2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 /* \summary: Ethernet printer */
28 #include "netdissect-stdinc.h"
30 #include "netdissect.h"
32 #include "addrtoname.h"
33 #include "ethertype.h"
36 * Structure of an Ethernet header.
39 nd_mac_addr ether_dhost
;
40 nd_mac_addr ether_shost
;
41 nd_uint16_t ether_length_type
;
45 * Length of an Ethernet header; note that some compilers may pad
46 * "struct ether_header" to a multiple of 4 bytes, for example, so
47 * "sizeof (struct ether_header)" may not give the right answer.
49 #define ETHER_HDRLEN 14
51 const struct tok ethertype_values
[] = {
52 { ETHERTYPE_IP
, "IPv4" },
53 { ETHERTYPE_MPLS
, "MPLS unicast" },
54 { ETHERTYPE_MPLS_MULTI
, "MPLS multicast" },
55 { ETHERTYPE_IPV6
, "IPv6" },
56 { ETHERTYPE_8021Q
, "802.1Q" },
57 { ETHERTYPE_8021Q9100
, "802.1Q-9100" },
58 { ETHERTYPE_8021QinQ
, "802.1Q-QinQ" },
59 { ETHERTYPE_8021Q9200
, "802.1Q-9200" },
60 { ETHERTYPE_MACSEC
, "802.1AE MACsec" },
61 { ETHERTYPE_VMAN
, "VMAN" },
62 { ETHERTYPE_PUP
, "PUP" },
63 { ETHERTYPE_ARP
, "ARP"},
64 { ETHERTYPE_REVARP
, "Reverse ARP"},
65 { ETHERTYPE_NS
, "NS" },
66 { ETHERTYPE_SPRITE
, "Sprite" },
67 { ETHERTYPE_TRAIL
, "Trail" },
68 { ETHERTYPE_MOPDL
, "MOP DL" },
69 { ETHERTYPE_MOPRC
, "MOP RC" },
70 { ETHERTYPE_DN
, "DN" },
71 { ETHERTYPE_LAT
, "LAT" },
72 { ETHERTYPE_SCA
, "SCA" },
73 { ETHERTYPE_TEB
, "TEB" },
74 { ETHERTYPE_LANBRIDGE
, "Lanbridge" },
75 { ETHERTYPE_DECDNS
, "DEC DNS" },
76 { ETHERTYPE_DECDTS
, "DEC DTS" },
77 { ETHERTYPE_VEXP
, "VEXP" },
78 { ETHERTYPE_VPROD
, "VPROD" },
79 { ETHERTYPE_ATALK
, "Appletalk" },
80 { ETHERTYPE_AARP
, "Appletalk ARP" },
81 { ETHERTYPE_IPX
, "IPX" },
82 { ETHERTYPE_PPP
, "PPP" },
83 { ETHERTYPE_MPCP
, "MPCP" },
84 { ETHERTYPE_SLOW
, "Slow Protocols" },
85 { ETHERTYPE_PPPOED
, "PPPoE D" },
86 { ETHERTYPE_PPPOES
, "PPPoE S" },
87 { ETHERTYPE_EAPOL
, "EAPOL" },
88 { ETHERTYPE_RRCP
, "RRCP" },
89 { ETHERTYPE_MS_NLB_HB
, "MS NLB heartbeat" },
90 { ETHERTYPE_JUMBO
, "Jumbo" },
91 { ETHERTYPE_NSH
, "NSH" },
92 { ETHERTYPE_LOOPBACK
, "Loopback" },
93 { ETHERTYPE_ISO
, "OSI" },
94 { ETHERTYPE_GRE_ISO
, "GRE-OSI" },
95 { ETHERTYPE_CFM_OLD
, "CFM (old)" },
96 { ETHERTYPE_CFM
, "CFM" },
97 { ETHERTYPE_IEEE1905_1
, "IEEE1905.1" },
98 { ETHERTYPE_LLDP
, "LLDP" },
99 { ETHERTYPE_TIPC
, "TIPC"},
100 { ETHERTYPE_GEONET_OLD
, "GeoNet (old)"},
101 { ETHERTYPE_GEONET
, "GeoNet"},
102 { ETHERTYPE_CALM_FAST
, "CALM FAST"},
103 { ETHERTYPE_AOE
, "AoE" },
104 { ETHERTYPE_PTP
, "PTP" },
105 { ETHERTYPE_ARISTA
, "Arista Vendor Specific Protocol" },
110 ether_addresses_print(netdissect_options
*ndo
, const u_char
*src
,
113 ND_PRINT("%s > %s, ",
114 GET_ETHERADDR_STRING(src
), GET_ETHERADDR_STRING(dst
));
118 ether_type_print(netdissect_options
*ndo
, uint16_t type
)
121 ND_PRINT("ethertype %s (0x%04x)",
122 tok2str(ethertype_values
, "Unknown", type
), type
);
125 tok2str(ethertype_values
, "Unknown Ethertype (0x%04x)", type
));
129 * Common code for printing Ethernet frames.
