2 * Definitions for packet disassembly structures and routines
4 * $Id: packet.h,v 1.47 1999/04/30 03:16:03 guy Exp $
6 * Ethereal - Network traffic analyzer
7 * By Gerald Combs <gerald@zing.org>
8 * Copyright 1998 Gerald Combs
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version 2
14 * of the License, or (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
30 /* Pointer versions of ntohs and ntohl. Given a pointer to a member of a
31 * byte array, returns the value of the two or four bytes at the pointer.
32 * The pletoh[sl] versions return the little-endian representation.
35 #define pntohs(p) ((guint16) \
36 ((guint16)*((guint8 *)p+0)<<8| \
37 (guint16)*((guint8 *)p+1)<<0))
39 #define pntohl(p) ((guint32)*((guint8 *)p+0)<<24| \
40 (guint32)*((guint8 *)p+1)<<16| \
41 (guint32)*((guint8 *)p+2)<<8| \
42 (guint32)*((guint8 *)p+3)<<0)
44 #define pletohs(p) ((guint16) \
45 ((guint16)*((guint8 *)p+1)<<8| \
46 (guint16)*((guint8 *)p+0)<<0))
48 #define pletohl(p) ((guint32)*((guint8 *)p+3)<<24| \
49 (guint32)*((guint8 *)p+2)<<16| \
50 (guint32)*((guint8 *)p+1)<<8| \
51 (guint32)*((guint8 *)p+0)<<0)
54 #define hi_nibble(b) ((b & 0xf0) >> 4)
55 #define lo_nibble(b) (b & 0x0f)
59 #define LITTLE_ENDIAN 4321
60 #define BIG_ENDIAN 1234
61 #ifdef WORDS_BIGENDIAN
62 #define BYTE_ORDER BIG_ENDIAN
64 #define BYTE_ORDER LITTLE_ENDIAN
68 /* Useful when highlighting regions inside a dissect_*() function. With this
69 * macro, you can highlight from an arbitrary offset to the end of the
70 * frame. See dissect_data() for an example.
72 #define END_OF_FRAME (fd->cap_len - offset)
75 typedef struct _column_info {
76 gint num_cols; /* Number of columns */
77 gboolean **fmt_matx; /* Specifies which formats apply to a column */
78 gchar **col_data; /* Column data */
81 #define COL_MAX_LEN 256
83 typedef struct _packet_counts {
91 typedef struct _frame_data {
92 guint32 pkt_len; /* Packet length */
93 guint32 cap_len; /* Amount actually captured */
94 guint32 rel_secs; /* Relative seconds */
95 guint32 rel_usecs; /* Relative microseconds */
96 guint32 abs_secs; /* Absolute seconds */
97 guint32 abs_usecs; /* Absolute microseconds */
98 guint32 del_secs; /* Delta seconds */
99 guint32 del_usecs; /* Delta microseconds */
100 long file_off; /* File offset */
101 column_info *cinfo; /* Column formatting information */
103 int lnk_t; /* Per-packet encapsulation/data-link type */
107 typedef struct _packet_info {
120 /* Struct for the match_strval function */
122 typedef struct _value_string {
127 /* Many of the structs and definitions below and in packet-*.c files
128 * were taken from include files in the Linux distribution. */
130 typedef struct tcp_extra_data {
136 /* Tree types. Each dissect_* routine should have one for each
137 add_subtree() call. */
156 ETT_IP_OPTION_TIMESTAMP,
228 NUM_TREE_TYPES /* last item number plus one */
231 /* The version of pcap.h that comes with some systems is missing these
239 #ifndef DLT_SLIP_BSDOS
240 #define DLT_SLIP_BSDOS 13
243 #ifndef DLT_PPP_BSDOS
244 #define DLT_PPP_BSDOS 14
248 /* Utility routines used by packet*.c */
249 gchar* ether_to_str(const guint8 *);
250 gchar* ip_to_str(const guint8 *);
251 gchar* time_secs_to_str(guint32);
252 const u_char *find_line_end(const u_char *data, const u_char *dataend,
254 int get_token_len(const u_char *linep, const u_char *lineend,
255 const u_char **next_token);
256 gchar* format_text(const u_char *line, int len);
257 gchar* val_to_str(guint32, const value_string *, const char *);
258 gchar* match_strval(guint32, const value_string*);
259 const char *decode_boolean_bitfield(guint32 val, guint32 mask, int width,
260 const char *truedesc, const char *falsedesc);
261 const char *decode_enumerated_bitfield(guint32 val, guint32 mask, int width,
262 const value_string *tab, const char *fmt);
263 const char *decode_numeric_bitfield(guint32 val, guint32 mask, int width,
265 gint check_col(frame_data *, gint);
267 void col_add_fstr(frame_data *, gint, gchar *, ...)
