2 * Definitions for packet disassembly structures and routines
4 * $Id: packet.h,v 1.80 1999/08/10 04:13:35 guy Exp $
6 * Ethereal - Network traffic analyzer
7 * By Gerald Combs <gerald@zing.org>
8 * Copyright 1998 Gerald Combs
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version 2
14 * of the License, or (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
34 /* Pointer versions of ntohs and ntohl. Given a pointer to a member of a
35 * byte array, returns the value of the two or four bytes at the pointer.
36 * The pletoh[sl] versions return the little-endian representation.
39 #define pntohs(p) ((guint16) \
40 ((guint16)*((guint8 *)p+0)<<8| \
41 (guint16)*((guint8 *)p+1)<<0))
43 #define pntohl(p) ((guint32)*((guint8 *)p+0)<<24| \
44 (guint32)*((guint8 *)p+1)<<16| \
45 (guint32)*((guint8 *)p+2)<<8| \
46 (guint32)*((guint8 *)p+3)<<0)
48 #define pletohs(p) ((guint16) \
49 ((guint16)*((guint8 *)p+1)<<8| \
50 (guint16)*((guint8 *)p+0)<<0))
52 #define pletohl(p) ((guint32)*((guint8 *)p+3)<<24| \
53 (guint32)*((guint8 *)p+2)<<16| \
54 (guint32)*((guint8 *)p+1)<<8| \
55 (guint32)*((guint8 *)p+0)<<0)
58 #define hi_nibble(b) ((b & 0xf0) >> 4)
59 #define lo_nibble(b) (b & 0x0f)
63 #define LITTLE_ENDIAN 4321
64 #define BIG_ENDIAN 1234
65 #ifdef WORDS_BIGENDIAN
66 #define BYTE_ORDER BIG_ENDIAN
68 #define BYTE_ORDER LITTLE_ENDIAN
72 /* Useful when you have an array whose size you can tell at compile-time */
73 #define array_length(x) (sizeof x / sizeof x[0])
76 /* Useful when highlighting regions inside a dissect_*() function. With this
77 * macro, you can highlight from an arbitrary offset to the end of the
78 * frame. See dissect_data() for an example.
80 #define END_OF_FRAME (fd->cap_len - offset)
82 /* To pass one of two strings, singular or plural */
83 #define plurality(d,s,p) ((d) == 1 ? (s) : (p))
85 typedef struct _column_info {
86 gint num_cols; /* Number of columns */
87 gint *col_fmt; /* Format of column */
88 gboolean **fmt_matx; /* Specifies which formats apply to a column */
89 gint *col_width; /* Column widths to use during a "-S" capture */
90 gchar **col_data; /* Column data */
93 #define COL_MAX_LEN 256
95 typedef struct _packet_counts {
104 typedef struct _frame_data {
105 struct _frame_data *next; /* Next element in list */
106 guint32 pkt_len; /* Packet length */
107 guint32 cap_len; /* Amount actually captured */
108 guint32 rel_secs; /* Relative seconds */
109 guint32 rel_usecs; /* Relative microseconds */
110 guint32 abs_secs; /* Absolute seconds */
111 guint32 abs_usecs; /* Absolute microseconds */
112 guint32 del_secs; /* Delta seconds */
113 guint32 del_usecs; /* Delta microseconds */
114 long file_off; /* File offset */
115 column_info *cinfo; /* Column formatting information */
116 gint row; /* Row number for this packet in the display */
117 int lnk_t; /* Per-packet encapsulation/data-link type */
118 gboolean passed_dfilter; /* TRUE = display, FALSE = no display */
119 guint8 flags; /* for ENCAP_LAPB : 1st bit means From DCE */
122 typedef struct _packet_info {
134 /* Struct for the match_strval function */
136 typedef struct _value_string {
141 /* Many of the structs and definitions below and in packet-*.c files
142 * were taken from include files in the Linux distribution. */
144 typedef struct tcp_extra_data {
