The Tcpdump Group git mirrors - tcpdump/blobdiff

* with an awful lot of hacking by Jeffrey Mogul, DECWRL

*/

* with an awful lot of hacking by Jeffrey Mogul, DECWRL

*/

-#ifndef lint

-static const char rcsid[] =

- "@(#) $Header: /tcpdump/master/tcpdump/print-llc.c,v 1.34 2001-01-15 03:24:00 guy Exp $";

-#endif

-

#ifdef HAVE_CONFIG_H

#include "config.h"

#endif

#ifdef HAVE_CONFIG_H

#include "config.h"

#endif

-#include <sys/param.h>

-#include <sys/time.h>

-

-#include <netinet/in.h>

+#include <netdissect-stdinc.h>

-#include <ctype.h>

-#include <netdb.h>

-#include <stdio.h>

-#include <string.h>

-

-#include "interface.h"

+#include "netdissect.h"

#include "addrtoname.h"

-#include "extract.h" /* must come after interface.h */

+#include "extract.h"

#include "llc.h"

+#include "ethertype.h"

+#include "oui.h"

-static struct tok cmd2str[] = {

+static const struct tok llc_values[] = {

+ { LLCSAP_NULL, "Null" },

+ { LLCSAP_GLOBAL, "Global" },

+ { LLCSAP_8021B_I, "802.1B I" },

+ { LLCSAP_8021B_G, "802.1B G" },

+ { LLCSAP_IP, "IP" },

+ { LLCSAP_SNA, "SNA" },

+ { LLCSAP_PROWAYNM, "ProWay NM" },

+ { LLCSAP_8021D, "STP" },

+ { LLCSAP_RS511, "RS511" },

+ { LLCSAP_ISO8208, "ISO8208" },

+ { LLCSAP_PROWAY, "ProWay" },

+ { LLCSAP_SNAP, "SNAP" },

+ { LLCSAP_IPX, "IPX" },

+ { LLCSAP_NETBEUI, "NetBeui" },

+ { LLCSAP_ISONS, "OSI" },

+ { 0, NULL },

+};

+

+static const struct tok llc_cmd_values[] = {

{ LLC_UI, "ui" },

{ LLC_TEST, "test" },

{ LLC_XID, "xid" },

{ LLC_UI, "ui" },

{ LLC_TEST, "test" },

{ LLC_XID, "xid" },

{ 0, NULL }

};

{ 0, NULL }

};

+static const struct tok llc_flag_values[] = {

+ { 0, "Command" },

+ { LLC_GSAP, "Response" },

+ { LLC_U_POLL, "Poll" },

+ { LLC_GSAP|LLC_U_POLL, "Final" },

+ { LLC_IS_POLL, "Poll" },

+ { LLC_GSAP|LLC_IS_POLL, "Final" },

+ { 0, NULL }

+};

+

+static const struct tok llc_ig_flag_values[] = {

+ { 0, "Individual" },

+ { LLC_IG, "Group" },

+ { 0, NULL }

+};

+

+static const struct tok llc_supervisory_values[] = {

+ { 0, "Receiver Ready" },

+ { 1, "Receiver not Ready" },

+ { 2, "Reject" },

+ { 0, NULL }

+};

+

+static const struct tok cisco_values[] = {

+ { PID_CISCO_CDP, "CDP" },

+ { PID_CISCO_VTP, "VTP" },

+ { PID_CISCO_DTP, "DTP" },

+ { PID_CISCO_UDLD, "UDLD" },

+ { PID_CISCO_PVST, "PVST" },

+ { PID_CISCO_VLANBRIDGE, "VLAN Bridge" },

+ { 0, NULL }

+};

