improve ZeroMQ support (ZMTP/1.0 inside PGM/EPGM)

This change adds new code to decode ZeroMQ datagrams, couples it with
the PGM decoder and extends the -T option to make all this work.

There are two new test cases based on existing captures of ZMTP/1.0
inside [E]PGM to decode the ZMTP/1.0 part of these.

This functionality enables decoding of the traffic zeromq library
produces for "pgm://" and "epgm://" protocol schemas.

diff --git a/interface.h b/interface.h
index 053d30511064cd6903091e3096b755983c15cdcc..9044e28fd554e59846f3cf2662b963e28ae89b91 100644 (file)
--- a/interface.h
+++ b/interface.h
@@ -75,6 +75,7 @@ extern char *strsep(char **, const char *);
 #define PT_ZMTP1       12      /* ZeroMQ Message Transport Protocol 1.0 */
 #define PT_VXLAN       13      /* Virtual eXtensible Local Area Network */
 #define PT_PGM         14      /* [UDP-encapsulated] Pragmatic General Multicast */
+#define PT_PGM_ZMTP1   15      /* ZMTP/1.0 inside PGM (native or UDP-encapsulated) */
 
 #ifndef min
 #define min(a,b) ((a)>(b)?(b):(a))
@@ -315,6 +316,7 @@ extern void mpls_print(const u_char *, u_int);
 extern void mpls_lsp_ping_print(const u_char *, u_int);
 extern void zephyr_print(const u_char *, int);
 extern void zmtp1_print(const u_char *, u_int);
+extern void zmtp1_print_datagram(const u_char *, u_int);
 extern void hsrp_print(const u_char *, u_int);
 extern void bfd_print(const u_char *, u_int, u_int);
 extern void sip_print(const u_char *, u_int);

diff --git a/netdissect.h b/netdissect.h
index a808f2e03b61f9bb4efe8fac7f87585d73de6f71..6e4a8972b5c7f97cd85dc90d5490863889b28b22 100644 (file)
--- a/netdissect.h
+++ b/netdissect.h
@@ -184,6 +184,7 @@ struct netdissect_options {
 #define PT_ZMTP1       12      /* ZeroMQ Message Transport Protocol 1.0 */
 #define PT_VXLAN       13      /* Virtual eXtensible Local Area Network */
 #define PT_PGM         14      /* [UDP-encapsulated] Pragmatic General Multicast */
+#define PT_PGM_ZMTP1   15      /* ZMTP/1.0 inside PGM (native or UDP-encapsulated) */
 
 #ifndef min
 #define min(a,b) ((a)>(b)?(b):(a))

diff --git a/print-pgm.c b/print-pgm.c
index ac560ec990125e5eaa34a1b24423a81e85cdd15f..72c80d9a5da98a3333244bc3792d29267a247677 100644 (file)
--- a/print-pgm.c
+++ b/print-pgm.c
@@ -834,6 +834,9 @@ pgm_print(register const u_char *bp, register u_int length,
        }
 
        (void)printf(" [%u]", length);
+       if (packettype == PT_PGM_ZMTP1 &&
+           (pgm->pgm_type == PGM_ODATA || pgm->pgm_type == PGM_RDATA))
+               zmtp1_print_datagram(bp, EXTRACT_16BITS(&pgm->pgm_length));
 
        return;
 

diff --git a/print-udp.c b/print-udp.c
index ebb947d89516652a3dc06c7673b56ecf52f70309..6e0c99bb192852ff0d6b20bbea2c96faa996eb41 100644 (file)
--- a/print-udp.c
+++ b/print-udp.c
@@ -481,6 +481,7 @@ udp_print(register const u_char *bp, u_int length,
                        break;
 
                case PT_PGM:
+               case PT_PGM_ZMTP1:
                        udpipaddr_print(ip, sport, dport);
                        pgm_print(cp, length, bp2);
                        break;

diff --git a/print-zeromq.c b/print-zeromq.c
index 10ca2cc4f0490dc6649a638df6e10d62188f9594..5aea478d76c3e4ea5f1c5b474032782c3f60b8b5 100644 (file)
--- a/print-zeromq.c
+++ b/print-zeromq.c
@@ -146,3 +146,69 @@ zmtp1_print(const u_char *cp, u_int len) {
                cp = zmtp1_print_frame(cp, ep);
 }
 
