epan/dissectors/packet-cisco-marker.c

   1 /* packet-cisco-marker.c
   2  * Routines for CISCO's ERSPAN3 Marker Packet
   3  * See: http://www.cisco.com/c/en/us/products/collateral/switches/nexus-9000-series-switches/white-paper-c11-733921.html#_Toc413144488
   4  * Copyright 2015, Peter Membrey
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * Copied from packet-time.c
  11  *
  12  * SPDX-License-Identifier: GPL-2.0-or-later
  13  */
  14
  15 #define NEW_PROTO_TREE_API
  16
  17 #include "config.h"
  18
  19 #include <epan/packet.h>
  20
  21 void proto_register_erspan_marker(void);
  22 void proto_reg_handoff_erspan_marker(void);
  23
  24
  25 static dissector_handle_t marker_handle;
  26
  27 static header_field_info *hfi_marker = NULL;
  28
  29
  30 #define CISCO_ERSPAN_MARKER_HFI_INIT HFI_INIT(proto_marker)
  31
  32 static header_field_info cisco_erspan_prop_header CISCO_ERSPAN_MARKER_HFI_INIT =
  33 { "Proprietary CISCO Header", "cisco_erspan_marker.prop_header",
  34   FT_BYTES, BASE_NONE, NULL, 0x0,
  35   NULL, HFILL };
  36
  37 static header_field_info cisco_erspan_info CISCO_ERSPAN_MARKER_HFI_INIT =
  38 { "Header", "cisco_erspan_marker.header",
  39   FT_BOOLEAN, 8, NULL, 0x0,
  40   NULL, HFILL };
  41
  42 static header_field_info cisco_erspan_version CISCO_ERSPAN_MARKER_HFI_INIT =
  43 { "Version", "cisco_erspan_marker.version",
  44   FT_UINT16, BASE_DEC, NULL, 0x0f00,
  45   NULL, HFILL };
  46
  47 static header_field_info cisco_erspan_type CISCO_ERSPAN_MARKER_HFI_INIT =
  48 { "Type", "cisco_erspan_marker.type",
  49   FT_UINT16, BASE_DEC, NULL, 0xf000,
  50   NULL, HFILL };
  51
  52 static header_field_info cisco_erspan_ssid CISCO_ERSPAN_MARKER_HFI_INIT =
  53 { "SSID", "cisco_erspan_marker.ssid",
  54   FT_UINT16, BASE_DEC, NULL, 0x00ff,
  55   NULL, HFILL };
  56
  57 static header_field_info cisco_erspan_granularity CISCO_ERSPAN_MARKER_HFI_INIT =
  58 { "Granularity", "cisco_erspan_marker.granularity",
  59   FT_UINT16, BASE_DEC, NULL, 0xff00,
  60   NULL, HFILL };
  61
  62 static header_field_info cisco_erspan_utcoffset CISCO_ERSPAN_MARKER_HFI_INIT =
  63 { "UTC Offset", "cisco_erspan_marker.utc_offset",
  64   FT_UINT16, BASE_DEC, NULL, 0x00ff,
  65   NULL, HFILL };
  66
  67 static header_field_info cisco_erspan_timestamp CISCO_ERSPAN_MARKER_HFI_INIT =
  68 { "Timestamp", "cisco_erspan_marker.timestamp",
  69   FT_UINT32, BASE_DEC, NULL, 0xffffffff,
  70   NULL, HFILL };
  71
  72 static header_field_info cisco_erspan_utc_sec CISCO_ERSPAN_MARKER_HFI_INIT =
  73 { "UTC Seconds", "cisco_erspan_marker.utc_sec",
  74   FT_UINT32, BASE_DEC, NULL, 0xffffffff,
  75   NULL, HFILL };
  76
  77 static header_field_info cisco_erspan_utc_usec CISCO_ERSPAN_MARKER_HFI_INIT =
  78 { "UTC Microseconds", "cisco_erspan_marker.utc_usec",
  79   FT_UINT32, BASE_DEC, NULL, 0xffffffff,
  80   NULL, HFILL };
  81
  82 static header_field_info cisco_erspan_sequence_number CISCO_ERSPAN_MARKER_HFI_INIT =
  83 { "Sequence Number", "cisco_erspan_marker.sequence_number",
  84   FT_UINT32, BASE_DEC, NULL, 0xffffffff,
  85   NULL, HFILL };
  86
  87 static header_field_info cisco_erspan_reserved CISCO_ERSPAN_MARKER_HFI_INIT =
  88 { "Reserved", "cisco_erspan_marker.sequence_number",
  89   FT_UINT32, BASE_DEC, NULL, 0xffffffff,
  90   NULL, HFILL };
  91
  92 static header_field_info cisco_erspan_tail CISCO_ERSPAN_MARKER_HFI_INIT =
  93 { "TAIL", "cisco_erspan_marker.tail",
  94   FT_UINT32, BASE_DEC, NULL, 0xffffffff,
  95   NULL, HFILL };
  96
  97
  98
  99
 100
 101 static gint ett_marker = -1;
 102
 103
 104 static int
 105 dissect_marker(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 106 {
