diff options
| author | Guy Harris <guy@alum.mit.edu> | 2019-05-08 18:41:26 -0700 |
|---|---|---|
| committer | Guy Harris <guy@alum.mit.edu> | 2019-05-09 04:27:52 +0000 |
| commit | 2e3dcd479ebfea160b979882423f4fd04150aec7 (patch) | |
| tree | 01a35ce90cc8147806f3dba7f514bbd5fdcf0ad0 /epan/dissectors/packet-llc.c | |
| parent | 9f8ac4d422ba8262ef52b203f08aa779e54fb9ca (diff) | |
Fix dissection of gatewayed/bridged LLAP packets.
EtherTalk and TokenTalk frames use LLC/SNAP headers with an OUI of
08:00:07 and a PID of 0x809B.
Frames with an Ethertype of 0x809B - either as the Ethertype field of an
Ethernet frame or as the PID, in combination of an OUI of 00:00:00, of
an LLC/SNAP frame - have an LLAP frame, complete with an LLAP header, as
the payload.
Don't treat 08:00:07 as a special case - register it as an OUI and give
it a dissector table, and register the DDP dissector in that dissector
table with ETHERTYPE_ATALK. Register the LLAP dissector in the
"ethertype" table with the Ethertype ETHERTYPE_ATALK.
This means we now have two separate LLC+SNAP PID tables for Apple; name
them appropriately.
That also means we need to add packet-atalk.c to the list of files
allowed to add "llc." named fields.
Change-Id: I00bafd692f83f73bd347628cb9e950863c26a2b7
Reviewed-on: https://code.wireshark.org/review/33125
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Diffstat (limited to 'epan/dissectors/packet-llc.c')
| -rw-r--r-- | epan/dissectors/packet-llc.c | 16 |
1 files changed, 0 insertions, 16 deletions
diff --git a/epan/dissectors/packet-llc.c b/epan/dissectors/packet-llc.c index 3088d8a3a3..aff42f2d59 100644 --- a/epan/dissectors/packet-llc.c +++ b/epan/dissectors/packet-llc.c @@ -253,14 +253,6 @@ capture_snap(const guchar *pd, int offset, int len, capture_packet_info_t *cpinf case OUI_ENCAP_ETHER: case OUI_CISCO_90: - case OUI_APPLE_ATALK: - /* No, I have no idea why Apple used - one of their own OUIs, rather than - OUI_ENCAP_ETHER, and an Ethernet - packet type as protocol ID, for - AppleTalk data packets - but used - OUI_ENCAP_ETHER and an Ethernet - packet type for AARP packets. */ return try_capture_dissector("ethertype", etype, pd, offset+5, len, cpinfo, pseudo_header); case OUI_CISCO: @@ -538,14 +530,6 @@ dissect_snap(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, case OUI_ENCAP_ETHER: case OUI_CISCO_90: - case OUI_APPLE_ATALK: - /* No, I have no idea why Apple used - one of their own OUIs, rather than - OUI_ENCAP_ETHER, and an Ethernet - packet type as protocol ID, for - AppleTalk data packets - but used - OUI_ENCAP_ETHER and an Ethernet - packet type for AARP packets. */ if (XDLC_IS_INFORMATION(control)) { if (tree) { proto_tree_add_uint(snap_tree, hf_type, |