1998-09-16 02:39:15 +00:00
/* packet-arp.c
2004-06-17 20:04:53 +00:00
* Routines for ARP packet disassembly ( RFC 826 )
1998-09-16 02:39:15 +00:00
*
2006-05-21 04:49:01 +00:00
* Wireshark - Network traffic analyzer
* By Gerald Combs < gerald @ wireshark . org >
1998-09-16 02:39:15 +00:00
* Copyright 1998 Gerald Combs
2002-08-28 21:04:11 +00:00
*
2013-09-12 12:37:27 +00:00
* By Deepti Ragha < dlragha @ ncsu . edu >
2012-05-29 08:00:35 +00:00
* Copyright 2012 Deepti Ragha
*
1998-09-16 02:39:15 +00:00
* This program is free software ; you can redistribute it and / or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation ; either version 2
* of the License , or ( at your option ) any later version .
2002-08-28 21:04:11 +00:00
*
1998-09-16 02:39:15 +00:00
* This program is distributed in the hope that it will be useful ,
* but WITHOUT ANY WARRANTY ; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
* GNU General Public License for more details .
2002-08-28 21:04:11 +00:00
*
1998-09-16 02:39:15 +00:00
* You should have received a copy of the GNU General Public License
* along with this program ; if not , write to the Free Software
2006-10-29 19:14:31 +00:00
* Foundation , Inc . , 51 Franklin Street , Fifth Floor , Boston , MA 02110 - 1301 , USA .
1998-09-16 02:39:15 +00:00
*/
2012-09-20 02:03:38 +00:00
# include "config.h"
1998-09-16 02:39:15 +00:00
2002-01-21 07:37:49 +00:00
# include <epan/packet.h>
2015-12-13 21:54:16 +00:00
# include <epan/capture_dissectors.h>
2004-12-26 22:26:02 +00:00
# include <epan/arptypes.h>
2004-08-06 19:57:49 +00:00
# include <epan/addr_resolv.h>
1999-11-27 04:48:14 +00:00
# include "packet-arp.h"
2005-09-17 00:02:31 +00:00
# include <epan/etypes.h>
# include <epan/arcnet_pids.h>
2012-08-03 01:58:12 +00:00
# include <epan/ax25_pids.h>
2017-03-30 22:00:06 +00:00
# include <epan/osi-utils.h>
2006-10-20 14:20:22 +00:00
# include <epan/prefs.h>
# include <epan/expert.h>
2016-01-25 01:10:20 +00:00
# include <epan/proto_data.h>
1998-09-16 02:39:15 +00:00
2013-03-13 21:14:20 +00:00
void proto_register_arp ( void ) ;
void proto_reg_handoff_arp ( void ) ;
1999-07-29 05:47:07 +00:00
static int proto_arp = - 1 ;
1999-10-03 17:12:15 +00:00
static int hf_arp_hard_type = - 1 ;
static int hf_arp_proto_type = - 1 ;
static int hf_arp_hard_size = - 1 ;
2000-11-30 10:42:50 +00:00
static int hf_atmarp_sht = - 1 ;
static int hf_atmarp_shl = - 1 ;
static int hf_atmarp_sst = - 1 ;
1999-11-27 04:01:43 +00:00
static int hf_atmarp_ssl = - 1 ;
1999-10-03 17:12:15 +00:00
static int hf_arp_proto_size = - 1 ;
static int hf_arp_opcode = - 1 ;
2009-05-21 05:15:03 +00:00
static int hf_arp_isgratuitous = - 1 ;
1999-11-27 04:01:43 +00:00
static int hf_atmarp_spln = - 1 ;
2000-11-30 10:42:50 +00:00
static int hf_atmarp_tht = - 1 ;
static int hf_atmarp_thl = - 1 ;
static int hf_atmarp_tst = - 1 ;
1999-11-27 04:01:43 +00:00
static int hf_atmarp_tsl = - 1 ;
static int hf_atmarp_tpln = - 1 ;
2002-02-10 22:41:48 +00:00
static int hf_arp_src_hw = - 1 ;
static int hf_arp_src_hw_mac = - 1 ;
1999-10-03 17:12:15 +00:00
static int hf_arp_src_proto = - 1 ;
2002-02-10 22:41:48 +00:00
static int hf_arp_src_proto_ipv4 = - 1 ;
static int hf_arp_dst_hw = - 1 ;
static int hf_arp_dst_hw_mac = - 1 ;
1999-10-03 17:12:15 +00:00
static int hf_arp_dst_proto = - 1 ;
2002-02-10 22:41:48 +00:00
static int hf_arp_dst_proto_ipv4 = - 1 ;
2012-05-29 08:00:35 +00:00
static int hf_drarp_error_status = - 1 ;
2007-12-19 10:49:22 +00:00
static int hf_arp_duplicate_ip_address_earlier_frame = - 1 ;
static int hf_arp_duplicate_ip_address_seconds_since_earlier_frame = - 1 ;
1999-11-27 04:48:14 +00:00
static int hf_atmarp_src_atm_num_e164 = - 1 ;
static int hf_atmarp_src_atm_num_nsap = - 1 ;
1999-11-27 04:01:43 +00:00
static int hf_atmarp_src_atm_subaddr = - 1 ;
1999-11-27 04:48:14 +00:00
static int hf_atmarp_dst_atm_num_e164 = - 1 ;
static int hf_atmarp_dst_atm_num_nsap = - 1 ;
1999-11-27 04:01:43 +00:00
static int hf_atmarp_dst_atm_subaddr = - 1 ;
2014-10-18 13:26:52 +00:00
/* Generated from convert_proto_tree_add_text.pl */
static int hf_atmarp_src_atm_data_country_code = - 1 ;
static int hf_atmarp_src_atm_data_country_code_group = - 1 ;
static int hf_atmarp_src_atm_e_164_isdn = - 1 ;
static int hf_atmarp_src_atm_e_164_isdn_group = - 1 ;
static int hf_atmarp_src_atm_rest_of_address = - 1 ;
static int hf_atmarp_src_atm_end_system_identifier = - 1 ;
static int hf_atmarp_src_atm_high_order_dsp = - 1 ;
static int hf_atmarp_src_atm_selector = - 1 ;
static int hf_atmarp_src_atm_international_code_designator = - 1 ;
static int hf_atmarp_src_atm_international_code_designator_group = - 1 ;
static int hf_atmarp_src_atm_afi = - 1 ;
1999-07-29 05:47:07 +00:00
2012-08-02 17:48:18 +00:00
static int hf_arp_dst_hw_ax25 = - 1 ;
static int hf_arp_src_hw_ax25 = - 1 ;
1999-11-16 11:44:20 +00:00
static gint ett_arp = - 1 ;
1999-11-27 04:48:14 +00:00
static gint ett_atmarp_nsap = - 1 ;
2000-11-30 10:42:50 +00:00
static gint ett_atmarp_tl = - 1 ;
2007-12-19 10:49:22 +00:00
static gint ett_arp_duplicate_address = - 1 ;
1999-11-16 11:44:20 +00:00
2013-05-24 18:02:54 +00:00
static expert_field ei_seq_arp_dup_ip = EI_INIT ;
static expert_field ei_seq_arp_storm = EI_INIT ;
2014-10-18 13:26:52 +00:00
static expert_field ei_atmarp_src_atm_unknown_afi = EI_INIT ;
2013-05-24 18:02:54 +00:00
2013-08-05 18:09:43 +00:00
static dissector_handle_t arp_handle ;
2001-11-26 05:13:14 +00:00
2013-08-05 18:09:43 +00:00
static dissector_handle_t atmarp_handle ;
2012-08-02 17:48:18 +00:00
static dissector_handle_t ax25arp_handle ;
2006-10-20 14:20:22 +00:00
2016-10-26 16:07:47 +00:00
static capture_dissector_handle_t arp_cap_handle ;
2006-10-20 14:20:22 +00:00
/* Used for determining if frequency of ARP requests constitute a storm */
# define STORM 1
# define NO_STORM 2
/* Preference settings */
static gboolean global_arp_detect_request_storm = FALSE ;
static guint32 global_arp_detect_request_storm_packets = 30 ;
static guint32 global_arp_detect_request_storm_period = 100 ;
2007-12-19 10:49:22 +00:00
static gboolean global_arp_detect_duplicate_ip_addresses = TRUE ;
2016-01-18 15:00:29 +00:00
static gboolean global_arp_register_network_address_binding = TRUE ;
2007-12-19 10:49:22 +00:00
2006-10-20 14:20:22 +00:00
static guint32 arp_request_count = 0 ;
static nstime_t time_at_start_of_count ;
2007-12-19 10:49:22 +00:00
/* Map of (IP address -> MAC address) to detect duplicate IP addresses
Key is unsigned32 */
2017-02-02 04:13:42 +00:00
static wmem_map_t * address_hash_table = NULL ;
2007-12-19 10:49:22 +00:00
2012-02-08 11:48:02 +00:00
typedef struct address_hash_value {
2009-03-29 22:16:26 +00:00
guint8 mac [ 6 ] ;
guint frame_num ;
time_t time_of_entry ;
2012-02-08 11:48:02 +00:00
} address_hash_value ;
/* Map of ((frame Num, IP address) -> MAC address) */
2017-02-02 04:13:42 +00:00
static wmem_map_t * duplicate_result_hash_table = NULL ;
2012-02-08 11:48:02 +00:00
typedef struct duplicate_result_key {
2012-04-23 17:50:02 +00:00
guint32 frame_number ;
guint32 ip_address ;
2012-02-08 11:48:02 +00:00
} duplicate_result_key ;
2007-12-19 10:49:22 +00:00
1998-11-03 07:45:10 +00:00
/* Definitions taken from Linux "linux/if_arp.h" header file, and from
2009-03-29 22:16:26 +00:00
http : //www.iana.org/assignments/arp-parameters
1998-11-03 07:45:10 +00:00
2009-03-29 22:16:26 +00:00
*/
1998-11-03 07:45:10 +00:00
2012-05-29 08:00:35 +00:00
1999-03-23 03:14:46 +00:00
/* ARP / RARP structs and definitions */
# ifndef ARPOP_REQUEST
# define ARPOP_REQUEST 1 /* ARP request. */
# endif
# ifndef ARPOP_REPLY
# define ARPOP_REPLY 2 /* ARP reply. */
# endif
/* Some OSes have different names, or don't define these at all */
# ifndef ARPOP_RREQUEST
# define ARPOP_RREQUEST 3 /* RARP request. */
# endif
# ifndef ARPOP_RREPLY
# define ARPOP_RREPLY 4 /* RARP reply. */
# endif
2012-05-29 08:00:35 +00:00
/*Additional parameters as per http://www.iana.org/assignments/arp-parameters*/
# ifndef ARPOP_DRARPREQUEST
# define ARPOP_DRARPREQUEST 5 /* DRARP request. */
# endif
# ifndef ARPOP_DRARPREPLY
# define ARPOP_DRARPREPLY 6 /* DRARP reply. */
# endif
# ifndef ARPOP_DRARPERROR
# define ARPOP_DRARPERROR 7 /* DRARP error. */
# endif
1999-11-27 04:01:43 +00:00
# ifndef ARPOP_IREQUEST
# define ARPOP_IREQUEST 8 /* Inverse ARP (RFC 1293) request. */
# endif
# ifndef ARPOP_IREPLY
# define ARPOP_IREPLY 9 /* Inverse ARP reply. */
# endif
# ifndef ATMARPOP_NAK
# define ATMARPOP_NAK 10 /* ATMARP NAK. */
# endif
2012-05-29 08:00:35 +00:00
/*Additional parameters as per http://www.iana.org/assignments/arp-parameters*/
# ifndef ARPOP_MARS_REQUEST
# define ARPOP_MARS_REQUEST 11 /*MARS request message. */
# endif
# ifndef ARPOP_MARS_MULTI
# define ARPOP_MARS_MULTI 12 /*MARS-Multi message. */
# endif
# ifndef ARPOP_MARS_MSERV
# define ARPOP_MARS_MSERV 13 /*MARS-Mserv message. */
# endif
# ifndef ARPOP_MARS_JOIN
# define ARPOP_MARS_JOIN 14 /*MARS-Join request. */
# endif
# ifndef ARPOP_MARS_LEAVE
# define ARPOP_MARS_LEAVE 15 /*MARS Leave request. */
# endif
# ifndef ARPOP_MARS_NAK
# define ARPOP_MARS_NAK 16 /*MARS nak message.*/
# endif
# ifndef ARPOP_MARS_UNSERV
# define ARPOP_MARS_UNSERV 17 /*MARS Unserv message. */
# endif
# ifndef ARPOP_MARS_SJOIN
# define ARPOP_MARS_SJOIN 18 /*MARS Sjoin message. */
# endif
# ifndef ARPOP_MARS_SLEAVE
# define ARPOP_MARS_SLEAVE 19 /*MARS Sleave message. */
# endif
# ifndef ARPOP_MARS_GROUPLIST_REQUEST
# define ARPOP_MARS_GROUPLIST_REQUEST 20 /*MARS Grouplist request message. */
# endif
# ifndef ARPOP_MARS_GROUPLIST_REPLY
# define ARPOP_MARS_GROUPLIST_REPLY 21 /*MARS Grouplist reply message. */
# endif
# ifndef ARPOP_MARS_REDIRECT_MAP
# define ARPOP_MARS_REDIRECT_MAP 22 /*MARS Grouplist request message. */
# endif
# ifndef ARPOP_MAPOS_UNARP
2013-10-13 18:14:59 +00:00
# define ARPOP_MAPOS_UNARP 23 /*MAPOS UNARP*/
2012-05-29 08:00:35 +00:00
# endif
2010-07-18 16:01:11 +00:00
# ifndef ARPOP_EXP1
# define ARPOP_EXP1 24 /* Experimental 1 */
# endif
# ifndef ARPOP_EXP2
# define ARPOP_EXP2 25 /* Experimental 2 */
# endif
1999-03-23 03:14:46 +00:00
2013-10-13 18:14:59 +00:00
# ifndef ARPOP_RESERVED1
# define ARPOP_RESERVED1 0 /*Reserved opcode 1*/
2012-05-29 08:00:35 +00:00
# endif
2013-10-13 18:14:59 +00:00
# ifndef ARPOP_RESERVED2
2012-05-29 08:00:35 +00:00
# define ARPOP_RESERVED2 65535 /*Reserved opcode 2*/
# endif
# ifndef DRARPERR_RESTRICTED
2013-10-13 18:14:59 +00:00
# define DRARPERR_RESTRICTED 1
2012-05-29 08:00:35 +00:00
# endif
# ifndef DRARPERR_NOADDRESSES
# define DRARPERR_NOADDRESSES 2
# endif
# ifndef DRARPERR_SERVERDOWN
# define DRARPERR_SERVERDOWN 3
# endif
# ifndef DRARPERR_MOVED
# define DRARPERR_MOVED 4
# endif
# ifndef DRARPERR_FAILURE
# define DRARPERR_FAILURE 5
# endif
1999-11-04 08:15:38 +00:00
static const value_string op_vals [ ] = {
2013-10-13 18:14:59 +00:00
{ ARPOP_REQUEST , " request " } ,
{ ARPOP_REPLY , " reply " } ,
{ ARPOP_RREQUEST , " reverse request " } ,
{ ARPOP_RREPLY , " reverse reply " } ,
{ ARPOP_DRARPREQUEST , " drarp request " } ,
{ ARPOP_DRARPREPLY , " drarp reply " } ,
{ ARPOP_DRARPERROR , " drarp error " } ,
{ ARPOP_IREQUEST , " inverse request " } ,
{ ARPOP_IREPLY , " inverse reply " } ,
{ ATMARPOP_NAK , " arp nak " } ,
{ ARPOP_MARS_REQUEST , " mars request " } ,
{ ARPOP_MARS_MULTI , " mars multi " } ,
{ ARPOP_MARS_MSERV , " mars mserv " } ,
{ ARPOP_MARS_JOIN , " mars join " } ,
{ ARPOP_MARS_LEAVE , " mars leave " } ,
{ ARPOP_MARS_NAK , " mars nak " } ,
{ ARPOP_MARS_UNSERV , " mars unserv " } ,
{ ARPOP_MARS_SJOIN , " mars sjoin " } ,
{ ARPOP_MARS_SLEAVE , " mars sleave " } ,
{ ARPOP_MARS_GROUPLIST_REQUEST , " mars grouplist request " } ,
{ ARPOP_MARS_GROUPLIST_REPLY , " mars gruoplist reply " } ,
{ ARPOP_MARS_REDIRECT_MAP , " mars redirect map " } ,
{ ARPOP_MAPOS_UNARP , " mapos unarp " } ,
{ ARPOP_EXP1 , " experimental 1 " } ,
{ ARPOP_EXP2 , " experimental 2 " } ,
{ ARPOP_RESERVED1 , " reserved " } ,
{ ARPOP_RESERVED2 , " reserved " } ,
2012-05-29 08:00:35 +00:00
{ 0 , NULL } } ;
static const value_string drarp_status [ ] = {
2013-10-13 18:14:59 +00:00
{ DRARPERR_RESTRICTED , " restricted " } ,
{ DRARPERR_NOADDRESSES , " no address " } ,
{ DRARPERR_SERVERDOWN , " serverdown " } ,
{ DRARPERR_MOVED , " moved " } ,
{ DRARPERR_FAILURE , " failure " } ,
2012-05-29 08:00:35 +00:00
{ 0 , NULL } } ;
1999-11-27 04:01:43 +00:00
static const value_string atmop_vals [ ] = {
2013-10-13 18:14:59 +00:00
{ ARPOP_REQUEST , " request " } ,
{ ARPOP_REPLY , " reply " } ,
{ ARPOP_IREQUEST , " inverse request " } ,
{ ARPOP_IREPLY , " inverse reply " } ,
{ ATMARPOP_NAK , " nak " } ,
{ ARPOP_MARS_REQUEST , " mars request " } ,
{ ARPOP_MARS_MULTI , " mars multi " } ,
{ ARPOP_MARS_MSERV , " mars mserv " } ,
{ ARPOP_MARS_JOIN , " mars join " } ,
{ ARPOP_MARS_LEAVE , " mars leave " } ,
{ ARPOP_MARS_NAK , " mars nak " } ,
{ ARPOP_MARS_UNSERV , " mars unserv " } ,
{ ARPOP_MARS_SJOIN , " mars sjoin " } ,
{ ARPOP_MARS_SLEAVE , " mars sleave " } ,
{ ARPOP_MARS_GROUPLIST_REQUEST , " mars grouplist request " } ,
{ ARPOP_MARS_GROUPLIST_REPLY , " mars gruoplist reply " } ,
{ ARPOP_MARS_REDIRECT_MAP , " mars redirect map " } ,
{ ARPOP_MAPOS_UNARP , " mapos unarp " } ,
{ ARPOP_EXP1 , " experimental 1 " } ,
{ ARPOP_EXP2 , " experimental 2 " } ,
{ ARPOP_RESERVED1 , " reserved " } ,
{ ARPOP_RESERVED2 , " reserved " } ,
2012-05-29 08:00:35 +00:00
{ 0 , NULL } } ;
1999-11-04 08:15:38 +00:00
2012-04-23 17:50:02 +00:00
# define ATMARP_IS_E164 0x40 /* bit in type/length for E.164 format */
# define ATMARP_LEN_MASK 0x3F /* length of {sub}address in type/length */
1999-11-27 04:01:43 +00:00
2002-02-10 22:41:48 +00:00
/*
* Given the hardware address type and length , check whether an address
* is an Ethernet address - the address must be of type " Ethernet " or
* " IEEE 802.x " , and the length must be 6 bytes .
