2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 /* \summary: Ethernet printer */
28 #include "netdissect-stdinc.h"
30 #define ND_LONGJMP_FROM_TCHECK
31 #include "netdissect.h"
33 #include "addrtoname.h"
34 #include "ethertype.h"
37 * Structure of an Ethernet header.
42 nd_uint16_t ether_length_type
;
46 * Length of an Ethernet header; note that some compilers may pad
47 * "struct ether_header" to a multiple of 4 bytes, for example, so
48 * "sizeof (struct ether_header)" may not give the right answer.
50 #define ETHER_HDRLEN 14
52 const struct tok ethertype_values
[] = {
53 { ETHERTYPE_IP
, "IPv4" },
54 { ETHERTYPE_MPLS
, "MPLS unicast" },
55 { ETHERTYPE_MPLS_MULTI
, "MPLS multicast" },
56 { ETHERTYPE_IPV6
, "IPv6" },
57 { ETHERTYPE_8021Q
, "802.1Q" },
58 { ETHERTYPE_8021Q9100
, "802.1Q-9100" },
59 { ETHERTYPE_8021QinQ
, "802.1Q-QinQ" },
60 { ETHERTYPE_8021Q9200
, "802.1Q-9200" },
61 { ETHERTYPE_MACSEC
, "802.1AE MACsec" },
62 { ETHERTYPE_VMAN
, "VMAN" },
63 { ETHERTYPE_PUP
, "PUP" },
64 { ETHERTYPE_ARP
, "ARP"},
65 { ETHERTYPE_REVARP
, "Reverse ARP"},
66 { ETHERTYPE_NS
, "NS" },
67 { ETHERTYPE_SPRITE
, "Sprite" },
68 { ETHERTYPE_TRAIL
, "Trail" },
69 { ETHERTYPE_MOPDL
, "MOP DL" },
70 { ETHERTYPE_MOPRC
, "MOP RC" },
71 { ETHERTYPE_DN
, "DN" },
72 { ETHERTYPE_LAT
, "LAT" },
73 { ETHERTYPE_SCA
, "SCA" },
74 { ETHERTYPE_TEB
, "TEB" },
75 { ETHERTYPE_LANBRIDGE
, "Lanbridge" },
76 { ETHERTYPE_DECDNS
, "DEC DNS" },
77 { ETHERTYPE_DECDTS
, "DEC DTS" },
78 { ETHERTYPE_VEXP
, "VEXP" },
79 { ETHERTYPE_VPROD
, "VPROD" },
80 { ETHERTYPE_ATALK
, "Appletalk" },
81 { ETHERTYPE_AARP
, "Appletalk ARP" },
82 { ETHERTYPE_IPX
, "IPX" },
83 { ETHERTYPE_PPP
, "PPP" },
84 { ETHERTYPE_MPCP
, "MPCP" },
85 { ETHERTYPE_SLOW
, "Slow Protocols" },
86 { ETHERTYPE_PPPOED
, "PPPoE D" },
87 { ETHERTYPE_PPPOES
, "PPPoE S" },
88 { ETHERTYPE_EAPOL
, "EAPOL" },
89 { ETHERTYPE_REALTEK
, "Realtek protocols" },
90 { ETHERTYPE_MS_NLB_HB
, "MS NLB heartbeat" },
91 { ETHERTYPE_JUMBO
, "Jumbo" },
92 { ETHERTYPE_NSH
, "NSH" },
93 { ETHERTYPE_LOOPBACK
, "Loopback" },
94 { ETHERTYPE_ISO
, "OSI" },
95 { ETHERTYPE_GRE_ISO
, "GRE-OSI" },
96 { ETHERTYPE_CFM_OLD
, "CFM (old)" },
97 { ETHERTYPE_CFM
, "CFM" },
98 { ETHERTYPE_IEEE1905_1
, "IEEE1905.1" },
99 { ETHERTYPE_LLDP
, "LLDP" },
100 { ETHERTYPE_TIPC
, "TIPC"},
101 { ETHERTYPE_GEONET_OLD
, "GeoNet (old)"},
102 { ETHERTYPE_GEONET
, "GeoNet"},
103 { ETHERTYPE_CALM_FAST
, "CALM FAST"},
104 { ETHERTYPE_AOE
, "AoE" },
105 { ETHERTYPE_PTP
, "PTP" },
106 { ETHERTYPE_ARISTA
, "Arista Vendor Specific Protocol" },
111 ether_addresses_print(netdissect_options
*ndo
, const u_char
*src
,
114 ND_PRINT("%s > %s, ",
115 GET_MAC48_STRING(src
), GET_MAC48_STRING(dst
));
119 ether_type_print(netdissect_options
*ndo
, uint16_t type
)
122 ND_PRINT("ethertype %s (0x%04x)",
123 tok2str(ethertype_values
, "Unknown", type
), type
);
126 tok2str(ethertype_values
, "Unknown Ethertype (0x%04x)", type
));
130 * Common code for printing Ethernet frames.
