2 * Definitions for packet disassembly structures and routines
4 * $Id: packet.h,v 1.164 1999/12/29 07:25:47 guy Exp $
6 * Ethereal - Network traffic analyzer
7 * By Gerald Combs <gerald@zing.org>
8 * Copyright 1998 Gerald Combs
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version 2
14 * of the License, or (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
31 #include "wiretap/wtap.h"
38 /* Pointer versions of ntohs and ntohl. Given a pointer to a member of a
39 * byte array, returns the value of the two or four bytes at the pointer.
40 * The pletoh[sl] versions return the little-endian representation.
43 #define pntohs(p) ((guint16) \
44 ((guint16)*((guint8 *)p+0)<<8| \
45 (guint16)*((guint8 *)p+1)<<0))
47 #define pntohl(p) ((guint32)*((guint8 *)p+0)<<24| \
48 (guint32)*((guint8 *)p+1)<<16| \
49 (guint32)*((guint8 *)p+2)<<8| \
50 (guint32)*((guint8 *)p+3)<<0)
52 #define pletohs(p) ((guint16) \
53 ((guint16)*((guint8 *)p+1)<<8| \
54 (guint16)*((guint8 *)p+0)<<0))
56 #define pletohl(p) ((guint32)*((guint8 *)p+3)<<24| \
57 (guint32)*((guint8 *)p+2)<<16| \
58 (guint32)*((guint8 *)p+1)<<8| \
59 (guint32)*((guint8 *)p+0)<<0)
62 #define hi_nibble(b) ((b & 0xf0) >> 4)
63 #define lo_nibble(b) (b & 0x0f)
65 /* Useful when you have an array whose size you can tell at compile-time */
66 #define array_length(x) (sizeof x / sizeof x[0])
69 /* Useful when highlighting regions inside a dissect_*() function. With this
70 * macro, you can highlight from an arbitrary offset to the end of the
71 * packet (which may come before the end of the frame).
72 * See dissect_data() for an example.
74 #define END_OF_FRAME (pi.captured_len - offset)
76 /* Check whether the "len" bytes of data starting at "offset" is
77 * entirely inside the captured data for this packet. */
78 #define BYTES_ARE_IN_FRAME(offset, len) ((offset) + (len) <= pi.captured_len)
80 /* Check whether there's any data at all starting at "offset". */
81 #define IS_DATA_IN_FRAME(offset) ((offset) < pi.captured_len)
83 /* To pass one of two strings, singular or plural */
84 #define plurality(d,s,p) ((d) == 1 ? (s) : (p))
86 typedef struct _column_info {
87 gint num_cols; /* Number of columns */
88 gint *col_fmt; /* Format of column */
89 gboolean **fmt_matx; /* Specifies which formats apply to a column */
90 gint *col_width; /* Column widths to use during a "-S" capture */
91 gchar **col_title; /* Column titles */
92 gchar **col_data; /* Column data */
95 #define COL_MAX_LEN 256
96 #define COL_MAX_INFO_LEN 4096
98 typedef struct _packet_counts {
110 /* Types of character encodings */
112 CHAR_ASCII, /* ASCII */
113 CHAR_EBCDIC /* EBCDIC */
116 /* XXX - some of this stuff is used only while a packet is being dissected;
117 should we keep around a separate data structure for that, to save
120 Also, should the pseudo-header be supplied by Wiretap when you do a
121 seek-and-read, so that we don't have to save it for all frames? */
122 typedef struct _frame_data {
123 struct _frame_data *next; /* Next element in list */
124 struct _frame_data *prev; /* Previous element in list */
125 guint32 num; /* Frame number */
126 guint32 pkt_len; /* Packet length */
127 guint32 cap_len; /* Amount actually captured */
128 guint32 rel_secs; /* Relative seconds */
129 guint32 rel_usecs; /* Relative microseconds */
130 guint32 abs_secs; /* Absolute seconds */
131 guint32 abs_usecs; /* Absolute microseconds */
132 guint32 del_secs; /* Delta seconds */
133 guint32 del_usecs; /* Delta microseconds */
134 long file_off; /* File offset */
135 column_info *cinfo; /* Column formatting information */
136 gint row; /* Row number for this packet in the display */
137 int lnk_t; /* Per-packet encapsulation/data-link type */
138 gboolean passed_dfilter; /* TRUE = display, FALSE = no display */
139 char_enc encoding; /* Character encoding (ASCII, EBCDIC...) */
140 union pseudo_header pseudo_header; /* "pseudo-header" from wiretap */
143 /* Types of addresses Ethereal knows about. */
