aboutsummaryrefslogtreecommitdiffstats
path: root/packet-ip.c
AgeCommit message (Collapse)AuthorFilesLines
1999-11-21Added Heikki Vatiainen's <hessu@cs.tut.fi> VRRP dissector.Gilbert Ramirez1-1/+4
svn path=/trunk/; revision=1083
1999-11-17Typo fix, from Heikki Vatiainen.Guy Harris1-2/+2
svn path=/trunk/; revision=1045
1999-11-16Replace the ETT_ "enum" members, declared in "packet.h", withGuy Harris1-19/+55
dynamically-assigned "ett_" integer values, assigned by "proto_register_subtree_array()"; this: obviates the need to update "packet.h" whenever you add a new subtree type - you only have to add a call to "proto_register_subtree_array()" to a "register" routine and an array of pointers to "ett_", if they're not already there, and add a pointer to the new "ett_" variable to the array, if they are there; would allow run-time-loaded dissectors to allocate subtree types when they're loaded. svn path=/trunk/; revision=1043
1999-11-02Format the IP header length as an unsigned quantity.Guy Harris1-2/+2
svn path=/trunk/; revision=965
1999-11-02Make a bunch of the bitfields in the IP header filterable items.Guy Harris1-33/+68
svn path=/trunk/; revision=963
1999-10-30Don Lafontaine's IGRP/EIGRP dissector.Guy Harris1-16/+102
svn path=/trunk/; revision=949
1999-10-22Generalize the "ip_src" and "ip_dst" members of the "packet_info"Guy Harris1-12/+17
structure to "dl_src"/"dl_dst", "net_src"/"net_dst", and "src"/"dst" addresses, where an address is an address type, an address length in bytes, and a pointer to that many bytes. "dl_{src,dst}" are the link-layer source/destination; "net_{src,dst}" are the network-layer source/destination; "{src,dst}" are the source/destination from the highest of those two layers that we have in the packet. Add a port type to "packet_info" as well, specifying whether it's a TCP or UDP port. Don't set the address and port columns in the dissector functions; just set the address and port members of the "packet_info" structure. Set the columns in "fill_in_columns()"; this means that if we're showing COL_{DEF,RES,UNRES}_SRC" or "COL_{DEF,RES,UNRES}_DST", we only generate the string from "src" or "dst", we don't generate a string for the link-layer address and then overwrite it with a string for the network-layer address (generating those strings costs CPU). Add support for "conversations", where a "conversation" is (at present) a source and destination address and a source and destination port. (In the future, we may support "conversations" above the transport layer, e.g. a TFTP conversation, where the first packet goes from the client to the TFTP server port, but the reply comes back from a different port, and all subsequent packets go between the client address/port and the server address/new port, or an NFS conversation, which might include lock manager, status monitor, and mount packets, as well as NFS packets.) Currently, all we support is a call that takes the source and destination address/port pairs, looks them up in a hash table, and: if nothing is found, creates a new entry in the hash table, and assigns it a unique 32-bit conversation ID, and returns that conversation ID; if an entry is found, returns its conversation ID. Use that in the SMB and AFS code to keep track of individual SMB or AFS conversations. We need to match up requests and replies, as, for certain replies, the operation code for the request to which it's a reply doesn't show up in the reply - you have to find the request with a matching transaction ID. Transaction IDs are per-conversation, so the hash table for requests should include a conversation ID and transaction ID as the key. This allows SMB and AFS decoders to handle IPv4 or IPv6 addresses transparently (and should allow the SMB decoder to handle NetBIOS atop other protocols as well, if the source and destination address and port values in the "packet_info" structure are set appropriately). In the "Follow TCP Connection" code, check to make sure that the addresses are IPv4 addressses; ultimately, that code should be changed to use the conversation code instead, which will let it handle IPv6 transparently. svn path=/trunk/; revision=909
