2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
24 #define NETDISSECT_REWORKED
29 #include <tcpdump-stdinc.h>
31 #include "interface.h"
32 #include "addrtoname.h"
34 #include "appletalk.h"
50 uint16_t rh_flags; /* T:2 P:1 CNT:5 PT:8 */
51 uint16_t rh_len; /* length of message (in words) */
52 uint32_t rh_ssrc; /* synchronization src id */
56 uint32_t upper; /* more significant 32 bits */
57 uint32_t lower; /* less significant 32 bits */
64 ntp64 sr_ntp; /* 64-bit ntp timestamp */
65 uint32_t sr_ts; /* reference media timestamp */
66 uint32_t sr_np; /* no. packets sent */
67 uint32_t sr_nb; /* no. bytes sent */
72 * Time stamps are middle 32-bits of ntp timestamp.
75 uint32_t rr_srcid; /* sender being reported */
76 uint32_t rr_nl; /* no. packets lost */
77 uint32_t rr_ls; /* extended last seq number received */
78 uint32_t rr_dv; /* jitter (delay variance) */
79 uint32_t rr_lsr; /* orig. ts from last rr from this src */
80 uint32_t rr_dlsr; /* time from recpt of last rr to xmit time */
84 #define RTCP_PT_SR 200
85 #define RTCP_PT_RR 201
86 #define RTCP_PT_SDES 202
87 #define RTCP_SDES_CNAME 1
88 #define RTCP_SDES_NAME 2
89 #define RTCP_SDES_EMAIL 3
90 #define RTCP_SDES_PHONE 4
91 #define RTCP_SDES_LOC 5
92 #define RTCP_SDES_TOOL 6
93 #define RTCP_SDES_NOTE 7
94 #define RTCP_SDES_PRIV 8
95 #define RTCP_PT_BYE 203
96 #define RTCP_PT_APP 204
99 vat_print(netdissect_options *ndo, const void *hdr, register const struct udphdr *up)
102 u_int ts = *(uint16_t *)hdr;
103 if ((ts & 0xf060) != 0) {
105 ND_PRINT((ndo, "udp/vt %u %d / %d",
106 (uint32_t)(EXTRACT_16BITS(&up->uh_ulen) - sizeof(*up)),
107 ts & 0x3ff, ts >> 10));
110 uint32_t i0 = EXTRACT_32BITS(&((u_int *)hdr)[0]);
111 uint32_t i1 = EXTRACT_32BITS(&((u_int *)hdr)[1]);
112 ND_PRINT((ndo, "udp/vat %u c%d %u%s",
113 (uint32_t)(EXTRACT_16BITS(&up->uh_ulen) - sizeof(*up) - 8),
115 i1, i0 & 0x800000? "*" : ""));
118 ND_PRINT((ndo, " f%d", (i0 >> 16) & 0x1f));
120 ND_PRINT((ndo, " s%d", (i0 >> 24) & 0x3f));
125 rtp_print(netdissect_options *ndo, const void *hdr, u_int len,
126 register const struct udphdr *up)
129 u_int *ip = (u_int *)hdr;
130 u_int hasopt, hasext, contype, hasmarker;
131 uint32_t i0 = EXTRACT_32BITS(&((u_int *)hdr)[0]);
132 uint32_t i1 = EXTRACT_32BITS(&((u_int *)hdr)[1]);
133 u_int dlen = EXTRACT_16BITS(&up->uh_ulen) - sizeof(*up) - 8;
141 if ((i0 >> 30) == 1) {
143 hasopt = i0 & 0x800000;
144 contype = (i0 >> 16) & 0x3f;
145 hasmarker = i0 & 0x400000;
149 hasext = i0 & 0x10000000;
150 contype = (i0 >> 16) & 0x7f;
151 hasmarker = i0 & 0x800000;
157 ND_PRINT((ndo, "udp/%s %d c%d %s%s %d %u",
161 (hasopt || hasext)? "+" : "",
165 if (ndo->ndo_vflag) {
166 ND_PRINT((ndo, " %u", EXTRACT_32BITS(&((u_int *)hdr)[2])));
171 optlen = (i2 >> 16) & 0xff;
172 if (optlen == 0 || optlen > len) {
173 ND_PRINT((ndo, " !opt"));
178 } while ((int)i2 >= 0);
183 extlen = (i2 & 0xffff) + 1;
185 ND_PRINT((ndo, " !ext"));
190 if (contype == 0x1f) /*XXX H.261 */
191 ND_PRINT((ndo, " 0x%04x", ip[0] >> 16));
195 static const u_char *
196 rtcp_print(netdissect_options *ndo, const u_char *hdr, const u_char *ep)
198 /* rtp v2 control (rtcp) */
199 struct rtcp_rr *rr = 0;
201 struct rtcphdr *rh = (struct rtcphdr *)hdr;
206 if ((u_char *)(rh + 1) > ep) {
207 ND_PRINT((ndo, " [|rtcp]"));
210 len = (EXTRACT_16BITS(&rh->rh_len) + 1) * 4;