*/
2009-03-29 22:16:26 +00:00
# define ARP_HW_IS_ETHER(ar_hrd, ar_hln) \
( ( ( ar_hrd ) = = ARPHRD_ETHER | | ( ar_hrd ) = = ARPHRD_IEEE802 ) \
& & ( ar_hln ) = = 6 )
2002-02-10 22:41:48 +00:00
2012-08-02 17:48:18 +00:00
/*
* Given the hardware address type and length , check whether an address
* is an AX .25 address - the address must be of type " AX.25 " and the
* length must be 7 bytes .
*/
# define ARP_HW_IS_AX25(ar_hrd, ar_hln) \
( ( ar_hrd ) = = ARPHRD_AX25 & & ( ar_hln ) = = 7 )
2002-02-10 22:41:48 +00:00
/*
* Given the protocol address type and length , check whether an address
* is an IPv4 address - the address must be of type " IP " , and the length
* must be 4 bytes .
*/
2009-03-29 22:16:26 +00:00
# define ARP_PRO_IS_IPv4(ar_pro, ar_pln) \
2012-08-02 17:48:18 +00:00
( ( ( ar_pro ) = = ETHERTYPE_IP | | ( ar_pro ) = = AX25_P_IP ) & & ( ar_pln ) = = 4 )
2002-02-10 22:41:48 +00:00
2005-07-27 07:57:01 +00:00
const gchar *
2011-02-11 03:33:11 +00:00
tvb_arphrdaddr_to_str ( tvbuff_t * tvb , gint offset , int ad_len , guint16 type )
1999-11-27 04:01:43 +00:00
{
if ( ad_len = = 0 )
return " <No address> " ;
2002-02-10 22:41:48 +00:00
if ( ARP_HW_IS_ETHER ( type , ad_len ) ) {
/* Ethernet address (or IEEE 802.x address, which is the same type of
address ) . */
2011-02-11 03:33:11 +00:00
return tvb_ether_to_str ( tvb , offset ) ;
1998-11-03 07:45:10 +00:00
}
2015-01-07 15:11:22 +00:00
return tvb_bytes_to_str ( wmem_packet_scope ( ) , tvb , offset , ad_len ) ;
1998-11-03 07:45:10 +00:00
}
2005-07-27 07:57:01 +00:00
static const gchar *
2001-03-13 21:34:28 +00:00
arpproaddr_to_str ( const guint8 * ad , int ad_len , guint16 type )
1999-11-27 04:01:43 +00:00
{
2014-12-21 13:02:26 +00:00
address addr ;
1999-11-27 04:01:43 +00:00
if ( ad_len = = 0 )
return " <No address> " ;
2002-02-10 22:41:48 +00:00
if ( ARP_PRO_IS_IPv4 ( type , ad_len ) ) {
1999-11-27 04:01:43 +00:00
/* IPv4 address. */
2015-10-21 19:04:16 +00:00
set_address ( & addr , AT_IPv4 , 4 , ad ) ;
2014-12-21 13:02:26 +00:00
return address_to_str ( wmem_packet_scope ( ) , & addr ) ;
1998-11-03 07:45:10 +00:00
}
2012-08-02 17:48:18 +00:00
if ( ARP_HW_IS_AX25 ( type , ad_len ) ) {
2014-12-19 23:13:17 +00:00
{
2012-08-02 17:48:18 +00:00
/* AX.25 address */
2015-10-21 19:04:16 +00:00
set_address ( & addr , AT_AX25 , AX25_ADDR_LEN , ad ) ;
2014-12-19 23:13:17 +00:00
return address_to_str ( wmem_packet_scope ( ) , & addr ) ;
}
2012-08-02 17:48:18 +00:00
}
2015-01-07 23:13:23 +00:00
return bytes_to_str ( wmem_packet_scope ( ) , ad , ad_len ) ;
1998-11-03 07:45:10 +00:00
}
2015-03-01 15:11:17 +00:00
static const gchar *
tvb_arpproaddr_to_str ( tvbuff_t * tvb , gint offset , int ad_len , guint16 type )
{
return arpproaddr_to_str ( tvb_get_ptr ( tvb , offset , ad_len ) , ad_len , type ) ;
}
2012-04-23 17:50:02 +00:00
# define MAX_E164_STR_LEN 20
2000-11-30 10:42:50 +00:00
2005-07-27 07:57:01 +00:00
static const gchar *
2015-03-01 15:11:17 +00:00
atmarpnum_to_str ( tvbuff_t * tvb , int offset , int ad_tl )
1999-11-27 04:01:43 +00:00
{
2013-10-13 18:14:59 +00:00
int ad_len = ad_tl & ATMARP_LEN_MASK ;
gchar * cur ;
1999-11-27 04:01:43 +00:00
if ( ad_len = = 0 )
return " <No address> " ;
1999-11-27 04:48:14 +00:00
if ( ad_tl & ATMARP_IS_E164 ) {
/*
* I ' m assuming this means it ' s an ASCII ( IA5 ) string .
*/
2013-09-12 12:37:27 +00:00
cur = ( gchar * ) wmem_alloc ( wmem_packet_scope ( ) , MAX_E164_STR_LEN + 3 + 1 ) ;
1999-11-27 04:48:14 +00:00
if ( ad_len > MAX_E164_STR_LEN ) {
/* Can't show it all. */
2015-03-01 15:11:17 +00:00
tvb_memcpy ( tvb , cur , offset , MAX_E164_STR_LEN ) ;
2005-10-16 00:33:00 +00:00
g_snprintf ( & cur [ MAX_E164_STR_LEN ] , 3 + 1 , " ... " ) ;
1999-11-27 04:48:14 +00:00
} else {
2015-03-01 15:11:17 +00:00
tvb_memcpy ( tvb , cur , offset , ad_len ) ;
1999-11-27 04:48:14 +00:00
cur [ ad_len + 1 ] = ' \0 ' ;
}
return cur ;
} else {
/*
* NSAP .
*
* XXX - break down into subcomponents .
*/
2015-03-01 15:11:17 +00:00
return tvb_bytes_to_str ( wmem_packet_scope ( ) , tvb , offset , ad_len ) ;
1999-11-27 04:48:14 +00:00
}
1999-11-27 04:01:43 +00:00
}
2005-07-27 07:57:01 +00:00
static const gchar *
2015-03-01 15:11:17 +00:00
atmarpsubaddr_to_str ( tvbuff_t * tvb , int offset , int ad_tl )
1999-11-27 04:01:43 +00:00
{
2013-10-13 18:14:59 +00:00
int ad_len = ad_tl & ATMARP_LEN_MASK ;
2000-11-30 10:42:50 +00:00
1999-11-27 04:01:43 +00:00
if ( ad_len = = 0 )
return " <No address> " ;
/*
2000-11-30 10:42:50 +00:00
* E .164 isn ' t considered legal in subaddresses ( RFC 2225 says that
* a null or unknown ATM address is indicated by setting the length
* to 0 , in which case the type must be ignored ; we ' ve seen some
* captures in which the length of a subaddress is 0 and the type
* is E .164 ) .
*
1999-11-27 04:01:43 +00:00
* XXX - break down into subcomponents ?
*/
2015-03-01 15:11:17 +00:00
return tvb_bytes_to_str ( wmem_packet_scope ( ) , tvb , offset , ad_len ) ;
1999-11-27 04:01:43 +00:00
}
2012-10-14 15:27:52 +00:00
const value_string arp_hrd_vals [ ] = {
2013-10-13 18:14:59 +00:00
{ ARPHRD_NETROM , " NET/ROM pseudo " } ,
{ ARPHRD_ETHER , " Ethernet " } ,
{ ARPHRD_EETHER , " Experimental Ethernet " } ,
{ ARPHRD_AX25 , " AX.25 " } ,
{ ARPHRD_PRONET , " ProNET " } ,
{ ARPHRD_CHAOS , " Chaos " } ,
{ ARPHRD_IEEE802 , " IEEE 802 " } ,
{ ARPHRD_ARCNET , " ARCNET " } ,
{ ARPHRD_HYPERCH , " Hyperchannel " } ,
{ ARPHRD_LANSTAR , " Lanstar " } ,
{ ARPHRD_AUTONET , " Autonet Short Address " } ,
{ ARPHRD_LOCALTLK , " Localtalk " } ,
{ ARPHRD_LOCALNET , " LocalNet " } ,
{ ARPHRD_ULTRALNK , " Ultra link " } ,
{ ARPHRD_SMDS , " SMDS " } ,
{ ARPHRD_DLCI , " Frame Relay DLCI " } ,
{ ARPHRD_ATM , " ATM " } ,
{ ARPHRD_HDLC , " HDLC " } ,
{ ARPHRD_FIBREC , " Fibre Channel " } ,
{ ARPHRD_ATM2225 , " ATM (RFC 2225) " } ,
{ ARPHRD_SERIAL , " Serial Line " } ,
{ ARPHRD_ATM2 , " ATM " } ,
{ ARPHRD_MS188220 , " MIL-STD-188-220 " } ,
{ ARPHRD_METRICOM , " Metricom STRIP " } ,
{ ARPHRD_IEEE1394 , " IEEE 1394.1995 " } ,
{ ARPHRD_MAPOS , " MAPOS " } ,
{ ARPHRD_TWINAX , " Twinaxial " } ,
{ ARPHRD_EUI_64 , " EUI-64 " } ,
{ ARPHRD_HIPARP , " HIPARP " } ,
{ ARPHRD_IP_ARP_ISO_7816_3 , " IP and ARP over ISO 7816-3 " } ,
{ ARPHRD_ARPSEC , " ARPSec " } ,
{ ARPHRD_IPSEC_TUNNEL , " IPsec tunnel " } ,
{ ARPHRD_INFINIBAND , " InfiniBand " } ,
{ ARPHRD_TIA_102_PRJ_25_CAI , " TIA-102 Project 25 CAI " } ,
{ ARPHRD_WIEGAND_INTERFACE , " Wiegand Interface " } ,
{ ARPHRD_PURE_IP , " Pure IP " } ,
{ ARPHDR_HW_EXP1 , " Experimental 1 " } ,
{ ARPHDR_HFI , " HFI " } ,
{ ARPHDR_HW_EXP2 , " Experimental 2 " } ,
2017-03-21 23:32:14 +00:00
/* Virtual ARP types for non ARP hardware used in Linux cooked mode. */
{ ARPHRD_LOOPBACK , " Loopback " } ,
{ ARPHRD_IPGRE , " GRE over IP " } ,
{ ARPHRD_NETLINK , " Netlink " } ,
2013-10-13 18:14:59 +00:00
{ 0 , NULL } } ;
1999-11-04 08:15:38 +00:00
1999-01-28 21:29:36 +00:00
/* Offsets of fields within an ARP packet. */
2012-04-23 17:50:02 +00:00
# define AR_HRD 0
# define AR_PRO 2
# define AR_HLN 4
# define AR_PLN 5
# define AR_OP 6
# define MIN_ARP_HEADER_SIZE 8
1999-01-28 21:29:36 +00:00
1999-11-27 04:01:43 +00:00
/* Offsets of fields within an ATMARP packet. */
2013-10-13 18:14:59 +00:00
# define ATM_AR_HRD 0
# define ATM_AR_PRO 2
# define ATM_AR_SHTL 4
# define ATM_AR_SSTL 5
# define ATM_AR_OP 6
# define ATM_AR_SPLN 8
# define ATM_AR_THTL 9
2012-04-23 17:50:02 +00:00
# define ATM_AR_TSTL 10
# define ATM_AR_TPLN 11
# define MIN_ATMARP_HEADER_SIZE 12
1999-11-27 04:01:43 +00:00
1999-11-27 04:48:14 +00:00
static void
2014-10-18 13:26:52 +00:00
dissect_atm_number ( tvbuff_t * tvb , packet_info * pinfo , int offset , int tl , int hf_e164 ,
2009-03-29 22:16:26 +00:00
int hf_nsap , proto_tree * tree )
1999-11-27 04:48:14 +00:00
{
2013-10-13 18:14:59 +00:00
int len = tl & ATMARP_LEN_MASK ;
2009-03-29 22:16:26 +00:00
proto_item * ti ;
proto_tree * nsap_tree ;
if ( tl & ATMARP_IS_E164 )
2011-09-26 08:25:18 +00:00
proto_tree_add_item ( tree , hf_e164 , tvb , offset , len , ENC_BIG_ENDIAN ) ;
2009-03-29 22:16:26 +00:00
else {
2011-09-26 08:25:18 +00:00
ti = proto_tree_add_item ( tree , hf_nsap , tvb , offset , len , ENC_BIG_ENDIAN ) ;
2009-03-29 22:16:26 +00:00
if ( len > = 20 ) {
nsap_tree = proto_item_add_subtree ( ti , ett_atmarp_nsap ) ;
2014-10-18 13:26:52 +00:00
dissect_atm_nsap ( tvb , pinfo , offset , len , nsap_tree ) ;
2009-03-29 22:16:26 +00:00
}
}
1999-11-27 04:48:14 +00:00
}
2014-10-18 13:26:52 +00:00
static const value_string atm_nsap_afi_vals [ ] = {
2017-03-30 22:00:06 +00:00
{ NSAP_IDI_ISO_DCC_BIN , " DCC ATM format " } ,
2017-03-31 07:27:48 +00:00
{ NSAP_IDI_ISO_DCC_BIN_GROUP , " DCC ATM group format " } ,
2017-03-30 22:00:06 +00:00
{ NSAP_IDI_ISO_6523_ICD_BIN , " ICD ATM format " } ,
{ NSAP_IDI_ISO_6523_ICD_BIN_GROUP , " ICD ATM group format " } ,
2017-03-31 00:48:58 +00:00
{ NSAP_IDI_E_164_BIN_FSD_NZ , " E.164 ATM format " } ,
{ NSAP_IDI_E_164_BIN_FSD_NZ_GROUP , " E.164 ATM group format " } ,
2017-03-30 22:00:06 +00:00
{ 0 , NULL }
2014-10-18 13:26:52 +00:00
} ;
2005-09-12 07:44:11 +00:00
/*
* XXX - shouldn ' t there be a centralized routine for dissecting NSAPs ?
