aboutsummaryrefslogtreecommitdiffstats
path: root/epan/dissectors/packet-arp.c
diff options
context:
space:
mode:
authormorriss <morriss@f5534014-38df-0310-8fa8-9805f1628bb7>2012-06-20 13:30:07 +0000
committermorriss <morriss@f5534014-38df-0310-8fa8-9805f1628bb7>2012-06-20 13:30:07 +0000
commitc8391561bf16bde475344593e7987bc45c94944e (patch)
tree7f1ac290c1925812ef8d63c739a0e558ed2cd958 /epan/dissectors/packet-arp.c
parentade3bd548ae4b02c8cb9bb8344b9329997ed62d8 (diff)
Use separate filters for the RTT found on a SACK and the RTT found on a
DATA chunk: having them in both places is helpful when looking at the messages but having them separate is helpful when graphing the RTTs. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@43406 f5534014-38df-0310-8fa8-9805f1628bb7
Diffstat (limited to 'epan/dissectors/packet-arp.c')
-rw-r--r--epan/dissectors/packet-arp.c713
1 files changed, 573 insertions, 140 deletions
diff --git a/epan/dissectors/packet-arp.c b/epan/dissectors/packet-arp.c
index 39c3e60e91..0c120e52f1 100644
--- a/epan/dissectors/packet-arp.c
+++ b/epan/dissectors/packet-arp.c
@@ -7,6 +7,9 @@
* By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
+ * By Deepti Ragha <dlragha@ncsu.edu>
+ * Copyright 2012 Deepti Ragha
+ *
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
@@ -64,6 +67,7 @@ static int hf_arp_dst_hw = -1;
static int hf_arp_dst_hw_mac = -1;
static int hf_arp_dst_proto = -1;
static int hf_arp_dst_proto_ipv4 = -1;
+static int hf_drarp_error_status = -1;
static int hf_arp_packet_storm = -1;
static int hf_arp_duplicate_ip_address = -1;
static int hf_arp_duplicate_ip_address_earlier_frame = -1;
@@ -115,8 +119,8 @@ typedef struct address_hash_value {
static GHashTable *duplicate_result_hash_table = NULL;
typedef struct duplicate_result_key {
- guint32 frame_number;
- guint32 ip_address;
+ guint32 frame_number;
+ guint32 ip_address;
} duplicate_result_key;
@@ -126,6 +130,7 @@ typedef struct duplicate_result_key {
*/
+
/* ARP / RARP structs and definitions */
#ifndef ARPOP_REQUEST
#define ARPOP_REQUEST 1 /* ARP request. */
@@ -140,6 +145,20 @@ typedef struct duplicate_result_key {
#ifndef ARPOP_RREPLY
#define ARPOP_RREPLY 4 /* RARP reply. */
#endif
+
+/*Additional parameters as per http://www.iana.org/assignments/arp-parameters*/
+#ifndef ARPOP_DRARPREQUEST
+#define ARPOP_DRARPREQUEST 5 /* DRARP request. */
+#endif
+
+#ifndef ARPOP_DRARPREPLY
+#define ARPOP_DRARPREPLY 6 /* DRARP reply. */
+#endif
+
+#ifndef ARPOP_DRARPERROR
+#define ARPOP_DRARPERROR 7 /* DRARP error. */
+#endif
+
#ifndef ARPOP_IREQUEST
#define ARPOP_IREQUEST 8 /* Inverse ARP (RFC 1293) request. */
#endif
@@ -149,6 +168,60 @@ typedef struct duplicate_result_key {
#ifndef ATMARPOP_NAK
#define ATMARPOP_NAK 10 /* ATMARP NAK. */
#endif
+
+/*Additional parameters as per http://www.iana.org/assignments/arp-parameters*/
+#ifndef ARPOP_MARS_REQUEST
+#define ARPOP_MARS_REQUEST 11 /*MARS request message. */
+#endif
+
+#ifndef ARPOP_MARS_MULTI
+#define ARPOP_MARS_MULTI 12 /*MARS-Multi message. */
+#endif
+
+#ifndef ARPOP_MARS_MSERV
+#define ARPOP_MARS_MSERV 13 /*MARS-Mserv message. */
+#endif
+
+#ifndef ARPOP_MARS_JOIN
+#define ARPOP_MARS_JOIN 14 /*MARS-Join request. */
+#endif
+
+#ifndef ARPOP_MARS_LEAVE
+#define ARPOP_MARS_LEAVE 15 /*MARS Leave request. */
+#endif
+
+#ifndef ARPOP_MARS_NAK
+#define ARPOP_MARS_NAK 16 /*MARS nak message.*/
+#endif
+
+#ifndef ARPOP_MARS_UNSERV
+#define ARPOP_MARS_UNSERV 17 /*MARS Unserv message. */
+#endif
+
+#ifndef ARPOP_MARS_SJOIN
+#define ARPOP_MARS_SJOIN 18 /*MARS Sjoin message. */
+#endif
+
+#ifndef ARPOP_MARS_SLEAVE
+#define ARPOP_MARS_SLEAVE 19 /*MARS Sleave message. */
+#endif
+
+#ifndef ARPOP_MARS_GROUPLIST_REQUEST
+#define ARPOP_MARS_GROUPLIST_REQUEST 20 /*MARS Grouplist request message. */
+#endif
+
+#ifndef ARPOP_MARS_GROUPLIST_REPLY
+#define ARPOP_MARS_GROUPLIST_REPLY 21 /*MARS Grouplist reply message. */
+#endif
+
+#ifndef ARPOP_MARS_REDIRECT_MAP
+#define ARPOP_MARS_REDIRECT_MAP 22 /*MARS Grouplist request message. */
+#endif
+
