2 * Routines for ethernet packet disassembly
6 * Wireshark - Network traffic analyzer
7 * By Gerald Combs <gerald@wireshark.org>
8 * Copyright 1998 Gerald Combs
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version 2
13 * of the License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
30 #include <epan/packet.h>
31 #include <epan/prefs.h>
32 #include <epan/etypes.h>
33 #include <epan/addr_resolv.h>
34 #include "packet-eth.h"
35 #include "packet-ieee8023.h"
36 #include "packet-ipx.h"
37 #include "packet-isl.h"
38 #include "packet-llc.h"
39 #include <epan/crc32.h>
41 #include <epan/expert.h>
43 /* Assume all packets have an FCS */
44 static gboolean eth_assume_fcs = FALSE;
45 /* Interpret packets as FW1 monitor file packets if they look as if they are */
46 static gboolean eth_interpret_as_fw1_monitor = FALSE;
47 /* Preference settings defining conditions for which the CCSDS dissector is called */
48 static gboolean ccsds_heuristic_length = FALSE;
49 static gboolean ccsds_heuristic_version = FALSE;
50 static gboolean ccsds_heuristic_header = FALSE;
51 static gboolean ccsds_heuristic_bit = FALSE;
52 /* Preference moved over from the old vlan dissector */
53 static guint q_in_q_ethertype = 0x9100;
55 /* protocols and header fields */
56 static int proto_eth = -1;
57 static int hf_eth_dst = -1;
58 static int hf_eth_src = -1;
59 static int hf_eth_len = -1;
60 static int hf_eth_vlan_tpid = -1;
61 static int hf_eth_vlan_pri = -1;
62 static int hf_eth_vlan_cfi = -1;
63 static int hf_eth_vlan_id = -1;
64 static int hf_eth_type = -1;
65 static int hf_eth_addr = -1;
66 static int hf_eth_ig = -1;
67 static int hf_eth_lg = -1;
68 static int hf_eth_trailer = -1;
70 static gint ett_ieee8023 = -1;
71 static gint ett_ether2 = -1;
72 static gint ett_addr = -1;
73 static gint ett_tag = -1;
75 static dissector_handle_t fw1_handle;
76 static heur_dissector_list_t heur_subdissector_list;
77 static heur_dissector_list_t eth_trailer_subdissector_list;
79 static int eth_tap = -1;
81 /* From Table G-2 of IEEE standard 802.1D-2004 */
82 static const value_string pri_vals[] = {
85 { 0, "Best Effort (default)" },
86 { 3, "Excellent Effort" },
87 { 4, "Controlled Load" },
88 { 5, "Video, < 100ms latency and jitter" },
89 { 6, "Voice, < 10ms latency and jitter" },
90 { 7, "Network Control" },
94 static const value_string cfi_vals[] = {
96 { 1, "Non-canonical" },
100 #define ETH_HEADER_SIZE 14
102 static const true_false_string ig_tfs = {
103 "Group address (multicast/broadcast)",
104 "Individual address (unicast)"
106 static const true_false_string lg_tfs = {
107 "Locally administered address (this is NOT the factory default)",
108 "Globally unique address (factory default)"
111 /* These are the Netware-ish names for the different Ethernet frame types.
112 EthernetII: The ethernet with a Type field instead of a length field
113 Ethernet802.2: An 802.3 header followed by an 802.2 header
114 Ethernet802.3: A raw 802.3 packet. IPX/SPX can be the only payload.
115 There's no 802.2 hdr in this.
116 EthernetSNAP: Basically 802.2, just with 802.2SNAP. For our purposes,
117 there's no difference between 802.2 and 802.2SNAP, since we just
118 pass it down to the LLC dissector. -- Gilbert
120 #define ETHERNET_II 0
121 #define ETHERNET_802_2 1
122 #define ETHERNET_802_3 2
123 #define ETHERNET_SNAP 3
126 capture_eth(const guchar *pd, int offset, int len, packet_counts *ld)
128 guint16 etype, length;
129 int ethhdr_type; /* the type of ethernet frame */
131 if (!BYTES_ARE_IN_FRAME(offset, len, ETH_HEADER_SIZE)) {
136 etype = pntohs(&pd[offset+12]);
138 if (etype <= IEEE_802_3_MAX_LEN) {
139 /* Oh, yuck. Cisco ISL frames require special interpretation of the
140 destination address field; fortunately, they can be recognized by
141 checking the first 5 octets of the destination address, which are
142 01-00-0C-00-00 or 0C-00-0C-00-00 for ISL frames. */
143 if ((pd[offset] == 0x01 || pd[offset] == 0x0C) && pd[offset+1] == 0x00
144 && pd[offset+2] == 0x0C && pd[offset+3] == 0x00
145 && pd[offset+4] == 0x00) {
146 capture_isl(pd, offset, len, ld);
152 * If the type/length field is <= the maximum 802.3 length,
153 * and is not zero, this is an 802.3 frame, and it's a length
154 * field; it might be an Novell "raw 802.3" frame, with no
155 * 802.2 LLC header, or it might be a frame with an 802.2 LLC
158 * If the type/length field is > the maximum 802.3 length,
159 * this is an Ethernet II frame, and it's a type field.