+/* The functions below decode a ZeroMQ datagram, supposedly stored in the "Data"
+ * field of an ODATA/RDATA [E]PGM packet. An excerpt from zmq_pgm(7) man page
+ * follows.
+ *
+ * In order for late joining consumers to be able to identify message
+ * boundaries, each PGM datagram payload starts with a 16-bit unsigned integer
+ * in network byte order specifying either the offset of the first message frame
+ * in the datagram or containing the value 0xFFFF if the datagram contains
+ * solely an intermediate part of a larger message.
+ *
+ * Note that offset specifies where the first message begins rather than the
+ * first message part. Thus, if there are trailing message parts at the
+ * beginning of the packet the offset ignores them and points to first initial
+ * message part in the packet.
+ */
+
+static const u_char *
+zmtp1_print_intermediate_part(const u_char *cp, const u_int len) {
+       u_int frame_offset;
+       u_int64_t remaining_len;
+
+       TCHECK2(*cp, 2);
+       frame_offset = EXTRACT_16BITS(cp);
+       printf("\n\t frame offset 0x%04"PRIx16"", frame_offset);
+       cp += 2;
+       remaining_len = snapend - cp; /* without the frame length */
+
+       if (frame_offset == 0xFFFF)
+               frame_offset = len - 2; /* always within the declared length */
+       else if (2 + frame_offset > len) {
+               printf(" (exceeds datagram declared length)");
+               goto trunc;
+       }
+
+       /* offset within declared length of the datagram */
+       if (frame_offset) {
+               printf("\n\t frame intermediate part, %u bytes", frame_offset);
+               if (frame_offset > remaining_len)
+                       printf(" (%"PRIu64" captured)", remaining_len);
+               if (vflag) {
+                       u_int64_t len_printed = MIN(frame_offset, remaining_len);
+
+                       if (vflag == 1)
+                               len_printed = MIN(VBYTES, len_printed);
+                       if (len_printed > 1) {
+                               printf(", first %"PRIu64" byte(s):", len_printed);
+                               hex_and_ascii_print("\n\t ", cp, len_printed);
+                               printf("\n");
+                       }
+               }
+       }
+       return cp + frame_offset;
+
+trunc:
+       printf(" [|zmtp1]");
+       return cp + len;
+}
+
+void
+zmtp1_print_datagram(const u_char *cp, const u_int len) {
+       const u_char *ep = MIN(snapend, cp + len);
+
+       cp = zmtp1_print_intermediate_part(cp, len);
+       while (cp < ep)
+               cp = zmtp1_print_frame(cp, ep);
+}

diff --git a/tcpdump.1.in b/tcpdump.1.in
index c2569db3c3843b81f25c13f2c1af56d2dc631d56..bbc8d1d9796d79f41cbde653b9641a9345f526d8 100644 (file)
--- a/tcpdump.1.in
+++ b/tcpdump.1.in
@@ -520,6 +520,7 @@ Currently known types are
 \fBcarp\fR (Common Address Redundancy Protocol),
 \fBcnfp\fR (Cisco NetFlow protocol),
 \fBpgm\fR (Pragmatic General Multicast),
+\fBpgm_zmtp1\fR (ZMTP/1.0 inside PGM/EPGM),
 \fBradius\fR (RADIUS),
 \fBrpc\fR (Remote Procedure Call),
 \fBrtp\fR (Real-Time Applications protocol),
@@ -535,6 +536,12 @@ and
 Note that the \fBpgm\fR type above affects UDP interpretation only, the native
 PGM is always recognised as IP protocol 113 regardless. UDP-encapsulated PGM is
 often called "EPGM" or "PGM/UDP".
+.IP
+Note that the \fBpgm_zmtp1\fR type above affects interpretation of both native
+PGM and UDP at once. During the native PGM decoding the application data of an
+ODATA/RDATA packet would be decoded as a ZeroMQ datagram with ZMTP/1.0 frames.
+During the UDP decoding in addition to that any UDP packet would be treated as
+an encapsulated PGM packet.
 .TP
 .B \-t
 \fIDon't\fP print a timestamp on each dump line.

