2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
24 #define NETDISSECT_REWORKED
29 #include <tcpdump-stdinc.h>
31 #include "interface.h"
32 #include "addrtoname.h"
34 #include "appletalk.h"
51 uint16_t rh_flags; /* T:2 P:1 CNT:5 PT:8 */
52 uint16_t rh_len; /* length of message (in words) */
53 uint32_t rh_ssrc; /* synchronization src id */
57 uint32_t upper; /* more significant 32 bits */
58 uint32_t lower; /* less significant 32 bits */
65 ntp64 sr_ntp; /* 64-bit ntp timestamp */
66 uint32_t sr_ts; /* reference media timestamp */
67 uint32_t sr_np; /* no. packets sent */
68 uint32_t sr_nb; /* no. bytes sent */
73 * Time stamps are middle 32-bits of ntp timestamp.
76 uint32_t rr_srcid; /* sender being reported */
77 uint32_t rr_nl; /* no. packets lost */
78 uint32_t rr_ls; /* extended last seq number received */
79 uint32_t rr_dv; /* jitter (delay variance) */
80 uint32_t rr_lsr; /* orig. ts from last rr from this src */
81 uint32_t rr_dlsr; /* time from recpt of last rr to xmit time */
85 #define RTCP_PT_SR 200
86 #define RTCP_PT_RR 201
87 #define RTCP_PT_SDES 202
88 #define RTCP_SDES_CNAME 1
89 #define RTCP_SDES_NAME 2
90 #define RTCP_SDES_EMAIL 3
91 #define RTCP_SDES_PHONE 4
92 #define RTCP_SDES_LOC 5
93 #define RTCP_SDES_TOOL 6
94 #define RTCP_SDES_NOTE 7
95 #define RTCP_SDES_PRIV 8
96 #define RTCP_PT_BYE 203
97 #define RTCP_PT_APP 204
100 vat_print(netdissect_options *ndo, const void *hdr, register const struct udphdr *up)
103 u_int ts = *(uint16_t *)hdr;
104 if ((ts & 0xf060) != 0) {
106 ND_PRINT((ndo, "udp/vt %u %d / %d",
107 (uint32_t)(EXTRACT_16BITS(&up->uh_ulen) - sizeof(*up)),
108 ts & 0x3ff, ts >> 10));
111 uint32_t i0 = EXTRACT_32BITS(&((u_int *)hdr)[0]);
112 uint32_t i1 = EXTRACT_32BITS(&((u_int *)hdr)[1]);
113 ND_PRINT((ndo, "udp/vat %u c%d %u%s",
114 (uint32_t)(EXTRACT_16BITS(&up->uh_ulen) - sizeof(*up) - 8),
116 i1, i0 & 0x800000? "*" : ""));
119 ND_PRINT((ndo, " f%d", (i0 >> 16) & 0x1f));
121 ND_PRINT((ndo, " s%d", (i0 >> 24) & 0x3f));
126 rtp_print(netdissect_options *ndo, const void *hdr, u_int len,
127 register const struct udphdr *up)
130 u_int *ip = (u_int *)hdr;
131 u_int hasopt, hasext, contype, hasmarker;
132 uint32_t i0 = EXTRACT_32BITS(&((u_int *)hdr)[0]);
133 uint32_t i1 = EXTRACT_32BITS(&((u_int *)hdr)[1]);
134 u_int dlen = EXTRACT_16BITS(&up->uh_ulen) - sizeof(*up) - 8;
142 if ((i0 >> 30) == 1) {
144 hasopt = i0 & 0x800000;
145 contype = (i0 >> 16) & 0x3f;
146 hasmarker = i0 & 0x400000;
150 hasext = i0 & 0x10000000;
151 contype = (i0 >> 16) & 0x7f;
152 hasmarker = i0 & 0x800000;
158 ND_PRINT((ndo, "udp/%s %d c%d %s%s %d %u",
162 (hasopt || hasext)? "+" : "",
166 if (ndo->ndo_vflag) {
167 ND_PRINT((ndo, " %u", EXTRACT_32BITS(&((u_int *)hdr)[2])));
172 optlen = (i2 >> 16) & 0xff;
173 if (optlen == 0 || optlen > len) {
174 ND_PRINT((ndo, " !opt"));
179 } while ((int)i2 >= 0);
184 extlen = (i2 & 0xffff) + 1;
186 ND_PRINT((ndo, " !ext"));
191 if (contype == 0x1f) /*XXX H.261 */
192 ND_PRINT((ndo, " 0x%04x", ip[0] >> 16));
196 static const u_char *
197 rtcp_print(netdissect_options *ndo, const u_char *hdr, const u_char *ep)
199 /* rtp v2 control (rtcp) */
200 struct rtcp_rr *rr = 0;
202 struct rtcphdr *rh = (struct rtcphdr *)hdr;
207 if ((u_char *)(rh + 1) > ep) {
208 ND_PRINT((ndo, " [|rtcp]"));
211 len = (EXTRACT_16BITS(&rh->rh_len) + 1) * 4;
