packet-portmap.c

   1 /* packet-portmap.c
   2  * Routines for portmap dissection
   3  *
   4  * $Id: packet-portmap.c,v 1.37 2002/05/11 18:52:55 guy Exp $
   5  *
   6  * Ethereal - Network traffic analyzer
   7  * By Gerald Combs <gerald@ethereal.com>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * Copied from packet-smb.c
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31
  32 #ifdef HAVE_SYS_TYPES_H
  33 #include <sys/types.h>
  34 #endif
  35
  36
  37 #include "packet-rpc.h"
  38 #include "packet-portmap.h"
  39 #include "ipproto.h"
  40 #include "epan/conversation.h"
  41 #include "epan/packet_info.h"
  42
  43 /*
  44  * See:
  45  *
  46  *      RFC 1833, "Binding Protocols for ONC RPC Version 2".
  47  */
  48
  49 static int proto_portmap = -1;
  50 static int hf_portmap_proto = -1;
  51 static int hf_portmap_prog = -1;
  52 static int hf_portmap_proc = -1;
  53 static int hf_portmap_version = -1;
  54 static int hf_portmap_port = -1;
  55 static int hf_portmap_answer = -1;
  56 static int hf_portmap_args = -1;
  57 static int hf_portmap_result = -1;
  58 static int hf_portmap_rpcb = -1;
  59 static int hf_portmap_rpcb_prog = -1;
  60 static int hf_portmap_rpcb_version = -1;
  61 static int hf_portmap_rpcb_netid = -1;
  62 static int hf_portmap_rpcb_addr = -1;
  63 static int hf_portmap_rpcb_owner = -1;
  64 static int hf_portmap_uaddr = -1;
  65
  66
  67 static gint ett_portmap = -1;
  68 static gint ett_portmap_rpcb = -1;
  69 static gint ett_portmap_entry = -1;
  70
  71 static dissector_handle_t rpc_handle;
  72 static dissector_handle_t rpc_tcp_handle;
  73
  74 /* Dissect a getport call */
  75 static int
  76 dissect_getport_call(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,
  77         proto_tree *tree)
  78 {
  79         guint32 proto;
  80         guint32 prog;
  81
  82         /* make sure we remember protocol type until the reply packet */
  83         if(!pinfo->fd->flags.visited){
  84                 rpc_call_info_value *rpc_call=pinfo->private_data;
  85                 if(rpc_call){
  86                         proto = tvb_get_ntohl(tvb, offset+8);
  87                         if(proto==IP_PROTO_UDP){  /* only do this for UDP */
  88                                 rpc_call->private_data=(void *)PT_UDP;
  89                         }
  90                 }
  91         }
  92
  93         if ( tree )
  94         {
  95                 prog = tvb_get_ntohl(tvb, offset+0);
  96                 proto_tree_add_uint_format(tree, hf_portmap_prog, tvb,
  97                         offset, 4, prog, "Program: %s (%u)",
  98                         rpc_prog_name(prog), prog);
  99                 proto_tree_add_item(tree, hf_portmap_version, tvb,
 100                         offset+4, 4, FALSE);
 101
 102                 proto = tvb_get_ntohl(tvb, offset+8);
 103                 proto_tree_add_uint_format(tree, hf_portmap_proto, tvb,
 104                         offset+8, 4, proto, "Proto: %s (%u)", ipprotostr(proto), proto);
 105
 106                 proto_tree_add_item(tree, hf_portmap_port, tvb,
 107                         offset+12, 4, FALSE);
 108         }
 109
 110         return offset+16;
 111 }
 112
 113 static int
 114 dissect_getport_reply(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,
 115         proto_tree *tree)
 116 {
 117         /* we might have learnt a <ipaddr><protocol><port> mapping for ONC-RPC*/
 118         if(!pinfo->fd->flags.visited){
 119                 rpc_call_info_value *rpc_call=pinfo->private_data;
