_ether.c

This directory contains source code for tcpdump, a tool for network monitoring and data acquisition

/* 
 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996
 *      The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that: (1) source code distributions
 * retain the above copyright notice and this paragraph in its entirety, (2)
 * distributions including binary code include the above copyright notice and
 * this paragraph in its entirety in the documentation or other materials
 * provided with the distribution, and (3) all advertising materials mentioning
 * features or use of this software display the following acknowledgement:
 * ``This product includes software developed by the University of California,
 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
 * the University nor the names of its contributors may be used to endorse
 * or promote products derived from this software without specific prior
 * written permission.
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 */

#include <stdio.h>
#include <time.h>
#include <sys/param.h>
#include <sys/socket.h>

#include <net/if.h>
#include <netinet/in.h>
#include <netinet/if_ether.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>

#include "interfac.h"
#include "a2name.h"
#include "ethertyp.h"

static void ether_print (const u_char * bp, u_int length)
{
  const struct ether_header *ep;

  ep = (const struct ether_header *) bp;
  if (qflag)
       PRINTF ("%s %s %-4d: ",
               etheraddr_string(ESRC(ep)),
               etheraddr_string(EDST(ep)),
               length);
  else PRINTF ("%s %s %s %-4d: ",
               etheraddr_string(ESRC(ep)),
               etheraddr_string(EDST(ep)),
               etherproto_string (ep->ether_type),
               length);
}

/* 
 * This is the top level routine of the printer.  'p' is the points
 * to the ether header of the packet, 'tvp' is the timestamp,
 * 'length' is the length of the packet off the wire, and 'caplen'
 * is the number of bytes actually captured.
 */
void ether_if_print (u_char *user, const struct pcap_pkthdr *h, const u_char *p)
{
  struct  ether_header *ep;
  static  u_int32_t num_pkt = 0;
  u_int   caplen = h->caplen;
  u_int   length = h->len;
  u_short ether_type;

  ARGSUSED (user);

  /* Remember the timestamp (yucch), res 3-Nov-98
   */
  PacketTimestamp = &h->ts;

  ts_print (&h->ts);

#ifdef __linux__
  if (h->ifindex)
  {
    static char ifnames[16][16];
    if (h->ifindex>0 && h->ifindex <= 16)
    {
      if (ifnames[h->ifindex-1][0] == 0)
      {
        int tmp_fd;
        struct ifreq ifr;
        ifr.ifr_ifindex = h->ifindex;
        tmp_fd = socket(AF_INET, SOCK_DGRAM, 0);
        if (ioctl(tmp_fd, SIOCGIFNAME, (char*)&ifr) == 0)
             memcpy (ifnames[h->ifindex-1], ifr.ifr_name, 16);
        else sprintf (ifnames[h->ifindex-1], "if%2d ", h->ifindex);
        close (tmp_fd);
      }
      PRINTF ("%4s ", ifnames[h->ifindex-1]);
    }
    else
      PRINTF ("if%2d ", h->ifindex);
  }

  switch (h->pkt_type)
  {
    case PACKET_HOST:
         PUTS ("< ");
         break;
    case PACKET_BROADCAST:
         PUTS ("B ");
         break;
    case PACKET_MULTICAST:
         PUTS ("M ");
         break;
    case PACKET_OTHERHOST:
         PUTS ("P ");
         break;
    case PACKET_OUTGOING:
         PUTS ("> ");
         break;
    default:
         PUTS ("? ");
         break;
  }
#endif

  if (caplen < sizeof(struct ether_header))
  {
    PUTS ("[|ether]");
    goto out;
  }

  if (eflag)
     ether_print (p, length);

  /*
   * Some printers want to get back at the ethernet addresses,
   * and/or check that they're not walking off the end of the packet.
   * Rather than pass them all the way down, we set these globals.
   */
  packetp = p;
  snapend = p + caplen;

  length -= sizeof(struct ether_header);
  caplen -= sizeof(struct ether_header);

  ep = (struct ether_header *) p;
  p += sizeof(struct ether_header);

  ether_type = ntohs (ep->ether_type);