131 * It can handle Ethernet headers with extra tag information inserted
132 * after the destination and source addresses, as is inserted by some
133 * switch chips, and extra encapsulation header information before
134 * printing Ethernet header information (such as a LANE ID for ATM LANE).
137 ether_common_print(netdissect_options
*ndo
, const u_char
*p
, u_int length
,
139 void (*print_switch_tag
)(netdissect_options
*ndo
, const u_char
*),
140 u_int switch_tag_len
,
141 void (*print_encap_header
)(netdissect_options
*ndo
, const u_char
*),
142 const u_char
*encap_header_arg
)
144 const struct ether_header
*ehp
;
150 struct lladdr_info src
, dst
;
152 if (caplen
< ETHER_HDRLEN
+ switch_tag_len
) {
156 if (length
< ETHER_HDRLEN
+ switch_tag_len
) {
161 if (print_encap_header
!= NULL
)
162 (*print_encap_header
)(ndo
, encap_header_arg
);
164 orig_length
= length
;
167 * Get the source and destination addresses, skip past them,
168 * and print them if we're printing the link-layer header.
170 ehp
= (const struct ether_header
*)p
;
171 src
.addr
= ehp
->ether_shost
;
172 src
.addr_string
= etheraddr_string
;
173 dst
.addr
= ehp
->ether_dhost
;
174 dst
.addr_string
= etheraddr_string
;
176 length
-= 2*MAC_ADDR_LEN
;
177 caplen
-= 2*MAC_ADDR_LEN
;
179 hdrlen
= 2*MAC_ADDR_LEN
;
182 ether_addresses_print(ndo
, src
.addr
, dst
.addr
);
185 * Print the switch tag, if we have one, and skip past it.
187 if (print_switch_tag
!= NULL
)
188 (*print_switch_tag
)(ndo
, p
);
190 length
-= switch_tag_len
;
191 caplen
-= switch_tag_len
;
193 hdrlen
+= switch_tag_len
;
196 * Get the length/type field, skip past it, and print it
197 * if we're printing the link-layer header.
200 length_type
= GET_BE_U_2(p
);
207 if (length_type
== ETHERTYPE_MACSEC
) {
209 * MACsec, aka IEEE 802.1AE-2006
210 * Print the header, and try to print the payload if it's not encrypted
212 int ret
= macsec_print(ndo
, &p
, &length
, &caplen
, &hdrlen
, &length_type
);
215 /* Payload is encrypted; just quit. */
216 return (hdrlen
+ caplen
);
217 } else if (ret
> 0) {
218 /* Problem printing the header; just quit. */
224 * Process VLAN tag types.
227 while (length_type
== ETHERTYPE_8021Q
||
228 length_type
== ETHERTYPE_8021Q9100
||
229 length_type
== ETHERTYPE_8021Q9200
||
230 length_type
== ETHERTYPE_8021QinQ
) {
233 * Print VLAN information, and then go back and process
234 * the enclosed type field.
237 ndo
->ndo_protocol
= "vlan";
239 return (hdrlen
+ caplen
);
242 ndo
->ndo_protocol
= "vlan";
244 return (hdrlen
+ length
);
246 if (ndo
->ndo_eflag
) {
247 uint16_t tag
= GET_BE_U_2(p
);
249 ether_type_print(ndo
, length_type
);
250 if (!printed_length
) {
251 ND_PRINT(", length %u: ", orig_length
);
255 ND_PRINT("%s, ", ieee8021q_tci_string(tag
));
258 length_type
= GET_BE_U_2(p
+ 2);
266 * We now have the final length/type field.
268 if (length_type
<= MAX_ETHERNET_LENGTH_VAL
) {
270 * It's a length field, containing the length of the
271 * remaining payload; use it as such, as long as
272 * it's not too large (bigger than the actual payload).
274 if (length_type
< length
) {
275 length
= length_type
;
281 * Cut off the snapshot length to the end of the
284 nd_push_snapend(ndo
, p
+ length
);
286 if (ndo
->ndo_eflag
) {
289 ND_PRINT(", length %u: ", length
);
293 * An LLC header follows the length. Print that and
296 llc_hdrlen
= llc_print(ndo
, p
, length
, caplen
, &src
, &dst
);
297 if (llc_hdrlen
< 0) {
298 /* packet type not known, print raw packet */
299 if (!ndo
->ndo_suppress_default_print
)
300 ND_DEFAULTPRINT(p
, caplen
);
301 llc_hdrlen
= -llc_hdrlen
;
303 hdrlen
+= llc_hdrlen
;
304 nd_pop_packet_info(ndo
);
305 } else if (length_type
== ETHERTYPE_JUMBO
) {
307 * It's a type field, with the type for Alteon jumbo frames.