145 AT_NONE, /* no link-layer address */
146 AT_ETHER, /* MAC (Ethernet, 802.x, FDDI) address */
151 AT_ATALK, /* Appletalk DDP */
152 AT_VINES /* Banyan Vines */
155 typedef struct _address {
156 address_type type; /* type of address */
157 int len; /* length of address, in bytes */
158 const guint8 *data; /* bytes that constitute address */
161 #define SET_ADDRESS(addr, addr_type, addr_len, addr_data) { \
162 (addr)->type = (addr_type); \
163 (addr)->len = (addr_len); \
164 (addr)->data = (addr_data); \
167 /* Types of port numbers Ethereal knows about. */
169 PT_NONE, /* no port number */
174 typedef struct _packet_info {
177 address dl_src; /* link-layer source address */
178 address dl_dst; /* link-layer destination address */
179 address net_src; /* network-layer source address */
180 address net_dst; /* network-layer destination address */
181 address src; /* source address (net if present, DL otherwise )*/
182 address dst; /* destination address (net if present, DL otherwise )*/
184 port_type ptype; /* type of the following two port numbers */
185 guint32 srcport; /* source port */
186 guint32 destport; /* destination port */
192 extern packet_info pi;
194 /* Struct for the match_strval function */
196 typedef struct _value_string {
201 /* Struct for boolean enumerations */
202 typedef struct true_false_string {
208 /* Many of the structs and definitions below and in packet-*.c files
209 * were taken from include files in the Linux distribution. */
211 typedef struct tcp_extra_data {
217 /* Utility routines used by packet*.c */
218 gchar* ether_to_str(const guint8 *);
219 gchar* ether_to_str_punct(const guint8 *, char);
220 gchar* ip_to_str(const guint8 *);
222 gchar* ip6_to_str(struct e_in6_addr *);
223 gchar* ipx_addr_to_str(guint32, const guint8 *);
224 gchar* abs_time_to_str(struct timeval*);
225 gchar* rel_time_to_str(struct timeval*);
226 gchar* time_secs_to_str(guint32);
227 gchar* bytes_to_str(const guint8 *, int);
228 const u_char *find_line_end(const u_char *data, const u_char *dataend,
230 int get_token_len(const u_char *linep, const u_char *lineend,
231 const u_char **next_token);
232 gchar* format_text(const u_char *line, int len);
233 gchar* val_to_str(guint32, const value_string *, const char *);
234 gchar* match_strval(guint32, const value_string*);
235 char * decode_bitfield_value(char *buf, guint32 val, guint32 mask, int width);
236 const char *decode_boolean_bitfield(guint32 val, guint32 mask, int width,
237 const char *truedesc, const char *falsedesc);
238 const char *decode_enumerated_bitfield(guint32 val, guint32 mask, int width,
239 const value_string *tab, const char *fmt);
240 const char *decode_numeric_bitfield(guint32 val, guint32 mask, int width,
242 gint check_col(frame_data *, gint);
244 void col_add_fstr(frame_data *, gint, gchar *, ...)
245 __attribute__((format (printf, 3, 4)));
246 void col_append_fstr(frame_data *, gint, gchar *, ...)
247 __attribute__((format (printf, 3, 4)));
249 void col_add_fstr(frame_data *, gint, gchar *, ...);
250 void col_append_fstr(frame_data *, gint, gchar *, ...);
252 void col_add_str(frame_data *, gint, const gchar *);
253 void col_append_str(frame_data *, gint, gchar *);
254 void col_set_cls_time(frame_data *, int);
255 void fill_in_columns(frame_data *);
257 void blank_packetinfo(void);
259 /* Allow protocols to register "init" routines, which are called before
260 we make a pass through a capture file and dissect all its packets
261 (e.g., when we read in a new capture file, or run a "filter packets"
262 or "colorize packets" pass over the current capture file). */
263 void register_init_routine(void (*func)(void));
265 /* Call all the registered "init" routines. */
266 void init_all_protocols(void);
268 void dissect_packet(const u_char *, frame_data *, proto_tree *);
271 * Routines in packet-*.c
272 * Routines should take three args: packet data *, cap_len, packet_counts *
273 * They should never modify the packet data.