+

+static const struct tok bridged_values[] = {

+ { PID_RFC2684_ETH_FCS, "Ethernet + FCS" },

+ { PID_RFC2684_ETH_NOFCS, "Ethernet w/o FCS" },

+ { PID_RFC2684_802_4_FCS, "802.4 + FCS" },

+ { PID_RFC2684_802_4_NOFCS, "802.4 w/o FCS" },

+ { PID_RFC2684_802_5_FCS, "Token Ring + FCS" },

+ { PID_RFC2684_802_5_NOFCS, "Token Ring w/o FCS" },

+ { PID_RFC2684_FDDI_FCS, "FDDI + FCS" },

+ { PID_RFC2684_FDDI_NOFCS, "FDDI w/o FCS" },

+ { PID_RFC2684_802_6_FCS, "802.6 + FCS" },

+ { PID_RFC2684_802_6_NOFCS, "802.6 w/o FCS" },

+ { PID_RFC2684_BPDU, "BPDU" },

+ { 0, NULL },

+};

+

+static const struct tok null_values[] = {

+ { 0, NULL }

+};

+

+struct oui_tok {

+ uint32_t oui;

+ const struct tok *tok;

+};

+

+static const struct oui_tok oui_to_tok[] = {

+ { OUI_ENCAP_ETHER, ethertype_values },

+ { OUI_CISCO_90, ethertype_values }, /* uses some Ethertype values */

+ { OUI_APPLETALK, ethertype_values }, /* uses some Ethertype values */

+ { OUI_CISCO, cisco_values },

+ { OUI_RFC2684, bridged_values }, /* bridged, RFC 2427 FR or RFC 2864 ATM */

+ { 0, NULL }

+};

+

/*

- * Returns non-zero IFF it succeeds in printing the header

+ * If we printed information about the payload, returns the length of the LLC

+ * header, plus the length of any SNAP header following it.

+ *

+ * Otherwise (for example, if the packet has unknown SAPs or has a SNAP

+ * header with an unknown OUI/PID combination), returns the *negative*

+ * of that value.

*/

int

*/

int

-llc_print(const u_char *p, u_int length, u_int caplen,

- const u_char *esrc, const u_char *edst, u_short *extracted_ethertype)

+llc_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen,

+ const u_char *esrc, const u_char *edst)

{

- struct llc llc;

- register u_short et;

- u_int16_t control;

- register int ret;

+ uint8_t dsap_field, dsap, ssap_field, ssap;

+ uint16_t control;

+ int hdrlen;

+ int is_u;

if (caplen < 3) {

- (void)printf("[|llc]");

- default_print((u_char *)p, caplen);

- return(0);

+ ND_PRINT((ndo, "[|llc]"));

+ ND_DEFAULTPRINT((const u_char *)p, caplen);

+ return (caplen);

+ }

+ if (length < 3) {

+ ND_PRINT((ndo, "[|llc]"));

+ ND_DEFAULTPRINT((const u_char *)p, caplen);

+ return (length);

}

- /* Watch out for possible alignment problems */

- memcpy((char *)&llc, (char *)p, min(caplen, sizeof(llc)));

+ dsap_field = *p;

+ ssap_field = *(p + 1);

+

+ /*

+ * OK, what type of LLC frame is this? The length

+ * of the control field depends on that - I frames

+ * have a two-byte control field, and U frames have

+ * a one-byte control field.

+ */

+ control = *(p + 2);

+ if ((control & LLC_U_FMT) == LLC_U_FMT) {

+ /*

+ * U frame.

+ */

+ is_u = 1;

+ hdrlen = 3; /* DSAP, SSAP, 1-byte control field */

+ } else {

+ /*

+ * The control field in I and S frames is

+ * 2 bytes...

+ */

+ if (caplen < 4) {

+ ND_PRINT((ndo, "[|llc]"));

+ ND_DEFAULTPRINT((const u_char *)p, caplen);

+ return (caplen);

+ }

+ if (length < 4) {

+ ND_PRINT((ndo, "[|llc]"));

+ ND_DEFAULTPRINT((const u_char *)p, caplen);

+ return (length);

+ }

+

+ /*

+ * ...and is little-endian.

