From a look at the Linux ARCNET code, it appears that no frame delivered

to the networking stack will have an exception frame header.

Note, however, that on the BSD's ARCNET might be a bit of a mess.

svn path=/trunk/; revision=6986

3 files changed, 70 insertions, 16 deletions

diff --git a/capture.c b/capture.c
index c8b5336d51..82e2217614 100644
--- a/capture.c
+++ b/capture.c
@@ -1,7 +1,7 @@
 /* capture.c
  * Routines for packet capture windows
  *
- * $Id: capture.c,v 1.204 2003/01/23 06:57:35 guy Exp $
+ * $Id: capture.c,v 1.205 2003/01/23 09:04:54 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -2253,10 +2253,10 @@ capture_pcap_cb(guchar *user, const struct pcap_pkthdr *phdr,
       capture_ipfc(pd, whdr.caplen, &ld->counts);
       break;
     case WTAP_ENCAP_ARCNET:
-      capture_arcnet(pd, whdr.caplen, &ld->counts, FALSE);
+      capture_arcnet(pd, whdr.caplen, &ld->counts, FALSE, TRUE);
       break;
     case WTAP_ENCAP_ARCNET_LINUX:
-      capture_arcnet(pd, whdr.caplen, &ld->counts, TRUE);
+      capture_arcnet(pd, whdr.caplen, &ld->counts, TRUE, FALSE);
       break;
     /* XXX - some ATM drivers on FreeBSD might prepend a 4-byte ATM
        pseudo-header to DLT_ATM_RFC1483, with LLC header following;
diff --git a/packet-arcnet.c b/packet-arcnet.c
index aa1300a0ed..6b623c603f 100644
--- a/packet-arcnet.c
+++ b/packet-arcnet.c
@@ -2,7 +2,7 @@
  * Routines for arcnet dissection
  * Copyright 2001-2002, Peter Fales <ethereal@fales-lorenz.net>
  *
- * $Id: packet-arcnet.c,v 1.6 2003/01/23 07:55:28 guy Exp $
+ * $Id: packet-arcnet.c,v 1.7 2003/01/23 09:04:54 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -56,7 +56,7 @@ static dissector_handle_t data_handle;
 
 void
 capture_arcnet (const guchar *pd, int len, packet_counts *ld,
-		gboolean has_offset)
+		gboolean has_offset, gboolean has_exception)
 {
   int offset = has_offset ? 2 : 4;
 
@@ -73,13 +73,38 @@ capture_arcnet (const guchar *pd, int len, packet_counts *ld,
     break;
 
   case ARCNET_PROTO_IP_1201:
-    /* There's fragmentation stuff in the header */
+    /*
+     * There's fragmentation stuff in the header.
+     *
+     * XXX - on at least some versions of NetBSD, it appears that we
+     * might we get ARCNET frames, not reassembled packets; we should
+     * perhaps bump "ld->other" for all but the first frame of a packet.
+     *
+     * XXX - but on FreeBSD it appears that we get reassembled packets
+     * on input (but apparently we get frames on output - or maybe
+     * we get the packet *and* all its frames!); how to tell the
+     * difference?  It looks from the FreeBSD reassembly code as if
+     * the reassembled packet arrives with the header for the first
+     * frame.  It also looks as if, on output, we first get the
+     * full packet, with a header containing none of the fragmentation
+     * stuff, and then get the frames.
+     *
+     * On Linux, we get only reassembled packets, and the exception
+     * frame stuff is hidden - there's a split flag and sequence
+     * number, but it appears that it will never have the exception
+     * frame stuff.
+     *
+     * XXX - what about OpenBSD?  And, for that matter, what about
+     * Windows?  (I suspect Windows supplies reassembled frames,
+     * as WinPcap, like PF_PACKET sockets, taps into the networking
+     * stack just as other protocols do.)
+     */
     offset++;
     if (!BYTES_ARE_IN_FRAME(offset, len, 1)) {
       ld->other++;
       return;
     }
-    if (pd[offset] == 0xff) {
+    if (has_exception && pd[offset] == 0xff) {
       /* This is an exception packet.  The flag value there is the
          "this is an exception flag" packet; the next two bytes
          after it are padding, and another copy of the packet
@@ -91,6 +116,9 @@ capture_arcnet (const guchar *pd, int len, packet_counts *ld,
 
   case ARCNET_PROTO_ARP_1051:
   case ARCNET_PROTO_ARP_1201:
+    /*
+     * XXX - do we have to worry about fragmentation for ARP?
+     */
     ld->arp++;
     break;
 
