Work around a duplicate dest mac that appears in *some* frames captured on a FEX

Change-Id: I6604c764d4b354653280891c8bf50a73954370b3
Reviewed-on: https://code.wireshark.org/review/25994
Reviewed-by: Jörg Mayer <jmayer@loplof.de>

1 files changed, 25 insertions, 7 deletions

diff --git a/epan/dissectors/packet-eth.c b/epan/dissectors/packet-eth.c
index 4616858ae9..fb1650fc5e 100644
--- a/epan/dissectors/packet-eth.c
+++ b/epan/dissectors/packet-eth.c
@@ -45,6 +45,8 @@ static gboolean eth_assume_fcs = FALSE;
 static gboolean eth_check_fcs = TRUE;
 /* Interpret packets as FW1 monitor file packets if they look as if they are */
 static gboolean eth_interpret_as_fw1_monitor = FALSE;
+/* When capturing on a Cisco FEX some frames start with an extra destination mac */
+static gboolean eth_deduplicate_dmac = FALSE;
 /* Preference settings defining conditions for which the CCSDS dissector is called */
 static gboolean ccsds_heuristic_length = FALSE;
 static gboolean ccsds_heuristic_version = FALSE;
@@ -751,12 +753,23 @@ dissect_eth(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
 {
   struct eth_phdr   *eth = (struct eth_phdr *)data;
   proto_tree        *fh_tree;
+  tvbuff_t          *real_tvb;
+
+  /* When capturing on a Cisco FEX, some frames (most likely all frames
+     captured without a vntag) have an extra destination mac prepended. */
+  if (eth_deduplicate_dmac && tvb_captured_length(tvb) > 20 &&
+      memcmp(tvb_get_ptr(tvb,0,6),tvb_get_ptr(tvb,6,6), 6) == 0) {
+    real_tvb = tvb_new_subset_length_caplen(tvb, 6,
+      tvb_captured_length(tvb) - 6, tvb_reported_length(tvb) - 6);
+  } else {
+    real_tvb = tvb;
+  }
 
   /* Some devices slice the packet and add their own trailer before
      putting the frame on the network. Make sure these packets get
      a proper trailer (even though the sliced frame might not
      properly dissect. */
-  if ( (eth_trailer_length > 0) && (eth_trailer_length < tvb_captured_length(tvb)) ) {
+  if ( (eth_trailer_length > 0) && (eth_trailer_length < tvb_captured_length(real_tvb)) ) {
     tvbuff_t *next_tvb;
     guint total_trailer_length;
 
@@ -767,25 +780,25 @@ dissect_eth(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
     total_trailer_length = eth_trailer_length + (eth_assume_fcs ? 4 : 0);
 
     /* Dissect the tvb up to, but not including the trailer */
-    next_tvb = tvb_new_subset_length_caplen(tvb, 0,
-                              tvb_captured_length(tvb) - total_trailer_length,
-                              tvb_reported_length(tvb) - total_trailer_length);
+    next_tvb = tvb_new_subset_length_caplen(real_tvb, 0,
+                              tvb_captured_length(real_tvb) - total_trailer_length,
+                              tvb_reported_length(real_tvb) - total_trailer_length);
     fh_tree = dissect_eth_common(next_tvb, pinfo, tree, 0);
 
     /* Now handle the ethernet trailer and optional FCS */
-    next_tvb = tvb_new_subset_remaining(tvb, tvb_captured_length(tvb) - total_trailer_length);
+    next_tvb = tvb_new_subset_remaining(real_tvb, tvb_captured_length(real_tvb) - total_trailer_length);
     /*
      * XXX - this overrides Wiretap saying "this packet definitely has
      * no FCS".
      */
-    add_ethernet_trailer(pinfo, tree, fh_tree, hf_eth_trailer, tvb, next_tvb,
+    add_ethernet_trailer(pinfo, tree, fh_tree, hf_eth_trailer, real_tvb, next_tvb,
                          eth_assume_fcs ? 4 : eth->fcs_len);
   } else {
     /*
      * XXX - this overrides Wiretap saying "this packet definitely has
      * no FCS".
      */
-    dissect_eth_common(tvb, pinfo, tree, eth_assume_fcs ? 4 : eth->fcs_len);
+    dissect_eth_common(real_tvb, pinfo, tree, eth_assume_fcs ? 4 : eth->fcs_len);
   }
   return tvb_captured_length(tvb);
 }
@@ -946,6 +959,11 @@ proto_register_eth(void)
                                  "Whether packets should be interpreted as coming from CheckPoint FireWall-1 monitor file if they look as if they do",
                                  &eth_interpret_as_fw1_monitor);
 
+  prefs_register_bool_preference(eth_module, "deduplicate_dmac",
+                                 "Skip bytes 1-6 if identical to 7-12",
+                                 "When capturing on a Cisco FEX some frames start with an extra destination mac",
+                                 &eth_deduplicate_dmac);
+
   prefs_register_static_text_preference(eth_module, "ccsds_heuristic",
                                         "Dissect as CCSDS if",
                                         "These are the conditions to match a payload against in order to determine if this\n"