+ */

+ control = EXTRACT_LE_16BITS(p + 2);

+ is_u = 0;

+ hdrlen = 4; /* DSAP, SSAP, 2-byte control field */

+ }

- if (llc.ssap == LLCSAP_GLOBAL && llc.dsap == LLCSAP_GLOBAL) {

+ if (ssap_field == LLCSAP_GLOBAL && dsap_field == LLCSAP_GLOBAL) {

/*

* This is an Ethernet_802.3 IPX frame; it has an

* 802.3 header (i.e., an Ethernet header where the

/*

* This is an Ethernet_802.3 IPX frame; it has an

* 802.3 header (i.e., an Ethernet header where the

* the IPX packet starts right after the Ethernet header,

* with a signature of two bytes of 0xFF (which is

* LLCSAP_GLOBAL).

* the IPX packet starts right after the Ethernet header,

* with a signature of two bytes of 0xFF (which is

* LLCSAP_GLOBAL).

+ *

+ * (It might also have been an Ethernet_802.3 IPX at

+ * one time, but got bridged onto another network,

+ * such as an 802.11 network; this has appeared in at

+ * least one capture file.)

+ */

+

+ if (ndo->ndo_eflag)

+ ND_PRINT((ndo, "IPX 802.3: "));

+

+ ipx_print(ndo, p, length);

+ return (0); /* no LLC header */

+ }

+

+ dsap = dsap_field & ~LLC_IG;

+ ssap = ssap_field & ~LLC_GSAP;

+

+ if (ndo->ndo_eflag) {

+ ND_PRINT((ndo, "LLC, dsap %s (0x%02x) %s, ssap %s (0x%02x) %s",

+ tok2str(llc_values, "Unknown", dsap),

+ dsap,

+ tok2str(llc_ig_flag_values, "Unknown", dsap_field & LLC_IG),

+ tok2str(llc_values, "Unknown", ssap),

+ ssap,

+ tok2str(llc_flag_values, "Unknown", ssap_field & LLC_GSAP)));

+

+ if (is_u) {

+ ND_PRINT((ndo, ", ctrl 0x%02x: ", control));

+ } else {

+ ND_PRINT((ndo, ", ctrl 0x%04x: ", control));

+ }

+

+ /*

+ * Skip LLC header.

+ */

+ p += hdrlen;

+ length -= hdrlen;

+ caplen -= hdrlen;

+

+ if (ssap == LLCSAP_SNAP && dsap == LLCSAP_SNAP

+ && control == LLC_UI) {

+ /*

+ * XXX - what *is* the right bridge pad value here?

+ * Does anybody ever bridge one form of LAN traffic

+ * over a networking type that uses 802.2 LLC?

*/

- ipx_print(p, length);

- return (1);

+ if (!snap_print(ndo, p, length, caplen, esrc, edst, 2)) {

+ /*

+ * Unknown packet type; tell our caller, by

+ * returning a negative value, so they

+ * can print the raw packet.

+ */

+ return (-(hdrlen + 5)); /* include LLC and SNAP header */

+ } else

+ return (hdrlen + 5); /* include LLC and SNAP header */

}

- /* Cisco Discovery Protocol - SNAP & ether type 0x2000 */

- if(llc.ssap == LLCSAP_SNAP && llc.dsap == LLCSAP_SNAP &&

- llc.llcui == LLC_UI &&

- llc.ethertype[0] == 0x20 && llc.ethertype[1] == 0x00 ) {

- cdp_print( p, length, caplen, esrc, edst);

- return (1);

+ if (ssap == LLCSAP_8021D && dsap == LLCSAP_8021D &&

+ control == LLC_UI) {

+ stp_print(ndo, p, length);

+ return (hdrlen);

}

- if (llc.ssap == LLCSAP_8021D && llc.dsap == LLCSAP_8021D) {

- stp_print(p, length);

- return (1);

+ if (ssap == LLCSAP_IP && dsap == LLCSAP_IP &&

+ control == LLC_UI) {

+ /*

+ * This is an RFC 948-style IP packet, with

+ * an 802.3 header and an 802.2 LLC header

+ * with the source and destination SAPs being

+ * the IP SAP.

