Cisco ACI specific protocol enhancements

Add Ethertype for Cisco ACI ARP gleaning and dissect its payload
Improve some Cisco ACI vendor specific DHCP options
Update mcp after looking at knet_parser.py
Update lldp after looking at knet_parser.py

Also reorder some ETHERTYPEs by value

5 files changed, 233 insertions, 142 deletions

diff --git a/epan/dissectors/packet-cisco-mcp.c b/epan/dissectors/packet-cisco-mcp.c
index 7082479bc8..00e27dc434 100644
--- a/epan/dissectors/packet-cisco-mcp.c
+++ b/epan/dissectors/packet-cisco-mcp.c
@@ -1,5 +1,5 @@
 /* packet-cisco-mcp.c
- * Routines for the disassembly of Cisco's MCP (Miscabling Protocol)
+ * Routines for the disassembly of Cisco's MCP (MisCabling Protocol)
  *
  * Copyright 2019 Joerg Mayer (see AUTHORS file)
  *
@@ -12,9 +12,7 @@
 
 /*
   TODO:
-  - Figure out the meaning of more types
   - Figure out the hash calculation
-  - Display Value in TLV toplevel item where appropriate
 
 Specs: No specs available
   No header
@@ -28,6 +26,7 @@ Patent:
 Documentation:
   https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-737909.pdf
   https://unofficialaciguide.com/2018/03/27/using-mcp-miscabling-protocol-for-aci/
+  knet_parser.py from Cisco
  */
 
 #include "config.h"
@@ -45,13 +44,14 @@ static int proto_mcp = -1;
 static int hf_mcp_tlv_type = -1;
 static int hf_mcp_tlv_length = -1;
 /* Values */
-static int hf_mcp_1 = -1;
-static int hf_mcp_switchid = -1;
-static int hf_mcp_3 = -1;
-static int hf_mcp_ifindex = -1;
-static int hf_mcp_timestamp = -1;
-static int hf_mcp_hmac = -1;
-// static int hf_mcp_end = -1;
+static int hf_mcp_fabric_id = -1;
+static int hf_mcp_node_id = -1;
+static int hf_mcp_vpc_domain = -1;
+static int hf_mcp_vpc_id = -1;
+static int hf_mcp_vpc_vtep = -1;
+static int hf_mcp_port_id = -1;
+static int hf_mcp_send_time = -1;
+static int hf_mcp_digest = -1;
 static int hf_mcp_unknown = -1;
 
 static expert_field ei_mcp_short_tlv = EI_INIT;
@@ -65,22 +65,22 @@ static gint ett_mcp_tlv_header = -1;
 #define PROTO_LONG_NAME "Miscabling Protocol"
 
 typedef enum {
-	MCP_TYPE_1 = 1,		// Len=4, perhaps version or fabric-id
-	MCP_TYPE_SWITCHID = 2,	// Len=4,
-	MCP_TYPE_3 = 3,		// Len=12,
-	MCP_TYPE_IFINDEX = 4,	// Len=4,
-	MCP_TYPE_TIMESTAMP = 5,	// Len=4,
-	MCP_TYPE_HMAC = 6,	// Len=20, Guessing, possibly SHA1
+	MCP_TYPE_FABRIC_ID = 1,	// Len=4,
+	MCP_TYPE_NODE_ID = 2,	// Len=4,
+	MCP_TYPE_VPC_INFO = 3,	// Len=12,
+	MCP_TYPE_PORT_ID = 4,	// Len=4,
+	MCP_TYPE_SEND_TIME = 5,	// Len=4,
+	MCP_TYPE_DIGEST = 6,	// Len=20,
 	MCP_TYPE_END = 7	// Len=0
 } mcp_type_t;
 
 static const value_string mcp_type_vals[] = {
-	{ MCP_TYPE_1,		"Unknown1"},
-	{ MCP_TYPE_SWITCHID,	"SwitchID"},
-	{ MCP_TYPE_3,		"Unknown3"},
-	{ MCP_TYPE_IFINDEX,	"IfIndex"},
-	{ MCP_TYPE_TIMESTAMP,	"Timestamp"},
-	{ MCP_TYPE_HMAC,	"HMAC?"},
+	{ MCP_TYPE_FABRIC_ID,	"Fabric ID"},
+	{ MCP_TYPE_NODE_ID,	"Node ID"},
+	{ MCP_TYPE_VPC_INFO,	"VPC Info"},
+	{ MCP_TYPE_PORT_ID,	"Port ID"},
+	{ MCP_TYPE_SEND_TIME,	"Send Time"},
+	{ MCP_TYPE_DIGEST,	"Digest"},
 	{ MCP_TYPE_END,		"End"},
 