* See also " dissect_nsap() " in epan / dissectors / packet - isup . c and
2017-03-30 22:00:06 +00:00
* " print_nsap_net() " in epan / osi - utils . c .
2005-09-12 07:44:11 +00:00
*/
1999-11-27 04:48:14 +00:00
void
2014-10-18 13:26:52 +00:00
dissect_atm_nsap ( tvbuff_t * tvb , packet_info * pinfo , int offset , int len , proto_tree * tree )
1999-11-27 04:48:14 +00:00
{
2009-03-29 22:16:26 +00:00
guint8 afi ;
2014-10-18 13:26:52 +00:00
proto_item * ti ;
2009-03-29 22:16:26 +00:00
afi = tvb_get_guint8 ( tvb , offset ) ;
2014-12-13 17:52:20 +00:00
ti = proto_tree_add_item ( tree , hf_atmarp_src_atm_afi , tvb , offset , 1 , ENC_BIG_ENDIAN ) ;
2009-03-29 22:16:26 +00:00
switch ( afi ) {
2017-03-30 22:00:06 +00:00
case NSAP_IDI_ISO_DCC_BIN : /* DCC ATM format */
2017-03-31 07:27:48 +00:00
case NSAP_IDI_ISO_DCC_BIN_GROUP : /* DCC ATM group format */
proto_tree_add_item ( tree , ( afi = = NSAP_IDI_ISO_DCC_BIN_GROUP ) ? hf_atmarp_src_atm_data_country_code_group : hf_atmarp_src_atm_data_country_code ,
2014-10-18 13:26:52 +00:00
tvb , offset + 1 , 2 , ENC_BIG_ENDIAN ) ;
proto_tree_add_item ( tree , hf_atmarp_src_atm_high_order_dsp , tvb , offset + 3 , 10 , ENC_NA ) ;
proto_tree_add_item ( tree , hf_atmarp_src_atm_end_system_identifier , tvb , offset + 13 , 6 , ENC_NA ) ;
2014-12-13 17:52:20 +00:00
proto_tree_add_item ( tree , hf_atmarp_src_atm_selector , tvb , offset + 19 , 1 , ENC_BIG_ENDIAN ) ;
2009-03-29 22:16:26 +00:00
break ;
2017-03-30 22:00:06 +00:00
case NSAP_IDI_ISO_6523_ICD_BIN : /* ICD ATM format */
case NSAP_IDI_ISO_6523_ICD_BIN_GROUP : /* ICD ATM group format */
proto_tree_add_item ( tree , ( afi = = NSAP_IDI_ISO_6523_ICD_BIN_GROUP ) ? hf_atmarp_src_atm_international_code_designator_group : hf_atmarp_src_atm_international_code_designator ,
2014-10-18 13:26:52 +00:00
tvb , offset + 1 , 2 , ENC_BIG_ENDIAN ) ;
proto_tree_add_item ( tree , hf_atmarp_src_atm_high_order_dsp , tvb , offset + 3 , 10 , ENC_NA ) ;
proto_tree_add_item ( tree , hf_atmarp_src_atm_end_system_identifier , tvb , offset + 13 , 6 , ENC_NA ) ;
2014-12-13 17:52:20 +00:00
proto_tree_add_item ( tree , hf_atmarp_src_atm_selector , tvb , offset + 19 , 1 , ENC_BIG_ENDIAN ) ;
2009-03-29 22:16:26 +00:00
break ;
2017-03-31 00:48:58 +00:00
case NSAP_IDI_E_164_BIN_FSD_NZ : /* E.164 ATM format */
case NSAP_IDI_E_164_BIN_FSD_NZ_GROUP : /* E.164 ATM group format */
proto_tree_add_item ( tree , ( afi = = NSAP_IDI_E_164_BIN_FSD_NZ_GROUP ) ? hf_atmarp_src_atm_e_164_isdn_group : hf_atmarp_src_atm_e_164_isdn ,
2014-10-18 13:26:52 +00:00
tvb , offset + 1 , 8 , ENC_NA ) ;
proto_tree_add_item ( tree , hf_atmarp_src_atm_high_order_dsp , tvb , offset + 9 , 4 , ENC_NA ) ;
proto_tree_add_item ( tree , hf_atmarp_src_atm_end_system_identifier , tvb , offset + 13 , 6 , ENC_NA ) ;
2014-12-13 17:52:20 +00:00
proto_tree_add_item ( tree , hf_atmarp_src_atm_selector , tvb , offset + 19 , 1 , ENC_BIG_ENDIAN ) ;
2009-03-29 22:16:26 +00:00
break ;
default :
2014-10-18 13:26:52 +00:00
expert_add_info ( pinfo , ti , & ei_atmarp_src_atm_unknown_afi ) ;
proto_tree_add_item ( tree , hf_atmarp_src_atm_rest_of_address , tvb , offset + 1 , len - 1 , ENC_NA ) ;
2009-03-29 22:16:26 +00:00
break ;
}
1999-11-27 04:48:14 +00:00
}
2007-12-19 10:49:22 +00:00
/* l.s. 32 bits are ipv4 address */
2012-04-23 17:50:02 +00:00
static guint
address_hash_func ( gconstpointer v )
2007-12-19 10:49:22 +00:00
{
2009-03-29 22:16:26 +00:00
return GPOINTER_TO_UINT ( v ) ;
2007-12-19 10:49:22 +00:00
}
/* Compare 2 ipv4 addresses */
2012-04-23 17:50:02 +00:00
static gint
address_equal_func ( gconstpointer v , gconstpointer v2 )
2007-12-19 10:49:22 +00:00
{
2009-03-29 22:16:26 +00:00
return v = = v2 ;
2007-12-19 10:49:22 +00:00
}
2012-04-23 17:50:02 +00:00
static guint
duplicate_result_hash_func ( gconstpointer v )
2012-02-08 11:48:02 +00:00
{
2013-03-13 21:14:20 +00:00
const duplicate_result_key * key = ( const duplicate_result_key * ) v ;
2012-02-08 11:48:02 +00:00
return ( key - > frame_number + key - > ip_address ) ;
}
2012-04-23 17:50:02 +00:00
static gint
duplicate_result_equal_func ( gconstpointer v , gconstpointer v2 )
2012-02-08 11:48:02 +00:00
{
2013-03-13 21:14:20 +00:00
const duplicate_result_key * key1 = ( const duplicate_result_key * ) v ;
const duplicate_result_key * key2 = ( const duplicate_result_key * ) v2 ;
2012-02-08 11:48:02 +00:00
return ( memcmp ( key1 , key2 , sizeof ( duplicate_result_key ) ) = = 0 ) ;
}
2007-12-19 10:49:22 +00:00
/* Check to see if this mac & ip pair represent 2 devices trying to share
2008-01-02 10:35:20 +00:00
the same IP address - report if found ( + return TRUE and set out param ) */
2012-04-23 17:50:02 +00:00
static gboolean
check_for_duplicate_addresses ( packet_info * pinfo , proto_tree * tree ,
2008-01-02 10:35:20 +00:00
tvbuff_t * tvb ,
2008-05-30 00:01:24 +00:00
const guint8 * mac , guint32 ip ,
2008-01-02 10:35:20 +00:00
guint32 * duplicate_ip )
2007-12-19 10:49:22 +00:00
{
2013-10-13 18:14:59 +00:00
address_hash_value * value ;
address_hash_value * result = NULL ;
2016-01-24 03:40:51 +00:00
duplicate_result_key result_key = { pinfo - > num , ip } ;
2012-02-08 11:48:02 +00:00
/* Look up existing result */
if ( pinfo - > fd - > flags . visited ) {
2017-02-02 04:13:42 +00:00
result = ( address_hash_value * ) wmem_map_lookup ( duplicate_result_hash_table ,
2012-02-08 11:48:02 +00:00
& result_key ) ;
}
else {
/* First time around, need to work out if represents duplicate and
store result */
2007-12-19 10:49:22 +00:00
2012-02-08 11:48:02 +00:00
/* Look up current assignment of IP address */
2017-02-02 04:13:42 +00:00
value = ( address_hash_value * ) wmem_map_lookup ( address_hash_table , GUINT_TO_POINTER ( ip ) ) ;
2007-12-19 10:49:22 +00:00
2012-02-08 11:48:02 +00:00
/* If MAC matches table, just update details */
if ( value ! = NULL )
2009-03-29 22:16:26 +00:00
{
2016-01-24 03:40:51 +00:00
if ( pinfo - > num > value - > frame_num )
2012-02-08 11:48:02 +00:00
{
if ( ( memcmp ( value - > mac , mac , 6 ) = = 0 ) )
{
/* Same MAC as before - update existing entry */
2016-01-24 03:40:51 +00:00
value - > frame_num = pinfo - > num ;
2016-01-23 03:50:21 +00:00
value - > time_of_entry = pinfo - > abs_ts . secs ;
2012-02-08 11:48:02 +00:00
}
else
{
/* Create result and store in result table */
2013-09-12 12:37:27 +00:00
duplicate_result_key * persistent_key = wmem_new ( wmem_file_scope ( ) , duplicate_result_key ) ;
2012-02-08 11:48:02 +00:00
memcpy ( persistent_key , & result_key , sizeof ( duplicate_result_key ) ) ;
2013-09-12 12:37:27 +00:00
result = wmem_new ( wmem_file_scope ( ) , address_hash_value ) ;
2012-02-08 11:48:02 +00:00
memcpy ( result , value , sizeof ( address_hash_value ) ) ;
2017-02-02 04:13:42 +00:00
wmem_map_insert ( duplicate_result_hash_table , persistent_key , result ) ;
2012-02-08 11:48:02 +00:00
}
}
2009-03-29 22:16:26 +00:00
}
else
{
2012-02-08 11:48:02 +00:00
/* No existing entry. Prepare one */
2013-09-12 12:37:27 +00:00
value = wmem_new ( wmem_file_scope ( ) , struct address_hash_value ) ;
2012-02-08 11:48:02 +00:00
memcpy ( value - > mac , mac , 6 ) ;
2016-01-24 03:40:51 +00:00
value - > frame_num = pinfo - > num ;
2016-01-23 03:50:21 +00:00
value - > time_of_entry = pinfo - > abs_ts . secs ;
2012-02-08 11:48:02 +00:00
/* Add it */
2017-02-02 04:13:42 +00:00
wmem_map_insert ( address_hash_table , GUINT_TO_POINTER ( ip ) , value ) ;
2009-03-29 22:16:26 +00:00
}
}
2012-02-08 11:48:02 +00:00
/* Add report to tree if we found a duplicate */
if ( result ! = NULL ) {
proto_tree * duplicate_tree ;
2014-06-22 20:01:36 +00:00
proto_item * ti ;
2014-12-20 02:42:14 +00:00
address mac_addr , result_mac_addr ;
2015-10-21 19:04:16 +00:00
set_address ( & mac_addr , AT_ETHER , 6 , mac ) ;
set_address ( & result_mac_addr , AT_ETHER , 6 , result - > mac ) ;
2012-02-08 11:48:02 +00:00
/* Create subtree */
2014-06-22 20:01:36 +00:00
duplicate_tree = proto_tree_add_subtree_format ( tree , tvb , 0 , 0 , ett_arp_duplicate_address , & ti ,
2012-02-08 11:48:02 +00:00
" Duplicate IP address detected for %s (%s) - also in use by %s (frame %u) " ,
arpproaddr_to_str ( ( guint8 * ) & ip , 4 , ETHERTYPE_IP ) ,
2014-12-20 02:42:14 +00:00
address_to_str ( wmem_packet_scope ( ) , & mac_addr ) ,
address_to_str ( wmem_packet_scope ( ) , & result_mac_addr ) ,
2012-02-08 11:48:02 +00:00
result - > frame_num ) ;
PROTO_ITEM_SET_GENERATED ( ti ) ;
/* Add item for navigating to earlier frame */
ti = proto_tree_add_uint ( duplicate_tree , hf_arp_duplicate_ip_address_earlier_frame ,
tvb , 0 , 0 , result - > frame_num ) ;
PROTO_ITEM_SET_GENERATED ( ti ) ;
2013-09-09 00:44:09 +00:00
expert_add_info_format ( pinfo , ti ,
2013-05-24 18:02:54 +00:00
& ei_seq_arp_dup_ip ,
2012-02-08 11:48:02 +00:00
" Duplicate IP address configured (%s) " ,
arpproaddr_to_str ( ( guint8 * ) & ip , 4 , ETHERTYPE_IP ) ) ;
/* Time since that frame was seen */
ti = proto_tree_add_uint ( duplicate_tree ,
hf_arp_duplicate_ip_address_seconds_since_earlier_frame ,
tvb , 0 , 0 ,
2016-01-23 03:50:21 +00:00
( guint32 ) ( pinfo - > abs_ts . secs - result - > time_of_entry ) ) ;
2012-02-08 11:48:02 +00:00
PROTO_ITEM_SET_GENERATED ( ti ) ;
/* Set out parameter */
* duplicate_ip = ip ;
2009-03-29 22:16:26 +00:00
}
2008-01-02 10:35:20 +00:00
2012-02-08 11:48:02 +00:00
return ( result ! = NULL ) ;
2007-12-19 10:49:22 +00:00
}
2006-10-20 14:20:22 +00:00
/* Take note that a request has been seen */
2012-04-23 17:50:02 +00:00
static void
request_seen ( packet_info * pinfo )
2006-10-20 14:20:22 +00:00
{
2009-03-29 22:16:26 +00:00
/* Don't count frame again after already recording first time around. */
2013-11-23 02:20:13 +00:00
if ( p_get_proto_data ( wmem_file_scope ( ) , pinfo , proto_arp , 0 ) = = 0 )
2009-03-29 22:16:26 +00:00
{
arp_request_count + + ;
}
2006-10-20 14:20:22 +00:00
}
/* Has storm request rate been exceeded with this request? */
2012-04-23 17:50:02 +00:00
static void
check_for_storm_count ( tvbuff_t * tvb , packet_info * pinfo , proto_tree * tree )
2006-10-20 14:20:22 +00:00
{
2009-03-29 22:16:26 +00:00
gboolean report_storm = FALSE ;
2006-10-20 14:20:22 +00:00
2013-11-23 02:20:13 +00:00
if ( p_get_proto_data ( wmem_file_scope ( ) , pinfo , proto_arp , 0 ) ! = 0 )
2009-03-29 22:16:26 +00:00
{
/* Read any previous stored packet setting */
2013-11-23 02:20:13 +00:00
report_storm = ( p_get_proto_data ( wmem_file_scope ( ) , pinfo , proto_arp , 0 ) = = ( void * ) STORM ) ;
2009-03-29 22:16:26 +00:00
}
else
{
/* Seeing packet for first time - check against preference settings */
2016-01-23 03:50:21 +00:00
gint seconds_delta = ( gint ) ( pinfo - > abs_ts . secs - time_at_start_of_count . secs ) ;
gint nseconds_delta = pinfo - > abs_ts . nsecs - time_at_start_of_count . nsecs ;
2009-03-29 22:16:26 +00:00
gint gap = ( seconds_delta * 1000 ) + ( nseconds_delta / 1000000 ) ;
/* Reset if gap exceeds period or -ve gap (indicates we're rescanning from start) */
if ( ( gap > ( gint ) global_arp_detect_request_storm_period ) | |
( gap < 0 ) )
2006-10-20 14:20:22 +00:00
{
2009-03-29 22:16:26 +00:00
/* Time period elapsed without threshold being exceeded */
arp_request_count = 1 ;
2016-01-23 03:50:21 +00:00
time_at_start_of_count = pinfo - > abs_ts ;
2013-11-23 02:20:13 +00:00
p_add_proto_data ( wmem_file_scope ( ) , pinfo , proto_arp , 0 , ( void * ) NO_STORM ) ;
