2 * Definitions for packet disassembly structures and routines
4 * $Id: packet.h,v 1.107 1999/10/14 01:28:28 guy Exp $
6 * Ethereal - Network traffic analyzer
7 * By Gerald Combs <gerald@zing.org>
8 * Copyright 1998 Gerald Combs
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version 2
14 * of the License, or (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
31 #include "wiretap/wtap.h"
38 /* Pointer versions of ntohs and ntohl. Given a pointer to a member of a
39 * byte array, returns the value of the two or four bytes at the pointer.
40 * The pletoh[sl] versions return the little-endian representation.
43 #define pntohs(p) ((guint16) \
44 ((guint16)*((guint8 *)p+0)<<8| \
45 (guint16)*((guint8 *)p+1)<<0))
47 #define pntohl(p) ((guint32)*((guint8 *)p+0)<<24| \
48 (guint32)*((guint8 *)p+1)<<16| \
49 (guint32)*((guint8 *)p+2)<<8| \
50 (guint32)*((guint8 *)p+3)<<0)
52 #define pletohs(p) ((guint16) \
53 ((guint16)*((guint8 *)p+1)<<8| \
54 (guint16)*((guint8 *)p+0)<<0))
56 #define pletohl(p) ((guint32)*((guint8 *)p+3)<<24| \
57 (guint32)*((guint8 *)p+2)<<16| \
58 (guint32)*((guint8 *)p+1)<<8| \
59 (guint32)*((guint8 *)p+0)<<0)
62 #define hi_nibble(b) ((b & 0xf0) >> 4)
63 #define lo_nibble(b) (b & 0x0f)
65 /* Useful when you have an array whose size you can tell at compile-time */
66 #define array_length(x) (sizeof x / sizeof x[0])
69 /* Useful when highlighting regions inside a dissect_*() function. With this
70 * macro, you can highlight from an arbitrary offset to the end of the
71 * packet (which may come before the end of the frame).
72 * See dissect_data() for an example.
74 #define END_OF_FRAME (pi.captured_len - offset)
76 /* Check whether the "len" bytes of data starting at "offset" is
77 * entirely inside the captured data for this packet. */
78 #define BYTES_ARE_IN_FRAME(offset, len) ((offset) + (len) <= pi.captured_len)
80 /* Check whether there's any data at all starting at "offset". */
81 #define IS_DATA_IN_FRAME(offset) ((offset) < pi.captured_len)
83 /* To pass one of two strings, singular or plural */
84 #define plurality(d,s,p) ((d) == 1 ? (s) : (p))
86 typedef struct _column_info {
87 gint num_cols; /* Number of columns */
88 gint *col_fmt; /* Format of column */
89 gboolean **fmt_matx; /* Specifies which formats apply to a column */
90 gint *col_width; /* Column widths to use during a "-S" capture */
91 gchar **col_title; /* Column titles */
92 gchar **col_data; /* Column data */
95 #define COL_MAX_LEN 256
97 typedef struct _packet_counts {
108 typedef struct _frame_data {
109 struct _frame_data *next; /* Next element in list */
110 guint32 num; /* Frame number */
111 guint32 pkt_len; /* Packet length */
112 guint32 cap_len; /* Amount actually captured */
113 guint32 rel_secs; /* Relative seconds */
114 guint32 rel_usecs; /* Relative microseconds */
115 guint32 abs_secs; /* Absolute seconds */
116 guint32 abs_usecs; /* Absolute microseconds */
117 guint32 del_secs; /* Delta seconds */
118 guint32 del_usecs; /* Delta microseconds */
119 long file_off; /* File offset */
120 column_info *cinfo; /* Column formatting information */
121 gint row; /* Row number for this packet in the display */
122 int lnk_t; /* Per-packet encapsulation/data-link type */
123 gboolean passed_dfilter; /* TRUE = display, FALSE = no display */
124 union pseudo_header pseudo_header; /* "pseudo-header" from wiretap */
127 typedef struct _packet_info {
140 extern packet_info pi;
142 /* Struct for the match_strval function */
144 typedef struct _value_string {
149 /* Struct for boolean enumerations */
150 typedef struct true_false_string {
156 /* Many of the structs and definitions below and in packet-*.c files
157 * were taken from include files in the Linux distribution. */
159 typedef struct tcp_extra_data {
165 /* Tree types. Each dissect_* routine should have one for each