+ */

+ ip_print(ndo, p, length);

+ return (hdrlen);

}

- if (llc.ssap == LLCSAP_IPX && llc.dsap == LLCSAP_IPX &&

- llc.llcui == LLC_UI) {

+ if (ssap == LLCSAP_IPX && dsap == LLCSAP_IPX &&

+ control == LLC_UI) {

/*

* This is an Ethernet_802.2 IPX frame, with an 802.3

* header and an 802.2 LLC header with the source and

* destination SAPs being the IPX SAP.

/*

* This is an Ethernet_802.2 IPX frame, with an 802.3

* header and an 802.2 LLC header with the source and

* destination SAPs being the IPX SAP.

- *

- * Skip DSAP, LSAP, and control field.

*/

- p += 3;

- length -= 3;

- caplen -= 3;

- ipx_print(p, length);

- return (1);

+ if (ndo->ndo_eflag)

+ ND_PRINT((ndo, "IPX 802.2: "));

+

+ ipx_print(ndo, p, length);

+ return (hdrlen);

}

- if (llc.ssap == 0xf0 && llc.dsap == 0xf0

- && (!(llc.llcu & LLC_S_FMT) || llc.llcu == LLC_U_FMT)) {

+#ifdef ENABLE_SMB

+ if (ssap == LLCSAP_NETBEUI && dsap == LLCSAP_NETBEUI

+ && (!(control & LLC_S_FMT) || control == LLC_U_FMT)) {

/*

* we don't actually have a full netbeui parser yet, but the

* smb parser can handle many smb-in-netbeui packets, which

/*

* we don't actually have a full netbeui parser yet, but the

* smb parser can handle many smb-in-netbeui packets, which

* LLC_S_FMT, set in the first byte of the control field)

* and UI frames (whose control field is just 3, LLC_U_FMT).

*/

* LLC_S_FMT, set in the first byte of the control field)

* and UI frames (whose control field is just 3, LLC_U_FMT).

*/

+ netbeui_print(ndo, control, p, length);

+ return (hdrlen);

+ }

+#endif

+ if (ssap == LLCSAP_ISONS && dsap == LLCSAP_ISONS

+ && control == LLC_UI) {

+ isoclns_print(ndo, p, length, caplen);

+ return (hdrlen);

+ }

+

+ if (!ndo->ndo_eflag) {

+ if (ssap == dsap) {

+ if (esrc == NULL || edst == NULL)

+ ND_PRINT((ndo, "%s ", tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)));

+ else

+ ND_PRINT((ndo, "%s > %s %s ",

+ etheraddr_string(ndo, esrc),

+ etheraddr_string(ndo, edst),

+ tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)));

+ } else {

+ if (esrc == NULL || edst == NULL)

+ ND_PRINT((ndo, "%s > %s ",

+ tok2str(llc_values, "Unknown SSAP 0x%02x", ssap),

+ tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)));

+ else

+ ND_PRINT((ndo, "%s %s > %s %s ",

+ etheraddr_string(ndo, esrc),

+ tok2str(llc_values, "Unknown SSAP 0x%02x", ssap),

+ etheraddr_string(ndo, edst),

+ tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)));

+ }

+

+ if (is_u) {

+ ND_PRINT((ndo, "Unnumbered, %s, Flags [%s], length %u",

+ tok2str(llc_cmd_values, "%02x", LLC_U_CMD(control)),

+ tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_U_POLL)),

+ length + hdrlen));

+

+ if ((control & ~LLC_U_POLL) == LLC_XID) {

+ if (*p == LLC_XID_FI) {

+ ND_PRINT((ndo, ": %02x %02x", p[1], p[2]));

