2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
25 static const char rcsid[] =
26 "@(#) $Header: /tcpdump/master/tcpdump/print-udp.c,v 1.101 2001/10/08 21:25:24 fenner Exp $ (LBL)";
33 #include <sys/param.h>
36 #include <netinet/in.h>
41 #include <arpa/tftp.h>
48 #include "interface.h"
49 #include "addrtoname.h"
50 #include "appletalk.h"
64 u_int16_t rh_flags; /* T:2 P:1 CNT:5 PT:8 */
65 u_int16_t rh_len; /* length of message (in words) */
66 u_int32_t rh_ssrc; /* synchronization src id */
70 u_int32_t upper; /* more significant 32 bits */
71 u_int32_t lower; /* less significant 32 bits */
78 ntp64 sr_ntp; /* 64-bit ntp timestamp */
79 u_int32_t sr_ts; /* reference media timestamp */
80 u_int32_t sr_np; /* no. packets sent */
81 u_int32_t sr_nb; /* no. bytes sent */
86 * Time stamps are middle 32-bits of ntp timestamp.
89 u_int32_t rr_srcid; /* sender being reported */
90 u_int32_t rr_nl; /* no. packets lost */
91 u_int32_t rr_ls; /* extended last seq number received */
92 u_int32_t rr_dv; /* jitter (delay variance) */
93 u_int32_t rr_lsr; /* orig. ts from last rr from this src */
94 u_int32_t rr_dlsr; /* time from recpt of last rr to xmit time */
98 #define RTCP_PT_SR 200
99 #define RTCP_PT_RR 201
100 #define RTCP_PT_SDES 202
101 #define RTCP_SDES_CNAME 1
102 #define RTCP_SDES_NAME 2
103 #define RTCP_SDES_EMAIL 3
104 #define RTCP_SDES_PHONE 4
105 #define RTCP_SDES_LOC 5
106 #define RTCP_SDES_TOOL 6
107 #define RTCP_SDES_NOTE 7
108 #define RTCP_SDES_PRIV 8
109 #define RTCP_PT_BYE 203
110 #define RTCP_PT_APP 204
113 vat_print(const void *hdr, u_int len, register const struct udphdr *up)
116 u_int ts = *(u_int16_t *)hdr;
117 if ((ts & 0xf060) != 0) {
119 (void)printf("udp/vt %u %d / %d",
120 (u_int32_t)(ntohs(up->uh_ulen) - sizeof(*up)),
121 ts & 0x3ff, ts >> 10);
124 u_int32_t i0 = (u_int32_t)ntohl(((u_int *)hdr)[0]);
125 u_int32_t i1 = (u_int32_t)ntohl(((u_int *)hdr)[1]);
126 printf("udp/vat %u c%d %u%s",
127 (u_int32_t)(ntohs(up->uh_ulen) - sizeof(*up) - 8),
129 i1, i0 & 0x800000? "*" : "");
132 printf(" f%d", (i0 >> 16) & 0x1f);
134 printf(" s%d", (i0 >> 24) & 0x3f);
139 rtp_print(const void *hdr, u_int len, register const struct udphdr *up)
142 u_int *ip = (u_int *)hdr;
143 u_int hasopt, hasext, contype, hasmarker;
144 u_int32_t i0 = (u_int32_t)ntohl(((u_int *)hdr)[0]);
145 u_int32_t i1 = (u_int32_t)ntohl(((u_int *)hdr)[1]);
146 u_int dlen = ntohs(up->uh_ulen) - sizeof(*up) - 8;
154 if ((i0 >> 30) == 1) {
156 hasopt = i0 & 0x800000;
157 contype = (i0 >> 16) & 0x3f;
158 hasmarker = i0 & 0x400000;
162 hasext = i0 & 0x10000000;
163 contype = (i0 >> 16) & 0x7f;
164 hasmarker = i0 & 0x800000;
170 printf("udp/%s %d c%d %s%s %d %u",
174 (hasopt || hasext)? "+" : "",
179 printf(" %u", (u_int32_t)ntohl(((u_int *)hdr)[2]));
