2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 static const char rcsid
[] =
24 "@(#) $Header: /tcpdump/master/tcpdump/print-udp.c,v 1.96 2001-06-26 06:19:06 guy Exp $ (LBL)";
31 #include <sys/param.h>
34 #include <netinet/in.h>
39 #include <arpa/tftp.h>
46 #include "interface.h"
47 #include "addrtoname.h"
48 #include "appletalk.h"
62 u_int16_t rh_flags
; /* T:2 P:1 CNT:5 PT:8 */
63 u_int16_t rh_len
; /* length of message (in words) */
64 u_int32_t rh_ssrc
; /* synchronization src id */
68 u_int32_t upper
; /* more significant 32 bits */
69 u_int32_t lower
; /* less significant 32 bits */
76 ntp64 sr_ntp
; /* 64-bit ntp timestamp */
77 u_int32_t sr_ts
; /* reference media timestamp */
78 u_int32_t sr_np
; /* no. packets sent */
79 u_int32_t sr_nb
; /* no. bytes sent */
84 * Time stamps are middle 32-bits of ntp timestamp.
87 u_int32_t rr_srcid
; /* sender being reported */
88 u_int32_t rr_nl
; /* no. packets lost */
89 u_int32_t rr_ls
; /* extended last seq number received */
90 u_int32_t rr_dv
; /* jitter (delay variance) */
91 u_int32_t rr_lsr
; /* orig. ts from last rr from this src */
92 u_int32_t rr_dlsr
; /* time from recpt of last rr to xmit time */
96 #define RTCP_PT_SR 200
97 #define RTCP_PT_RR 201
98 #define RTCP_PT_SDES 202
99 #define RTCP_SDES_CNAME 1
100 #define RTCP_SDES_NAME 2
101 #define RTCP_SDES_EMAIL 3
102 #define RTCP_SDES_PHONE 4
103 #define RTCP_SDES_LOC 5
104 #define RTCP_SDES_TOOL 6
105 #define RTCP_SDES_NOTE 7
106 #define RTCP_SDES_PRIV 8
107 #define RTCP_PT_BYE 203
108 #define RTCP_PT_APP 204
111 vat_print(const void *hdr
, u_int len
, register const struct udphdr
*up
)
114 u_int ts
= *(u_int16_t
*)hdr
;
115 if ((ts
& 0xf060) != 0) {
117 (void)printf(" udp/vt %u %d / %d",
118 (u_int32_t
)(ntohs(up
->uh_ulen
) - sizeof(*up
)),
119 ts
& 0x3ff, ts
>> 10);
122 u_int32_t i0
= (u_int32_t
)ntohl(((u_int
*)hdr
)[0]);
123 u_int32_t i1
= (u_int32_t
)ntohl(((u_int
*)hdr
)[1]);
124 printf(" udp/vat %u c%d %u%s",
125 (u_int32_t
)(ntohs(up
->uh_ulen
) - sizeof(*up
) - 8),
127 i1
, i0
& 0x800000? "*" : "");
130 printf(" f%d", (i0
>> 16) & 0x1f);
132 printf(" s%d", (i0
>> 24) & 0x3f);
137 rtp_print(const void *hdr
, u_int len
, register const struct udphdr
*up
)
140 u_int
*ip
= (u_int
*)hdr
;
141 u_int hasopt
, hasext
, contype
, hasmarker
;
142 u_int32_t i0
= (u_int32_t
)ntohl(((u_int
*)hdr
)[0]);
143 u_int32_t i1
= (u_int32_t
)ntohl(((u_int
*)hdr
)[1]);
144 u_int dlen
= ntohs(up
->uh_ulen
) - sizeof(*up
) - 8;
152 if ((i0
>> 30) == 1) {
154 hasopt
= i0
& 0x800000;
155 contype
= (i0
>> 16) & 0x3f;
156 hasmarker
= i0
& 0x400000;
160 hasext
= i0
& 0x10000000;
161 contype
= (i0
>> 16) & 0x7f;
162 hasmarker
= i0
& 0x800000;
168 printf(" udp/%s %d c%d %s%s %d %u",
172 (hasopt
|| hasext
)? "+" : "",
177 printf(" %u", (u_int32_t