 	{ 0,	NULL }
@@ -89,7 +89,7 @@ static const value_string mcp_type_vals[] = {
 static int
 dissect_mcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 {
-	proto_item *ti;
+	proto_item *ti, *pi;
 	proto_tree *mcp_tree;
 	proto_tree *tlv_tree;
 	guint32 offset = 0;
@@ -97,8 +97,8 @@ dissect_mcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 	guint8 tlv_type;
 	guint16 tlv_length;
 	guint16 data_length = tvb_reported_length_remaining(tvb, offset);;
-	guint32 switchid, ifindex, timestamp;
-	gchar* timestamp_str;
+	guint32 fabricid, nodeid, vpcdomain, vpcid, portid, sendtime;
+	gchar *sendtime_str, *vpcvtep_str;
 
 	col_set_str(pinfo->cinfo, COL_PROTOCOL, PROTO_SHORT_NAME);
 	col_set_str(pinfo->cinfo, COL_INFO, "");
@@ -118,8 +118,7 @@ dissect_mcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 		tlv_length = tvb_get_guint8(tvb, offset + 1);
 
 		tlv_tree = proto_tree_add_subtree_format(mcp_tree, tvb, offset, tlv_length + 2,
-			ett_mcp_tlv_header, NULL, "TLV length %d, type %d = %s",
-			tlv_length, tlv_type, val_to_str(tlv_type, mcp_type_vals, "Unknown (0x%02x)"));
+			ett_mcp_tlv_header, NULL, "%s", val_to_str(tlv_type, mcp_type_vals, "Unknown (0x%02x)"));
 
 		proto_tree_add_uint(tlv_tree, hf_mcp_tlv_type, tvb, offset, 1, tlv_type);
 		offset += 1;
@@ -133,56 +132,64 @@ dissect_mcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 		offset += 1;
 
 		switch (tlv_type) {
-		case MCP_TYPE_1:
+		case MCP_TYPE_FABRIC_ID:
 			if (tlv_length == 4) {
-				proto_tree_add_item(tlv_tree, hf_mcp_1, tvb, offset, tlv_length, ENC_BIG_ENDIAN);
+				proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_fabric_id, tvb, offset, tlv_length, ENC_BIG_ENDIAN, &fabricid);
+				proto_item_append_text(tlv_tree, ": %u", fabricid);
+				col_append_fstr(pinfo->cinfo, COL_INFO, "FabricID/%u ", fabricid);
 			} else {
 				proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
 					offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
 					4, tlv_length);
 			}
 			break;
-		case MCP_TYPE_SWITCHID:
+		case MCP_TYPE_NODE_ID:
 			if (tlv_length == 4) {
-				proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_switchid, tvb, offset, tlv_length, ENC_BIG_ENDIAN, &switchid);
-				proto_item_append_text(tlv_tree, ": %u", switchid);
-				col_append_fstr(pinfo->cinfo, COL_INFO, "SwID/%u ", switchid);
+				proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_node_id, tvb, offset, tlv_length, ENC_BIG_ENDIAN, &nodeid);
+				proto_item_append_text(tlv_tree, ": %u", nodeid);
+				col_append_fstr(pinfo->cinfo, COL_INFO, "NodeID/%u ", nodeid);
 			} else {
 				proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
 					offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
 					4, tlv_length);
 			}
 			break;
-		case MCP_TYPE_3:
-			proto_tree_add_item(tlv_tree, hf_mcp_3, tvb, offset, tlv_length, ENC_NA);
+		case MCP_TYPE_VPC_INFO:
+			proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_vpc_domain, tvb, offset, 4, ENC_NA, &vpcdomain);
+			proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_vpc_id, tvb, offset + 4, 4, ENC_NA, &vpcid);
+			pi = proto_tree_add_item(tlv_tree, hf_mcp_vpc_vtep, tvb, offset + 8, 4, ENC_NA);
+			vpcvtep_str = proto_item_get_display_repr(wmem_packet_scope(), pi);
+			proto_item_append_text(tlv_tree, ": %u/%u/%s", vpcdomain, vpcid, vpcvtep_str);
+// FIXME: Why is vpcvtep_str displayed as "(null)" in COL_INFO but not above??? scope???
+			col_append_fstr(pinfo->cinfo, COL_INFO, "VpcInfo/%u,%u,%s ", vpcdomain, vpcid, vpcvtep_str);
 			break;
-		case MCP_TYPE_IFINDEX:
+		case MCP_TYPE_PORT_ID:
 			if (tlv_length == 4) {
-				proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_ifindex, tvb, offset, tlv_length, ENC_BIG_ENDIAN, &ifindex);
-				proto_item_append_text(tlv_tree, ": 0x%08x", ifindex);
-				col_append_fstr(pinfo->cinfo, COL_INFO, "ifIdx/0x%08x ", ifindex);
+				proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_port_id, tvb, offset, tlv_length, ENC_BIG_ENDIAN, &portid);
+				proto_item_append_text(tlv_tree, ": 0x%08x", portid);
+				col_append_fstr(pinfo->cinfo, COL_INFO, "PortID/0x%08x ", portid);
 			} else {
 				proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
 					offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
 					4, tlv_length);
 			}
 			break;
-		case MCP_TYPE_TIMESTAMP:
+		case MCP_TYPE_SEND_TIME:
 			if (tlv_length == 4) {
-				proto_tree_add_item(tlv_tree, hf_mcp_timestamp, tvb, offset, tlv_length, ENC_TIME_SECS|ENC_BIG_ENDIAN);
-				timestamp = tvb_get_ntohl(tvb, offset);
-				timestamp_str = abs_time_secs_to_str(wmem_packet_scope(), timestamp, ABSOLUTE_TIME_LOCAL, TRUE);
-				proto_item_append_text(tlv_tree, ": %s", timestamp_str);
-				col_append_fstr(pinfo->cinfo, COL_INFO, "time/%s ", timestamp_str);
+				proto_tree_add_item(tlv_tree, hf_mcp_send_time, tvb, offset, tlv_length, ENC_TIME_SECS|ENC_BIG_ENDIAN);
+				sendtime = tvb_get_ntohl(tvb, offset);
+				sendtime_str = abs_time_secs_to_str(wmem_packet_scope(), sendtime, ABSOLUTE_TIME_LOCAL, TRUE);
+				proto_item_append_text(tlv_tree, ": %s", sendtime_str);
+				col_append_fstr(pinfo->cinfo, COL_INFO, "SendTime/%s ", sendtime_str);
 			} else {
 				proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
 					offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
 					4, tlv_length);
 			}
 			break;
-		case MCP_TYPE_HMAC:
+		case MCP_TYPE_DIGEST:
 			if (tlv_length == 20) {
-				proto_tree_add_item(tlv_tree, hf_mcp_hmac, tvb, offset, tlv_length, ENC_NA);
+				proto_tree_add_item(tlv_tree, hf_mcp_digest, tvb, offset, tlv_length, ENC_NA);
 			} else {
 				proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
 					offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
@@ -226,28 +233,36 @@ proto_register_mcp(void)
 			0x0, NULL, HFILL }},
 
