    ipaddr_string(prefix),
 345                    bit_length);
 346             if (EXTRACT_32BITS(&tlv_ptr.eigrp_tlv_ip_int->nexthop) == 0)
 347                 printf("self");
 348             else
 349                 printf("%s",ipaddr_string(&tlv_ptr.eigrp_tlv_ip_int->nexthop));
 350
 351             printf("\n\t      delay %u ms, bandwidth %u Kbps, mtu %u, hop %u, reliability %u, load %u",
 352                    (EXTRACT_32BITS(&tlv_ptr.eigrp_tlv_ip_int->delay)/100),
 353                    EXTRACT_32BITS(&tlv_ptr.eigrp_tlv_ip_int->bandwidth),
 354                    EXTRACT_24BITS(&tlv_ptr.eigrp_tlv_ip_int->mtu),
 355                    tlv_ptr.eigrp_tlv_ip_int->hopcount,
 356                    tlv_ptr.eigrp_tlv_ip_int->reliability,
 357                    tlv_ptr.eigrp_tlv_ip_int->load);
 358             break;
 359
 360         case EIGRP_TLV_IP_EXT:
 361             tlv_ptr.eigrp_tlv_ip_ext = (const struct eigrp_tlv_ip_ext_t *)tlv_tptr;
 362
 363             bit_length = tlv_ptr.eigrp_tlv_ip_ext->plen;
 364             if (bit_length > 32) {
 365                 printf("\n\t    illegal prefix length %u",bit_length);
 366                 break;
 367             }
 368             byte_length = (bit_length + 7) / 8; /* variable length encoding */
 369             memset(prefix, 0, 4);
 370             memcpy(prefix,&tlv_ptr.eigrp_tlv_ip_ext->destination,byte_length);
 371
 372             printf("\n\t    IPv4 prefix: %15s/%u, nexthop: ",
 373                    ipaddr_string(prefix),
 374                    bit_length);
 375             if (EXTRACT_32BITS(&tlv_ptr.eigrp_tlv_ip_ext->nexthop) == 0)
 376                 printf("self");
 377             else
 378                 printf("%s",ipaddr_string(&tlv_ptr.eigrp_tlv_ip_ext->nexthop));
 379
 380             printf("\n\t      origin-router %s, origin-as %u, origin-proto %s, flags [0x%02x], tag 0x%08x, metric %u",
 381                    ipaddr_string(tlv_ptr.eigrp_tlv_ip_ext->origin_router),
 382                    EXTRACT_32BITS(tlv_ptr.eigrp_tlv_ip_ext->origin_as),
 383                    tok2str(eigrp_ext_proto_id_values,"unknown",tlv_ptr.eigrp_tlv_ip_ext->proto_id),
 384                    tlv_ptr.eigrp_tlv_ip_ext->flags,
 385                    EXTRACT_32BITS(tlv_ptr.eigrp_tlv_ip_ext->tag),
 386                    EXTRACT_32BITS(tlv_ptr.eigrp_tlv_ip_ext->metric));
 387
 388             printf("\n\t      delay %u ms, bandwidth %u Kbps, mtu %u, hop %u, reliability %u, load %u",
 389                    (EXTRACT_32BITS(&tlv_ptr.eigrp_tlv_ip_ext->delay)/100),
 390                    EXTRACT_32BITS(&tlv_ptr.eigrp_tlv_ip_ext->bandwidth),
 391                    EXTRACT_24BITS(&tlv_ptr.eigrp_tlv_ip_ext->mtu),
 392                    tlv_ptr.eigrp_tlv_ip_ext->hopcount,
 393                    tlv_ptr.eigrp_tlv_ip_ext->reliability,
 394                    tlv_ptr.eigrp_tlv_ip_ext->load);
 395             break;
 396
 397         case EIGRP_TLV_AT_CABLE_SETUP:
 398             tlv_ptr.eigrp_tlv_at_cable_setup = (const struct eigrp_tlv_at_cable_setup_t *)tlv_tptr;
 399
 400             printf("\n\t    Cable-range: %u-%u, Router-ID %u",
 401                    EXTRACT_16BITS(&tlv_ptr.eigrp_tlv_at_cable_setup->cable_start),
 402                    EXTRACT_16BITS(&tlv_ptr.eigrp_tlv_at_cable_setup->cable_end),
 403                    EXTRACT_32BITS(&tlv_ptr.eigrp_tlv_at_cable_setup->router_id));
 404             break;
 405
 406         case EIGRP_TLV_AT_INT:
 407             tlv_ptr.eigrp_tlv_at_int = (const struct eigrp_tlv_at_int_t *)tlv_tptr;
 408
 409             printf("\n\t     Cable-Range: %u-%u, nexthop: ",
 410                    EXTRACT_16BITS(&tlv_ptr.eigrp_tlv_at_int->cable_start),