132 * It can handle Ethernet headers with extra tag information inserted
133 * after the destination and source addresses, as is inserted by some
134 * switch chips, and extra encapsulation header information before
135 * printing Ethernet header information (such as a LANE ID for ATM LANE).
138 ether_common_print(netdissect_options
*ndo
, const u_char
*p
, u_int length
,
140 void (*print_switch_tag
)(netdissect_options
*ndo
, const u_char
*),
141 u_int switch_tag_len
,
142 void (*print_encap_header
)(netdissect_options
*ndo
, const u_char
*),
143 const u_char
*encap_header_arg
)
145 const struct ether_header
*ehp
;
151 struct lladdr_info src
, dst
;
153 if (length
< caplen
) {
154 ND_PRINT("[length %u < caplen %u]", length
, caplen
);
155 nd_print_invalid(ndo
);
158 if (caplen
< ETHER_HDRLEN
+ switch_tag_len
) {
163 if (print_encap_header
!= NULL
)
164 (*print_encap_header
)(ndo
, encap_header_arg
);
166 orig_length
= length
;
169 * Get the source and destination addresses, skip past them,
170 * and print them if we're printing the link-layer header.
172 ehp
= (const struct ether_header
*)p
;
173 src
.addr
= ehp
->ether_shost
;
174 src
.addr_string
= mac48_string
;
175 dst
.addr
= ehp
->ether_dhost
;
176 dst
.addr_string
= mac48_string
;
178 length
-= 2*MAC48_LEN
;
179 caplen
-= 2*MAC48_LEN
;
181 hdrlen
= 2*MAC48_LEN
;
184 ether_addresses_print(ndo
, src
.addr
, dst
.addr
);
187 * Print the switch tag, if we have one, and skip past it.
189 if (print_switch_tag
!= NULL
)
190 (*print_switch_tag
)(ndo
, p
);
192 length
-= switch_tag_len
;
193 caplen
-= switch_tag_len
;
195 hdrlen
+= switch_tag_len
;
198 * Get the length/type field, skip past it, and print it
199 * if we're printing the link-layer header.
202 length_type
= GET_BE_U_2(p
);
210 * Process 802.1AE MACsec headers.
213 if (length_type
== ETHERTYPE_MACSEC
) {
215 * MACsec, aka IEEE 802.1AE-2006
216 * Print the header, and try to print the payload if it's not encrypted
218 if (ndo
->ndo_eflag
) {
219 ether_type_print(ndo
, length_type
);
220 ND_PRINT(", length %u: ", orig_length
);
224 int ret
= macsec_print(ndo
, &p
, &length
, &caplen
, &hdrlen
,
228 /* Payload is encrypted; print it as raw data. */
229 if (!ndo
->ndo_suppress_default_print
)
230 ND_DEFAULTPRINT(p
, caplen
);
232 } else if (ret
> 0) {
233 /* Problem printing the header; just quit. */
237 * Keep processing type/length fields.