1999-10-22Check to make sure the header length is at least the minimum length forGuy Harris1-2/+11
an IP header. svn path=/trunk/; revision=906
1999-10-16- replace proto_tree_add_item_format by proto_tree_add_item.Laurent Deniel1-17/+9
- fix hf_ip_len type field (FT_UINT16). svn path=/trunk/; revision=866
1999-10-15IPComp (RFC2393) decoding.Jun-ichiro itojun Hagino1-2/+5
svn path=/trunk/; revision=838
1999-10-14add string IP protocol name into info field of fragmented packet.Jun-ichiro itojun Hagino1-3/+3
svn path=/trunk/; revision=833
1999-10-14implement ipprotostr() in ipproto.c, which basically does ipprotobynumber()Jun-ichiro itojun Hagino1-3/+5
for ip.ip_p and ip6.ip6_nxt (and other IPv6 header chain). use val_to_str() as much as possible in dissect_{ipv6,pim,ripng}(). make --disable-zlib a default for netbsd (temporary workaround). svn path=/trunk/; revision=827
1999-10-13Jun-ichiro itojun Hagino's code for PIM, and some fixes from him asGuy Harris1-2/+12
well. Add some more protocols to the list of value/string pairs for IP protocol types. svn path=/trunk/; revision=822
1999-10-12New proto_tree header_field_info stuff. Header_field_infos now containGilbert Ramirez1-23/+48
the base for numbers to be displayed in, bitmasks for bitfields, and blurbs (which are one or two sentences describing the field). proto_tree_add*() routines now automatically handle bitfields. You tell it which header field you are adding, and just pass it the value of the entire field, and the proto_tree routines will do the masking and shifting for you. This means that bitfields are more naturally filtered via dfilter now. Added Phil Techau's support for signed integers in dfilters/proto_tree. Added the beginning of the SNA dissector. It's not complete, but I'm committing it now because it has example after example of how to use bitfields with the new header_field_info struct and proto_tree routines. It was the impetus to change how header_field_info works. svn path=/trunk/; revision=815
1999-10-02Add ICMP display filters.Laurent Deniel1-9/+29
svn path=/trunk/; revision=751
1999-10-02Fix IGMP dfilter (some fields were registered and soLaurent Deniel1-11/+17
documented in man but the new dfilter functions were not used). svn path=/trunk/; revision=750
1999-09-23Dirk Bonne's fix to ICMP timestamp dissection.Guy Harris1-5/+3
svn path=/trunk/; revision=713
1999-09-14Daniel Ryde's patch to show the IP flags as 4 bits, rather than showingGuy Harris1-5/+5
the full octet containing the flags and the upper 4 bits of the fragment offset. svn path=/trunk/; revision=678
1999-08-31We now use "snprintf()" in "dissect_ip_tcp_options()", so we may need toGuy Harris1-1/+10
include "snprintf.h" to declare it. svn path=/trunk/; revision=621
1999-08-28For unknown options without "syntax" errors, show the length in bytes.Guy Harris1-8/+13
svn path=/trunk/; revision=605
1999-08-28Handle unknown options in "dissect_ip_tcp_options()" better; we assumeGuy Harris1-19/+35
that the only options that contain *no* length byte are the IP and TCP EOL and NOP options so that we can treat unknown options as VARIABLE_LENGTH with a minimum of 2, and at least be able to move on to the next option by using the length in the option, rather than just reporting the unknown option and processing no options after it. svn path=/trunk/; revision=604
1999-08-28PPP options in LCP, IPCP, etc. are like IP and TCP options - one octetGuy Harris1-35/+46
of option code, one octet of length (which includes the two option code and length bytes), followed by 0 or more octets of option data, with some options being fixed-length and some being variable-length. Put some stuff from the PPP control protocol option parsing code into the IP-and-TCP option parsing code, and use the latter instead of the former. (That code might also be usable for CDP as well, with some stuff added to it.) Shuffle the arguments to "dissect_ip_tcp_options()" to resemble those of various other dissectors (i.e., with the "proto_tree *" at the end). Add in code to dissect a pile of PPP options documented in various RFCs. svn path=/trunk/; revision=601
