Make the Tethereal usage message reflect whether libpcap support was

[obnox/wireshark/wip.git] / packet-aarp.c

diff --git a/packet-aarp.c b/packet-aarp.c
index 757a79cc516a855b632418e4ca783435f78bb221..49af2ede28c0dee6f1bd055277385b1666348bd3 100644 (file)
--- a/packet-aarp.c
+++ b/packet-aarp.c
@@ -1,7 +1,7 @@
 /* packet-aarp.c
  * Routines for Appletalk ARP packet disassembly
  *
- * $Id: packet-aarp.c,v 1.13 1999/11/04 08:21:04 guy Exp $
+ * $Id: packet-aarp.c,v 1.16 1999/12/10 00:45:15 nneul Exp $
  *
  * Simon Wilkinson <sxw@dcs.ed.ac.uk>
  *
@@ -44,6 +44,8 @@ static int hf_aarp_src_id = -1;
 static int hf_aarp_dst_ether = -1;
 static int hf_aarp_dst_id = -1;
 
+static gint ett_aarp = -1;
+
 #ifndef AARP_REQUEST
 #define AARP_REQUEST   0x0001
 #endif
@@ -54,10 +56,19 @@ static int hf_aarp_dst_id = -1;
 #define AARP_PROBE     0x0003
 #endif
 
+/* The following is screwed up shit to deal with the fact that
+   the linux kernel edits the packet inline. */
+#define AARP_REQUEST_SWAPPED    0x0100
+#define AARP_REPLY_SWAPPED  0x0200
+#define AARP_PROBE_SWAPPED  0x0300
+
 static const value_string op_vals[] = {
-  {AARP_REQUEST,  "AARP request" },
-  {AARP_REPLY,    "AARP reply"   },
-  {AARP_PROBE,    "AARP probe"   },
+  {AARP_REQUEST,  "request" },
+  {AARP_REPLY,    "reply"   },
+  {AARP_PROBE,    "probe"   },
+  {AARP_REQUEST_SWAPPED,  "request" },
+  {AARP_REPLY_SWAPPED,    "reply"   },
+  {AARP_PROBE_SWAPPED,    "probe"   },
   {0,             NULL           } };
 
 /* AARP protocol HARDWARE identifiers. */
@@ -161,12 +172,15 @@ dissect_aarp(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
   if (check_col(fd, COL_INFO)) {
     switch (ar_op) {
       case AARP_REQUEST:
+      case AARP_REQUEST_SWAPPED:
         col_add_fstr(fd, COL_INFO, "Who has %s?  Tell %s", tpa_str, spa_str);
         break;
       case AARP_REPLY:
+      case AARP_REPLY_SWAPPED:
         col_add_fstr(fd, COL_INFO, "%s is at %s", spa_str, sha_str);
         break;
       case AARP_PROBE:
+      case AARP_PROBE_SWAPPED:
         col_add_fstr(fd, COL_INFO, "Is there a %s", tpa_str);
         break;
       default:
@@ -179,13 +193,13 @@ dissect_aarp(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
     if ((op_str = match_strval(ar_op, op_vals)))
       ti = proto_tree_add_item_format(tree, proto_aarp, offset,
                                      MIN_AARP_HEADER_SIZE + 2*ar_hln + 
-                                     2*ar_pln, NULL, op_str);
+                                     2*ar_pln, NULL, "AppleTalk Address Resolution Protocol (%s)", op_str);
     else
       ti = proto_tree_add_item_format(tree, proto_aarp, offset,
                                      MIN_AARP_HEADER_SIZE + 2*ar_hln + 
                                      2*ar_pln, NULL,
-                                     "Unknown AARP (opcode 0x%04x)", ar_op);
-    aarp_tree = proto_item_add_subtree(ti, ETT_AARP);
+                                     "AppleTalk Address Resolution Protocol (opcode 0x%04x)", ar_op);
+    aarp_tree = proto_item_add_subtree(ti, ett_aarp);
     proto_tree_add_item(aarp_tree, hf_aarp_hard_type, offset + AR_HRD, 2,
                               ar_hrd);
     proto_tree_add_item(aarp_tree, hf_aarp_proto_type, offset + AR_PRO, 2, 
@@ -260,8 +274,12 @@ proto_register_aarp(void)
        FT_BYTES,       BASE_HEX,       NULL,   0x0,
        "" }},
   };
+  static gint *ett[] = {
+    &ett_aarp,
+  };
 
   proto_aarp = proto_register_protocol("Appletalk Address Resolution Protocol",
                                       "aarp");
   proto_register_field_array(proto_aarp, hf, array_length(hf));
+  proto_register_subtree_array(ett, array_length(ett));
 }