310 * https://tools.ietf.org/html/draft-ietf-isis-ext-eth-01
312 * which indicates that, following the type field,
313 * there's an LLC header and payload.
315 /* Try to print the LLC-layer header & higher layers */
316 llc_hdrlen
= llc_print(ndo
, p
, length
, caplen
, &src
, &dst
);
317 if (llc_hdrlen
< 0) {
318 /* packet type not known, print raw packet */
319 if (!ndo
->ndo_suppress_default_print
)
320 ND_DEFAULTPRINT(p
, caplen
);
321 llc_hdrlen
= -llc_hdrlen
;
323 hdrlen
+= llc_hdrlen
;
324 } else if (length_type
== ETHERTYPE_ARISTA
) {
326 ND_PRINT("[|arista]");
327 return (hdrlen
+ caplen
);
330 ND_PRINT("[|arista]");
331 return (hdrlen
+ length
);
333 ether_type_print(ndo
, length_type
);
334 ND_PRINT(", length %u: ", orig_length
);
335 int bytesConsumed
= arista_ethertype_print(ndo
, p
, length
);
336 if (bytesConsumed
> 0) {
338 length
-= bytesConsumed
;
339 caplen
-= bytesConsumed
;
340 hdrlen
+= bytesConsumed
;
343 /* subtype/version not known, print raw packet */
344 if (!ndo
->ndo_eflag
&& length_type
> MAX_ETHERNET_LENGTH_VAL
) {
345 ether_addresses_print(ndo
, src
.addr
, dst
.addr
);
346 ether_type_print(ndo
, length_type
);
347 ND_PRINT(", length %u: ", orig_length
);
349 if (!ndo
->ndo_suppress_default_print
)
350 ND_DEFAULTPRINT(p
, caplen
);
354 * It's a type field with some other value.
356 if (ndo
->ndo_eflag
) {
357 ether_type_print(ndo
, length_type
);
359 ND_PRINT(", length %u: ", orig_length
);
363 if (ethertype_print(ndo
, length_type
, p
, length
, caplen
, &src
, &dst
) == 0) {
365 /* type not known, print raw packet */
366 if (!ndo
->ndo_eflag
) {
368 * We didn't print the full link-layer
369 * header, as -e wasn't specified, so
370 * print only the source and destination
371 * MAC addresses and the final Ethernet
374 ether_addresses_print(ndo
, src
.addr
, dst
.addr
);
375 ether_type_print(ndo
, length_type
);
376 ND_PRINT(", length %u: ", orig_length
);
379 if (!ndo
->ndo_suppress_default_print
)
380 ND_DEFAULTPRINT(p
, caplen
);
387 * Print an Ethernet frame while specyfing a non-standard Ethernet header
389 * This might be encapsulated within another frame; we might be passed
390 * a pointer to a function that can print header information for that
391 * frame's protocol, and an argument to pass to that function.
393 * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
396 ether_switch_tag_print(netdissect_options
*ndo
, const u_char
*p
, u_int length
,
398 void (*print_switch_tag
)(netdissect_options
*, const u_char
*),
399 u_int switch_tag_len
)
401 return (ether_common_print(ndo
, p
, length
, caplen
, print_switch_tag
,
402 switch_tag_len
, NULL
, NULL
));
406 * Print an Ethernet frame.
407 * This might be encapsulated within another frame; we might be passed
408 * a pointer to a function that can print header information for that
409 * frame's protocol, and an argument to pass to that function.
411 * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
414 ether_print(netdissect_options
*ndo
,
415 const u_char
*p
, u_int length
, u_int caplen
,
416 void (*print_encap_header
)(netdissect_options
*ndo
, const u_char
*),
417 const u_char
*encap_header_arg
)
419 ndo
->ndo_protocol
= "ether";
420 return (ether_common_print(ndo
, p
, length
, caplen
, NULL
, 0,
421 print_encap_header
, encap_header_arg
));
425 * This is the top level routine of the printer. 'p' points
426 * to the ether header of the packet, 'h->len' is the length
427 * of the packet off the wire, and 'h->caplen' is the number
428 * of bytes actually captured.