184 optlen = (i2 >> 16) & 0xff;
185 if (optlen == 0 || optlen > len) {
191 } while ((int)i2 >= 0);
196 extlen = (i2 & 0xffff) + 1;
203 if (contype == 0x1f) /*XXX H.261 */
204 printf(" 0x%04x", ip[0] >> 16);
208 static const u_char *
209 rtcp_print(const u_char *hdr, const u_char *ep)
211 /* rtp v2 control (rtcp) */
212 struct rtcp_rr *rr = 0;
214 struct rtcphdr *rh = (struct rtcphdr *)hdr;
219 if ((u_char *)(rh + 1) > ep) {
223 len = (ntohs(rh->rh_len) + 1) * 4;
224 flags = ntohs(rh->rh_flags);
225 cnt = (flags >> 8) & 0x1f;
226 switch (flags & 0xff) {
228 sr = (struct rtcp_sr *)(rh + 1);
230 if (len != cnt * sizeof(*rr) + sizeof(*sr) + sizeof(*rh))
231 printf(" [%d]", len);
233 printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc));
234 if ((u_char *)(sr + 1) > ep) {
238 ts = (double)((u_int32_t)ntohl(sr->sr_ntp.upper)) +
239 ((double)((u_int32_t)ntohl(sr->sr_ntp.lower)) /
241 printf(" @%.2f %u %up %ub", ts, (u_int32_t)ntohl(sr->sr_ts),
242 (u_int32_t)ntohl(sr->sr_np), (u_int32_t)ntohl(sr->sr_nb));
243 rr = (struct rtcp_rr *)(sr + 1);
247 if (len != cnt * sizeof(*rr) + sizeof(*rh))
248 printf(" [%d]", len);
249 rr = (struct rtcp_rr *)(rh + 1);
251 printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc));
254 printf(" sdes %d", len);
256 printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc));
260 printf(" bye %d", len);
262 printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc));
266 printf(" type-0x%x %d", flags & 0xff, len);
273 if ((u_char *)(rr + 1) > ep) {
278 printf(" %u", (u_int32_t)ntohl(rr->rr_srcid));
279 ts = (double)((u_int32_t)ntohl(rr->rr_lsr)) / 65536.;
280 dts = (double)((u_int32_t)ntohl(rr->rr_dlsr)) / 65536.;
281 printf(" %ul %us %uj @%.2f+%.2f",
282 (u_int32_t)ntohl(rr->rr_nl) & 0x00ffffff,
283 (u_int32_t)ntohl(rr->rr_ls),
284 (u_int32_t)ntohl(rr->rr_dv), ts, dts);
289 static int udp_cksum(register const struct ip *ip,
290 register const struct udphdr *up,
303 register const u_int16_t *sp;
305 /* pseudo-header.. */
306 phu.ph.len = htons(len);
308 phu.ph.proto = IPPROTO_UDP;
309 memcpy(&phu.ph.src, &ip->ip_src.s_addr, sizeof(u_int32_t));
310 memcpy(&phu.ph.dst, &ip->ip_dst.s_addr, sizeof(u_int32_t));
313 return in_cksum((u_short *)up, len,
314 sp[0]+sp[1]+sp[2]+sp[3]+sp[4]+sp[5]);
318 static int udp6_cksum(const struct ip6_hdr *ip6, const struct udphdr *up,
322 register const u_int16_t *sp;
326 struct in6_addr ph_src;
327 struct in6_addr ph_dst;
335 tlen = ntohs(ip6->ip6_plen) + sizeof(struct ip6_hdr) -
336 ((const char *)up - (const char*)ip6);
339 memset(&phu, 0, sizeof(phu));
340 phu.ph.ph_src = ip6->ip6_src;
341 phu.ph.ph_dst = ip6->ip6_dst;
342 phu.ph.ph_len = htonl(tlen);
343 phu.ph.ph_nxt = IPPROTO_UDP;
346 for (i = 0; i < sizeof(phu.pa) / sizeof(phu.pa[0]); i++)