 120                 /* only do this for UDP, TCP does not need anything like this */
 121                 if(rpc_call && ((int)rpc_call->private_data==PT_UDP) ){
 122                         guint32 port;
 123                         port=tvb_get_ntohl(tvb, offset);
 124                         if(port){
 125                                 conversation_t *conv;
 126                                 conv=find_conversation(&pinfo->src, &pinfo->dst, (port_type)rpc_call->private_data, port, 0, NO_ADDR_B|NO_PORT_B);
 127                                 if(!conv){
 128                                         conv=conversation_new(&pinfo->src, &pinfo->dst, (port_type)rpc_call->private_data, port, 0, NO_ADDR_B|NO_PORT_B);
 129                                 }
 130                                 conversation_set_dissector(conv, rpc_handle);
 131                         }
 132                 }
 133         }
 134
 135         offset = dissect_rpc_uint32(tvb, tree, hf_portmap_port,
 136             offset);
 137         return offset;
 138 }
 139
 140 /* Dissect a 'set' call */
 141 static int
 142 dissect_set_call(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,
 143         proto_tree *tree)
 144 {
 145         guint32 proto;
 146         guint32 prog;
 147
 148         if ( tree )
 149         {
 150                 prog = tvb_get_ntohl(tvb, offset+0);
 151                 proto_tree_add_uint_format(tree, hf_portmap_prog, tvb,
 152                         offset, 4, prog, "Program: %s (%d)",
 153                         rpc_prog_name(prog), prog);
 154                 proto_tree_add_item(tree, hf_portmap_version, tvb,
 155                         offset+4, 4, FALSE);
 156
 157                 proto = tvb_get_ntohl(tvb, offset+8);
 158                 proto_tree_add_uint_format(tree, hf_portmap_proto,tvb,
 159                         offset+8, 4, proto, "Proto: %s (%d)", ipprotostr(proto), proto);
 160
 161                 proto_tree_add_item(tree, hf_portmap_port, tvb,
 162                         offset+12, 4, FALSE);
 163         }
 164
 165         return offset+16;
 166 }
 167
 168 /* Dissect a 'unset' call */
 169 static int
 170 dissect_unset_call(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,
 171         proto_tree *tree)
 172 {
 173         guint32 proto;
 174         guint32 prog;
 175
 176         if ( tree )
 177         {
 178                 prog = tvb_get_ntohl(tvb, offset+0);
 179                 proto_tree_add_uint_format(tree, hf_portmap_prog, tvb,
 180                         offset, 4, prog, "Program: %s (%d)",
 181                         rpc_prog_name(prog), prog);
 182                 proto_tree_add_item(tree, hf_portmap_version, tvb,
 183                         offset+4, 4, FALSE);
 184
 185                 proto = tvb_get_ntohl(tvb, offset+8);
 186                 proto_tree_add_uint(tree, hf_portmap_proto, tvb,
 187                         offset+8, 4, proto);
 188
 189                 proto_tree_add_item(tree, hf_portmap_port, tvb,
 190                         offset+12, 4, FALSE);
 191         }
 192
 193         return offset+16;
 194 }
 195
 196 static int
 197 dissect_set_reply(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,
 198         proto_tree *tree)
 199 {
 200         offset = dissect_rpc_bool(tvb, tree, hf_portmap_answer,
 201             offset);
 202         return offset;
 203 }
 204
 205 static int
 206 dissect_dump_entry(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,
 207         proto_tree *tree)
 208 {