@@ -102,7 +130,7 @@ capture_arcnet (const guchar *pd, int len, packet_counts *ld,
 
 static void
 dissect_arcnet_common (tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree,
-		       gboolean has_offset)
+		       gboolean has_offset, gboolean has_exception)
 {
   int offset = 0;
   guint8 dst, src, protID, split_flag;
@@ -158,9 +186,34 @@ dissect_arcnet_common (tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree,
     break;
 
   default:
-    /* Show the fragmentation stuff - flag and sequence ID */
+    /*
+     * Show the fragmentation stuff - flag and sequence ID.
+     *
+     * XXX - on at least some versions of NetBSD, it appears that
+     * we might get ARCNET frames, not reassembled packets; if so,
+     * we should reassemble them.
+     *
+     * XXX - but on FreeBSD it appears that we get reassembled packets
+     * on input (but apparently we get frames on output - or maybe
+     * we get the packet *and* all its frames!); how to tell the
+     * difference?  It looks from the FreeBSD reassembly code as if
+     * the reassembled packet arrives with the header for the first
+     * frame.  It also looks as if, on output, we first get the
+     * full packet, with a header containing none of the fragmentation
+     * stuff, and then get the frames.
+     *
+     * On Linux, we get only reassembled packets, and the exception
+     * frame stuff is hidden - there's a split flag and sequence
+     * number, but it appears that it will never have the exception
+     * frame stuff.
+     *
+     * XXX - what about OpenBSD?  And, for that matter, what about
+     * Windows?  (I suspect Windows supplies reassembled frames,
+     * as WinPcap, like PF_PACKET sockets, taps into the networking
+     * stack just as other protocols do.)
+     */
     split_flag = tvb_get_guint8 (tvb, offset);
-    if (split_flag == 0xff) {
+    if (has_exception && split_flag == 0xff) {
       /* This is an exception packet.  The flag value there is the
          "this is an exception flag" packet; the next two bytes
          after it are padding. */
@@ -215,22 +268,23 @@ dissect_arcnet_common (tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree,
 
 /*
  * BSD-style ARCNET headers - they don't have the offset field from the
- * ARCNET hardware packet.
+ * ARCNET hardware packet, but we might get an exception frame header.
  */
 static void
 dissect_arcnet (tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree)
 {
-	dissect_arcnet_common (tvb, pinfo, tree, FALSE);
+	dissect_arcnet_common (tvb, pinfo, tree, FALSE, TRUE);
 }
 
 /*
  * Linux-style ARCNET headers - they *do* have the offset field from the
- * ARCNET hardware packet.
+ * ARCNET hardware packet, but we should never see an exception frame
+ * header.
  */
 static void
 dissect_arcnet_linux (tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree)
 {
-	dissect_arcnet_common (tvb, pinfo, tree, TRUE);
+	dissect_arcnet_common (tvb, pinfo, tree, TRUE, FALSE);
 }
 
 static const value_string arcnet_prot_id_vals[] = {
diff --git a/packet-arcnet.h b/packet-arcnet.h
index 474186001d..d1334ca0be 100644
--- a/packet-arcnet.h
+++ b/packet-arcnet.h
@@ -1,6 +1,6 @@
 /* packet-arcnet.h
  *
- * $Id: packet-arcnet.h,v 1.1 2003/01/23 06:57:37 guy Exp $
+ * $Id: packet-arcnet.h,v 1.2 2003/01/23 09:04:54 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -24,6 +24,6 @@
 #ifndef __PACKET_ARCNET_H__
 #define __PACKET_ARCNET_H__
 
-void capture_arcnet (const guchar *, int, packet_counts *, gboolean);
+void capture_arcnet (const guchar *, int, packet_counts *, gboolean, gboolean);
 
 #endif