2009-03-29 22:16:26 +00:00
return ;
2006-10-20 14:20:22 +00:00
}
else
2009-03-29 22:16:26 +00:00
if ( arp_request_count > global_arp_detect_request_storm_packets )
{
/* Storm detected, record and reset start time. */
report_storm = TRUE ;
2013-11-23 02:20:13 +00:00
p_add_proto_data ( wmem_file_scope ( ) , pinfo , proto_arp , 0 , ( void * ) STORM ) ;
2016-01-23 03:50:21 +00:00
time_at_start_of_count = pinfo - > abs_ts ;
2009-03-29 22:16:26 +00:00
}
else
{
/* Threshold not exceeded yet - no storm */
2013-11-23 02:20:13 +00:00
p_add_proto_data ( wmem_file_scope ( ) , pinfo , proto_arp , 0 , ( void * ) NO_STORM ) ;
2009-03-29 22:16:26 +00:00
}
}
2007-03-11 06:16:00 +00:00
2009-03-29 22:16:26 +00:00
if ( report_storm )
{
/* Report storm and reset counter */
2014-09-11 00:04:22 +00:00
proto_tree_add_expert_format ( tree , pinfo , & ei_seq_arp_storm , tvb , 0 , 0 ,
2009-03-29 22:16:26 +00:00
" ARP packet storm detected (%u packets in < %u ms) " ,
global_arp_detect_request_storm_packets ,
global_arp_detect_request_storm_period ) ;
arp_request_count = 0 ;
}
2006-10-20 14:20:22 +00:00
}
1999-11-27 04:01:43 +00:00
/*
* RFC 2225 ATMARP - it ' s just like ARP , except where it isn ' t .
*/
2015-11-15 13:00:10 +00:00
static int
dissect_atmarp ( tvbuff_t * tvb , packet_info * pinfo , proto_tree * tree , void * data _U_ )
1999-11-27 04:01:43 +00:00
{
2013-10-13 18:14:59 +00:00
guint16 ar_hrd ;
guint16 ar_pro ;
guint8 ar_shtl ;
guint8 ar_shl ;
guint8 ar_sstl ;
guint8 ar_ssl ;
guint16 ar_op ;
guint8 ar_spln ;
guint8 ar_thtl ;
guint8 ar_thl ;
guint8 ar_tstl ;
guint8 ar_tsl ;
guint8 ar_tpln ;
int tot_len ;
proto_tree * arp_tree ;
proto_item * ti ;
const gchar * op_str ;
int sha_offset , ssa_offset , spa_offset ;
int tha_offset , tsa_offset , tpa_offset ;
const gchar * sha_str , * ssa_str , * spa_str ;
const gchar * tha_str , * tsa_str , * tpa_str ;
proto_tree * tl_tree ;
1999-11-27 04:01:43 +00:00
2000-11-13 07:19:37 +00:00
ar_hrd = tvb_get_ntohs ( tvb , ATM_AR_HRD ) ;
ar_pro = tvb_get_ntohs ( tvb , ATM_AR_PRO ) ;
ar_shtl = tvb_get_guint8 ( tvb , ATM_AR_SHTL ) ;
1999-11-27 04:01:43 +00:00
ar_shl = ar_shtl & ATMARP_LEN_MASK ;
2000-11-30 10:42:50 +00:00
ar_sstl = tvb_get_guint8 ( tvb , ATM_AR_SSTL ) ;
ar_ssl = ar_sstl & ATMARP_LEN_MASK ;
2000-11-13 07:19:37 +00:00
ar_op = tvb_get_ntohs ( tvb , AR_OP ) ;
ar_spln = tvb_get_guint8 ( tvb , ATM_AR_SPLN ) ;
ar_thtl = tvb_get_guint8 ( tvb , ATM_AR_THTL ) ;
1999-11-27 04:01:43 +00:00
ar_thl = ar_thtl & ATMARP_LEN_MASK ;
2000-11-30 10:42:50 +00:00
ar_tstl = tvb_get_guint8 ( tvb , ATM_AR_TSTL ) ;
ar_tsl = ar_tstl & ATMARP_LEN_MASK ;
2000-11-13 07:19:37 +00:00
ar_tpln = tvb_get_guint8 ( tvb , ATM_AR_TPLN ) ;
1999-11-27 04:01:43 +00:00
2000-11-30 10:42:50 +00:00
tot_len = MIN_ATMARP_HEADER_SIZE + ar_shl + ar_ssl + ar_spln +
2009-03-29 22:16:26 +00:00
ar_thl + ar_tsl + ar_tpln ;
2002-08-28 21:04:11 +00:00
2000-11-19 01:00:20 +00:00
/* Adjust the length of this tvbuff to include only the ARP datagram.
Our caller may use that to determine how much of its packet
was padding . */
tvb_set_reported_length ( tvb , tot_len ) ;
1999-11-27 04:01:43 +00:00
/* Extract the addresses. */
2000-11-13 07:19:37 +00:00
sha_offset = MIN_ATMARP_HEADER_SIZE ;
2015-03-01 15:11:17 +00:00
sha_str = atmarpnum_to_str ( tvb , sha_offset , ar_shtl ) ;
2000-11-13 07:19:37 +00:00
1999-11-27 04:01:43 +00:00
ssa_offset = sha_offset + ar_shl ;
2000-11-13 07:19:37 +00:00
if ( ar_ssl ! = 0 ) {
2015-03-01 15:11:17 +00:00
ssa_str = atmarpsubaddr_to_str ( tvb , ssa_offset , ar_sstl ) ;
2000-11-13 07:19:37 +00:00
} else {
1999-11-27 04:01:43 +00:00
ssa_str = NULL ;
2000-11-13 07:19:37 +00:00
}
1999-11-27 04:01:43 +00:00
spa_offset = ssa_offset + ar_ssl ;
2015-03-01 15:11:17 +00:00
spa_str = tvb_arpproaddr_to_str ( tvb , spa_offset , ar_spln , ar_pro ) ;
2000-11-13 07:19:37 +00:00
1999-11-27 04:01:43 +00:00
tha_offset = spa_offset + ar_spln ;
2015-03-01 15:11:17 +00:00
tha_str = atmarpnum_to_str ( tvb , tha_offset , ar_thtl ) ;
2000-11-13 07:19:37 +00:00
1999-11-27 04:01:43 +00:00
tsa_offset = tha_offset + ar_thl ;
2000-11-13 07:19:37 +00:00
if ( ar_tsl ! = 0 ) {
2015-03-01 15:11:17 +00:00
tsa_str = atmarpsubaddr_to_str ( tvb , tsa_offset , ar_tstl ) ;
2000-11-13 07:19:37 +00:00
} else {
1999-11-27 04:01:43 +00:00
tsa_str = NULL ;
2000-11-13 07:19:37 +00:00
}
1999-11-27 04:01:43 +00:00
tpa_offset = tsa_offset + ar_tsl ;
2015-03-01 15:11:17 +00:00
tpa_str = tvb_arpproaddr_to_str ( tvb , tpa_offset , ar_tpln , ar_pro ) ;
2000-11-19 01:00:20 +00:00
2011-09-26 08:25:18 +00:00
switch ( ar_op ) {
case ARPOP_REQUEST :
case ARPOP_REPLY :
case ATMARPOP_NAK :
default :
2012-04-23 17:50:02 +00:00
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " ATMARP " ) ;
break ;
2011-09-26 08:25:18 +00:00
case ARPOP_RREQUEST :
case ARPOP_RREPLY :
2012-04-23 17:50:02 +00:00
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " ATMRARP " ) ;
break ;
2011-09-26 08:25:18 +00:00
case ARPOP_IREQUEST :
case ARPOP_IREPLY :
2012-04-23 17:50:02 +00:00
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " Inverse ATMARP " ) ;
break ;
2012-05-29 08:00:35 +00:00
case ARPOP_MARS_REQUEST :
case ARPOP_MARS_MULTI :
case ARPOP_MARS_MSERV :
case ARPOP_MARS_JOIN :
case ARPOP_MARS_LEAVE :
case ARPOP_MARS_NAK :
case ARPOP_MARS_UNSERV :
case ARPOP_MARS_SJOIN :
case ARPOP_MARS_SLEAVE :
case ARPOP_MARS_GROUPLIST_REQUEST :
case ARPOP_MARS_GROUPLIST_REPLY :
case ARPOP_MARS_REDIRECT_MAP :
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " MARS " ) ;
break ;
case ARPOP_MAPOS_UNARP :
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " MAPOS " ) ;
break ;
1999-11-27 04:01:43 +00:00
}
2011-09-26 08:25:18 +00:00
switch ( ar_op ) {
case ARPOP_REQUEST :
2015-07-08 08:09:31 +00:00
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Who has %s? Tell %s " ,
2011-09-26 08:25:18 +00:00
tpa_str , spa_str ) ;
break ;
case ARPOP_REPLY :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " %s is at %s%s%s " , spa_str , sha_str ,
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ) ;
break ;
case ARPOP_IREQUEST :
2015-07-08 08:09:31 +00:00
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Who is %s%s%s? Tell %s%s%s " ,
2011-09-26 08:25:18 +00:00
tha_str ,
( ( tsa_str ! = NULL ) ? " , " : " " ) ,
( ( tsa_str ! = NULL ) ? tsa_str : " " ) ,
sha_str ,
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ) ;
break ;
case ARPOP_IREPLY :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " %s%s%s is at %s " ,
sha_str ,
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ,
spa_str ) ;
break ;
case ATMARPOP_NAK :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " I don't know where %s is " , spa_str ) ;
break ;
2012-05-29 08:00:35 +00:00
case ARPOP_MARS_REQUEST :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS request from %s%s%s at %s " ,
sha_str ,
2013-10-13 18:14:59 +00:00
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
2012-05-29 08:00:35 +00:00
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ,
spa_str ) ;
break ;
case ARPOP_MARS_MULTI :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS MULTI request from %s%s%s at %s " ,
2013-10-13 18:14:59 +00:00
sha_str ,
2012-05-29 08:00:35 +00:00
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ,
spa_str ) ;
break ;
case ARPOP_MARS_MSERV :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS MSERV request from %s%s%s at %s " ,
2013-10-13 18:14:59 +00:00
sha_str ,
2012-05-29 08:00:35 +00:00
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ,
spa_str ) ;
break ;
case ARPOP_MARS_JOIN :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS JOIN request from %s%s%s at %s " ,
2013-10-13 18:14:59 +00:00
sha_str ,
2012-05-29 08:00:35 +00:00
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ,
spa_str ) ;
break ;
case ARPOP_MARS_LEAVE :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS LEAVE from %s%s%s at %s " ,
2013-10-13 18:14:59 +00:00
sha_str ,
2012-05-29 08:00:35 +00:00
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ,
spa_str ) ;
break ;
case ARPOP_MARS_NAK :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS NAK from %s%s%s at %s " ,
sha_str ,
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ,
spa_str ) ;
break ;
case ARPOP_MARS_UNSERV :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS UNSERV request from %s%s%s at %s " ,
sha_str ,
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ,
spa_str ) ;
break ;
case ARPOP_MARS_SJOIN :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS SJOIN request from %s%s%s at %s " ,
sha_str ,
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ,
spa_str ) ;
break ;
case ARPOP_MARS_SLEAVE :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS SLEAVE from %s%s%s at %s " ,
sha_str ,
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ,
spa_str ) ;
break ;
case ARPOP_MARS_GROUPLIST_REQUEST :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS grouplist request from %s%s%s at %s " ,
sha_str ,
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ,
spa_str ) ;
break ;
case ARPOP_MARS_GROUPLIST_REPLY :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS grouplist reply from %s%s%s at %s " ,
sha_str ,
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ,
spa_str ) ;
break ;
case ARPOP_MARS_REDIRECT_MAP :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS redirect map from %s%s%s at %s " ,
sha_str ,
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ,
spa_str ) ;
break ;
case ARPOP_MAPOS_UNARP :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MAPOS UNARP request from %s%s%s at %s " ,
sha_str ,
( ( ssa_str ! = NULL ) ? " , " : " " ) ,
( ( ssa_str ! = NULL ) ? ssa_str : " " ) ,
spa_str ) ;
break ;
case ARPOP_EXP1 :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Experimental 1 ( opcode %d ) " , ar_op ) ;
break ;
case ARPOP_EXP2 :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Experimental 2 ( opcode %d ) " , ar_op ) ;
break ;
case 0 :
case 65535 :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Reserved opcode %d " , ar_op ) ;
break ;
2011-09-26 08:25:18 +00:00
default :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Unknown ATMARP opcode 0x%04x " , ar_op ) ;
break ;
1999-11-27 04:01:43 +00:00
}
if ( tree ) {
2013-03-29 00:26:23 +00:00
if ( ( op_str = try_val_to_str ( ar_op , atmop_vals ) ) )
2000-11-13 07:19:37 +00:00
ti = proto_tree_add_protocol_format ( tree , proto_arp , tvb , 0 , tot_len ,
2009-03-29 22:16:26 +00:00
" ATM Address Resolution Protocol (%s) " ,
op_str ) ;
1999-11-27 04:01:43 +00:00
else
2000-11-13 07:19:37 +00:00
ti = proto_tree_add_protocol_format ( tree , proto_arp , tvb , 0 , tot_len ,
2009-03-29 22:16:26 +00:00
" ATM Address Resolution Protocol (opcode 0x%04x) " , ar_op ) ;
1999-11-27 04:01:43 +00:00
arp_tree = proto_item_add_subtree ( ti , ett_arp ) ;
2000-11-30 10:42:50 +00:00
2000-11-13 07:19:37 +00:00
proto_tree_add_uint ( arp_tree , hf_arp_hard_type , tvb , ATM_AR_HRD , 2 , ar_hrd ) ;
2000-11-30 10:42:50 +00:00
2000-11-13 07:19:37 +00:00
proto_tree_add_uint ( arp_tree , hf_arp_proto_type , tvb , ATM_AR_PRO , 2 , ar_pro ) ;
2000-11-30 10:42:50 +00:00
2014-06-22 20:01:36 +00:00
tl_tree = proto_tree_add_subtree_format ( arp_tree , tvb , ATM_AR_SHTL , 1 ,
ett_atmarp_tl , NULL ,
2009-03-29 22:16:26 +00:00
" Sender ATM number type/length: %s/%u " ,
( ar_shtl & ATMARP_IS_E164 ?