 411                    EXTRACT_16BITS(&tlv_ptr.eigrp_tlv_at_int->cable_end));
 412
 413             if (EXTRACT_32BITS(&tlv_ptr.eigrp_tlv_at_int->nexthop) == 0)
 414                 printf("self");
 415             else
 416                 printf("%u.%u",
 417                        EXTRACT_16BITS(&tlv_ptr.eigrp_tlv_at_int->nexthop),
 418                        EXTRACT_16BITS(&tlv_ptr.eigrp_tlv_at_int->nexthop[2]));
 419
 420             printf("\n\t      delay %u ms, bandwidth %u Kbps, mtu %u, hop %u, reliability %u, load %u",
 421                    (EXTRACT_32BITS(&tlv_ptr.eigrp_tlv_at_int->delay)/100),
 422                    EXTRACT_32BITS(&tlv_ptr.eigrp_tlv_at_int->bandwidth),
 423                    EXTRACT_24BITS(&tlv_ptr.eigrp_tlv_at_int->mtu),
 424                    tlv_ptr.eigrp_tlv_at_int->hopcount,
 425                    tlv_ptr.eigrp_tlv_at_int->reliability,
 426                    tlv_ptr.eigrp_tlv_at_int->load);
 427             break;
 428
 429         case EIGRP_TLV_AT_EXT:
 430             tlv_ptr.eigrp_tlv_at_ext = (const struct eigrp_tlv_at_ext_t *)tlv_tptr;
 431
 432             printf("\n\t     Cable-Range: %u-%u, nexthop: ",
 433                    EXTRACT_16BITS(&tlv_ptr.eigrp_tlv_at_ext->cable_start),
 434                    EXTRACT_16BITS(&tlv_ptr.eigrp_tlv_at_ext->cable_end));
 435
 436             if (EXTRACT_32BITS(&tlv_ptr.eigrp_tlv_at_ext->nexthop) == 0)
 437                 printf("self");
 438             else
 439                 printf("%u.%u",
 440                        EXTRACT_16BITS(&tlv_ptr.eigrp_tlv_at_ext->nexthop),
 441                        EXTRACT_16BITS(&tlv_ptr.eigrp_tlv_at_ext->nexthop[2]));
 442
 443             printf("\n\t      origin-router %u, origin-as %u, origin-proto %s, flags [0x%02x], tag 0x%08x, metric %u",
 444                    EXTRACT_32BITS(tlv_ptr.eigrp_tlv_at_ext->origin_router),
 445                    EXTRACT_32BITS(tlv_ptr.eigrp_tlv_at_ext->origin_as),
 446                    tok2str(eigrp_ext_proto_id_values,"unknown",tlv_ptr.eigrp_tlv_at_ext->proto_id),
 447                    tlv_ptr.eigrp_tlv_at_ext->flags,
 448                    EXTRACT_32BITS(tlv_ptr.eigrp_tlv_at_ext->tag),
 449                    EXTRACT_16BITS(tlv_ptr.eigrp_tlv_at_ext->metric));
 450
 451             printf("\n\t      delay %u ms, bandwidth %u Kbps, mtu %u, hop %u, reliability %u, load %u",
 452                    (EXTRACT_32BITS(&tlv_ptr.eigrp_tlv_at_ext->delay)/100),
 453                    EXTRACT_32BITS(&tlv_ptr.eigrp_tlv_at_ext->bandwidth),
 454                    EXTRACT_24BITS(&tlv_ptr.eigrp_tlv_at_ext->mtu),
 455                    tlv_ptr.eigrp_tlv_at_ext->hopcount,
 456                    tlv_ptr.eigrp_tlv_at_ext->reliability,
 457                    tlv_ptr.eigrp_tlv_at_ext->load);
 458             break;
 459
 460             /*
 461              * FIXME those are the defined TLVs that lack a decoder
 462              * you are welcome to contribute code ;-)
 463              */
 464
 465         case EIGRP_TLV_AUTH:
 466         case EIGRP_TLV_SEQ:
 467         case EIGRP_TLV_MCAST_SEQ:
 468         case EIGRP_TLV_IPX_INT:
 469         case EIGRP_TLV_IPX_EXT:
 470
 471         default:
 472             if (vflag <= 1)
 473                 print_unknown_data(tlv_tptr,"\n\t    ",tlv_tlen);
 474             break;
 475         }
 476         /* do we want to see an additionally hexdump ? */
 477         if (vflag > 1)
 478             print_unknown_data(tptr+sizeof(sizeof(struct eigrp_tlv_header)),"\n\t    ",
 479                                eigrp_tlv_len-sizeof(struct eigrp_tlv_header));
 480
 481         tptr+=eigrp_tlv_len;
 482         tlen-=eigrp_tlv_len;
 483     }
 484     return;
 485 trunc:
 486     printf("\n\t\t packet exceeded snapshot");
 487 }