275 void capture_clip(const u_char *, guint32, packet_counts *);
276 void capture_eth(const u_char *, guint32, packet_counts *);
277 void capture_fddi(const u_char *, guint32, packet_counts *);
278 void capture_null(const u_char *, guint32, packet_counts *);
279 void capture_ppp(const u_char *, guint32, packet_counts *);
280 void capture_raw(const u_char *, guint32, packet_counts *);
281 void capture_tr(const u_char *, guint32, packet_counts *);
284 * Routines in packet-*.c
285 * Routines should take four args: packet data *, offset, cap_len,
287 * They should never modify the packet data.
289 void capture_netbios(const u_char *, int, guint32, packet_counts *);
290 void capture_llc(const u_char *, int, guint32, packet_counts *);
291 void capture_ip(const u_char *, int, guint32, packet_counts *);
292 void capture_ipx(const u_char *, int, guint32, packet_counts *);
293 void capture_vlan(const u_char *, int, guint32, packet_counts *);
296 * Routines in packet-*.c
297 * Routines should take three args: packet data *, frame_data *, tree *
298 * They should never modify the packet data.
300 void dissect_ascend(const u_char *, frame_data *, proto_tree *);
301 void dissect_atm(const u_char *, frame_data *, proto_tree *);
302 void dissect_clip(const u_char *, frame_data *, proto_tree *);
303 void dissect_lapb(const u_char *, frame_data *, proto_tree *);
304 void dissect_lapd(const u_char *, frame_data *, proto_tree *);
305 void dissect_null(const u_char *, frame_data *, proto_tree *);
306 void dissect_ppp(const u_char *, frame_data *, proto_tree *);
307 void dissect_raw(const u_char *, frame_data *, proto_tree *);
308 void dissect_v120(const u_char *, frame_data *, proto_tree *);
311 * Routines in packet-*.c
312 * Routines should take four args: packet data *, frame_data *, tree *,
314 * They should never modify the packet data.
316 void dissect_fddi(const u_char *, frame_data *, proto_tree *, gboolean);
318 typedef void (*DissectFunc) (const u_char*, int, frame_data*, proto_tree*);
321 * Routines in packet-*.c
322 * Routines should take four args: packet data *, offset, frame_data *,
324 * They should never modify the packet data.
326 int dissect_ah(const u_char *, int, frame_data *, proto_tree *);
327 void dissect_aarp(const u_char *, int, frame_data *, proto_tree *);
328 void dissect_afs(const u_char *, int, frame_data *, proto_tree *);
329 void dissect_arp(const u_char *, int, frame_data *, proto_tree *);
330 void dissect_auto_rp(const u_char *, int, frame_data *, proto_tree *);
331 void dissect_bgp(const u_char *, int, frame_data *, proto_tree *);
332 void dissect_bootp(const u_char *, int, frame_data *, proto_tree *);
333 void dissect_bpdu(const u_char *, int, frame_data *, proto_tree *);
334 void dissect_cdp(const u_char *, int, frame_data *, proto_tree *);
335 void dissect_cotp(const u_char *, int, frame_data *, proto_tree *);
336 void dissect_data(const u_char *, int, frame_data *, proto_tree *);
337 void dissect_ddp(const u_char *, int, frame_data *, proto_tree *);
338 void dissect_dns(const u_char *, int, frame_data *, proto_tree *);
339 void dissect_eigrp(const u_char *, int, frame_data *, proto_tree *);
340 void dissect_esp(const u_char *, int, frame_data *, proto_tree *);
341 void dissect_eth(const u_char *, int, frame_data *, proto_tree *);
342 void dissect_ftp(const u_char *, int, frame_data *, proto_tree *);
343 void dissect_ftpdata(const u_char *, int, frame_data *, proto_tree *);
344 void dissect_giop(const u_char *, int, frame_data *, proto_tree *);
345 void dissect_hsrp(const u_char *, int, frame_data *, proto_tree *);
346 void dissect_http(const u_char *, int, frame_data *, proto_tree *);
347 void dissect_icmp(const u_char *, int, frame_data *, proto_tree *);
348 void dissect_icmpv6(const u_char *, int, frame_data *, proto_tree *);
349 void dissect_igmp(const u_char *, int, frame_data *, proto_tree *);