" E.164 " :
" ATM Forum NSAPA " ) ,
ar_shl ) ;
2000-11-30 10:42:50 +00:00
proto_tree_add_boolean ( tl_tree , hf_atmarp_sht , tvb , ATM_AR_SHTL , 1 , ar_shtl ) ;
proto_tree_add_uint ( tl_tree , hf_atmarp_shl , tvb , ATM_AR_SHTL , 1 , ar_shtl ) ;
2014-06-22 20:01:36 +00:00
tl_tree = proto_tree_add_subtree_format ( arp_tree , tvb , ATM_AR_SSTL , 1 ,
ett_atmarp_tl , NULL ,
2009-03-29 22:16:26 +00:00
" Sender ATM subaddress type/length: %s/%u " ,
( ar_sstl & ATMARP_IS_E164 ?
" E.164 " :
" ATM Forum NSAPA " ) ,
ar_ssl ) ;
2000-11-30 10:42:50 +00:00
proto_tree_add_boolean ( tl_tree , hf_atmarp_sst , tvb , ATM_AR_SSTL , 1 , ar_sstl ) ;
proto_tree_add_uint ( tl_tree , hf_atmarp_ssl , tvb , ATM_AR_SSTL , 1 , ar_sstl ) ;
2000-11-13 07:19:37 +00:00
proto_tree_add_uint ( arp_tree , hf_arp_opcode , tvb , AR_OP , 2 , ar_op ) ;
2000-11-30 10:42:50 +00:00
2009-05-21 05:15:03 +00:00
2000-11-13 07:19:37 +00:00
proto_tree_add_uint ( arp_tree , hf_atmarp_spln , tvb , ATM_AR_SPLN , 1 , ar_spln ) ;
2000-11-30 10:42:50 +00:00
2014-06-22 20:01:36 +00:00
tl_tree = proto_tree_add_subtree_format ( arp_tree , tvb , ATM_AR_THTL , 1 ,
ett_atmarp_tl , NULL ,
2009-03-29 22:16:26 +00:00
" Target ATM number type/length: %s/%u " ,
( ar_thtl & ATMARP_IS_E164 ?
" E.164 " :
" ATM Forum NSAPA " ) ,
ar_thl ) ;
2000-11-30 10:42:50 +00:00
proto_tree_add_boolean ( tl_tree , hf_atmarp_tht , tvb , ATM_AR_THTL , 1 , ar_thtl ) ;
proto_tree_add_uint ( tl_tree , hf_atmarp_thl , tvb , ATM_AR_THTL , 1 , ar_thtl ) ;
2014-06-24 01:54:48 +00:00
tl_tree = proto_tree_add_subtree_format ( arp_tree , tvb , ATM_AR_TSTL , 1 ,
2014-06-22 20:01:36 +00:00
ett_atmarp_tl , NULL ,
2009-03-29 22:16:26 +00:00
" Target ATM subaddress type/length: %s/%u " ,
( ar_tstl & ATMARP_IS_E164 ?
" E.164 " :
" ATM Forum NSAPA " ) ,
ar_tsl ) ;
2000-11-30 10:42:50 +00:00
proto_tree_add_boolean ( tl_tree , hf_atmarp_tst , tvb , ATM_AR_TSTL , 1 , ar_tstl ) ;
proto_tree_add_uint ( tl_tree , hf_atmarp_tsl , tvb , ATM_AR_TSTL , 1 , ar_tstl ) ;
2000-11-13 07:19:37 +00:00
proto_tree_add_uint ( arp_tree , hf_atmarp_tpln , tvb , ATM_AR_TPLN , 1 , ar_tpln ) ;
2000-11-30 10:42:50 +00:00
1999-11-27 04:01:43 +00:00
if ( ar_shl ! = 0 )
2014-10-18 13:26:52 +00:00
dissect_atm_number ( tvb , pinfo , sha_offset , ar_shtl , hf_atmarp_src_atm_num_e164 ,
2009-03-29 22:16:26 +00:00
hf_atmarp_src_atm_num_nsap , arp_tree ) ;
2000-11-30 10:42:50 +00:00
1999-11-27 04:01:43 +00:00
if ( ar_ssl ! = 0 )
2013-09-29 18:19:29 +00:00
proto_tree_add_bytes_format_value ( arp_tree , hf_atmarp_src_atm_subaddr , tvb , ssa_offset ,
2015-03-01 15:11:17 +00:00
ar_ssl , NULL , " %s " , ssa_str ) ;
2000-11-30 10:42:50 +00:00
2002-02-10 22:41:48 +00:00
if ( ar_spln ! = 0 ) {
proto_tree_add_item ( arp_tree ,
2009-03-29 22:16:26 +00:00
ARP_PRO_IS_IPv4 ( ar_pro , ar_spln ) ? hf_arp_src_proto_ipv4
: hf_arp_src_proto ,
2011-09-26 08:25:18 +00:00
tvb , spa_offset , ar_spln , ENC_BIG_ENDIAN ) ;
2002-02-10 22:41:48 +00:00
}
2000-11-30 10:42:50 +00:00
1999-11-27 04:01:43 +00:00
if ( ar_thl ! = 0 )
2014-10-18 13:26:52 +00:00
dissect_atm_number ( tvb , pinfo , tha_offset , ar_thtl , hf_atmarp_dst_atm_num_e164 ,
2009-03-29 22:16:26 +00:00
hf_atmarp_dst_atm_num_nsap , arp_tree ) ;
2000-11-30 10:42:50 +00:00
1999-11-27 04:01:43 +00:00
if ( ar_tsl ! = 0 )
2013-09-29 18:19:29 +00:00
proto_tree_add_bytes_format_value ( arp_tree , hf_atmarp_dst_atm_subaddr , tvb , tsa_offset ,
2015-03-01 15:11:17 +00:00
ar_tsl , NULL , " %s " , tsa_str ) ;
2000-11-30 10:42:50 +00:00
2002-02-10 22:41:48 +00:00
if ( ar_tpln ! = 0 ) {
proto_tree_add_item ( arp_tree ,
2009-03-29 22:16:26 +00:00
ARP_PRO_IS_IPv4 ( ar_pro , ar_tpln ) ? hf_arp_dst_proto_ipv4
: hf_arp_dst_proto ,
2011-09-26 08:25:18 +00:00
tvb , tpa_offset , ar_tpln , ENC_BIG_ENDIAN ) ;
2002-02-10 22:41:48 +00:00
}
1999-11-27 04:01:43 +00:00
}
2015-11-15 13:00:10 +00:00
return tvb_captured_length ( tvb ) ;
1999-11-27 04:01:43 +00:00
}
2012-08-02 17:48:18 +00:00
/*
* AX .25 ARP - it ' s just like ARP , except where it isn ' t .
*/
2015-11-15 13:00:10 +00:00
static int
dissect_ax25arp ( tvbuff_t * tvb , packet_info * pinfo , proto_tree * tree , void * data _U_ )
2012-08-02 17:48:18 +00:00
{
2013-10-13 18:14:59 +00:00
# define ARP_AX25 204
guint16 ar_hrd ;
guint16 ar_pro ;
guint8 ar_hln ;
guint8 ar_pln ;
guint16 ar_op ;
int tot_len ;
2012-08-02 17:48:18 +00:00
proto_tree * arp_tree = NULL ;
proto_item * ti ;
const gchar * op_str ;
2013-10-13 18:14:59 +00:00
int sha_offset , spa_offset , tha_offset , tpa_offset ;
2015-03-01 15:11:17 +00:00
const gchar * spa_str , * tpa_str ;
2013-10-13 18:14:59 +00:00
gboolean is_gratuitous ;
2012-08-02 17:48:18 +00:00
/* Hardware Address Type */
ar_hrd = tvb_get_ntohs ( tvb , AR_HRD ) ;
/* Protocol Address Type */
ar_pro = tvb_get_ntohs ( tvb , AR_PRO ) ;
/* Hardware Address Size */
ar_hln = tvb_get_guint8 ( tvb , AR_HLN ) ;
/* Protocol Address Size */
ar_pln = tvb_get_guint8 ( tvb , AR_PLN ) ;
/* Operation */
ar_op = tvb_get_ntohs ( tvb , AR_OP ) ;
tot_len = MIN_ARP_HEADER_SIZE + ar_hln * 2 + ar_pln * 2 ;
/* Adjust the length of this tvbuff to include only the ARP datagram.
Our caller may use that to determine how much of its packet
was padding . */
tvb_set_reported_length ( tvb , tot_len ) ;
2013-06-14 19:46:54 +00:00
switch ( ar_op ) {
2012-08-02 17:48:18 +00:00
2013-06-14 19:46:54 +00:00
case ARPOP_REQUEST :
if ( global_arp_detect_request_storm )
request_seen ( pinfo ) ;
2012-08-04 18:45:57 +00:00
/* fall-through */
2013-06-14 19:46:54 +00:00
case ARPOP_REPLY :
default :
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " ARP " ) ;
break ;
2012-08-02 17:48:18 +00:00
2013-06-14 19:46:54 +00:00
case ARPOP_RREQUEST :
case ARPOP_RREPLY :
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " RARP " ) ;
break ;
2012-08-02 17:48:18 +00:00
2013-06-14 19:46:54 +00:00
case ARPOP_IREQUEST :
case ARPOP_IREPLY :
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " Inverse ARP " ) ;
break ;
2012-08-02 17:48:18 +00:00
}
/* Get the offsets of the addresses. */
/* Source Hardware Address */
sha_offset = MIN_ARP_HEADER_SIZE ;
/* Source Protocol Address */
spa_offset = sha_offset + ar_hln ;
/* Target Hardware Address */
tha_offset = spa_offset + ar_pln ;
/* Target Protocol Address */
tpa_offset = tha_offset + ar_hln ;
2015-03-01 15:11:17 +00:00
spa_str = tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ;
tpa_str = tvb_arpproaddr_to_str ( tvb , tpa_offset , ar_pln , ar_pro ) ;
2012-08-02 17:48:18 +00:00
/* ARP requests/replies with the same sender and target protocol
address are flagged as " gratuitous ARPs " , i . e . ARPs sent out as ,
in effect , an announcement that the machine has MAC address
2013-10-13 18:14:59 +00:00
XX : XX : XX : XX : XX : XX and IPv4 address YY . YY . YY . YY . Requests are to
2012-08-02 17:48:18 +00:00
provoke complaints if some other machine has the same IPv4 address ,
2013-10-13 18:14:59 +00:00
replies are used to announce relocation of network address , like
2012-08-02 17:48:18 +00:00
in failover solutions . */
2015-03-01 15:11:17 +00:00
if ( ( ( ar_op = = ARPOP_REQUEST ) | | ( ar_op = = ARPOP_REPLY ) ) & & ( strcmp ( spa_str , tpa_str ) = = 0 ) )
2012-08-02 17:48:18 +00:00
is_gratuitous = TRUE ;
else
is_gratuitous = FALSE ;
2013-06-14 19:46:54 +00:00
switch ( ar_op ) {
case ARPOP_REQUEST :
2013-10-13 18:14:59 +00:00
if ( is_gratuitous )
2015-03-01 15:11:17 +00:00
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Gratuitous ARP for %s (Request) " , tpa_str ) ;
2013-10-13 18:14:59 +00:00
else
2015-07-08 08:09:31 +00:00
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Who has %s? Tell %s " , tpa_str , spa_str ) ;
2013-06-14 19:46:54 +00:00
break ;
case ARPOP_REPLY :
if ( is_gratuitous )
2015-03-01 15:11:17 +00:00
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Gratuitous ARP for %s (Reply) " , spa_str ) ;
2013-06-14 19:46:54 +00:00
else
col_add_fstr ( pinfo - > cinfo , COL_INFO , " %s is at %s " ,
2015-03-01 15:11:17 +00:00
spa_str ,
2012-08-02 17:48:18 +00:00
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ) ;
2013-06-14 19:46:54 +00:00
break ;
case ARPOP_RREQUEST :
case ARPOP_IREQUEST :
2015-07-08 08:09:31 +00:00
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Who is %s? Tell %s " ,
2013-06-14 19:46:54 +00:00
tvb_arphrdaddr_to_str ( tvb , tha_offset , ar_hln , ar_hrd ) ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ) ;
break ;
case ARPOP_RREPLY :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " %s is at %s " ,
tvb_arphrdaddr_to_str ( tvb , tha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tpa_str ) ;
2013-06-14 19:46:54 +00:00
break ;
case ARPOP_IREPLY :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " %s is at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
spa_str ) ;
2013-06-14 19:46:54 +00:00
break ;
default :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Unknown ARP opcode 0x%04x " , ar_op ) ;
break ;
2012-08-02 17:48:18 +00:00
}
if ( tree ) {
2013-10-13 18:14:59 +00:00
if ( ( op_str = try_val_to_str ( ar_op , op_vals ) ) ) {
2012-08-02 17:48:18 +00:00
if ( is_gratuitous & & ( ar_op = = ARPOP_REQUEST ) )
op_str = " request/gratuitous ARP " ;
if ( is_gratuitous & & ( ar_op = = ARPOP_REPLY ) )
op_str = " reply/gratuitous ARP " ;
ti = proto_tree_add_protocol_format ( tree , proto_arp , tvb , 0 , tot_len ,
2013-10-13 18:14:59 +00:00
" Address Resolution Protocol (%s) " , op_str ) ;
2012-08-02 17:48:18 +00:00
} else
ti = proto_tree_add_protocol_format ( tree , proto_arp , tvb , 0 , tot_len ,
2013-10-13 18:14:59 +00:00
" Address Resolution Protocol (opcode 0x%04x) " , ar_op ) ;
2012-08-02 17:48:18 +00:00
arp_tree = proto_item_add_subtree ( ti , ett_arp ) ;
proto_tree_add_uint ( arp_tree , hf_arp_hard_type , tvb , AR_HRD , 2 , ar_hrd ) ;
proto_tree_add_uint ( arp_tree , hf_arp_proto_type , tvb , AR_PRO , 2 , ar_pro ) ;
proto_tree_add_uint ( arp_tree , hf_arp_hard_size , tvb , AR_HLN , 1 , ar_hln ) ;
proto_tree_add_uint ( arp_tree , hf_arp_proto_size , tvb , AR_PLN , 1 , ar_pln ) ;
proto_tree_add_uint ( arp_tree , hf_arp_opcode , tvb , AR_OP , 2 , ar_op ) ;
if ( ar_hln ! = 0 ) {
proto_tree_add_item ( arp_tree ,
2013-10-13 18:14:59 +00:00
ARP_HW_IS_AX25 ( ar_hrd , ar_hln ) ? hf_arp_src_hw_ax25 : hf_arp_src_hw ,
tvb , sha_offset , ar_hln , FALSE ) ;
2012-08-02 17:48:18 +00:00
}
if ( ar_pln ! = 0 ) {
proto_tree_add_item ( arp_tree ,
2013-10-13 18:14:59 +00:00
ARP_PRO_IS_IPv4 ( ar_pro , ar_pln ) ? hf_arp_src_proto_ipv4
: hf_arp_src_proto ,
tvb , spa_offset , ar_pln , FALSE ) ;
2012-08-02 17:48:18 +00:00
}
if ( ar_hln ! = 0 ) {
proto_tree_add_item ( arp_tree ,
2013-10-13 18:14:59 +00:00
ARP_HW_IS_AX25 ( ar_hrd , ar_hln ) ? hf_arp_dst_hw_ax25 : hf_arp_dst_hw ,
tvb , tha_offset , ar_hln , FALSE ) ;
2012-08-02 17:48:18 +00:00
}
if ( ar_pln ! = 0 ) {
proto_tree_add_item ( arp_tree ,
2013-10-13 18:14:59 +00:00
ARP_PRO_IS_IPv4 ( ar_pro , ar_pln ) ? hf_arp_dst_proto_ipv4
: hf_arp_dst_proto ,
tvb , tpa_offset , ar_pln , FALSE ) ;
2012-08-02 17:48:18 +00:00
}
}
if ( global_arp_detect_request_storm )
{
