Document the "netbeui" filter expression keyword.

Add a #define LLCSAP_NETBEUI for the NetBEUI LLC SAP, and use that
rather than "0xf0" in the LLC dissector.

diff --git a/llc.h b/llc.h
index de185c8e9e2d5d7e6658e68870a4406f34448838..b812bf1c3feb097146ceb815b9e71c8c3ab55ba1 100644 (file)
--- a/llc.h
+++ b/llc.h
@@ -18,7 +18,7 @@
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *

- * @(#) $Header: /tcpdump/master/tcpdump/llc.h,v 1.9 2001-01-15 00:33:59 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/tcpdump/llc.h,v 1.10 2001-01-28 09:46:42 guy Exp $ (LBL)

  */
 
 /*
  */
 
 /*


@@ -115,9 +115,12 @@ struct llc {
 #ifndef LLCSAP_SNAP
 #define        LLCSAP_SNAP             0xaa
 #endif
 #ifndef LLCSAP_SNAP
 #define        LLCSAP_SNAP             0xaa
 #endif

-#ifndef LLCSAP_ISONS
-#define        LLCSAP_ISONS            0xfe
-#endif

 #ifndef LLCSAP_IPX
 #define LLCSAP_IPX             0xe0
 #endif
 #ifndef LLCSAP_IPX
 #define LLCSAP_IPX             0xe0
 #endif

+#ifndef LLCSAP_NETBEUI
+#define LLCSAP_NETBEUI         0xf0
+#endif
+#ifndef LLCSAP_ISONS
+#define        LLCSAP_ISONS            0xfe
+#endif

diff --git a/print-llc.c b/print-llc.c
index 4557c4f09c4f80b1554496c6e874fc610a441b0c..100ed8837614b3e59b82a1434866e6fb5dc88a34 100644 (file)
--- a/print-llc.c
+++ b/print-llc.c
@@ -24,7 +24,7 @@
 
 #ifndef lint
 static const char rcsid[] =
 
 #ifndef lint
 static const char rcsid[] =

-    "@(#) $Header: /tcpdump/master/tcpdump/print-llc.c,v 1.35 2001-01-15 03:59:13 guy Exp $";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-llc.c,v 1.36 2001-01-28 09:46:43 guy Exp $";

 #endif
 
 #ifdef HAVE_CONFIG_H
 #endif
 
 #ifdef HAVE_CONFIG_H


@@ -123,7 +123,7 @@ llc_print(const u_char *p, u_int length, u_int caplen,
                return (1);
        }
 
                return (1);
        }
 

-       if (llc.ssap == 0xf0 && llc.dsap == 0xf0
+       if (llc.ssap == LLCSAP_NETBEUI && llc.dsap == LLCSAP_NETBEUI

            && (!(llc.llcu & LLC_S_FMT) || llc.llcu == LLC_U_FMT)) {
                /*
                 * we don't actually have a full netbeui parser yet, but the
            && (!(llc.llcu & LLC_S_FMT) || llc.llcu == LLC_U_FMT)) {
                /*
                 * we don't actually have a full netbeui parser yet, but the

diff --git a/tcpdump.1 b/tcpdump.1
index f51c9fbffd1e97bc483ee90cacdfd9725fdcd21b..ba3af30bea5e9b5d2b9754123f8641df9c2cc084 100644 (file)
--- a/tcpdump.1
+++ b/tcpdump.1
@@ -1,4 +1,4 @@
-.\" @(#) $Header: /tcpdump/master/tcpdump/Attic/tcpdump.1,v 1.98 2001-01-18 04:37:23 guy Exp $ (LBL)
+.\" @(#) $Header: /tcpdump/master/tcpdump/Attic/tcpdump.1,v 1.99 2001-01-28 09:46:43 guy Exp $ (LBL)

 .\"
 .\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
 .\"    The Regents of the University of California.  All rights reserved.
 .\"
 .\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
 .\"    The Regents of the University of California.  All rights reserved.


@@ -530,7 +530,7 @@ True if the packet is of ether type \fIprotocol\fR.
 \fIProtocol\fP can be a number or one of the names
 \fIip\fP, \fIip6\fP, \fIarp\fP, \fIrarp\fP, \fIatalk\fP, \fIaarp\fP,
 \fIdecnet\fP, \fIsca\fP, \fIlat\fP, \fImopdl\fP, \fImoprc\fP,
 \fIProtocol\fP can be a number or one of the names
 \fIip\fP, \fIip6\fP, \fIarp\fP, \fIrarp\fP, \fIatalk\fP, \fIaarp\fP,
 \fIdecnet\fP, \fIsca\fP, \fIlat\fP, \fImopdl\fP, \fImoprc\fP,

-\fIiso\fP, \fIstp\fP, or \fIipx\fP.
+\fIiso\fP, \fIstp\fP, \fIipx\fP, or \fInetbeui\fP.

