mirrors/tcpdump
0
0
Fork 0
mirror of https://github.com/the-tcpdump-group/tcpdump.git synced 2024-11-27 12:03:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

Handle DLT_NULL correctly - the AF_ value is in host byte order, which

Browse Source 
may not be *our* byte order if we're reading a capture file from another
machine; we currently handle that by checking whether it looks like an
integer < 65536 or not and, if it's not, byte-swap it.

This also lets us handle OpenBSD DLT_LOOP as well - it's like DLT_NULL
except that the AF_ value is in *network* byte order.

(Old-style Linux loopback captures were also DLT_NULL, but the header
had an Ethernet type in it; there have also been captures where the
header was a PPP header.  For now, we just continue to assume that all
DLT_NULL packets are IP, and check the IP version field to decide
whether it's IPv4, IPv6, or something else.

We may want to consider adopting Ethereal's heuristics, which would at
least mean we wouldn't be reporting bogus packet types for old-style
Linux loopback captures and those weird PPP - ISDN4BSD? - captures,
although the version of libpcap that goes with this version of tcpdump
doesn't produce bogus DLT_NULL captures for Linux loopback devices.)
This commit is contained in:
guy 2000-12-16 22:00:50 +00:00
parent 86eb0bec35
commit aa22569a90
2 changed files with 39 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
print-null.c
View File

@ -21,7 +21,7 @@
#ifndef lint
static const char rcsid[] =
"@(#) $Header: /tcpdump/master/tcpdump/print-null.c,v 1.39 2000-12-04 06:47:17 guy Exp $ (LBL)";
"@(#) $Header: /tcpdump/master/tcpdump/print-null.c,v 1.40 2000-12-16 22:00:50 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
@ -56,20 +56,22 @@ struct rtentry;
#endif
/*
* The DLT_NULL packet header is 4 bytes long. It contains a network
* order 32 bit integer that specifies the family, e.g. AF_INET
* The DLT_NULL packet header is 4 bytes long. It contains a host-byte-order
* 32-bit integer that specifies the family, e.g. AF_INET.
*
* Note here that "host" refers to the host on which the packets were
* captured; that isn't necessarily *this* host.
*
* The OpenBSD DLT_LOOP packet header is the same, except that the integer
* is in network byte order.
*/
#define NULL_HDRLEN 4
static void
null_print(const u_char *p, const struct ip *ip, u_int length)
null_print(u_int family, u_int length)
{
u_int family;
memcpy((char *)&family, (char *)p, sizeof(family));
if (nflag)
printf("AF %d ", family);
printf("AF %u ", family);
else {
switch (family) {
@ -88,22 +90,44 @@ null_print(const u_char *p, const struct ip *ip, u_int length)
break;
default:
printf("AF %d ", family);
printf("AF %u ", family);
break;
}
}
printf("%d: ", length);
}
/*
* Byte-swap a 32-bit number.
* ("htonl()" or "ntohl()" won't work - we want to byte-swap even on
* big-endian platforms.)
*/
#define SWAPLONG(y) \
((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
void
null_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
{
u_int length = h->len;
u_int caplen = h->caplen;
const struct ip *ip;
u_int family;
ts_print(&h->ts);
memcpy((char *)&family, (char *)p, sizeof(family));
/*
* This isn't necessarily in our host byte order; if this is
* a DLT_LOOP capture, it's in network byte order, and if
* this is a DLT_NULL capture from a machine with the opposite
* byte-order, it's in the opposite byte order from ours.
*
* If the upper 16 bits aren't all zero, assume it's byte-swapped.
*/
if ((family & 0xFFFF0000) != 0)
family = SWAPLONG(family);
/*
* Some printers want to get back at the link level addresses,
* and/or check that they're not walking off the end of the packet.
@ -117,7 +141,7 @@ null_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
ip = (struct ip *)(p + NULL_HDRLEN);
if (eflag)
null_print(p, ip, length);
null_print(family, length);
switch (IP_V(ip)) {
case 4:

5
tcpdump.c
View File

@ -24,7 +24,7 @@ static const char copyright[] =
"@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997\n\
The Regents of the University of California. All rights reserved.\n";
static const char rcsid[] =
"@(#) $Header: /tcpdump/master/tcpdump/tcpdump.c,v 1.156 2000-12-09 02:58:48 fenner Exp $ (LBL)";
"@(#) $Header: /tcpdump/master/tcpdump/tcpdump.c,v 1.157 2000-12-16 22:00:50 guy Exp $ (LBL)";
#endif
/*
@ -116,6 +116,9 @@ static struct printer printers[] = {
{ ppp_bsdos_if_print, DLT_PPP_BSDOS },
{ fddi_if_print, DLT_FDDI },
{ null_if_print, DLT_NULL },
#ifdef DLT_LOOP
{ null_if_print, DLT_LOOP },
#endif
{ raw_if_print, DLT_RAW },
{ atm_if_print, DLT_ATM_RFC1483 },
#ifdef DLT_C_HDLC