 	/* TLV data (aka V) */
-		{ &hf_mcp_1,
-		{ "Type1",	"mcp.type1", FT_UINT32, BASE_DEC, NULL,
+		{ &hf_mcp_fabric_id,
+		{ "Fabric ID",	"mcp.fabric_id", FT_UINT32, BASE_DEC, NULL,
 			0x0, NULL, HFILL }},
 
-		{ &hf_mcp_switchid,
-		{ "Switch ID",	"mcp.switchid", FT_UINT32, BASE_DEC, NULL,
+		{ &hf_mcp_node_id,
+		{ "Node ID",	"mcp.node_id", FT_UINT32, BASE_DEC, NULL,
 			0x0, "Originating Switch", HFILL }},
 
-		{ &hf_mcp_3,
-		{ "Type3",	"mcp.type3", FT_BYTES, BASE_NONE, NULL,
+		{ &hf_mcp_vpc_domain,
+		{ "VPC Domain",	"mcp.vpc.domain", FT_UINT32, BASE_DEC, NULL,
 			0x0, NULL, HFILL }},
 
-		{ &hf_mcp_ifindex,
-		{ "IfIndex",	"mcp.ifindex", FT_UINT32, BASE_HEX, NULL,
+		{ &hf_mcp_vpc_id,
+		{ "VPC ID",	"mcp.vpc.id", FT_UINT32, BASE_DEC, NULL,
 			0x0, NULL, HFILL }},
 
-		{ &hf_mcp_timestamp,
-		{ "Timestamp",	"mcp.timestamp", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL,
+		{ &hf_mcp_vpc_vtep,
+		{ "VPC VTEP",	"mcp.vpc.vtep", FT_IPv4, BASE_NONE, NULL,
 			0x0, NULL, HFILL }},
 
-		{ &hf_mcp_hmac,
-		{ "HMAC(?)",	"mcp.hmac", FT_BYTES, BASE_NONE, NULL,
+		{ &hf_mcp_port_id,
+		{ "Port ID",	"mcp.port_id", FT_UINT32, BASE_HEX, NULL,
+			0x0, NULL, HFILL }},
+
+		{ &hf_mcp_send_time,
+		{ "Send Time",	"mcp.send_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL,
+			0x0, NULL, HFILL }},
+
+		{ &hf_mcp_digest,
+		{ "Digest",	"mcp.digest", FT_BYTES, BASE_NONE, NULL,
 			0x0, NULL, HFILL }},
 
 		{ &hf_mcp_unknown,
diff --git a/epan/dissectors/packet-dhcp.c b/epan/dissectors/packet-dhcp.c
index 5c45b68b76..5418adcbf7 100644
--- a/epan/dissectors/packet-dhcp.c
+++ b/epan/dissectors/packet-dhcp.c
@@ -4712,19 +4712,33 @@ dissect_apple_bsdp_vendor_info_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tre
 
