+ /*
+ * OK, what type of LLC frame is this? The length
+ * of the control field depends on that - I frames
+ * have a two-byte control field, and U frames have
+ * a one-byte control field.
+ */
+ control = *(p + 2);
+ if ((control & LLC_U_FMT) == LLC_U_FMT) {
+ /*
+ * U frame.
+ */
+ is_u = 1;
+ hdrlen = 3; /* DSAP, SSAP, 1-byte control field */
+ } else {
+ /*
+ * The control field in I and S frames is
+ * 2 bytes...
+ */
+ if (caplen < 4) {
+ ND_PRINT((ndo, "[|llc]"));
+ ND_DEFAULTPRINT((const u_char *)p, caplen);
+ return (caplen);
+ }
+ if (length < 4) {
+ ND_PRINT((ndo, "[|llc]"));
+ ND_DEFAULTPRINT((const u_char *)p, caplen);
+ return (length);
+ }
+
+ /*
+ * ...and is little-endian.
+ */
+ control = EXTRACT_LE_16BITS(p + 2);
+ is_u = 0;
+ hdrlen = 4; /* DSAP, SSAP, 2-byte control field */
+ }
+
+ if (ssap_field == LLCSAP_GLOBAL && dsap_field == LLCSAP_GLOBAL) {
+ /*
+ * This is an Ethernet_802.3 IPX frame; it has an
+ * 802.3 header (i.e., an Ethernet header where the
+ * type/length field is <= ETHERMTU, i.e. it's a length
+ * field, not a type field), but has no 802.2 header -
+ * the IPX packet starts right after the Ethernet header,
+ * with a signature of two bytes of 0xFF (which is
+ * LLCSAP_GLOBAL).
+ *
+ * (It might also have been an Ethernet_802.3 IPX at
+ * one time, but got bridged onto another network,
+ * such as an 802.11 network; this has appeared in at
+ * least one capture file.)
+ */
+
+ if (ndo->ndo_eflag)
+ ND_PRINT((ndo, "IPX 802.3: "));
+
+ ipx_print(ndo, p, length);
+ return (0); /* no LLC header */
+ }
+
+ dsap = dsap_field & ~LLC_IG;
+ ssap = ssap_field & ~LLC_GSAP;
+
+ if (ndo->ndo_eflag) {
+ ND_PRINT((ndo, "LLC, dsap %s (0x%02x) %s, ssap %s (0x%02x) %s",
+ tok2str(llc_values, "Unknown", dsap),
+ dsap,
+ tok2str(llc_ig_flag_values, "Unknown", dsap_field & LLC_IG),
+ tok2str(llc_values, "Unknown", ssap),
+ ssap,
+ tok2str(llc_flag_values, "Unknown", ssap_field & LLC_GSAP)));
+
+ if (is_u) {
+ ND_PRINT((ndo, ", ctrl 0x%02x: ", control));
+ } else {
+ ND_PRINT((ndo, ", ctrl 0x%04x: ", control));
+ }
+ }
+
+ /*
+ * Skip LLC header.
+ */
+ p += hdrlen;
+ length -= hdrlen;
+ caplen -= hdrlen;
+
+ if (ssap == LLCSAP_SNAP && dsap == LLCSAP_SNAP
+ && control == LLC_UI) {
+ /*
+ * XXX - what *is* the right bridge pad value here?
+ * Does anybody ever bridge one form of LAN traffic
+ * over a networking type that uses 802.2 LLC?
+ */
+ if (!snap_print(ndo, p, length, caplen, esrc, edst, 2)) {
+ /*
+ * Unknown packet type; tell our caller, by
+ * returning a negative value, so they
+ * can print the raw packet.
+ */
+ return (-(hdrlen + 5)); /* include LLC and SNAP header */
+ } else
+ return (hdrlen + 5); /* include LLC and SNAP header */
projects / tcpdump / blobdiff