2 * Routines for BPDU (Spanning Tree Protocol) disassembly
4 * $Id: packet-bpdu.c,v 1.27 2001/07/23 18:21:30 guy Exp $
6 * Copyright 1999 Christophe Tronche <ch.tronche@computer.org>
8 * Ethereal - Network traffic analyzer
9 * By Gerald Combs <gerald@ethereal.com>
10 * Copyright 1998 Gerald Combs
13 * This program is free software; you can redistribute it and/or
14 * modify it under the terms of the GNU General Public License
15 * as published by the Free Software Foundation; either version 2
16 * of the License, or (at your option) any later version.
18 * This program is distributed in the hope that it will be useful,
19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21 * GNU General Public License for more details.
23 * You should have received a copy of the GNU General Public License
24 * along with this program; if not, write to the Free Software
25 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
32 #ifdef HAVE_SYS_TYPES_H
33 # include <sys/types.h>
36 #ifdef HAVE_NETINET_IN_H
37 # include <netinet/in.h>
48 /* Offsets of fields within a BPDU */
50 #define BPDU_IDENTIFIER 0
51 #define BPDU_VERSION_IDENTIFIER 2
54 #define BPDU_ROOT_IDENTIFIER 5
55 #define BPDU_ROOT_PATH_COST 13
56 #define BPDU_BRIDGE_IDENTIFIER 17
57 #define BPDU_PORT_IDENTIFIER 25
58 #define BPDU_MESSAGE_AGE 27
59 #define BPDU_MAX_AGE 29
60 #define BPDU_HELLO_TIME 31
61 #define BPDU_FORWARD_DELAY 33
63 static int proto_bpdu = -1;
64 static int hf_bpdu_proto_id = -1;
65 static int hf_bpdu_version_id = -1;
66 static int hf_bpdu_type = -1;
67 static int hf_bpdu_flags = -1;
68 static int hf_bpdu_root_mac = -1;
69 static int hf_bpdu_root_cost = -1;
70 static int hf_bpdu_bridge_mac = -1;
71 static int hf_bpdu_port_id = -1;
72 static int hf_bpdu_msg_age = -1;
73 static int hf_bpdu_max_age = -1;
74 static int hf_bpdu_hello_time = -1;
75 static int hf_bpdu_forward_delay = -1;
77 static gint ett_bpdu = -1;
79 static dissector_handle_t gvrp_handle;
80 static dissector_handle_t gmrp_handle;
83 dissect_bpdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
84 guint16 protocol_identifier;
85 guint8 protocol_version_identifier;
88 guint16 root_identifier_bridge_priority;
89 const guint8 *root_identifier_mac;
90 gchar *root_identifier_mac_str;
91 guint32 root_path_cost;
92 guint16 bridge_identifier_bridge_priority;
93 const guint8 *bridge_identifier_mac;
94 gchar *bridge_identifier_mac_str;
95 guint16 port_identifier;
101 proto_tree *bpdu_tree;
104 /* GARP application frames require special interpretation of the
105 destination address field; otherwise, they will be mistaken as
107 Fortunately, they can be recognized by checking the first 6 octets
108 of the destination address, which are in the range from
109 01-80-C2-00-00-20 to 01-80-C2-00-00-2F.