 /* Cisco Vendor Specific Information */
 
+/*
+        {  1, "1" },            * D,R: 03 *
+        {  2, "2" },            * D,R: 01 *
+        {  3, "3" },            * D,R: 00 01 # O,A: 00 02 *
+        {  4, "Node ID" },      * O,A: 00 00 00 ca *
+        {  5, "5" },            * O,A: 01 *
+        {  6, "6" },            * D,R: 01 # O,A: 01 *
+        {  7, "Model" },        * D,R: N9K-C9336PQ *
+        {  8, "APIC UUID" },    * O,A: 09bced36-69f1-11e6-96ce-8baf09371338 *
+        {  9, "Fabricname" },   * O,A: ams-fab1 *
+        { 10, "10" },           * D,R: 00 00 00 01 *
+        { 11, "SerialNo" },     * D,R: SAL1926J4QW *
+        { 12, "Client Int" },   * D,O: eth1/20.20 # R,A: eth1/20.20 *
+*/
 static const value_string option43_cisco_suboption_vals[] = {
-	{  1, "Unk-1" },	/* Number */
-	{  2, "Unk-2" },	/* Number */
-	{  3, "Unk-3" },	/* Number */
-	{  4, "Node ID" },	/* Number */
-	{  5, "Unk-5" },	/* Number */
-	{  6, "Unk-6" },	/* Number */
-	{  7, "Model" },	/* String */
-	{  8, "APIC UUID" },	/* String */
-	{  9, "Fabricname" },	/* String */
-	{ 10, "Unk-10" },	/* Number */
-	{ 11, "SerialNo" },	/* String */
-	{ 12, "Client Int" },	/* String */
+	{  1, "Unk-1 (Node role?)" },		/* uint8 */
+	{  2, "Unk-2 (Spine level?)" },		/* uint8 */
+	{  3, "Unk-3 (Pod ID?)" },		/* uint16 */
+	{  4, "Node ID" },			/* uint32 */
+	{  5, "Unk-5" },			/* uint8 */
+	{  6, "Unk-6" },			/* uint8 */
+	{  7, "Model" },			/* String */
+	{  8, "APIC UUID" },			/* String */
+	{  9, "Fabricname" },			/* String */
+	{ 10, "Unk-10" },			/* uint32 */
+	{ 11, "SerialNo" },			/* String */
+	{ 12, "Interfacename" },		/* String */
 
 	{ 0, NULL}
 };
diff --git a/epan/dissectors/packet-ethertype.c b/epan/dissectors/packet-ethertype.c
index acf3c20b48..90aa21fbf8 100644
--- a/epan/dissectors/packet-ethertype.c
+++ b/epan/dissectors/packet-ethertype.c
@@ -76,7 +76,7 @@ const value_string etype_vals[] = {
 	{ ETHERTYPE_MRP,                  "MRP" },
 	{ ETHERTYPE_IEEE_802_1AD,         "802.1ad Provider Bridge (Q-in-Q)" },
 	{ ETHERTYPE_MACSEC,               "802.1AE (MACsec)" },
-	{ ETHERTYPE_IEEE_1905,		  "1905.1a Convergent Digital Home Network for Heterogenous Technologies" },
+	{ ETHERTYPE_IEEE_1905,            "1905.1a Convergent Digital Home Network for Heterogenous Technologies" },
 	{ ETHERTYPE_IEEE_802_1AH,         "802.1ah Provider Backbone Bridge (mac-in-mac)" },
 	{ ETHERTYPE_IEEE_802_1BR,         "802.1br Bridge Port Extension E-Tag" },
 	{ ETHERTYPE_EAPOL,                "802.1X Authentication" },
@@ -175,7 +175,7 @@ const value_string etype_vals[] = {
 	{ ETHERTYPE_HSR,                  "High-availability Seamless Redundancy (IEC62439 Part 3)" },
 	{ ETHERTYPE_BPQ,                  "AX.25" },
 	{ ETHERTYPE_CMD,                  "CiscoMetaData" },
-	{ ETHERTYPE_GEONETWORKING,       "GeoNetworking" },
+	{ ETHERTYPE_GEONETWORKING,        "GeoNetworking" },
 	{ ETHERTYPE_XIP,                  "eXpressive Internet Protocol" },
 	{ ETHERTYPE_NWP,                  "Neighborhood Watch Protocol" },
 	{ ETHERTYPE_BLUECOM,              "bluecom Protocol" },
@@ -185,6 +185,7 @@ const value_string etype_vals[] = {
 	{ ETHERTYPE_AVSP,                 "Arista Timestamp" },
 	{ ETHERTYPE_ECPRI,                "eCPRI" },
 	{ ETHERTYPE_CABLELABS,            "CableLabs Layer-3 Protocol" },
+	{ ETHERTYPE_ACIGLEAN,             "Cisco ACI ARP gleaning" },
 	{ 0, NULL }
 };
 
@@ -231,6 +232,34 @@ dissect_ethertype(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *dat
 	reported_length = tvb_reported_length_remaining(tvb,
 							ethertype_data->payload_offset);
 