212 flags = EXTRACT_16BITS(&rh->rh_flags);
213 cnt = (flags >> 8) & 0x1f;
214 switch (flags & 0xff) {
216 sr = (struct rtcp_sr *)(rh + 1);
217 ND_PRINT((ndo, " sr"));
218 if (len != cnt * sizeof(*rr) + sizeof(*sr) + sizeof(*rh))
219 ND_PRINT((ndo, " [%d]", len));
221 ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rh->rh_ssrc)));
222 if ((u_char *)(sr + 1) > ep) {
223 ND_PRINT((ndo, " [|rtcp]"));
226 ts = (double)(EXTRACT_32BITS(&sr->sr_ntp.upper)) +
227 ((double)(EXTRACT_32BITS(&sr->sr_ntp.lower)) /
229 ND_PRINT((ndo, " @%.2f %u %up %ub", ts, EXTRACT_32BITS(&sr->sr_ts),
230 EXTRACT_32BITS(&sr->sr_np), EXTRACT_32BITS(&sr->sr_nb)));
231 rr = (struct rtcp_rr *)(sr + 1);
234 ND_PRINT((ndo, " rr"));
235 if (len != cnt * sizeof(*rr) + sizeof(*rh))
236 ND_PRINT((ndo, " [%d]", len));
237 rr = (struct rtcp_rr *)(rh + 1);
239 ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rh->rh_ssrc)));
242 ND_PRINT((ndo, " sdes %d", len));
244 ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rh->rh_ssrc)));
248 ND_PRINT((ndo, " bye %d", len));
250 ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rh->rh_ssrc)));
254 ND_PRINT((ndo, " type-0x%x %d", flags & 0xff, len));
259 ND_PRINT((ndo, " c%d", cnt));
261 if ((u_char *)(rr + 1) > ep) {
262 ND_PRINT((ndo, " [|rtcp]"));
266 ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rr->rr_srcid)));
267 ts = (double)(EXTRACT_32BITS(&rr->rr_lsr)) / 65536.;
268 dts = (double)(EXTRACT_32BITS(&rr->rr_dlsr)) / 65536.;
269 ND_PRINT((ndo, " %ul %us %uj @%.2f+%.2f",
270 EXTRACT_32BITS(&rr->rr_nl) & 0x00ffffff,
271 EXTRACT_32BITS(&rr->rr_ls),
272 EXTRACT_32BITS(&rr->rr_dv), ts, dts));
277 static int udp_cksum(netdissect_options *ndo, register const struct ip *ip,
278 register const struct udphdr *up,
281 return nextproto4_cksum(ndo, ip, (const uint8_t *)(void *)up, len, len,
286 static int udp6_cksum(const struct ip6_hdr *ip6, const struct udphdr *up,
289 return nextproto6_cksum(ip6, (const uint8_t *)(void *)up, len, len,
295 udpipaddr_print(netdissect_options *ndo, const struct ip *ip, int sport, int dport)
298 const struct ip6_hdr *ip6;
301 ip6 = (const struct ip6_hdr *)ip;
306 if (ip6->ip6_nxt == IPPROTO_UDP) {
308 ND_PRINT((ndo, "%s > %s: ",
309 ip6addr_string(ndo, &ip6->ip6_src),
310 ip6addr_string(ndo, &ip6->ip6_dst)));
312 ND_PRINT((ndo, "%s.%s > %s.%s: ",
313 ip6addr_string(ndo, &ip6->ip6_src),
314 udpport_string(sport),
315 ip6addr_string(ndo, &ip6->ip6_dst),
316 udpport_string(dport)));
320 ND_PRINT((ndo, "%s > %s: ",
321 udpport_string(sport),
322 udpport_string(dport)));
328 if (ip->ip_p == IPPROTO_UDP) {
330 ND_PRINT((ndo, "%s > %s: ",
331 ipaddr_string(ndo, &ip->ip_src),
332 ipaddr_string(ndo, &ip->ip_dst)));
334 ND_PRINT((ndo, "%s.%s > %s.%s: ",
335 ipaddr_string(ndo, &ip->ip_src),
336 udpport_string(sport),
337 ipaddr_string(ndo, &ip->ip_dst),
338 udpport_string(dport)));
342 ND_PRINT((ndo, "%s > %s: ",
343 udpport_string(sport),
344 udpport_string(dport)));
351 udp_print(netdissect_options *ndo, register const u_char *bp, u_int length,
352 register const u_char *bp2, int fragmented)
354 register const struct udphdr *up;
355 register const struct ip *ip;
356 register const u_char *cp;
357 register const u_char *ep = bp + length;
358 uint16_t sport, dport, ulen;
360 register const struct ip6_hdr *ip6;
363 if (ep > ndo->ndo_snapend)