+#ifndef ARPOP_MAPOS_UNARP
+#define ARPOP_MAPOS_UNARP 23 /*MAPOS UNARP*/
+#endif
+
#ifndef ARPOP_EXP1
#define ARPOP_EXP1 24 /* Experimental 1 */
#endif
@@ -156,16 +229,73 @@ typedef struct duplicate_result_key {
#define ARPOP_EXP2 25 /* Experimental 2 */
#endif
+#ifndef ARPOP_RESERVED1
+#define ARPOP_RESERVED1 0 /*Reserved opcode 1*/
+#endif
+
+#ifndef ARPOP_RESERVED2
+#define ARPOP_RESERVED2 65535 /*Reserved opcode 2*/
+#endif
+
+#ifndef DRARPERR_RESTRICTED
+#define DRARPERR_RESTRICTED 1
+#endif
+
+#ifndef DRARPERR_NOADDRESSES
+#define DRARPERR_NOADDRESSES 2
+#endif
+
+#ifndef DRARPERR_SERVERDOWN
+#define DRARPERR_SERVERDOWN 3
+#endif
+
+#ifndef DRARPERR_MOVED
+#define DRARPERR_MOVED 4
+#endif
+
+#ifndef DRARPERR_FAILURE
+#define DRARPERR_FAILURE 5
+#endif
+
+
+
static const value_string op_vals[] = {
{ARPOP_REQUEST, "request" },
{ARPOP_REPLY, "reply" },
{ARPOP_RREQUEST, "reverse request"},
{ARPOP_RREPLY, "reverse reply" },
+ {ARPOP_DRARPREQUEST, "drarp request"},
+ {ARPOP_DRARPREPLY, "drarp reply"},
+ {ARPOP_DRARPERROR, "drarp error"},
{ARPOP_IREQUEST, "inverse request"},
{ARPOP_IREPLY, "inverse reply" },
+ {ATMARPOP_NAK, "arp nak" },
+ {ARPOP_MARS_REQUEST, "mars request"},
+ {ARPOP_MARS_MULTI, "mars multi"},
+ {ARPOP_MARS_MSERV, "mars mserv"},
+ {ARPOP_MARS_JOIN, "mars join"},
+ {ARPOP_MARS_LEAVE, "mars leave"},
+ {ARPOP_MARS_NAK, "mars nak"},
+ {ARPOP_MARS_UNSERV, "mars unserv"},
+ {ARPOP_MARS_SJOIN, "mars sjoin"},
+ {ARPOP_MARS_SLEAVE, "mars sleave"},
+ {ARPOP_MARS_GROUPLIST_REQUEST, "mars grouplist request"},
+ {ARPOP_MARS_GROUPLIST_REPLY, "mars gruoplist reply"},
+ {ARPOP_MARS_REDIRECT_MAP, "mars redirect map"},
+ {ARPOP_MAPOS_UNARP, "mapos unarp"},
{ARPOP_EXP1, "experimental 1" },
{ARPOP_EXP2, "experimental 2" },
- {0, NULL } };
+ {ARPOP_RESERVED1, "reserved"},
+ {ARPOP_RESERVED2, "reserved"},
+ {0, NULL}};
+
+static const value_string drarp_status[]={
+{DRARPERR_RESTRICTED, "restricted"},
+{DRARPERR_NOADDRESSES, "no address"},
+{DRARPERR_SERVERDOWN, "serverdown"},
+{DRARPERR_MOVED, "moved"},
+{DRARPERR_FAILURE, "failure"},
+{0, NULL}};
static const value_string atmop_vals[] = {
{ARPOP_REQUEST, "request" },
@@ -173,10 +303,27 @@ static const value_string atmop_vals[] = {
{ARPOP_IREQUEST, "inverse request"},
{ARPOP_IREPLY, "inverse reply" },
{ATMARPOP_NAK, "nak" },
- {0, NULL } };
+ {ARPOP_MARS_REQUEST, "mars request"},
+ {ARPOP_MARS_MULTI, "mars multi"},
+ {ARPOP_MARS_MSERV, "mars mserv"},
+ {ARPOP_MARS_JOIN, "mars join"},
+ {ARPOP_MARS_LEAVE, "mars leave"},
+ {ARPOP_MARS_NAK, "mars nak"},
+ {ARPOP_MARS_UNSERV, "mars unserv"},
+ {ARPOP_MARS_SJOIN, "mars sjoin"},
+ {ARPOP_MARS_SLEAVE, "mars sleave"},
+ {ARPOP_MARS_GROUPLIST_REQUEST, "mars grouplist request"},
+ {ARPOP_MARS_GROUPLIST_REPLY, "mars gruoplist reply"},
+ {ARPOP_MARS_REDIRECT_MAP, "mars redirect map"},
+ {ARPOP_MAPOS_UNARP, "mapos unarp"},
+ {ARPOP_EXP1, "experimental 1" },
+ {ARPOP_EXP2, "experimental 2" },
+ {ARPOP_RESERVED1, "reserved"},
+ {ARPOP_RESERVED2, "reserved"},
+ {0, NULL} };
-#define ATMARP_IS_E164 0x40 /* bit in type/length for E.164 format */
-#define ATMARP_LEN_MASK 0x3F /* length of {sub}address in type/length */
+#define ATMARP_IS_E164 0x40 /* bit in type/length for E.164 format */
+#define ATMARP_LEN_MASK 0x3F /* length of {sub}address in type/length */
/*
* Given the hardware address type and length, check whether an address
@@ -220,7 +367,7 @@ arpproaddr_to_str(const guint8 *ad, int ad_len, guint16 type)
return bytes_to_str(ad, ad_len);
}
-#define MAX_E164_STR_LEN 20
+#define MAX_E164_STR_LEN 20
static const gchar *
atmarpnum_to_str(const guint8 *ad, int ad_tl)
@@ -323,24 +470,24 @@ arphrdtype_to_str(guint16 hwtype, const char *fmt) {
}
/* Offsets of fields within an ARP packet. */
-#define AR_HRD 0
-#define AR_PRO 2
-#define AR_HLN 4
-#define AR_PLN 5
-#define AR_OP 6
-#define MIN_ARP_HEADER_SIZE 8
+#define AR_HRD 0
+#define AR_PRO 2
+#define AR_HLN 4
+#define AR_PLN 5
+#define AR_OP 6
+#define MIN_ARP_HEADER_SIZE 8
/* Offsets of fields within an ATMARP packet. */
