_udp.c

This directory contains source code for tcpdump, a tool for network monitoring and data acquisition

  phu.ph.ph_nxt = IPPROTO_UDP;

  sum = 0;
  for (i = 0; i < sizeof(phu.pa) / sizeof(phu.pa[0]); i++)
    sum += phu.pa[i];

  sp = (const u_int16_t *) up;

  for (i = 0; i < (tlen & ~1); i += 2)
    sum += *sp++;

  if (tlen & 1)
    sum += htons ((*(const u_int8_t *) sp) << 8);

  while (sum > 0xffff)
    sum = (sum & 0xffff) + (sum >> 16);
  sum = ~sum & 0xffff;

  return (sum);
}
#endif


/* XXX probably should use getservbyname() and cache answers
 */
#define TFTP_PORT                    69
#define KERBEROS_PORT                88
#define AXIPUDP_PORT                 93
#define SUNRPC_PORT                 111
#define NTP_PORT                    123
#define NETBIOS_NS_PORT             137
#define NETBIOS_DGRAM_PORT          138
#define SNMP_PORT                   161
#define SNMPTRAP_PORT               162
#define CISCO_AUTORP_PORT           496
#define ISAKMP_PORT                 500
#define RIP_PORT                    520
#define RIPNG_PORT                  521
#define TIMED_PORT                  525
#define DHCP6_SERV_PORT             546
#define DHCP6_CLI_PORT              547
#define KERBEROS_SEC_PORT           750
#define RADIUS_PORT                1645
#define RADIUS_NEW_PORT            1812
#define RADIUS_ACCOUNTING_PORT     1646
#define L2TP_PORT                  1701
#define RADIUS_NEW_ACCOUNTING_PORT 1813
#define RX_PORT_LOW                7000
#define RX_PORT_HIGH               7009
#define ISAKMP_PORT_USER1          7500
#define ISAKMP_PORT_USER2          8500


/* IANA UDP port numbers for active network research
 */
#define ANEP_PORT (3322 || 3323 || 3324 || 3325)


void udp_print (const u_char *bp, u_int length, const u_char *bp2, int fragmented)
{
  const struct udphdr *up;
  const struct ip     *ip;
  const u_char        *cp;
  const u_char        *ep = bp + length;
  u_short sport, dport, ulen;

#ifdef USE_INET6
  const struct ip6_hdr *ip6;
#endif

  if (ep > snapend)
      ep = snapend;
  up = (struct udphdr*)bp;
  ip = (struct ip*)bp2;
  cp = (u_char*)(up+1);

#ifdef USE_INET6
  if (IP_V (ip) == 6)
       ip6 = (struct ip6_hdr*)bp2;
  else ip6 = NULL;
#endif

  if (cp > snapend)
  {
    PRINTF ("%s > %s: [|udp]",
            ipaddr_string (&ip->ip_src),
            ipaddr_string (&ip->ip_dst));
    return;
  }
  if (length < sizeof(struct udphdr))
  {
    PRINTF ("%s > %s: truncated-udp %d",
            ipaddr_string (&ip->ip_src),
            ipaddr_string (&ip->ip_dst), length);
    return;
  }

  length -= sizeof(struct udphdr);

  sport = ntohs (up->uh_sport);
  dport = ntohs (up->uh_dport);
  ulen  = ntohs (up->uh_ulen);
  if (ulen < 8)
  {
    PRINTF ("%s > %s: truncated-udplength %d",
            ipaddr_string (&ip->ip_src),
            ipaddr_string (&ip->ip_dst), ulen);
    return;
  }
  if (packettype)
  {
    struct rpc_msg *rp;
    enum msg_type direction;

    switch (packettype)
    {
      case PT_VAT:
           PRINTF ("%s.%s > %s.%s:",
                   ipaddr_string (&ip->ip_src), udpport_string (sport),
                   ipaddr_string (&ip->ip_dst), udpport_string (dport));
           vat_print ((void*)(up+1), length, up);
           break;

      case PT_WB:
           PRINTF ("%s.%s > %s.%s:",
                   ipaddr_string (&ip->ip_src), udpport_string (sport),
                   ipaddr_string (&ip->ip_dst), udpport_string (dport));
           wb_print ((void*)(up+1), length);
           break;

      case PT_RPC:
           rp = (struct rpc_msg*)(up+1);
           direction = ntohl (rp->rm_direction);
           if (direction == CALL)
                sunrpcrequest_print ((u_char*)rp, length, (u_char*)ip);
           else nfsreply_print ((u_char*)rp, length, (u_char*)ip);
           break;