+	/* With Cisco ACI gleaning, the rest of the packet is dissected for informational purposes only */
+	if (ethertype_data->etype == ETHERTYPE_ACIGLEAN) {
+
+		guint gleantype, payload_etype;
+
+		col_add_fstr(pinfo->cinfo, COL_PROTOCOL, "0x%04x", ethertype_data->etype);
+		col_set_writable(pinfo->cinfo, COL_PROTOCOL, FALSE);
+
+		description = try_val_to_str(ethertype_data->etype, etype_vals);
+		col_add_str(pinfo->cinfo, COL_INFO, description);
+		col_set_writable(pinfo->cinfo, COL_INFO, FALSE);
+		if (reported_length >= 1) {
+			gleantype = (tvb_get_guint8(tvb, ethertype_data->payload_offset) & 0xF0) >> 4;
+			switch (gleantype) {
+			case 4: /* IPv4 */
+				payload_etype = 0x0800;
+				break;
+			case 6: /* IPv6 */
+				payload_etype = 0x86BB;
+				break;
+			default: /* ARP */
+				payload_etype = 0x0806;
+			}
+			ethertype_data->etype = payload_etype;
+// FIXME: Add glean to protocol-stack in frame-header
+		}
+	}
+
 	/* Remember how much data there is after the Ethernet type,
 	   including any trailer and FCS. */
 	length_before = reported_length;
diff --git a/epan/dissectors/packet-lldp.c b/epan/dissectors/packet-lldp.c
index 4c6398a4a3..62795ec28f 100644
--- a/epan/dissectors/packet-lldp.c
+++ b/epan/dissectors/packet-lldp.c
@@ -390,23 +390,24 @@ static int hf_cisco_upoe_pse_spare_pair_oper = -1;
 static int hf_cisco_aci_portstate = -1;
 static int hf_cisco_aci_noderole = -1;
 static int hf_cisco_aci_nodeid = -1;
-static int hf_cisco_aci_unknowncc = -1;
-static int hf_cisco_aci_pod = -1;
+static int hf_cisco_aci_spinelevel = -1;
+static int hf_cisco_aci_podid = -1;
 static int hf_cisco_aci_fabricname = -1;
 static int hf_cisco_aci_apiclist = -1;
 static int hf_cisco_aci_apicid = -1;
 static int hf_cisco_aci_apicipv4 = -1;
 static int hf_cisco_aci_apicuuid = -1;
 static int hf_cisco_aci_nodeip = -1;
-static int hf_cisco_aci_unknownd1 = -1;
+static int hf_cisco_aci_portrole = -1;
 static int hf_cisco_aci_version = -1;
 static int hf_cisco_aci_fabricvlan = -1;
 static int hf_cisco_aci_serialno = -1;
 static int hf_cisco_aci_model = -1;
 static int hf_cisco_aci_nodename = -1;
 static int hf_cisco_aci_portmode = -1;
-static int hf_cisco_aci_unknownd9 = -1;
+static int hf_cisco_aci_authcookie = -1;
 static int hf_cisco_aci_apicmode = -1;
+static int hf_cisco_aci_fabricid = -1;
 static int hf_hytec_tlv_subtype = -1;
 static int hf_hytec_group = -1;
 static int hf_hytec_identifier = -1;
@@ -780,21 +781,21 @@ static const value_string cisco_subtypes[] = {
 	{ 0xc9, "ACI Port State" },
 	{ 0xca, "ACI Node Role" },
 	{ 0xcb, "ACI Node ID" },
-	{ 0xcc, "ACI Unknown-CC" },
+	{ 0xcc, "ACI Spine Level" },
 	{ 0xcd, "ACI Pod ID" },
 	{ 0xce, "ACI Fabric Name" },
 	{ 0xcf, "ACI Appliance Vector" },
 	{ 0xd0, "ACI Node IP" },
-	{ 0xd1, "ACI Unknown-D1" },
+	{ 0xd1, "ACI Port Role" },
 	{ 0xd2, "ACI Firmware Version" },
 	{ 0xd3, "ACI Infra VLAN" },
 	{ 0xd4, "ACI Serial Number" },
 	{ 0xd6, "ACI Model" },
 	{ 0xd7, "ACI Node Name" },
 	{ 0xd8, "ACI Port Mode" },
-	{ 0xd9, "ACI Unknown D9" },
+	{ 0xd9, "ACI Authentication Cookie" },
 	{ 0xda, "ACI APIC-Mode" },
-	{ 0xdb, "ACI Unknown-DB" },
+	{ 0xdb, "ACI Fabric ID" },
 	{ 0, NULL }
 };
 
@@ -806,13 +807,24 @@ static const value_string cisco_portstate_vals[] = {
 	{ 0, NULL }
 };
 
+static const value_string cisco_portrole_vals[] = {
+	{ 1,	"Active" },
+	{ 2,	"Backup" },
+	{ 0, NULL }
+};
+static const value_string cisco_portmode_vals[] = {
+	{ 0,	"Normal" },
+	{ 1,	"Recovery Mode" },
+	{ 0, NULL }
+};
+
 /* Guessing here, the output of apic show commands only has leaf and spine, and
    those values are leaf=2, spine=3 (off by 1) */
 static const value_string cisco_noderole_vals[] = {
 	{ 0,	"APIC" },
 	{ 1,	"Leaf" },
 	{ 2,	"Spine" },
-	{ 3,	"Unknown" },
+	{ 3,	"vLeaf" },
 	{ 0, NULL }
 };
 