161 * If the type/length field is zero (ETHERTYPE_UNK), this is
162 * a frame used internally by the Cisco MDS switch to contain
163 * Fibre Channel ("Vegas"). We treat that as an Ethernet II
164 * frame; the dissector for those frames registers itself with
165 * an ethernet type of ETHERTYPE_UNK.
167 if (etype <= IEEE_802_3_MAX_LEN && etype != ETHERTYPE_UNK) {
170 /* Is there an 802.2 layer? I can tell by looking at the first 2
171 bytes after the 802.3 header. If they are 0xffff, then what
172 follows the 802.3 header is an IPX payload, meaning no 802.2.
173 (IPX/SPX is they only thing that can be contained inside a
174 straight 802.3 packet). A non-0xffff value means that there's an
175 802.2 layer inside the 802.3 layer */
176 if (pd[offset+14] == 0xff && pd[offset+15] == 0xff) {
177 ethhdr_type = ETHERNET_802_3;
180 ethhdr_type = ETHERNET_802_2;
183 /* Convert the LLC length from the 802.3 header to a total
184 frame length, by adding in the size of any data that preceded
185 the Ethernet header, and adding in the Ethernet header size,
186 and set the payload and captured-payload lengths to the minima
187 of the total length and the frame lengths. */
188 length += offset + ETH_HEADER_SIZE;
192 ethhdr_type = ETHERNET_II;
194 offset += ETH_HEADER_SIZE;
196 switch (ethhdr_type) {
201 capture_llc(pd, offset, len, ld);
204 capture_ethertype(etype, pd, offset, len, ld);
209 static gboolean check_is_802_2(tvbuff_t *tvb, int fcs_len);
212 dissect_eth_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree,
215 proto_item *ti = NULL, *tag_item;
218 proto_tree *fh_tree = NULL;
219 const guint8 *src_addr, *dst_addr;
220 static eth_hdr ehdrs[4];
221 static int ehdr_num=0;
223 proto_item *addr_item;
224 proto_tree *addr_tree=NULL;
225 proto_tree *tag_tree;
234 ehdr=&ehdrs[ehdr_num];
238 col_set_str(pinfo->cinfo, COL_PROTOCOL, "Ethernet");
240 src_addr=tvb_get_ptr(tvb, 6, 6);
241 SET_ADDRESS(&pinfo->dl_src, AT_ETHER, 6, src_addr);
242 SET_ADDRESS(&pinfo->src, AT_ETHER, 6, src_addr);
243 SET_ADDRESS(&ehdr->src, AT_ETHER, 6, src_addr);
244 dst_addr=tvb_get_ptr(tvb, 0, 6);
245 SET_ADDRESS(&pinfo->dl_dst, AT_ETHER, 6, dst_addr);
246 SET_ADDRESS(&pinfo->dst, AT_ETHER, 6, dst_addr);
247 SET_ADDRESS(&ehdr->dst, AT_ETHER, 6, dst_addr);
249 ehdr->type = tvb_get_ntohs(tvb, 12);
251 tap_queue_packet(eth_tap, pinfo, ehdr);
254 * In case the packet is a non-Ethernet packet inside
255 * Ethernet framing, allow heuristic dissectors to take
256 * a first look before we assume that it's actually an
259 if (dissector_try_heuristic(heur_subdissector_list, tvb, pinfo, parent_tree))
262 if (ehdr->type <= IEEE_802_3_MAX_LEN) {
263 /* Oh, yuck. Cisco ISL frames require special interpretation of the
264 destination address field; fortunately, they can be recognized by
265 checking the first 5 octets of the destination address, which are
266 01-00-0C-00-00 for ISL frames. */
267 if ( (tvb_get_guint8(tvb, 0) == 0x01 ||
268 tvb_get_guint8(tvb, 0) == 0x0C) &&
269 tvb_get_guint8(tvb, 1) == 0x00 &&
270 tvb_get_guint8(tvb, 2) == 0x0C &&
271 tvb_get_guint8(tvb, 3) == 0x00 &&
272 tvb_get_guint8(tvb, 4) == 0x00 ) {
273 dissect_isl(tvb, pinfo, parent_tree, fcs_len);
279 * If the type/length field is <= the maximum 802.3 length,
280 * and is not zero, this is an 802.3 frame, and it's a length
281 * field; it might be an Novell "raw 802.3" frame, with no
282 * 802.2 LLC header, or it might be a frame with an 802.2 LLC
285 * If the type/length field is > the maximum 802.3 length,
286 * this is an Ethernet II frame, and it's a type field.