211 flags = EXTRACT_16BITS(&rh->rh_flags);
212 cnt = (flags >> 8) & 0x1f;
213 switch (flags & 0xff) {
215 sr = (struct rtcp_sr *)(rh + 1);
216 ND_PRINT((ndo, " sr"));
217 if (len != cnt * sizeof(*rr) + sizeof(*sr) + sizeof(*rh))
218 ND_PRINT((ndo, " [%d]", len));
220 ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rh->rh_ssrc)));
221 if ((u_char *)(sr + 1) > ep) {
222 ND_PRINT((ndo, " [|rtcp]"));
225 ts = (double)(EXTRACT_32BITS(&sr->sr_ntp.upper)) +
226 ((double)(EXTRACT_32BITS(&sr->sr_ntp.lower)) /
228 ND_PRINT((ndo, " @%.2f %u %up %ub", ts, EXTRACT_32BITS(&sr->sr_ts),
229 EXTRACT_32BITS(&sr->sr_np), EXTRACT_32BITS(&sr->sr_nb)));
230 rr = (struct rtcp_rr *)(sr + 1);
233 ND_PRINT((ndo, " rr"));
234 if (len != cnt * sizeof(*rr) + sizeof(*rh))
235 ND_PRINT((ndo, " [%d]", len));
236 rr = (struct rtcp_rr *)(rh + 1);
238 ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rh->rh_ssrc)));
241 ND_PRINT((ndo, " sdes %d", len));
243 ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rh->rh_ssrc)));
247 ND_PRINT((ndo, " bye %d", len));
249 ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rh->rh_ssrc)));
253 ND_PRINT((ndo, " type-0x%x %d", flags & 0xff, len));
258 ND_PRINT((ndo, " c%d", cnt));
260 if ((u_char *)(rr + 1) > ep) {
261 ND_PRINT((ndo, " [|rtcp]"));
265 ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rr->rr_srcid)));
266 ts = (double)(EXTRACT_32BITS(&rr->rr_lsr)) / 65536.;
267 dts = (double)(EXTRACT_32BITS(&rr->rr_dlsr)) / 65536.;
268 ND_PRINT((ndo, " %ul %us %uj @%.2f+%.2f",
269 EXTRACT_32BITS(&rr->rr_nl) & 0x00ffffff,
270 EXTRACT_32BITS(&rr->rr_ls),
271 EXTRACT_32BITS(&rr->rr_dv), ts, dts));
276 static int udp_cksum(netdissect_options *ndo, register const struct ip *ip,
277 register const struct udphdr *up,
280 return nextproto4_cksum(ndo, ip, (const uint8_t *)(void *)up, len, len,
285 static int udp6_cksum(const struct ip6_hdr *ip6, const struct udphdr *up,
288 return nextproto6_cksum(ip6, (const uint8_t *)(void *)up, len, len,
294 udpipaddr_print(netdissect_options *ndo, const struct ip *ip, int sport, int dport)
297 const struct ip6_hdr *ip6;
300 ip6 = (const struct ip6_hdr *)ip;
305 if (ip6->ip6_nxt == IPPROTO_UDP) {
307 ND_PRINT((ndo, "%s > %s: ",
308 ip6addr_string(ndo, &ip6->ip6_src),
309 ip6addr_string(ndo, &ip6->ip6_dst)));
311 ND_PRINT((ndo, "%s.%s > %s.%s: ",
312 ip6addr_string(ndo, &ip6->ip6_src),
313 udpport_string(sport),
314 ip6addr_string(ndo, &ip6->ip6_dst),
315 udpport_string(dport)));
319 ND_PRINT((ndo, "%s > %s: ",
320 udpport_string(sport),
321 udpport_string(dport)));
327 if (ip->ip_p == IPPROTO_UDP) {
329 ND_PRINT((ndo, "%s > %s: ",
330 ipaddr_string(ndo, &ip->ip_src),
331 ipaddr_string(ndo, &ip->ip_dst)));
333 ND_PRINT((ndo, "%s.%s > %s.%s: ",
334 ipaddr_string(ndo, &ip->ip_src),
335 udpport_string(sport),
336 ipaddr_string(ndo, &ip->ip_dst),
337 udpport_string(dport)));
341 ND_PRINT((ndo, "%s > %s: ",
342 udpport_string(sport),
343 udpport_string(dport)));
350 udp_print(netdissect_options *ndo, register const u_char *bp, u_int length,
351 register const u_char *bp2, int fragmented)
353 register const struct udphdr *up;
354 register const struct ip *ip;
355 register const u_char *cp;
356 register const u_char *ep = bp + length;
357 uint16_t sport, dport, ulen;
359 register const struct ip6_hdr *ip6;
362 if (ep > ndo->ndo_snapend)
363 ep = ndo->ndo_snapend;