1999-08-28Changed ip.flags from FT_UINT16 to FT_UINT8, and made it highlight onlyGilbert Ramirez1-3/+3
one byte in the hexdump. svn path=/trunk/; revision=600
1999-08-28Set protocol column to "IP" for fragmented IP packets. It was not being set atGilbert Ramirez1-1/+3
the IP layer, leaving the lower layer's abbreviation in the protocol column. svn path=/trunk/; revision=599
1999-08-26Dissect unknown IP protocols with dissect_data().Gilbert Ramirez1-1/+4
svn path=/trunk/; revision=585
1999-08-21Richard J�rgensen <ric@tbit.dk> pointed out that ICMP and IGMP checksumsGerald Combs1-3/+3
were printed in the wrong byteorder. svn path=/trunk/; revision=539
1999-08-18Declare the "packet_info" structure "pi" in "packet.h", rather than in aGuy Harris1-7/+16
bunch of source files. Replace the "payload" field of a "packet_info" structure with "len" and "captured_len" fields, which contain the total packet length and total captured packet length (including all headers) at the current protocol layer (i.e., if a given layer has a length field, and that length field says its shorter than the length we got from the capture, reduce the "pi.len" and "pi.captured_len" values appropriately). Those fields can be used in the future if we add checks to make sure a field we're extracting from a packet doesn't go past the end of the packet, or past the captured part of the packet. Get rid of the additional payload argument to some dissection functions; use "pi.captured_len - offset" instead. Have the END_OF_FRAME macro use "pi.captured_len" rather than "fd->cap_len", so that "dissect the rest of the frame" becomes "dissect the rest of the packet", and doesn't dissect end-of-frame padding such as padding added to make an Ethernet frame 60 or more octets long. (We might want to rename it END_OF_PACKET; if we ever want to label the end-of-frame padding for the benefit of people curious what that extra gunk is, we could have a separate END_OF_FRAME macro that uses "fd->cap_len".) svn path=/trunk/; revision=506
1999-08-17Converted more of the IP fields to filterable fields.Gilbert Ramirez1-11/+32
svn path=/trunk/; revision=505
1999-08-14Add ICMP to the set of packet types counted in the window shown while aGuy Harris1-1/+4
capture is in progress. svn path=/trunk/; revision=491
1999-08-10Fix the list of descriptions of codes in ICMP Unreachable messages.Guy Harris1-2/+6
svn path=/trunk/; revision=458
1999-08-09Added John McDermott's patch for handling ICMP Unreachable|FragmentationGilbert Ramirez1-1/+30
Required packets. svn path=/trunk/; revision=455
1999-08-05Fix a "proto_tree_add_text()" call that should've been aGuy Harris1-2/+2
"proto_tree_add_item()" call (and fix the length passed to it, which, it appears, has been wrong for ages). svn path=/trunk/; revision=439
1999-07-31Remove srcip and destip from packet_info since it is not safe to affectLaurent Deniel1-3/+2
string pointer from the result of ip_to_str (statically allocated string). Use the ip_src and the new field ip_dst in follow.c to build a correct string display filter. svn path=/trunk/; revision=408
1999-07-29Made the protocol (but not the fields) use the new proto_tree routine,Gilbert Ramirez1-20/+28
allowing users to filter on the existence of these protocols. I also added packet-clip.c to the Nmake makefile. svn path=/trunk/; revision=402
1999-07-17Added just enough fields to TCP to support "Follow TCP Stream". It works now.Gilbert Ramirez1-4/+41
Added the protocol IDs for ipx and IGMP, but not their fields. svn path=/trunk/; revision=365
1999-07-15Modified the proto_register_field_array usage again. Thanks to Guy'sGilbert Ramirez1-11/+31