 209         int prog, version, proto, port;
 210         proto_item *ti, *subtree;
 211
 212         prog = tvb_get_ntohl(tvb, offset+0);
 213         version = tvb_get_ntohl(tvb, offset+4);
 214         proto = tvb_get_ntohl(tvb, offset+8);
 215         port = tvb_get_ntohl(tvb, offset+12);
 216         if ( tree )
 217         {
 218                 ti = proto_tree_add_text(tree, tvb, offset, 16,
 219                         "Map Entry: %s (%u) V%d",
 220                         rpc_prog_name(prog), prog, version);
 221                 subtree = proto_item_add_subtree(ti, ett_portmap_entry);
 222
 223                 proto_tree_add_uint_format(subtree, hf_portmap_prog, tvb,
 224                         offset+0, 4, prog,
 225                         "Program: %s (%u)", rpc_prog_name(prog), prog);
 226                 proto_tree_add_uint(subtree, hf_portmap_version, tvb,
 227                         offset+4, 4, version);
 228                 proto_tree_add_uint_format(subtree, hf_portmap_proto, tvb,
 229                         offset+8, 4, proto,
 230                         "Protocol: %s (0x%02x)", ipprotostr(proto), proto);
 231                 proto_tree_add_uint(subtree, hf_portmap_port, tvb,
 232                         offset+12, 4, port);
 233         }
 234         offset += 16;
 235         return offset;
 236 }
 237
 238 static int
 239 dissect_dump_reply(tvbuff_t *tvb, int offset, packet_info *pinfo,
 240         proto_tree *tree)
 241 {
 242         offset = dissect_rpc_list(tvb, pinfo, tree, offset,
 243                 dissect_dump_entry);
 244         return offset;
 245 }
 246
 247 /* Dissect a callit call */
 248 static int
 249 dissect_callit_call(tvbuff_t *tvb, int offset, packet_info *pinfo,
 250         proto_tree *tree)
 251 {
 252         guint32 prog, vers, proc;
 253
 254         prog = tvb_get_ntohl(tvb, offset+0);
 255         if ( tree )
 256         {
 257                 proto_tree_add_uint_format(tree, hf_portmap_prog, tvb,
 258                         offset, 4, prog, "Program: %s (%u)",
 259                         rpc_prog_name(prog), prog);
 260         }
 261
 262         vers = tvb_get_ntohl(tvb, offset+4);
 263         if ( tree )
 264         {
 265                 proto_tree_add_uint(tree, hf_portmap_version, tvb,
 266                         offset+4, 4, vers);
 267         }
 268
 269         proc = tvb_get_ntohl(tvb, offset+8);
 270         if ( tree )
 271         {
 272                 proto_tree_add_uint_format(tree, hf_portmap_proc, tvb,
 273                         offset+8, 4, proc, "Procedure: %s (%u)",
 274                         rpc_proc_name(prog, vers, proc), proc);
 275         }
 276
 277         offset += 12;
 278
 279         /* Dissect the arguments for this procedure.
 280            Make the columns non-writable, so the dissector won't change
 281            them out from under us. */
 282         col_set_writable(pinfo->cinfo, FALSE);
 283         offset = dissect_rpc_indir_call(tvb, pinfo, tree, offset,
 284                 hf_portmap_args, prog, vers, proc);
 285
 286         return offset;
 287 }
 288
 289 /* Dissect a callit reply */
 290 static int
 291 dissect_callit_reply(tvbuff_t *tvb, int offset, packet_info *pinfo,
 292         proto_tree *tree)
 293 {
 294         if ( tree )
 295         {
 296                 proto_tree_add_item(tree, hf_portmap_port, tvb,
 297                         offset, 4, FALSE);
 298         }
 299         offset += 4;
 300
 301         /* Dissect the result of this procedure.