364 up = (struct udphdr *)bp;
365 ip = (struct ip *)bp2;
368 ip6 = (struct ip6_hdr *)bp2;
372 if (!ND_TTEST(up->uh_dport)) {
373 udpipaddr_print(ndo, ip, -1, -1);
374 ND_PRINT((ndo, "[|udp]"));
378 sport = EXTRACT_16BITS(&up->uh_sport);
379 dport = EXTRACT_16BITS(&up->uh_dport);
381 if (length < sizeof(struct udphdr)) {
382 udpipaddr_print(ndo, ip, sport, dport);
383 ND_PRINT((ndo, "truncated-udp %d", length));
386 ulen = EXTRACT_16BITS(&up->uh_ulen);
387 if (ulen < sizeof(struct udphdr)) {
388 udpipaddr_print(ndo, ip, sport, dport);
389 ND_PRINT((ndo, "truncated-udplength %d", ulen));
392 ulen -= sizeof(struct udphdr);
393 length -= sizeof(struct udphdr);
397 cp = (u_char *)(up + 1);
398 if (cp > ndo->ndo_snapend) {
399 udpipaddr_print(ndo, ip, sport, dport);
400 ND_PRINT((ndo, "[|udp]"));
404 if (ndo->ndo_packettype) {
405 register struct sunrpc_msg *rp;
406 enum sunrpc_msg_type direction;
408 switch (ndo->ndo_packettype) {
411 udpipaddr_print(ndo, ip, sport, dport);
412 vat_print(ndo, (void *)(up + 1), up);
416 udpipaddr_print(ndo, ip, sport, dport);
417 wb_print(ndo, (void *)(up + 1), length);
421 rp = (struct sunrpc_msg *)(up + 1);
422 direction = (enum sunrpc_msg_type)EXTRACT_32BITS(&rp->rm_direction);
423 if (direction == SUNRPC_CALL)
424 sunrpcrequest_print(ndo, (u_char *)rp, length,
427 nfsreply_print(ndo, (u_char *)rp, length,
428 (u_char *)ip); /*XXX*/
432 udpipaddr_print(ndo, ip, sport, dport);
433 rtp_print(ndo, (void *)(up + 1), length, up);
437 udpipaddr_print(ndo, ip, sport, dport);
439 cp = rtcp_print(ndo, cp, ep);
443 udpipaddr_print(ndo, ip, sport, dport);
444 snmp_print(ndo, (const u_char *)(up + 1), length);
448 udpipaddr_print(ndo, ip, sport, dport);
453 udpipaddr_print(ndo, ip, sport, dport);
454 tftp_print(ndo, cp, length);
458 udpipaddr_print(ndo, ip, sport, dport);
459 aodv_print(ndo, (const u_char *)(up + 1), length,
468 udpipaddr_print(ndo, ip, sport, dport);
469 radius_print(ndo, cp, length);
473 udpipaddr_print(ndo, ip, sport, dport);
474 vxlan_print(ndo, (const u_char *)(up + 1), length);
479 udpipaddr_print(ndo, ip, sport, dport);
480 pgm_print(ndo, cp, length, bp2);
483 udpipaddr_print(ndo, ip, sport, dport);
484 lmp_print(ndo, cp, length);
490 udpipaddr_print(ndo, ip, sport, dport);
491 if (!ndo->ndo_qflag) {
492 register struct sunrpc_msg *rp;
493 enum sunrpc_msg_type direction;
495 rp = (struct sunrpc_msg *)(up + 1);
496 if (ND_TTEST(rp->rm_direction)) {
497 direction = (enum sunrpc_msg_type)EXTRACT_32BITS(&rp->rm_direction);
498 if (dport == NFS_PORT && direction == SUNRPC_CALL) {
499 ND_PRINT((ndo, "NFS request xid %u ", EXTRACT_32BITS(&rp->rm_xid)));
500 nfsreq_print_noaddr(ndo, (u_char *)rp, length,
504 if (sport == NFS_PORT && direction == SUNRPC_REPLY) {
505 ND_PRINT((ndo, "NFS reply xid %u ", EXTRACT_32BITS(&rp->rm_xid)));
506 nfsreply_print_noaddr(ndo, (u_char *)rp, length,
511 if (dport == SUNRPC_PORT && direction == SUNRPC_CALL) {
512 sunrpcrequest_print((u_char *)rp, length, (u_char *)ip);
517 if (ND_TTEST(((struct LAP *)cp)->type) &&
518 ((struct LAP *)cp)->type == lapDDP &&
519 (atalk_port(sport) || atalk_port(dport))) {
521 ND_PRINT((ndo, "kip "));
522 llap_print(ndo, cp, length);
527 if (ndo->ndo_vflag && !ndo->ndo_Kflag && !fragmented) {
528 /* Check the checksum, if possible. */
529 uint16_t sum, udp_sum;
532 * XXX - do this even if vflag == 1?