diff --git a/tcpdump.c b/tcpdump.c
index a32701cf459d46cf9afa7392d815c6c1f7211dc2..c0605fbb697a75dfa08ba3b76186f26b2850859b 100644 (file)
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -1017,6 +1017,8 @@ main(int argc, char **argv)
                                packettype = PT_VXLAN;
                        else if (strcasecmp(optarg, "pgm") == 0)
                                packettype = PT_PGM;
+                       else if (strcasecmp(optarg, "pgm_zmtp1") == 0)
+                               packettype = PT_PGM_ZMTP1;
                        else
                                error("unknown packet type `%s'", optarg);
                        break;

diff --git a/tests/TESTLIST b/tests/TESTLIST
index a73474f89cfe82a3a93b6b6153c89d819d713826..28ca4d01912036dc3afb601e10fffe6a975e6523 100644 (file)
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -96,6 +96,10 @@ zmtp1v               zmtp1.pcap              zmtp1.out       -t -v -T zmtp1
 pgmv           pgm_zmtp1.pcap          pgmv.out        -t -v
 # UDP-encapsulated PGM
 epgmv          epgm_zmtp1.pcap         epgmv.out       -t -v -T pgm
+# ZMTP/1.0 inside native PGM
+pgm_zmtp1v     pgm_zmtp1.pcap          pgm_zmtp1v.out  -t -v -T pgm_zmtp1
+# ZMTP/1.0 inside UDP-encapsulated PGM
+epgm_zmtp1v    epgm_zmtp1.pcap         epgm_zmtp1v.out -t -v -T pgm_zmtp1
 