350 void dissect_ip(const u_char *, int, frame_data *, proto_tree *);
351 void dissect_ipcomp(const u_char *, int, frame_data *, proto_tree *);
352 void dissect_ipp(const u_char *, int, frame_data *, proto_tree *);
353 void dissect_ipv6(const u_char *, int, frame_data *, proto_tree *);
354 void dissect_ipx(const u_char *, int, frame_data *, proto_tree *);
355 void dissect_irc(const u_char *, int, frame_data *, proto_tree *);
356 void dissect_isis(const u_char *, int, frame_data *, proto_tree *);
357 void dissect_ldap(const u_char *, int, frame_data *, proto_tree *);
358 void dissect_llc(const u_char *, int, frame_data *, proto_tree *);
359 void dissect_lpd(const u_char *, int, frame_data *, proto_tree *);
360 void dissect_mapi(const u_char *, int, frame_data *, proto_tree *);
361 void dissect_nbdgm(const u_char *, int, frame_data *, proto_tree *);
362 void dissect_netbios(const u_char *, int, frame_data *, proto_tree *);
363 void dissect_nbipx(const u_char *, int, frame_data *, proto_tree *);
364 void dissect_nbns(const u_char *, int, frame_data *, proto_tree *);
365 void dissect_nbss(const u_char *, int, frame_data *, proto_tree *);
366 void dissect_ncp(const u_char *, int, frame_data *, proto_tree *);
367 void dissect_nntp(const u_char *, int, frame_data *, proto_tree *);
368 void dissect_ntp(const u_char *, int, frame_data *, proto_tree *);
369 void dissect_nwlink_dg(const u_char *, int, frame_data *, proto_tree *);
370 void dissect_osi(const u_char *, int, frame_data *, proto_tree *);
371 void dissect_ospf(const u_char *, int, frame_data *, proto_tree *);
372 void dissect_ospf_hello(const u_char *, int, frame_data *, proto_tree *);
373 void dissect_pim(const u_char *, int, frame_data *, proto_tree *);
374 void dissect_pop(const u_char *, int, frame_data *, proto_tree *);
375 void dissect_pppoed(const u_char *, int, frame_data *, proto_tree *);
376 void dissect_pppoes(const u_char *, int, frame_data *, proto_tree *);
377 void dissect_icp(const u_char *,int, frame_data *, proto_tree *);
378 void dissect_icq(const u_char *,int, frame_data *, proto_tree *);
379 void dissect_imap(const u_char *,int, frame_data *, proto_tree *);
380 void dissect_isakmp(const u_char *, int, frame_data *, proto_tree *);
381 void dissect_pim(const u_char *, int, frame_data *, proto_tree *);
382 void dissect_q931(const u_char *, int, frame_data *, proto_tree *);
383 void dissect_q2931(const u_char *, int, frame_data *, proto_tree *);
384 void dissect_radius(const u_char *, int, frame_data *, proto_tree *);
385 void dissect_rip(const u_char *, int, frame_data *, proto_tree *);
386 void dissect_ripng(const u_char *, int, frame_data *, proto_tree *);
387 void dissect_rsvp(const u_char *, int, frame_data *, proto_tree *);
388 void dissect_rtsp(const u_char *, int, frame_data *, proto_tree *);
389 void dissect_rx(const u_char *, int, frame_data *, proto_tree *);
390 void dissect_sap(const u_char *, int, frame_data *, proto_tree *);
391 void dissect_sdp(const u_char *, int, frame_data *, proto_tree *);
392 void dissect_sna(const u_char *, int, frame_data *, proto_tree *);
393 void dissect_snmp(const u_char *, int, frame_data *, proto_tree *);
394 void dissect_sscop(const u_char *, int, frame_data *, proto_tree *);
395 void dissect_tacacs(const u_char *, int, frame_data *, proto_tree *);
396 void dissect_tacplus(const u_char *, int, frame_data *, proto_tree *);
397 void dissect_tcp(const u_char *, int, frame_data *, proto_tree *);
398 void dissect_telnet(const u_char *, int, frame_data *, proto_tree *);
399 void dissect_tftp(const u_char *, int, frame_data *, proto_tree *);
400 void dissect_tns(const u_char *, int, frame_data *, proto_tree *);
401 void dissect_tr(const u_char *, int, frame_data *, proto_tree *);
402 void dissect_trmac(const u_char *, int, frame_data *, proto_tree *);
403 void dissect_udp(const u_char *, int, frame_data *, proto_tree *);