check_for_storm_count ( tvb , pinfo , arp_tree ) ;
}
2015-11-15 13:00:10 +00:00
return tvb_captured_length ( tvb ) ;
2012-08-02 17:48:18 +00:00
}
2016-11-12 14:46:43 +00:00
static gboolean
2015-12-15 00:25:31 +00:00
capture_arp ( const guchar * pd _U_ , int offset _U_ , int len _U_ , capture_packet_info_t * cpinfo , const union wtap_pseudo_header * pseudo_header _U_ )
2015-12-13 21:54:16 +00:00
{
2015-12-19 15:11:40 +00:00
capture_dissector_increment_count ( cpinfo , proto_arp ) ;
2015-12-13 21:54:16 +00:00
return TRUE ;
}
2003-02-10 21:13:13 +00:00
static const guint8 mac_allzero [ 6 ] = { 0x00 , 0x00 , 0x00 , 0x00 , 0x00 , 0x00 } ;
2001-01-09 01:02:34 +00:00
2015-11-23 03:59:08 +00:00
static int
dissect_arp ( tvbuff_t * tvb , packet_info * pinfo , proto_tree * tree , void * data _U_ )
1999-11-27 04:01:43 +00:00
{
2013-10-13 18:14:59 +00:00
guint16 ar_hrd ;
guint16 ar_pro ;
guint8 ar_hln ;
guint8 ar_pln ;
guint16 ar_op ;
int tot_len ;
proto_tree * arp_tree = NULL ;
proto_item * ti , * item ;
const gchar * op_str ;
int sha_offset , spa_offset , tha_offset , tpa_offset ;
gboolean is_gratuitous ;
gboolean duplicate_detected = FALSE ;
guint32 duplicate_ip = 0 ;
1999-01-28 21:29:36 +00:00
2000-12-29 04:16:57 +00:00
/* Call it ARP, for now, so that if we throw an exception before
we decide whether it ' s ARP or RARP or IARP or ATMARP , it shows
up in the packet list as ARP .
Clear the Info column so that , if we throw an exception , it
shows up as a short or malformed ARP frame . */
2009-08-09 06:26:46 +00:00
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " ARP " ) ;
2009-08-09 07:36:13 +00:00
col_clear ( pinfo - > cinfo , COL_INFO ) ;
2000-12-29 04:16:57 +00:00
2004-06-17 08:32:59 +00:00
/* Hardware Address Type */
2000-11-13 07:19:37 +00:00
ar_hrd = tvb_get_ntohs ( tvb , AR_HRD ) ;
1999-11-27 04:01:43 +00:00
if ( ar_hrd = = ARPHRD_ATM2225 ) {
2001-11-27 07:13:32 +00:00
call_dissector ( atmarp_handle , tvb , pinfo , tree ) ;
2015-11-23 03:59:08 +00:00
return tvb_captured_length ( tvb ) ;
1999-11-27 04:01:43 +00:00
}
2012-08-02 17:48:18 +00:00
if ( ar_hrd = = ARPHRD_AX25 ) {
call_dissector ( ax25arp_handle , tvb , pinfo , tree ) ;
2015-11-23 03:59:08 +00:00
return tvb_captured_length ( tvb ) ;
2012-08-02 17:48:18 +00:00
}
2004-06-17 08:32:59 +00:00
/* Protocol Address Type */
2000-11-13 07:19:37 +00:00
ar_pro = tvb_get_ntohs ( tvb , AR_PRO ) ;
2004-06-17 08:32:59 +00:00
/* Hardware Address Size */
2000-11-13 07:19:37 +00:00
ar_hln = tvb_get_guint8 ( tvb , AR_HLN ) ;
2004-06-17 08:32:59 +00:00
/* Protocol Address Size */
2000-11-13 07:19:37 +00:00
ar_pln = tvb_get_guint8 ( tvb , AR_PLN ) ;
2004-06-17 08:32:59 +00:00
/* Operation */
2000-11-13 07:19:37 +00:00
ar_op = tvb_get_ntohs ( tvb , AR_OP ) ;
1998-09-16 02:39:15 +00:00
1999-11-27 04:01:43 +00:00
tot_len = MIN_ARP_HEADER_SIZE + ar_hln * 2 + ar_pln * 2 ;
2002-08-28 21:04:11 +00:00
2000-11-19 01:00:20 +00:00
/* Adjust the length of this tvbuff to include only the ARP datagram.
Our caller may use that to determine how much of its packet
was padding . */
tvb_set_reported_length ( tvb , tot_len ) ;
1999-10-03 17:12:15 +00:00
2011-09-26 08:25:18 +00:00
switch ( ar_op ) {
case ARPOP_REQUEST :
if ( global_arp_detect_request_storm )
{
request_seen ( pinfo ) ;
}
/* FALLTHRU */
case ARPOP_REPLY :
default :
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " ARP " ) ;
break ;
case ARPOP_RREQUEST :
case ARPOP_RREPLY :
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " RARP " ) ;
break ;
2012-05-29 08:00:35 +00:00
case ARPOP_DRARPREQUEST :
case ARPOP_DRARPREPLY :
case ARPOP_DRARPERROR :
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " DRARP " ) ;
break ;
2011-09-26 08:25:18 +00:00
case ARPOP_IREQUEST :
case ARPOP_IREPLY :
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " Inverse ARP " ) ;
break ;
2013-10-13 18:14:59 +00:00
2012-05-29 08:00:35 +00:00
case ARPOP_MARS_REQUEST :
case ARPOP_MARS_MULTI :
case ARPOP_MARS_MSERV :
case ARPOP_MARS_JOIN :
case ARPOP_MARS_LEAVE :
case ARPOP_MARS_NAK :
case ARPOP_MARS_UNSERV :
case ARPOP_MARS_SJOIN :
case ARPOP_MARS_SLEAVE :
case ARPOP_MARS_GROUPLIST_REQUEST :
case ARPOP_MARS_GROUPLIST_REPLY :
case ARPOP_MARS_REDIRECT_MAP :
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " MARS " ) ;
2013-10-13 18:14:59 +00:00
break ;
2012-05-29 08:00:35 +00:00
case ARPOP_MAPOS_UNARP :
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , " MAPOS " ) ;
break ;
1998-11-17 04:29:13 +00:00
}
2004-06-17 20:04:53 +00:00
/* Get the offsets of the addresses. */
/* Source Hardware Address */
sha_offset = MIN_ARP_HEADER_SIZE ;
/* Source Protocol Address */
spa_offset = sha_offset + ar_hln ;
/* Target Hardware Address */
tha_offset = spa_offset + ar_pln ;
/* Target Protocol Address */
tpa_offset = tha_offset + ar_hln ;
1998-11-03 07:45:10 +00:00
2000-08-10 20:09:29 +00:00
if ( ( ar_op = = ARPOP_REPLY | | ar_op = = ARPOP_REQUEST ) & &
2002-02-10 22:41:48 +00:00
ARP_HW_IS_ETHER ( ar_hrd , ar_hln ) & &
ARP_PRO_IS_IPv4 ( ar_pro , ar_pln ) ) {
2000-08-10 20:09:29 +00:00
/* inform resolv.c module of the new discovered addresses */
2008-01-02 10:35:20 +00:00
guint32 ip ;
2001-03-13 21:34:28 +00:00
const guint8 * mac ;
2000-08-10 20:09:29 +00:00
2003-02-10 21:13:13 +00:00
/* Add sender address if sender MAC address is neither a broadcast/
multicast address nor an all - zero address and if sender IP address
isn ' t all zeroes . */
2005-09-11 21:25:37 +00:00
ip = tvb_get_ipv4 ( tvb , spa_offset ) ;
2016-05-17 02:17:33 +00:00
mac = ( const guint8 * ) tvb_memdup ( wmem_packet_scope ( ) , tvb , sha_offset , 6 ) ;
2003-02-10 21:13:13 +00:00
if ( ( mac [ 0 ] & 0x01 ) = = 0 & & memcmp ( mac , mac_allzero , 6 ) ! = 0 & & ip ! = 0 )
2007-12-19 10:49:22 +00:00
{
2016-01-18 15:00:29 +00:00
if ( global_arp_register_network_address_binding )
{
add_ether_byip ( ip , mac ) ;
}
2007-12-19 10:49:22 +00:00
if ( global_arp_detect_duplicate_ip_addresses )
{
2008-01-02 10:35:20 +00:00
duplicate_detected =
2009-03-29 22:16:26 +00:00
check_for_duplicate_addresses ( pinfo , tree , tvb , mac , ip ,
& duplicate_ip ) ;
2007-12-19 10:49:22 +00:00
}
}
2003-02-10 21:13:13 +00:00
/* Add target address if target MAC address is neither a broadcast/
multicast address nor an all - zero address and if target IP address
isn ' t all zeroes . */
2007-03-11 06:16:00 +00:00
2005-02-03 22:52:20 +00:00
/* Do not add target address if the packet is a Request. According to the RFC,
target addresses in requests have no meaning */
2007-03-11 06:16:00 +00:00
2012-05-29 08:00:35 +00:00
2005-09-11 21:25:37 +00:00
ip = tvb_get_ipv4 ( tvb , tpa_offset ) ;
2016-05-17 02:17:33 +00:00
mac = ( const guint8 * ) tvb_memdup ( wmem_packet_scope ( ) , tvb , tha_offset , 6 ) ;
2007-03-11 06:16:00 +00:00
if ( ( mac [ 0 ] & 0x01 ) = = 0 & & memcmp ( mac , mac_allzero , 6 ) ! = 0 & & ip ! = 0
2007-12-19 10:49:22 +00:00
& & ar_op ! = ARPOP_REQUEST )
{
2016-01-18 15:00:29 +00:00
if ( global_arp_register_network_address_binding )
{
add_ether_byip ( ip , mac ) ;
}
2013-04-22 12:08:42 +00:00
/* If Gratuitous, don't report duplicate for same IP address twice */
if ( global_arp_detect_duplicate_ip_addresses & & ( duplicate_ip ! = ip ) )
2007-12-19 10:49:22 +00:00
{
2008-01-02 10:35:20 +00:00
duplicate_detected =
2009-03-29 22:16:26 +00:00
check_for_duplicate_addresses ( pinfo , tree , tvb , mac , ip ,
& duplicate_ip ) ;
2007-12-19 10:49:22 +00:00
}
}
2012-05-29 08:00:35 +00:00
2000-08-10 20:09:29 +00:00
}
2006-10-29 19:14:31 +00:00
/* ARP requests/replies with the same sender and target protocol
address are flagged as " gratuitous ARPs " , i . e . ARPs sent out as ,
in effect , an announcement that the machine has MAC address
2007-03-11 06:16:00 +00:00
XX : XX : XX : XX : XX : XX and IPv4 address YY . YY . YY . YY . Requests are to
2006-10-29 19:14:31 +00:00
provoke complaints if some other machine has the same IPv4 address ,
2007-03-11 06:16:00 +00:00
replies are used to announce relocation of network address , like
2006-10-29 19:14:31 +00:00
in failover solutions . */
2015-03-01 15:11:17 +00:00
if ( ( ( ar_op = = ARPOP_REQUEST ) | | ( ar_op = = ARPOP_REPLY ) ) & &
( tvb_memeql ( tvb , spa_offset , tvb_get_ptr ( tvb , tpa_offset , ar_pln ) , ar_pln ) = = 0 ) )
2004-06-17 20:04:53 +00:00
is_gratuitous = TRUE ;
else
is_gratuitous = FALSE ;
2011-09-26 08:25:18 +00:00
switch ( ar_op ) {
case ARPOP_REQUEST :
2011-11-13 22:44:51 +00:00
if ( is_gratuitous )
2011-09-26 08:25:18 +00:00
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Gratuitous ARP for %s (Request) " ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , tpa_offset , ar_pln , ar_pro ) ) ;
2011-11-13 22:44:51 +00:00
else
2015-07-08 08:09:31 +00:00
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Who has %s? Tell %s " ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , tpa_offset , ar_pln , ar_pro ) ,
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2011-09-26 08:25:18 +00:00
break ;
case ARPOP_REPLY :
if ( is_gratuitous )
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Gratuitous ARP for %s (Reply) " ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2011-09-26 08:25:18 +00:00
else
col_add_fstr ( pinfo - > cinfo , COL_INFO , " %s is at %s " ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ,
2011-09-26 08:25:18 +00:00
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ) ;
break ;
case ARPOP_RREQUEST :
case ARPOP_IREQUEST :
2012-05-29 08:00:35 +00:00
case ARPOP_DRARPREQUEST :
2015-07-08 08:09:31 +00:00
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Who is %s? Tell %s " ,
2011-09-26 08:25:18 +00:00
tvb_arphrdaddr_to_str ( tvb , tha_offset , ar_hln , ar_hrd ) ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ) ;
break ;
case ARPOP_RREPLY :
2012-05-29 08:00:35 +00:00
case ARPOP_DRARPREPLY :
2011-09-26 08:25:18 +00:00
col_add_fstr ( pinfo - > cinfo , COL_INFO , " %s is at %s " ,
tvb_arphrdaddr_to_str ( tvb , tha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , tpa_offset , ar_pln , ar_pro ) ) ;
2011-09-26 08:25:18 +00:00
break ;
2012-05-29 08:00:35 +00:00
case ARPOP_DRARPERROR :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " DRARP Error " ) ;
2013-10-13 18:14:59 +00:00
break ;
2012-05-29 08:00:35 +00:00
2011-09-26 08:25:18 +00:00
case ARPOP_IREPLY :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " %s is at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2011-09-26 08:25:18 +00:00
break ;
2012-05-29 08:00:35 +00:00
case ATMARPOP_NAK :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " ARP NAK " ) ;
break ;
case ARPOP_MARS_REQUEST :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS request from %s at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2012-05-29 08:00:35 +00:00
break ;
case ARPOP_MARS_MULTI :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS MULTI request from %s at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2012-05-29 08:00:35 +00:00
break ;
case ARPOP_MARS_MSERV :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS MSERV request from %s at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2012-05-29 08:00:35 +00:00
