From: Romain Francoise Date: Sat, 23 Feb 2013 17:48:52 +0000 (+0100) Subject: Add MS NLB heartbeat ethertype, as well as a basic printer X-Git-Tag: tcpdump-4.4.0^2~3^2~1 X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/66c1d1031b993aa947e8ff978c7f05ce923a11cf Add MS NLB heartbeat ethertype, as well as a basic printer The protocol is undocumented but Wireshark extracts some useful bits of info from the packet, so it was used as a reference. --- diff --git a/Makefile.in b/Makefile.in index 06ff410d..b52d662b 100644 --- a/Makefile.in +++ b/Makefile.in @@ -84,7 +84,7 @@ CSRC = addrtoname.c af.c checksum.c cpack.c gmpls.c oui.c gmt2local.c ipproto.c print-l2tp.c print-lane.c print-ldp.c print-lldp.c print-llc.c \ print-lmp.c print-lspping.c print-lwapp.c \ print-lwres.c print-mobile.c print-mpcp.c print-mpls.c print-msdp.c \ - print-nfs.c print-ntp.c print-null.c print-olsr.c print-ospf.c \ + print-msnlb.c print-nfs.c print-ntp.c print-null.c print-olsr.c print-ospf.c \ print-pgm.c print-pim.c \ print-ppi.c print-ppp.c print-pppoe.c print-pptp.c \ print-radius.c print-raw.c print-rip.c print-rpki-rtr.c print-rrcp.c print-rsvp.c \ diff --git a/ethertype.h b/ethertype.h index 8c063396..385da5d7 100644 --- a/ethertype.h +++ b/ethertype.h @@ -153,6 +153,9 @@ #ifndef ETHERTYPE_PPPOES2 #define ETHERTYPE_PPPOES2 0x3c13 #endif +#ifndef ETHERTYPE_MS_NLB_HB +#define ETHERTYPE_MS_NLB_HB 0x886f /* MS Network Load Balancing Heartbeat */ +#endif #ifndef ETHERTYPE_JUMBO #define ETHERTYPE_JUMBO 0x8870 #endif diff --git a/netdissect.h b/netdissect.h index f187fd5d..cc24d36c 100644 --- a/netdissect.h +++ b/netdissect.h @@ -286,6 +286,7 @@ extern int esp_print(netdissect_options *, int *nhdr, int *padlen); extern void arp_print(netdissect_options *,const u_char *, u_int, u_int); extern void tipc_print(netdissect_options *, const u_char *, u_int, u_int); +extern void msnlb_print(netdissect_options *, const u_char *, u_int); extern void icmp6_print(netdissect_options *ndo, const u_char *, u_int, const u_char *, int); extern void isakmp_print(netdissect_options *,const u_char *, diff --git a/print-ether.c b/print-ether.c index e2f487c2..f783341d 100644 --- a/print-ether.c +++ b/print-ether.c @@ -76,6 +76,7 @@ const struct tok ethertype_values[] = { { ETHERTYPE_PPPOES, "PPPoE S" }, { ETHERTYPE_EAPOL, "EAPOL" }, { ETHERTYPE_RRCP, "RRCP" }, + { ETHERTYPE_MS_NLB_HB, "MS NLB heartbeat" }, { ETHERTYPE_JUMBO, "Jumbo" }, { ETHERTYPE_LOOPBACK, "Loopback" }, { ETHERTYPE_ISO, "OSI" }, @@ -412,6 +413,10 @@ ethertype_print(netdissect_options *ndo, tipc_print(ndo, p, length, caplen); return (1); + case ETHERTYPE_MS_NLB_HB: + msnlb_print(ndo, p, length); + return (1); + case ETHERTYPE_LAT: case ETHERTYPE_SCA: case ETHERTYPE_MOPRC: diff --git a/print-msnlb.c b/print-msnlb.c new file mode 100644 index 00000000..4c5fb0cb --- /dev/null +++ b/print-msnlb.c @@ -0,0 +1,66 @@ +/* + * Copyright (c) 2013 Romain Francoise + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include + +#include +#include + +#include "netdissect.h" +#include "addrtoname.h" +#include "extract.h" + +struct msnlb_heartbeat_pkt { + u_int32_t unknown1; + u_int32_t unknown2; + u_int32_t host_prio; /* little-endian */ + u_int32_t virtual_ip; + u_int32_t host_ip; + /* the protocol is undocumented so we ignore the rest */ +}; + +void +msnlb_print(netdissect_options *ndo, const u_char *bp, u_int length) +{ + const struct msnlb_heartbeat_pkt *hb; + + hb = (struct msnlb_heartbeat_pkt *)bp; + ND_TCHECK(*hb); + + ND_PRINT((ndo, "MS NLB heartbeat, host priority: %u,", + EXTRACT_LE_32BITS(&(hb->host_prio)))); + ND_PRINT((ndo, " cluster IP: %s,", ipaddr_string(&(hb->virtual_ip)))); + ND_PRINT((ndo, " host IP: %s", ipaddr_string(&(hb->host_ip)))); + return; +trunc: + ND_PRINT((ndo, "[|MS NLB]")); +}