404 void dissect_vines(const u_char *, int, frame_data *, proto_tree *);
405 void dissect_vines_arp(const u_char *, int, frame_data *, proto_tree *);
406 void dissect_vines_frp(const u_char *, int, frame_data *, proto_tree *);
407 void dissect_vines_icp(const u_char *, int, frame_data *, proto_tree *);
408 void dissect_vines_ipc(const u_char *, int, frame_data *, proto_tree *);
409 void dissect_vines_rtp(const u_char *, int, frame_data *, proto_tree *);
410 void dissect_vines_spp(const u_char *, int, frame_data *, proto_tree *);
411 void dissect_vlan(const u_char *, int, frame_data *, proto_tree *);
412 void dissect_vrrp(const u_char *, int, frame_data *, proto_tree *);
413 void dissect_wccp(const u_char *, int, frame_data *, proto_tree *);
414 void dissect_who(const u_char *, int, frame_data *, proto_tree *);
415 void dissect_payload_ppp(const u_char *, int, frame_data *, proto_tree *);
416 void dissect_x25(const u_char *, int, frame_data *, proto_tree *);
417 void dissect_yhoo(const u_char *, int, frame_data *, proto_tree *);
418 void dissect_srvloc(const u_char *, int, frame_data *, proto_tree *);
420 void dissect_smb(const u_char *, int, frame_data *, proto_tree *, int);
421 void dissect_pptp(const u_char *, int, frame_data *, proto_tree *);
422 void dissect_gre(const u_char *, int, frame_data *, proto_tree *);
425 * Routines in packet-*.c
426 * Routines should take four args: packet data *, offset, frame_data *,
428 * They should never modify the packet data.
429 * They should return TRUE if the packet is of the type the routine would
430 * dissect, FALSE otherwise.
432 gboolean dissect_rpc(const u_char *, int, frame_data *, proto_tree *);
434 void init_dissect_rpc(void);
435 void init_dissect_udp(void);
436 void init_dissect_x25(void);
438 /* These functions are in ethertype.c */
439 void capture_ethertype(guint16 etype, int offset,
440 const u_char *pd, guint32 cap_len, packet_counts *ld);
441 void ethertype(guint16 etype, int offset,
442 const u_char *pd, frame_data *fd, proto_tree *tree,
443 proto_tree *fh_tree, int item_id);
444 extern const value_string etype_vals[];
447 extern const char *ipprotostr(int proto);
450 * All of the possible columns in summary listing.
452 * NOTE: The SRC and DST entries MUST remain in this order, or else you
453 * need to fix the offset #defines before get_column_format!
456 COL_NUMBER, /* Packet list item number */
457 COL_CLS_TIME, /* Command line-specified time (default relative) */
458 COL_REL_TIME, /* Relative time */
459 COL_ABS_TIME, /* Absolute time */
460 COL_DELTA_TIME, /* Delta time */
461 COL_DEF_SRC, /* Source address */
462 COL_RES_SRC, /* Resolved source */
463 COL_UNRES_SRC, /* Unresolved source */
464 COL_DEF_DL_SRC, /* Data link layer source address */
465 COL_RES_DL_SRC, /* Resolved DL source */
466 COL_UNRES_DL_SRC, /* Unresolved DL source */
467 COL_DEF_NET_SRC, /* Network layer source address */
468 COL_RES_NET_SRC, /* Resolved net source */
469 COL_UNRES_NET_SRC, /* Unresolved net source */
470 COL_DEF_DST, /* Destination address */
471 COL_RES_DST, /* Resolved dest */
472 COL_UNRES_DST, /* Unresolved dest */
473 COL_DEF_DL_DST, /* Data link layer dest address */
474 COL_RES_DL_DST, /* Resolved DL dest */
475 COL_UNRES_DL_DST, /* Unresolved DL dest */
476 COL_DEF_NET_DST, /* Network layer dest address */
477 COL_RES_NET_DST, /* Resolved net dest */
478 COL_UNRES_NET_DST, /* Unresolved net dest */
479 COL_DEF_SRC_PORT, /* Source port */
480 COL_RES_SRC_PORT, /* Resolved source port */
481 COL_UNRES_SRC_PORT, /* Unresolved source port */
482 COL_DEF_DST_PORT, /* Destination port */
483 COL_RES_DST_PORT, /* Resolved dest port */
484 COL_UNRES_DST_PORT, /* Unresolved dest port */
485 COL_PROTOCOL, /* Protocol */
486 COL_INFO, /* Description */
487 COL_PACKET_LENGTH, /* Packet length in bytes */
488 NUM_COL_FMTS /* Should always be last */
491 #endif /* packet.h */