2 * Routines for Frame Relay dissection
4 * Copyright 2001, Paul Ionescu <paul@acorp.ro>
6 * $Id: packet-fr.c,v 1.15 2001/03/30 11:14:41 guy Exp $
8 * Ethereal - Network traffic analyzer
9 * By Gerald Combs <gerald@zing.org>
10 * Copyright 1998 Gerald Combs
13 * This program is free software; you can redistribute it and/or
14 * modify it under the terms of the GNU General Public License
15 * as published by the Free Software Foundation; either version 2
16 * of the License, or (at your option) any later version.
18 * This program is distributed in the hope that it will be useful,
19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21 * GNU General Public License for more details.
23 * You should have received a copy of the GNU General Public License
24 * along with this program; if not, write to the Free Software
25 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
30 * http://www.protocols.com/pbook/frame.htm
31 * http://www.frforum.com/5000/Approved/FRF.3/FRF.3.2.pdf
32 * ITU Recommendation Q.933
36 * http://www.trillium.com/whats-new/wp_frmrly.html
51 #include "packet-fr.h"
52 #include "packet-osi.h"
53 #include "packet-llc.h"
54 #include "packet-chdlc.h"
59 #include "conversation.h"
62 * Bits in the address field.
64 #define FRELAY_DLCI 0xfcf0 /* 2 byte DLCI Address */
65 #define FRELAY_CR 0x0200 /* Command/Response bit */
66 #define FRELAY_EA 0x0001 /* Address Extension bit */
67 #define FRELAY_FECN 0x0008 /* Forward Explicit Congestion Notification */
68 #define FRELAY_BECN 0x0004 /* Backward Explicit Congestion Notification */
69 #define FRELAY_DE 0x0002 /* Discard Eligibility */
70 #define FRELAY_DC 0x0002 /* Control bits */
73 * Extract the DLCI from the address field.
75 #define EXTRACT_DLCI(addr) ((((addr)&0xfc00) >> 6) | (((addr)&0xf0) >> 4))
77 #define FROM_DCE 0x80 /* for direction setting */
79 static gint proto_fr = -1;
80 static gint ett_fr = -1;
81 static gint hf_fr_dlci = -1;
82 static gint hf_fr_cr = -1;
83 static gint hf_fr_becn = -1;
84 static gint hf_fr_fecn = -1;
85 static gint hf_fr_de = -1;
86 static gint hf_fr_ea = -1;
87 static gint hf_fr_dc = -1;
88 static gint hf_fr_nlpid = -1;
89 static gint hf_fr_oui = -1;
90 static gint hf_fr_pid = -1;
91 static gint hf_fr_snaptype = -1;
92 static gint hf_fr_chdlctype = -1;
94 static const true_false_string cmd_string = {
98 static const true_false_string ctrl_string = {
102 static const true_false_string ea_string = {
108 * This isn't the same as "nlpid_vals[]"; 0x08 is Q.933, not Q.931,
109 * and 0x09 is LMI, not Q.2931.