suggestion, this new method using a static array should use less memory and be faster. It also has a nice side-effect of making the source-code more readble, IMHO. Changed the print routines to look for protocol proto_data instead of looking at the text label as they did before, hoping that the data hex dump field item starts with "Data (". Added the -G keyword to ethereal to make it dump a glossary of display filter keywords to stdout and exit. This data is then formatted with the doc/dfilter2pod perl program to pod format, which is combined with doc/ethereal.pod.template to create doc/ethereal.pod, from which the ethereal manpage is created. This way we can keep the manpage up-to-date with a list of fields that can be filtered on. svn path=/trunk/; revision=364
1999-07-08Added Johan's RADIUS dissector, finally. I modified it to fit in with theGilbert Ramirez1-46/+13
new proto_tree routines. I also removed the check for lex and yacc from wiretap's configure script. The IP dissector now uses proto_register_field_array(). svn path=/trunk/; revision=348
1999-07-07Created a new protocol tree implementation and a new display filterGilbert Ramirez1-115/+176
mechanism that is built into ethereal. Wiretap is now used to read all file formats. Libpcap is used only for capturing. svn path=/trunk/; revision=342
1999-06-21Added "0x" to a couple of proto_tree_add_item printf-style labels thatGilbert Ramirez1-3/+3
were printing values in hex. The lack of "0x" in fron of the hex numbers made me think the values were decimal, causing me to waste a bit of time during debugging. svn path=/trunk/; revision=323
1999-06-11Added RSVP protocol dissector.Gilbert Ramirez1-1/+4
svn path=/trunk/; revision=304
1999-06-11Added PPPoE, PPTP, GRE, and ISAKMP dissectors.Gilbert Ramirez1-1/+8
svn path=/trunk/; revision=303
1999-05-20Dissect ICMP Router Discovery packets (router advertisements and routerGuy Harris1-2/+37
solicitations). svn path=/trunk/; revision=295
1999-05-12Minor performance improvement and TCP option decoding fixed (when no tree).Laurent Deniel1-26/+27
svn path=/trunk/; revision=283
1999-04-05FTP, POP, and Telnet support from Richard Sharpe.Guy Harris1-1/+2
svn path=/trunk/; revision=237
1999-03-30Bugfix: The IP Precedence (first three bits in the TOS field) has been clearedhannes1-3/+2
by accident -> It should be displayed correctly with this fix svn path=/trunk/; revision=234
1999-03-28Jun-ichiro's IPv6 patch is merged in with ethereal and now uses the newGilbert Ramirez1-2/+29
proto*() functions. The configure script tries to use ipv6 name resolution if it knows the type of ipv6 stack the user has (this can be avoided with the --disable-ipv6 switch) Additionally, the configure script now deals with wiretap better. If the user doesn't want to compile wiretap, the wiretap is never visited. A few unnecessary #includes were removed from some wiretap files, and a CPP macro was moved from bpf.c to wtap.h. svn path=/trunk/; revision=229
1999-03-23Removed all references to gtk objects from packet*.[ch] files. They nowGilbert Ramirez1-108/+256
reference the protocol tree with struct proto_tree and struct proto_item objects. That way, the packet decoding source code file can be used with non-gtk packet decoders, like a curses-based ethereal, e.g. I also re-arranged some of the information in packet.h to more appropriate places (like other packet-*.[ch] files). svn path=/trunk/; revision=223
1999-03-09Decode more stuff in an ICMP packet.Guy Harris1-1/+67
svn path=/trunk/; revision=213
1999-03-09Make the arrays of pointers to strings for ICMP decoding static, asGuy Harris1-24/+38
they're not used outside this file. Compute their sizes with the standard "number of elements in an array" C idiom, rather than hardcoding them as numbers. Add the "information request" and "information reply" ICMP packet types. svn path=/trunk/; revision=212
1999-02-09When doing a capture, decode enough of the incoming packets to correctlyGuy Harris1-1/+18
update the packet counts and percentages in the dialog box popped up during a capture, even for non-Ethernet captures. svn path=/trunk/; revision=184
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-02 20:45:29 +0000