-#define ATM_AR_HRD 0
-#define ATM_AR_PRO 2
-#define ATM_AR_SHTL 4
-#define ATM_AR_SSTL 5
-#define ATM_AR_OP 6
-#define ATM_AR_SPLN 8
-#define ATM_AR_THTL 9
-#define ATM_AR_TSTL 10
-#define ATM_AR_TPLN 11
-#define MIN_ATMARP_HEADER_SIZE 12
+#define ATM_AR_HRD 0
+#define ATM_AR_PRO 2
+#define ATM_AR_SHTL 4
+#define ATM_AR_SSTL 5
+#define ATM_AR_OP 6
+#define ATM_AR_SPLN 8
+#define ATM_AR_THTL 9
+#define ATM_AR_TSTL 10
+#define ATM_AR_TPLN 11
+#define MIN_ATMARP_HEADER_SIZE 12
static void
dissect_atm_number(tvbuff_t *tvb, int offset, int tl, int hf_e164,
@@ -374,8 +521,8 @@ dissect_atm_nsap(tvbuff_t *tvb, int offset, int len, proto_tree *tree)
afi = tvb_get_guint8(tvb, offset);
switch (afi) {
- case 0x39: /* DCC ATM format */
- case 0xBD: /* DCC ATM group format */
+ case 0x39: /* DCC ATM format */
+ case 0xBD: /* DCC ATM group format */
proto_tree_add_text(tree, tvb, offset + 0, 3,
"Data Country Code%s: 0x%04X",
(afi == 0xBD) ? " (group)" : "",
@@ -390,8 +537,8 @@ dissect_atm_nsap(tvbuff_t *tvb, int offset, int len, proto_tree *tree)
"Selector: 0x%02X", tvb_get_guint8(tvb, offset + 19));
break;
- case 0x47: /* ICD ATM format */
- case 0xC5: /* ICD ATM group format */
+ case 0x47: /* ICD ATM format */
+ case 0xC5: /* ICD ATM group format */
proto_tree_add_text(tree, tvb, offset + 0, 3,
"International Code Designator%s: 0x%04X",
(afi == 0xC5) ? " (group)" : "",
@@ -406,8 +553,8 @@ dissect_atm_nsap(tvbuff_t *tvb, int offset, int len, proto_tree *tree)
"Selector: 0x%02X", tvb_get_guint8(tvb, offset + 19));
break;
- case 0x45: /* E.164 ATM format */
- case 0xC3: /* E.164 ATM group format */
+ case 0x45: /* E.164 ATM format */
+ case 0xC3: /* E.164 ATM group format */
proto_tree_add_text(tree, tvb, offset + 0, 9,
"E.164 ISDN%s: %s",
(afi == 0xC3) ? " (group)" : "",
@@ -433,24 +580,28 @@ dissect_atm_nsap(tvbuff_t *tvb, int offset, int len, proto_tree *tree)
}
/* l.s. 32 bits are ipv4 address */
-static guint address_hash_func(gconstpointer v)
+static guint
+address_hash_func(gconstpointer v)
{
return GPOINTER_TO_UINT(v);
}
/* Compare 2 ipv4 addresses */
-static gint address_equal_func(gconstpointer v, gconstpointer v2)
+static gint
+address_equal_func(gconstpointer v, gconstpointer v2)
{
return v == v2;
}
-static guint duplicate_result_hash_func(gconstpointer v)
+static guint
+duplicate_result_hash_func(gconstpointer v)
{
duplicate_result_key *key = (duplicate_result_key*)v;
return (key->frame_number + key->ip_address);
}
-static gint duplicate_result_equal_func(gconstpointer v, gconstpointer v2)
+static gint
+duplicate_result_equal_func(gconstpointer v, gconstpointer v2)
{
duplicate_result_key *key1 = (duplicate_result_key*)v;
duplicate_result_key *key2 = (duplicate_result_key*)v2;
@@ -463,7 +614,8 @@ static gint duplicate_result_equal_func(gconstpointer v, gconstpointer v2)
/* Check to see if this mac & ip pair represent 2 devices trying to share
the same IP address - report if found (+ return TRUE and set out param) */
-static gboolean check_for_duplicate_addresses(packet_info *pinfo, proto_tree *tree,
+static gboolean
+check_for_duplicate_addresses(packet_info *pinfo, proto_tree *tree,
tvbuff_t *tvb,
const guint8 *mac, guint32 ip,
guint32 *duplicate_ip)
@@ -586,7 +738,8 @@ arp_init_protocol(void)
/* Take note that a request has been seen */
-static void request_seen(packet_info *pinfo)
+static void
+request_seen(packet_info *pinfo)
{
/* Don't count frame again after already recording first time around. */
if (p_get_proto_data(pinfo->fd, proto_arp) == 0)
@@ -596,7 +749,8 @@ static void request_seen(packet_info *pinfo)
}
/* Has storm request rate been exceeded with this request? */
-static void check_for_storm_count(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
+static void
+check_for_storm_count(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
gboolean report_storm = FALSE;
@@ -764,18 +918,38 @@ dissect_atmarp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
case ARPOP_REPLY:
case ATMARPOP_NAK:
default:
- col_set_str(pinfo->cinfo, COL_PROTOCOL, "ATMARP");