166 add_subtree() call. */
189 ETT_IP_OPTION_TIMESTAMP,
202 ETT_NCP_REQUEST_FIELDS,
203 ETT_NCP_REPLY_FIELDS,
255 ETT_NBIPX_NAME_TYPE_FLAGS,
281 ETT_SMB_CAPABILITIES,
284 ETT_SMB_DESIREDACCESS,
287 ETT_SMB_OPENFUNCTION,
288 ETT_SMB_FILEATTRIBUTES,
304 ETT_LCP_ASYNC_MAP_OPT,
305 ETT_LCP_AUTHPROT_OPT,
306 ETT_LCP_QUALPROT_OPT,
307 ETT_LCP_MAGICNUM_OPT,
308 ETT_LCP_FCS_ALTERNATIVES_OPT,
309 ETT_LCP_NUMBERED_MODE_OPT,
310 ETT_LCP_CALLBACK_OPT,
311 ETT_LCP_MULTILINK_EP_DISC_OPT,
312 ETT_LCP_INTERNATIONALIZATION_OPT,
315 ETT_IPCP_IPADDRS_OPT,
316 ETT_IPCP_COMPRESSPROT_OPT,
318 ETT_RSVP_UNKNOWN_CLASS,
324 ETT_RSVP_TIME_VALUES,
329 ETT_RSVP_FILTER_SPEC,
330 ETT_RSVP_SENDER_TEMPLATE,
331 ETT_RSVP_SENDER_TSPEC,
335 ETT_RSVP_ADSPEC_SUBTREE1,
336 ETT_RSVP_ADSPEC_SUBTREE2,
337 ETT_RSVP_ADSPEC_SUBTREE3,
347 ETT_ATM_LANE_LC_FLAGS,
348 ETT_ATM_LANE_LC_LAN_DEST,
349 ETT_ATM_LANE_LC_LAN_DEST_RD,
364 NUM_TREE_TYPES /* last item number plus one */
367 /* TRUE if subtrees of an item of the specified type are to be expanded. */
368 extern gboolean tree_is_expanded[NUM_TREE_TYPES];
370 /* Utility routines used by packet*.c */
371 gchar* ether_to_str(const guint8 *);
372 gchar* ip_to_str(const guint8 *);
373 gchar* abs_time_to_str(struct timeval*);
374 gchar* rel_time_to_str(struct timeval*);
375 gchar* time_secs_to_str(guint32);
376 gchar* bytes_to_str(const guint8 *, int);
377 const u_char *find_line_end(const u_char *data, const u_char *dataend,
379 int get_token_len(const u_char *linep, const u_char *lineend,
380 const u_char **next_token);
381 gchar* format_text(const u_char *line, int len);
382 gchar* val_to_str(guint32, const value_string *, const char *);
383 gchar* match_strval(guint32, const value_string*);
384 char * decode_bitfield_value(char *buf, guint32 val, guint32 mask, int width);
385 const char *decode_boolean_bitfield(guint32 val, guint32 mask, int width,
386 const char *truedesc, const char *falsedesc);
387 const char *decode_enumerated_bitfield(guint32 val, guint32 mask, int width,
388 const value_string *tab, const char *fmt);
389 const char *decode_numeric_bitfield(guint32 val, guint32 mask, int width,
391 gint check_col(frame_data *, gint);
393 void col_add_fstr(frame_data *, gint, gchar *, ...)
394 __attribute__((format (printf, 3, 4)));
395 void col_append_fstr(frame_data *, gint, gchar *, ...)
396 __attribute__((format (printf, 3, 4)));
398 void col_add_fstr(frame_data *, gint, gchar *, ...);
399 void col_append_fstr(frame_data *, gint, gchar *, ...);
401 void col_add_str(frame_data *, gint, const gchar *);
402 void col_append_str(frame_data *, gint, gchar *);
405 void smb_init_protocol(void);
407 void dissect_packet(const u_char *, frame_data *, proto_tree *);
409 * Routines in packet-*.c
410 * Routines should take three args: packet data *, cap_len, packet_counts *
411 * They should never modify the packet data.
413 void capture_clip(const u_char *, guint32, packet_counts *);
414 void capture_eth(const u_char *, guint32, packet_counts *);
415 void capture_fddi(const u_char *, guint32, packet_counts *);
416 void capture_null(const u_char *, guint32, packet_counts *);
417 void capture_ppp(const u_char *, guint32, packet_counts *);
418 void capture_raw(const u_char *, guint32, packet_counts *);
419 void capture_tr(const u_char *, guint32, packet_counts *);
422 * Routines in packet-*.c
423 * Routines should take four args: packet data *, offset, cap_len,
425 * They should never modify the packet data.
427 void capture_netbios(const u_char *, int, guint32, packet_counts *);
428 void capture_llc(const u_char *, int, guint32, packet_counts *);
429 void capture_ip(const u_char *, int, guint32, packet_counts *);
432 * Routines in packet-*.c
433 * Routines should take three args: packet data *, frame_data *, tree *
434 * They should never modify the packet data.