349 sp = (const u_int16_t *)up;
351 for (i = 0; i < (tlen & ~1); i += 2)
355 sum += htons((*(const u_int8_t *)sp) << 8);
358 sum = (sum & 0xffff) + (sum >> 16);
366 /* XXX probably should use getservbyname() and cache answers */
367 #define TFTP_PORT 69 /*XXX*/
368 #define KERBEROS_PORT 88 /*XXX*/
369 #define SUNRPC_PORT 111 /*XXX*/
370 #define SNMP_PORT 161 /*XXX*/
371 #define NTP_PORT 123 /*XXX*/
372 #define SNMPTRAP_PORT 162 /*XXX*/
373 #define ISAKMP_PORT 500 /*XXX*/
374 #define TIMED_PORT 525 /*XXX*/
375 #define RIP_PORT 520 /*XXX*/
376 #define KERBEROS_SEC_PORT 750 /*XXX*/
377 #define L2TP_PORT 1701 /*XXX*/
378 #define ISAKMP_PORT_USER1 7500 /*XXX - nonstandard*/
379 #define ISAKMP_PORT_USER2 8500 /*XXX - nonstandard*/
380 #define RX_PORT_LOW 7000 /*XXX*/
381 #define RX_PORT_HIGH 7009 /*XXX*/
382 #define NETBIOS_NS_PORT 137
383 #define NETBIOS_DGRAM_PORT 138
384 #define CISCO_AUTORP_PORT 496 /*XXX*/
385 #define RADIUS_PORT 1645
386 #define RADIUS_NEW_PORT 1812
387 #define RADIUS_ACCOUNTING_PORT 1646
388 #define RADIUS_NEW_ACCOUNTING_PORT 1813
389 #define HSRP_PORT 1985 /*XXX*/
390 #define LWRES_PORT 921
391 #define ZEPHYR_SRV_PORT 2103
392 #define ZEPHYR_CLT_PORT 2104
395 #define RIPNG_PORT 521 /*XXX*/
396 #define DHCP6_SERV_PORT 546 /*XXX*/
397 #define DHCP6_CLI_PORT 547 /*XXX*/
401 udp_print(register const u_char *bp, u_int length,
402 register const u_char *bp2, int fragmented)
404 register const struct udphdr *up;
405 register const struct ip *ip;
406 register const u_char *cp;
407 register const u_char *ep = bp + length;
408 u_int16_t sport, dport, ulen;
410 register const struct ip6_hdr *ip6;
415 up = (struct udphdr *)bp;
416 ip = (struct ip *)bp2;
419 ip6 = (struct ip6_hdr *)bp2;
423 cp = (u_char *)(up + 1);
425 (void)printf("%s > %s: [|udp]",
426 ipaddr_string(&ip->ip_src), ipaddr_string(&ip->ip_dst));
429 if (length < sizeof(struct udphdr)) {
430 (void)printf("%s > %s: truncated-udp %d",
431 ipaddr_string(&ip->ip_src), ipaddr_string(&ip->ip_dst),
435 length -= sizeof(struct udphdr);
437 sport = ntohs(up->uh_sport);
438 dport = ntohs(up->uh_dport);
439 ulen = ntohs(up->uh_ulen);
441 (void)printf("%s > %s: truncated-udplength %d",
442 ipaddr_string(&ip->ip_src),
443 ipaddr_string(&ip->ip_dst),
448 register struct rpc_msg *rp;
449 enum msg_type direction;
451 switch (packettype) {
454 (void)printf("%s.%s > %s.%s: ",
455 ipaddr_string(&ip->ip_src),
456 udpport_string(sport),
457 ipaddr_string(&ip->ip_dst),
458 udpport_string(dport));
459 vat_print((void *)(up + 1), length, up);
463 (void)printf("%s.%s > %s.%s: ",
464 ipaddr_string(&ip->ip_src),
465 udpport_string(sport),
466 ipaddr_string(&ip->ip_dst),
467 udpport_string(dport));
468 wb_print((void *)(up + 1), length);