  /*
   * Is it (gag) an 802.3 encapsulation?
   */
  extracted_ethertype = 0;
  if (ether_type <= ETHERMTU)
  {
    /* Try to print the LLC-layer header & higher layers
     */
    if (llc_print (p, length, caplen, ESRC (ep), EDST (ep)) == 0)
    {
      /* ether_type not known, print raw packet */
      if (!eflag)
         ether_print ((u_char *) ep, length);

      if (extracted_ethertype)
         PRINTF ("(LLC %s) ", etherproto_string(htons(extracted_ethertype)));

      if (!xflag && !qflag)
         default_print (p, caplen);
    }
  }
  else if (ether_encap_print (p, ether_type, length, caplen) == 0)
  {
    /* ether_type not known, print raw packet
     */
    if (!eflag)
       ether_print ((u_char *) ep, length + sizeof(*ep));
    if (!xflag && !qflag)
       default_print (p, caplen);
  }
  if (xflag)
     default_print (p, caplen);

  if (aflag)
     ascii_print(p, caplen);

out:
  PUTS ("\n");
  status_write ("Eth: %lu (%lu)", ++num_pkt, pcap_mac_packets());
}


/*
 * Prints the packet encapsulated in an Ethernet data segment
 * (or an equivalent encapsulation), given the Ethernet type code.
 *
 * Returns non-zero if it can do so, zero if the ethertype is unknown.
 *
 * Stuffs the ether type into a global for the benefit of lower layers
 * that might want to know what it is.
 */
int ether_encap_print (const u_char *p, u_int ethertype, u_int length, u_int caplen)
{
recurse:
  extracted_ethertype = ethertype;

  switch (ethertype)
  {
    case ETHERTYPE_IP:
         ip_print (p, length);
         return (1);

#ifdef USE_INET6
    case ETHERTYPE_IPV6:
         ip6_print (p, length);
         return (1);
#endif

    case ETHERTYPE_ARP:
    case ETHERTYPE_REVARP:
         arp_print (p, length, caplen);
         return (1);

    case ETHERTYPE_DN:
         decnet_print (p, length, caplen);
         return (1);

    case ETHERTYPE_ATALK:
         if (vflag)
           PUTS ("et1 ");
         atalk_print (p, length);
         return (1);

    case ETHERTYPE_AARP:
         aarp_print (p, length);
         return (1);

    case ETHERTYPE_8021Q:
         PRINTF ("802.1Q vlan#%d P%d%s",
                 ntohs (*(unsigned short*)p) & 0xFFF,
                 ntohs (*(unsigned short*)p) >> 13,
                 (ntohs (*(unsigned short*)p) & 0x1000) ? " CFI" : "");
         ethertype = ntohs (*(unsigned short*)(p + 2));
         p += 4;
         length -= 4;
         caplen -= 4;
         if (ethertype > ETHERMTU)
            goto recurse;

         extracted_ethertype = 0;

         if (llc_print (p, length, caplen, p-18, p-12) == 0)
         {
           /* ether_type not known, print raw packet
            */
           if (!eflag)
              ether_print (p - 18, length + 4);

           if (extracted_ethertype)
              PRINTF ("(LLC %s) ",
                      etherproto_string (htons (extracted_ethertype)));

           if (!xflag && !qflag)
             default_print (p - 18, caplen + 4);
         }
         return (1);

    case ETHERTYPE_PPPOED:
    case ETHERTYPE_PPPOES:
         pppoe_print (p, length, caplen);
         return (1);

    case ETHERTYPE_IPX:
         ipx_print (p, length);
         return (1);

    case ETHERTYPE_LAT:
    case ETHERTYPE_SCA:
    case ETHERTYPE_MOPRC:
    case ETHERTYPE_MOPDL:
         /* default_print for now */

    default:
         return (0);
  }
}