- break;
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "ATMARP");
+ break;
case ARPOP_RREQUEST:
case ARPOP_RREPLY:
- col_set_str(pinfo->cinfo, COL_PROTOCOL, "ATMRARP");
- break;
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "ATMRARP");
+ break;
case ARPOP_IREQUEST:
case ARPOP_IREPLY:
- col_set_str(pinfo->cinfo, COL_PROTOCOL, "Inverse ATMARP");
- break;
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "Inverse ATMARP");
+ break;
+
+ case ARPOP_MARS_REQUEST:
+ case ARPOP_MARS_MULTI:
+ case ARPOP_MARS_MSERV:
+ case ARPOP_MARS_JOIN:
+ case ARPOP_MARS_LEAVE:
+ case ARPOP_MARS_NAK:
+ case ARPOP_MARS_UNSERV:
+ case ARPOP_MARS_SJOIN:
+ case ARPOP_MARS_SLEAVE:
+ case ARPOP_MARS_GROUPLIST_REQUEST:
+ case ARPOP_MARS_GROUPLIST_REPLY:
+ case ARPOP_MARS_REDIRECT_MAP:
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "MARS");
+ break;
+
+ case ARPOP_MAPOS_UNARP:
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "MAPOS");
+ break;
+
}
switch (ar_op) {
@@ -807,6 +981,123 @@ dissect_atmarp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
case ATMARPOP_NAK:
col_add_fstr(pinfo->cinfo, COL_INFO, "I don't know where %s is", spa_str);
break;
+ case ARPOP_MARS_REQUEST:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS request from %s%s%s at %s",
+ sha_str,
+ ((ssa_str != NULL) ? "," : ""),
+ ((ssa_str != NULL) ? ssa_str : ""),
+ spa_str);
+ break;
+
+ case ARPOP_MARS_MULTI:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS MULTI request from %s%s%s at %s",
+ sha_str,
+ ((ssa_str != NULL) ? "," : ""),
+ ((ssa_str != NULL) ? ssa_str : ""),
+ spa_str);
+ break;
+
+ case ARPOP_MARS_MSERV:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS MSERV request from %s%s%s at %s",
+ sha_str,
+ ((ssa_str != NULL) ? "," : ""),
+ ((ssa_str != NULL) ? ssa_str : ""),
+ spa_str);
+ break;
+
+ case ARPOP_MARS_JOIN:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS JOIN request from %s%s%s at %s",
+ sha_str,
+ ((ssa_str != NULL) ? "," : ""),
+ ((ssa_str != NULL) ? ssa_str : ""),
+ spa_str);
+ break;
+
+ case ARPOP_MARS_LEAVE:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS LEAVE from %s%s%s at %s",
+ sha_str,
+ ((ssa_str != NULL) ? "," : ""),
+ ((ssa_str != NULL) ? ssa_str : ""),
+ spa_str);
+ break;
+
+ case ARPOP_MARS_NAK:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS NAK from %s%s%s at %s",
+ sha_str,
+ ((ssa_str != NULL) ? "," : ""),
+ ((ssa_str != NULL) ? ssa_str : ""),
+ spa_str);
+ break;
+
+ case ARPOP_MARS_UNSERV:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS UNSERV request from %s%s%s at %s",
+ sha_str,
+ ((ssa_str != NULL) ? "," : ""),
+ ((ssa_str != NULL) ? ssa_str : ""),
+ spa_str);
+ break;
+
+ case ARPOP_MARS_SJOIN:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS SJOIN request from %s%s%s at %s",
+ sha_str,
+ ((ssa_str != NULL) ? "," : ""),
+ ((ssa_str != NULL) ? ssa_str : ""),
+ spa_str);
+ break;
+
+ case ARPOP_MARS_SLEAVE:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS SLEAVE from %s%s%s at %s",
+ sha_str,
+ ((ssa_str != NULL) ? "," : ""),
+ ((ssa_str != NULL) ? ssa_str : ""),
+ spa_str);
+ break;
+
+ case ARPOP_MARS_GROUPLIST_REQUEST:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS grouplist request from %s%s%s at %s",
+ sha_str,
+ ((ssa_str != NULL) ? "," : ""),
+ ((ssa_str != NULL) ? ssa_str : ""),
+ spa_str);
+ break;
+
+ case ARPOP_MARS_GROUPLIST_REPLY:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS grouplist reply from %s%s%s at %s",
+ sha_str,
+ ((ssa_str != NULL) ? "," : ""),
+ ((ssa_str != NULL) ? ssa_str : ""),
+ spa_str);
+ break;
+
+ case ARPOP_MARS_REDIRECT_MAP:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS redirect map from %s%s%s at %s",
+ sha_str,
+ ((ssa_str != NULL) ? "," : ""),
+ ((ssa_str != NULL) ? ssa_str : ""),
+ spa_str);
+ break;
+
+ case ARPOP_MAPOS_UNARP:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MAPOS UNARP request from %s%s%s at %s",
+ sha_str,
+ ((ssa_str != NULL) ? "," : ""),
+ ((ssa_str != NULL) ? ssa_str : ""),
+ spa_str);
