2 * Routines for IGRP dissection
3 * Copyright 2000, Paul Ionescu <paul@acorp.ro>
7 * http://www.cisco.com/en/US/tech/tk365/technologies_white_paper09186a00800c8ae1.shtml
11 * Wireshark - Network traffic analyzer
12 * By Gerald Combs <gerald@wireshark.org>
13 * Copyright 1998 Gerald Combs
15 * Copied from packet-syslog.c
17 * This program is free software; you can redistribute it and/or
18 * modify it under the terms of the GNU General Public License
19 * as published by the Free Software Foundation; either version 2
20 * of the License, or (at your option) any later version.
22 * This program is distributed in the hope that it will be useful,
23 * but WITHOUT ANY WARRANTY; without even the implied warranty of
24 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25 * GNU General Public License for more details.
27 * You should have received a copy of the GNU General Public License
28 * along with this program; if not, write to the Free Software
29 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
42 #include <epan/packet.h>
43 #include <epan/ipproto.h>
45 #define IGRP_HEADER_LENGTH 12
46 #define IGRP_ENTRY_LENGTH 14
48 static gint proto_igrp = -1;
49 static gint hf_igrp_update = -1;
50 static gint hf_igrp_as = -1;
52 static gint ett_igrp = -1;
53 static gint ett_igrp_vektor = -1;
54 static gint ett_igrp_net = -1;
56 static void dissect_vektor_igrp (tvbuff_t *tvb, proto_tree *igrp_vektor_tree, guint8 network);
58 static void dissect_igrp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
60 guint8 ver_and_opcode,version,opcode,network;
61 gint offset=IGRP_HEADER_LENGTH;
62 guint16 ninterior,nsystem,nexterior;
65 proto_tree *igrp_tree, *igrp_vektor_tree;
68 if (check_col(pinfo->cinfo, COL_PROTOCOL))
69 col_set_str(pinfo->cinfo, COL_PROTOCOL, "IGRP");
70 if (check_col(pinfo->cinfo, COL_INFO))
71 col_clear(pinfo->cinfo, COL_INFO);
73 ver_and_opcode = tvb_get_guint8(tvb,0);
76 if (check_col(pinfo->cinfo, COL_INFO)) {
77 switch (ver_and_opcode) {
79 col_set_str(pinfo->cinfo, COL_INFO, "Response" );
82 col_set_str(pinfo->cinfo, COL_INFO, "Request" );
85 col_set_str(pinfo->cinfo, COL_INFO, "Unknown version or opcode");
93 ti = proto_tree_add_protocol_format(tree, proto_igrp, tvb, 0, -1,
96 igrp_tree = proto_item_add_subtree(ti, ett_igrp);
98 version = (ver_and_opcode&0xf0)>>4 ; /* version is the fist half of the byte */
99 opcode = ver_and_opcode&0x0f ; /* opcode is the last half of the byte */
101 proto_tree_add_text(igrp_tree, tvb, 0,1,"IGRP Version : %d %s",version,(version==1?" ":" - Unknown Version, The dissection may be inaccurate"));
102 proto_tree_add_text(igrp_tree, tvb, 0,1,"Command : %d %s",opcode,(opcode==1?"(Response)":"(Request)"));
103 proto_tree_add_item(igrp_tree, hf_igrp_update, tvb, 1,1, FALSE);
104 proto_tree_add_item(igrp_tree, hf_igrp_as, tvb, 2,2, FALSE);
106 ninterior = tvb_get_ntohs(tvb,4);
107 nsystem = tvb_get_ntohs(tvb,6);
108 nexterior = tvb_get_ntohs(tvb,8);
110 /* this is a ugly hack to find the first byte of the IP source address */
111 if (pinfo->net_src.type == AT_IPv4) {
112 ipsrc = pinfo->net_src.data;
115 network = 0; /* XXX - shouldn't happen */
117 ti = proto_tree_add_text(igrp_tree, tvb, 4,2,"Interior routes : %d",ninterior);
118 for( ; ninterior>0 ; ninterior-- ) {
119 igrp_vektor_tree = proto_item_add_subtree(ti,ett_igrp_vektor);
120 next_tvb = tvb_new_subset(tvb, offset, IGRP_ENTRY_LENGTH, -1);
121 dissect_vektor_igrp (next_tvb,igrp_vektor_tree,network);
122 offset+=IGRP_ENTRY_LENGTH;
125 ti = proto_tree_add_text(igrp_tree, tvb, 6,2,"System routes : %d",nsystem);
126 for( ; nsystem>0 ; nsystem-- ) {
127 igrp_vektor_tree = proto_item_add_subtree(ti,ett_igrp_vektor);