)ntohl(((u_int
*)hdr
)[2]));
182 optlen
= (i2
>> 16) & 0xff;
183 if (optlen
== 0 || optlen
> len
) {
189 } while ((int)i2
>= 0);
194 extlen
= (i2
& 0xffff) + 1;
201 if (contype
== 0x1f) /*XXX H.261 */
202 printf(" 0x%04x", ip
[0] >> 16);
206 static const u_char
*
207 rtcp_print(const u_char
*hdr
, const u_char
*ep
)
209 /* rtp v2 control (rtcp) */
210 struct rtcp_rr
*rr
= 0;
212 struct rtcphdr
*rh
= (struct rtcphdr
*)hdr
;
217 if ((u_char
*)(rh
+ 1) > ep
) {
221 len
= (ntohs(rh
->rh_len
) + 1) * 4;
222 flags
= ntohs(rh
->rh_flags
);
223 cnt
= (flags
>> 8) & 0x1f;
224 switch (flags
& 0xff) {
226 sr
= (struct rtcp_sr
*)(rh
+ 1);
228 if (len
!= cnt
* sizeof(*rr
) + sizeof(*sr
) + sizeof(*rh
))
229 printf(" [%d]", len
);
231 printf(" %u", (u_int32_t
)ntohl(rh
->rh_ssrc
));
232 if ((u_char
*)(sr
+ 1) > ep
) {
236 ts
= (double)((u_int32_t
)ntohl(sr
->sr_ntp
.upper
)) +
237 ((double)((u_int32_t
)ntohl(sr
->sr_ntp
.lower
)) /
239 printf(" @%.2f %u %up %ub", ts
, (u_int32_t
)ntohl(sr
->sr_ts
),
240 (u_int32_t
)ntohl(sr
->sr_np
), (u_int32_t
)ntohl(sr
->sr_nb
));
241 rr
= (struct rtcp_rr
*)(sr
+ 1);
245 if (len
!= cnt
* sizeof(*rr
) + sizeof(*rh
))
246 printf(" [%d]", len
);
247 rr
= (struct rtcp_rr
*)(rh
+ 1);
249 printf(" %u", (u_int32_t
)ntohl(rh
->rh_ssrc
));
252 printf(" sdes %d", len
);
254 printf(" %u", (u_int32_t
)ntohl(rh
->rh_ssrc
));
258 printf(" bye %d", len
);
260 printf(" %u", (u_int32_t
)ntohl(rh
->rh_ssrc
));
264 printf(" type-0x%x %d", flags
& 0xff, len
);
271 if ((u_char
*)(rr
+ 1) > ep
) {
276 printf(" %u", (u_int32_t
)ntohl(rr
->rr_srcid
));
277 ts
= (double)((u_int32_t
)ntohl(rr
->rr_lsr
)) / 65536.;
278 dts
= (double)((u_int32_t
)ntohl(rr
->rr_dlsr
)) / 65536.;
279 printf(" %ul %us %uj @%.2f+%.2f",
280 (u_int32_t
)ntohl(rr
->rr_nl
) & 0x00ffffff,
281 (u_int32_t
)ntohl(rr
->rr_ls
),
282 (u_int32_t
)ntohl(rr
->rr_dv
), ts
, dts
);
287 static int udp_cksum(register const struct ip
*ip
,
288 register const struct udphdr
*up
,
302 register const u_int16_t
*sp
;
304 tlen
= ntohs(ip
->ip_len
) - ((const char *)up
-(const char*)ip
);
306 /* pseudo-header.. */
307 phu
.ph
.len
= htons(tlen
);
309 phu
.ph
.proto
= IPPROTO_UDP
;
310 memcpy(&phu
.ph
.src
, &ip
->ip_src
.s_addr
, sizeof(u_int32_t
));
311 memcpy(&phu
.ph
.dst
, &ip
->ip_dst
.s_addr
, sizeof(u_int32_t
));
314 sum
= sp
[0]+sp
[1]+sp
[2]+sp
[3]+sp
[4]+sp
[5];
316 sp
= (const u_int16_t
*)up
;
318 for (i
=0; i
<(tlen
&~1); i
+= 2)
322 sum
+= htons( (*(const u_int8_t
*)sp
) << 8);
326 sum
= (sum
& 0xffff) + (sum
>> 16);
333 static int udp6_cksum(const struct ip6_hdr
*ip6
, const struct udphdr
*up
,
337 register const u_int16_t
*sp
;
341 struct in6_addr ph_src
;
342 struct in6_addr ph_dst
;
350 tlen
= ntohs(ip6
->ip6_plen
) + sizeof(struct ip6_hdr
) -
351 ((const char *)up