 # MS NLB tests
 msnlb          msnlb.pcap              msnlb.out       -t

diff --git a/tests/epgm_zmtp1v.out b/tests/epgm_zmtp1v.out
new file mode 100644 (file)
index 0000000..171ecac
--- /dev/null
+++ b/tests/epgm_zmtp1v.out
@@ -0,0 +1,79 @@
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto UDP (17), length 64)
+    10.0.0.45.33280 > 239.255.0.16.5563: 39236 > 5563: PGM, length 0 0x47e3fdad9a9c SPM seq 471 trail 0 lead 281 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto UDP (17), length 64)
+    10.0.0.45.33280 > 239.255.0.16.5563: 39236 > 5563: PGM, length 0 0x47e3fdad9a9c SPM seq 472 trail 0 lead 281 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto UDP (17), length 64)
+    10.0.0.45.33280 > 239.255.0.16.5563: 39236 > 5563: PGM, length 0 0x47e3fdad9a9c SPM seq 473 trail 0 lead 281 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto UDP (17), length 64)
+    10.0.0.45.33280 > 239.255.0.16.5563: 39236 > 5563: PGM, length 0 0x47e3fdad9a9c SPM seq 474 trail 0 lead 281 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto UDP (17), length 64)
+    10.0.0.45.33280 > 239.255.0.16.5563: 39236 > 5563: PGM, length 0 0x47e3fdad9a9c SPM seq 475 trail 0 lead 281 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto UDP (17), length 1480)
+    10.0.0.45.40251 > 239.255.0.16.5563: 39236 > 5563: PGM, length 1428 0x47e3fdad9a9c ODATA trail 0 seq 282 [1452]
+        frame offset 0x0000
+        frame flags+body  (8-bit) length 116, flags 0x00 (-|-|-|-|-|-|-|-), first 115 byte(s) of body:
+        0x0000:  5468 6973 2069 7320 6120 7368 6f72 7420  This.is.a.short.
+        0x0010:  4153 4349 4920 6d65 7373 6167 6520 666f  ASCII.message.fo
+        0x0020:  6c6c 6f77 6564 2062 7920 6120 7368 6f72  llowed.by.a.shor
+        0x0030:  7420 6269 6e61 7279 206d 6573 7361 6765  t.binary.message
+        0x0040:  2c20 6120 6c6f 6e67 6572 2041 5343 4949  ,.a.longer.ASCII
+        0x0050:  206d 6573 7361 6765 2061 6e64 2061 2073  .message.and.a.s
+        0x0060:  686f 7274 2041 5343 4949 206d 6573 7361  hort.ASCII.messa
+        0x0070:  6765 2e                                  ge.
+
+        frame flags+body  (8-bit) length 17, flags 0x00 (-|-|-|-|-|-|-|-), first 16 byte(s) of body:
+        0x0000:  0001 0203 0405 0607 0809 0a0b 0c0d 0e0f  ................
+
+        frame flags+body (64-bit) length 2790 (1282 captured), flags 0x00 (-|-|-|-|-|-|-|-), first 128 byte(s) of body:
+        0x0000:  5468 6520 7175 6963 6b20 6272 6f77 6e20  The.quick.brown.
+        0x0010:  666f 7820 6a75 6d70 7320 6f76 6572 2074  fox.jumps.over.t
+        0x0020:  6865 206c 617a 7920 646f 672e 2054 6865  he.lazy.dog..The
+        0x0030:  2071 7569 636b 2062 726f 776e 2066 6f78  .quick.brown.fox
+        0x0040:  206a 756d 7073 206f 7665 7220 7468 6520  .jumps.over.the.
+        0x0050:  6c61 7a79 2064 6f67 2e20 5468 6520 7175  lazy.dog..The.qu
+        0x0060:  6963 6b20 6272 6f77 6e20 666f 7820 6a75  ick.brown.fox.ju
+        0x0070:  6d70 7320 6f76 6572 2074 6865 206c 617a  mps.over.the.laz
+ [|zmtp1]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto UDP (17), length 1480)
+    10.0.0.45.40251 > 239.255.0.16.5563: 39236 > 5563: PGM, length 1428 0x47e3fdad9a9c ODATA trail 0 seq 283 [1452]
+        frame offset 0xffff
+        frame intermediate part, 1426 bytes, first 128 byte(s):
+        0x0000:  756d 7073 206f 7665 7220 7468 6520 6c61  umps.over.the.la
+        0x0010:  7a79 2064 6f67 2e20 5468 6520 7175 6963  zy.dog..The.quic
+        0x0020:  6b20 6272 6f77 6e20 666f 7820 6a75 6d70  k.brown.fox.jump
+        0x0030:  7320 6f76 6572 2074 6865 206c 617a 7920  s.over.the.lazy.
+        0x0040:  646f 672e 2054 6865 2071 7569 636b 2062  dog..The.quick.b
+        0x0050:  726f 776e 2066 6f78 206a 756d 7073 206f  rown.fox.jumps.o
+        0x0060:  7665 7220 7468 6520 6c61 7a79 2064 6f67  ver.the.lazy.dog
+        0x0070:  2e20 5468 6520 7175 6963 6b20 6272 6f77  ..The.quick.brow
+
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto UDP (17), length 173)
+    10.0.0.45.40251 > 239.255.0.16.5563: 39236 > 5563: PGM, length 121 0x47e3fdad9a9c ODATA trail 0 seq 284 [145]
+        frame offset 0x0052
+        frame intermediate part, 82 bytes, first 82 byte(s):
+        0x0000:  636b 2062 726f 776e 2066 6f78 206a 756d  ck.brown.fox.jum
+        0x0010:  7073 206f 7665 7220 7468 6520 6c61 7a79  ps.over.the.lazy
+        0x0020:  2064 6f67 2e20 5468 6520 7175 6963 6b20  .dog..The.quick.
+        0x0030:  6272 6f77 6e20 666f 7820 6a75 6d70 7320  brown.fox.jumps.
+        0x0040:  6f76 6572 2074 6865 206c 617a 7920 646f  over.the.lazy.do
+        0x0050:  672e                                     g.
+
+        frame flags+body  (8-bit) length 36, flags 0x00 (-|-|-|-|-|-|-|-), first 35 byte(s) of body:
+        0x0000:  5468 6973 2069 7320 7468 6520 7472 6169  This.is.the.trai
+        0x0010:  6c69 6e67 2041 5343 4949 206d 6573 7361  ling.ASCII.messa
+        0x0020:  6765 2e                                  ge.
+
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto UDP (17), length 64)
+    10.0.0.45.33280 > 239.255.0.16.5563: 39236 > 5563: PGM, length 0 0x47e3fdad9a9c SPM seq 476 trail 0 lead 284 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 1, id 0, offset 0, flags [DF], proto UDP (17), length 44)
+    10.0.0.45.46357 > 239.255.0.16.5563: 5563 > 39236: PGM, length 0 0x47e3fdad9a9c SPMR [16]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto UDP (17), length 64)
+    10.0.0.45.33280 > 239.255.0.16.5563: 39236 > 5563: PGM, length 0 0x47e3fdad9a9c SPM seq 477 trail 0 lead 284 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto UDP (17), length 64)
+    10.0.0.45.33280 > 239.255.0.16.5563: 39236 > 5563: PGM, length 0 0x47e3fdad9a9c SPM seq 478 trail 0 lead 284 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto UDP (17), length 64)
+    10.0.0.45.33280 > 239.255.0.16.5563: 39236 > 5563: PGM, length 0 0x47e3fdad9a9c SPM seq 479 trail 0 lead 284 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto UDP (17), length 64)
+    10.0.0.45.33280 > 239.255.0.16.5563: 39236 > 5563: PGM, length 0 0x47e3fdad9a9c SPM seq 480 trail 0 lead 284 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto UDP (17), length 64)
+    10.0.0.45.33280 > 239.255.0.16.5563: 39236 > 5563: PGM, length 0 0x47e3fdad9a9c SPM seq 481 trail 0 lead 284 nla 10.0.0.45 [36]