239 length_type
= GET_BE_U_2(p
);
241 ND_ICHECK_U(caplen
, <, 2);
250 * Process VLAN tag types.
252 while (length_type
== ETHERTYPE_8021Q
||
253 length_type
== ETHERTYPE_8021Q9100
||
254 length_type
== ETHERTYPE_8021Q9200
||
255 length_type
== ETHERTYPE_8021QinQ
) {
258 * Print VLAN information, and then go back and process
259 * the enclosed type field.
262 ndo
->ndo_protocol
= "vlan";
264 return hdrlen
+ caplen
;
267 ndo
->ndo_protocol
= "vlan";
269 return hdrlen
+ length
;
271 if (ndo
->ndo_eflag
) {
272 uint16_t tag
= GET_BE_U_2(p
);
274 ether_type_print(ndo
, length_type
);
275 if (!printed_length
) {
276 ND_PRINT(", length %u: ", orig_length
);
280 ND_PRINT("%s, ", ieee8021q_tci_string(tag
));
283 length_type
= GET_BE_U_2(p
+ 2);
291 * We now have the final length/type field.
293 if (length_type
<= MAX_ETHERNET_LENGTH_VAL
) {
295 * It's a length field, containing the length of the
296 * remaining payload; use it as such, as long as
297 * it's not too large (bigger than the actual payload).
299 if (length_type
< length
) {
300 length
= length_type
;
306 * Cut off the snapshot length to the end of the
309 if (!nd_push_snaplen(ndo
, p
, length
)) {
310 (*ndo
->ndo_error
)(ndo
, S_ERR_ND_MEM_ALLOC
,
311 "%s: can't push snaplen on buffer stack", __func__
);
314 if (ndo
->ndo_eflag
) {
317 ND_PRINT(", length %u: ", length
);
321 * An LLC header follows the length. Print that and
324 llc_hdrlen
= llc_print(ndo
, p
, length
, caplen
, &src
, &dst
);
325 if (llc_hdrlen
< 0) {
326 /* packet type not known, print raw packet */
327 if (!ndo
->ndo_suppress_default_print
)
328 ND_DEFAULTPRINT(p
, caplen
);
329 llc_hdrlen
= -llc_hdrlen
;
331 hdrlen
+= llc_hdrlen
;
332 nd_pop_packet_info(ndo
);
333 } else if (length_type
== ETHERTYPE_JUMBO
) {
335 * It's a type field, with the type for Alteon jumbo frames.
338 * https://tools.ietf.org/html/draft-ietf-isis-ext-eth-01
340 * which indicates that, following the type field,
341 * there's an LLC header and payload.
343 /* Try to print the LLC-layer header & higher layers */
344 llc_hdrlen
= llc_print(ndo
, p
, length
, caplen
, &src
, &dst
);
345 if (llc_hdrlen
< 0) {
346 /* packet type not known, print raw packet */
347 if (!ndo
->ndo_suppress_default_print
)
348 ND_DEFAULTPRINT(p
, caplen
);
349 llc_hdrlen
= -llc_hdrlen
;
351 hdrlen
+= llc_hdrlen
;
352 } else if (length_type
== ETHERTYPE_ARISTA
) {
354 ND_PRINT("[|arista]");
355 return hdrlen
+ caplen
;
358 ND_PRINT("[|arista]");
359 return hdrlen
+ length
;
361 ether_type_print(ndo
, length_type
);
362 ND_PRINT(", length %u: ", orig_length
);
363 int bytesConsumed
= arista_ethertype_print(ndo
, p
, length
);
364 if (bytesConsumed
> 0) {
366 length
-= bytesConsumed
;
367 caplen
-= bytesConsumed
;
368 hdrlen
+= bytesConsumed
;
371 /* subtype/version not known, print raw packet */
372 if (!ndo
->ndo_eflag
&& length_type
> MAX_ETHERNET_LENGTH_VAL
) {
373 ether_addresses_print(ndo
, src
.addr
, dst
.addr
);
374 ether_type_print(ndo
, length_type
);
375 ND_PRINT(", length %u: ", orig_length
);
377 if (!ndo
->ndo_suppress_default_print
)
378 ND_DEFAULTPRINT(p
, caplen
);
382 * It's a type field with some other value.