364 ep = ndo->ndo_snapend;
365 up = (struct udphdr *)bp;
366 ip = (struct ip *)bp2;
369 ip6 = (struct ip6_hdr *)bp2;
373 cp = (u_char *)(up + 1);
374 if (!ND_TTEST(up->uh_dport)) {
375 udpipaddr_print(ndo, ip, -1, -1);
376 ND_PRINT((ndo, "[|udp]"));
380 sport = EXTRACT_16BITS(&up->uh_sport);
381 dport = EXTRACT_16BITS(&up->uh_dport);
383 if (length < sizeof(struct udphdr)) {
384 udpipaddr_print(ndo, ip, sport, dport);
385 ND_PRINT((ndo, "truncated-udp %d", length));
388 length -= sizeof(struct udphdr);
390 if (cp > ndo->ndo_snapend) {
391 udpipaddr_print(ndo, ip, sport, dport);
392 ND_PRINT((ndo, "[|udp]"));
396 ulen = EXTRACT_16BITS(&up->uh_ulen);
398 udpipaddr_print(ndo, ip, sport, dport);
399 ND_PRINT((ndo, "truncated-udplength %d", ulen));
402 if (ndo->ndo_packettype) {
403 register struct sunrpc_msg *rp;
404 enum sunrpc_msg_type direction;
406 switch (ndo->ndo_packettype) {
409 udpipaddr_print(ndo, ip, sport, dport);
410 vat_print(ndo, (void *)(up + 1), up);
414 udpipaddr_print(ndo, ip, sport, dport);
415 wb_print(ndo, (void *)(up + 1), length);
419 rp = (struct sunrpc_msg *)(up + 1);
420 direction = (enum sunrpc_msg_type)EXTRACT_32BITS(&rp->rm_direction);
421 if (direction == SUNRPC_CALL)
422 sunrpcrequest_print(ndo, (u_char *)rp, length,
425 nfsreply_print(ndo, (u_char *)rp, length,
426 (u_char *)ip); /*XXX*/
430 udpipaddr_print(ndo, ip, sport, dport);
431 rtp_print(ndo, (void *)(up + 1), length, up);
435 udpipaddr_print(ndo, ip, sport, dport);
437 cp = rtcp_print(ndo, cp, ep);
441 udpipaddr_print(ndo, ip, sport, dport);
442 snmp_print(ndo, (const u_char *)(up + 1), length);
446 udpipaddr_print(ndo, ip, sport, dport);
447 cnfp_print(ndo, cp, (const u_char *)ip);
451 udpipaddr_print(ndo, ip, sport, dport);
452 tftp_print(ndo, cp, length);
456 udpipaddr_print(ndo, ip, sport, dport);
457 aodv_print(ndo, (const u_char *)(up + 1), length,
466 udpipaddr_print(ndo, ip, sport, dport);
467 radius_print(ndo, cp, length);
471 udpipaddr_print(ndo, ip, sport, dport);
472 vxlan_print(ndo, (const u_char *)(up + 1), length);
477 udpipaddr_print(ndo, ip, sport, dport);
478 pgm_print(ndo, cp, length, bp2);
481 udpipaddr_print(ndo, ip, sport, dport);
482 lmp_print(ndo, cp, length);
488 udpipaddr_print(ndo, ip, sport, dport);
489 if (!ndo->ndo_qflag) {
490 register struct sunrpc_msg *rp;
491 enum sunrpc_msg_type direction;
493 rp = (struct sunrpc_msg *)(up + 1);
494 if (ND_TTEST(rp->rm_direction)) {
495 direction = (enum sunrpc_msg_type)EXTRACT_32BITS(&rp->rm_direction);
496 if (dport == NFS_PORT && direction == SUNRPC_CALL) {
497 ND_PRINT((ndo, "NFS request xid %u ", EXTRACT_32BITS(&rp->rm_xid)));
498 nfsreq_print_noaddr(ndo, (u_char *)rp, length,
502 if (sport == NFS_PORT && direction == SUNRPC_REPLY) {
503 ND_PRINT((ndo, "NFS reply xid %u ", EXTRACT_32BITS(&rp->rm_xid)));
504 nfsreply_print_noaddr(ndo, (u_char *)rp, length,
509 if (dport == SUNRPC_PORT && direction == SUNRPC_CALL) {
510 sunrpcrequest_print((u_char *)rp, length, (u_char *)ip);
515 if (ND_TTEST(((struct LAP *)cp)->type) &&
516 ((struct LAP *)cp)->type == lapDDP &&
517 (atalk_port(sport) || atalk_port(dport))) {
519 ND_PRINT((ndo, "kip "));
520 llap_print(ndo, cp, length);
525 if (ndo->ndo_vflag && !ndo->ndo_Kflag && !fragmented) {
526 /* Check the checksum, if possible. */
527 uint16_t sum, udp_sum;
530 * XXX - do this even if vflag == 1?
