From: Darren Reed <[email protected]>

To: [email protected]
Date: Sat, 09 Apr 2011 12:51:14 +1000
Subject: [tcpdump-workers] Printing PPI packets

Printing PPI packets with tcpdump does not turn out
to be that hard.

My simple tests have produced the output as below.

It would be worthwhile having some changes made into
the tcpdump code base that were similar to the attached
that print them out.

diff --git a/Makefile.in b/Makefile.in
index d122a940421cbc16fedccdb6cc0d32ed04de8a4a..80034fd2cb1bf9b4f101f1d471e7e4f653062119 100644 (file)
--- a/Makefile.in
+++ b/Makefile.in
@@ -85,7 +85,8 @@ CSRC =        addrtoname.c af.c checksum.c cpack.c gmpls.c oui.c gmt2local.c ipproto.c
         print-lmp.c print-lspping.c print-lwapp.c \
        print-lwres.c print-mobile.c print-mpcp.c print-mpls.c print-msdp.c \
        print-nfs.c print-ntp.c print-null.c print-olsr.c print-ospf.c \
-       print-pgm.c print-pim.c print-ppp.c print-pppoe.c print-pptp.c \
+       print-pgm.c print-pim.c \
+       print-ppi.c print-ppp.c print-pppoe.c print-pptp.c \
        print-radius.c print-raw.c print-rip.c print-rrcp.c print-rsvp.c \
        print-rx.c print-sctp.c print-sflow.c print-sip.c print-sl.c print-sll.c \
        print-slow.c print-snmp.c print-stp.c print-sunatm.c print-sunrpc.c \

diff --git a/interface.h b/interface.h
index aa3954f5df1ac7a9626f2d89410df36e7c4285f4..075b78fe41a23ea7f9173281487cf89a4454a9db 100644 (file)
--- a/interface.h
+++ b/interface.h
@@ -97,6 +97,14 @@ extern char *program_name;   /* used to generate self-identifying messages */
 
 extern int32_t thiszone;       /* seconds offset from gmt to local time */
 
+typedef u_int (*if_ndo_printer)(struct netdissect_options *ndo,
+                               const struct pcap_pkthdr *, const u_char *);
+typedef u_int (*if_printer)(const struct pcap_pkthdr *, const u_char *);
+
+extern if_ndo_printer lookup_ndo_printer(int);
+extern if_printer lookup_printer(int);
+
+
 /*
  * True if  "l" bytes of "var" were captured.
  *
@@ -314,6 +322,7 @@ extern u_int bt_if_print(const struct pcap_pkthdr *, const u_char *);
 extern u_int usb_linux_48_byte_print(const struct pcap_pkthdr *, const u_char *);
 extern u_int usb_linux_64_byte_print(const struct pcap_pkthdr *, const u_char *);
 
+
 #ifdef INET6
 extern void ip6_opt_print(const u_char *, int);
 extern int hbhopt_print(const u_char *);

diff --git a/netdissect.h b/netdissect.h
index 8bed55fcd6654fbedb92b53d189368c14a1803d5..48ff2b20f53527635526002cde96897269bcd3c6 100644 (file)
--- a/netdissect.h
+++ b/netdissect.h
@@ -446,6 +446,8 @@ extern void pptp_print(netdissect_options *,const u_char *, u_int);
 #endif
 
 extern u_int ipnet_if_print(netdissect_options *,const struct pcap_pkthdr *, const u_char *);
+extern u_int ppi_if_print(netdissect_options *,const struct pcap_pkthdr *, const u_char *);
+
 extern u_int ieee802_15_4_if_print(netdissect_options *,const struct pcap_pkthdr *, const u_char *);
 
 #ifdef INET6

diff --git a/ppi.h b/ppi.h
new file mode 100644 (file)
index 0000000..733eb95
--- /dev/null
+++ b/ppi.h
@@ -0,0 +1,9 @@
+typedef struct ppi_header {
+       uint8_t         ppi_ver;
+       uint8_t         ppi_flags;
+       uint16_t        ppi_len;
+       uint32_t        ppi_dlt;
+} ppi_header_t;
+
+#define        PPI_HDRLEN      8
+