111 static const value_string fr_nlpid_vals[] = {
112 { NLPID_NULL, "NULL" },
113 { NLPID_T_70, "T.70" },
114 { NLPID_X_633, "X.633" },
115 { NLPID_Q_931, "Q.933" },
116 { NLPID_LMI, "LMI" },
117 { NLPID_Q_2119, "Q.2119" },
118 { NLPID_SNAP, "SNAP" },
119 { NLPID_ISO8473_CLNP, "CLNP" },
120 { NLPID_ISO9542_ESIS, "ESIS" },
121 { NLPID_ISO10589_ISIS, "ISIS" },
122 { NLPID_ISO10747_IDRP, "IDRP" },
123 { NLPID_ISO9542X25_ESIS, "ESIS (X.25)" },
124 { NLPID_ISO10030, "ISO 10030" },
125 { NLPID_ISO11577, "ISO 11577" },
126 { NLPID_COMPRESSED, "Data compression protocol" },
128 { NLPID_PPP, "PPP" },
132 dissector_table_t fr_subdissector_table;
134 static void dissect_fr_nlpid(tvbuff_t *tvb, int offset, packet_info *pinfo,
135 proto_tree *tree, proto_item *ti,
136 proto_tree *fr_tree, guint8 fr_ctrl);
137 static void dissect_lapf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
138 static void dissect_fr_xid(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
140 static void dissect_fr(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
142 proto_item *ti = NULL;
143 proto_tree *fr_tree = NULL;
144 guint16 fr_header,fr_type,offset=2; /* default header length of FR is 2 bytes */
149 pinfo->current_proto = "Frame Relay";
150 if (check_col(pinfo->fd, COL_PROTOCOL))
151 col_set_str(pinfo->fd, COL_PROTOCOL, "FR");
153 if (pinfo->pseudo_header->x25.flags & FROM_DCE) {
154 if(check_col(pinfo->fd, COL_RES_DL_DST))
155 col_set_str(pinfo->fd, COL_RES_DL_DST, "DTE");
156 if(check_col(pinfo->fd, COL_RES_DL_SRC))
157 col_set_str(pinfo->fd, COL_RES_DL_SRC, "DCE");
160 if(check_col(pinfo->fd, COL_RES_DL_DST))
161 col_set_str(pinfo->fd, COL_RES_DL_DST, "DCE");
162 if(check_col(pinfo->fd, COL_RES_DL_SRC))
163 col_set_str(pinfo->fd, COL_RES_DL_SRC, "DTE");
166 /*XXX We should check the EA bits and use that to generate the address. */
168 fr_header = tvb_get_ntohs(tvb, 0);
169 fr_ctrl = tvb_get_guint8( tvb, 2);
170 address = EXTRACT_DLCI(fr_header);
172 if (check_col(pinfo->fd, COL_INFO))
173 col_add_fstr(pinfo->fd, COL_INFO, "DLCI %u", address);
176 ti = proto_tree_add_protocol_format(tree, proto_fr, tvb, 0, 3, "Frame Relay");
177 fr_tree = proto_item_add_subtree(ti, ett_fr);
179 decode_bitfield_value(buf, fr_header, FRELAY_DLCI, 16);
180 proto_tree_add_uint_format(fr_tree, hf_fr_dlci, tvb, 0, 2, address,
181 "%sDLCI: %u", buf, address);
182 proto_tree_add_boolean(fr_tree, hf_fr_cr, tvb, 0, offset, fr_header);
183 proto_tree_add_boolean(fr_tree, hf_fr_fecn, tvb, 0, offset, fr_header);
184 proto_tree_add_boolean(fr_tree, hf_fr_becn, tvb, 0, offset, fr_header);
185 proto_tree_add_boolean(fr_tree, hf_fr_de, tvb, 0, offset, fr_header);
186 proto_tree_add_boolean(fr_tree, hf_fr_ea, tvb, 0, offset, fr_header);
189 if (fr_ctrl == XDLC_U) {
191 proto_tree_add_text(fr_tree, tvb, offset, 0, "------- Q.933 Encapsulation -------");
193 * XXX - if we're going to show this as Unnumbered
194 * Information, should we just hand it to
195 * "dissect_xdlc_control()"?
197 proto_tree_add_text(fr_tree, tvb, offset, 1, "Unnumbered Information");
201 SET_ADDRESS(&pinfo->dl_src, AT_DLCI, 2, (guint8*)&address);
203 dissect_fr_nlpid(tvb, offset, pinfo, tree, ti, fr_tree, fr_ctrl);
206 /* this must be some sort of lapf on DLCI 0 for SVC */
207 /* because DLCI 0 is rezerved for LMI and SVC signaling encaplulated in lapf */
208 /* and LMI is transmitted in unnumbered information (03) */
209 /* so this must be lapf (guessing) */
210 dissect_lapf(tvb_new_subset(tvb,offset,-1,-1),pinfo,tree);
213 if (fr_ctrl == (XDLC_U|XDLC_XID)) {
214 dissect_fr_xid(tvb_new_subset(tvb,offset,-1,-1),pinfo,tree);
219 * If the data does not start with unnumbered information (03) and
220 * the DLCI# is not 0, then there may be Cisco Frame Relay encapsulation.