431 ether_if_print(netdissect_options
*ndo
, const struct pcap_pkthdr
*h
,
434 ndo
->ndo_protocol
= "ether_if";
435 return (ether_print(ndo
, p
, h
->len
, h
->caplen
, NULL
, NULL
));
439 * This is the top level routine of the printer. 'p' points
440 * to the ether header of the packet, 'h->len' is the length
441 * of the packet off the wire, and 'h->caplen' is the number
442 * of bytes actually captured.
444 * This is for DLT_NETANALYZER, which has a 4-byte pseudo-header
445 * before the Ethernet header.
448 netanalyzer_if_print(netdissect_options
*ndo
, const struct pcap_pkthdr
*h
,
452 * Fail if we don't have enough data for the Hilscher pseudo-header.
454 ndo
->ndo_protocol
= "netanalyzer_if";
460 /* Skip the pseudo-header. */
461 return (4 + ether_print(ndo
, p
+ 4, h
->len
- 4, h
->caplen
- 4, NULL
, NULL
));
465 * This is the top level routine of the printer. 'p' points
466 * to the ether header of the packet, 'h->len' is the length
467 * of the packet off the wire, and 'h->caplen' is the number
468 * of bytes actually captured.
470 * This is for DLT_NETANALYZER_TRANSPARENT, which has a 4-byte
471 * pseudo-header, a 7-byte Ethernet preamble, and a 1-byte Ethernet SOF
472 * before the Ethernet header.
475 netanalyzer_transparent_if_print(netdissect_options
*ndo
,
476 const struct pcap_pkthdr
*h
,
480 * Fail if we don't have enough data for the Hilscher pseudo-header,
483 ndo
->ndo_protocol
= "netanalyzer_transparent_if";
484 if (h
->caplen
< 12) {
489 /* Skip the pseudo-header, preamble, and SOF. */
490 return (12 + ether_print(ndo
, p
+ 12, h
->len
- 12, h
->caplen
- 12, NULL
, NULL
));
494 * Prints the packet payload, given an Ethernet type code for the payload's
497 * Returns non-zero if it can do so, zero if the ethertype is unknown.
501 ethertype_print(netdissect_options
*ndo
,
502 u_short ether_type
, const u_char
*p
,
503 u_int length
, u_int caplen
,
504 const struct lladdr_info
*src
, const struct lladdr_info
*dst
)
506 switch (ether_type
) {
509 ip_print(ndo
, p
, length
);
513 ip6_print(ndo
, p
, length
);
517 case ETHERTYPE_REVARP
:
518 arp_print(ndo
, p
, length
, caplen
);
522 decnet_print(ndo
, p
, length
, caplen
);
525 case ETHERTYPE_ATALK
:
528 atalk_print(ndo
, p
, length
);
532 aarp_print(ndo
, p
, length
);
536 ND_PRINT("(NOV-ETHII) ");
537 ipx_print(ndo
, p
, length
);
541 if (length
== 0 || caplen
== 0) {
542 ndo
->ndo_protocol
= "isoclns";
546 isoclns_print(ndo
, p
+ 1, length
- 1);
549 case ETHERTYPE_PPPOED
:
550 case ETHERTYPE_PPPOES
:
551 case ETHERTYPE_PPPOED2
:
552 case ETHERTYPE_PPPOES2
:
553 pppoe_print(ndo
, p
, length
);
556 case ETHERTYPE_EAPOL
:
557 eap_print(ndo
, p
, length
);
561 rrcp_print(ndo
, p
, length
, src
, dst
);
567 ppp_print(ndo
, p
, length
);
572 mpcp_print(ndo
, p
, length
);
576 slow_print(ndo
, p
, length
);
580 case ETHERTYPE_CFM_OLD
:
581 cfm_print(ndo
, p
, length
);
585 lldp_print(ndo
, p
, length
);
589 nsh_print(ndo
, p
, length
);
592 case ETHERTYPE_LOOPBACK
:
593 loopback_print(ndo
, p
, length
);
597 case ETHERTYPE_MPLS_MULTI
:
598 mpls_print(ndo
, p
, length
);
602 tipc_print(ndo
, p
, length
, caplen
);
605 case ETHERTYPE_MS_NLB_HB
:
609 case ETHERTYPE_GEONET_OLD
:
610 case ETHERTYPE_GEONET
:
611 geonet_print(ndo
, p
, length
, src
);
614 case ETHERTYPE_CALM_FAST
:
615 calm_fast_print(ndo
, p
, length
, src
);
619 aoe_print(ndo
, p
, length
);
623 ptp_print(ndo
, p
, length
);
628 case ETHERTYPE_MOPRC
:
629 case ETHERTYPE_MOPDL
:
630 case ETHERTYPE_IEEE1905_1
:
631 /* default_print for now */