436 void dissect_ascend(const u_char *, frame_data *, proto_tree *);
437 void dissect_atm(const u_char *, frame_data *, proto_tree *);
438 void dissect_clip(const u_char *, frame_data *, proto_tree *);
439 void dissect_lapb(const u_char *, frame_data *, proto_tree *);
440 void dissect_null(const u_char *, frame_data *, proto_tree *);
441 void dissect_ppp(const u_char *, frame_data *, proto_tree *);
442 void dissect_raw(const u_char *, frame_data *, proto_tree *);
445 * Routines in packet-*.c
446 * Routines should take four args: packet data *, frame_data *, tree *,
448 * They should never modify the packet data.
450 void dissect_fddi(const u_char *, frame_data *, proto_tree *, gboolean);
452 typedef void (*DissectFunc) (const u_char*, int, frame_data*, proto_tree*);
455 * Routines in packet-*.c
456 * Routines should take four args: packet data *, offset, frame_data *,
458 * They should never modify the packet data.
460 int dissect_ah(const u_char *, int, frame_data *, proto_tree *);
461 void dissect_aarp(const u_char *, int, frame_data *, proto_tree *);
462 void dissect_arp(const u_char *, int, frame_data *, proto_tree *);
463 void dissect_bootp(const u_char *, int, frame_data *, proto_tree *);
464 void dissect_bpdu(const u_char *, int, frame_data *, proto_tree *);
465 void dissect_cdp(const u_char *, int, frame_data *, proto_tree *);
466 void dissect_cotp(const u_char *, int, frame_data *, proto_tree *);
467 void dissect_data(const u_char *, int, frame_data *, proto_tree *);
468 void dissect_ddp(const u_char *, int, frame_data *, proto_tree *);
469 void dissect_dns(const u_char *, int, frame_data *, proto_tree *);
470 void dissect_esp(const u_char *, int, frame_data *, proto_tree *);
471 void dissect_eth(const u_char *, int, frame_data *, proto_tree *);
472 void dissect_ftp(const u_char *, int, frame_data *, proto_tree *);
473 void dissect_ftpdata(const u_char *, int, frame_data *, proto_tree *);
474 void dissect_giop(const u_char *, int, frame_data *, proto_tree *);
475 void dissect_http(const u_char *, int, frame_data *, proto_tree *);
476 void dissect_icmp(const u_char *, int, frame_data *, proto_tree *);
477 void dissect_icmpv6(const u_char *, int, frame_data *, proto_tree *);
478 void dissect_igmp(const u_char *, int, frame_data *, proto_tree *);
479 void dissect_ip(const u_char *, int, frame_data *, proto_tree *);
480 void dissect_ipp(const u_char *, int, frame_data *, proto_tree *);
481 void dissect_ipv6(const u_char *, int, frame_data *, proto_tree *);
482 void dissect_ipx(const u_char *, int, frame_data *, proto_tree *);
483 void dissect_llc(const u_char *, int, frame_data *, proto_tree *);
484 void dissect_lpd(const u_char *, int, frame_data *, proto_tree *);
485 void dissect_nbdgm(const u_char *, int, frame_data *, proto_tree *);
486 void dissect_netbios(const u_char *, int, frame_data *, proto_tree *);
487 void dissect_nbipx(const u_char *, int, frame_data *, proto_tree *);
488 void dissect_nbns(const u_char *, int, frame_data *, proto_tree *);
489 void dissect_nbss(const u_char *, int, frame_data *, proto_tree *);
490 void dissect_ncp(const u_char *, int, frame_data *, proto_tree *);
491 void dissect_nntp(const u_char *, int, frame_data *, proto_tree *);
492 void dissect_nwlink_dg(const u_char *, int, frame_data *, proto_tree *);
493 void dissect_osi(const u_char *, int, frame_data *, proto_tree *);
494 void dissect_ospf(const u_char *, int, frame_data *, proto_tree *);
495 void dissect_ospf_hello(const u_char *, int, frame_data *, proto_tree *);
496 void dissect_pim(const u_char *, int, frame_data *, proto_tree *);
497 void dissect_pop(const u_char *, int, frame_data *, proto_tree *);
498 void dissect_pppoed(const u_char *, int, frame_data *, proto_tree *);
499 void dissect_pppoes(const u_char *, int, frame_data *, proto_tree *);
500 void dissect_icp(const u_char *,int, frame_data *, proto_tree *);
501 void dissect_isakmp(const u_char *, int, frame_data *, proto_tree *);
502 void dissect_radius(const u_char *, int, frame_data *, proto_tree *);
503 void dissect_rip(const u_char *, int, frame_data *, proto_tree *);