150 /* Tree types. Each dissect_* routine should have one for each
151 add_subtree() call. */
173 ETT_IP_OPTION_TIMESTAMP,
186 ETT_NCP_REQUEST_FIELDS,
187 ETT_NCP_REPLY_FIELDS,
257 ETT_SMB_CAPABILITIES,
260 ETT_SMB_DESIREDACCESS,
263 ETT_SMB_OPENFUNCTION,
264 ETT_SMB_FILEATTRIBUTES,
276 ETT_RSVP_UNKNOWN_CLASS,
282 ETT_RSVP_TIME_VALUES,
287 ETT_RSVP_FILTER_SPEC,
288 ETT_RSVP_SENDER_TEMPLATE,
289 ETT_RSVP_SENDER_TSPEC,
293 ETT_RSVP_ADSPEC_SUBTREE1,
294 ETT_RSVP_ADSPEC_SUBTREE2,
295 ETT_RSVP_ADSPEC_SUBTREE3,
303 NUM_TREE_TYPES /* last item number plus one */
306 /* The version of pcap.h that comes with some systems is missing these
314 #ifndef DLT_SLIP_BSDOS
315 #define DLT_SLIP_BSDOS 13
318 #ifndef DLT_PPP_BSDOS
319 #define DLT_PPP_BSDOS 14
323 /* Utility routines used by packet*.c */
324 gchar* ether_to_str(const guint8 *);
325 gchar* ip_to_str(const guint8 *);
326 gchar* abs_time_to_str(struct timeval*);
327 gchar* time_secs_to_str(guint32);
328 gchar* bytes_to_str(const guint8 *, int);
329 const u_char *find_line_end(const u_char *data, const u_char *dataend,
331 int get_token_len(const u_char *linep, const u_char *lineend,
332 const u_char **next_token);
333 gchar* format_text(const u_char *line, int len);
334 gchar* val_to_str(guint32, const value_string *, const char *);
335 gchar* match_strval(guint32, const value_string*);
336 const char *decode_boolean_bitfield(guint32 val, guint32 mask, int width,
337 const char *truedesc, const char *falsedesc);
338 const char *decode_enumerated_bitfield(guint32 val, guint32 mask, int width,
339 const value_string *tab, const char *fmt);
340 const char *decode_numeric_bitfield(guint32 val, guint32 mask, int width,
342 gint check_col(frame_data *, gint);
343 void col_add_cls_time(frame_data *);
345 void col_add_fstr(frame_data *, gint, gchar *, ...)
346 __attribute__((format (printf, 3, 4)));
347 void col_append_fstr(frame_data *, gint, gchar *, ...)
348 __attribute__((format (printf, 3, 4)));
350 void col_add_fstr(frame_data *, gint, gchar *, ...);
351 void col_append_fstr(frame_data *, gint, gchar *, ...);
353 void col_add_str(frame_data *, gint, const gchar *);
354 void col_append_str(frame_data *, gint, gchar *);
357 void dissect_packet(const u_char *, frame_data *, proto_tree *);
359 * Routines in packet-*.c
360 * Routines should take three args: packet data *, cap_len, packet_counts *
361 * They should never modify the packet data.
363 void capture_clip(const u_char *, guint32, packet_counts *);
364 void capture_eth(const u_char *, guint32, packet_counts *);
365 void capture_fddi(const u_char *, guint32, packet_counts *);
366 void capture_null(const u_char *, guint32, packet_counts *);
367 void capture_ppp(const u_char *, guint32, packet_counts *);
368 void capture_raw(const u_char *, guint32, packet_counts *);
369 void capture_tr(const u_char *, guint32, packet_counts *);
372 * Routines in packet-*.c
373 * Routines should take four args: packet data *, offset, cap_len,
375 * They should never modify the packet data.
377 void capture_llc(const u_char *, int, guint32, packet_counts *);
378 void capture_ip(const u_char *, int, guint32, packet_counts *);
381 * Routines in packet-*.c
382 * Routines should take three args: packet data *, frame_data *, tree *
383 * They should never modify the packet data.