+ return (hdrlen);

+ }

+ } else {

+ if ((control & LLC_S_FMT) == LLC_S_FMT) {

+ ND_PRINT((ndo, "Supervisory, %s, rcv seq %u, Flags [%s], length %u",

+ tok2str(llc_supervisory_values,"?",LLC_S_CMD(control)),

+ LLC_IS_NR(control),

+ tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)),

+ length + hdrlen));

+ return (hdrlen); /* no payload to print */

+ } else {

+ ND_PRINT((ndo, "Information, send seq %u, rcv seq %u, Flags [%s], length %u",

+ LLC_I_NS(control),

+ LLC_IS_NR(control),

+ tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)),

+ length + hdrlen));

+ }

+ return (-hdrlen);

+}

+

+static const struct tok *

+oui_to_struct_tok(uint32_t orgcode)

+{

+ const struct tok *tok = null_values;

+ const struct oui_tok *otp;

+

+ for (otp = &oui_to_tok[0]; otp->tok != NULL; otp++) {

+ if (otp->oui == orgcode) {

+ tok = otp->tok;

+ break;

+ }

+ return (tok);

+}

+

+int

+snap_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen,

+ const u_char *esrc, const u_char *edst, u_int bridge_pad)

+{

+ uint32_t orgcode;

+ register u_short et;

+ register int ret;

+ ND_TCHECK2(*p, 5);

+ if (caplen < 5 || length < 5)

+ goto trunc;

+ orgcode = EXTRACT_24BITS(p);

+ et = EXTRACT_16BITS(p + 3);

+

+ if (ndo->ndo_eflag) {

/*

- * Skip the DSAP and LSAP.

+ * Somebody's already printed the MAC addresses, if there

+ * are any, so just print the SNAP header, not the MAC

+ * addresses.

*/

- p += 2;

- length -= 2;

- caplen -= 2;

+ ND_PRINT((ndo, "oui %s (0x%06x), %s %s (0x%04x), length %u: ",

+ tok2str(oui_values, "Unknown", orgcode),

+ orgcode,

+ (orgcode == 0x000000 ? "ethertype" : "pid"),

+ tok2str(oui_to_struct_tok(orgcode), "Unknown", et),

+ et, length - 5));

+ }

+ p += 5;

+ length -= 5;

+ caplen -= 5;

+ switch (orgcode) {

+ case OUI_ENCAP_ETHER:

+ case OUI_CISCO_90:

/*

- * OK, what type of LLC frame is this? The length

- * of the control field depends on that - I frames

- * have a two-byte control field, and U frames have

- * a one-byte control field.

+ * This is an encapsulated Ethernet packet,

+ * or a packet bridged by some piece of

+ * Cisco hardware; the protocol ID is

+ * an Ethernet protocol type.

*/

- if (llc.llcu == LLC_U_FMT) {

- control = llc.llcu;

- p += 1;

- length -= 1;

- caplen -= 1;

- } else {

+ ret = ethertype_print(ndo, et, p, length, caplen);

+ if (ret)

+ return (ret);

+ break;

+

+ case OUI_APPLETALK:

+ if (et == ETHERTYPE_ATALK) {

/*

- * The control field in I and S frames is

- * little-endian.

+ * No, I have no idea why Apple used one

+ * of their own OUIs, rather than

+ * 0x000000, and an Ethernet packet

+ * type, for Appletalk data packets,

+ * but used 0x000000 and an Ethernet

+ * packet type for AARP packets.