 107   proto_tree    *marker_tree;
 108   proto_item    *ti;
 109
 110   col_set_str(pinfo->cinfo, COL_PROTOCOL, "CISCO ERSPAN3 MARKER");
 111
 112
 113   if (tree) {
 114
 115     /* Skip the proprietary CISCO header - no docs have been released for this */
 116     guint32 offset = 20;
 117
 118     ti = proto_tree_add_item(tree, hfi_marker, tvb, 0, -1, ENC_NA);
 119     marker_tree = proto_item_add_subtree(ti, ett_marker);
 120
 121     proto_tree_add_item(marker_tree, &cisco_erspan_prop_header, tvb, 0, 20, ENC_LITTLE_ENDIAN);
 122     proto_tree_add_item(marker_tree, &cisco_erspan_info, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 123     offset += 2;
 124
 125     proto_tree_add_item(marker_tree, &cisco_erspan_version, tvb, offset, 2, ENC_BIG_ENDIAN);
 126     proto_tree_add_item(marker_tree, &cisco_erspan_type, tvb, offset, 2, ENC_BIG_ENDIAN);
 127     proto_tree_add_item(marker_tree, &cisco_erspan_ssid, tvb, offset, 2, ENC_BIG_ENDIAN);
 128     offset += 2;
 129
 130     proto_tree_add_item(marker_tree, &cisco_erspan_granularity, tvb, offset, 2, ENC_BIG_ENDIAN);
 131     proto_tree_add_item(marker_tree, &cisco_erspan_utcoffset, tvb, offset, 2, ENC_BIG_ENDIAN);
 132     offset+= 2;
 133
 134     proto_tree_add_item(marker_tree, &cisco_erspan_timestamp, tvb, offset, 4, ENC_BIG_ENDIAN);
 135     offset+=4;
 136
 137     proto_tree_add_item(marker_tree, &cisco_erspan_utc_sec, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 138     offset+=4;
 139
 140     proto_tree_add_item(marker_tree, &cisco_erspan_utc_usec, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 141     offset+=4;
 142
 143     proto_tree_add_item(marker_tree, &cisco_erspan_sequence_number, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 144     offset+=4;
 145
 146     proto_tree_add_item(marker_tree, &cisco_erspan_reserved, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 147     offset+=4;
 148
 149     proto_tree_add_item(marker_tree, &cisco_erspan_tail, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 150   }
 151   return tvb_captured_length(tvb);
 152 }
 153
 154
 155 void
 156 proto_register_erspan_marker(void)
 157 {
 158
 159
 160 #ifndef HAVE_HFI_SECTION_INIT
 161   static header_field_info *hfi[] = {
 162     &cisco_erspan_prop_header,
 163     &cisco_erspan_info,
 164     &cisco_erspan_version,
 165     &cisco_erspan_type,
 166     &cisco_erspan_ssid,
 167     &cisco_erspan_granularity,
 168     &cisco_erspan_utcoffset,
 169     &cisco_erspan_timestamp,
 170     &cisco_erspan_utc_sec,
 171     &cisco_erspan_utc_usec,
 172     &cisco_erspan_sequence_number,
 173     &cisco_erspan_reserved,
 174     &cisco_erspan_tail
 175   };
 176 #endif
 177
 178   static gint *ett[] = {
 179     &ett_marker,
 180   };
 181
 182   int proto_marker;
 183
 184
 185
 186   proto_marker = proto_register_protocol("CISCO ERSPAN3 Marker Packet", "CISCO3 ERSPAN MARKER", "cisco-erspan3-marker");
 187
 188   hfi_marker = proto_registrar_get_nth(proto_marker);
 189
 190   proto_register_fields(proto_marker, hfi, array_length(hfi));
 191   proto_register_subtree_array(ett, array_length(ett));
 192
 193   marker_handle = create_dissector_handle(dissect_marker, proto_marker);
 194 }
 195
 196 void
 197 proto_reg_handoff_erspan_marker(void)
 198 {
 199   dissector_add_for_decode_as_with_preference("udp.port", marker_handle);
 200 }
 201
 202 /*
 203  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 204  *
 205  * Local Variables:
 206  * c-basic-offset: 2
 207  * tab-width: 8
 208  * indent-tabs-mode: nil
 209  * End:
 210  *
 211  * ex: set shiftwidth=2 tabstop=8 expandtab:
 212  * :indentSize=2:tabSize=8:noTabs=true:
 213  */