3 * Routines for TPKT dissection
4 * Copyright 2000, Philips Electronics N.V.
5 * Andreas Sikkema <andreas.sikkema@philips.com>
7 * Ethereal - Network traffic analyzer
8 * By Gerald Combs <gerald@zing.org>
9 * Copyright 1998 Gerald Combs
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version 2
15 * of the License, or (at your option) any later version.
17 * This program is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, write to the Free Software
24 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
28 * This dissector tries to dissect the TPKT protocol according to
31 * IMPORTANT IMPORTANT IMPORTANT IMPORTANT IMPORTANT IMPORTANT IMPORTANT
33 * Please examine the dissector. It is NOT defined in the normal way!
34 * Some variables are references and the dissector also returns a
35 * value! And no, this is not a heuristic dissector!
37 * IMPORTANT IMPORTANT IMPORTANT IMPORTANT IMPORTANT IMPORTANT IMPORTANT
48 #ifdef HAVE_SYS_TYPES_H
49 # include <sys/types.h>
52 #ifdef HAVE_NETINET_IN_H
53 # include <netinet/in.h>
59 #include "packet-tpkt.h"
61 /* TPKT header fields */
62 static int proto_tpkt = -1;
63 static int hf_tpkt_version = -1;
64 static int hf_tpkt_reserved = -1;
65 static int hf_tpkt_length = -1;
67 /* TPKT fields defining a sub tree */
68 static gint ett_tpkt = -1;
71 is_tpkt( tvbuff_t *tvb, unsigned int* offset )
73 if ( (*offset) + 4 > tvb_length( tvb ) ) return FALSE;
74 if ( ! ( ( tvb_get_guint8( tvb, ( *offset ) ) == 3 ) &&
75 ( tvb_get_guint8( tvb, ( *offset ) + 1 ) == 0 ) ) ) return FALSE;
81 dissect_tpkt( tvbuff_t *tvb, unsigned int* offset, packet_info *pinfo, proto_tree *tree )
83 proto_item *ti = NULL;
84 proto_tree *tpkt_tree = NULL;
85 unsigned int data_len = 0;
88 pinfo->current_proto = "TPKT";
90 /* There should at least be 4 bytes left in the frame */
91 if ( (*offset) + 4 > tvb_length( tvb ) ) return -1;
93 * The first octet should be 3 and the second one should be 0
94 * The H.323 implementers guide suggests that this migh not
95 * always be the case....
97 if ( ! ( ( tvb_get_guint8( tvb, ( *offset ) ) == 3 ) &&
98 ( tvb_get_guint8( tvb, ( *offset ) + 1 ) == 0 ) ) ) return -1;
100 if ( check_col( pinfo->fd, COL_PROTOCOL ) ) {
101 col_set_str( pinfo->fd, COL_PROTOCOL, "TPKT" );
104 if ( check_col( pinfo->fd, COL_INFO) ) {
105 /*data_len = pntohs( &pd[ (*offset) + 2 ] );*/
106 data_len = tvb_get_ntohs( tvb, (*offset) + 2 );
108 col_add_fstr( pinfo->fd, COL_INFO, "TPKT Data length = %d", data_len );
112 ti = proto_tree_add_item( tree, proto_tpkt, tvb, (*offset), 4, FALSE );
113 tpkt_tree = proto_item_add_subtree( ti, ett_tpkt );
114 /* Version 1st octet */
115 proto_tree_add_item( tpkt_tree, hf_tpkt_version, tvb, (*offset), 1, FALSE );
118 proto_tree_add_item( tpkt_tree, hf_tpkt_reserved, tvb, (*offset), 1, FALSE );
124 /* Length, two octets */
125 /*data_len = pntohs( &pd[ (*offset) ] );*/
126 data_len = tvb_get_ntohs( tvb, (*offset) );
129 proto_tree_add_uint_format( tpkt_tree, hf_tpkt_length, tvb, (*offset), 2, data_len, "Length: %d", data_len );
136 proto_register_tpkt(void)
138 static hf_register_info hf[] =
184 proto_tpkt = proto_register_protocol("TPKT", "TPKT", "tpkt");
185 proto_register_field_array(proto_tpkt, hf, array_length(hf));
186 proto_register_subtree_array(ett, array_length(ett));