from stephen f

new protocol: veritas low latency transport

---
Attached is a patch file that adds a new dissector for the LLT protocol
(Veritas Low Level Transport, used for server clustering).  They use
ethertype 0xCAFE even though it isn't assigned to them :(.  There are
other fields and possibly other message types directly between servers
it does not yet dissect as no one outside of Veritas knows what they
are.  This dissector understands the one people will run across most -
multiple servers broadcasting these heartbeats all over the place.  I
figured out these fields through many Internet searches.

I will add the protocol to the Wiki after it is committed.


Thanks,
  Steve




svn path=/trunk/; revision=18944

4 files changed, 171 insertions, 0 deletions

diff --git a/epan/dissectors/Makefile.common b/epan/dissectors/Makefile.common
index 0192d18d0e..ec6a2c5820 100644
--- a/epan/dissectors/Makefile.common
+++ b/epan/dissectors/Makefile.common
@@ -419,6 +419,7 @@ DISSECTOR_SRC =	\
 	packet-logotypecertextn.c	\
 	packet-llc.c	\
 	packet-lldp.c	\
+	packet-llt.c	\
 	packet-lmi.c	\
 	packet-lmp.c	\
 	packet-loop.c	\
diff --git a/epan/dissectors/packet-ethertype.c b/epan/dissectors/packet-ethertype.c
index b3e04a7674..c3196f42ef 100644
--- a/epan/dissectors/packet-ethertype.c
+++ b/epan/dissectors/packet-ethertype.c
@@ -123,6 +123,7 @@ const value_string etype_vals[] = {
     {PPP_LCP,			"PPP Link Control Protocol" },
     {PPP_PAP,			"PPP Password Authentication Protocol" },
     {PPP_CCP,			"PPP Compression Control Protocol" },
+    {ETHERTYPE_LLT,		"Veritas Low Latency Transport (not officially registered)"},
     {0,				NULL				} };
 
