2 * Copyright (c) 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 * Code by Matt Thomas, Digital Equipment Corporation
22 * with an awful lot of hacking by Jeffrey Mogul, DECWRL
26 static const char rcsid
[] _U_
=
27 "@(#) $Header: /tcpdump/master/tcpdump/print-llc.c,v 1.66 2005-09-29 07:37:08 hannes Exp $";
34 #include <tcpdump-stdinc.h>
39 #include "interface.h"
40 #include "addrtoname.h"
41 #include "extract.h" /* must come after interface.h */
44 #include "ethertype.h"
47 static struct tok llc_values
[] = {
48 { LLCSAP_NULL
, "Null" },
49 { LLCSAP_GLOBAL
, "Global" },
50 { LLCSAP_8021B_I
, "802.1B I" },
51 { LLCSAP_8021B_G
, "802.1B G" },
53 { LLCSAP_SNA
, "SNA" },
54 { LLCSAP_PROWAYNM
, "ProWay NM" },
55 { LLCSAP_8021D
, "STP" },
56 { LLCSAP_RS511
, "RS511" },
57 { LLCSAP_ISO8208
, "ISO8208" },
58 { LLCSAP_PROWAY
, "ProWay" },
59 { LLCSAP_SNAP
, "SNAP" },
60 { LLCSAP_IPX
, "IPX" },
61 { LLCSAP_NETBEUI
, "NetBeui" },
62 { LLCSAP_ISONS
, "OSI" },
66 static struct tok llc_cmd_values
[] = {
73 { LLC_SABME
, "sabme" },
78 static const struct tok llc_flag_values
[] = {
80 { LLC_GSAP
, "Response" },
81 { LLC_U_POLL
, "Poll" },
82 { LLC_GSAP
|LLC_U_POLL
, "Final" },
83 { LLC_GSAP
|LLC_IS_POLL
, "Final" },
87 static const struct tok llc_supervisory_values
[] = {
88 { 0, "Receiver Ready" },
90 { 2, "Receiver not Ready" },
95 static const struct tok cisco_values
[] = {
96 { PID_CISCO_CDP
, "CDP" },
100 static const struct tok bridged_values
[] = {
101 { PID_RFC2684_ETH_FCS
, "Ethernet + FCS" },
102 { PID_RFC2684_ETH_NOFCS
, "Ethernet w/o FCS" },
103 { PID_RFC2684_802_4_FCS
, "802.4 + FCS" },
104 { PID_RFC2684_802_4_NOFCS
, "802.4 w/o FCS" },
105 { PID_RFC2684_802_5_FCS
, "Token Ring + FCS" },
106 { PID_RFC2684_802_5_NOFCS
, "Token Ring w/o FCS" },
107 { PID_RFC2684_FDDI_FCS
, "FDDI + FCS" },
108 { PID_RFC2684_FDDI_NOFCS
, "FDDI w/o FCS" },
109 { PID_RFC2684_802_6_FCS
, "802.6 + FCS" },
110 { PID_RFC2684_802_6_NOFCS
, "802.6 w/o FCS" },
111 { PID_RFC2684_BPDU
, "BPDU" },
117 const struct tok
*tok
;
120 static const struct oui_tok oui_to_tok
[] = {
121 { OUI_ENCAP_ETHER
, ethertype_values
},
122 { OUI_CISCO_90
, ethertype_values
}, /* uses some Ethertype values */
123 { OUI_APPLETALK
, ethertype_values
}, /* uses some Ethertype values */
124 { OUI_CISCO
, cisco_values
},
125 { OUI_RFC2684
, bridged_values
}, /* bridged, RFC 2427 FR or RFC 2864 ATM */
130 * Returns non-zero IFF it succeeds in printing the header
133 llc_print(const u_char
*p
, u_int length
, u_int caplen
,
134 const u_char
*esrc
, const u_char
*edst
, u_short
*extracted_ethertype
)
136 u_int8_t dsap_field
, dsap
, ssap_field
, ssap
;
142 (void)printf("[|llc]");
143 default_print((u_char
*)p
, caplen
);
148 dsap
= dsap_field
& ~LLC_IG
;
149 ssap_field
= *(p
+ 1);
150 ssap
= ssap_field
& ~LLC_GSAP
;
153 * OK, what type of LLC frame is this? The length
154 * of the control field depends on that - I frames
155 * have a two-byte control field, and U frames have
156 * a one-byte control field.
