2 * Routines for the disassembly of the "Cisco Discovery Protocol"
3 * (c) Copyright Hannes R. Boehm <hannes@boehm.org>
5 * $Id: packet-cdp.c,v 1.20 2000/01/22 04:59:54 guy Exp $
7 * Ethereal - Network traffic analyzer
8 * By Gerald Combs <gerald@zing.org>
9 * Copyright 1998 Gerald Combs
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version 2
15 * of the License, or (at your option) any later version.
17 * This program is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, write to the Free Software
24 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
29 #ifdef HAVE_SYS_TYPES_H
30 #include <sys/types.h>
43 * http://www.cisco.com/univercd/cc/td/doc/product/lan/trsrb/frames.htm
45 * for some information on CDP.
48 /* Offsets in TLV structure. */
52 static int proto_cdp = -1;
53 static int hf_cdp_version = -1;
54 static int hf_cdp_flags = -1;
55 static int hf_cdp_ttl = -1;
56 static int hf_cdp_tlvtype = -1;
57 static int hf_cdp_tlvlength = -1;
59 static gint ett_cdp = -1;
60 static gint ett_cdp_tlv = -1;
61 static gint ett_cdp_address = -1;
62 static gint ett_cdp_capabilities = -1;
65 dissect_address_tlv(const u_char *pd, int offset, int length, proto_tree *tree);
67 dissect_capabilities(const u_char *pd, int offset, int length, proto_tree *tree);
69 add_multi_line_string_to_tree(proto_tree *tree, gint start, gint len,
70 const gchar *prefix, const gchar *string);
72 #define TYPE_DEVICE_ID 0x0001
73 #define TYPE_ADDRESS 0x0002
74 #define TYPE_PORT_ID 0x0003
75 #define TYPE_CAPABILITIES 0x0004
76 #define TYPE_IOS_VERSION 0x0005
77 #define TYPE_PLATFORM 0x0006
79 static const value_string type_vals[] = {
80 { TYPE_DEVICE_ID, "Device ID" },
81 { TYPE_ADDRESS, "Addresses" },
82 { TYPE_PORT_ID, "Port ID" },
83 { TYPE_CAPABILITIES, "Capabilities" },
84 { TYPE_IOS_VERSION, "Software version" },
85 { TYPE_PLATFORM, "Platform" },
90 dissect_cdp(const u_char *pd, int offset, frame_data *fd, proto_tree *tree)
93 proto_tree *cdp_tree = NULL;
104 if (check_col(fd, COL_PROTOCOL))
105 col_add_str(fd, COL_PROTOCOL, "CDP");
106 if (check_col(fd, COL_INFO))
107 col_add_str(fd, COL_INFO, "Cisco Discovery Protocol");
110 ti = proto_tree_add_item(tree, proto_cdp, offset, END_OF_FRAME, NULL);
111 cdp_tree = proto_item_add_subtree(ti, ett_cdp);
114 proto_tree_add_item(cdp_tree, hf_cdp_version, offset, 1, pd[offset]);
116 proto_tree_add_item_format(cdp_tree, hf_cdp_ttl, offset, 1,
118 "TTL: %u seconds", pd[offset]);
120 proto_tree_add_item_format(cdp_tree, hf_cdp_flags, offset, 2,
122 "Checksum: 0x%04x", pntohs(&pd[offset]));
125 while( IS_DATA_IN_FRAME(offset) ){
126 type = pntohs(&pd[offset + TLV_TYPE]);
127 length = pntohs(&pd[offset + TLV_LENGTH]);
128 type_str = val_to_str(type, type_vals,
134 tlvi = proto_tree_add_text(cdp_tree, offset,
135 length, "Device ID: %s",
137 tlv_tree = proto_item_add_subtree(tlvi,
139 proto_tree_add_item(tlv_tree, hf_cdp_tlvtype,
140 offset + TLV_TYPE, 2, type);
141 proto_tree_add_item(tlv_tree, hf_cdp_tlvlength,
142 offset + TLV_LENGTH, 2, length);
143 proto_tree_add_text(tlv_tree, offset + 4,
144 length - 4, "Device ID: %s",
150 tlvi = proto_tree_add_text(cdp_tree, offset,
151 length, "Addresses");
152 tlv_tree = proto_item_add_subtree(tlvi,
154 proto_tree_add_item(tlv_tree, hf_cdp_tlvtype,
155 offset + TLV_TYPE, 2, type);
156 proto_tree_add_item(tlv_tree, hf_cdp_tlvlength,
157 offset + TLV_LENGTH, 2, length);
160 naddresses = pntohl(&pd[offset]);
161 proto_tree_add_text(tlv_tree, offset, 4,
162 "Number of addresses: %u", naddresses);
165 while (naddresses != 0) {
166 addr_length = dissect_address_tlv(pd,
167 offset, length, tlv_tree);
170 offset += addr_length;
171 length -= addr_length;
178 real_length = length;
179 if (pd[offset + real_length] != 0x00) {
180 /* The length in the TLV doesn't
181 appear to be the length of the
182 TLV, as the byte just past it
183 isn't the first byte of a 2-byte
