diff options
author | Joerg Mayer <jmayer@loplof.de> | 2018-02-22 07:59:52 +0100 |
---|---|---|
committer | Jörg Mayer <jmayer@loplof.de> | 2018-02-23 15:47:07 +0000 |
commit | a8ed879d7e9cae014d768ae10c7f407c3831ef10 (patch) | |
tree | f9dee4a750521d340c83b1dae1b5a787ea01d7cf /epan/dissectors | |
parent | 24ba73ccf0bd850ea7d423f7f07f150b7e43c676 (diff) |
Work around a duplicate dest mac that appears in *some* frames captured on a FEX
Change-Id: I6604c764d4b354653280891c8bf50a73954370b3
Reviewed-on: https://code.wireshark.org/review/25994
Reviewed-by: Jörg Mayer <jmayer@loplof.de>
Diffstat (limited to 'epan/dissectors')
-rw-r--r-- | epan/dissectors/packet-eth.c | 32 |
1 files changed, 25 insertions, 7 deletions
diff --git a/epan/dissectors/packet-eth.c b/epan/dissectors/packet-eth.c index 4616858ae9..fb1650fc5e 100644 --- a/epan/dissectors/packet-eth.c +++ b/epan/dissectors/packet-eth.c @@ -45,6 +45,8 @@ static gboolean eth_assume_fcs = FALSE; static gboolean eth_check_fcs = TRUE; /* Interpret packets as FW1 monitor file packets if they look as if they are */ static gboolean eth_interpret_as_fw1_monitor = FALSE; +/* When capturing on a Cisco FEX some frames start with an extra destination mac */ +static gboolean eth_deduplicate_dmac = FALSE; /* Preference settings defining conditions for which the CCSDS dissector is called */ static gboolean ccsds_heuristic_length = FALSE; static gboolean ccsds_heuristic_version = FALSE; @@ -751,12 +753,23 @@ dissect_eth(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data) { struct eth_phdr *eth = (struct eth_phdr *)data; proto_tree *fh_tree; + tvbuff_t *real_tvb; + + /* When capturing on a Cisco FEX, some frames (most likely all frames + captured without a vntag) have an extra destination mac prepended. */ + if (eth_deduplicate_dmac && tvb_captured_length(tvb) > 20 && + memcmp(tvb_get_ptr(tvb,0,6),tvb_get_ptr(tvb,6,6), 6) == 0) { + real_tvb = tvb_new_subset_length_caplen(tvb, 6, + tvb_captured_length(tvb) - 6, tvb_reported_length(tvb) - 6); + } else { + real_tvb = tvb; + } /* Some devices slice the packet and add their own trailer before putting the frame on the network. Make sure these packets get a proper trailer (even though the sliced frame might not properly dissect. */ - if ( (eth_trailer_length > 0) && (eth_trailer_length < tvb_captured_length(tvb)) ) { + if ( (eth_trailer_length > 0) && (eth_trailer_length < tvb_captured_length(real_tvb)) ) { tvbuff_t *next_tvb; guint total_trailer_length; @@ -767,25 +780,25 @@ dissect_eth(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data) total_trailer_length = eth_trailer_length + (eth_assume_fcs ? 4 : 0); /* Dissect the tvb up to, but not including the trailer */ - next_tvb = tvb_new_subset_length_caplen(tvb, 0, - tvb_captured_length(tvb) - total_trailer_length, - tvb_reported_length(tvb) - total_trailer_length); + next_tvb = tvb_new_subset_length_caplen(real_tvb, 0, + tvb_captured_length(real_tvb) - total_trailer_length, + tvb_reported_length(real_tvb) - total_trailer_length); fh_tree = dissect_eth_common(next_tvb, pinfo, tree, 0); /* Now handle the ethernet trailer and optional FCS */ - next_tvb = tvb_new_subset_remaining(tvb, tvb_captured_length(tvb) - total_trailer_length); + next_tvb = tvb_new_subset_remaining(real_tvb, tvb_captured_length(real_tvb) - total_trailer_length); /* * XXX - this overrides Wiretap saying "this packet definitely has * no FCS". */ - add_ethernet_trailer(pinfo, tree, fh_tree, hf_eth_trailer, tvb, next_tvb, + add_ethernet_trailer(pinfo, tree, fh_tree, hf_eth_trailer, real_tvb, next_tvb, eth_assume_fcs ? 4 : eth->fcs_len); } else { /* * XXX - this overrides Wiretap saying "this packet definitely has * no FCS". */ - dissect_eth_common(tvb, pinfo, tree, eth_assume_fcs ? 4 : eth->fcs_len); + dissect_eth_common(real_tvb, pinfo, tree, eth_assume_fcs ? 4 : eth->fcs_len); } return tvb_captured_length(tvb); } @@ -946,6 +959,11 @@ proto_register_eth(void) "Whether packets should be interpreted as coming from CheckPoint FireWall-1 monitor file if they look as if they do", ð_interpret_as_fw1_monitor); + prefs_register_bool_preference(eth_module, "deduplicate_dmac", + "Skip bytes 1-6 if identical to 7-12", + "When capturing on a Cisco FEX some frames start with an extra destination mac", + ð_deduplicate_dmac); + prefs_register_static_text_preference(eth_module, "ccsds_heuristic", "Dissect as CCSDS if", "These are the conditions to match a payload against in order to determine if this\n" |