159 if ((control
& LLC_U_FMT
) == LLC_U_FMT
) {
166 * The control field in I and S frames is
170 (void)printf("[|llc]");
171 default_print((u_char
*)p
, caplen
);
176 * ...and is little-endian.
178 control
= EXTRACT_LE_16BITS(p
+ 2);
182 if (ssap
== LLCSAP_GLOBAL
&& dsap
== LLCSAP_GLOBAL
) {
184 * This is an Ethernet_802.3 IPX frame; it has an
185 * 802.3 header (i.e., an Ethernet header where the
186 * type/length field is <= ETHERMTU, i.e. it's a length
187 * field, not a type field), but has no 802.2 header -
188 * the IPX packet starts right after the Ethernet header,
189 * with a signature of two bytes of 0xFF (which is
192 * (It might also have been an Ethernet_802.3 IPX at
193 * one time, but got bridged onto another network,
194 * such as an 802.11 network; this has appeared in at
195 * least one capture file.)
199 printf("IPX 802.3: ");
201 ipx_print(p
, length
);
206 printf("LLC, dsap %s (0x%02x), ssap %s (0x%02x)",
207 tok2str(llc_values
, "Unknown", dsap
),
209 tok2str(llc_values
, "Unknown", ssap
),
213 printf(", cmd 0x%02x: ", control
);
215 printf(", cmd 0x%04x: ", control
);
219 if (ssap
== LLCSAP_8021D
&& dsap
== LLCSAP_8021D
&&
221 stp_print(p
+3, length
-3);
225 if (ssap
== LLCSAP_IP
&& dsap
== LLCSAP_IP
&&
227 ip_print(gndo
, p
+4, length
-4);
231 if (ssap
== LLCSAP_IPX
&& dsap
== LLCSAP_IPX
&&
234 * This is an Ethernet_802.2 IPX frame, with an 802.3
235 * header and an 802.2 LLC header with the source and
236 * destination SAPs being the IPX SAP.
238 * Skip DSAP, LSAP, and control field.
241 printf("IPX 802.2: ");
243 ipx_print(p
+3, length
-3);
247 #ifdef TCPDUMP_DO_SMB
248 if (ssap
== LLCSAP_NETBEUI
&& dsap
== LLCSAP_NETBEUI
249 && (!(control
& LLC_S_FMT
) || control
== LLC_U_FMT
)) {
251 * we don't actually have a full netbeui parser yet, but the
252 * smb parser can handle many smb-in-netbeui packets, which
253 * is very useful, so we call that
255 * We don't call it for S frames, however, just I frames
256 * (which are frames that don't have the low-order bit,
257 * LLC_S_FMT, set in the first byte of the control field)
258 * and UI frames (whose control field is just 3, LLC_U_FMT).
262 * Skip the LLC header.
273 netbeui_print(control
, p
, length
);
277 if (ssap
== LLCSAP_ISONS
&& dsap
== LLCSAP_ISONS
278 && control
== LLC_UI
) {
279 isoclns_print(p
+ 3, length
- 3, caplen
- 3);
283 if (ssap
== LLCSAP_SNAP
&& dsap
== LLCSAP_SNAP
284 && control
== LLC_UI
) {
286 * XXX - what *is* the right bridge pad value here?
287 * Does anybody ever bridge one form of LAN traffic
288 * over a networking type that uses 802.2 LLC?
