2 * Routines for ethernet packet disassembly
4 * $Id: packet-eth.c,v 1.53 2001/01/03 10:34:41 guy Exp $
6 * Ethereal - Network traffic analyzer
7 * By Gerald Combs <gerald@zing.org>
8 * Copyright 1998 Gerald Combs
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version 2
14 * of the License, or (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
30 #ifdef HAVE_SYS_TYPES_H
31 # include <sys/types.h>
38 #include "packet-eth.h"
39 #include "packet-ipx.h"
40 #include "packet-isl.h"
41 #include "packet-llc.h"
43 extern const value_string etype_vals[];
45 /* protocols and header fields */
46 static int proto_eth = -1;
47 static int hf_eth_dst = -1;
48 static int hf_eth_src = -1;
49 static int hf_eth_len = -1;
50 static int hf_eth_type = -1;
51 static int hf_eth_addr = -1;
52 static int hf_eth_trailer = -1;
54 static gint ett_ieee8023 = -1;
55 static gint ett_ether2 = -1;
57 static dissector_handle_t isl_handle;
58 static dissector_handle_t llc_handle;
60 #define ETH_HEADER_SIZE 14
62 /* These are the Netware-ish names for the different Ethernet frame types.
63 EthernetII: The ethernet with a Type field instead of a length field
64 Ethernet802.2: An 802.3 header followed by an 802.2 header
65 Ethernet802.3: A raw 802.3 packet. IPX/SPX can be the only payload.
66 There's no 802.2 hdr in this.
67 EthernetSNAP: Basically 802.2, just with 802.2SNAP. For our purposes,
68 there's no difference between 802.2 and 802.2SNAP, since we just
69 pass it down to the LLC dissector. -- Gilbert
72 #define ETHERNET_802_2 1
73 #define ETHERNET_802_3 2
74 #define ETHERNET_SNAP 3
77 capture_eth(const u_char *pd, int offset, packet_counts *ld)
79 guint16 etype, length;
80 int ethhdr_type; /* the type of ethernet frame */
82 if (!BYTES_ARE_IN_FRAME(offset, ETH_HEADER_SIZE)) {
87 etype = pntohs(&pd[offset+12]);
89 /* either ethernet802.3 or ethernet802.2 */
90 if (etype <= IEEE_802_3_MAX_LEN) {
93 /* Is there an 802.2 layer? I can tell by looking at the first 2
94 bytes after the 802.3 header. If they are 0xffff, then what
95 follows the 802.3 header is an IPX payload, meaning no 802.2.
96 (IPX/SPX is they only thing that can be contained inside a
97 straight 802.3 packet). A non-0xffff value means that there's an
98 802.2 layer inside the 802.3 layer */
99 if (pd[offset+14] == 0xff && pd[offset+15] == 0xff) {
100 ethhdr_type = ETHERNET_802_3;
103 ethhdr_type = ETHERNET_802_2;
106 /* Oh, yuck. Cisco ISL frames require special interpretation of the
107 destination address field; fortunately, they can be recognized by
108 checking the first 5 octets of the destination address, which are
109 01-00-0C-00-00 for ISL frames. */
110 if (pd[offset] == 0x01 && pd[offset+1] == 0x00 && pd[offset+2] == 0x0C
111 && pd[offset+3] == 0x00 && pd[offset+4] == 0x00) {
112 capture_isl(pd, offset, ld);
116 /* Convert the LLC length from the 802.3 header to a total
117 frame length, by adding in the size of any data that preceded
118 the Ethernet header, and adding in the Ethernet header size,
119 and set the payload and captured-payload lengths to the minima
120 of the total length and the frame lengths. */
121 length += offset + ETH_HEADER_SIZE;
124 if (pi.captured_len > length)
125 pi.captured_len = length;
127 ethhdr_type = ETHERNET_II;