 static void add_dix_trailer(proto_tree *fh_tree, int trailer_id, tvbuff_t *tvb,
diff --git a/epan/dissectors/packet-llt.c b/epan/dissectors/packet-llt.c
new file mode 100644
index 0000000000..d4334d9f85
--- /dev/null
+++ b/epan/dissectors/packet-llt.c
@@ -0,0 +1,165 @@
+/* packet-llt.c
+ * Routines for Veritas Low Latency Transport (LLT) dissection
+ * Copyright 2006, Stephen Fisher <stephentfisher@yahoo.com>
+ *
+ * $Id$
+ *
+ * Wireshark - Network traffic analyzer
+ * By Gerald Combs <gerald@wireshark.org>
+ * Copyright 1998 Gerald Combs
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <glib.h>
+
+#include <epan/packet.h>
+#include <epan/prefs.h>
+#include <epan/etypes.h>
+
+static const value_string message_type_vs[] = {
+  { 0x0a, "heartbeat" },
+  { 0, NULL}
+};
+
+/* Forward declaration we need below */
+void proto_reg_handoff_llt(void);
+
+/* Variables for our preferences */
+static guint preference_alternate_ethertype = 0x0;
+
+/* Behind the scenes variable to keep track of the last preference setting */
+static guint preference_alternate_ethertype_last;
+
+/* Initialize the protocol and registered fields */
+static int proto_llt = -1;
+
+static int hf_llt_cluster_num = -1;
+static int hf_llt_node_id = -1;
+static int hf_llt_message_type = -1;
+static int hf_llt_sequence_num = -1;
+static int hf_llt_message_time = -1;
+
+/* Initialize the subtree pointers */
+static gint ett_llt = -1;
+
+dissector_handle_t llt_handle; /* Declaring this here allows us to use it for re-registration throughout the handoff function */
+
+/* Code to actually dissect the packets */
+static void
+dissect_llt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
+{
+	/* Set up structures needed to add the protocol subtree and manage it */
+	proto_item *ti=NULL;
+	proto_tree *llt_tree=NULL;
+	guint8 message_type;
+	
+	/* Make entries in Protocol column and Info column on summary display */
+	if(check_col(pinfo->cinfo, COL_PROTOCOL)) 
+		col_set_str(pinfo->cinfo, COL_PROTOCOL, "LLT");
+
+	message_type = tvb_get_guint8(tvb, 3);
+
+	if(check_col(pinfo->cinfo, COL_INFO)) {
+		col_clear(pinfo->cinfo, COL_INFO);
+		col_add_fstr(pinfo->cinfo, COL_INFO, "Message type: %s", match_strval(message_type, message_type_vs));
+	}
+
+	if (tree) {
+		ti = proto_tree_add_item(tree, proto_llt, tvb, 0, -1, FALSE);
+		llt_tree = proto_item_add_subtree(ti, ett_llt);
+	}
+
+	proto_tree_add_item(llt_tree, hf_llt_cluster_num, tvb, 2, 1, FALSE);
+	proto_tree_add_item(llt_tree, hf_llt_message_type, tvb, 3, 1, FALSE);
+	proto_tree_add_item(llt_tree, hf_llt_node_id, tvb, 7, 1, FALSE);
+	proto_tree_add_item(llt_tree, hf_llt_sequence_num, tvb, 24, 4, FALSE);
+	proto_tree_add_item(llt_tree, hf_llt_message_time, tvb, 40, 4, FALSE);
+	
+}
+
+/* Register the protocol with Wireshark */
+void
+proto_register_llt(void)
+{                 
+	module_t *llt_module;
+
+	static hf_register_info hf[] = {
+		
+		{ &hf_llt_cluster_num,  { "Cluster number", "llt.cluster_num",
+					  FT_UINT8, BASE_DEC, NULL, 0,
+					  "Cluster number that this node belongs to", HFILL } },
+		
+		{ &hf_llt_message_type, { "Message type", "llt.message_type",
+					  FT_UINT8, BASE_HEX, VALS(message_type_vs), 0,
+					  "Type of LLT message contained in this frame", HFILL } },
+		
+		{ &hf_llt_node_id,      { "Node ID", "llt.node_id",
+					  FT_UINT8, BASE_DEC, NULL, 0,
+					  "Number identifying this node within the cluster", HFILL } },
+		
+		{ &hf_llt_sequence_num, { "Sequence number", "llt.sequence_num",
+					  FT_UINT32, BASE_DEC, NULL, 0,
+					  "Sequence number of this frame", HFILL } },
+		
+		{ &hf_llt_message_time, { "Message time", "llt.message_time",
+					  FT_UINT32, BASE_DEC, NULL, 0,
+					  "Number of ticks since this node was last rebooted", HFILL } }
+	};
+	
+	/* Setup protocol subtree array */
+	static gint *ett[] = {
+		&ett_llt,
+	};
+
+	/* Register the protocol name and description */
+	proto_llt = proto_register_protocol("Veritas Low Latency Transport (LLT)", "LLT", "llt");
+
+	/* Required function calls to register the header fields and subtrees used */
+	proto_register_field_array(proto_llt, hf, array_length(hf));
+	proto_register_subtree_array(ett, array_length(ett));
+
+	/* Register preferences module */
+	llt_module = prefs_register_protocol(proto_llt, proto_reg_handoff_llt);
+
+	/* Register our preferences */
+	prefs_register_uint_preference(llt_module, "alternate_ethertype", "Alternate ethertype value",
+				       "Dissect this ethertype as LLT traffic in addition to the default, 0xCAFE.",
+				       16, &preference_alternate_ethertype); /* A base-16 (hexadecimal) value */
+
+}
+
+
+void
+proto_reg_handoff_llt(void)
+{
+	llt_handle = create_dissector_handle(dissect_llt, proto_llt);
+	dissector_add("ethertype", ETHERTYPE_LLT, llt_handle);
+
+	if((preference_alternate_ethertype != 0xCAFE) 
+	&& (preference_alternate_ethertype != 0x0)){
+		dissector_delete("ethertype", preference_alternate_ethertype_last, llt_handle);
+		preference_alternate_ethertype_last = preference_alternate_ethertype; /* Save the setting to see if it has changed later */
+		dissector_add("ethertype", preference_alternate_ethertype, llt_handle); /* Register the new ethertype setting */
+	}
+}
diff --git a/epan/etypes.h b/epan/etypes.h
index b2676fc0db..a65f3a5657 100644
--- a/epan/etypes.h
+++ b/epan/etypes.h
@@ -322,6 +322,10 @@
 #define ETHERTYPE_RTCFG		0x9022 	/* RTnet: Real-Time Configuration Protocol */
 #endif
 
+#ifndef ETHERTYPE_LLT
+#define ETHERTYPE_LLT           0xCAFE /* Veritas Low Latency Transport (not officially registered) */
+#endif
+
 #ifndef ETHERTYPE_FCFT
 /* type used to transport FC frames+MDS hdr internal to Cisco's MDS switch */
 #define ETHERTYPE_FCFT          0xFCFC