break ;
case ARPOP_MARS_JOIN :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS JOIN request from %s at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2012-05-29 08:00:35 +00:00
break ;
case ARPOP_MARS_LEAVE :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS LEAVE from %s at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2012-05-29 08:00:35 +00:00
break ;
case ARPOP_MARS_NAK :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS NAK from %s at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2012-05-29 08:00:35 +00:00
break ;
case ARPOP_MARS_UNSERV :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS UNSERV request from %s at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2012-05-29 08:00:35 +00:00
break ;
case ARPOP_MARS_SJOIN :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS SJOIN request from %s at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2012-05-29 08:00:35 +00:00
break ;
case ARPOP_MARS_SLEAVE :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS SLEAVE from %s at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2012-05-29 08:00:35 +00:00
break ;
case ARPOP_MARS_GROUPLIST_REQUEST :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS grouplist request from %s at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2012-05-29 08:00:35 +00:00
break ;
case ARPOP_MARS_GROUPLIST_REPLY :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS grouplist reply from %s at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2012-05-29 08:00:35 +00:00
break ;
case ARPOP_MARS_REDIRECT_MAP :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MARS redirect map from %s at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2012-05-29 08:00:35 +00:00
break ;
case ARPOP_MAPOS_UNARP :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " MAPOS UNARP request from %s at %s " ,
tvb_arphrdaddr_to_str ( tvb , sha_offset , ar_hln , ar_hrd ) ,
2015-03-01 15:11:17 +00:00
tvb_arpproaddr_to_str ( tvb , spa_offset , ar_pln , ar_pro ) ) ;
2012-05-29 08:00:35 +00:00
break ;
case ARPOP_EXP1 :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Experimental 1 ( opcode %d ) " , ar_op ) ;
break ;
case ARPOP_EXP2 :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Experimental 2 ( opcode %d ) " , ar_op ) ;
break ;
case 0 :
case 65535 :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Reserved opcode %d " , ar_op ) ;
break ;
2011-09-26 08:25:18 +00:00
default :
col_add_fstr ( pinfo - > cinfo , COL_INFO , " Unknown ARP opcode 0x%04x " , ar_op ) ;
break ;
2004-06-17 20:04:53 +00:00
}
1998-11-03 07:45:10 +00:00
if ( tree ) {
2013-03-29 00:26:23 +00:00
if ( ( op_str = try_val_to_str ( ar_op , op_vals ) ) ) {
2006-10-29 19:14:31 +00:00
if ( is_gratuitous & & ( ar_op = = ARPOP_REQUEST ) )
2004-06-17 20:04:53 +00:00
op_str = " request/gratuitous ARP " ;
2006-10-29 19:14:31 +00:00
if ( is_gratuitous & & ( ar_op = = ARPOP_REPLY ) )
op_str = " reply/gratuitous ARP " ;
2000-11-13 07:19:37 +00:00
ti = proto_tree_add_protocol_format ( tree , proto_arp , tvb , 0 , tot_len ,
2009-03-29 22:16:26 +00:00
" Address Resolution Protocol (%s) " , op_str ) ;
2004-06-17 08:32:59 +00:00
} else
2000-11-13 07:19:37 +00:00
ti = proto_tree_add_protocol_format ( tree , proto_arp , tvb , 0 , tot_len ,
2009-03-29 22:16:26 +00:00
" Address Resolution Protocol (opcode 0x%04x) " , ar_op ) ;
1999-11-16 11:44:20 +00:00
arp_tree = proto_item_add_subtree ( ti , ett_arp ) ;
2000-11-13 07:19:37 +00:00
proto_tree_add_uint ( arp_tree , hf_arp_hard_type , tvb , AR_HRD , 2 , ar_hrd ) ;
proto_tree_add_uint ( arp_tree , hf_arp_proto_type , tvb , AR_PRO , 2 , ar_pro ) ;
proto_tree_add_uint ( arp_tree , hf_arp_hard_size , tvb , AR_HLN , 1 , ar_hln ) ;
proto_tree_add_uint ( arp_tree , hf_arp_proto_size , tvb , AR_PLN , 1 , ar_pln ) ;
proto_tree_add_uint ( arp_tree , hf_arp_opcode , tvb , AR_OP , 2 , ar_op ) ;
2013-10-13 18:14:59 +00:00
if ( is_gratuitous )
2012-05-29 08:00:35 +00:00
{
2009-12-10 22:35:09 +00:00
item = proto_tree_add_boolean ( arp_tree , hf_arp_isgratuitous , tvb , 0 , 0 , is_gratuitous ) ;
2009-05-21 05:15:03 +00:00
PROTO_ITEM_SET_GENERATED ( item ) ;
2013-10-13 18:14:59 +00:00
}
2002-02-10 22:41:48 +00:00
if ( ar_hln ! = 0 ) {
proto_tree_add_item ( arp_tree ,
2007-12-19 10:49:22 +00:00
ARP_HW_IS_ETHER ( ar_hrd , ar_hln ) ?
2009-03-29 22:16:26 +00:00
hf_arp_src_hw_mac :
hf_arp_src_hw ,
2011-09-26 08:25:18 +00:00
tvb , sha_offset , ar_hln , ENC_BIG_ENDIAN ) ;
2002-02-10 22:41:48 +00:00
}
if ( ar_pln ! = 0 ) {
proto_tree_add_item ( arp_tree ,
2007-12-19 10:49:22 +00:00
ARP_PRO_IS_IPv4 ( ar_pro , ar_pln ) ?
2009-03-29 22:16:26 +00:00
hf_arp_src_proto_ipv4 :
hf_arp_src_proto ,
2011-09-26 08:25:18 +00:00
tvb , spa_offset , ar_pln , ENC_BIG_ENDIAN ) ;
2002-02-10 22:41:48 +00:00
}
if ( ar_hln ! = 0 ) {
proto_tree_add_item ( arp_tree ,
2007-12-19 10:49:22 +00:00
ARP_HW_IS_ETHER ( ar_hrd , ar_hln ) ?
2009-03-29 22:16:26 +00:00
hf_arp_dst_hw_mac :
hf_arp_dst_hw ,
2011-09-26 08:25:18 +00:00
tvb , tha_offset , ar_hln , ENC_BIG_ENDIAN ) ;
2002-02-10 22:41:48 +00:00
}
2012-05-29 08:00:35 +00:00
if ( ar_pln ! = 0 & & ar_op ! = ARPOP_DRARPERROR ) { /*DISPLAYING ERROR NUMBER FOR DRARPERROR*/
2002-02-10 22:41:48 +00:00
proto_tree_add_item ( arp_tree ,
2007-12-19 10:49:22 +00:00
ARP_PRO_IS_IPv4 ( ar_pro , ar_pln ) ?
2009-03-29 22:16:26 +00:00
hf_arp_dst_proto_ipv4 :
hf_arp_dst_proto ,
2011-09-26 08:25:18 +00:00
tvb , tpa_offset , ar_pln , ENC_BIG_ENDIAN ) ;
2002-02-10 22:41:48 +00:00
}
2012-05-29 08:00:35 +00:00
else if ( ar_pln ! = 0 & & ar_op = = ARPOP_DRARPERROR ) {
proto_tree_add_item ( arp_tree , hf_drarp_error_status , tvb , tpa_offset , 1 , ENC_BIG_ENDIAN ) ; /*Adding the first byte of tpa field as drarp_error_status*/
}
1998-09-16 02:39:15 +00:00
}
2006-10-20 14:20:22 +00:00
if ( global_arp_detect_request_storm )
{
check_for_storm_count ( tvb , pinfo , arp_tree ) ;
}
2008-01-02 10:35:20 +00:00
if ( duplicate_detected )
{
/* Also indicate in info column */
2011-09-26 08:25:18 +00:00
col_append_fstr ( pinfo - > cinfo , COL_INFO , " (duplicate use of %s detected!) " ,
arpproaddr_to_str ( ( guint8 * ) & duplicate_ip , 4 , ETHERTYPE_IP ) ) ;
2008-01-02 10:35:20 +00:00
}
2015-11-23 03:59:08 +00:00
return tvb_captured_length ( tvb ) ;
1998-09-16 02:39:15 +00:00
}
1999-07-29 05:47:07 +00:00
void
proto_register_arp ( void )
{
2009-05-08 22:18:14 +00:00
static struct true_false_string tfs_type_bit = { " E.164 " , " ATM Forum NSAPA " } ;
2000-11-30 10:42:50 +00:00
1999-10-03 17:12:15 +00:00
static hf_register_info hf [ ] = {
{ & hf_arp_hard_type ,
2012-04-23 17:50:02 +00:00
{ " Hardware type " , " arp.hw.type " ,
2012-10-14 15:27:52 +00:00
FT_UINT16 , BASE_DEC , VALS ( arp_hrd_vals ) , 0x0 ,
2012-04-23 17:50:02 +00:00
NULL , HFILL } } ,
1999-10-12 06:21:15 +00:00
1999-10-03 17:12:15 +00:00
{ & hf_arp_proto_type ,
2012-04-23 17:50:02 +00:00
{ " Protocol type " , " arp.proto.type " ,
FT_UINT16 , BASE_HEX , VALS ( etype_vals ) , 0x0 ,
NULL , HFILL } } ,
1999-10-12 06:21:15 +00:00
1999-10-03 17:12:15 +00:00
{ & hf_arp_hard_size ,
2012-04-23 17:50:02 +00:00
{ " Hardware size " , " arp.hw.size " ,
FT_UINT8 , BASE_DEC , NULL , 0x0 ,
NULL , HFILL } } ,
1999-11-27 04:01:43 +00:00
2000-11-30 10:42:50 +00:00
{ & hf_atmarp_sht ,
2012-04-23 17:50:02 +00:00
{ " Sender ATM number type " , " arp.src.htype " ,
FT_BOOLEAN , 8 , TFS ( & tfs_type_bit ) , ATMARP_IS_E164 ,
NULL , HFILL } } ,
2000-11-30 10:42:50 +00:00
{ & hf_atmarp_shl ,
2012-04-23 17:50:02 +00:00
{ " Sender ATM number length " , " arp.src.hlen " ,
FT_UINT8 , BASE_DEC , NULL , ATMARP_LEN_MASK ,
NULL , HFILL } } ,
2000-11-30 10:42:50 +00:00
{ & hf_atmarp_sst ,
2012-04-23 17:50:02 +00:00
{ " Sender ATM subaddress type " , " arp.src.stype " ,
FT_BOOLEAN , 8 , TFS ( & tfs_type_bit ) , ATMARP_IS_E164 ,
NULL , HFILL } } ,
1999-11-27 04:01:43 +00:00
{ & hf_atmarp_ssl ,
2012-04-23 17:50:02 +00:00
{ " Sender ATM subaddress length " , " arp.src.slen " ,
FT_UINT8 , BASE_DEC , NULL , ATMARP_LEN_MASK ,
NULL , HFILL } } ,
1999-10-12 06:21:15 +00:00
1999-10-03 17:12:15 +00:00
{ & hf_arp_proto_size ,
2012-04-23 17:50:02 +00:00
{ " Protocol size " , " arp.proto.size " ,
FT_UINT8 , BASE_DEC , NULL , 0x0 ,
NULL , HFILL } } ,
1999-10-12 06:21:15 +00:00
1999-10-03 17:12:15 +00:00
{ & hf_arp_opcode ,
2012-04-23 17:50:02 +00:00
{ " Opcode " , " arp.opcode " ,
FT_UINT16 , BASE_DEC , VALS ( op_vals ) , 0x0 ,
NULL , HFILL } } ,
2009-05-21 05:15:03 +00:00
{ & hf_arp_isgratuitous ,
2012-04-23 17:50:02 +00:00
{ " Is gratuitous " , " arp.isgratuitous " ,
FT_BOOLEAN , BASE_NONE , TFS ( & tfs_true_false ) , 0x0 ,
NULL , HFILL } } ,
1999-10-12 06:21:15 +00:00
1999-11-27 04:01:43 +00:00
{ & hf_atmarp_spln ,
2012-04-23 17:50:02 +00:00
{ " Sender protocol size " , " arp.src.pln " ,
FT_UINT8 , BASE_DEC , NULL , 0x0 ,
NULL , HFILL } } ,
1999-11-27 04:01:43 +00:00
2000-11-30 10:42:50 +00:00
{ & hf_atmarp_tht ,
2012-04-23 17:50:02 +00:00
{ " Target ATM number type " , " arp.dst.htype " ,
FT_BOOLEAN , 8 , TFS ( & tfs_type_bit ) , ATMARP_IS_E164 ,
NULL , HFILL } } ,
2000-11-30 10:42:50 +00:00
{ & hf_atmarp_thl ,
2012-04-23 17:50:02 +00:00
{ " Target ATM number length " , " arp.dst.hlen " ,
FT_UINT8 , BASE_DEC , NULL , ATMARP_LEN_MASK ,
NULL , HFILL } } ,
2000-11-30 10:42:50 +00:00
{ & hf_atmarp_tst ,
2012-04-23 17:50:02 +00:00
{ " Target ATM subaddress type " , " arp.dst.stype " ,
FT_BOOLEAN , 8 , TFS ( & tfs_type_bit ) , ATMARP_IS_E164 ,
NULL , HFILL } } ,
1999-11-27 04:01:43 +00:00
{ & hf_atmarp_tsl ,
2012-04-23 17:50:02 +00:00
{ " Target ATM subaddress length " , " arp.dst.slen " ,
FT_UINT8 , BASE_DEC , NULL , ATMARP_LEN_MASK ,
NULL , HFILL } } ,
1999-11-27 04:01:43 +00:00
{ & hf_atmarp_tpln ,
2012-04-23 17:50:02 +00:00
{ " Target protocol size " , " arp.dst.pln " ,
FT_UINT8 , BASE_DEC , NULL , 0x0 ,
NULL , HFILL } } ,
1999-11-27 04:01:43 +00:00
2002-02-10 22:41:48 +00:00
{ & hf_arp_src_hw ,
2012-04-23 17:50:02 +00:00
{ " Sender hardware address " , " arp.src.hw " ,
FT_BYTES , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
1999-10-12 06:21:15 +00:00
2002-02-10 22:41:48 +00:00
{ & hf_arp_src_hw_mac ,
2012-04-23 17:50:02 +00:00
{ " Sender MAC address " , " arp.src.hw_mac " ,
FT_ETHER , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
2002-02-10 22:41:48 +00:00
2012-08-02 17:48:18 +00:00
{ & hf_arp_src_hw_ax25 ,
2013-10-13 18:14:59 +00:00
{ " Sender AX.25 address " , " arp.src.hw_ax25 " ,
FT_AX25 , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
2012-08-02 17:48:18 +00:00
1999-11-27 04:48:14 +00:00
{ & hf_atmarp_src_atm_num_e164 ,
2012-04-23 17:50:02 +00:00
{ " Sender ATM number (E.164) " , " arp.src.atm_num_e164 " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
1999-11-27 04:48:14 +00:00
{ & hf_atmarp_src_atm_num_nsap ,
2012-04-23 17:50:02 +00:00
{ " Sender ATM number (NSAP) " , " arp.src.atm_num_nsap " ,
FT_BYTES , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
1999-11-27 04:01:43 +00:00
{ & hf_atmarp_src_atm_subaddr ,
2012-04-23 17:50:02 +00:00
{ " Sender ATM subaddress " , " arp.src.atm_subaddr " ,