+ break;
+
+ case ARPOP_EXP1:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "Experimental 1 ( opcode %d )", ar_op);
+ break;
+
+ case ARPOP_EXP2:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "Experimental 2 ( opcode %d )", ar_op);
+ break;
+
+ case 0:
+ case 65535:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "Reserved opcode %d", ar_op);
+ break;
+
default:
col_add_fstr(pinfo->cinfo, COL_INFO, "Unknown ATMARP opcode 0x%04x", ar_op);
break;
@@ -978,10 +1269,35 @@ dissect_arp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
col_set_str(pinfo->cinfo, COL_PROTOCOL, "RARP");
break;
+ case ARPOP_DRARPREQUEST:
+ case ARPOP_DRARPREPLY:
+ case ARPOP_DRARPERROR:
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "DRARP");
+ break;
+
case ARPOP_IREQUEST:
case ARPOP_IREPLY:
col_set_str(pinfo->cinfo, COL_PROTOCOL, "Inverse ARP");
break;
+
+ case ARPOP_MARS_REQUEST:
+ case ARPOP_MARS_MULTI:
+ case ARPOP_MARS_MSERV:
+ case ARPOP_MARS_JOIN:
+ case ARPOP_MARS_LEAVE:
+ case ARPOP_MARS_NAK:
+ case ARPOP_MARS_UNSERV:
+ case ARPOP_MARS_SJOIN:
+ case ARPOP_MARS_SLEAVE:
+ case ARPOP_MARS_GROUPLIST_REQUEST:
+ case ARPOP_MARS_GROUPLIST_REPLY:
+ case ARPOP_MARS_REDIRECT_MAP:
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "MARS");
+ break;
+
+ case ARPOP_MAPOS_UNARP:
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "MAPOS");
+ break;
}
/* Get the offsets of the addresses. */
@@ -1026,6 +1342,7 @@ dissect_arp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
/* Do not add target address if the packet is a Request. According to the RFC,
target addresses in requests have no meaning */
+
ip = tvb_get_ipv4(tvb, tpa_offset);
mac = tvb_get_ptr(tvb, tha_offset, 6);
if ((mac[0] & 0x01) == 0 && memcmp(mac, mac_allzero, 6) != 0 && ip != 0
@@ -1039,6 +1356,8 @@ dissect_arp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
&duplicate_ip);
}
}
+
+
}
spa_val = tvb_get_ptr(tvb, spa_offset, ar_pln);
@@ -1077,20 +1396,123 @@ dissect_arp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
break;
case ARPOP_RREQUEST:
case ARPOP_IREQUEST:
+ case ARPOP_DRARPREQUEST:
col_add_fstr(pinfo->cinfo, COL_INFO, "Who is %s? Tell %s",
tvb_arphrdaddr_to_str(tvb, tha_offset, ar_hln, ar_hrd),
tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd));
break;
case ARPOP_RREPLY:
+ case ARPOP_DRARPREPLY:
col_add_fstr(pinfo->cinfo, COL_INFO, "%s is at %s",
tvb_arphrdaddr_to_str(tvb, tha_offset, ar_hln, ar_hrd),
arpproaddr_to_str(tpa_val, ar_pln, ar_pro));
break;
+
+ case ARPOP_DRARPERROR:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "DRARP Error");
+ break;
+
case ARPOP_IREPLY:
col_add_fstr(pinfo->cinfo, COL_INFO, "%s is at %s",
tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd),
arpproaddr_to_str(spa_val, ar_pln, ar_pro));
break;
+
+ case ATMARPOP_NAK:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "ARP NAK");
+ break;
+
+ case ARPOP_MARS_REQUEST:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS request from %s at %s",
+ tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd),
+ arpproaddr_to_str(spa_val, ar_pln, ar_pro));
+ break;
+
+ case ARPOP_MARS_MULTI:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS MULTI request from %s at %s",
+ tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd),
+ arpproaddr_to_str(spa_val, ar_pln, ar_pro));
+ break;
+
+ case ARPOP_MARS_MSERV:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS MSERV request from %s at %s",
+ tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd),
+ arpproaddr_to_str(spa_val, ar_pln, ar_pro));
+ break;
+
+ case ARPOP_MARS_JOIN:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS JOIN request from %s at %s",
+ tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd),
+ arpproaddr_to_str(spa_val, ar_pln, ar_pro));
+ break;
+
+ case ARPOP_MARS_LEAVE:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS LEAVE from %s at %s",
+ tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd),
+ arpproaddr_to_str(spa_val, ar_pln, ar_pro));
+ break;
+