504 void dissect_ripng(const u_char *, int, frame_data *, proto_tree *);
505 void dissect_rsvp(const u_char *, int, frame_data *, proto_tree *);
506 void dissect_rtsp(const u_char *, int, frame_data *, proto_tree *);
507 void dissect_sdp(const u_char *, int, frame_data *, proto_tree *);
508 void dissect_sna(const u_char *, int, frame_data *, proto_tree *);
509 void dissect_snmp(const u_char *, int, frame_data *, proto_tree *);
510 void dissect_tcp(const u_char *, int, frame_data *, proto_tree *);
511 void dissect_telnet(const u_char *, int, frame_data *, proto_tree *);
512 void dissect_tftp(const u_char *, int, frame_data *, proto_tree *);
513 void dissect_tr(const u_char *, int, frame_data *, proto_tree *);
514 void dissect_trmac(const u_char *, int, frame_data *, proto_tree *);
515 void dissect_udp(const u_char *, int, frame_data *, proto_tree *);
516 void dissect_vines(const u_char *, int, frame_data *, proto_tree *);
517 void dissect_vines_arp(const u_char *, int, frame_data *, proto_tree *);
518 void dissect_vines_frp(const u_char *, int, frame_data *, proto_tree *);
519 void dissect_vines_icp(const u_char *, int, frame_data *, proto_tree *);
520 void dissect_vines_ipc(const u_char *, int, frame_data *, proto_tree *);
521 void dissect_vines_rtp(const u_char *, int, frame_data *, proto_tree *);
522 void dissect_vines_spp(const u_char *, int, frame_data *, proto_tree *);
523 void dissect_payload_ppp(const u_char *, int, frame_data *, proto_tree *);
524 void dissect_x25(const u_char *, int, frame_data *, proto_tree *);
525 void dissect_yhoo(const u_char *, int, frame_data *, proto_tree *);
527 void dissect_smb(const u_char *, int, frame_data *, proto_tree *, int);
528 void dissect_pptp(const u_char *, int, frame_data *, proto_tree *);
529 void dissect_gre(const u_char *, int, frame_data *, proto_tree *);
531 void init_dissect_udp(void);
532 void init_dissect_x25(void);
534 /* These functions are in ethertype.c */
535 void capture_ethertype(guint16 etype, int offset,
536 const u_char *pd, guint32 cap_len, packet_counts *ld);
537 void ethertype(guint16 etype, int offset,
538 const u_char *pd, frame_data *fd, proto_tree *tree,
539 proto_tree *fh_tree, int item_id);
540 extern const value_string etype_vals[];
542 /* These functions are in packet-arp.c */
543 gchar *arphrdaddr_to_str(guint8 *ad, int ad_len, guint16 type);
544 gchar *arphrdtype_to_str(guint16 hwtype, const char *fmt);
547 * All of the possible columns in summary listing.
549 * NOTE: The SRC and DST entries MUST remain in this order, or else you
550 * need to fix the offset #defines before get_column_format!
553 COL_NUMBER, /* Packet list item number */
554 COL_CLS_TIME, /* Command line-specified time (default relative) */
555 COL_REL_TIME, /* Relative time */
556 COL_ABS_TIME, /* Absolute time */
557 COL_DELTA_TIME, /* Delta time */
558 COL_DEF_SRC, /* Source address */
559 COL_RES_SRC, /* Resolved source */
560 COL_UNRES_SRC, /* Unresolved source */
561 COL_DEF_DL_SRC, /* Data link layer source address */
562 COL_RES_DL_SRC, /* Resolved DL source */
563 COL_UNRES_DL_SRC, /* Unresolved DL source */
564 COL_DEF_NET_SRC, /* Network layer source address */
565 COL_RES_NET_SRC, /* Resolved net source */
566 COL_UNRES_NET_SRC, /* Unresolved net source */
567 COL_DEF_DST, /* Destination address */
568 COL_RES_DST, /* Resolved dest */
569 COL_UNRES_DST, /* Unresolved dest */
570 COL_DEF_DL_DST, /* Data link layer dest address */
571 COL_RES_DL_DST, /* Resolved DL dest */
572 COL_UNRES_DL_DST, /* Unresolved DL dest */
573 COL_DEF_NET_DST, /* Network layer dest address */
574 COL_RES_NET_DST, /* Resolved net dest */
575 COL_UNRES_NET_DST, /* Unresolved net dest */
576 COL_DEF_SRC_PORT, /* Source port */
577 COL_RES_SRC_PORT, /* Resolved source port */
578 COL_UNRES_SRC_PORT, /* Unresolved source port */
579 COL_DEF_DST_PORT, /* Destination port */
580 COL_RES_DST_PORT, /* Resolved dest port */
581 COL_UNRES_DST_PORT, /* Unresolved dest port */
582 COL_PROTOCOL, /* Protocol */
583 COL_INFO, /* Description */
584 COL_PACKET_LENGTH, /* Packet length in bytes */
585 NUM_COL_FMTS /* Should always be last */
588 #endif /* packet.h */