128 next_tvb = tvb_new_subset(tvb, offset, IGRP_ENTRY_LENGTH, -1);
129 dissect_vektor_igrp (next_tvb,igrp_vektor_tree,0);
130 offset+=IGRP_ENTRY_LENGTH;
133 ti = proto_tree_add_text(igrp_tree, tvb, 8,2,"Exterior routes : %d",nexterior);
134 for( ; nexterior>0 ; nexterior-- ) {
135 igrp_vektor_tree = proto_item_add_subtree(ti,ett_igrp_vektor);
136 next_tvb = tvb_new_subset(tvb, offset, IGRP_ENTRY_LENGTH, -1);
137 dissect_vektor_igrp (next_tvb,igrp_vektor_tree,0);
138 offset+=IGRP_ENTRY_LENGTH;
141 proto_tree_add_text(igrp_tree, tvb, 10,2,"Checksum = 0x%4x",tvb_get_ntohs(tvb,10));
145 static void dissect_vektor_igrp (tvbuff_t *tvb, proto_tree *igrp_vektor_tree, guint8 network)
148 guint8 *ptr_addr,addr[5];
151 addr[1]=tvb_get_guint8(tvb,0);
152 addr[2]=tvb_get_guint8(tvb,1);
153 addr[3]=tvb_get_guint8(tvb,2);
157 if (network==0) ptr_addr=&addr[1];
159 ti = proto_tree_add_text (igrp_vektor_tree, tvb, 0 ,14,
160 "Entry for network %s", ip_to_str(ptr_addr)) ;
161 igrp_vektor_tree = proto_item_add_subtree(ti,ett_igrp_net);
162 proto_tree_add_text (igrp_vektor_tree, tvb, 0 ,3,"Network = %s",ip_to_str(ptr_addr)) ;
163 proto_tree_add_text (igrp_vektor_tree, tvb, 3 ,3,"Delay = %d",tvb_get_ntoh24(tvb,3)) ;
164 proto_tree_add_text (igrp_vektor_tree, tvb, 6 ,3,"Bandwidth = %d",tvb_get_ntoh24(tvb,6)) ;
165 proto_tree_add_text (igrp_vektor_tree, tvb, 9 ,2,"MTU = %d bytes",tvb_get_ntohs(tvb,9)) ;
166 proto_tree_add_text (igrp_vektor_tree, tvb, 11,1,"Reliability = %d",tvb_get_guint8(tvb,11)) ;
167 proto_tree_add_text (igrp_vektor_tree, tvb, 12,1,"Load = %d",tvb_get_guint8(tvb,12)) ;
168 proto_tree_add_text (igrp_vektor_tree, tvb, 13,1,"Hop count = %d hops",tvb_get_guint8(tvb,13)) ;
172 /* Register the protocol with Wireshark */
173 void proto_register_igrp(void)
176 /* Setup list of header fields */
177 static hf_register_info hf[] = {
180 { "Update Release", "igrp.update",
181 FT_UINT8, BASE_DEC, NULL, 0x0 ,
182 "Update Release number", HFILL }
185 { "Autonomous System", "igrp.as",
186 FT_UINT16, BASE_DEC, NULL, 0x0 ,
187 "Autonomous System number", HFILL }
191 /* Setup protocol subtree array */
192 static gint *ett[] = {
198 /* Register the protocol name and description */
199 proto_igrp = proto_register_protocol("Cisco Interior Gateway Routing Protocol",
202 /* Required function calls to register the header fields and subtrees used */
203 proto_register_field_array(proto_igrp, hf, array_length(hf));
204 proto_register_subtree_array(ett, array_length(ett));
208 proto_reg_handoff_igrp(void)
210 dissector_handle_t igrp_handle;
212 igrp_handle = create_dissector_handle(dissect_igrp, proto_igrp);
213 dissector_add("ip.proto", IP_PROTO_IGRP, igrp_handle);
216 /* IGRP Packet structure:
218 HEADER structure + k * VECTOR structure
219 where: k = (Number of Interior routes) + (Number of System routes) + (Number of Exterior routes)
221 HEADER structure is 12 bytes as follows :
223 4 bits Version (only version 1 is defined)
224 4 bits Opcode (1=Replay, 2=Request)
225 8 bits Update Release
226 16 bits Autonomous system number
227 16 bits Number of Interior routes
228 16 bits Number of System routes
229 16 bits Number of Exterior routes
234 VECTOR structure is 14 bytes as follows :
245 It is interesting how is coded an ip network address in 3 bytes because IGRP is a classful routing protocol:
246 If it is a interior route then this 3 bytes are the final bytes, and the first one is taken from the source ip address of the ip packet
247 If it is a system route or a exterior route then this 3 bytes are the first three and the last byte is not important
249 If the Delay is 0xFFFFFF then the network is unreachable