- (const char*)ip6
);
354 memset(&phu
, 0, sizeof(phu
));
355 phu
.ph
.ph_src
= ip6
->ip6_src
;
356 phu
.ph
.ph_dst
= ip6
->ip6_dst
;
357 phu
.ph
.ph_len
= htonl(tlen
);
358 phu
.ph
.ph_nxt
= IPPROTO_UDP
;
361 for (i
= 0; i
< sizeof(phu
.pa
) / sizeof(phu
.pa
[0]); i
++)
364 sp
= (const u_int16_t
*)up
;
366 for (i
= 0; i
< (tlen
& ~1); i
+= 2)
370 sum
+= htons((*(const u_int8_t
*)sp
) << 8);
373 sum
= (sum
& 0xffff) + (sum
>> 16);
381 /* XXX probably should use getservbyname() and cache answers */
382 #define TFTP_PORT 69 /*XXX*/
383 #define KERBEROS_PORT 88 /*XXX*/
384 #define SUNRPC_PORT 111 /*XXX*/
385 #define SNMP_PORT 161 /*XXX*/
386 #define NTP_PORT 123 /*XXX*/
387 #define SNMPTRAP_PORT 162 /*XXX*/
388 #define ISAKMP_PORT 500 /*XXX*/
389 #define TIMED_PORT 525 /*XXX*/
390 #define RIP_PORT 520 /*XXX*/
391 #define KERBEROS_SEC_PORT 750 /*XXX*/
392 #define L2TP_PORT 1701 /*XXX*/
393 #define ISAKMP_PORT_USER1 7500 /*XXX - nonstandard*/
394 #define ISAKMP_PORT_USER2 8500 /*XXX - nonstandard*/
395 #define RX_PORT_LOW 7000 /*XXX*/
396 #define RX_PORT_HIGH 7009 /*XXX*/
397 #define NETBIOS_NS_PORT 137
398 #define NETBIOS_DGRAM_PORT 138
399 #define CISCO_AUTORP_PORT 496 /*XXX*/
400 #define RADIUS_PORT 1645
401 #define RADIUS_NEW_PORT 1812
402 #define RADIUS_ACCOUNTING_PORT 1646
403 #define RADIUS_NEW_ACCOUNTING_PORT 1813
404 #define LWRES_PORT 921
407 #define RIPNG_PORT 521 /*XXX*/
408 #define DHCP6_SERV_PORT 546 /*XXX*/
409 #define DHCP6_CLI_PORT 547 /*XXX*/
413 udp_print(register const u_char
*bp
, u_int length
,
414 register const u_char
*bp2
, int fragmented
)
416 register const struct udphdr
*up
;
417 register const struct ip
*ip
;
418 register const u_char
*cp
;
419 register const u_char
*ep
= bp
+ length
;
420 u_int16_t sport
, dport
, ulen
;
422 register const struct ip6_hdr
*ip6
;
427 up
= (struct udphdr
*)bp
;
428 ip
= (struct ip
*)bp2
;
431 ip6
= (struct ip6_hdr
*)bp2
;
435 cp
= (u_char
*)(up
+ 1);
437 (void)printf("%s > %s: [|udp]",
438 ipaddr_string(&ip
->ip_src
), ipaddr_string(&ip
->ip_dst
));
441 if (length
< sizeof(struct udphdr
)) {
442 (void)printf("%s > %s: truncated-udp %d",
443 ipaddr_string(&ip
->ip_src
), ipaddr_string(&ip
->ip_dst
),
447 length
-= sizeof(struct udphdr
);
449 sport
= ntohs(up
->uh_sport
);
450 dport
= ntohs(up
->uh_dport
);
451 ulen
= ntohs(up
->uh_ulen
);
453 (void)printf("%s > %s: truncated-udplength %d",
454 ipaddr_string(&ip
->ip_src
),
455 ipaddr_string(&ip
->ip_dst
),
460 register struct rpc_msg
*rp
;
461 enum msg_type direction
;
463 switch (packettype
) {
466 (void)printf("%s.%s > %s.%s:",
467 ipaddr_string(&ip
->ip_src
),
468 udpport_string(sport
),
469 ipaddr_string(&ip
->ip_dst
),
470 udpport_string(dport
));
471 vat_print((void *)(up
+ 1), length
, up
);
475 (void)printf("%s.%s > %s.%s:",
476 ipaddr_string(&ip