385 void dissect_clip(const u_char *, frame_data *, proto_tree *);
386 void dissect_eth(const u_char *, frame_data *, proto_tree *);
387 void dissect_fddi(const u_char *, frame_data *, proto_tree *);
388 void dissect_lapb(const u_char *, frame_data *, proto_tree *);
389 void dissect_null(const u_char *, frame_data *, proto_tree *);
390 void dissect_ppp(const u_char *, frame_data *, proto_tree *);
391 void dissect_raw(const u_char *, frame_data *, proto_tree *);
392 void dissect_tr(const u_char *, frame_data *, proto_tree *);
395 * Routines in packet-*.c
396 * Routines should take four args: packet data *, offset, frame_data *,
398 * They should never modify the packet data.
400 int dissect_ah(const u_char *, int, frame_data *, proto_tree *);
401 void dissect_aarp(const u_char *, int, frame_data *, proto_tree *);
402 void dissect_arp(const u_char *, int, frame_data *, proto_tree *);
403 void dissect_bootp(const u_char *, int, frame_data *, proto_tree *);
404 void dissect_cdp(const u_char *, int, frame_data *, proto_tree *);
405 void dissect_cotp(const u_char *, int, frame_data *, proto_tree *);
406 void dissect_data(const u_char *, int, frame_data *, proto_tree *);
407 void dissect_ddp(const u_char *, int, frame_data *, proto_tree *);
408 void dissect_dns(const u_char *, int, frame_data *, proto_tree *);
409 void dissect_esp(const u_char *, int, frame_data *, proto_tree *);
410 void dissect_giop(const u_char *, int, frame_data *, proto_tree *);
411 void dissect_http(const u_char *, int, frame_data *, proto_tree *);
412 void dissect_icmp(const u_char *, int, frame_data *, proto_tree *);
413 void dissect_icmpv6(const u_char *, int, frame_data *, proto_tree *);
414 void dissect_igmp(const u_char *, int, frame_data *, proto_tree *);
415 void dissect_ip(const u_char *, int, frame_data *, proto_tree *);
416 void dissect_ipv6(const u_char *, int, frame_data *, proto_tree *);
417 void dissect_ipx(const u_char *, int, frame_data *, proto_tree *);
418 void dissect_llc(const u_char *, int, frame_data *, proto_tree *);
419 void dissect_lpd(const u_char *, int, frame_data *, proto_tree *);
420 void dissect_nbdgm(const u_char *, int, frame_data *, proto_tree *, int);
421 void dissect_nbipx_ns(const u_char *, int, frame_data *, proto_tree *, int);
422 void dissect_nbns(const u_char *, int, frame_data *, proto_tree *);
423 void dissect_ncp(const u_char *, int, frame_data *, proto_tree *, int);
424 void dissect_nwlink_dg(const u_char *, int, frame_data *, proto_tree *, int);
425 void dissect_osi(const u_char *, int, frame_data *, proto_tree *);
426 void dissect_ospf(const u_char *, int, frame_data *, proto_tree *);
427 void dissect_ospf_hello(const u_char *, int, frame_data *, proto_tree *);
428 void dissect_pppoed(const u_char *, int, frame_data *, proto_tree *);
429 void dissect_pppoes(const u_char *, int, frame_data *, proto_tree *);
430 void dissect_isakmp(const u_char *, int, frame_data *, proto_tree *);
431 void dissect_radius(const u_char *, int, frame_data *, proto_tree *);
432 void dissect_rip(const u_char *, int, frame_data *, proto_tree *);
433 void dissect_rsvp(const u_char *, int, frame_data *, proto_tree *);
434 void dissect_rtsp(const u_char *, int, frame_data *, proto_tree *);
435 void dissect_sdp(const u_char *, int, frame_data *, proto_tree *);
436 void dissect_snmp(const u_char *, int, frame_data *, proto_tree *);
437 void dissect_tcp(const u_char *, int, frame_data *, proto_tree *);
438 void dissect_tftp(const u_char *, int, frame_data *, proto_tree *);
439 void dissect_trmac(const u_char *, int, frame_data *, proto_tree *);
440 void dissect_udp(const u_char *, int, frame_data *, proto_tree *);