290 ret
= snap_print(p
+3, length
-3, caplen
-3, extracted_ethertype
,
298 if (esrc
== NULL
|| edst
== NULL
)
299 (void)printf("%s ", tok2str(llc_values
, "Unknown DSAP 0x%02x", dsap
));
301 (void)printf("%s > %s %s ",
302 etheraddr_string(esrc
),
303 etheraddr_string(edst
),
304 tok2str(llc_values
, "Unknown DSAP 0x%02x", dsap
));
306 if (esrc
== NULL
|| edst
== NULL
)
307 (void)printf("%s > %s ",
308 tok2str(llc_values
, "Unknown SSAP 0x%02x", ssap
),
309 tok2str(llc_values
, "Unknown DSAP 0x%02x", dsap
));
311 (void)printf("%s %s > %s %s ",
312 etheraddr_string(esrc
),
313 tok2str(llc_values
, "Unknown SSAP 0x%02x", ssap
),
314 etheraddr_string(edst
),
315 tok2str(llc_values
, "Unknown DSAP 0x%02x", dsap
));
320 printf("Unnumbered, %s, Flags [%s], length %u",
321 tok2str(llc_cmd_values
, "%02x", LLC_U_CMD(control
)),
322 bittok2str(llc_flag_values
,"?",(ssap
) | (control
& LLC_U_POLL
)),
329 if ((control
& ~LLC_U_POLL
) == LLC_XID
) {
330 if (*p
== LLC_XID_FI
) {
331 printf(": %02x %02x", p
[1], p
[2]);
339 if ((control
& LLC_S_FMT
) == LLC_S_FMT
) {
340 (void)printf("Supervisory, %s, rcv seq %u, Flags [%s], length %u",
341 tok2str(llc_supervisory_values
,"?",LLC_S_CMD(control
)),
343 bittok2str(llc_flag_values
,"?",(ssap
) | (control
& LLC_IS_POLL
)),
346 (void)printf("Information, send seq %u, rcv seq %u, Flags [%s], length %u",
349 bittok2str(llc_flag_values
,"?",(ssap
) | (control
& LLC_IS_POLL
)),
360 snap_print(const u_char
*p
, u_int length
, u_int caplen
,
361 u_short
*extracted_ethertype
, u_int bridge_pad
)
368 orgcode
= EXTRACT_24BITS(p
);
369 et
= EXTRACT_16BITS(p
+ 3);
372 const struct tok
*tok
= NULL
;
373 const struct oui_tok
*otp
;
375 for (otp
= &oui_to_tok
[0]; otp
->tok
!= NULL
; otp
++) {
376 if (otp
->oui
== orgcode
) {
381 (void)printf("oui %s (0x%06x), %s %s (0x%04x): ",
382 tok2str(oui_values
, "Unknown", orgcode
),
384 (orgcode
== 0x000000 ? "ethertype" : "pid"),
385 tok2str(tok
, "Unknown", et
),
393 case OUI_ENCAP_ETHER
:
396 * This is an encapsulated Ethernet packet,
397 * or a packet bridged by some piece of
398 * Cisco hardware; the protocol ID is
399 * an Ethernet protocol type.
401 ret
= ether_encap_print(et
, p
, length
, caplen
,
402 extracted_ethertype
);
408 if (et
== ETHERTYPE_ATALK
) {
410 * No, I have no idea why Apple used one
411 * of their own OUIs, rather than
412 * 0x000000, and an Ethernet packet
413 * type, for Appletalk data packets,
414 * but used 0x000000 and an Ethernet
415 * packet type for AARP packets.
417 ret
= ether_encap_print(et
, p
, length
, caplen
,
418 extracted_ethertype
);
425 if (et
== PID_CISCO_CDP
) {
426 cdp_print(p
, length
, caplen
);
434 case PID_RFC2684_ETH_FCS
:
435 case PID_RFC2684_ETH_NOFCS
:
437 * XXX - remove the last two bytes for
438 * PID_RFC2684_ETH_FCS?
443 TCHECK2(*p
, bridge_pad
);
444 caplen
-= bridge_pad
;
445 length
-= bridge_pad
;
449 * What remains is an Ethernet packet.
451 ether_print(p
, length
, caplen
);
454 case PID_RFC2684_802_5_FCS
:
455 case PID_RFC2684_802_5_NOFCS
:
457 * XXX - remove the last two bytes for
458 * PID_RFC2684_ETH_FCS?
461 * Skip the padding, but not the Access
464 TCHECK2(*p
, bridge_pad
);
465 caplen
-= bridge_pad
;
466 length
-= bridge_pad
;
470 * What remains is an 802.5 Token Ring
473 token_print(p
, length
, caplen
);
476 case PID_RFC2684_FDDI_FCS
:
477 case PID_RFC2684_FDDI_NOFCS
:
479 * XXX - remove the last two bytes for
480 * PID_RFC2684_ETH_FCS?
485 TCHECK2(*p
, bridge_pad
+ 1);
486 caplen
-= bridge_pad
+ 1;
487 length
-= bridge_pad
+ 1;
491 * What remains is an FDDI packet.
493 fddi_print(p
, length
, caplen
);
496 case PID_RFC2684_BPDU
:
497 stp_print(p
, length
);
504 (void)printf("[|snap]");
511 * c-style: whitesmith