472 rp = (struct rpc_msg *)(up + 1);
473 direction = (enum msg_type)ntohl(rp->rm_direction);
474 if (direction == CALL)
475 sunrpcrequest_print((u_char *)rp, length,
478 nfsreply_print((u_char *)rp, length,
479 (u_char *)ip); /*XXX*/
483 (void)printf("%s.%s > %s.%s: ",
484 ipaddr_string(&ip->ip_src),
485 udpport_string(sport),
486 ipaddr_string(&ip->ip_dst),
487 udpport_string(dport));
488 rtp_print((void *)(up + 1), length, up);
492 (void)printf("%s.%s > %s.%s:",
493 ipaddr_string(&ip->ip_src),
494 udpport_string(sport),
495 ipaddr_string(&ip->ip_dst),
496 udpport_string(dport));
498 cp = rtcp_print(cp, ep);
502 (void)printf("%s.%s > %s.%s:",
503 ipaddr_string(&ip->ip_src),
504 udpport_string(sport),
505 ipaddr_string(&ip->ip_dst),
506 udpport_string(dport));
507 snmp_print((const u_char *)(up + 1), length);
511 (void)printf("%s.%s > %s.%s:",
512 ipaddr_string(&ip->ip_src),
513 udpport_string(sport),
514 ipaddr_string(&ip->ip_dst),
515 udpport_string(dport));
516 cnfp_print(cp, length, (const u_char *)ip);
523 register struct rpc_msg *rp;
524 enum msg_type direction;
526 rp = (struct rpc_msg *)(up + 1);
527 if (TTEST(rp->rm_direction)) {
528 direction = (enum msg_type)ntohl(rp->rm_direction);
529 if (dport == NFS_PORT && direction == CALL) {
530 nfsreq_print((u_char *)rp, length,
534 if (sport == NFS_PORT && direction == REPLY) {
535 nfsreply_print((u_char *)rp, length,
540 if (dport == SUNRPC_PORT && direction == CALL) {
541 sunrpcrequest_print((u_char *)rp, length, (u_char *)ip);
546 if (TTEST(((struct LAP *)cp)->type) &&
547 ((struct LAP *)cp)->type == lapDDP &&
548 (atalk_port(sport) || atalk_port(dport))) {
550 fputs("kip ", stdout);
551 llap_print(cp, length);
557 if (ip6->ip6_nxt == IPPROTO_UDP) {
558 (void)printf("%s.%s > %s.%s: ",
559 ip6addr_string(&ip6->ip6_src),
560 udpport_string(sport),
561 ip6addr_string(&ip6->ip6_dst),
562 udpport_string(dport));
564 (void)printf("%s > %s: ",
565 udpport_string(sport), udpport_string(dport));
570 if (ip->ip_p == IPPROTO_UDP) {
571 (void)printf("%s.%s > %s.%s: ",
572 ipaddr_string(&ip->ip_src),
573 udpport_string(sport),
574 ipaddr_string(&ip->ip_dst),
575 udpport_string(dport));
577 (void)printf("%s > %s: ",
578 udpport_string(sport), udpport_string(dport));
582 if (IP_V(ip) == 4 && vflag && !fragmented) {
583 int sum = up->uh_sum;
585 (void)printf("[no cksum] ");
586 } else if (TTEST2(cp[0], length)) {
587 sum = udp_cksum(ip, up, length + sizeof(struct udphdr));
589 (void)printf("[bad udp cksum %x!] ", sum);
591 (void)printf("[udp sum ok] ");
595 if (IP_V(ip) == 6 && ip6->ip6_plen && vflag && !fragmented) {
596 int sum = up->uh_sum;
597 /* for IPv6, UDP checksum is mandatory */
598 if (TTEST2(cp[0], length)) {
599 sum = udp6_cksum(ip6, up, length);