->ip_src
),
477 udpport_string(sport
),
478 ipaddr_string(&ip
->ip_dst
),
479 udpport_string(dport
));
480 wb_print((void *)(up
+ 1), length
);
484 rp
= (struct rpc_msg
*)(up
+ 1);
485 direction
= (enum msg_type
)ntohl(rp
->rm_direction
);
486 if (direction
== CALL
)
487 sunrpcrequest_print((u_char
*)rp
, length
,
490 nfsreply_print((u_char
*)rp
, length
,
491 (u_char
*)ip
); /*XXX*/
495 (void)printf("%s.%s > %s.%s:",
496 ipaddr_string(&ip
->ip_src
),
497 udpport_string(sport
),
498 ipaddr_string(&ip
->ip_dst
),
499 udpport_string(dport
));
500 rtp_print((void *)(up
+ 1), length
, up
);
504 (void)printf("%s.%s > %s.%s:",
505 ipaddr_string(&ip
->ip_src
),
506 udpport_string(sport
),
507 ipaddr_string(&ip
->ip_dst
),
508 udpport_string(dport
));
510 cp
= rtcp_print(cp
, ep
);
514 (void)printf("%s.%s > %s.%s:",
515 ipaddr_string(&ip
->ip_src
),
516 udpport_string(sport
),
517 ipaddr_string(&ip
->ip_dst
),
518 udpport_string(dport
));
519 snmp_print((const u_char
*)(up
+ 1), length
);
523 (void)printf("%s.%s > %s.%s:",
524 ipaddr_string(&ip
->ip_src
),
525 udpport_string(sport
),
526 ipaddr_string(&ip
->ip_dst
),
527 udpport_string(dport
));
528 cnfp_print(cp
, length
, (const u_char
*)ip
);
535 register struct rpc_msg
*rp
;
536 enum msg_type direction
;
538 rp
= (struct rpc_msg
*)(up
+ 1);
539 if (TTEST(rp
->rm_direction
)) {
540 direction
= (enum msg_type
)ntohl(rp
->rm_direction
);
541 if (dport
== NFS_PORT
&& direction
== CALL
) {
542 nfsreq_print((u_char
*)rp
, length
,
546 if (sport
== NFS_PORT
&& direction
== REPLY
) {
547 nfsreply_print((u_char
*)rp
, length
,
552 if (dport
== SUNRPC_PORT
&& direction
== CALL
) {
553 sunrpcrequest_print((u_char
*)rp
, length
, (u_char
*)ip
);
558 if (TTEST(((struct LAP
*)cp
)->type
) &&
559 ((struct LAP
*)cp
)->type
== lapDDP
&&
560 (atalk_port(sport
) || atalk_port(dport
))) {
562 fputs("kip ", stdout
);
563 llap_print(cp
, length
);
569 if (ip6
->ip6_nxt
== IPPROTO_UDP
) {
570 (void)printf("%s.%s > %s.%s: ",
571 ip6addr_string(&ip6
->ip6_src
),
572 udpport_string(sport
),
573 ip6addr_string(&ip6
->ip6_dst
),
574 udpport_string(dport
));
576 (void)printf("%s > %s: ",
577 udpport_string(sport
), udpport_string(dport
));
582 if (ip
->ip_p
== IPPROTO_UDP
) {
583 (void)printf("%s.%s > %s.%s: ",
584 ipaddr_string(&ip
->ip_src
),
585 udpport_string(sport
),
586 ipaddr_string(&ip
->ip_dst
),
587 udpport_string(dport
));
589 (void)printf("%s > %s: ",
590 udpport_string(sport
), udpport_string(dport
));
594 if (IP_V(ip
) == 4 && vflag
&& !fragmented
) {
595 int sum
= up
->uh_sum
;
597 (void)printf("[no cksum] ");
598 } else if (TTEST2(cp
[0], length
)) {
599 sum
= udp_cksum(ip
, up
, length
);
601 (void)printf("[bad udp cksum %x!] ", sum
);
603 (void)printf("[udp sum ok] ");
607 if (IP_V(ip
) == 6 && ip6