533 * TCP does, and we do so for UDP-over-IPv6.
535 if (IP_V(ip) == 4 && (ndo->ndo_vflag > 1)) {
536 udp_sum = EXTRACT_16BITS(&up->uh_sum);
538 ND_PRINT((ndo, "[no cksum] "));
539 } else if (ND_TTEST2(cp[0], length)) {
540 sum = udp_cksum(ndo, ip, up, length + sizeof(struct udphdr));
543 ND_PRINT((ndo, "[bad udp cksum 0x%04x -> 0x%04x!] ",
545 in_cksum_shouldbe(udp_sum, sum)));
547 ND_PRINT((ndo, "[udp sum ok] "));
551 else if (IP_V(ip) == 6 && ip6->ip6_plen) {
552 /* for IPv6, UDP checksum is mandatory */
553 if (ND_TTEST2(cp[0], length)) {
554 sum = udp6_cksum(ip6, up, length + sizeof(struct udphdr));
555 udp_sum = EXTRACT_16BITS(&up->uh_sum);
558 ND_PRINT((ndo, "[bad udp cksum 0x%04x -> 0x%04x!] ",
560 in_cksum_shouldbe(udp_sum, sum)));
562 ND_PRINT((ndo, "[udp sum ok] "));
568 if (!ndo->ndo_qflag) {
569 #define ISPORT(p) (dport == (p) || sport == (p))
570 if (ISPORT(NAMESERVER_PORT))
571 ns_print(ndo, (const u_char *)(up + 1), length, 0);
572 else if (ISPORT(MULTICASTDNS_PORT))
573 ns_print(ndo, (const u_char *)(up + 1), length, 1);
574 else if (ISPORT(TIMED_PORT))
575 timed_print(ndo, (const u_char *)(up + 1));
576 else if (ISPORT(TFTP_PORT))
577 tftp_print(ndo, (const u_char *)(up + 1), length);
578 else if (ISPORT(BOOTPC_PORT) || ISPORT(BOOTPS_PORT))
579 bootp_print(ndo, (const u_char *)(up + 1), length);
580 else if (ISPORT(RIP_PORT))
581 rip_print(ndo, (const u_char *)(up + 1), length);
582 else if (ISPORT(AODV_PORT))
583 aodv_print(ndo, (const u_char *)(up + 1), length,
589 else if (ISPORT(ISAKMP_PORT))
590 isakmp_print(ndo, (const u_char *)(up + 1), length, bp2);
591 else if (ISPORT(ISAKMP_PORT_NATT))
592 isakmp_rfc3948_print(ndo, (const u_char *)(up + 1), length, bp2);
594 else if (ISPORT(ISAKMP_PORT_USER1) || ISPORT(ISAKMP_PORT_USER2))
595 isakmp_print(ndo, (const u_char *)(up + 1), length, bp2);
597 else if (ISPORT(SNMP_PORT) || ISPORT(SNMPTRAP_PORT))
598 snmp_print(ndo, (const u_char *)(up + 1), length);
599 else if (ISPORT(NTP_PORT))
600 ntp_print(ndo, (const u_char *)(up + 1), length);
601 else if (ISPORT(KERBEROS_PORT) || ISPORT(KERBEROS_SEC_PORT))
602 krb_print(ndo, (const void *)(up + 1));
603 else if (ISPORT(L2TP_PORT))
604 l2tp_print(ndo, (const u_char *)(up + 1), length);
605 #ifdef TCPDUMP_DO_SMB
606 else if (ISPORT(NETBIOS_NS_PORT))
607 nbt_udp137_print(ndo, (const u_char *)(up + 1), length);
608 else if (ISPORT(NETBIOS_DGRAM_PORT))
609 nbt_udp138_print(ndo, (const u_char *)(up + 1), length);
611 else if (dport == VAT_PORT)
612 vat_print(ndo, (const void *)(up + 1), up);
613 else if (ISPORT(ZEPHYR_SRV_PORT) || ISPORT(ZEPHYR_CLT_PORT))
614 zephyr_print(ndo, (const void *)(up + 1), length);
616 * Since there are 10 possible ports to check, I think
617 * a <> test would be more efficient
619 else if ((sport >= RX_PORT_LOW && sport <= RX_PORT_HIGH) ||
620 (dport >= RX_PORT_LOW && dport <= RX_PORT_HIGH))
621 rx_print(ndo, (const void *)(up + 1), length, sport, dport,
624 else if (ISPORT(RIPNG_PORT))
625 ripng_print(ndo, (const u_char *)(up + 1), length);
626 else if (ISPORT(DHCP6_SERV_PORT) || ISPORT(DHCP6_CLI_PORT))
627 dhcp6_print(ndo, (const u_char *)(up + 1), length);
628 else if (ISPORT(AHCP_PORT))
629 ahcp_print(ndo, (const u_char *)(up + 1), length);
630 else if (ISPORT(BABEL_PORT) || ISPORT(BABEL_PORT_OLD))
631 babel_print(ndo, (const u_char *)(up + 1), length);
634 * Kludge in test for whiteboard packets.