531 * TCP does, and we do so for UDP-over-IPv6.
533 if (IP_V(ip) == 4 && (ndo->ndo_vflag > 1)) {
534 udp_sum = EXTRACT_16BITS(&up->uh_sum);
536 ND_PRINT((ndo, "[no cksum] "));
537 } else if (ND_TTEST2(cp[0], length)) {
538 sum = udp_cksum(ndo, ip, up, length + sizeof(struct udphdr));
541 ND_PRINT((ndo, "[bad udp cksum 0x%04x -> 0x%04x!] ",
543 in_cksum_shouldbe(udp_sum, sum)));
545 ND_PRINT((ndo, "[udp sum ok] "));
549 else if (IP_V(ip) == 6 && ip6->ip6_plen) {
550 /* for IPv6, UDP checksum is mandatory */
551 if (ND_TTEST2(cp[0], length)) {
552 sum = udp6_cksum(ip6, up, length + sizeof(struct udphdr));
553 udp_sum = EXTRACT_16BITS(&up->uh_sum);
556 ND_PRINT((ndo, "[bad udp cksum 0x%04x -> 0x%04x!] ",
558 in_cksum_shouldbe(udp_sum, sum)));
560 ND_PRINT((ndo, "[udp sum ok] "));
566 if (!ndo->ndo_qflag) {
567 #define ISPORT(p) (dport == (p) || sport == (p))
568 if (ISPORT(NAMESERVER_PORT))
569 ns_print(ndo, (const u_char *)(up + 1), length, 0);
570 else if (ISPORT(MULTICASTDNS_PORT))
571 ns_print(ndo, (const u_char *)(up + 1), length, 1);
572 else if (ISPORT(TIMED_PORT))
573 timed_print(ndo, (const u_char *)(up + 1));
574 else if (ISPORT(TFTP_PORT))
575 tftp_print(ndo, (const u_char *)(up + 1), length);
576 else if (ISPORT(IPPORT_BOOTPC) || ISPORT(IPPORT_BOOTPS))
577 bootp_print(ndo, (const u_char *)(up + 1), length);
578 else if (ISPORT(RIP_PORT))
579 rip_print(ndo, (const u_char *)(up + 1), length);
580 else if (ISPORT(AODV_PORT))
581 aodv_print(ndo, (const u_char *)(up + 1), length,
587 else if (ISPORT(ISAKMP_PORT))
588 isakmp_print(ndo, (const u_char *)(up + 1), length, bp2);
589 else if (ISPORT(ISAKMP_PORT_NATT))
590 isakmp_rfc3948_print(ndo, (const u_char *)(up + 1), length, bp2);
592 else if (ISPORT(ISAKMP_PORT_USER1) || ISPORT(ISAKMP_PORT_USER2))
593 isakmp_print(ndo, (const u_char *)(up + 1), length, bp2);
595 else if (ISPORT(SNMP_PORT) || ISPORT(SNMPTRAP_PORT))
596 snmp_print(ndo, (const u_char *)(up + 1), length);
597 else if (ISPORT(NTP_PORT))
598 ntp_print(ndo, (const u_char *)(up + 1), length);
599 else if (ISPORT(KERBEROS_PORT) || ISPORT(KERBEROS_SEC_PORT))
600 krb_print(ndo, (const void *)(up + 1));
601 else if (ISPORT(L2TP_PORT))
602 l2tp_print(ndo, (const u_char *)(up + 1), length);
603 #ifdef TCPDUMP_DO_SMB
604 else if (ISPORT(NETBIOS_NS_PORT))
605 nbt_udp137_print(ndo, (const u_char *)(up + 1), length);
606 else if (ISPORT(NETBIOS_DGRAM_PORT))
607 nbt_udp138_print(ndo, (const u_char *)(up + 1), length);
609 else if (dport == VAT_PORT)
610 vat_print(ndo, (const void *)(up + 1), up);
611 else if (ISPORT(ZEPHYR_SRV_PORT) || ISPORT(ZEPHYR_CLT_PORT))
612 zephyr_print(ndo, (const void *)(up + 1), length);
614 * Since there are 10 possible ports to check, I think
615 * a <> test would be more efficient