->ip6_plen
&& vflag
&& !fragmented
) {
608 int sum
= up
->uh_sum
;
609 /* for IPv6, UDP checksum is mandatory */
610 if (TTEST2(cp
[0], length
)) {
611 sum
= udp6_cksum(ip6
, up
, length
);
613 (void)printf("[bad udp cksum %x!] ", sum
);
615 (void)printf("[udp sum ok] ");
621 #define ISPORT(p) (dport == (p) || sport == (p))
622 if (ISPORT(NAMESERVER_PORT
))
623 ns_print((const u_char
*)(up
+ 1), length
);
624 else if (ISPORT(TIMED_PORT
))
625 timed_print((const u_char
*)(up
+ 1), length
);
626 else if (ISPORT(TFTP_PORT
))
627 tftp_print((const u_char
*)(up
+ 1), length
);
628 else if (ISPORT(IPPORT_BOOTPC
) || ISPORT(IPPORT_BOOTPS
))
629 bootp_print((const u_char
*)(up
+ 1), length
,
631 else if (ISPORT(RIP_PORT
))
632 rip_print((const u_char
*)(up
+ 1), length
);
633 else if (ISPORT(ISAKMP_PORT
))
634 isakmp_print((const u_char
*)(up
+ 1), length
, bp2
);
636 else if (ISPORT(ISAKMP_PORT_USER1
) || ISPORT(ISAKMP_PORT_USER2
))
637 isakmp_print((const u_char
*)(up
+ 1), length
, bp2
);
639 else if (ISPORT(SNMP_PORT
) || ISPORT(SNMPTRAP_PORT
))
640 snmp_print((const u_char
*)(up
+ 1), length
);
641 else if (ISPORT(NTP_PORT
))
642 ntp_print((const u_char
*)(up
+ 1), length
);
643 else if (ISPORT(KERBEROS_PORT
) || ISPORT(KERBEROS_SEC_PORT
))
644 krb_print((const void *)(up
+ 1), length
);
645 else if (ISPORT(L2TP_PORT
))
646 l2tp_print((const u_char
*)(up
+ 1), length
);
647 else if (ISPORT(NETBIOS_NS_PORT
))
648 nbt_udp137_print((const u_char
*)(up
+ 1), length
);
649 else if (ISPORT(NETBIOS_DGRAM_PORT
))
650 nbt_udp138_print((const u_char
*)(up
+ 1), length
);
651 else if (dport
== 3456)
652 vat_print((const void *)(up
+ 1), length
, up
);
654 * Since there are 10 possible ports to check, I think
655 * a <> test would be more efficient
657 else if ((sport
>= RX_PORT_LOW
&& sport
<= RX_PORT_HIGH
) ||
658 (dport
>= RX_PORT_LOW
&& dport
<= RX_PORT_HIGH
))
659 rx_print((const void *)(up
+ 1), length
, sport
, dport
,
662 else if (ISPORT(RIPNG_PORT
))
663 ripng_print((const u_char
*)(up
+ 1), length
);
664 else if (ISPORT(DHCP6_SERV_PORT
) || ISPORT(DHCP6_CLI_PORT
)) {
665 dhcp6_print((const u_char
*)(up
+ 1), length
,
670 * Kludge in test for whiteboard packets.
672 else if (dport
== 4567)
673 wb_print((const void *)(up
+ 1), length
);
674 else if (ISPORT(CISCO_AUTORP_PORT
))
675 cisco_autorp_print((const void *)(up
+ 1), length
);
676 else if (ISPORT(RADIUS_PORT
) ||
677 ISPORT(RADIUS_NEW_PORT
) ||
678 ISPORT(RADIUS_ACCOUNTING_PORT
) ||
679 ISPORT(RADIUS_NEW_ACCOUNTING_PORT
) )
680 radius_print((const u_char
*)(up
+1), length
);
681 else if (ISPORT(LWRES_PORT
))
682 lwres_print((const u_char
*)(up
+ 1), length
);
684 (void)printf(" udp %u",
685 (u_int32_t
)(ulen
- sizeof(*up
)));
688 (void)printf(" udp %u", (u_int32_t
)(ulen
- sizeof(*up
)));