288 * If the type/length field is zero (ETHERTYPE_UNK), this is
289 * a frame used internally by the Cisco MDS switch to contain
290 * Fibre Channel ("Vegas"). We treat that as an Ethernet II
291 * frame; the dissector for those frames registers itself with
292 * an ethernet type of ETHERTYPE_UNK.
294 if (ehdr->type <= IEEE_802_3_MAX_LEN && ehdr->type != ETHERTYPE_UNK) {
296 is_802_2 = check_is_802_2(tvb, fcs_len);
298 col_add_fstr(pinfo->cinfo, COL_INFO, "IEEE 802.3 Ethernet %s",
299 (is_802_2 ? "" : "Raw "));
301 ti = proto_tree_add_protocol_format(tree, proto_eth, tvb, 0, ETH_HEADER_SIZE,
302 "IEEE 802.3 Ethernet %s", (is_802_2 ? "" : "Raw "));
304 fh_tree = proto_item_add_subtree(ti, ett_ieee8023);
307 /* if IP is not referenced from any filters we dont need to worry about
308 generating any tree items. We must do this after we created the actual
309 protocol above so that proto hier stat still works though.
311 if(!proto_field_is_referenced(parent_tree, proto_eth)){
316 addr_item=proto_tree_add_ether(fh_tree, hf_eth_dst, tvb, 0, 6, dst_addr);
318 addr_tree = proto_item_add_subtree(addr_item, ett_addr);
320 proto_tree_add_ether(addr_tree, hf_eth_addr, tvb, 0, 6, dst_addr);
321 proto_tree_add_item(addr_tree, hf_eth_ig, tvb, 0, 3, FALSE);
322 proto_tree_add_item(addr_tree, hf_eth_lg, tvb, 0, 3, FALSE);
324 addr_item=proto_tree_add_ether(fh_tree, hf_eth_src, tvb, 6, 6, src_addr);
326 addr_tree = proto_item_add_subtree(addr_item, ett_addr);
328 proto_tree_add_ether(addr_tree, hf_eth_addr, tvb, 6, 6, src_addr);
329 proto_tree_add_item(addr_tree, hf_eth_ig, tvb, 6, 3, FALSE);
330 proto_tree_add_item(addr_tree, hf_eth_lg, tvb, 6, 3, FALSE);
332 dissect_802_3(ehdr->type, is_802_2, tvb, ETH_HEADER_SIZE, pinfo, parent_tree, fh_tree,
333 hf_eth_len, hf_eth_trailer, fcs_len);
335 if (eth_interpret_as_fw1_monitor) {
336 if ((dst_addr[0] == 'i') || (dst_addr[0] == 'I') ||
337 (dst_addr[0] == 'o') || (dst_addr[0] == 'O')) {
338 call_dissector(fw1_handle, tvb, pinfo, parent_tree);
343 col_set_str(pinfo->cinfo, COL_INFO, "Ethernet II");
344 if(ehdr->type == ETHERTYPE_VLAN || ehdr->type == q_in_q_ethertype)
345 col_append_str(pinfo->cinfo, COL_INFO, " (VLAN tagged)");
348 if (PTREE_DATA(parent_tree)->visible) {
349 ti = proto_tree_add_protocol_format(parent_tree, proto_eth, tvb, 0, ETH_HEADER_SIZE,
350 "Ethernet II%s, Src: %s (%s), Dst: %s (%s)",
351 (ehdr->type == ETHERTYPE_VLAN || ehdr->type == q_in_q_ethertype) ? " (VLAN tagged)" : "",
352 get_ether_name(src_addr), ether_to_str(src_addr), get_ether_name(dst_addr), ether_to_str(dst_addr));