@@ -3639,43 +3651,43 @@ dissect_cisco_tlv(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree)
 		length--;
 		break;
 	/* ACI */
-	case 0xc9:
+	case 0xc9: // 201 port-state, uint8
 		tf = proto_tree_add_item(tree, hf_cisco_aci_portstate, tvb, offset, length, ENC_NA);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
-		offset += length;
-		length -= length;
+		offset++;
+		length--;
 		break;
-	case 0xca:
+	case 0xca: // 202 node-role, uint8
 		tf = proto_tree_add_item(tree, hf_cisco_aci_noderole, tvb, offset, length, ENC_NA);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
-		offset += length;
-		length -= length;
+		offset++;
+		length--;
 		break;
-	case 0xcb:
-		tf = proto_tree_add_item(tree, hf_cisco_aci_nodeid, tvb, offset, length, ENC_NA);
+	case 0xcb: // 203 node-id, uint32
+		tf = proto_tree_add_item(tree, hf_cisco_aci_nodeid, tvb, offset, length, ENC_BIG_ENDIAN);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
 		offset += 4;
 		length -= 4;
 		break;
-	case 0xcc:
-		tf = proto_tree_add_item(tree, hf_cisco_aci_unknowncc, tvb, offset, length, ENC_NA);
+	case 0xcc: // 204 spine-level, uint8
+		tf = proto_tree_add_item(tree, hf_cisco_aci_spinelevel, tvb, offset, length, ENC_NA);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
-		offset += length;
-		length -= length;
+		offset++;
+		length--;
 		break;
-	case 0xcd:
-		tf = proto_tree_add_item(tree, hf_cisco_aci_pod, tvb, offset, 2, ENC_NA);
+	case 0xcd: // 205 pod-id, uint16
+		tf = proto_tree_add_item(tree, hf_cisco_aci_podid, tvb, offset, 2, ENC_BIG_ENDIAN);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
 		offset += 2;
 		length -= 2;
 		break;
-	case 0xce:
+	case 0xce: // 206 fabric-name, string
 		tf = proto_tree_add_item(tree, hf_cisco_aci_fabricname, tvb, offset, length, ENC_ASCII|ENC_NA);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
 		offset += length;
 		length -= length;
 		break;
-	case 0xcf:
+	case 0xcf: // 207 av (id, ip, uuid) (uint8, ipv4, string)
 		proto_tree_add_item(tree, hf_cisco_aci_apiclist, tvb, offset, length, ENC_NA);
 		while (length > 0) {
 			tf = proto_tree_add_item(tree, hf_cisco_aci_apicid, tvb, offset, 1, ENC_NA);
@@ -3690,65 +3702,75 @@ dissect_cisco_tlv(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree)
 			length -= 36;
 		}
 		break;
-	case 0xd0:
+	case 0xd0: // 208 node-ip, ipv4
 		tf = proto_tree_add_item(tree, hf_cisco_aci_nodeip, tvb, offset, length, ENC_NA);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
 		offset += 4;
 		length -= 4;
 		break;
-	case 0xd1:
-		tf = proto_tree_add_item(tree, hf_cisco_aci_unknownd1, tvb, offset, length, ENC_NA);
+	case 0xd1: // 209 port-role, uint8
+		tf = proto_tree_add_item(tree, hf_cisco_aci_portrole, tvb, offset, length, ENC_NA);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
-		offset += length;
-		length -= length;
+		offset++;
+		length--;
 		break;
-	case 0xd2:
+	case 0xd2: // 210 fw-ver, string
 		tf = proto_tree_add_item(tree, hf_cisco_aci_version, tvb, offset, length, ENC_ASCII|ENC_NA);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
 		offset += length;
 		length -= length;
 		break;
-	case 0xd3:
-		tf = proto_tree_add_item(tree, hf_cisco_aci_fabricvlan, tvb, offset, 2, ENC_NA);
+	case 0xd3: // 211 infra-vlan, uint16
+		tf = proto_tree_add_item(tree, hf_cisco_aci_fabricvlan, tvb, offset, 2, ENC_BIG_ENDIAN);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
 		offset += 2;
 		length -= 2;
 		break;
-	case 0xd4:
+	case 0xd4: // 212 serial-number, string
 		tf = proto_tree_add_item(tree, hf_cisco_aci_serialno, tvb, offset, length, ENC_ASCII|ENC_NA);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
 		offset += length;
 		length -= length;
 		break;
-	case 0xd6:
+#if 0
+	case 0xd5: // 213 unused
+		break;
+#endif
+	case 0xd6: // 214 model, string
 		tf = proto_tree_add_item(tree, hf_cisco_aci_model, tvb, offset, length, ENC_ASCII|ENC_NA);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
 		offset += length;
 		length -= length;
 		break;
-	case 0xd7:
+	case 0xd7: // 215 name, string
 		tf = proto_tree_add_item(tree, hf_cisco_aci_nodename, tvb, offset, length, ENC_ASCII|ENC_NA);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
 		offset += length;
 		length -= length;
 		break;
-	case 0xd8:
-		tf = proto_tree_add_item(tree, hf_cisco_aci_portmode, tvb, offset, length, ENC_NA);