129 offset += ETH_HEADER_SIZE;
131 switch (ethhdr_type) {
133 capture_ipx(pd, offset, ld);
136 capture_llc(pd, offset, ld);
139 capture_ethertype(etype, offset, pd, ld);
145 dissect_eth(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
147 int orig_captured_len;
152 volatile guint16 etype;
153 volatile int ethhdr_type; /* the type of Ethernet frame */
154 volatile int eth_offset;
155 volatile guint16 length;
156 tvbuff_t *volatile next_tvb;
157 tvbuff_t *volatile trailer_tvb;
158 proto_tree *volatile fh_tree;
161 CHECK_DISPLAY_AS_DATA(proto_eth, tvb, pinfo, tree);
163 tvb_compat(tvb, &pd, (int*)ð_offset);
165 pinfo->current_proto = "Ethernet";
166 orig_captured_len = pinfo->captured_len;
168 if (check_col(pinfo->fd, COL_PROTOCOL))
169 col_set_str(pinfo->fd, COL_PROTOCOL, "Ethernet");
171 src = tvb_get_ptr(tvb, 6, 6);
172 dst = tvb_get_ptr(tvb, 0, 6);
173 SET_ADDRESS(&pinfo->dl_src, AT_ETHER, 6, src);
174 SET_ADDRESS(&pinfo->src, AT_ETHER, 6, src);
175 SET_ADDRESS(&pinfo->dl_dst, AT_ETHER, 6, dst);
176 SET_ADDRESS(&pinfo->dst, AT_ETHER, 6, dst);
178 etype = tvb_get_ntohs(tvb, 12);
180 /* either ethernet802.3 or ethernet802.2 */
181 if (etype <= IEEE_802_3_MAX_LEN) {
184 /* Is there an 802.2 layer? I can tell by looking at the first 2
185 bytes after the 802.3 header. If they are 0xffff, then what
186 follows the 802.3 header is an IPX payload, meaning no 802.2.
187 (IPX/SPX is they only thing that can be contained inside a
188 straight 802.3 packet). A non-0xffff value means that there's an
189 802.2 layer inside the 802.3 layer */
190 ethhdr_type = ETHERNET_802_2;
192 if (tvb_get_ntohs(tvb, 14) == 0xffff) {
193 ethhdr_type = ETHERNET_802_3;
196 CATCH2(BoundsError, ReportedBoundsError) {
202 /* Oh, yuck. Cisco ISL frames require special interpretation of the
203 destination address field; fortunately, they can be recognized by
204 checking the first 5 octets of the destination address, which are
205 01-00-0C-00-00 for ISL frames. */
206 if ( tvb_get_guint8(tvb, 0) == 0x01 &&
207 tvb_get_guint8(tvb, 1) == 0x00 &&
208 tvb_get_guint8(tvb, 2) == 0x0C &&
209 tvb_get_guint8(tvb, 3) == 0x00 &&
210 tvb_get_guint8(tvb, 4) == 0x00 ) {
211 call_dissector(isl_handle, tvb, pinfo, tree);
215 if (check_col(pinfo->fd, COL_INFO)) {
216 col_add_fstr(pinfo->fd, COL_INFO, "IEEE 802.3 %s",
217 (ethhdr_type == ETHERNET_802_3 ? "Raw " : ""));
221 ti = proto_tree_add_protocol_format(tree, proto_eth, tvb, 0, ETH_HEADER_SIZE,
222 "IEEE 802.3 %s", (ethhdr_type == ETHERNET_802_3 ? "Raw " : ""));
224 fh_tree = proto_item_add_subtree(ti, ett_ieee8023);
226 proto_tree_add_ether(fh_tree, hf_eth_dst, tvb, 0, 6, dst);
227 proto_tree_add_ether(fh_tree, hf_eth_src, tvb, 6, 6, src);
229 /* add items for eth.addr filter */
230 proto_tree_add_ether_hidden(fh_tree, hf_eth_addr, tvb, 0, 6, dst);
231 proto_tree_add_ether_hidden(fh_tree, hf_eth_addr, tvb, 6, 6, src);
233 proto_tree_add_uint(fh_tree, hf_eth_len, tvb, 12, 2, length);
236 /* Convert the LLC length from the 802.3 header to a total
237 frame length, by adding in the size of any data that preceded
238 the Ethernet header, and adding in the Ethernet header size,
239 and set the payload and captured-payload lengths to the minima
240 of the total length and the frame lengths.