 302            Make the columns non-writable, so the dissector won't change
 303            them out from under us. */
 304         col_set_writable(pinfo->cinfo, FALSE);
 305         offset = dissect_rpc_indir_reply(tvb, pinfo, tree, offset,
 306                 hf_portmap_result, hf_portmap_prog, hf_portmap_version,
 307                 hf_portmap_proc);
 308
 309         return offset;
 310 }
 311
 312 /* proc number, "proc name", dissect_request, dissect_reply */
 313 /* NULL as function pointer means: type of arguments is "void". */
 314 static const vsff portmap1_proc[] = {
 315         { PORTMAPPROC_NULL,     "NULL",         NULL,   NULL },
 316         { PORTMAPPROC_SET,      "SET",          NULL,   NULL },
 317         { PORTMAPPROC_UNSET,    "UNSET",        NULL,   NULL },
 318         { PORTMAPPROC_GETPORT,  "GETPORT",      NULL,   NULL },
 319         { PORTMAPPROC_DUMP,     "DUMP",         NULL,   NULL },
 320         { PORTMAPPROC_CALLIT,   "CALLIT",       NULL,   NULL },
 321         { 0,                    NULL,           NULL,   NULL }
 322 };
 323 /* end of Portmap version 1 */
 324
 325 static const vsff portmap2_proc[] = {
 326         { PORTMAPPROC_NULL, "NULL",
 327                 NULL, NULL },
 328         { PORTMAPPROC_SET, "SET",
 329                 dissect_set_call, dissect_set_reply },
 330         { PORTMAPPROC_UNSET, "UNSET",
 331                 dissect_unset_call, dissect_set_reply },
 332         { PORTMAPPROC_GETPORT,  "GETPORT",
 333                 dissect_getport_call, dissect_getport_reply },
 334         { PORTMAPPROC_DUMP, "DUMP",
 335                 NULL, dissect_dump_reply },
 336         { PORTMAPPROC_CALLIT, "CALLIT",
 337                 dissect_callit_call, dissect_callit_reply },
 338         { 0, NULL, NULL, NULL }
 339 };
 340 /* end of Portmap version 2 */
 341
 342
 343 /* RFC 1833, Page 3 */
 344 static int
 345 dissect_rpcb(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree)
 346 {
 347         proto_item* rpcb_item = NULL;
 348         proto_tree* rpcb_tree = NULL;
 349         int old_offset = offset;
 350         guint32 prog;
 351
 352         if (tree) {
 353                 rpcb_item = proto_tree_add_item(tree, hf_portmap_rpcb, tvb,
 354                         offset, -1, FALSE);
 355                 if (rpcb_item)
 356                         rpcb_tree = proto_item_add_subtree(rpcb_item, ett_portmap_rpcb);
 357         }
 358
 359         prog = tvb_get_ntohl(tvb, offset);
 360         if (rpcb_tree)
 361                 proto_tree_add_uint_format(rpcb_tree, hf_portmap_rpcb_prog, tvb,
 362                         offset, 4, prog,
 363                         "Program: %s (%u)", rpc_prog_name(prog), prog);
 364         offset += 4;
 365
 366         offset = dissect_rpc_uint32(tvb, rpcb_tree,
 367             hf_portmap_rpcb_version, offset);
 368         offset = dissect_rpc_string(tvb, rpcb_tree,
 369             hf_portmap_rpcb_netid, offset, NULL);
 370         offset = dissect_rpc_string(tvb, rpcb_tree,
 371             hf_portmap_rpcb_addr, offset, NULL);
 372         offset = dissect_rpc_string(tvb, rpcb_tree,
 373             hf_portmap_rpcb_owner, offset, NULL);
 374
 375         /* now we know, that rpcb is shorter */
 376         if (rpcb_item) {
 377                 proto_item_set_len(rpcb_item, offset - old_offset);
 378         }
 379
 380         return offset;
 381 }
 382
 383
 384
 385 /* RFC 1833, Page 7 */
 386 static int
 387 dissect_rpcb3_getaddr_call(tvbuff_t *tvb, int offset, packet_info *pinfo,
 388         proto_tree *tree)
 389 {
 390         offset = dissect_rpcb(tvb, offset, pinfo, tree);
 391
 392         return offset;
 393 }
 394
 395
 396 /* RFC 1833, Page 7 */
 397 static int
 398 dissect_rpcb3_getaddr_reply(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,
 399         proto_tree *tree)
 400 {
 401         offset = dissect_rpc_string(tvb, tree,
 402             hf_portmap_uaddr, offset, NULL);
 403
 404         return offset;
 405 }
 406
 407
 408 /* RFC 1833, Page 7 */
 409 static int
 410 dissect_rpcb3_dump_reply(tvbuff_t *tvb, int offset, packet_info *pinfo,
 411         proto_tree *tree)
 412 {
 413         offset = dissect_rpc_list(tvb, pinfo, tree, offset, dissect_rpcb);
 414         return offset;
 415 }
 416
 417 /* RFC 1833, page 4 */
 418 static int
 419 dissect_rpcb_rmtcallres(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,
 420         proto_tree *tree)
 421 {
 422         /* Dissect the remote universal address. */
 423         offset = dissect_rpc_string(tvb, tree,
 424             hf_portmap_rpcb_addr, offset, NULL);
 425
 426         /* Dissect the result of this procedure.