+ case ARPOP_MARS_NAK:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS NAK from %s at %s",
+ tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd),
+ arpproaddr_to_str(spa_val, ar_pln, ar_pro));
+ break;
+
+ case ARPOP_MARS_UNSERV:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS UNSERV request from %s at %s",
+ tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd),
+ arpproaddr_to_str(spa_val, ar_pln, ar_pro));
+ break;
+
+ case ARPOP_MARS_SJOIN:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS SJOIN request from %s at %s",
+ tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd),
+ arpproaddr_to_str(spa_val, ar_pln, ar_pro));
+ break;
+
+ case ARPOP_MARS_SLEAVE:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS SLEAVE from %s at %s",
+ tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd),
+ arpproaddr_to_str(spa_val, ar_pln, ar_pro));
+ break;
+
+ case ARPOP_MARS_GROUPLIST_REQUEST:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS grouplist request from %s at %s",
+ tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd),
+ arpproaddr_to_str(spa_val, ar_pln, ar_pro));
+ break;
+
+ case ARPOP_MARS_GROUPLIST_REPLY:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS grouplist reply from %s at %s",
+ tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd),
+ arpproaddr_to_str(spa_val, ar_pln, ar_pro));
+ break;
+
+ case ARPOP_MARS_REDIRECT_MAP:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MARS redirect map from %s at %s",
+ tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd),
+ arpproaddr_to_str(spa_val, ar_pln, ar_pro));
+ break;
+
+ case ARPOP_MAPOS_UNARP:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "MAPOS UNARP request from %s at %s",
+ tvb_arphrdaddr_to_str(tvb, sha_offset, ar_hln, ar_hrd),
+ arpproaddr_to_str(spa_val, ar_pln, ar_pro));
+ break;
+
+ case ARPOP_EXP1:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "Experimental 1 ( opcode %d )", ar_op);
+ break;
+
+ case ARPOP_EXP2:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "Experimental 2 ( opcode %d )", ar_op);
+ break;
+
+ case 0:
+ case 65535:
+ col_add_fstr(pinfo->cinfo, COL_INFO, "Reserved opcode %d", ar_op);
+ break;
+
default:
col_add_fstr(pinfo->cinfo, COL_INFO, "Unknown ARP opcode 0x%04x", ar_op);
break;
@@ -1113,8 +1535,11 @@ dissect_arp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
proto_tree_add_uint(arp_tree, hf_arp_hard_size, tvb, AR_HLN, 1, ar_hln);
proto_tree_add_uint(arp_tree, hf_arp_proto_size, tvb, AR_PLN, 1, ar_pln);
proto_tree_add_uint(arp_tree, hf_arp_opcode, tvb, AR_OP, 2, ar_op);
+ if(is_gratuitous)
+ {
item = proto_tree_add_boolean(arp_tree, hf_arp_isgratuitous, tvb, 0, 0, is_gratuitous);
PROTO_ITEM_SET_GENERATED(item);
+ }
if (ar_hln != 0) {
proto_tree_add_item(arp_tree,
ARP_HW_IS_ETHER(ar_hrd, ar_hln) ?
@@ -1136,13 +1561,16 @@ dissect_arp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
hf_arp_dst_hw,
tvb, tha_offset, ar_hln, ENC_BIG_ENDIAN);
}
- if (ar_pln != 0) {
+ if (ar_pln != 0 && ar_op != ARPOP_DRARPERROR) { /*DISPLAYING ERROR NUMBER FOR DRARPERROR*/
proto_tree_add_item(arp_tree,
ARP_PRO_IS_IPv4(ar_pro, ar_pln) ?
hf_arp_dst_proto_ipv4 :
hf_arp_dst_proto,
tvb, tpa_offset, ar_pln, ENC_BIG_ENDIAN);
}
+ else if (ar_pln != 0 && ar_op == ARPOP_DRARPERROR) {
+ proto_tree_add_item(arp_tree, hf_drarp_error_status, tvb, tpa_offset, 1, ENC_BIG_ENDIAN); /*Adding the first byte of tpa field as drarp_error_status*/
+ }
}
if (global_arp_detect_request_storm)
@@ -1165,173 +1593,178 @@ proto_register_arp(void)
static hf_register_info hf[] = {
{ &hf_arp_hard_type,
- { "Hardware type", "arp.hw.type",
- FT_UINT16, BASE_DEC, VALS(hrd_vals), 0x0,
- NULL, HFILL }},
+ { "Hardware type", "arp.hw.type",
+ FT_UINT16, BASE_DEC, VALS(hrd_vals), 0x0,
+ NULL, HFILL }},
{ &hf_arp_proto_type,
- { "Protocol type", "arp.proto.type",
- FT_UINT16, BASE_HEX, VALS(etype_vals), 0x0,
- NULL, HFILL }},
+ { "Protocol type", "arp.proto.type",
+ FT_UINT16, BASE_HEX, VALS(etype_vals), 0x0,
+ NULL, HFILL }},
{ &hf_arp_hard_size,
- { "Hardware size", "arp.hw.size",