*/

- control = EXTRACT_LE_16BITS(&llc.llcu);

- p += 2;

- length -= 2;

- caplen -= 2;

+ ret = ethertype_print(ndo, et, p, length, caplen);

+ if (ret)

+ return (ret);

}

- netbeui_print(control, p, p + min(caplen, length));

- return (1);

- }

- if (llc.ssap == LLCSAP_ISONS && llc.dsap == LLCSAP_ISONS

- && llc.llcui == LLC_UI) {

- isoclns_print(p + 3, length - 3, caplen - 3, esrc, edst);

- return (1);

- }

+ break;

- if (llc.ssap == LLCSAP_SNAP && llc.dsap == LLCSAP_SNAP

- && llc.llcui == LLC_UI) {

- if (caplen < sizeof(llc)) {

- (void)printf("[|llc-snap]");

- default_print((u_char *)p, caplen);

- return (0);

- }

- if (vflag)

- (void)printf("snap %s ", protoid_string(llc.llcpi));

+ case OUI_CISCO:

+ switch (et) {

+ case PID_CISCO_CDP:

+ cdp_print(ndo, p, length, caplen);

+ return (1);

+ case PID_CISCO_DTP:

+ dtp_print(ndo, p, length);

+ return (1);

+ case PID_CISCO_UDLD:

+ udld_print(ndo, p, length);

+ return (1);

+ case PID_CISCO_VTP:

+ vtp_print(ndo, p, length);

+ return (1);

+ case PID_CISCO_PVST:

+ case PID_CISCO_VLANBRIDGE:

+ stp_print(ndo, p, length);

+ return (1);

+ default:

+ break;

+ }

+ break;

- caplen -= sizeof(llc);

- length -= sizeof(llc);

- p += sizeof(llc);

+ case OUI_RFC2684:

+ switch (et) {

- /* This is an encapsulated Ethernet packet */

- et = EXTRACT_16BITS(&llc.ethertype[0]);

- ret = ether_encap_print(et, p, length, caplen,

- extracted_ethertype);

- if (ret)

- return (ret);

- }

+ case PID_RFC2684_ETH_FCS:

+ case PID_RFC2684_ETH_NOFCS:

+ /*

+ * XXX - remove the last two bytes for

+ * PID_RFC2684_ETH_FCS?

+ */

+ /*

+ * Skip the padding.

+ */

+ ND_TCHECK2(*p, bridge_pad);

+ caplen -= bridge_pad;

+ length -= bridge_pad;

+ p += bridge_pad;

- if ((llc.ssap & ~LLC_GSAP) == llc.dsap) {

- if (eflag)

- (void)printf("%s ", llcsap_string(llc.dsap));

- else

- (void)printf("%s > %s %s ",

- etheraddr_string(esrc),

- etheraddr_string(edst),

- llcsap_string(llc.dsap));

- } else {

- if (eflag)

- (void)printf("%s > %s ",

- llcsap_string(llc.ssap & ~LLC_GSAP),

- llcsap_string(llc.dsap));

- else

- (void)printf("%s %s > %s %s ",

- etheraddr_string(esrc),

- llcsap_string(llc.ssap & ~LLC_GSAP),

- etheraddr_string(edst),

- llcsap_string(llc.dsap));

- }

+ /*

+ * What remains is an Ethernet packet.

+ */

+ ether_print(ndo, p, length, caplen, NULL, NULL);

+ return (1);

- if ((llc.llcu & LLC_U_FMT) == LLC_U_FMT) {

- u_int16_t cmd;

- const char *m;

- char f;

-

- cmd = LLC_U_CMD(llc.llcu);

- m = tok2str(cmd2str, "%02x", cmd);

- switch ((llc.ssap & LLC_GSAP) | (llc.llcu & LLC_U_POLL)) {

- case 0: f = 'C'; break;

- case LLC_GSAP: f = 'R'; break;

- case LLC_U_POLL: f = 'P'; break;

- case LLC_GSAP|LLC_U_POLL: f = 'F'; break;

- default: f = '?'; break;

- }

+ case PID_RFC2684_802_5_FCS:

+ case PID_RFC2684_802_5_NOFCS:

+ /*

+ * XXX - remove the last two bytes for

+ * PID_RFC2684_ETH_FCS?