 427            Make the columns non-writable, so the dissector won't change
 428            them out from under us. */
 429         col_set_writable(pinfo->cinfo, FALSE);
 430         offset = dissect_rpc_indir_reply(tvb, pinfo, tree, offset,
 431                 hf_portmap_result, hf_portmap_prog, hf_portmap_version,
 432                 hf_portmap_proc);
 433
 434         return offset;
 435 }
 436
 437
 438 /* Portmapper version 3, RFC 1833, Page 7 */
 439 static const vsff portmap3_proc[] = {
 440         { RPCBPROC_NULL,        "NULL",
 441                 NULL, NULL },
 442         { RPCBPROC_SET,         "SET",
 443                 NULL, NULL },
 444         { RPCBPROC_UNSET,       "UNSET",
 445                 NULL, NULL },
 446         { RPCBPROC_GETADDR,     "GETADDR",
 447                 dissect_rpcb3_getaddr_call, dissect_rpcb3_getaddr_reply},
 448         { RPCBPROC_DUMP,        "DUMP",
 449                 NULL, dissect_rpcb3_dump_reply },
 450         { RPCBPROC_CALLIT,      "CALLIT",
 451                 dissect_callit_call, dissect_rpcb_rmtcallres },
 452         { RPCBPROC_GETTIME,     "GETTIME",
 453                 NULL, NULL },
 454         { RPCBPROC_UADDR2TADDR, "UADDR2TADDR",
 455                 NULL, NULL },
 456         { RPCBPROC_TADDR2UADDR, "TADDR2UADDR",
 457                 NULL, NULL },
 458         { 0, NULL, NULL, NULL }
 459 };
 460 /* end of Portmap version 3 */
 461
 462
 463 /* Portmapper version 4, RFC 1833, Page 8 */
 464 static const vsff portmap4_proc[] = {
 465         { RPCBPROC_NULL,        "NULL",
 466                 NULL, NULL },
 467         { RPCBPROC_SET,         "SET",
 468                 NULL, NULL },
 469         { RPCBPROC_UNSET,       "UNSET",
 470                 NULL, NULL },
 471         { RPCBPROC_GETADDR,     "GETADDR",
 472                 dissect_rpcb3_getaddr_call, dissect_rpcb3_getaddr_reply},
 473         { RPCBPROC_DUMP,        "DUMP",
 474                 NULL, dissect_rpcb3_dump_reply },
 475         { RPCBPROC_BCAST,       "BCAST",
 476                 dissect_callit_call, dissect_rpcb_rmtcallres },
 477         { RPCBPROC_GETTIME,     "GETTIME",
 478                 NULL, NULL },
 479         { RPCBPROC_UADDR2TADDR, "UADDR2TADDR",
 480                 NULL, NULL },
 481         { RPCBPROC_TADDR2UADDR, "TADDR2UADDR",
 482                 NULL, NULL },
 483         { RPCBPROC_GETVERSADDR, "GETVERSADDR",
 484                 NULL, NULL },
 485         { RPCBPROC_INDIRECT,    "INDIRECT",
 486                 dissect_callit_call, dissect_rpcb_rmtcallres },
 487         { RPCBPROC_GETADDRLIST, "GETADDRLIST",
 488                 NULL, NULL },
 489         { RPCBPROC_GETSTAT,     "GETSTAT",
 490                 NULL, NULL },
 491         { 0, NULL, NULL, NULL }
 492 };
 493 /* end of Portmap version 4 */
 494
 495 void
 496 proto_register_portmap(void)
 497 {
 498         static hf_register_info hf[] = {
 499                 { &hf_portmap_prog, {
 500                         "Program", "portmap.prog", FT_UINT32, BASE_DEC,
 501                         NULL, 0, "Program", HFILL }},
 502                 { &hf_portmap_port, {
 503                         "Port", "portmap.port", FT_UINT32, BASE_DEC,
 504                         NULL, 0, "Port", HFILL }},
 505                 { &hf_portmap_proc, {
 506                         "Procedure", "portmap.proc", FT_UINT32, BASE_DEC,
 507                         NULL, 0, "Procedure", HFILL }},