diff --git a/tests/pgm_zmtp1v.out b/tests/pgm_zmtp1v.out
new file mode 100644 (file)
index 0000000..09044a7
--- /dev/null
+++ b/tests/pgm_zmtp1v.out
@@ -0,0 +1,76 @@
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto PGM (113), length 56)
+    10.0.0.45 > 239.255.0.16: 10.0.0.45.13320 > 239.255.0.16.5563: PGM, length 0 0x3329041eba74 SPM seq 92190 trail 21618 lead 54950 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto PGM (113), length 56)
+    10.0.0.45 > 239.255.0.16: 10.0.0.45.13320 > 239.255.0.16.5563: PGM, length 0 0x3329041eba74 SPM seq 92191 trail 21618 lead 54950 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto PGM (113), length 56)
+    10.0.0.45 > 239.255.0.16: 10.0.0.45.13320 > 239.255.0.16.5563: PGM, length 0 0x3329041eba74 SPM seq 92192 trail 21618 lead 54950 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto PGM (113), length 1480)
+    10.0.0.45 > 239.255.0.16: 10.0.0.45.13320 > 239.255.0.16.5563: PGM, length 1436 0x3329041eba74 ODATA trail 21618 seq 54951 [1460]
+        frame offset 0x0000
+        frame flags+body  (8-bit) length 116, flags 0x00 (-|-|-|-|-|-|-|-), first 115 byte(s) of body:
+        0x0000:  5468 6973 2069 7320 6120 7368 6f72 7420  This.is.a.short.
+        0x0010:  4153 4349 4920 6d65 7373 6167 6520 666f  ASCII.message.fo
+        0x0020:  6c6c 6f77 6564 2062 7920 6120 7368 6f72  llowed.by.a.shor
+        0x0030:  7420 6269 6e61 7279 206d 6573 7361 6765  t.binary.message
+        0x0040:  2c20 6120 6c6f 6e67 6572 2041 5343 4949  ,.a.longer.ASCII
+        0x0050:  206d 6573 7361 6765 2061 6e64 2061 2073  .message.and.a.s
+        0x0060:  686f 7274 2041 5343 4949 206d 6573 7361  hort.ASCII.messa
+        0x0070:  6765 2e                                  ge.
+
+        frame flags+body  (8-bit) length 17, flags 0x00 (-|-|-|-|-|-|-|-), first 16 byte(s) of body:
+        0x0000:  0001 0203 0405 0607 0809 0a0b 0c0d 0e0f  ................
+
+        frame flags+body (64-bit) length 2790 (1290 captured), flags 0x00 (-|-|-|-|-|-|-|-), first 128 byte(s) of body:
+        0x0000:  5468 6520 7175 6963 6b20 6272 6f77 6e20  The.quick.brown.
+        0x0010:  666f 7820 6a75 6d70 7320 6f76 6572 2074  fox.jumps.over.t
+        0x0020:  6865 206c 617a 7920 646f 672e 2054 6865  he.lazy.dog..The
+        0x0030:  2071 7569 636b 2062 726f 776e 2066 6f78  .quick.brown.fox
+        0x0040:  206a 756d 7073 206f 7665 7220 7468 6520  .jumps.over.the.
+        0x0050:  6c61 7a79 2064 6f67 2e20 5468 6520 7175  lazy.dog..The.qu
+        0x0060:  6963 6b20 6272 6f77 6e20 666f 7820 6a75  ick.brown.fox.ju
+        0x0070:  6d70 7320 6f76 6572 2074 6865 206c 617a  mps.over.the.laz
+ [|zmtp1]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto PGM (113), length 1480)
+    10.0.0.45 > 239.255.0.16: 10.0.0.45.13320 > 239.255.0.16.5563: PGM, length 1436 0x3329041eba74 ODATA trail 21619 seq 54952 [1460]
+        frame offset 0xffff
+        frame intermediate part, 1434 bytes, first 128 byte(s):
+        0x0000:  7220 7468 6520 6c61 7a79 2064 6f67 2e20  r.the.lazy.dog..
+        0x0010:  5468 6520 7175 6963 6b20 6272 6f77 6e20  The.quick.brown.