      case PT_RTP:
           PRINTF ("%s.%s > %s.%s:",
                   ipaddr_string (&ip->ip_src), udpport_string (sport),
                   ipaddr_string (&ip->ip_dst), udpport_string (dport));
           rtp_print ((void*)(up+1), length, up);
           break;

      case PT_RTCP:
           PRINTF ("%s.%s > %s.%s:",
                   ipaddr_string (&ip->ip_src), udpport_string (sport),
                   ipaddr_string (&ip->ip_dst), udpport_string (dport));
           while (cp < ep)
                  cp = rtcp_print (cp, (u_char*)ep);
           break;

      case PT_SNMP:
           PRINTF ("%s.%s > %s.%s:",
                   ipaddr_string(&ip->ip_src),
                   udpport_string(sport),
                   ipaddr_string(&ip->ip_dst),
                   udpport_string(dport));
           snmp_print ((const u_char *)(up+1), length);
           break;

      case PT_CNFP:
           PRINTF ("%s.%s > %s.%s:",
                   ipaddr_string(&ip->ip_src),
                   udpport_string(sport),
                   ipaddr_string(&ip->ip_dst),
                   udpport_string(dport));
           cnfp_print (cp, length, (const u_char*)ip);
           break;

      case PT_SRM2:
           PRINTF ("%s.%s > %s.%s:",
                   ipaddr_string (&ip->ip_src), udpport_string (sport),
                   ipaddr_string (&ip->ip_dst), udpport_string (dport));
           srm2_print ((const u_char*)(up+1), length);
           break;

      case PT_WC:
           PRINTF ("%s.%s > %s.%s:",
                   ipaddr_string (&ip->ip_src), udpport_string (sport),
                   ipaddr_string (&ip->ip_dst), udpport_string (dport));
           wc_print ((const u_char*)(up+1), length, up);
           break;

      case PT_ANEP:
           PRINTF ("%s.%s > %s.%s:",
                   ipaddr_string (&ip->ip_src), udpport_string (sport),
                   ipaddr_string (&ip->ip_dst), udpport_string (dport));
           anep_print ((const u_char*)(up+1), length);
           break;
    }
    return;
  }

  if (!qflag)
  {
    struct rpc_msg *rp;
    enum   msg_type direction;

    rp = (struct rpc_msg*)(up+1);
    if (TTEST (rp->rm_direction))
    {
      direction = (enum msg_type) ntohl (rp->rm_direction);
      if (dport == NFS_PORT && direction == CALL)
      {
        nfsreq_print ((u_char*)rp, length, (u_char*)ip);
        return;
      }
      if (sport == NFS_PORT && direction == REPLY)
      {
        nfsreply_print ((u_char*)rp, length, (u_char*)ip);
        return;
      }
#ifdef notdef
      if (dport == SUNRPC_PORT && direction == CALL)
      {
        sunrpcrequest_print ((u_char*)rp, length, (u_char*)ip);
        return;
      }
#endif
    }
    if (TTEST (((struct LAP*)cp)->type) &&
        ((struct LAP*)cp)->type == lapDDP &&
        (atalk_port (sport) || atalk_port (dport)))
    {
      if (vflag)
         PUTS ("kip ");
      llap_print (cp, length);
      return;
    }
  }

#ifdef USE_INET6
  if (ip6)
  {
    if (ip6->ip6_nxt == IPPROTO_UDP)
         PRINTF ("%s.%s > %s.%s: ",
                 ip6addr_string (&ip6->ip6_src), udpport_string (sport),
                 ip6addr_string (&ip6->ip6_dst), udpport_string (dport));
    else PRINTF ("%s > %s: ", udpport_string (sport), udpport_string (dport));
  }
  else
#endif
  {
    if (ip->ip_p == IPPROTO_UDP)
         PRINTF ("%s.%s > %s.%s: ",
                 ipaddr_string (&ip->ip_src), udpport_string (sport),
                 ipaddr_string (&ip->ip_dst), udpport_string (dport));

    else PRINTF ("%s > %s: ", udpport_string (sport), udpport_string (dport));

  }

  if (IP_V (ip) == 4 && vflag && !fragmented)
  {
    int sum = up->uh_sum;

    if (sum == 0)
       PUTS (" [no cksum]");

    else if (TTEST2 (cp[0], length))
    {
      sum = udp_cksum (ip, up, length);
      if (sum != 0)
           PRINTF (" [bad udp cksum %x!]", sum);
      else PUTS (" [udp sum ok]");
    }
  }
#ifdef USE_INET6
  if (IP_V (ip) == 6 && ip6->ip6_plen && vflag && !fragmented)
  {
    int sum = up->uh_sum;