355 ti = proto_tree_add_item(parent_tree, proto_eth, tvb, 0, ETH_HEADER_SIZE, FALSE);
357 fh_tree = proto_item_add_subtree(ti, ett_ether2);
360 addr_item=proto_tree_add_ether(fh_tree, hf_eth_dst, tvb, 0, 6, dst_addr);
362 addr_tree = proto_item_add_subtree(addr_item, ett_addr);
364 proto_tree_add_ether(addr_tree, hf_eth_addr, tvb, 0, 6, dst_addr);
365 proto_tree_add_item(addr_tree, hf_eth_ig, tvb, 0, 3, FALSE);
366 proto_tree_add_item(addr_tree, hf_eth_lg, tvb, 0, 3, FALSE);
368 addr_item=proto_tree_add_ether(fh_tree, hf_eth_src, tvb, 6, 6, src_addr);
370 addr_tree = proto_item_add_subtree(addr_item, ett_addr);
371 if (tvb_get_guint8(tvb, 6) & 0x01) {
372 expert_add_info_format(pinfo, addr_item, PI_PROTOCOL, PI_WARN,
373 "Source MAC must not be a group address: IEEE 802.3-2002, Section 3.2.3(b)");
376 proto_tree_add_ether(addr_tree, hf_eth_addr, tvb, 6, 6, src_addr);
377 proto_tree_add_item(addr_tree, hf_eth_ig, tvb, 6, 3, FALSE);
378 proto_tree_add_item(addr_tree, hf_eth_lg, tvb, 6, 3, FALSE);
381 while(ehdr->type == ETHERTYPE_VLAN || ehdr->type == q_in_q_ethertype) {
382 tag_item = proto_tree_add_text(fh_tree, tvb, offset, 4, "VLAN tag: ");
383 tag_tree = proto_item_add_subtree(tag_item, ett_tag);
385 proto_tree_add_item(tag_tree, hf_eth_vlan_tpid, tvb, offset, 2, FALSE);
388 proto_tree_add_item(tag_tree, hf_eth_vlan_pri, tvb, offset, 2, FALSE);
389 tag_pri = tvb_get_guint8(tvb, offset) >> 5;
391 proto_tree_add_item(tag_tree, hf_eth_vlan_cfi, tvb, offset, 2, FALSE);
393 proto_tree_add_item(tag_tree, hf_eth_vlan_id, tvb, offset, 2, FALSE);
394 tag_vlan_id = tvb_get_ntohs(tvb, offset) & 0x0FFF;
396 proto_item_append_text(tag_item, "VLAN=%u, Priority=%s", tag_vlan_id,
397 val_to_str(tag_pri, pri_vals, "Unknown"));
399 if(check_col(pinfo->cinfo, COL_8021Q_VLAN_ID))
400 col_add_fstr(pinfo->cinfo, COL_8021Q_VLAN_ID, "%u", tag_vlan_id);
404 ehdr->type = tvb_get_ntohs(tvb, offset);
407 proto_item_set_len(ti, offset);
409 ethertype(ehdr->type, tvb, offset, pinfo, parent_tree, fh_tree,
410 hf_eth_type, hf_eth_trailer, 0);
415 static gboolean check_is_802_2(tvbuff_t *tvb, int fcs_len)
417 volatile gboolean is_802_2;
419 gint captured_length, reported_length;
423 /* Is there an 802.2 layer? I can tell by looking at the first 2
424 bytes after the 802.3 header. If they are 0xffff, then what
425 follows the 802.3 header is an IPX payload, meaning no 802.2.
426 A non-0xffff value means that there's an 802.2 layer or CCSDS
427 layer inside the 802.3 layer */
430 if (tvb_get_ntohs(tvb, 14) == 0xffff) {
433 /* Is this a CCSDS payload instead of an 802.2 (LLC)?
