Beginnings of a Cisco ERSPAN dissector - the only thing missing is the code

to actually call this (aka to handle the ambiguities of DLT values).

svn path=/trunk/; revision=21427

6 files changed, 173 insertions, 1 deletions

diff --git a/epan/dissectors/Makefile.common b/epan/dissectors/Makefile.common
index f51dd72fb2..74ca349f49 100644
--- a/epan/dissectors/Makefile.common
+++ b/epan/dissectors/Makefile.common
@@ -233,6 +233,7 @@ CLEAN_DISSECTOR_SRC = \
 	packet-cigi.c   	\
 	packet-cimd.c		\
 	packet-cip.c		\
+	packet-cisco-erspan.c	\
 	packet-cisco-oui.c	\
 	packet-cisco-wids.c	\
 	packet-clearcase.c	\
diff --git a/epan/dissectors/packet-cisco-erspan.c b/epan/dissectors/packet-cisco-erspan.c
new file mode 100644
index 0000000000..8d90de25be
--- /dev/null
+++ b/epan/dissectors/packet-cisco-erspan.c
@@ -0,0 +1,164 @@
+/* packet-extreme.c
+ * Routines for the disassembly of Cisco's ERSPAN protocol
+ *
+ * $Id$
+ *
+ * Copyright 2005 Joerg Mayer (see AUTHORS file)
+ *
+ * Wireshark - Network traffic analyzer
+ * By Gerald Combs <gerald@wireshark.org>
+ * Copyright 1998 Gerald Combs
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+/*
+ * TODO:
+ *	Find out the Unknown values
+ *
+ * Specs:
+ *	No real specs exist. Some general description can be found at:
+ *	http://www.cisco.com/en/US/products/hw/routers/ps368/products_configuration_guide_chapter09186a008069952a.html
+ *
+ *	For ERSPAN packets, the “protocol type” field value in the GRE header
+ *	is 0x88BE.
+ *
+ * 0000000: d4c3 b2a1 0200 0400 0000 0000 0000 0000 <-- pcap header
+ * 0000010: ffff 0000
+ * 0000010:           7100 0000 <-- 0x71 (DLT_TYPE) = linux_cooked_capture (of course not)
+ * 0000010:                     7507 f845 11d1 0500 <-- pcap record header
+ * 0000020: 7a00 0000 7a00 0000
+ * 0000020:                     0000 030a 0000 0000 <-- unknown
+ * 0000030: 0000 0000
+ * 0000030:           0000 88be <-- GRE header
+ * 0000030:                     1002 0001 0000 0380 <-- ERSPAN header (01: erspan-id)
+ * 0000040: 00d0 b7a7 7480 0015 c721 75c0 0800 4500 <-- Ethernet packet
+ * ...
+ * 
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#  include "config.h"
+#endif
+
+#include <glib.h>
+#include <epan/packet.h>
+#include <epan/greproto.h>
+
+static int proto_erspan = -1;
+
+static gint ett_erspan = -1;
+
+static int hf_erspan_unknown1 = -1;
+static int hf_erspan_vlan = -1;
+static int hf_erspan_unknown2 = -1;
+static int hf_erspan_spanid = -1;
+static int hf_erspan_unknown3 = -1;
+
+#define PROTO_SHORT_NAME "ERSPAN"
+#define PROTO_LONG_NAME "ER Switch Packet Analysis"
+
+static dissector_handle_t ethnofcs_handle;
+
+static void
+dissect_erspan(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
+{
+	proto_item *ti;
+	proto_tree *erspan_tree = NULL;
+	tvbuff_t *eth_tvb;
+	guint32 offset = 0;
+
+	if (check_col(pinfo->cinfo, COL_PROTOCOL))
+		col_set_str(pinfo->cinfo, COL_PROTOCOL, PROTO_SHORT_NAME);
+	if (check_col(pinfo->cinfo, COL_INFO))
+		col_set_str(pinfo->cinfo, COL_INFO, PROTO_SHORT_NAME ":");
+
+	if (tree) {
+		ti = proto_tree_add_item(tree, proto_erspan, tvb, offset, -1,
+		    FALSE);
+		erspan_tree = proto_item_add_subtree(ti, ett_erspan);
+
+		proto_tree_add_item(erspan_tree, hf_erspan_unknown1, tvb, offset, 2,
+			FALSE);
+
+		proto_tree_add_item(erspan_tree, hf_erspan_vlan, tvb, offset, 2,
+			FALSE);
+		offset += 2;
+
+		proto_tree_add_item(erspan_tree, hf_erspan_unknown2, tvb, offset, 2,
+			FALSE);
+
+		proto_tree_add_item(erspan_tree, hf_erspan_spanid, tvb, offset, 2,
+			FALSE);
+		offset += 2;
+
+		proto_tree_add_item(erspan_tree, hf_erspan_unknown3, tvb, offset, 4,
+			FALSE);
+		offset += 4;
+
+		eth_tvb = tvb_new_subset(tvb, offset, -1, -1);
+		call_dissector(ethnofcs_handle, eth_tvb, pinfo, tree);
+	}
+}
+
+void
+proto_register_erspan(void)
+{
+	static hf_register_info hf[] = {
+
+		{ &hf_erspan_unknown1,
+		{ "Unknown1",	"erspan.unknown1", FT_UINT16, BASE_HEX, NULL,
+			0xf000, "", HFILL }},
+
+		{ &hf_erspan_vlan,
+		{ "Vlan",	"erspan.vlan", FT_UINT16, BASE_DEC, NULL,
+			0x0fff, "", HFILL }},
+
+		{ &hf_erspan_unknown2,
+		{ "Unknown2",	"erspan.unknown2", FT_UINT16, BASE_HEX, NULL,
+			0xfc00, "", HFILL }},
+
+		{ &hf_erspan_spanid,
+		{ "SpanID",	"erspan.spanid", FT_UINT16, BASE_DEC, NULL,
+			0x03ff, "", HFILL }},
+
+		{ &hf_erspan_unknown3,
+		{ "Unknown3",	"erspan.unknown3", FT_BYTES, BASE_NONE, NULL,
+			0, "", HFILL }},
+
+        };
+	static gint *ett[] = {
+		&ett_erspan,
+	};
+
+        proto_erspan = proto_register_protocol(PROTO_LONG_NAME,
+	    PROTO_SHORT_NAME, "erspan");
+        proto_register_field_array(proto_erspan, hf, array_length(hf));
+	proto_register_subtree_array(ett, array_length(ett));
+}
+
+void
+proto_reg_handoff_erspan(void)
+{
+	dissector_handle_t erspan_handle;
+
+        ethnofcs_handle = find_dissector("eth_withoutfcs");
+
+	erspan_handle = create_dissector_handle(dissect_erspan, proto_erspan);
+        dissector_add("gre.proto", GRE_ERSPAN, erspan_handle);
+
+}
+
diff --git a/epan/dissectors/packet-cisco-oui.c b/epan/dissectors/packet-cisco-oui.c
index 92bbfc8beb..ed50219ebb 100644
--- a/epan/dissectors/packet-cisco-oui.c
+++ b/epan/dissectors/packet-cisco-oui.c
@@ -71,3 +71,4 @@ proto_register_cisco_oui(void)
 