+	case 0xd8: // 216 port-mode, uint16
+		tf = proto_tree_add_item(tree, hf_cisco_aci_portmode, tvb, offset, length, ENC_BIG_ENDIAN);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
-		offset += length;
-		length -= length;
+		offset += 2;
+		length -= 2;
 		break;
-	case 0xd9:
-		tf = proto_tree_add_item(tree, hf_cisco_aci_unknownd9, tvb, offset, length, ENC_NA);
+	case 0xd9: // 217 authenticate-cookie, bytes
+		tf = proto_tree_add_item(tree, hf_cisco_aci_authcookie, tvb, offset, length, ENC_NA);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
 		offset += length;
 		length -= length;
 		break;
-	case 0xda:
+	case 0xda: // 218 standby-apic, uint8
 		tf = proto_tree_add_item(tree, hf_cisco_aci_apicmode, tvb, offset, length, ENC_NA);
 		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
-		offset += length;
-		length -= length;
+		offset++;
+		length--;
+		break;
+	case 0xdb: // 219 fabric-id, uint16
+		tf = proto_tree_add_item(tree, hf_cisco_aci_fabricid, tvb, offset, length, ENC_BIG_ENDIAN);
+		proto_item_append_text(parent_item, ": %s", proto_item_get_display_repr(wmem_packet_scope(), tf));
+		offset += 2;
+		length -= 2;
 		break;
 	default:
 		if (length > 0) {
@@ -5810,6 +5832,7 @@ proto_register_lldp(void)
 			{ "GreenPeriodBegin.Offset",	"lldp.profinet.green_period_begin_offset", FT_UINT32, BASE_DEC,
 			NULL, 0x7FFFFFFF, "Unrestricted period, offset to cycle begin in nanoseconds", HFILL }
 		},
+	/* Cisco generic */
 		{ &hf_cisco_subtype,
 			{ "Cisco Subtype",	"lldp.cisco.subtype", FT_UINT8, BASE_HEX,
 			VALS(cisco_subtypes), 0x0, NULL, HFILL }
@@ -5834,6 +5857,7 @@ proto_register_lldp(void)
 			{ "PSE Spare Pair PoE", "lldp.cisco.upoe.pse_altb_oper", FT_BOOLEAN, 8,
 			TFS(&tfs_enabled_disabled), 0x08, "PSE ALT-B Pair Operational State", HFILL }
 		},
+	/* Cisco ACI */
 		{ &hf_cisco_aci_portstate,
 			{ "Port State", "lldp.cisco.portstate", FT_UINT8, BASE_NONE,
 			VALS(cisco_portstate_vals), 0x0, NULL, HFILL }
@@ -5846,12 +5870,12 @@ proto_register_lldp(void)
 			{ "Node ID", "lldp.cisco.nodeid", FT_UINT32, BASE_DEC,
 			NULL, 0x0, NULL, HFILL }
 		},
-		{ &hf_cisco_aci_unknowncc,
-			{ "Unknown 0xCC", "lldp.cisco.unknowncc", FT_BYTES, BASE_NONE,
+		{ &hf_cisco_aci_spinelevel,
+			{ "Spine Level", "lldp.cisco.spinelevel", FT_UINT8, BASE_DEC,
 			NULL, 0x0, NULL, HFILL }
 		},
-		{ &hf_cisco_aci_pod,
-			{ "Pod", "lldp.cisco.pod", FT_UINT16, BASE_DEC,
+		{ &hf_cisco_aci_podid,
+			{ "Pod ID", "lldp.cisco.podid", FT_UINT16, BASE_DEC,
 			NULL, 0x0, NULL, HFILL }
 		},
 		{ &hf_cisco_aci_fabricname,
@@ -5878,9 +5902,9 @@ proto_register_lldp(void)
 			{ "Node IP", "lldp.cisco.nodeip", FT_IPv4, BASE_NONE,
 			NULL, 0x0, NULL, HFILL }
 		},
-		{ &hf_cisco_aci_unknownd1,
-			{ "Unknown 0xD1", "lldp.cisco.unknownd1", FT_BYTES, BASE_NONE,
-			NULL, 0x0, NULL, HFILL }
+		{ &hf_cisco_aci_portrole,
+			{ "Port Role", "lldp.cisco.portrole", FT_UINT8, BASE_NONE,
+			VALS(cisco_portrole_vals), 0x0, NULL, HFILL }
 		},
 		{ &hf_cisco_aci_version,
 			{ "Version", "lldp.cisco.version", FT_STRING, BASE_NONE,
@@ -5903,17 +5927,22 @@ proto_register_lldp(void)
 			NULL, 0x0, NULL, HFILL }
 		},
 		{ &hf_cisco_aci_portmode,
-			{ "Port Mode", "lldp.cisco.portmode", FT_BYTES, BASE_NONE,
-			NULL, 0x0, NULL, HFILL }
+			{ "Port Mode", "lldp.cisco.portmode", FT_UINT8, BASE_NONE,
+			VALS(cisco_portmode_vals), 0x0, NULL, HFILL }
 		},
-		{ &hf_cisco_aci_unknownd9,
-			{ "Unknown 0xD9", "lldp.cisco.unknownd9", FT_BYTES, BASE_NONE,
+		{ &hf_cisco_aci_authcookie,
+			{ "Authentication Cookie", "lldp.cisco.authcookie", FT_BYTES, BASE_NONE,
 			NULL, 0x0, NULL, HFILL }
 		},
 		{ &hf_cisco_aci_apicmode,
-			{ "APIC Mode", "lldp.cisco.apicmode", FT_UINT8, BASE_NONE,
+			{ "APIC Mode", "lldp.cisco.apicmode", FT_UINT8, BASE_DEC,
 			VALS(cisco_apicmode_vals), 0x0, NULL, HFILL }
 		},
+		{ &hf_cisco_aci_fabricid,
+			{ "Fabric ID", "lldp.cisco.fabricd", FT_UINT16, BASE_DEC,
+			NULL, 0x0, NULL, HFILL }
+		},
+	/* Hytec */
 		{ &hf_hytec_tlv_subtype,
 			{ "Hytec Subtype",	"lldp.hytec.tlv_subtype", FT_UINT8, BASE_DEC,
 			VALS(hytec_subtypes), 0x0, NULL, HFILL }
diff --git a/epan/etypes.h b/epan/etypes.h
index 05ba03ffc8..e386690ce4 100644
--- a/epan/etypes.h
+++ b/epan/etypes.h
@@ -602,14 +602,14 @@ extern "C" {
 #define ETHERTYPE_QINQ_OLD		0x9100	/* QinQ: old non-standard 802.1ad */
 #endif
 