 508                 { &hf_portmap_proto, {
 509                         "Protocol", "portmap.proto", FT_UINT32, BASE_DEC,
 510                         NULL, 0, "Protocol", HFILL }},
 511                 { &hf_portmap_version, {
 512                         "Version", "portmap.version", FT_UINT32, BASE_DEC,
 513                         NULL, 0, "Version", HFILL }},
 514                 { &hf_portmap_answer, {
 515                         "Answer", "portmap.answer", FT_BOOLEAN, BASE_DEC,
 516                         NULL, 0, "Answer", HFILL }},
 517                 { &hf_portmap_args, {
 518                         "Arguments", "portmap.args", FT_BYTES, BASE_HEX,
 519                         NULL, 0, "Arguments", HFILL }},
 520                 { &hf_portmap_result, {
 521                         "Result", "portmap.result", FT_BYTES, BASE_HEX,
 522                         NULL, 0, "Result", HFILL }},
 523                 { &hf_portmap_rpcb, {
 524                         "RPCB", "portmap.rpcb", FT_NONE, 0,
 525                         NULL, 0, "RPCB", HFILL }},
 526                 { &hf_portmap_rpcb_prog, {
 527                         "Program", "portmap.rpcb.prog", FT_UINT32, BASE_DEC,
 528                         NULL, 0, "Program", HFILL }},
 529                 { &hf_portmap_rpcb_version, {
 530                         "Version", "portmap.rpcb.version", FT_UINT32, BASE_DEC,
 531                         NULL, 0, "Version", HFILL }},
 532                 { &hf_portmap_rpcb_netid, {
 533                         "Network Id", "portmap.rpcb.netid", FT_STRING, BASE_DEC,
 534                         NULL, 0, "Network Id", HFILL }},
 535                 { &hf_portmap_rpcb_addr, {      /* address in rpcb structure in request */
 536                         "Universal Address", "portmap.rpcb.addr", FT_STRING, BASE_DEC,
 537                         NULL, 0, "Universal Address", HFILL }},
 538                 { &hf_portmap_rpcb_owner, {
 539                         "Owner of this Service", "portmap.rpcb.owner", FT_STRING, BASE_DEC,
 540                         NULL, 0, "Owner of this Service", HFILL }},
 541                 { &hf_portmap_uaddr, {  /* address in RPCBPROC_GETADDR reply */
 542                         "Universal Address", "portmap.uaddr", FT_STRING, BASE_DEC,
 543                         NULL, 0, "Universal Address", HFILL }},
 544         };
 545         static gint *ett[] = {
 546                 &ett_portmap,
 547                 &ett_portmap_rpcb,
 548                 &ett_portmap_entry
 549         };
 550
 551         proto_portmap = proto_register_protocol("Portmap", "Portmap", "portmap");
 552         proto_register_field_array(proto_portmap, hf, array_length(hf));
 553         proto_register_subtree_array(ett, array_length(ett));
 554 }
 555
 556 void
 557 proto_reg_handoff_portmap(void)
 558 {
 559         /* Register the protocol as RPC */
 560         rpc_init_prog(proto_portmap, PORTMAP_PROGRAM, ett_portmap);
 561         /* Register the procedure tables */
 562         rpc_init_proc_table(PORTMAP_PROGRAM, 1, portmap1_proc);
 563         rpc_init_proc_table(PORTMAP_PROGRAM, 2, portmap2_proc);
 564         rpc_init_proc_table(PORTMAP_PROGRAM, 3, portmap3_proc);
 565         rpc_init_proc_table(PORTMAP_PROGRAM, 4, portmap4_proc);
 566         rpc_handle = find_dissector("rpc");
 567         rpc_tcp_handle = find_dissector("rpc-tcp");
 568 }