Fix the printing of RFC 948-style IP packets.

They have a 3-octet LLC UI frame followed *immediately* by an IP packet;
the payload is 3 bytes, not 4 bytes, past the LLC header.

diff --git a/print-llc.c b/print-llc.c
index 5681b49569b9e66ad21dc24f153bc9d4ef485052..65c08c08ccd41573c71408c9d84c7118e6728b1e 100644 (file)
--- a/print-llc.c
+++ b/print-llc.c
@@ -255,12 +255,13 @@ llc_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen,
 
        if (ssap == LLCSAP_IP && dsap == LLCSAP_IP &&
            control == LLC_UI) {
-               if (caplen < 4 || length < 4) {
-                       ND_PRINT((ndo, "[|llc]"));
-                       ND_DEFAULTPRINT((u_char *)p, caplen);
-                       return (1);
-               }
-               ip_print(ndo, p+4, length-4);
+               /*
+                * This is an RFC 948-style IP packet, with
+                * an 802.3 header and an 802.2 LLC header
+                * with the source and destination SAPs being
+                * the IP SAP.
+                */
+               ip_print(ndo, p+3, length-3);
                return (1);
        }