111 Yes - we *do* need to check the destination address type;
112 on Linux cooked captures, there *is* no destination address,
114 if (pinfo->dl_dst.type == AT_ETHER &&
115 pinfo->dl_dst.data[0] == 0x01 && pinfo->dl_dst.data[1] == 0x80 &&
116 pinfo->dl_dst.data[2] == 0xC2 && pinfo->dl_dst.data[3] == 0x00 &&
117 pinfo->dl_dst.data[4] == 0x00 && ((pinfo->dl_dst.data[5] & 0x20) == 0x20)) {
119 protocol_identifier = tvb_get_ntohs(tvb, BPDU_IDENTIFIER);
121 switch (pinfo->dl_dst.data[5]) {
125 call_dissector(gmrp_handle, tvb, pinfo, tree);
130 call_dissector(gvrp_handle, tvb, pinfo, tree);
134 pinfo->current_proto = "GARP";
136 if (check_col(pinfo->fd, COL_PROTOCOL)) {
137 col_set_str(pinfo->fd, COL_PROTOCOL, "GARP");
138 /* Generic Attribute Registration Protocol */
141 if (check_col(pinfo->fd, COL_INFO)) {
142 col_add_fstr(pinfo->fd, COL_INFO,
143 "Unknown GARP application (0x%02X)",
144 pinfo->dl_dst.data[5]);
150 if (check_col(pinfo->fd, COL_PROTOCOL)) {
151 col_set_str(pinfo->fd, COL_PROTOCOL, "STP"); /* Spanning Tree Protocol */
153 if (check_col(pinfo->fd, COL_INFO)) {
154 col_clear(pinfo->fd, COL_INFO);
157 bpdu_type = tvb_get_guint8(tvb, BPDU_TYPE);
158 if (bpdu_type == 0) {
159 flags = tvb_get_guint8(tvb, BPDU_FLAGS);
160 root_identifier_bridge_priority = tvb_get_ntohs(tvb,
161 BPDU_ROOT_IDENTIFIER);
162 root_identifier_mac = tvb_get_ptr(tvb, BPDU_ROOT_IDENTIFIER + 2, 6);
163 root_identifier_mac_str = ether_to_str(root_identifier_mac);
164 root_path_cost = tvb_get_ntohl(tvb, BPDU_ROOT_PATH_COST);
165 port_identifier = tvb_get_ntohs(tvb, BPDU_PORT_IDENTIFIER);
167 /* Squelch GCC complaints. */
169 root_identifier_bridge_priority = 0;
170 root_identifier_mac = NULL;
171 root_identifier_mac_str = NULL;
176 if (check_col(pinfo->fd, COL_INFO)) {
178 col_add_fstr(pinfo->fd, COL_INFO, "Conf. %sRoot = %d/%s Cost = %d Port = 0x%04x",
179 flags & 0x1 ? "TC + " : "",
180 root_identifier_bridge_priority, root_identifier_mac_str, root_path_cost,
182 else if (bpdu_type == 0x80)
183 col_add_fstr(pinfo->fd, COL_INFO, "Topology Change Notification");
187 ti = proto_tree_add_protocol_format(tree, proto_bpdu, tvb, 0, 35,
188 "Spanning Tree Protocol");
189 bpdu_tree = proto_item_add_subtree(ti, ett_bpdu);
191 protocol_identifier = tvb_get_ntohs(tvb, BPDU_IDENTIFIER);
192 proto_tree_add_uint_format(bpdu_tree, hf_bpdu_proto_id, tvb,
195 "Protocol Identifier: 0x%04x (%s)",
197 protocol_identifier == 0 ?
198 "Spanning Tree" : "Unknown Protocol");
200 protocol_version_identifier = tvb_get_guint8(tvb, BPDU_VERSION_IDENTIFIER);
201 proto_tree_add_uint(bpdu_tree, hf_bpdu_version_id, tvb,
202 BPDU_VERSION_IDENTIFIER, 1,
203 protocol_version_identifier);
204 if (protocol_version_identifier != 0)
205 proto_tree_add_text(bpdu_tree, tvb, BPDU_VERSION_IDENTIFIER, 1,
206 " (Warning: this version of Ethereal only knows about version = 0)");
207 proto_tree_add_uint_format(bpdu_tree, hf_bpdu_type, tvb,
210 "BPDU Type: 0x%02x (%s)",
212 bpdu_type == 0 ? "Configuration" :
213 bpdu_type == 0x80 ? "Topology Change Notification" : "Unknown");
215 if (bpdu_type != 0) {
216 dissect_data(tvb, BPDU_TYPE + 1, pinfo, tree);
220 bridge_identifier_bridge_priority = tvb_get_ntohs(tvb, BPDU_BRIDGE_IDENTIFIER);
221 bridge_identifier_mac = tvb_get_ptr(tvb, BPDU_BRIDGE_IDENTIFIER + 2, 6);