222 proto_tree_add_text(fr_tree, tvb, offset, 0, "------- Cisco Encapsulation -------");
223 fr_type = tvb_get_ntohs(tvb, offset);
225 /* Include the second byte of the Cisco HDLC type
226 in the top-level protocol tree item. */
227 proto_item_set_len(ti, proto_item_get_len(ti) + 1);
229 chdlctype(fr_type, tvb, offset+2, pinfo, tree, fr_tree, hf_fr_chdlctype);
234 void dissect_fr_uncompressed(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
236 proto_item *ti = NULL;
237 proto_tree *fr_tree = NULL;
239 CHECK_DISPLAY_AS_DATA(proto_fr, tvb, pinfo, tree);
241 pinfo->current_proto = "Frame Relay";
242 if (check_col(pinfo->fd, COL_PROTOCOL))
243 col_set_str(pinfo->fd, COL_PROTOCOL, "FR");
244 if (check_col(pinfo->fd, COL_INFO))
245 col_clear(pinfo->fd, COL_INFO);
248 ti = proto_tree_add_protocol_format(tree, proto_fr, tvb, 0, 4, "Frame Relay");
249 fr_tree = proto_item_add_subtree(ti, ett_fr);
251 dissect_fr_nlpid(tvb, 0, pinfo, tree, ti, fr_tree, XDLC_U);
254 static void dissect_fr_nlpid(tvbuff_t *tvb, int offset, packet_info *pinfo,
255 proto_tree *tree, proto_item *ti,
256 proto_tree *fr_tree, guint8 fr_ctrl)
261 fr_nlpid = tvb_get_guint8 (tvb,offset);
264 proto_tree_add_text(fr_tree, tvb, offset, 1, "Padding");
267 /* Include the padding in the top-level protocol tree item. */
268 proto_item_set_len(ti, proto_item_get_len(ti) + 1);
270 fr_nlpid=tvb_get_guint8( tvb,offset);
274 * OSI network layer protocols consider the NLPID to be part
275 * of the frame, so we'll pass it as part of the payload and,
276 * if the protocol is one of those, add it as a hidden item here.
278 next_tvb = tvb_new_subset(tvb,offset,-1,-1);
279 if (dissector_try_port(osinl_subdissector_table, fr_nlpid, next_tvb,
282 * Yes, we got a match. Add the NLPID as a hidden item,
283 * so you can, at least, filter on it.
286 proto_tree_add_uint_hidden(fr_tree, hf_fr_nlpid,
287 tvb, offset, 1, fr_nlpid );
292 * All other protocols don't.
294 * XXX - not true for Q.933 and LMI, but we don't yet have a
295 * Q.933 dissector (it'd be similar to the Q.931 dissector,
296 * but I don't think it'd be identical, although it's less
297 * different than is the Q.2931 dissector), and the LMI
298 * dissector doesn't yet put the protocol discriminator
299 * (NLPID) into the tree.
301 * Note that an NLPID of 0x08 for Q.933 could either be a
302 * Q.933 signaling message or a message for a protocol
303 * identified by a 2-octet layer 2 protocol type and a
304 * 2-octet layer 3 protocol type, those protocol type
305 * octets having the values from octets 6, 6a, 7, and 7a
306 * of a Q.931 low layer compatibility information element
307 * (section 4.5.19 of Q.931; Q.933 says they have the values
308 * from a Q.933 low layer compatibility information element,
309 * but Q.933 low layer compatibility information elements
310 * don't have protocol values in them).
312 * Assuming that, as Q.933 seems to imply, that Q.933 messages
313 * look just like Q.931 messages except where it explicitly
314 * says they differ, then the octet after the NLPID would,
315 * in a Q.933 message, have its upper 4 bits zero (that's
316 * the length of the call reference value, in Q.931, and
317 * is limited to 15 or fewer octets). As appears to be the case,
318 * octet 6 of a Q.931 low layer compatibility element has the
319 * 0x40 bit set, so you can distinguish between a Q.933
320 * message and an encapsulated packet by checking whether
321 * the upper 4 bits of the octet after the NLPID are zero.