434 Check the conditions enabled by the user for CCSDS presence */
435 else if (ccsds_heuristic_length || ccsds_heuristic_version ||
436 ccsds_heuristic_header || ccsds_heuristic_bit) {
437 gboolean CCSDS_len = TRUE;
438 gboolean CCSDS_ver = TRUE;
439 gboolean CCSDS_head = TRUE;
440 gboolean CCSDS_bit = TRUE;
441 /* See if the reported payload size matches the
442 size contained in the CCSDS header. */
443 if (ccsds_heuristic_length) {
444 /* The following technique to account for FCS
445 is copied from packet-ieee8023.c dissect_802_3() */
446 length = tvb_get_ntohs(tvb, 12);
447 reported_length = tvb_reported_length_remaining(tvb, ETH_HEADER_SIZE);
449 if (reported_length >= fcs_len)
450 reported_length -= fcs_len;
452 /* Make sure the length in the 802.3 header doesn't go past the end of
454 if (length > reported_length) {
455 length = reported_length;
457 /* Only allow inspection of 'length' number of bytes. */
458 captured_length = tvb_length_remaining(tvb, ETH_HEADER_SIZE);
459 if (captured_length > length)
460 captured_length = length;
462 /* Check if payload is large enough to contain a CCSDS header */
463 if (captured_length >= 6) {
464 /* Compare length to packet length contained in CCSDS header. */
465 if (length != 7 + tvb_get_ntohs(tvb, ETH_HEADER_SIZE + 4))
469 /* Check if CCSDS Version number (first 3 bits of payload) is zero */
470 if ((ccsds_heuristic_version) && (tvb_get_bits8(tvb, 8*ETH_HEADER_SIZE, 3)!=0))
472 /* Check if Secondary Header Flag (4th bit of payload) is set to one. */
473 if ((ccsds_heuristic_header) && (tvb_get_bits8(tvb, 8*ETH_HEADER_SIZE + 4, 1)!=1))
475 /* Check if spare bit (1st bit of 7th word of payload) is zero. */
476 if ((ccsds_heuristic_bit) && (tvb_get_bits8(tvb, 8*ETH_HEADER_SIZE + 16*6, 1)!=0))
478 /* If all the conditions are true, don't interpret payload as an 802.2 (LLC).
479 * Additional check in packet-802.3.c will distinguish between
480 * IPX and CCSDS packets*/
481 if (CCSDS_len && CCSDS_ver && CCSDS_head && CCSDS_bit)
485 CATCH2(BoundsError, ReportedBoundsError) {
495 * Add an Ethernet trailer - which, for some captures, might be the FCS
496 * rather than a pad-to-60-bytes trailer.
498 * If fcs_len is 0, we assume the frame has no FCS; if it's 4, we assume
499 * it has an FCS; if it's anything else (such as -1, which means "maybe
500 * it does, maybe it doesn't"), we try to infer whether it has an FCS.
503 add_ethernet_trailer(packet_info *pinfo, proto_tree *tree, proto_tree *fh_tree, int trailer_id,
504 tvbuff_t *tvb, tvbuff_t *trailer_tvb, int fcs_len)
506 /* If there're some bytes left over, show those bytes as a trailer.
508 However, if the Ethernet frame was claimed to have had 64 or more
509 bytes - i.e., it was at least an FCS worth of data longer than
510 the minimum payload size - assume the last 4 bytes of the trailer
512 if (trailer_tvb && fh_tree) {
513 guint trailer_length, trailer_reported_length;
514 gboolean has_fcs = FALSE;
516 if (dissector_try_heuristic(eth_trailer_subdissector_list, trailer_tvb,
521 trailer_length = tvb_length(trailer_tvb);
522 trailer_reported_length = tvb_reported_length(trailer_tvb);
525 /* If fcs_len is 4, we assume we definitely have an FCS.
526 Otherwise, then, if the frame is big enough that, if we
527 have a trailer, it probably inclues an FCS, and we have
528 enough space in the trailer for the FCS, we assume we
531 "Big enough" means 64 bytes or more; any frame that big
532 needs no trailer, as there's no need to pad an Ethernet
533 packet past 60 bytes.
535 The trailer must be at least 4 bytes long to have enough
538 if (fcs_len == 4 || (tvb_reported_length(tvb) >= 64 &&
539 trailer_reported_length >= 4)) {
540 /* Either we know we have an FCS, or we believe we have an FCS. */
541 if (trailer_length < trailer_reported_length) {
542 /* The packet is claimed to have enough data for a 4-byte FCS,
543 but we didn't capture all of the packet.