184 big-endian small integer; make
185 the length of the TLV the length
186 in the TLV, plus 4 bytes for the
187 TLV type and length, minus 1
188 because that's what makes one
190 real_length = length + 3;
192 tlvi = proto_tree_add_text(cdp_tree, offset,
193 real_length, "Port ID: %s",
195 tlv_tree = proto_item_add_subtree(tlvi,
197 proto_tree_add_item(tlv_tree, hf_cdp_tlvtype,
198 offset + TLV_TYPE, 2, type);
199 proto_tree_add_item(tlv_tree, hf_cdp_tlvlength,
200 offset + TLV_LENGTH, 2, length);
201 proto_tree_add_text(tlv_tree, offset + 4,
203 "Sent through Interface: %s",
205 offset += real_length;
207 case TYPE_CAPABILITIES:
208 tlvi = proto_tree_add_text(cdp_tree, offset,
209 length, "Capabilities");
210 tlv_tree = proto_item_add_subtree(tlvi,
212 proto_tree_add_item(tlv_tree, hf_cdp_tlvtype,
213 offset + TLV_TYPE, 2, type);
214 proto_tree_add_item(tlv_tree, hf_cdp_tlvlength,
215 offset + TLV_LENGTH, 2, length);
218 dissect_capabilities(pd, offset, length,
222 case TYPE_IOS_VERSION:
223 tlvi = proto_tree_add_text(cdp_tree, offset,
224 length, "Software Version");
225 tlv_tree = proto_item_add_subtree(tlvi,
227 proto_tree_add_item(tlv_tree, hf_cdp_tlvtype,
228 offset + TLV_TYPE, 2, type);
229 proto_tree_add_item(tlv_tree, hf_cdp_tlvlength,
230 offset + TLV_LENGTH, 2, length);
231 add_multi_line_string_to_tree(tlv_tree,
232 offset + 4, length - 4, "Software Version: ",
238 stringmem = malloc(length);
239 memset(stringmem, '\0', length);
240 memcpy(stringmem, &pd[offset+4], length - 4 );
241 tlvi = proto_tree_add_text(cdp_tree,
242 offset, length, "Platform: %s",
244 tlv_tree = proto_item_add_subtree(tlvi,
246 proto_tree_add_item(tlv_tree, hf_cdp_tlvtype,
247 offset + TLV_TYPE, 2, type);
248 proto_tree_add_item(tlv_tree, hf_cdp_tlvlength,
249 offset + TLV_LENGTH, 2, length);
250 proto_tree_add_text(tlv_tree, offset + 4,
251 length - 4, "Platform: %s", stringmem);
256 tlvi = proto_tree_add_text(cdp_tree, offset,
257 length, "Type: %s, length: %u",
259 tlv_tree = proto_item_add_subtree(tlvi,
261 proto_tree_add_item(tlv_tree, hf_cdp_tlvtype,
262 offset + TLV_TYPE, 2, type);
263 proto_tree_add_item(tlv_tree, hf_cdp_tlvlength,
264 offset + TLV_LENGTH, 2, length);
266 proto_tree_add_text(tlv_tree,
267 offset + 4, length - 4, "Data");
273 dissect_data(pd, offset, fd, cdp_tree);
277 #define PROTO_TYPE_NLPID 1
278 #define PROTO_TYPE_IEEE_802_2 2
280 static const value_string proto_type_vals[] = {
281 { PROTO_TYPE_NLPID, "NLPID" },
282 { PROTO_TYPE_IEEE_802_2, "802.2" },
287 dissect_address_tlv(const u_char *pd, int offset, int length, proto_tree *tree)
290 proto_tree *address_tree;
291 guint8 protocol_type;
292 guint8 protocol_length;
295 guint16 address_length;
296 char *address_type_str;
301 ti = proto_tree_add_notext(tree, offset, length);
302 address_tree = proto_item_add_subtree(ti, ett_cdp_address);
303 protocol_type = pd[offset];
304 proto_tree_add_text(address_tree, offset, 1, "Protocol type: %s",
305 val_to_str(protocol_type, proto_type_vals, "Unknown (0x%02x)"));
310 proto_item_set_text(ti, "Truncated address");
313 protocol_length = pd[offset];
314 proto_tree_add_text(address_tree, offset, 1, "Protocol length: %u",
319 if (length < protocol_length) {
320 proto_item_set_text(ti, "Truncated address");
322 proto_tree_add_text(address_tree, offset, length,
323 "Protocol: %s (truncated)", bytes_to_str(&pd[offset], length));
328 if (protocol_type == PROTO_TYPE_NLPID && protocol_length == 1) {
330 protocol_str = val_to_str(nlpid, nlpid_vals, "Unknown (0x%02x)");
333 if (protocol_str == NULL)
334 protocol_str = bytes_to_str(&pd[offset], protocol_length);
335 proto_tree_add_text(address_tree, offset, protocol_length,
336 "Protocol: %s", protocol_str);
337 offset += protocol_length;
338 length -= protocol_length;
341 proto_item_set_text(ti, "Truncated address");
344 address_length = pntohs(&pd[offset]);