+ */

+ /*

+ * Skip the padding, but not the Access

+ * Control field.

+ */

+ ND_TCHECK2(*p, bridge_pad);

+ caplen -= bridge_pad;

+ length -= bridge_pad;

+ p += bridge_pad;

- printf("%s/%c", m, f);

+ /*

+ * What remains is an 802.5 Token Ring

+ * packet.

+ */

+ token_print(ndo, p, length, caplen);

+ return (1);

- p += 3;

- length -= 3;

- caplen -= 3;

+ case PID_RFC2684_FDDI_FCS:

+ case PID_RFC2684_FDDI_NOFCS:

+ /*

+ * XXX - remove the last two bytes for

+ * PID_RFC2684_ETH_FCS?

+ */

+ /*

+ * Skip the padding.

+ */

+ ND_TCHECK2(*p, bridge_pad + 1);

+ caplen -= bridge_pad + 1;

+ length -= bridge_pad + 1;

+ p += bridge_pad + 1;

- if ((llc.llcu & ~LLC_U_POLL) == LLC_XID) {

- if (*p == LLC_XID_FI) {

- printf(": %02x %02x", p[1], p[2]);

- p += 3;

- length -= 3;

- caplen -= 3;

- }

- } else {

- char f;

+ /*

+ * What remains is an FDDI packet.

+ */

+ fddi_print(ndo, p, length, caplen);

+ return (1);

+ case PID_RFC2684_BPDU:

+ stp_print(ndo, p, length);

+ return (1);

+ }

+ if (!ndo->ndo_eflag) {

/*

- * The control field in I and S frames is little-endian.

+ * Nobody printed the MAC addresses, so print them, if

+ * we have any.

*/

- control = EXTRACT_LE_16BITS(&llc.llcu);

- switch ((llc.ssap & LLC_GSAP) | (control & LLC_IS_POLL)) {

- case 0: f = 'C'; break;

- case LLC_GSAP: f = 'R'; break;

- case LLC_IS_POLL: f = 'P'; break;

- case LLC_GSAP|LLC_IS_POLL: f = 'F'; break;

- default: f = '?'; break;

+ if (esrc != NULL && edst != NULL) {

+ ND_PRINT((ndo, "%s > %s ",

+ etheraddr_string(ndo, esrc),

+ etheraddr_string(ndo, edst)));

}

-

- if ((control & LLC_S_FMT) == LLC_S_FMT) {

- static char *llc_s[] = { "rr", "rej", "rnr", "03" };

- (void)printf("%s (r=%d,%c)",

- llc_s[LLC_S_CMD(control)],

- LLC_IS_NR(control),

- f);

+ /*

+ * Print the SNAP header, but if the OUI is 000000, don't

+ * bother printing it, and report the PID as being an

+ * ethertype.

+ */

+ if (orgcode == 0x000000) {

+ ND_PRINT((ndo, "SNAP, ethertype %s (0x%04x), length %u: ",

+ tok2str(ethertype_values, "Unknown", et),

+ et, length));

} else {

- (void)printf("I (s=%d,r=%d,%c)",

- LLC_I_NS(control),

- LLC_IS_NR(control),

- f);

+ ND_PRINT((ndo, "SNAP, oui %s (0x%06x), pid %s (0x%04x), length %u: ",

+ tok2str(oui_values, "Unknown", orgcode),

+ orgcode,

+ tok2str(oui_to_struct_tok(orgcode), "Unknown", et),

+ et, length));

}

- p += 4;

- length -= 4;

- caplen -= 4;

}

- (void)printf(" len=%d", length);

- return(1);

+ return (0);

+

+trunc:

+ ND_PRINT((ndo, "[|snap]"));

+ return (1);

}

+

+/*

+ * Local Variables:

+ * c-style: whitesmith

+ * c-basic-offset: 8

+ * End:

+ */