544 Slice off the 4-byte FCS from the reported length, and
545 trim the captured length so it's no more than the reported
546 length; that will slice off what of the FCS, if any, is
547 in the captured packet. */
548 trailer_reported_length -= 4;
549 if (trailer_length > trailer_reported_length)
550 trailer_length = trailer_reported_length;
553 /* We captured all of the packet, including what appears to
554 be a 4-byte FCS. Slice it off. */
556 trailer_reported_length -= 4;
561 if (trailer_length != 0) {
562 tvb_ensure_bytes_exist(tvb, 0, trailer_length);
563 proto_tree_add_item(fh_tree, trailer_id, trailer_tvb, 0,
564 trailer_length, FALSE);
567 guint32 sent_fcs = tvb_get_ntohl(trailer_tvb, trailer_length);
568 guint32 fcs = crc32_802_tvb(tvb, tvb_length(tvb) - 4);
569 if (fcs == sent_fcs) {
570 proto_tree_add_text(fh_tree, trailer_tvb, trailer_length, 4,
571 "Frame check sequence: 0x%08x [correct]",
574 proto_tree_add_text(fh_tree, trailer_tvb, trailer_length, 4,
575 "Frame check sequence: 0x%08x [incorrect, should be 0x%08x]",
580 proto_tree_set_appendix(fh_tree, tvb, tvb_length(tvb) - trailer_length, trailer_length);
584 /* Called for the Ethernet Wiretap encapsulation type; pass the FCS length
585 reported to us, or, if the "assume_fcs" preference is set, pass 4. */
587 dissect_eth_maybefcs(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
589 dissect_eth_common(tvb, pinfo, tree,
591 pinfo->pseudo_header->eth.fcs_len);
594 /* Called by other dissectors This one's for encapsulated Ethernet
595 packets that don't include an FCS. */
597 dissect_eth_withoutfcs(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
599 dissect_eth_common(tvb, pinfo, tree, 0);
602 /* ...and this one's for encapsulated packets that do. */
604 dissect_eth_withfcs(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
606 dissect_eth_common(tvb, pinfo, tree, 4);
610 proto_register_eth(void)
612 static hf_register_info hf[] = {
615 { "Destination", "eth.dst", FT_ETHER, BASE_NONE, NULL, 0x0,
616 "Destination Hardware Address", HFILL }},
619 { "Source", "eth.src", FT_ETHER, BASE_NONE, NULL, 0x0,
620 "Source Hardware Address", HFILL }},
623 { "Length", "eth.len", FT_UINT16, BASE_DEC, NULL, 0x0,
626 /* registered here but handled in packet-ethertype.c */
628 { "Type", "eth.type", FT_UINT16, BASE_HEX, VALS(etype_vals), 0x0,
632 { "Identifier", "eth.vlan.tpid", FT_UINT16, BASE_HEX, VALS(etype_vals), 0x0,
633 "Tag Protocol Identifier (TPID)", HFILL }},
636 { "Priority", "eth.vlan.pri", FT_UINT16, BASE_DEC, VALS(pri_vals), 0xE000,
637 "Priority Code Point (PCP)", HFILL }},
640 { "CFI", "eth.vlan.cfi", FT_UINT16, BASE_DEC, VALS(cfi_vals), 0x1000,
641 "Canonical Format Identifier", HFILL }},
644 { "VLAN", "eth.vlan.id", FT_UINT16, BASE_DEC, NULL, 0x0FFF,
645 "VLAN Identifier (VID)", HFILL }},
648 { "Address", "eth.addr", FT_ETHER, BASE_NONE, NULL, 0x0,
649 "Source or Destination Hardware Address", HFILL }},
652 { "Trailer", "eth.trailer", FT_BYTES, BASE_NONE, NULL, 0x0,
653 "Ethernet Trailer or Checksum", HFILL }},
656 { "IG bit", "eth.ig", FT_BOOLEAN, 24,
657 TFS(&ig_tfs), 0x010000,
658 "Specifies if this is an individual (unicast) or group (broadcast/multicast) address", HFILL }},
661 { "LG bit", "eth.lg", FT_BOOLEAN, 24,
662 TFS(&lg_tfs), 0x020000,
663 "Specifies if this is a locally administered or globally unique (IEEE assigned) address", HFILL }}
666 static gint *ett[] = {
672 module_t *eth_module;
674 proto_eth = proto_register_protocol("Ethernet", "Ethernet", "eth");
675 proto_register_field_array(proto_eth, hf, array_length(hf));
676 proto_register_subtree_array(ett, array_length(ett));
678 /* subdissector code */
679 register_heur_dissector_list("eth", &heur_subdissector_list);