345 proto_tree_add_text(address_tree, offset, 2, "Address length: %u",
350 if (length < address_length) {
351 proto_item_set_text(ti, "Truncated address");
353 proto_tree_add_text(address_tree, offset, length,
354 "Address: %s (truncated)", bytes_to_str(&pd[offset], length));
358 /* XXX - the Cisco document seems to be saying that, for 802.2-format
359 protocol types, 0xAAAA03 0x000000 0x0800 is IPv6, but 0x0800 is
360 the Ethernet protocol type for IPv4. */
361 length = 2 + protocol_length + 2 + address_length;
362 address_type_str = NULL;
364 if (protocol_type == PROTO_TYPE_NLPID && protocol_length == 1) {
367 /* XXX - dissect NLPID_ISO8473_CLNP as OSI CLNP address? */
370 if (address_length == 4) {
371 /* The address is an IP address. */
372 address_type_str = "IP address";
373 address_str = ip_to_str(&pd[offset]);
378 if (address_type_str == NULL)
379 address_type_str = "Address";
380 if (address_str == NULL) {
381 address_str = bytes_to_str(&pd[offset], address_length);
383 proto_item_set_text(ti, "%s: %s", address_type_str, address_str);
384 proto_tree_add_text(address_tree, offset, address_length, "%s: %s",
385 address_type_str, address_str);
386 return 2 + protocol_length + 2 + address_length;
390 dissect_capabilities(const u_char *pd, int offset, int length, proto_tree *tree)
393 proto_tree *capabilities_tree;
394 guint32 capabilities;
398 capabilities = pntohl(&pd[offset]);
399 ti = proto_tree_add_text(tree, offset, length, "Capabilities: 0x%08x",
401 capabilities_tree = proto_item_add_subtree(ti, ett_cdp_capabilities);
402 proto_tree_add_text(capabilities_tree, offset, 4,
403 decode_boolean_bitfield(capabilities, 0x01, 4*8,
404 "Performs level 3 routing",
405 "Doesn't perform level 3 routing"));
406 proto_tree_add_text(capabilities_tree, offset, 4,
407 decode_boolean_bitfield(capabilities, 0x02, 4*8,
408 "Performs level 2 transparent bridging",
409 "Doesn't perform level 2 transparent bridging"));
410 proto_tree_add_text(capabilities_tree, offset, 4,
411 decode_boolean_bitfield(capabilities, 0x04, 4*8,
412 "Performs level 2 source-route bridging",
413 "Doesn't perform level 2 source-route bridging"));
414 proto_tree_add_text(capabilities_tree, offset, 4,
415 decode_boolean_bitfield(capabilities, 0x08, 4*8,
416 "Performs level 2 switching",
417 "Doesn't perform level 2 switching"));
418 proto_tree_add_text(capabilities_tree, offset, 4,
419 decode_boolean_bitfield(capabilities, 0x10, 4*8,
420 "Sends and receives packets for network-layer protocols",
421 "Doesn't send or receive packets for network-layer protocols"));
422 proto_tree_add_text(capabilities_tree, offset, 4,
423 decode_boolean_bitfield(capabilities, 0x20, 4*8,
424 "Doesn't forward IGMP Report packets on nonrouter ports",
425 "Forwards IGMP Report packets on nonrouter ports"));
426 proto_tree_add_text(capabilities_tree, offset, 4,
427 decode_boolean_bitfield(capabilities, 0x40, 4*8,
428 "Provides level 1 functionality",
429 "Doesn't provide level 1 functionality"));
433 add_multi_line_string_to_tree(proto_tree *tree, gint start, gint len,
434 const gchar *prefix, const gchar *string)
443 prefix_len = strlen(prefix);
446 for (i = 0; i < prefix_len; i++)
454 data_len = line_len + 1;
456 line_len = strlen(p);
459 proto_tree_add_text(tree, start, data_len, "%s%.*s", prefix,
470 proto_register_cdp(void)
472 static hf_register_info hf[] = {
474 { "Version", "cdp.version", FT_UINT8, BASE_DEC, NULL, 0x0,
478 { "Flags", "cdp.flags", FT_UINT8, BASE_HEX, NULL, 0x0,
482 { "TTL", "cdp.ttl", FT_UINT16, BASE_DEC, NULL, 0x0,
486 { "Type", "cdp.tlv.type", FT_UINT16, BASE_HEX, VALS(type_vals), 0x0,
490 { "Length", "cdp.tlv.len", FT_UINT16, BASE_DEC, NULL, 0x0,
493 static gint *ett[] = {
497 &ett_cdp_capabilities,
500 proto_cdp = proto_register_protocol("Cisco Discovery Protocol", "cdp");
501 proto_register_field_array(proto_cdp, hf, array_length(hf));
502 proto_register_subtree_array(ett, array_length(ett));