+
+int
+snap_print(const u_char *p, u_int length, u_int caplen,
+ u_short *extracted_ethertype, u_int bridge_pad)
+{
+ u_int32_t orgcode;
+ register u_short et;
+ register int ret;
+
+ TCHECK2(*p, 5);
+ orgcode = EXTRACT_24BITS(p);
+ et = EXTRACT_16BITS(p + 3);
+
+ if (eflag) {
+ const struct tok *tok = null_values;
+ const struct oui_tok *otp;
+
+ for (otp = &oui_to_tok[0]; otp->tok != NULL; otp++) {
+ if (otp->oui == orgcode) {
+ tok = otp->tok;
+ break;
+ }
+ }
+ (void)printf("oui %s (0x%06x), %s %s (0x%04x): ",
+ tok2str(oui_values, "Unknown", orgcode),
+ orgcode,
+ (orgcode == 0x000000 ? "ethertype" : "pid"),
+ tok2str(tok, "Unknown", et),
+ et);
+ }
+ p += 5;
+ length -= 5;
+ caplen -= 5;
+
+ switch (orgcode) {
+ case OUI_ENCAP_ETHER:
+ case OUI_CISCO_90:
+ /*
+ * This is an encapsulated Ethernet packet,
+ * or a packet bridged by some piece of
+ * Cisco hardware; the protocol ID is
+ * an Ethernet protocol type.
+ */
+ ret = ether_encap_print(et, p, length, caplen,
+ extracted_ethertype);
+ if (ret)
+ return (ret);
+ break;
+
+ case OUI_APPLETALK:
+ if (et == ETHERTYPE_ATALK) {
+ /*
+ * No, I have no idea why Apple used one
+ * of their own OUIs, rather than
+ * 0x000000, and an Ethernet packet
+ * type, for Appletalk data packets,
+ * but used 0x000000 and an Ethernet
+ * packet type for AARP packets.
+ */
+ ret = ether_encap_print(et, p, length, caplen,
+ extracted_ethertype);
+ if (ret)
+ return (ret);
+ }
+ break;
+
+ case OUI_CISCO:
+ switch (et) {
+ case PID_CISCO_CDP:
+ cdp_print(p, length, caplen);
+ return (1);
+ case PID_CISCO_DTP:
+ dtp_print(p, length);
+ return (1);
+ case PID_CISCO_UDLD:
+ udld_print(p, length);
+ return (1);
+ case PID_CISCO_VTP:
+ vtp_print(p, length);
+ return (1);
+ case PID_CISCO_PVST:
+ stp_print(p, length);
+ return (1);
+ default:
+ break;
+ }
+
+ case OUI_RFC2684:
+ switch (et) {
+
+ case PID_RFC2684_ETH_FCS:
+ case PID_RFC2684_ETH_NOFCS:
+ /*
+ * XXX - remove the last two bytes for
+ * PID_RFC2684_ETH_FCS?
+ */
+ /*
+ * Skip the padding.
+ */
+ TCHECK2(*p, bridge_pad);
+ caplen -= bridge_pad;
+ length -= bridge_pad;
+ p += bridge_pad;
+
+ /*
+ * What remains is an Ethernet packet.
+ */
+ ether_print(p, length, caplen);
+ return (1);
+
+ case PID_RFC2684_802_5_FCS:
+ case PID_RFC2684_802_5_NOFCS:
+ /*
+ * XXX - remove the last two bytes for
+ * PID_RFC2684_ETH_FCS?
+ */
+ /*
+ * Skip the padding, but not the Access
+ * Control field.
+ */
+ TCHECK2(*p, bridge_pad);
+ caplen -= bridge_pad;
+ length -= bridge_pad;
+ p += bridge_pad;
+
+ /*
+ * What remains is an 802.5 Token Ring
+ * packet.
+ */
+ token_print(p, length, caplen);
+ return (1);
+
+ case PID_RFC2684_FDDI_FCS:
+ case PID_RFC2684_FDDI_NOFCS:
+ /*
+ * XXX - remove the last two bytes for
+ * PID_RFC2684_ETH_FCS?
+ */
+ /*
+ * Skip the padding.
+ */
+ TCHECK2(*p, bridge_pad + 1);
+ caplen -= bridge_pad + 1;
+ length -= bridge_pad + 1;
+ p += bridge_pad + 1;
+
+ /*
+ * What remains is an FDDI packet.
+ */
+ fddi_print(p, length, caplen);
+ return (1);
+
+ case PID_RFC2684_BPDU:
+ stp_print(p, length);
+ return (1);
+ }
+ }
+ return (0);
+
+trunc:
+ (void)printf("[|snap]");
+ return (1);
+}
+
+
+/*
+ * Local Variables:
+ * c-style: whitesmith
+ * c-basic-offset: 8
+ * End:
+ */
projects / tcpdump / blobdiff