242 XXX - when all dissectors are tvbuffified we shouldn't have to
244 length += eth_offset + ETH_HEADER_SIZE;
245 if (pinfo->len > length)
247 if (pinfo->captured_len > length)
248 pinfo->captured_len = length;
250 ethhdr_type = ETHERNET_II;
251 if (check_col(pinfo->fd, COL_INFO))
252 col_set_str(pinfo->fd, COL_INFO, "Ethernet II");
255 ti = proto_tree_add_protocol_format(tree, proto_eth, tvb, 0, ETH_HEADER_SIZE,
258 fh_tree = proto_item_add_subtree(ti, ett_ether2);
260 proto_tree_add_ether(fh_tree, hf_eth_dst, tvb, 0, 6, dst);
261 proto_tree_add_ether(fh_tree, hf_eth_src, tvb, 6, 6, src);
262 /* add items for eth.addr filter */
263 proto_tree_add_ether_hidden(fh_tree, hf_eth_addr, tvb, 0, 6, dst);
264 proto_tree_add_ether_hidden(fh_tree, hf_eth_addr, tvb, 6, 6, src);
267 eth_offset += ETH_HEADER_SIZE;
269 if (etype <= IEEE_802_3_MAX_LEN) {
270 /* Give the next dissector only 'length' number of bytes */
272 next_tvb = tvb_new_subset(tvb, ETH_HEADER_SIZE, etype, etype);
273 trailer_tvb = tvb_new_subset(tvb, ETH_HEADER_SIZE + etype, -1, -1);
275 CATCH2(BoundsError, ReportedBoundsError) {
278 the packet doesn't have "etype" bytes worth of
279 captured data left in it - or it may not even have
280 "etype" bytes worth of data in it, period -
281 so the "tvb_new_subset()" creating "next_tvb"
286 the packet has exactly "etype" bytes worth of
287 captured data left in it, so the "tvb_new_subset()"
288 creating "trailer_tvb" threw an exception.
290 In either case, this means that all the data in the frame
291 is within the length value, so we give all the data to the
292 next protocol and have no trailer. */
293 next_tvb = tvb_new_subset(tvb, ETH_HEADER_SIZE, -1, etype);
299 next_tvb = NULL; /* "ethertype()" will create the next tvb for us */
300 trailer_tvb = NULL; /* we don't know how big the trailer is */
303 switch (ethhdr_type) {
305 dissect_ipx(next_tvb, pinfo, tree);
308 call_dissector(llc_handle, next_tvb, pinfo, tree);
311 length_before = tvb_reported_length(tvb);
312 length = ethertype(etype, tvb, ETH_HEADER_SIZE, pinfo, tree, fh_tree,
313 hf_eth_type) + ETH_HEADER_SIZE;
314 if (length < length_before) {
316 * Create a tvbuff for the padding.
319 trailer_tvb = tvb_new_subset(tvb, length, -1, -1);
321 CATCH2(BoundsError, ReportedBoundsError) {
322 /* The packet doesn't have "length" bytes worth of captured
323 data left in it. No trailer to display. */
331 /* If there's some bytes left over, mark them. */
332 if (trailer_tvb && tree) {
333 guint trailer_length;
335 trailer_length = tvb_length(trailer_tvb);
336 if (trailer_length != 0) {
337 proto_tree_add_item(fh_tree, hf_eth_trailer, trailer_tvb, 0,
338 trailer_length, FALSE);
345 proto_register_eth(void)
347 static hf_register_info hf[] = {
350 { "Destination", "eth.dst", FT_ETHER, BASE_NONE, NULL, 0x0,
351 "Destination Hardware Address" }},
354 { "Source", "eth.src", FT_ETHER, BASE_NONE, NULL, 0x0,
355 "Source Hardware Address" }},
358 { "Length", "eth.len", FT_UINT16, BASE_DEC, NULL, 0x0,
361 /* registered here but handled in ethertype.c */
363 { "Type", "eth.type", FT_UINT16, BASE_HEX, VALS(etype_vals), 0x0,
366 { "Source or Destination Address", "eth.addr", FT_ETHER, BASE_NONE, NULL, 0x0,
367 "Source or Destination Hardware Address" }},
370 { "Trailer", "eth.trailer", FT_BYTES, BASE_NONE, NULL, 0x0,
371 "Ethernet Trailer or Checksum" }},
374 static gint *ett[] = {
379 proto_eth = proto_register_protocol("Ethernet", "Ethernet", "eth");
380 proto_register_field_array(proto_eth, hf, array_length(hf));
381 proto_register_subtree_array(ett, array_length(ett));
383 register_dissector("eth", dissect_eth);
387 proto_reg_handoff_eth(void)
390 * Get handles for the ISL and LLC dissectors.
392 isl_handle = find_dissector("isl");
393 llc_handle = find_dissector("llc");
395 dissector_add("wtap_encap", WTAP_ENCAP_ETHERNET, dissect_eth);