    /* for IPv6, UDP checksum is mandatory */
    if (TTEST2 (cp[0], length))
    {
      sum = udp6_cksum (ip6, up, length);
      if (sum != 0)
           PRINTF (" [bad udp cksum %x!]", sum);
      else PUTS (" [udp sum ok]");
    }
  }
#endif

  if (!qflag)
  {
#define ISPORT(p) (dport == (p) || sport == (p))

    if (ISPORT (NAMESERVER_PORT))
         ns_print ((const u_char*) (up+1), length);

    else if (ISPORT (TIMED_PORT))
         timed_print ((const u_char*) (up+1), length);

    else if (ISPORT (TFTP_PORT))
         tftp_print ((const u_char*) (up+1), length);

    else if (ISPORT (IPPORT_BOOTPC) || ISPORT (IPPORT_BOOTPS))
         bootp_print ((const u_char*) (up+1), length, sport, dport);

    else if (ISPORT (RIP_PORT))
         rip_print ((const u_char*) (up+1), length);

    else if (ISPORT (ISAKMP_PORT))
         isakmp_print ((const u_char*)(up+1), length, bp2);

    else if (ISPORT (ISAKMP_PORT_USER1) || ISPORT (ISAKMP_PORT_USER2))
         isakmp_print ((const u_char*)(up+1), length, bp2);

    else if (ISPORT (SNMP_PORT) || ISPORT (SNMPTRAP_PORT))
         snmp_print ((const u_char*) (up+1), length);

    else if (ISPORT (NTP_PORT))
         ntp_print ((const u_char*) (up+1), length);

    else if (ISPORT (KERBEROS_PORT) || ISPORT (KERBEROS_SEC_PORT))
         krb_print ((const void*) (up+1), length);

    else if (ISPORT (L2TP_PORT))
         l2tp_print ((const u_char*)(up+1), length);

#ifdef PRINT_NETBIOS_DETAILS
    else if (ISPORT (NETBIOS_NS_PORT))
         nbt_udp137_print ((const u_char *) (up+1), length);

    else if (ISPORT (NETBIOS_DGRAM_PORT))
         nbt_udp138_print ((const u_char *) (up+1), length);
#endif

    else if (dport == 3456)
         vat_print ((const void *) (up + 1), length, up);

    else if (dport == 1698 || dport == 1699)
    {
      PUTS (" RSVP ");
#ifdef USE_RSVP
      ntoh_rsvp_packet ((const u_char*)(up+1), length);
      rsvp_print_pkt ((const u_char*)(up+1), length);
#endif
    }
    else if (dport == 3456)
         vat_print ((const void*)(up+1), length, up);

    else if (ISPORT(AXIPUDP_PORT))
         axipudp_print((const void *)(up+1), length);

    /* Since there are 10 possible ports to check, I think
     * a <> test would be more efficient
     */
    else if ((sport >= RX_PORT_LOW && sport <= RX_PORT_HIGH) ||
             (dport >= RX_PORT_LOW && dport <= RX_PORT_HIGH))
         rx_print ((void*)(up+1), length, sport, dport, (u_char*)ip);

#ifdef USE_INET6
    else if (ISPORT (RIPNG_PORT))
         ripng_print ((const u_char*)(up+1), length);

    else if (ISPORT (DHCP6_SERV_PORT) || ISPORT (DHCP6_CLI_PORT))
         dhcp6_print ((const u_char*)(up+1), length, sport, dport);

#endif

    /*
     * Kludge in test for whiteboard packets.
     */
    else if (dport == 4567)
         wb_print ((const void*)(up+1), length);

    else if (ISPORT(ANEP_PORT))
         anep_print ((const void*)(up+1), length);

    else if (ISPORT (CISCO_AUTORP_PORT))
         cisco_autorp_print ((const void*)(up+1), length);

    else if (ISPORT (RADIUS_PORT) || ISPORT (RADIUS_NEW_PORT) ||
             ISPORT (RADIUS_ACCOUNTING_PORT) || ISPORT (RADIUS_NEW_ACCOUNTING_PORT))
         radius_print ((const u_char *) (up+1), length);

    else PRINTF (" udp %lu", (u_int32_t)(ulen - sizeof(*up)));
  }
  else
    PRINTF (" udp %lu", (u_int32_t)(ulen - sizeof(*up)));
}