+        0x0020:  666f 7820 6a75 6d70 7320 6f76 6572 2074  fox.jumps.over.t
+        0x0030:  6865 206c 617a 7920 646f 672e 2054 6865  he.lazy.dog..The
+        0x0040:  2071 7569 636b 2062 726f 776e 2066 6f78  .quick.brown.fox
+        0x0050:  206a 756d 7073 206f 7665 7220 7468 6520  .jumps.over.the.
+        0x0060:  6c61 7a79 2064 6f67 2e20 5468 6520 7175  lazy.dog..The.qu
+        0x0070:  6963 6b20 6272 6f77 6e20 666f 7820 6a75  ick.brown.fox.ju
+
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto PGM (113), length 149)
+    10.0.0.45 > 239.255.0.16: 10.0.0.45.13320 > 239.255.0.16.5563: PGM, length 105 0x3329041eba74 ODATA trail 21620 seq 54953 [129]
+        frame offset 0x0042
+        frame intermediate part, 66 bytes, first 66 byte(s):
+        0x0000:  7073 206f 7665 7220 7468 6520 6c61 7a79  ps.over.the.lazy
+        0x0010:  2064 6f67 2e20 5468 6520 7175 6963 6b20  .dog..The.quick.
+        0x0020:  6272 6f77 6e20 666f 7820 6a75 6d70 7320  brown.fox.jumps.
+        0x0030:  6f76 6572 2074 6865 206c 617a 7920 646f  over.the.lazy.do
+        0x0040:  672e                                     g.
+
+        frame flags+body  (8-bit) length 36, flags 0x00 (-|-|-|-|-|-|-|-), first 35 byte(s) of body:
+        0x0000:  5468 6973 2069 7320 7468 6520 7472 6169  This.is.the.trai
+        0x0010:  6c69 6e67 2041 5343 4949 206d 6573 7361  ling.ASCII.messa
+        0x0020:  6765 2e                                  ge.
+
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto PGM (113), length 56)
+    10.0.0.45 > 239.255.0.16: 10.0.0.45.13320 > 239.255.0.16.5563: PGM, length 0 0x3329041eba74 SPM seq 92193 trail 21621 lead 54953 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 1, id 0, offset 0, flags [DF], proto PGM (113), length 36)
+    10.0.0.45 > 239.255.0.16: 10.0.0.45.5563 > 239.255.0.16.13320: PGM, length 0 0x3329041eba74 SPMR [16]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto PGM (113), length 56)
+    10.0.0.45 > 239.255.0.16: 10.0.0.45.13320 > 239.255.0.16.5563: PGM, length 0 0x3329041eba74 SPM seq 92194 trail 21621 lead 54953 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto PGM (113), length 56)
+    10.0.0.45 > 239.255.0.16: 10.0.0.45.13320 > 239.255.0.16.5563: PGM, length 0 0x3329041eba74 SPM seq 92195 trail 21621 lead 54953 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto PGM (113), length 56)
+    10.0.0.45 > 239.255.0.16: 10.0.0.45.13320 > 239.255.0.16.5563: PGM, length 0 0x3329041eba74 SPM seq 92196 trail 21621 lead 54953 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto PGM (113), length 56)
+    10.0.0.45 > 239.255.0.16: 10.0.0.45.13320 > 239.255.0.16.5563: PGM, length 0 0x3329041eba74 SPM seq 92197 trail 21621 lead 54953 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto PGM (113), length 56)
+    10.0.0.45 > 239.255.0.16: 10.0.0.45.13320 > 239.255.0.16.5563: PGM, length 0 0x3329041eba74 SPM seq 92198 trail 21621 lead 54953 nla 10.0.0.45 [36]
+IP (tos 0xb8, ttl 16, id 0, offset 0, flags [DF], proto PGM (113), length 56)
+    10.0.0.45 > 239.255.0.16: 10.0.0.45.13320 > 239.255.0.16.5563: PGM, length 0 0x3329041eba74 SPM seq 92199 trail 21621 lead 54953 nla 10.0.0.45 [36]