384 if (ndo
->ndo_eflag
) {
385 ether_type_print(ndo
, length_type
);
387 ND_PRINT(", length %u: ", orig_length
);
391 if (ethertype_print(ndo
, length_type
, p
, length
, caplen
, &src
, &dst
) == 0) {
392 /* type not known, print raw packet */
393 if (!ndo
->ndo_eflag
) {
395 * We didn't print the full link-layer
396 * header, as -e wasn't specified, so
397 * print only the source and destination
398 * MAC addresses and the final Ethernet
401 ether_addresses_print(ndo
, src
.addr
, dst
.addr
);
402 ether_type_print(ndo
, length_type
);
403 ND_PRINT(", length %u: ", orig_length
);
406 if (!ndo
->ndo_suppress_default_print
)
407 ND_DEFAULTPRINT(p
, caplen
);
415 * Print an Ethernet frame while specifying a non-standard Ethernet header
417 * This might be encapsulated within another frame; we might be passed
418 * a pointer to a function that can print header information for that
419 * frame's protocol, and an argument to pass to that function.
421 * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
424 ether_switch_tag_print(netdissect_options
*ndo
, const u_char
*p
, u_int length
,
426 void (*print_switch_tag
)(netdissect_options
*, const u_char
*),
427 u_int switch_tag_len
)
429 return ether_common_print(ndo
, p
, length
, caplen
, print_switch_tag
,
430 switch_tag_len
, NULL
, NULL
);
434 * Print an Ethernet frame.
435 * This might be encapsulated within another frame; we might be passed
436 * a pointer to a function that can print header information for that
437 * frame's protocol, and an argument to pass to that function.
439 * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
442 ether_print(netdissect_options
*ndo
,
443 const u_char
*p
, u_int length
, u_int caplen
,
444 void (*print_encap_header
)(netdissect_options
*ndo
, const u_char
*),
445 const u_char
*encap_header_arg
)
447 ndo
->ndo_protocol
= "ether";
448 return ether_common_print(ndo
, p
, length
, caplen
, NULL
, 0,
449 print_encap_header
, encap_header_arg
);
453 * This is the top level routine of the printer. 'p' points
454 * to the ether header of the packet, 'h->len' is the length
455 * of the packet off the wire, and 'h->caplen' is the number
456 * of bytes actually captured.
459 ether_if_print(netdissect_options
*ndo
, const struct pcap_pkthdr
*h
,
462 ndo
->ndo_protocol
= "ether";
463 ndo
->ndo_ll_hdr_len
+=
464 ether_print(ndo
, p
, h
->len
, h
->caplen
, NULL
, NULL
);
468 * This is the top level routine of the printer. 'p' points
469 * to the ether header of the packet, 'h->len' is the length
470 * of the packet off the wire, and 'h->caplen' is the number
471 * of bytes actually captured.
473 * This is for DLT_NETANALYZER, which has a 4-byte pseudo-header
474 * before the Ethernet header.
477 netanalyzer_if_print(netdissect_options
*ndo
, const struct pcap_pkthdr
*h
,
481 * Fail if we don't have enough data for the Hilscher pseudo-header.
483 ndo
->ndo_protocol
= "netanalyzer";
486 /* Skip the pseudo-header. */
487 ndo
->ndo_ll_hdr_len
+= 4;
488 ndo
->ndo_ll_hdr_len
+=
489 ether_print(ndo
, p
+ 4, h
->len
- 4, h
->caplen
- 4, NULL
, NULL
);
493 * This is the top level routine of the printer. 'p' points
494 * to the ether header of the packet, 'h->len' is the length
495 * of the packet off the wire, and 'h->caplen' is the number
496 * of bytes actually captured.