680 register_heur_dissector_list("eth.trailer", ð_trailer_subdissector_list);
682 /* Register configuration preferences */
683 eth_module = prefs_register_protocol(proto_eth, NULL);
685 prefs_register_bool_preference(eth_module, "assume_fcs",
686 "Assume packets have FCS",
687 "Some Ethernet adapters and drivers include the FCS at the end of a packet, others do not. "
688 "The Ethernet dissector attempts to guess whether a captured packet has an FCS, "
689 "but it cannot always guess correctly.",
692 prefs_register_bool_preference(eth_module, "interpret_as_fw1_monitor",
693 "Attempt to interpret as FireWall-1 monitor file",
694 "Whether packets should be interpreted as coming from CheckPoint FireWall-1 monitor file if they look as if they do",
695 ð_interpret_as_fw1_monitor);
697 prefs_register_uint_preference(eth_module, "qinq_ethertype",
698 "802.1QinQ Ethertype (in hex)", "The (hexadecimal) Ethertype used to indicate "
699 "802.1QinQ VLAN in VLAN tunneling.", 16, &q_in_q_ethertype);
701 /* This preference is copied over from the old vlan dissector by the set_pref()
702 * function in epan/prefs.c. We don't have it in this dissector because there could
703 * be multiple VLAN tags nested within the Ethernet header, so we wouldn't know which
705 prefs_register_obsolete_preference(eth_module, "summary_in_tree");
707 prefs_register_static_text_preference(eth_module, "ccsds_heuristic",
708 "These are the conditions to match a payload against in order to determine if this\n"
709 "is a CCSDS (Consultative Committee for Space Data Systems) packet within\n"
710 "an 802.3 packet. A packet is considered as a possible CCSDS packet only if\n"
711 "one or more of the conditions are checked.",
712 "Describe the conditions that must be true for the CCSDS dissector to be called");
714 prefs_register_bool_preference(eth_module, "ccsds_heuristic_length",
715 "CCSDS Length in header matches payload size",
716 "Set the condition that must be true for the CCSDS dissector to be called",
717 &ccsds_heuristic_length);
719 prefs_register_bool_preference(eth_module, "ccsds_heuristic_version",
720 "CCSDS Version # is zero",
721 "Set the condition that must be true for the CCSDS dissector to be called",
722 &ccsds_heuristic_version);
724 prefs_register_bool_preference(eth_module, "ccsds_heuristic_header",
725 "CCSDS Secondary Header Flag is set",
726 "Set the condition that must be true for the CCSDS dissector to be called",
727 &ccsds_heuristic_header);
729 prefs_register_bool_preference(eth_module, "ccsds_heuristic_bit",
730 "CCSDS Spare bit is cleared",
731 "Set the condition that must be true for the CCSDS dissector to be called",
732 &ccsds_heuristic_bit);
734 register_dissector("eth_withoutfcs", dissect_eth_withoutfcs, proto_eth);
735 register_dissector("eth_withfcs", dissect_eth_withfcs, proto_eth);
736 register_dissector("eth", dissect_eth_maybefcs, proto_eth);
737 eth_tap = register_tap("eth");
741 proto_reg_handoff_eth(void)
743 dissector_handle_t eth_maybefcs_handle, eth_withoutfcs_handle;
746 * Get a handle for the Firewall-1 dissector.
748 fw1_handle = find_dissector("fw1");
750 eth_maybefcs_handle = find_dissector("eth");
751 dissector_add("wtap_encap", WTAP_ENCAP_ETHERNET, eth_maybefcs_handle);
753 eth_withoutfcs_handle = find_dissector("eth_withoutfcs");
754 dissector_add("ethertype", ETHERTYPE_ETHBRIDGE, eth_withoutfcs_handle);
755 dissector_add("chdlctype", ETHERTYPE_ETHBRIDGE, eth_withoutfcs_handle);
756 dissector_add("gre.proto", ETHERTYPE_ETHBRIDGE, eth_withoutfcs_handle);
759 * This is to handle the output for the Cisco CMTS "cable intercept"
760 * command - it encapsulates Ethernet frames in UDP packets, but
761 * the UDP port is user-defined.
763 dissector_add_handle("udp.port", eth_withoutfcs_handle);