323 * To handle this, we'd handle Q.933's NLPID specially, which
324 * we'd want to do anyway, so that we give it a tvbuff that
325 * includes the NLPID.
328 proto_tree_add_uint(fr_tree, hf_fr_nlpid, tvb, offset, 1, fr_nlpid );
331 /* Include the NLPID in the top-level protocol tree item. */
332 proto_item_set_len(ti, proto_item_get_len(ti) + 1);
339 /* Include the SNAP header in the top-level protocol tree item. */
340 proto_item_set_len(ti, proto_item_get_len(ti) + 5);
342 dissect_snap(tvb, offset, pinfo, tree, fr_tree, fr_ctrl,
343 hf_fr_oui, hf_fr_snaptype, hf_fr_pid, 0);
347 next_tvb = tvb_new_subset(tvb,offset,-1,-1);
348 if (!dissector_try_port(fr_subdissector_table,fr_nlpid,
349 next_tvb, pinfo, tree))
350 dissect_data(next_tvb, 0, pinfo, tree);
355 static void dissect_lapf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
357 proto_tree_add_text(tree, tvb, 0, 0, "Frame relay lapf not yet implemented");
358 dissect_data(tvb_new_subset(tvb,0,-1,-1),0,pinfo,tree);
360 static void dissect_fr_xid(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
362 proto_tree_add_text(tree, tvb, 0, 0, "Frame relay xid not yet implemented");
363 dissect_data(tvb_new_subset(tvb,0,-1,-1),0,pinfo,tree);
366 /* Register the protocol with Ethereal */
367 void proto_register_fr(void)
369 static hf_register_info hf[] = {
372 "DLCI", "fr.dlci", FT_UINT16, BASE_DEC,
373 NULL, FRELAY_DLCI, "Data-Link Connection Identifier" }},
375 "CR", "fr.cr", FT_BOOLEAN, 16, TFS(&cmd_string),
376 FRELAY_CR, "Command/Response" }},
378 "DC", "fr.dc", FT_BOOLEAN, 16, TFS(&ctrl_string),
379 FRELAY_CR, "Address/Control" }},
382 "FECN", "fr.fecn", FT_BOOLEAN, 16,
383 NULL, FRELAY_FECN, "Forward Explicit Congestion Notification" }},
385 "BECN", "fr.becn", FT_BOOLEAN, 16,
386 NULL, FRELAY_BECN, "Backward Explicit Congestion Notification" }},
388 "DE", "fr.de", FT_BOOLEAN, 16,
389 NULL, FRELAY_DE, "Discard Eligibility" }},
391 "EA", "fr.ea", FT_BOOLEAN, 16, TFS(&ea_string),
392 FRELAY_EA, "Extended Address" }},
394 "NLPID", "fr.nlpid", FT_UINT8, BASE_HEX,
395 VALS(fr_nlpid_vals), 0x0, "FrameRelay Encapsulated Protocol NLPID" }},
397 "Organization Code", "fr.snap.oui", FT_UINT24, BASE_HEX,
398 VALS(oui_vals), 0x0, ""}},
400 "Protocol ID", "fr.snap.pid", FT_UINT16, BASE_HEX,
403 "Type", "fr.snaptype", FT_UINT16, BASE_HEX,
404 VALS(etype_vals), 0x0, "FrameRelay SNAP Encapsulated Protocol" }},
405 { &hf_fr_chdlctype, {
406 "Type", "fr.chdlctype", FT_UINT16, BASE_HEX,
407 VALS(chdlc_vals), 0x0, "FrameRelay Cisco HDLC Encapsulated Protocol" }},
411 /* Setup protocol subtree array */
412 static gint *ett[] = {
416 proto_fr = proto_register_protocol("Frame Relay", "FR", "fr");
417 proto_register_field_array(proto_fr, hf, array_length(hf));
418 proto_register_subtree_array(ett, array_length(ett));
420 fr_subdissector_table = register_dissector_table("fr.ietf");
423 void proto_reg_handoff_fr(void)
425 dissector_add("wtap_encap", WTAP_ENCAP_FRELAY, dissect_fr, proto_fr);
426 dissector_add("gre.proto", GRE_FR, dissect_fr, proto_fr);