441 void dissect_vines(const u_char *, int, frame_data *, proto_tree *);
442 void dissect_vines_arp(const u_char *, int, frame_data *, proto_tree *);
443 void dissect_vines_frp(const u_char *, int, frame_data *, proto_tree *);
444 void dissect_vines_icp(const u_char *, int, frame_data *, proto_tree *);
445 void dissect_vines_ipc(const u_char *, int, frame_data *, proto_tree *);
446 void dissect_vines_rtp(const u_char *, int, frame_data *, proto_tree *);
447 void dissect_vines_spp(const u_char *, int, frame_data *, proto_tree *);
448 void dissect_payload_ppp(const u_char *, int, frame_data *, proto_tree *);
449 void dissect_x25(const u_char *, int, frame_data *, proto_tree *);
451 void dissect_ftp(const u_char *, int, frame_data *, proto_tree *, int);
452 void dissect_ftpdata(const u_char *, int, frame_data *, proto_tree *, int);
453 void dissect_nbss(const u_char *, int, frame_data *, proto_tree *, int);
454 void dissect_nntp(const u_char *, int, frame_data *, proto_tree *, int);
455 void dissect_pop(const u_char *, int, frame_data *, proto_tree *, int);
456 void dissect_smb(const u_char *, int, frame_data *, proto_tree *, int);
457 void dissect_telnet(const u_char *, int, frame_data *, proto_tree *, int);
458 void dissect_pptp(const u_char *, int, frame_data *, proto_tree *);
459 void dissect_gre(const u_char *, int, frame_data *, proto_tree *);
461 void init_dissect_udp(void);
462 void init_dissect_x25(void);
464 /* These functions are in ethertype.c */
465 void capture_ethertype(guint16 etype, int offset,
466 const u_char *pd, guint32 cap_len, packet_counts *ld);
467 void ethertype(guint16 etype, int offset,
468 const u_char *pd, frame_data *fd, proto_tree *tree,
469 proto_tree *fh_tree, int item_id);
470 extern const value_string etype_vals[];
472 /* These functions are in packet-arp.c */
473 gchar *arphrdaddr_to_str(guint8 *ad, int ad_len, guint16 type);
474 gchar *arphrdtype_to_str(guint16 hwtype, const char *fmt);
477 * All of the possible columns in summary listing.
479 * NOTE: The SRC and DST entries MUST remain in this order, or else you
480 * need to fix the offset #defines before get_column_format!
483 COL_NUMBER, /* Packet list item number */
484 COL_CLS_TIME, /* Command line-specified time (default relative) */
485 COL_REL_TIME, /* Relative time */
486 COL_ABS_TIME, /* Absolute time */
487 COL_DELTA_TIME, /* Delta time */
488 COL_DEF_SRC, /* Source address */
489 COL_RES_SRC, /* Resolved source */
490 COL_UNRES_SRC, /* Unresolved source */
491 COL_DEF_DL_SRC, /* Data link layer source address */
492 COL_RES_DL_SRC, /* Resolved DL source */
493 COL_UNRES_DL_SRC, /* Unresolved DL source */
494 COL_DEF_NET_SRC, /* Network layer source address */
495 COL_RES_NET_SRC, /* Resolved net source */
496 COL_UNRES_NET_SRC, /* Unresolved net source */
497 COL_DEF_DST, /* Destination address */
498 COL_RES_DST, /* Resolved dest */
499 COL_UNRES_DST, /* Unresolved dest */
500 COL_DEF_DL_DST, /* Data link layer dest address */
501 COL_RES_DL_DST, /* Resolved DL dest */
502 COL_UNRES_DL_DST, /* Unresolved DL dest */
503 COL_DEF_NET_DST, /* Network layer dest address */
504 COL_RES_NET_DST, /* Resolved net dest */
505 COL_UNRES_NET_DST, /* Unresolved net dest */
506 COL_DEF_SRC_PORT, /* Source port */
507 COL_RES_SRC_PORT, /* Resolved source port */
508 COL_UNRES_SRC_PORT, /* Unresolved source port */
509 COL_DEF_DST_PORT, /* Destination port */
510 COL_RES_DST_PORT, /* Resolved dest port */
511 COL_UNRES_DST_PORT, /* Unresolved dest port */
512 COL_PROTOCOL, /* Protocol */
513 COL_INFO, /* Description */
514 COL_PACKET_LENGTH, /* Packet length in bytes */
515 NUM_COL_FMTS /* Should always be last */
518 #endif /* packet.h */