222 bridge_identifier_mac_str = ether_to_str(bridge_identifier_mac);
223 message_age = tvb_get_ntohs(tvb, BPDU_MESSAGE_AGE) / 256.0;
224 max_age = tvb_get_ntohs(tvb, BPDU_MAX_AGE) / 256.0;
225 hello_time = tvb_get_ntohs(tvb, BPDU_HELLO_TIME) / 256.0;
226 forward_delay = tvb_get_ntohs(tvb, BPDU_FORWARD_DELAY) / 256.0;
228 proto_tree_add_uint(bpdu_tree, hf_bpdu_flags, tvb,
229 BPDU_FLAGS, 1, flags);
231 proto_tree_add_text(bpdu_tree, tvb, BPDU_FLAGS, 1, " 1... .... Topology Change Acknowledgment");
233 proto_tree_add_text(bpdu_tree, tvb, BPDU_FLAGS, 1, " .... ...1 Topology Change");
235 proto_tree_add_ether_hidden(bpdu_tree, hf_bpdu_root_mac, tvb,
236 BPDU_ROOT_IDENTIFIER + 2, 6,
237 root_identifier_mac);
238 proto_tree_add_text(bpdu_tree, tvb,
239 BPDU_ROOT_IDENTIFIER, 8,
240 "Root Identifier: %d / %s",
241 root_identifier_bridge_priority,
242 root_identifier_mac_str);
243 proto_tree_add_uint(bpdu_tree, hf_bpdu_root_cost, tvb,
244 BPDU_ROOT_PATH_COST, 4,
246 proto_tree_add_text(bpdu_tree, tvb,
247 BPDU_BRIDGE_IDENTIFIER, 8,
248 "Bridge Identifier: %d / %s",
249 bridge_identifier_bridge_priority,
250 bridge_identifier_mac_str);
251 proto_tree_add_ether_hidden(bpdu_tree, hf_bpdu_bridge_mac, tvb,
252 BPDU_BRIDGE_IDENTIFIER + 2, 6,
253 bridge_identifier_mac);
254 proto_tree_add_uint(bpdu_tree, hf_bpdu_port_id, tvb,
255 BPDU_PORT_IDENTIFIER, 2,
257 proto_tree_add_double(bpdu_tree, hf_bpdu_msg_age, tvb,
260 proto_tree_add_double(bpdu_tree, hf_bpdu_max_age, tvb,
263 proto_tree_add_double(bpdu_tree, hf_bpdu_hello_time, tvb,
266 proto_tree_add_double(bpdu_tree, hf_bpdu_forward_delay, tvb,
267 BPDU_FORWARD_DELAY, 2,
273 proto_register_bpdu(void)
276 static hf_register_info hf[] = {
278 { "Protocol Identifier", "stp.protocol",
279 FT_UINT16, BASE_HEX, NULL, 0x0,
281 { &hf_bpdu_version_id,
282 { "Protocol Version Identifier", "stp.version",
283 FT_UINT8, BASE_DEC, NULL, 0x0,
286 { "BPDU type", "stp.type",
287 FT_UINT8, BASE_HEX, NULL, 0x0,
290 { "BPDU flags", "stp.flags",
291 FT_UINT8, BASE_HEX, NULL, 0x0,
294 { "Root Identifier", "stp.root.hw",
295 FT_ETHER, BASE_NONE, NULL, 0x0,
297 { &hf_bpdu_root_cost,
298 { "Root Path Cost", "stp.root.cost",
299 FT_UINT32, BASE_DEC, NULL, 0x0,
301 { &hf_bpdu_bridge_mac,
302 { "Bridge Identifier", "stp.bridge.hw",
303 FT_ETHER, BASE_NONE, NULL, 0x0,
306 { "Port identifier", "stp.port",
307 FT_UINT16, BASE_HEX, NULL, 0x0,
310 { "Message Age", "stp.msg_age",
311 FT_DOUBLE, BASE_NONE, NULL, 0x0,
314 { "Max Age", "stp.max_age",
315 FT_DOUBLE, BASE_NONE, NULL, 0x0,
317 { &hf_bpdu_hello_time,
318 { "Hello Time", "stp.hello",
319 FT_DOUBLE, BASE_NONE, NULL, 0x0,
321 { &hf_bpdu_forward_delay,
322 { "Forward Delay", "stp.forward",
323 FT_DOUBLE, BASE_NONE, NULL, 0x0,
326 static gint *ett[] = {
330 proto_bpdu = proto_register_protocol("Spanning Tree Protocol", "STP", "stp");
331 proto_register_field_array(proto_bpdu, hf, array_length(hf));
332 proto_register_subtree_array(ett, array_length(ett));
334 register_dissector("bpdu", dissect_bpdu, proto_bpdu);
338 proto_reg_handoff_bpdu(void)
341 * Get handle for the GVRP dissector.
343 gvrp_handle = find_dissector("gvrp");
346 * Get handle for the GMRP dissector.
348 gmrp_handle = find_dissector("gmrp");
350 dissector_add("llc.dsap", SAP_BPDU, dissect_bpdu, proto_bpdu);
351 dissector_add("ppp.protocol", PPP_BPDU, dissect_bpdu, proto_bpdu);