- FT_UINT8, BASE_DEC, NULL, 0x0,
- NULL, HFILL }},
+ { "Hardware size", "arp.hw.size",
+ FT_UINT8, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_atmarp_sht,
- { "Sender ATM number type", "arp.src.htype",
- FT_BOOLEAN, 8, TFS(&tfs_type_bit), ATMARP_IS_E164,
- NULL, HFILL }},
+ { "Sender ATM number type", "arp.src.htype",
+ FT_BOOLEAN, 8, TFS(&tfs_type_bit), ATMARP_IS_E164,
+ NULL, HFILL }},
{ &hf_atmarp_shl,
- { "Sender ATM number length", "arp.src.hlen",
- FT_UINT8, BASE_DEC, NULL, ATMARP_LEN_MASK,
- NULL, HFILL }},
+ { "Sender ATM number length", "arp.src.hlen",
+ FT_UINT8, BASE_DEC, NULL, ATMARP_LEN_MASK,
+ NULL, HFILL }},
{ &hf_atmarp_sst,
- { "Sender ATM subaddress type", "arp.src.stype",
- FT_BOOLEAN, 8, TFS(&tfs_type_bit), ATMARP_IS_E164,
- NULL, HFILL }},
+ { "Sender ATM subaddress type", "arp.src.stype",
+ FT_BOOLEAN, 8, TFS(&tfs_type_bit), ATMARP_IS_E164,
+ NULL, HFILL }},
{ &hf_atmarp_ssl,
- { "Sender ATM subaddress length", "arp.src.slen",
- FT_UINT8, BASE_DEC, NULL, ATMARP_LEN_MASK,
- NULL, HFILL }},
+ { "Sender ATM subaddress length", "arp.src.slen",
+ FT_UINT8, BASE_DEC, NULL, ATMARP_LEN_MASK,
+ NULL, HFILL }},
{ &hf_arp_proto_size,
- { "Protocol size", "arp.proto.size",
- FT_UINT8, BASE_DEC, NULL, 0x0,
- NULL, HFILL }},
+ { "Protocol size", "arp.proto.size",
+ FT_UINT8, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_arp_opcode,
- { "Opcode", "arp.opcode",
- FT_UINT16, BASE_DEC, VALS(op_vals), 0x0,
- NULL, HFILL }},
+ { "Opcode", "arp.opcode",
+ FT_UINT16, BASE_DEC, VALS(op_vals), 0x0,
+ NULL, HFILL }},
{ &hf_arp_isgratuitous,
- { "Is gratuitous", "arp.isgratuitous",
- FT_BOOLEAN, BASE_NONE, TFS(&tfs_true_false), 0x0,
- NULL, HFILL }},
+ { "Is gratuitous", "arp.isgratuitous",
+ FT_BOOLEAN, BASE_NONE, TFS(&tfs_true_false), 0x0,
+ NULL, HFILL }},
{ &hf_atmarp_spln,
- { "Sender protocol size", "arp.src.pln",
- FT_UINT8, BASE_DEC, NULL, 0x0,
- NULL, HFILL }},
+ { "Sender protocol size", "arp.src.pln",
+ FT_UINT8, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_atmarp_tht,
- { "Target ATM number type", "arp.dst.htype",
- FT_BOOLEAN, 8, TFS(&tfs_type_bit), ATMARP_IS_E164,
- NULL, HFILL }},
+ { "Target ATM number type", "arp.dst.htype",
+ FT_BOOLEAN, 8, TFS(&tfs_type_bit), ATMARP_IS_E164,
+ NULL, HFILL }},
{ &hf_atmarp_thl,
- { "Target ATM number length", "arp.dst.hlen",
- FT_UINT8, BASE_DEC, NULL, ATMARP_LEN_MASK,
- NULL, HFILL }},
+ { "Target ATM number length", "arp.dst.hlen",
+ FT_UINT8, BASE_DEC, NULL, ATMARP_LEN_MASK,
+ NULL, HFILL }},
{ &hf_atmarp_tst,
- { "Target ATM subaddress type", "arp.dst.stype",
- FT_BOOLEAN, 8, TFS(&tfs_type_bit), ATMARP_IS_E164,
- NULL, HFILL }},
+ { "Target ATM subaddress type", "arp.dst.stype",
+ FT_BOOLEAN, 8, TFS(&tfs_type_bit), ATMARP_IS_E164,
+ NULL, HFILL }},
{ &hf_atmarp_tsl,
- { "Target ATM subaddress length", "arp.dst.slen",
- FT_UINT8, BASE_DEC, NULL, ATMARP_LEN_MASK,
- NULL, HFILL }},
+ { "Target ATM subaddress length", "arp.dst.slen",
+ FT_UINT8, BASE_DEC, NULL, ATMARP_LEN_MASK,
+ NULL, HFILL }},
{ &hf_atmarp_tpln,
- { "Target protocol size", "arp.dst.pln",
- FT_UINT8, BASE_DEC, NULL, 0x0,
- NULL, HFILL }},
+ { "Target protocol size", "arp.dst.pln",
+ FT_UINT8, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_arp_src_hw,
- { "Sender hardware address", "arp.src.hw",
- FT_BYTES, BASE_NONE, NULL, 0x0,
- NULL, HFILL }},
+ { "Sender hardware address", "arp.src.hw",
+ FT_BYTES, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_arp_src_hw_mac,
- { "Sender MAC address", "arp.src.hw_mac",
- FT_ETHER, BASE_NONE, NULL, 0x0,
- NULL, HFILL }},
+ { "Sender MAC address", "arp.src.hw_mac",
+ FT_ETHER, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_atmarp_src_atm_num_e164,
- { "Sender ATM number (E.164)", "arp.src.atm_num_e164",
- FT_STRING, BASE_NONE, NULL, 0x0,
- NULL, HFILL }},
+ { "Sender ATM number (E.164)", "arp.src.atm_num_e164",
+ FT_STRING, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_atmarp_src_atm_num_nsap,
- { "Sender ATM number (NSAP)", "arp.src.atm_num_nsap",