268 __attribute__((format (printf, 3, 4)));
270 void col_add_fstr(frame_data *, gint, gchar *, ...);
272 void col_add_str(frame_data *, gint, gchar *);
274 /* Routines in packet.c */
276 typedef struct GtkWidget proto_tree;
277 typedef struct GtkWidget proto_item;
281 void proto_item_set_len(proto_item *ti, gint len);
282 proto_tree* proto_tree_new(void);
283 void proto_item_add_subtree(proto_item *ti, proto_tree *subtree, gint idx);
286 proto_item* proto_tree_add_item(proto_tree *tree, gint start, gint len,
288 __attribute__((format (printf, 4, 5)));
290 proto_item* proto_tree_add_item(proto_tree *tree, gint start, gint len,
294 void dissect_packet(const u_char *, frame_data *, proto_tree *);
296 * Routines in packet-*.c
297 * Routines should take three args: packet data *, cap_len, packet_counts *
298 * They should never modify the packet data.
300 void capture_eth(const u_char *, guint32, packet_counts *);
301 void capture_fddi(const u_char *, guint32, packet_counts *);
302 void capture_null(const u_char *, guint32, packet_counts *);
303 void capture_ppp(const u_char *, guint32, packet_counts *);
304 void capture_raw(const u_char *, guint32, packet_counts *);
305 void capture_tr(const u_char *, guint32, packet_counts *);
308 * Routines in packet-*.c
309 * Routines should take four args: packet data *, offset, cap_len,
311 * They should never modify the packet data.
313 void capture_llc(const u_char *, int, guint32, packet_counts *);
314 void capture_ip(const u_char *, int, guint32, packet_counts *);
317 * Routines in packet-*.c
318 * Routines should take three args: packet data *, frame_data *, tree *
319 * They should never modify the packet data.
321 void dissect_eth(const u_char *, frame_data *, proto_tree *);
322 void dissect_fddi(const u_char *, frame_data *, proto_tree *);
323 void dissect_null(const u_char *, frame_data *, proto_tree *);
324 void dissect_ppp(const u_char *, frame_data *, proto_tree *);
325 void dissect_raw(const u_char *, frame_data *, proto_tree *);
326 void dissect_tr(const u_char *, frame_data *, proto_tree *);
329 * Routines in packet-*.c
330 * Routines should take four args: packet data *, offset, frame_data *,
332 * They should never modify the packet data.
334 int dissect_ah(const u_char *, int, frame_data *, proto_tree *);
335 void dissect_aarp(const u_char *, int, frame_data *, proto_tree *);
336 void dissect_arp(const u_char *, int, frame_data *, proto_tree *);
337 void dissect_bootp(const u_char *, int, frame_data *, proto_tree *);
338 void dissect_cdp(const u_char *, int, frame_data *, proto_tree *);
339 void dissect_data(const u_char *, int, frame_data *, proto_tree *);
340 void dissect_ddp(const u_char *, int, frame_data *, proto_tree *);
341 void dissect_dns(const u_char *, int, frame_data *, proto_tree *);
342 void dissect_esp(const u_char *, int, frame_data *, proto_tree *);
343 void dissect_giop(const u_char *, int, frame_data *, proto_tree *);
344 void dissect_http(const u_char *, int, frame_data *, proto_tree *);
345 void dissect_icmp(const u_char *, int, frame_data *, proto_tree *);
346 void dissect_icmpv6(const u_char *, int, frame_data *, proto_tree *);
347 void dissect_igmp(const u_char *, int, frame_data *, proto_tree *);
348 void dissect_ip(const u_char *, int, frame_data *, proto_tree *);
349 void dissect_ipv6(const u_char *, int, frame_data *, proto_tree *);
350 void dissect_ipx(const u_char *, int, frame_data *, proto_tree *);
351 void dissect_llc(const u_char *, int, frame_data *, proto_tree *);
352 void dissect_lpd(const u_char *, int, frame_data *, proto_tree *);
353 void dissect_nbdgm(const u_char *, int, frame_data *, proto_tree *);
354 void dissect_nbipx_ns(const u_char *, int, frame_data *, proto_tree *);
355 void dissect_nbns(const u_char *, int, frame_data *, proto_tree *);
356 void dissect_ncp(const u_char *, int, frame_data *, proto_tree *);
