From: Guy Harris <guy@alum.mit.edu>
Date: Tue, 12 Jan 2016 00:14:56 +0000 (-0800)
Subject: Don't do the DDP-over-UDP heuristic check up front.
X-Git-Tag: tcpdump-4.8.0~44
X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/5e811a837e4f3d99ef2ce5264e387c4e6395d5a0

Don't do the DDP-over-UDP heuristic check up front.

There's probably less DDP-over-UDP traffic passing through tcpdump these
days than, for example, SNMP v2 traffic from a low source port longer
than 512 bytes, so move the latter heuristic check after all the other
checks.

Fixes GitHub tcpdump issue #499.
---

diff --git a/print-udp.c b/print-udp.c
index 37679eb1..6bf51c63 100644
--- a/print-udp.c
+++ b/print-udp.c
@@ -495,14 +495,6 @@ udp_print(netdissect_options *ndo, register const u_char *bp, u_int length,
 			}
 #endif
 		}
-		if (ND_TTEST(((const struct LAP *)cp)->type) &&
-		    ((const struct LAP *)cp)->type == lapDDP &&
-		    (atalk_port(sport) || atalk_port(dport))) {
-			if (ndo->ndo_vflag)
-				ND_PRINT((ndo, "kip "));
-			llap_print(ndo, cp, length);
-			return;
-		}
 	}
 
 	if (ndo->ndo_vflag && !ndo->ndo_Kflag && !fragmented) {
@@ -654,7 +646,13 @@ udp_print(netdissect_options *ndo, register const u_char *bp, u_int length,
 			geneve_print(ndo, (const u_char *)(up + 1), length);
 		else if (IS_SRC_OR_DST_PORT(LISP_CONTROL_PORT))
 			lisp_print(ndo, (const u_char *)(up + 1), length);
-		else {
+		else if (ND_TTEST(((const struct LAP *)cp)->type) &&
+		    ((const struct LAP *)cp)->type == lapDDP &&
+		    (atalk_port(sport) || atalk_port(dport))) {
+			if (ndo->ndo_vflag)
+				ND_PRINT((ndo, "kip "));
+			llap_print(ndo, cp, length);
+		} else {
 			if (ulen > length)
 				ND_PRINT((ndo, "UDP, bad length %u > %u",
 				    ulen, length));