- FT_BYTES, BASE_NONE, NULL, 0x0,
- NULL, HFILL }},
+ { "Sender ATM number (NSAP)", "arp.src.atm_num_nsap",
+ FT_BYTES, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_atmarp_src_atm_subaddr,
- { "Sender ATM subaddress", "arp.src.atm_subaddr",
- FT_BYTES, BASE_NONE, NULL, 0x0,
- NULL, HFILL }},
+ { "Sender ATM subaddress", "arp.src.atm_subaddr",
+ FT_BYTES, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_arp_src_proto,
- { "Sender protocol address", "arp.src.proto",
- FT_BYTES, BASE_NONE, NULL, 0x0,
- NULL, HFILL }},
+ { "Sender protocol address", "arp.src.proto",
+ FT_BYTES, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_arp_src_proto_ipv4,
- { "Sender IP address", "arp.src.proto_ipv4",
- FT_IPv4, BASE_NONE, NULL, 0x0,
- NULL, HFILL }},
+ { "Sender IP address", "arp.src.proto_ipv4",
+ FT_IPv4, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_arp_dst_hw,
- { "Target hardware address", "arp.dst.hw",
- FT_BYTES, BASE_NONE, NULL, 0x0,
- NULL, HFILL }},
+ { "Target hardware address", "arp.dst.hw",
+ FT_BYTES, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_arp_dst_hw_mac,
- { "Target MAC address", "arp.dst.hw_mac",
- FT_ETHER, BASE_NONE, NULL, 0x0,
- NULL, HFILL }},
+ { "Target MAC address", "arp.dst.hw_mac",
+ FT_ETHER, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_atmarp_dst_atm_num_e164,
- { "Target ATM number (E.164)", "arp.dst.atm_num_e164",
- FT_STRING, BASE_NONE, NULL, 0x0,
- NULL, HFILL }},
+ { "Target ATM number (E.164)", "arp.dst.atm_num_e164",
+ FT_STRING, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_atmarp_dst_atm_num_nsap,
- { "Target ATM number (NSAP)", "arp.dst.atm_num_nsap",
- FT_BYTES, BASE_NONE, NULL, 0x0,
- NULL, HFILL }},
+ { "Target ATM number (NSAP)", "arp.dst.atm_num_nsap",
+ FT_BYTES, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_atmarp_dst_atm_subaddr,
- { "Target ATM subaddress", "arp.dst.atm_subaddr",
- FT_BYTES, BASE_NONE, NULL, 0x0,
- NULL, HFILL }},
+ { "Target ATM subaddress", "arp.dst.atm_subaddr",
+ FT_BYTES, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
{ &hf_arp_dst_proto,
- { "Target protocol address", "arp.dst.proto",
- FT_BYTES, BASE_NONE, NULL, 0x0,
+ { "Target protocol address", "arp.dst.proto",
+ FT_BYTES, BASE_NONE, NULL, 0x0,
NULL, HFILL }},
{ &hf_arp_dst_proto_ipv4,
- { "Target IP address", "arp.dst.proto_ipv4",
- FT_IPv4, BASE_NONE, NULL, 0x0,
+ { "Target IP address", "arp.dst.proto_ipv4",
+ FT_IPv4, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_drarp_error_status,
+ { "DRARP error status", "arp.dst.drarp_error_status",
+ FT_UINT16, BASE_DEC, VALS(drarp_status), 0x0,
NULL, HFILL }},
{ &hf_arp_packet_storm,
- { "Packet storm detected", "arp.packet-storm-detected",
- FT_NONE, BASE_NONE, NULL, 0x0,
+ { "Packet storm detected", "arp.packet-storm-detected",
+ FT_NONE, BASE_NONE, NULL, 0x0,
NULL, HFILL }},
{ &hf_arp_duplicate_ip_address,
- { "Duplicate IP address detected", "arp.duplicate-address-detected",
- FT_NONE, BASE_NONE, NULL, 0x0,
+ { "Duplicate IP address detected", "arp.duplicate-address-detected",
+ FT_NONE, BASE_NONE, NULL, 0x0,
NULL, HFILL }},
{ &hf_arp_duplicate_ip_address_earlier_frame,
- { "Frame showing earlier use of IP address", "arp.duplicate-address-frame",
- FT_FRAMENUM, BASE_NONE, NULL, 0x0,
+ { "Frame showing earlier use of IP address", "arp.duplicate-address-frame",
+ FT_FRAMENUM, BASE_NONE, NULL, 0x0,
NULL, HFILL }},
{ &hf_arp_duplicate_ip_address_seconds_since_earlier_frame,
- { "Seconds since earlier frame seen", "arp.seconds-since-duplicate-address-frame",
- FT_UINT32, BASE_DEC, NULL, 0x0,
+ { "Seconds since earlier frame seen", "arp.seconds-since-duplicate-address-frame",
+ FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }},
};
@@ -1346,7 +1779,7 @@ proto_register_arp(void)
module_t *arp_module;
proto_arp = proto_register_protocol("Address Resolution Protocol",
- "ARP/RARP", "arp");
+ "ARP/RARP", "arp");
proto_register_field_array(proto_arp, hf, array_length(hf));
proto_register_subtree_array(ett, array_length(ett));