357 void dissect_nwlink_dg(const u_char *, int, frame_data *, proto_tree *);
358 void dissect_osi(const u_char *, int, frame_data *, proto_tree *);
359 void dissect_ospf(const u_char *, int, frame_data *, proto_tree *);
360 void dissect_ospf_hello(const u_char *, int, frame_data *, proto_tree *);
361 void dissect_rip(const u_char *, int, frame_data *, proto_tree *);
362 void dissect_tcp(const u_char *, int, frame_data *, proto_tree *);
363 void dissect_tftp(const u_char *, int, frame_data *, proto_tree *);
364 void dissect_trmac(const u_char *, int, frame_data *, proto_tree *);
365 void dissect_udp(const u_char *, int, frame_data *, proto_tree *);
366 void dissect_vines(const u_char *, int, frame_data *, proto_tree *);
367 void dissect_vines_arp(const u_char *, int, frame_data *, proto_tree *);
368 void dissect_vines_frp(const u_char *, int, frame_data *, proto_tree *);
369 void dissect_vines_icp(const u_char *, int, frame_data *, proto_tree *);
370 void dissect_vines_ipc(const u_char *, int, frame_data *, proto_tree *);
371 void dissect_vines_rtp(const u_char *, int, frame_data *, proto_tree *);
372 void dissect_vines_spp(const u_char *, int, frame_data *, proto_tree *);
374 void dissect_ftp(const u_char *, int, frame_data *, proto_tree *, int);
375 void dissect_ftpdata(const u_char *, int, frame_data *, proto_tree *, int);
376 void dissect_nbss(const u_char *, int, frame_data *, proto_tree *, int);
377 void dissect_nntp(const u_char *, int, frame_data *, proto_tree *, int);
378 void dissect_pop(const u_char *, int, frame_data *, proto_tree *, int);
379 void dissect_telnet(const u_char *, int, frame_data *, proto_tree *, int);
381 void init_dissect_udp(void);
383 /* These functions are in ethertype.c */
384 gchar *ethertype_to_str(guint16 etype, const char *fmt);
385 void capture_ethertype(guint16 etype, int offset,
386 const u_char *pd, guint32 cap_len, packet_counts *ld);
387 void ethertype(guint16 etype, int offset,
388 const u_char *pd, frame_data *fd, proto_tree *tree,
389 proto_tree *fh_tree);
391 /* These functions are in packet-arp.c */
392 gchar *arphrdaddr_to_str(guint8 *ad, int ad_len, guint16 type);
393 gchar *arphrdtype_to_str(guint16 hwtype, const char *fmt);
396 * All of the possible columns in summary listing.
398 * NOTE: The SRC and DST entries MUST remain in this order, or else you
399 * need to fix the offset #defines before get_column_format!
402 COL_NUMBER, /* Packet list item number */
403 COL_CLS_TIME, /* Command line-specified time (default relative) */
404 COL_REL_TIME, /* Relative time */
405 COL_ABS_TIME, /* Absolute time */
406 COL_DELTA_TIME, /* Delta time */
407 COL_DEF_SRC, /* Source address */
408 COL_RES_SRC, /* Resolved source */
409 COL_UNRES_SRC, /* Unresolved source */
410 COL_DEF_DL_SRC, /* Data link layer source address */
411 COL_RES_DL_SRC, /* Resolved DL source */
412 COL_UNRES_DL_SRC, /* Unresolved DL source */
413 COL_DEF_NET_SRC, /* Network layer source address */
414 COL_RES_NET_SRC, /* Resolved net source */
415 COL_UNRES_NET_SRC, /* Unresolved net source */
416 COL_DEF_DST, /* Destination address */
417 COL_RES_DST, /* Resolved dest */
418 COL_UNRES_DST, /* Unresolved dest */
419 COL_DEF_DL_DST, /* Data link layer dest address */
420 COL_RES_DL_DST, /* Resolved DL dest */
421 COL_UNRES_DL_DST, /* Unresolved DL dest */
422 COL_DEF_NET_DST, /* Network layer dest address */
423 COL_RES_NET_DST, /* Resolved net dest */
424 COL_UNRES_NET_DST, /* Unresolved net dest */
425 COL_DEF_SRC_PORT, /* Source port */
426 COL_RES_SRC_PORT, /* Resolved source port */
427 COL_UNRES_SRC_PORT, /* Unresolved source port */
428 COL_DEF_DST_PORT, /* Destination port */
429 COL_RES_DST_PORT, /* Resolved dest port */
430 COL_UNRES_DST_PORT, /* Unresolved dest port */
431 COL_PROTOCOL, /* Protocol */
432 COL_INFO, /* Description */
433 NUM_COL_FMTS /* Should always be last */
436 #endif /* packet.h */