636 else if (dport == WB_PORT)
637 wb_print(ndo, (const void *)(up + 1), length);
638 else if (ISPORT(CISCO_AUTORP_PORT))
639 cisco_autorp_print(ndo, (const void *)(up + 1), length);
640 else if (ISPORT(RADIUS_PORT) ||
641 ISPORT(RADIUS_NEW_PORT) ||
642 ISPORT(RADIUS_ACCOUNTING_PORT) ||
643 ISPORT(RADIUS_NEW_ACCOUNTING_PORT) ||
644 ISPORT(RADIUS_COA_PORT) )
645 radius_print(ndo, (const u_char *)(up+1), length);
646 else if (dport == HSRP_PORT)
647 hsrp_print(ndo, (const u_char *)(up + 1), length);
648 else if (ISPORT(LWRES_PORT))
649 lwres_print(ndo, (const u_char *)(up + 1), length);
650 else if (ISPORT(LDP_PORT))
651 ldp_print(ndo, (const u_char *)(up + 1), length);
652 else if (ISPORT(OLSR_PORT))
653 olsr_print(ndo, (const u_char *)(up + 1), length,
655 (IP_V(ip) == 6) ? 1 : 0);
659 else if (ISPORT(MPLS_LSP_PING_PORT))
660 lspping_print(ndo, (const u_char *)(up + 1), length);
661 else if (dport == BFD_CONTROL_PORT ||
662 dport == BFD_ECHO_PORT )
663 bfd_print(ndo, (const u_char *)(up+1), length, dport);
664 else if (ISPORT(LMP_PORT))
665 lmp_print(ndo, (const u_char *)(up + 1), length);
666 else if (ISPORT(VQP_PORT))
667 vqp_print(ndo, (const u_char *)(up + 1), length);
668 else if (ISPORT(SFLOW_PORT))
669 sflow_print(ndo, (const u_char *)(up + 1), length);
670 else if (dport == LWAPP_CONTROL_PORT)
671 lwapp_control_print(ndo, (const u_char *)(up + 1), length, 1);
672 else if (sport == LWAPP_CONTROL_PORT)
673 lwapp_control_print(ndo, (const u_char *)(up + 1), length, 0);
674 else if (ISPORT(LWAPP_DATA_PORT))
675 lwapp_data_print(ndo, (const u_char *)(up + 1), length);
676 else if (ISPORT(SIP_PORT))
677 sip_print(ndo, (const u_char *)(up + 1), length);
678 else if (ISPORT(SYSLOG_PORT))
679 syslog_print(ndo, (const u_char *)(up + 1), length);
680 else if (ISPORT(OTV_PORT))
681 otv_print(ndo, (const u_char *)(up + 1), length);
682 else if (ISPORT(VXLAN_PORT))
683 vxlan_print(ndo, (const u_char *)(up + 1), length);
684 else if (ISPORT(GENEVE_PORT))
685 geneve_print(ndo, (const u_char *)(up + 1), length);
688 ND_PRINT((ndo, "UDP, bad length %u > %u",
691 ND_PRINT((ndo, "UDP, length %u", ulen));
696 ND_PRINT((ndo, "UDP, bad length %u > %u",
699 ND_PRINT((ndo, "UDP, length %u", ulen));
706 * c-style: whitesmith