diff --git a/print-ppi.c b/print-ppi.c
new file mode 100644 (file)
index 0000000..b3b71f2
--- /dev/null
+++ b/print-ppi.c
@@ -0,0 +1,103 @@
+/*
+ * Oracle
+ */
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <tcpdump-stdinc.h>
+
+#include <stdio.h>
+#include <pcap.h>
+
+#include "netdissect.h"
+#include "interface.h"
+#include "extract.h"
+#include "ppi.h"
+
+#ifdef DLT_PPI
+
+static inline void
+ppi_header_print(struct netdissect_options *ndo, const u_char *bp, u_int length)
+{
+       const ppi_header_t *hdr;
+       hdr = (const ppi_header_t *)bp;
+       u_int32_t dlt;
+       u_int16_t len;
+
+       len = EXTRACT_16BITS(&hdr->ppi_len);
+       dlt = EXTRACT_32BITS(&hdr->ppi_dlt);
+
+       if (!ndo->ndo_qflag) {
+               ND_PRINT((ndo,", V.%d DLT %s (%d) len %d", hdr->ppi_ver,
+                         pcap_datalink_val_to_name(dlt), dlt,
+                          len));
+        } else {
+               ND_PRINT((ndo,", %s", pcap_datalink_val_to_name(dlt)));
+        }
+
+       ND_PRINT((ndo, ", length %u: ", length));
+}
+
+static void
+ppi_print(struct netdissect_options *ndo,
+               const struct pcap_pkthdr *h, const u_char *p)
+{
+       if_ndo_printer ndo_printer;
+        if_printer printer;
+       ppi_header_t *hdr;
+       u_int caplen = h->caplen;
+       u_int length = h->len;
+       u_int32_t dlt;
+
+       if (caplen < sizeof(ppi_header_t)) {
+               ND_PRINT((ndo, "[|ppi]"));
+               return;
+       }
+       hdr = (ppi_header_t *)p;
+       dlt = EXTRACT_32BITS(&hdr->ppi_dlt);
+
+       if (ndo->ndo_eflag)
+               ppi_header_print(ndo, p, length);
+
+       length -= sizeof(ppi_header_t);
+       caplen -= sizeof(ppi_header_t);
+       p += sizeof(ppi_header_t);
+
+       if ((printer = lookup_printer(dlt)) != NULL) {
+               printer(h, p);
+       } else if ((ndo_printer = lookup_ndo_printer(dlt)) != NULL) {
+               ndo_printer(ndo, h, p);
+       } else {
+               if (!ndo->ndo_eflag)
+                       ppi_header_print(ndo, (u_char *)hdr,
+                                       length + sizeof(ppi_header_t));
+
+               if (!ndo->ndo_suppress_default_print)
+                       ndo->ndo_default_print(ndo, p, caplen);
+       }
+}
+
+/*
+ * This is the top level routine of the printer.  'p' points
+ * to the ether header of the packet, 'h->ts' is the timestamp,
+ * 'h->len' is the length of the packet off the wire, and 'h->caplen'
+ * is the number of bytes actually captured.
+ */
+u_int
+ppi_if_print(struct netdissect_options *ndo,
+               const struct pcap_pkthdr *h, const u_char *p)
+{
+       ppi_print(ndo, h, p);
+
+       return (sizeof(ppi_header_t));
+}
+
+/*
+ * Local Variables:
+ * c-style: whitesmith
+ * c-basic-offset: 8
+ * End:
+ */
+
+#endif /* DLT_PPI */

diff --git a/tcpdump.c b/tcpdump.c
index 5300d92024c51abf237f5e40a6d30b10efec6eda..10b6239d5793d3c39c14f31c9aca007bce244a7e 100644 (file)
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -133,10 +133,6 @@ RETSIGTYPE requestinfo(int);
 static void info(int);
 static u_int packets_captured;
 
-typedef u_int (*if_printer)(const struct pcap_pkthdr *, const u_char *);
-typedef u_int (*if_ndo_printer)(struct netdissect_options *ndo,
-                                const struct pcap_pkthdr *, const u_char *);
-
 struct printer {
         if_printer f;
        int type;
@@ -314,11 +310,14 @@ static struct ndo_printer ndo_printers[] = {
 #endif
 #ifdef DLT_IEEE802_15_4_NOFCS
        { ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS },
+#endif
+#ifdef DLT_PPI
+       { ppi_if_print,         DLT_PPI },
 #endif
        { NULL,                 0 },
 };
 
-static if_printer
+if_printer
 lookup_printer(int type)
 {
        struct printer *p;
@@ -331,7 +330,7 @@ lookup_printer(int type)
        /* NOTREACHED */
 }
 
-static if_ndo_printer
+if_ndo_printer
 lookup_ndo_printer(int type)
 {
        struct ndo_printer *p;