498 * This is for DLT_NETANALYZER_TRANSPARENT, which has a 4-byte
499 * pseudo-header, a 7-byte Ethernet preamble, and a 1-byte Ethernet SOF
500 * before the Ethernet header.
503 netanalyzer_transparent_if_print(netdissect_options
*ndo
,
504 const struct pcap_pkthdr
*h
,
508 * Fail if we don't have enough data for the Hilscher pseudo-header,
511 ndo
->ndo_protocol
= "netanalyzer_transparent";
512 ND_TCHECK_LEN(p
, 12);
514 /* Skip the pseudo-header, preamble, and SOF. */
515 ndo
->ndo_ll_hdr_len
+= 12;
516 ndo
->ndo_ll_hdr_len
+=
517 ether_print(ndo
, p
+ 12, h
->len
- 12, h
->caplen
- 12, NULL
, NULL
);
521 * Prints the packet payload, given an Ethernet type code for the payload's
524 * Returns non-zero if it can do so, zero if the ethertype is unknown.
528 ethertype_print(netdissect_options
*ndo
,
529 u_short ether_type
, const u_char
*p
,
530 u_int length
, u_int caplen
,
531 const struct lladdr_info
*src
, const struct lladdr_info
*dst
)
533 switch (ether_type
) {
536 ip_print(ndo
, p
, length
);
540 ip6_print(ndo
, p
, length
);
544 case ETHERTYPE_REVARP
:
545 arp_print(ndo
, p
, length
, caplen
);
549 decnet_print(ndo
, p
, length
, caplen
);
552 case ETHERTYPE_ATALK
:
555 atalk_print(ndo
, p
, length
);
559 aarp_print(ndo
, p
, length
);
563 ND_PRINT("(NOV-ETHII) ");
564 ipx_print(ndo
, p
, length
);
568 if (length
== 0 || caplen
== 0) {
569 ndo
->ndo_protocol
= "isoclns";
573 /* At least one byte is required */
574 /* FIXME: Reference for this byte? */
576 isoclns_print(ndo
, p
+ 1, length
- 1);
579 case ETHERTYPE_PPPOED
:
580 case ETHERTYPE_PPPOES
:
581 case ETHERTYPE_PPPOED2
:
582 case ETHERTYPE_PPPOES2
:
583 pppoe_print(ndo
, p
, length
);
586 case ETHERTYPE_EAPOL
:
590 case ETHERTYPE_REALTEK
:
591 rtl_print(ndo
, p
, length
, src
, dst
);
597 ppp_print(ndo
, p
, length
);
602 mpcp_print(ndo
, p
, length
);
606 slow_print(ndo
, p
, length
);
610 case ETHERTYPE_CFM_OLD
:
611 cfm_print(ndo
, p
, length
);
615 lldp_print(ndo
, p
, length
);
619 nsh_print(ndo
, p
, length
);
622 case ETHERTYPE_LOOPBACK
:
623 loopback_print(ndo
, p
, length
);
627 case ETHERTYPE_MPLS_MULTI
:
628 mpls_print(ndo
, p
, length
);
632 tipc_print(ndo
, p
, length
, caplen
);
635 case ETHERTYPE_MS_NLB_HB
:
639 case ETHERTYPE_GEONET_OLD
:
640 case ETHERTYPE_GEONET
:
641 geonet_print(ndo
, p
, length
, src
);
644 case ETHERTYPE_CALM_FAST
:
645 calm_fast_print(ndo
, p
, length
, src
);
649 aoe_print(ndo
, p
, length
);
653 ptp_print(ndo
, p
, length
);
658 case ETHERTYPE_MOPRC
:
659 case ETHERTYPE_MOPDL
:
660 case ETHERTYPE_IEEE1905_1
:
661 /* default_print for now */