-#ifndef ETHERTYPE_TECMP
-#define ETHERTYPE_TECMP			0x99FE	/* Technically Enhanced Capture Module Protocol (TECMP) */
-#endif
-
 #ifndef ETHERTYPE_EERO
 #define ETHERTYPE_EERO			0x9104	/* EERO: broadcast packets sent by EERO MESH AP's (not officially registered) */
 #endif
 
+#ifndef ETHERTYPE_TECMP
+#define ETHERTYPE_TECMP			0x99FE	/* Technically Enhanced Capture Module Protocol (TECMP) */
+#endif
+
 #ifndef ETHERTYPE_6LOWPAN
 #define ETHERTYPE_6LOWPAN		0xA0ED	/* RFC 4944: Transmission of IPv6 Packets over IEEE 802.15.4 Networks */
 #endif
@@ -618,8 +618,8 @@ extern "C" {
 #define ETHERTYPE_ECPRI			0xAEFE /* Ethernet type of eCPRI */
 #endif
 
-#ifndef ETHERTYPE_LLT
-#define ETHERTYPE_LLT			0xCAFE	/* Veritas Low Latency Transport (not officially registered) */
+#ifndef ETHERTYPE_CABLELABS
+#define ETHERTYPE_CABLELABS		0xB4E3 /* Ethernet type for CableLabs layer-3 protocol */
 #endif
 
 #ifndef ETHERTYPE_XIP
@@ -630,20 +630,24 @@ extern "C" {
 #define ETHERTYPE_NWP			0xC0DF	/* Neighborhood Watch Protocol (not officially registered) */
 #endif
 
-#ifndef ETHERTYPE_TDMOE
-#define ETHERTYPE_TDMOE			0xD00D	/* Digium TDMoE packets (not officially registered) */
+#ifndef ETHERTYPE_LLT
+#define ETHERTYPE_LLT			0xCAFE	/* Veritas Low Latency Transport (not officially registered) */
 #endif
 
-#ifndef ETHERTYPE_FCFT
-#define ETHERTYPE_FCFT			0xFCFC	/* used to transport FC frames+MDS hdr internal to Cisco's MDS switch */
+#ifndef ETHERTYPE_TDMOE
+#define ETHERTYPE_TDMOE			0xD00D	/* Digium TDMoE packets (not officially registered) */
 #endif
 
 #ifndef ETHERTYPE_AVSP
 #define ETHERTYPE_AVSP			0xD28B /* Ethernet type for Arista vendor specific packet frames */
 #endif
 
-#ifndef ETHERTYPE_CABLELABS
-#define ETHERTYPE_CABLELABS		0xB4E3 /* Ethernet type for CableLabs layer-3 protocol */
+#ifndef ETHERTYPE_FCFT
+#define ETHERTYPE_FCFT			0xFCFC	/* used to transport FC frames+MDS hdr internal to Cisco's MDS switch */
+#endif
+
+#ifndef ETHERTYPE_ACIGLEAN
+#define ETHERTYPE_ACIGLEAN		0xFFF2	/* Used to transport Cisco ACI internal frames for ARP gleaning (not registered) */
 #endif
 
 WS_DLL_PUBLIC const value_string etype_vals[];