617 else if ((sport >= RX_PORT_LOW && sport <= RX_PORT_HIGH) ||
618 (dport >= RX_PORT_LOW && dport <= RX_PORT_HIGH))
619 rx_print(ndo, (const void *)(up + 1), length, sport, dport,
622 else if (ISPORT(RIPNG_PORT))
623 ripng_print(ndo, (const u_char *)(up + 1), length);
624 else if (ISPORT(DHCP6_SERV_PORT) || ISPORT(DHCP6_CLI_PORT))
625 dhcp6_print(ndo, (const u_char *)(up + 1), length);
626 else if (ISPORT(AHCP_PORT))
627 ahcp_print(ndo, (const u_char *)(up + 1), length);
628 else if (ISPORT(BABEL_PORT) || ISPORT(BABEL_PORT_OLD))
629 babel_print(ndo, (const u_char *)(up + 1), length);
632 * Kludge in test for whiteboard packets.
634 else if (dport == WB_PORT)
635 wb_print(ndo, (const void *)(up + 1), length);
636 else if (ISPORT(CISCO_AUTORP_PORT))
637 cisco_autorp_print(ndo, (const void *)(up + 1), length);
638 else if (ISPORT(RADIUS_PORT) ||
639 ISPORT(RADIUS_NEW_PORT) ||
640 ISPORT(RADIUS_ACCOUNTING_PORT) ||
641 ISPORT(RADIUS_NEW_ACCOUNTING_PORT) )
642 radius_print(ndo, (const u_char *)(up+1), length);
643 else if (dport == HSRP_PORT)
644 hsrp_print(ndo, (const u_char *)(up + 1), length);
645 else if (ISPORT(LWRES_PORT))
646 lwres_print(ndo, (const u_char *)(up + 1), length);
647 else if (ISPORT(LDP_PORT))
648 ldp_print(ndo, (const u_char *)(up + 1), length);
649 else if (ISPORT(OLSR_PORT))
650 olsr_print(ndo, (const u_char *)(up + 1), length,
652 (IP_V(ip) == 6) ? 1 : 0);
656 else if (ISPORT(MPLS_LSP_PING_PORT))
657 lspping_print(ndo, (const u_char *)(up + 1), length);
658 else if (dport == BFD_CONTROL_PORT ||
659 dport == BFD_ECHO_PORT )
660 bfd_print(ndo, (const u_char *)(up+1), length, dport);
661 else if (ISPORT(LMP_PORT))
662 lmp_print(ndo, (const u_char *)(up + 1), length);
663 else if (ISPORT(VQP_PORT))
664 vqp_print(ndo, (const u_char *)(up + 1), length);
665 else if (ISPORT(SFLOW_PORT))
666 sflow_print(ndo, (const u_char *)(up + 1), length);
667 else if (dport == LWAPP_CONTROL_PORT)
668 lwapp_control_print(ndo, (const u_char *)(up + 1), length, 1);
669 else if (sport == LWAPP_CONTROL_PORT)
670 lwapp_control_print(ndo, (const u_char *)(up + 1), length, 0);
671 else if (ISPORT(LWAPP_DATA_PORT))
672 lwapp_data_print(ndo, (const u_char *)(up + 1), length);
673 else if (ISPORT(SIP_PORT))
674 sip_print(ndo, (const u_char *)(up + 1), length);
675 else if (ISPORT(SYSLOG_PORT))
676 syslog_print(ndo, (const u_char *)(up + 1), length);
677 else if (ISPORT(OTV_PORT))
678 otv_print(ndo, (const u_char *)(up + 1), length);
679 else if (ISPORT(VXLAN_PORT))
680 vxlan_print(ndo, (const u_char *)(up + 1), length);
682 ND_PRINT((ndo, "UDP, length %u",
683 (uint32_t)(ulen - sizeof(*up))));
686 ND_PRINT((ndo, "UDP, length %u", (uint32_t)(ulen - sizeof(*up))));
692 * c-style: whitesmith