 	llc_add_oui(OUI_CISCO, "llc.cisco_pid", "Cisco OUI PID", &hf);
 }
+
diff --git a/epan/dissectors/packet-gre.c b/epan/dissectors/packet-gre.c
index abe3c4e07a..dc146fffb2 100644
--- a/epan/dissectors/packet-gre.c
+++ b/epan/dissectors/packet-gre.c
@@ -88,6 +88,7 @@ static const value_string typevals[] = {
 	{ SAP_OSINL5,          "OSI"},
 	{ GRE_WCCP,            "WCCP"},
 	{ GRE_NHRP,            "NHRP"},
+	{ GRE_ERSPAN,          "ERSPAN"},
 	{ ETHERTYPE_IPX,       "IPX"},
 	{ ETHERTYPE_ETHBRIDGE, "Transparent Ethernet bridging" },
 	{ ETHERTYPE_RAW_FR,    "Frame Relay"},
diff --git a/epan/greproto.h b/epan/greproto.h
index ef74dcb1a4..a1db28f9ff 100644
--- a/epan/greproto.h
+++ b/epan/greproto.h
@@ -33,3 +33,4 @@
 
 #define GRE_NHRP	0x2001
 #define GRE_WCCP	0x883E
+#define GRE_ERSPAN	0x88BE
diff --git a/wiretap/libpcap.c b/wiretap/libpcap.c
index 61a854587e..e8cf02b552 100644
--- a/wiretap/libpcap.c
+++ b/wiretap/libpcap.c
@@ -307,7 +307,11 @@ static const struct {
 
 	/*
 	 * Linux "cooked mode" captures, used by the current CVS version
-	 * of libpcap.
+	 * of libpcap 
+         * OR
+         * it could be a packet in Cisco's ERSPAN encapsulation which uses
+         * this number as well (why can't people stick to protocols when it
+         * comes to allocating/using DLT types).
 	 */
 	{ 113,		WTAP_ENCAP_SLL },	/* Linux cooked capture */