 Note these identifiers are also keywords
 and must be escaped via backslash (\\).
 .IP
 Note these identifiers are also keywords
 and must be escaped via backslash (\\).
 .IP


@@ -540,7 +540,7 @@ protocol identification comes from the 802.2 Logical Link Control (LLC)
 header, which is usually layered on top of the FDDI or Token Ring
 header.
 .IP
 header, which is usually layered on top of the FDDI or Token Ring
 header.
 .IP

-When filtering for those protocol identifiers on FDDI or Token Ring,
+When filtering for most protocol identifiers on FDDI or Token Ring,

 \fBtcpdump\fR checks only the protocol ID field of an LLC header in
 so-called SNAP format with an Organizational Unit Identifier (OUI) of
 0x000000, for encapsulated Ethernet; it doesn't check whether the packet
 \fBtcpdump\fR checks only the protocol ID field of an LLC header in
 so-called SNAP format with an Organizational Unit Identifier (OUI) of
 0x000000, for encapsulated Ethernet; it doesn't check whether the packet


@@ -548,21 +548,21 @@ is in SNAP format with an OUI of 0x000000.
 .IP
 The exceptions are \fIiso\fP, for which it checks the DSAP (Destination
 Service Access Point) and SSAP (Source Service Access Point) fields of
 .IP
 The exceptions are \fIiso\fP, for which it checks the DSAP (Destination
 Service Access Point) and SSAP (Source Service Access Point) fields of

-the LLC header, \fIstp\fP, where it checks the DSAP of the LLC
-header, and \fIatalk\fP, where it checks for a SNAP-format packet with
-an OUI of 0x080007 and the Appletalk etype.
+the LLC header, \fIstp\fP and \fInetbeui\fP, where it checks the DSAP of
+the LLC header, and \fIatalk\fP, where it checks for a SNAP-format
+packet with an OUI of 0x080007 and the Appletalk etype.

 .IP
 In the case of Ethernet, \fBtcpdump\fR checks the Ethernet type field
 .IP
 In the case of Ethernet, \fBtcpdump\fR checks the Ethernet type field

-for most of those protocols; the exceptions are \fIiso\fP and \fIsap\fP,
-for which it checks for an 802.3 frame and then checks the LLC header as
-it does for FDDI and Token Ring, \fIatalk\fP, where it checks both for
-the Appletalk etype in an Ethernet frame and for a SNAP-format packet as
-it does for FDDI and Token Ring, \fIaarp\fP, where it checks for the
-Appletalk ARP etype in either an Ethernet frame or an 802.2 SNAP frame
-with an OUI of 0x000000, and \fIipx\fP, where it checks for the IPX
-etype in an Ethernet frame, the IPX DSAP in the LLC header, the
-802.3 with no LLC header encapsulation of IPX, and the IPX etype in
-a SNAP frame.]
+for most of those protocols; the exceptions are \fIiso\fP, \fIsap\fP,
+and \fInetbeui\fP, for which it checks for an 802.3 frame and then
+checks the LLC header as it does for FDDI and Token Ring, \fIatalk\fP,
+where it checks both for the Appletalk etype in an Ethernet frame and
+for a SNAP-format packet as it does for FDDI and Token Ring, \fIaarp\fP,
+where it checks for the Appletalk ARP etype in either an Ethernet frame
+or an 802.2 SNAP frame with an OUI of 0x000000, and \fIipx\fP, where it
+checks for the IPX etype in an Ethernet frame, the IPX DSAP in the LLC
+header, the 802.3 with no LLC header encapsulation of IPX, and the IPX
+etype in a SNAP frame.]

 .IP "\fBdecnet src \fIhost\fR"
 True if the DECNET source address is
 .IR host ,
 .IP "\fBdecnet src \fIhost\fR"
 True if the DECNET source address is
 .IR host ,


@@ -575,7 +575,7 @@ True if the DECNET destination address is
 .IP "\fBdecnet host \fIhost\fR"
 True if either the DECNET source or destination address is
 .IR host .
 .IP "\fBdecnet host \fIhost\fR"
 True if either the DECNET source or destination address is
 .IR host .

-.IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBatalk\fR, \fBaarp\fR, \fBdecnet\fR, \fBiso\fR, \fBstp\fR, \fBipx\fR"
+.IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBatalk\fR, \fBaarp\fR, \fBdecnet\fR, \fBiso\fR, \fBstp\fR, \fBipx\fR, \fInetbeui\fP"

 Abbreviations for:
 .in +.5i
 .nf
 Abbreviations for:
 .in +.5i
 .nf