601 (void)printf("[bad udp cksum %x!] ", sum);
603 (void)printf("[udp sum ok] ");
609 #define ISPORT(p) (dport == (p) || sport == (p))
610 if (ISPORT(NAMESERVER_PORT))
611 ns_print((const u_char *)(up + 1), length);
612 else if (ISPORT(TIMED_PORT))
613 timed_print((const u_char *)(up + 1), length);
614 else if (ISPORT(TFTP_PORT))
615 tftp_print((const u_char *)(up + 1), length);
616 else if (ISPORT(IPPORT_BOOTPC) || ISPORT(IPPORT_BOOTPS))
617 bootp_print((const u_char *)(up + 1), length,
619 else if (ISPORT(RIP_PORT))
620 rip_print((const u_char *)(up + 1), length);
621 else if (ISPORT(ISAKMP_PORT))
622 isakmp_print((const u_char *)(up + 1), length, bp2);
624 else if (ISPORT(ISAKMP_PORT_USER1) || ISPORT(ISAKMP_PORT_USER2))
625 isakmp_print((const u_char *)(up + 1), length, bp2);
627 else if (ISPORT(SNMP_PORT) || ISPORT(SNMPTRAP_PORT))
628 snmp_print((const u_char *)(up + 1), length);
629 else if (ISPORT(NTP_PORT))
630 ntp_print((const u_char *)(up + 1), length);
631 else if (ISPORT(KERBEROS_PORT) || ISPORT(KERBEROS_SEC_PORT))
632 krb_print((const void *)(up + 1), length);
633 else if (ISPORT(L2TP_PORT))
634 l2tp_print((const u_char *)(up + 1), length);
635 #ifdef TCPDUMP_DO_SMB
636 else if (ISPORT(NETBIOS_NS_PORT))
637 nbt_udp137_print((const u_char *)(up + 1), length);
638 else if (ISPORT(NETBIOS_DGRAM_PORT))
639 nbt_udp138_print((const u_char *)(up + 1), length);
641 else if (dport == 3456)
642 vat_print((const void *)(up + 1), length, up);
643 else if (ISPORT(ZEPHYR_SRV_PORT) || ISPORT(ZEPHYR_CLT_PORT))
644 zephyr_print((const void *)(up + 1), length);
646 * Since there are 10 possible ports to check, I think
647 * a <> test would be more efficient
649 else if ((sport >= RX_PORT_LOW && sport <= RX_PORT_HIGH) ||
650 (dport >= RX_PORT_LOW && dport <= RX_PORT_HIGH))
651 rx_print((const void *)(up + 1), length, sport, dport,
654 else if (ISPORT(RIPNG_PORT))
655 ripng_print((const u_char *)(up + 1), length);
656 else if (ISPORT(DHCP6_SERV_PORT) || ISPORT(DHCP6_CLI_PORT)) {
657 dhcp6_print((const u_char *)(up + 1), length,
662 * Kludge in test for whiteboard packets.
664 else if (dport == 4567)
665 wb_print((const void *)(up + 1), length);
666 else if (ISPORT(CISCO_AUTORP_PORT))
667 cisco_autorp_print((const void *)(up + 1), length);
668 else if (ISPORT(RADIUS_PORT) ||
669 ISPORT(RADIUS_NEW_PORT) ||
670 ISPORT(RADIUS_ACCOUNTING_PORT) ||
671 ISPORT(RADIUS_NEW_ACCOUNTING_PORT) )
672 radius_print((const u_char *)(up+1), length);
673 else if (dport == HSRP_PORT)
674 hsrp_print((const u_char *)(up + 1), length);
675 else if (ISPORT(LWRES_PORT))
676 lwres_print((const u_char *)(up + 1), length);
678 (void)printf("udp %u",
679 (u_int32_t)(ulen - sizeof(*up)));
682 (void)printf("udp %u", (u_int32_t)(ulen - sizeof(*up)));