Don't do the DDP-over-UDP heuristic check up front.

There's probably less DDP-over-UDP traffic passing through tcpdump these
days than, for example, SNMP v2 traffic from a low source port longer
than 512 bytes, so move the latter heuristic check after all the other
checks.

Fixes GitHub tcpdump issue #499.

diff --git a/print-udp.c b/print-udp.c
index 37679eb169454e7b814a19dd47e55e9ee55a874e..6bf51c63a7c12bb565ae6363b103a843bcf4c08f 100644 (file)
--- a/print-udp.c
+++ b/print-udp.c
@@ -495,14 +495,6 @@ udp_print(netdissect_options *ndo, register const u_char *bp, u_int length,
                        }
 #endif
                }
-               if (ND_TTEST(((const struct LAP *)cp)->type) &&
-                   ((const struct LAP *)cp)->type == lapDDP &&
-                   (atalk_port(sport) || atalk_port(dport))) {
-                       if (ndo->ndo_vflag)
-                               ND_PRINT((ndo, "kip "));
-                       llap_print(ndo, cp, length);
-                       return;
-               }
        }
 
        if (ndo->ndo_vflag && !ndo->ndo_Kflag && !fragmented) {
@@ -654,7 +646,13 @@ udp_print(netdissect_options *ndo, register const u_char *bp, u_int length,
                        geneve_print(ndo, (const u_char *)(up + 1), length);
                else if (IS_SRC_OR_DST_PORT(LISP_CONTROL_PORT))
                        lisp_print(ndo, (const u_char *)(up + 1), length);
-               else {
+               else if (ND_TTEST(((const struct LAP *)cp)->type) &&
+                   ((const struct LAP *)cp)->type == lapDDP &&
+                   (atalk_port(sport) || atalk_port(dport))) {
+                       if (ndo->ndo_vflag)
+                               ND_PRINT((ndo, "kip "));
+                       llap_print(ndo, cp, length);
+               } else {
                        if (ulen > length)
                                ND_PRINT((ndo, "UDP, bad length %u > %u",
                                    ulen, length));