FT_BYTES , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
1999-11-27 04:01:43 +00:00
1999-10-03 17:12:15 +00:00
{ & hf_arp_src_proto ,
2012-04-23 17:50:02 +00:00
{ " Sender protocol address " , " arp.src.proto " ,
FT_BYTES , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
1999-10-12 06:21:15 +00:00
2002-02-10 22:41:48 +00:00
{ & hf_arp_src_proto_ipv4 ,
2012-04-23 17:50:02 +00:00
{ " Sender IP address " , " arp.src.proto_ipv4 " ,
FT_IPv4 , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
2002-02-10 22:41:48 +00:00
{ & hf_arp_dst_hw ,
2012-04-23 17:50:02 +00:00
{ " Target hardware address " , " arp.dst.hw " ,
FT_BYTES , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
1999-10-12 06:21:15 +00:00
2002-02-10 22:41:48 +00:00
{ & hf_arp_dst_hw_mac ,
2012-04-23 17:50:02 +00:00
{ " Target MAC address " , " arp.dst.hw_mac " ,
FT_ETHER , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
2002-02-10 22:41:48 +00:00
2012-08-02 17:48:18 +00:00
{ & hf_arp_dst_hw_ax25 ,
2013-10-13 18:14:59 +00:00
{ " Target AX.25 address " , " arp.dst.hw_ax25 " ,
FT_AX25 , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
2012-08-02 17:48:18 +00:00
1999-11-27 04:48:14 +00:00
{ & hf_atmarp_dst_atm_num_e164 ,
2012-04-23 17:50:02 +00:00
{ " Target ATM number (E.164) " , " arp.dst.atm_num_e164 " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
1999-11-27 04:48:14 +00:00
{ & hf_atmarp_dst_atm_num_nsap ,
2012-04-23 17:50:02 +00:00
{ " Target ATM number (NSAP) " , " arp.dst.atm_num_nsap " ,
FT_BYTES , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
1999-11-27 04:01:43 +00:00
{ & hf_atmarp_dst_atm_subaddr ,
2012-04-23 17:50:02 +00:00
{ " Target ATM subaddress " , " arp.dst.atm_subaddr " ,
FT_BYTES , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
1999-11-27 04:01:43 +00:00
1999-10-03 17:12:15 +00:00
{ & hf_arp_dst_proto ,
2012-04-23 17:50:02 +00:00
{ " Target protocol address " , " arp.dst.proto " ,
FT_BYTES , BASE_NONE , NULL , 0x0 ,
2009-05-21 05:15:03 +00:00
NULL , HFILL } } ,
2002-02-10 22:41:48 +00:00
{ & hf_arp_dst_proto_ipv4 ,
2012-04-23 17:50:02 +00:00
{ " Target IP address " , " arp.dst.proto_ipv4 " ,
FT_IPv4 , BASE_NONE , NULL , 0x0 ,
2009-05-21 05:15:03 +00:00
NULL , HFILL } } ,
2006-10-20 14:20:22 +00:00
2012-05-29 08:00:35 +00:00
{ & hf_drarp_error_status ,
{ " DRARP error status " , " arp.dst.drarp_error_status " ,
FT_UINT16 , BASE_DEC , VALS ( drarp_status ) , 0x0 ,
NULL , HFILL } } ,
2007-12-19 10:49:22 +00:00
{ & hf_arp_duplicate_ip_address_earlier_frame ,
2012-04-23 17:50:02 +00:00
{ " Frame showing earlier use of IP address " , " arp.duplicate-address-frame " ,
FT_FRAMENUM , BASE_NONE , NULL , 0x0 ,
2009-05-21 05:15:03 +00:00
NULL , HFILL } } ,
2007-12-19 10:49:22 +00:00
{ & hf_arp_duplicate_ip_address_seconds_since_earlier_frame ,
2012-04-23 17:50:02 +00:00
{ " Seconds since earlier frame seen " , " arp.seconds-since-duplicate-address-frame " ,
FT_UINT32 , BASE_DEC , NULL , 0x0 ,
2009-05-21 05:15:03 +00:00
NULL , HFILL } } ,
2007-12-19 10:49:22 +00:00
2014-10-18 13:26:52 +00:00
/* Generated from convert_proto_tree_add_text.pl */
{ & hf_atmarp_src_atm_data_country_code , { " Data Country Code " , " arp.src.atm_data_country_code " , FT_UINT16 , BASE_HEX , NULL , 0x0 , NULL , HFILL } } ,
{ & hf_atmarp_src_atm_data_country_code_group , { " Data Country Code (group) " , " arp.src.atm_data_country_code_group " , FT_UINT16 , BASE_HEX , NULL , 0x0 , NULL , HFILL } } ,
{ & hf_atmarp_src_atm_high_order_dsp , { " High Order DSP " , " arp.src.atm_high_order_dsp " , FT_BYTES , BASE_NONE , NULL , 0x0 , NULL , HFILL } } ,
{ & hf_atmarp_src_atm_end_system_identifier , { " End System Identifier " , " arp.src.atm_end_system_identifier " , FT_BYTES , BASE_NONE , NULL , 0x0 , NULL , HFILL } } ,
{ & hf_atmarp_src_atm_selector , { " Selector " , " arp.src.atm_selector " , FT_UINT8 , BASE_HEX , NULL , 0x0 , NULL , HFILL } } ,
{ & hf_atmarp_src_atm_international_code_designator , { " International Code Designator " , " arp.src.atm_international_code_designator " , FT_UINT16 , BASE_HEX , NULL , 0x0 , NULL , HFILL } } ,
{ & hf_atmarp_src_atm_international_code_designator_group , { " International Code Designator (group) " , " arp.src.atm_international_code_designator_group " , FT_UINT16 , BASE_HEX , NULL , 0x0 , NULL , HFILL } } ,
{ & hf_atmarp_src_atm_e_164_isdn , { " E.164 ISDN " , " arp.src.atm_e.164_isdn " , FT_BYTES , BASE_NONE , NULL , 0x0 , NULL , HFILL } } ,
{ & hf_atmarp_src_atm_e_164_isdn_group , { " E.164 ISDN " , " arp.src.atm_e.164_isdn_group " , FT_BYTES , BASE_NONE , NULL , 0x0 , NULL , HFILL } } ,
{ & hf_atmarp_src_atm_rest_of_address , { " Rest of address " , " arp.src.atm_rest_of_address " , FT_BYTES , BASE_NONE , NULL , 0x0 , NULL , HFILL } } ,
{ & hf_atmarp_src_atm_afi , { " AFI " , " arp.src.atm_afi " , FT_UINT8 , BASE_HEX , VALS ( atm_nsap_afi_vals ) , 0x0 , NULL , HFILL } } ,
1999-10-03 17:12:15 +00:00
} ;
2006-10-20 14:20:22 +00:00
1999-11-16 11:44:20 +00:00
static gint * ett [ ] = {
& ett_arp ,
1999-11-27 04:48:14 +00:00
& ett_atmarp_nsap ,
2007-12-19 10:49:22 +00:00
& ett_atmarp_tl ,
& ett_arp_duplicate_address
1999-11-16 11:44:20 +00:00
} ;
1999-07-29 05:47:07 +00:00
2013-05-24 18:02:54 +00:00
static ei_register_info ei [ ] = {
{ & ei_seq_arp_dup_ip , { " arp.duplicate-address-detected " , PI_SEQUENCE , PI_WARN , " Duplicate IP address configured " , EXPFILL } } ,
{ & ei_seq_arp_storm , { " arp.packet-storm-detected " , PI_SEQUENCE , PI_NOTE , " ARP packet storm detected " , EXPFILL } } ,
2014-10-18 13:26:52 +00:00
{ & ei_atmarp_src_atm_unknown_afi , { " arp.src.atm_afi.unknown " , PI_PROTOCOL , PI_WARN , " Unknown AFI " , EXPFILL } } ,
2013-05-24 18:02:54 +00:00
} ;
2006-10-20 14:20:22 +00:00
module_t * arp_module ;
2013-05-24 18:02:54 +00:00
expert_module_t * expert_arp ;
2015-11-26 13:25:32 +00:00
int proto_atmarp ;
2007-03-11 06:16:00 +00:00
2001-01-03 06:56:03 +00:00
proto_arp = proto_register_protocol ( " Address Resolution Protocol " ,
2012-04-23 17:50:02 +00:00
" ARP/RARP " , " arp " ) ;
2015-11-26 13:25:32 +00:00
proto_atmarp = proto_register_protocol ( " ATM Address Resolution Protocol " ,
" ATMARP " , " atmarp " ) ;
1999-10-03 17:12:15 +00:00
proto_register_field_array ( proto_arp , hf , array_length ( hf ) ) ;
1999-11-16 11:44:20 +00:00
proto_register_subtree_array ( ett , array_length ( ett ) ) ;
2001-11-27 07:13:32 +00:00
2013-05-24 18:02:54 +00:00
expert_arp = expert_register_protocol ( proto_arp ) ;
expert_register_field_array ( expert_arp , ei , array_length ( ei ) ) ;
2015-12-09 03:49:44 +00:00
atmarp_handle = create_dissector_handle ( dissect_atmarp , proto_atmarp ) ;
ax25arp_handle = create_dissector_handle ( dissect_ax25arp , proto_arp ) ;
2003-08-17 01:05:21 +00:00
2015-12-09 04:04:01 +00:00
arp_handle = register_dissector ( " arp " , dissect_arp , proto_arp ) ;
2006-10-20 14:20:22 +00:00
/* Preferences */
arp_module = prefs_register_protocol ( proto_arp , NULL ) ;
prefs_register_bool_preference ( arp_module , " detect_request_storms " ,
2009-03-29 22:16:26 +00:00
" Detect ARP request storms " ,
" Attempt to detect excessive rate of ARP requests " ,
& global_arp_detect_request_storm ) ;
2006-10-20 14:20:22 +00:00
prefs_register_uint_preference ( arp_module , " detect_storm_number_of_packets " ,
2009-03-29 22:16:26 +00:00
" Number of requests to detect during period " ,
" Number of requests needed within period to indicate a storm " ,
10 , & global_arp_detect_request_storm_packets ) ;
2006-10-20 14:20:22 +00:00
prefs_register_uint_preference ( arp_module , " detect_storm_period " ,
2009-03-29 22:16:26 +00:00
" Detection period (in ms) " ,
" Period in milliseconds during which a packet storm may be detected " ,
10 , & global_arp_detect_request_storm_period ) ;
2007-12-19 10:49:22 +00:00
prefs_register_bool_preference ( arp_module , " detect_duplicate_ips " ,
2009-03-29 22:16:26 +00:00
" Detect duplicate IP address configuration " ,
" Attempt to detect duplicate use of IP addresses " ,
& global_arp_detect_duplicate_ip_addresses ) ;
2007-12-19 10:49:22 +00:00
2016-01-18 15:00:29 +00:00
prefs_register_bool_preference ( arp_module , " register_network_address_binding " ,
" Register network address mappings " ,
" Try to resolve physical addresses to host names from ARP requests/responses " ,
& global_arp_register_network_address_binding ) ;
2007-12-19 10:49:22 +00:00
/* TODO: define a minimum time between sightings that is worth reporting? */
2017-02-02 04:13:42 +00:00
address_hash_table = wmem_map_new_autoreset ( wmem_epan_scope ( ) , wmem_file_scope ( ) , address_hash_func , address_equal_func ) ;
duplicate_result_hash_table = wmem_map_new_autoreset ( wmem_epan_scope ( ) , wmem_file_scope ( ) , duplicate_result_hash_func ,
duplicate_result_equal_func ) ;
2016-10-26 16:07:47 +00:00
arp_cap_handle = register_capture_dissector ( " arp " , capture_arp , proto_arp ) ;
1999-07-29 05:47:07 +00:00
}
Change the sub-dissector handoff registration routines so that the
sub-dissector table is not stored in the header_field_info struct, but
in a separate namespace. Dissector tables are now registered by name
and not by field ID. For example:
udp_dissector_table = register_dissector_table("udp.port");
Because of this different namespace, dissector tables can have names
that are not field names. This is useful for ethertype, since multiple
fields are "ethertypes".
packet-ethertype.c replaces ethertype.c (the name was changed so that it
would be named in the same fashion as all the filenames passed to make-reg-dotc)
Although it registers no protocol or field, it registers one dissector table:
ethertype_dissector_table = register_dissector_table("ethertype");
All protocols that can be called because of an ethertype field now register
that fact with dissector_add() calls.
In this way, one dissector_table services all ethertype fields
(hf_eth_type, hf_llc_type, hf_null_etype, hf_vlan_etype)
Furthermore, the code allows for names of protocols to exist in the
etype_vals, yet a dissector for that protocol doesn't exist. The name
of the dissector is printed in COL_INFO. You're welcome, Richard. :-)
svn path=/trunk/; revision=1848
2000-04-13 18:18:56 +00:00
void
proto_reg_handoff_arp ( void )
{
2010-12-20 05:35:29 +00:00
dissector_add_uint ( " ethertype " , ETHERTYPE_ARP , arp_handle ) ;
dissector_add_uint ( " ethertype " , ETHERTYPE_REVARP , arp_handle ) ;
dissector_add_uint ( " arcnet.protocol_id " , ARCNET_PROTO_ARP_1051 , arp_handle ) ;
dissector_add_uint ( " arcnet.protocol_id " , ARCNET_PROTO_ARP_1201 , arp_handle ) ;
dissector_add_uint ( " arcnet.protocol_id " , ARCNET_PROTO_RARP_1201 , arp_handle ) ;
2012-08-03 01:58:12 +00:00
dissector_add_uint ( " ax25.pid " , AX25_P_ARP , arp_handle ) ;
2016-05-18 20:55:26 +00:00
dissector_add_uint ( " gre.proto " , ETHERTYPE_ARP , arp_handle ) ;
2016-10-26 16:07:47 +00:00
capture_dissector_add_uint ( " ethertype " , ETHERTYPE_ARP , arp_cap_handle ) ;
capture_dissector_add_uint ( " ax25.pid " , AX25_P_ARP , arp_cap_handle ) ;
Change the sub-dissector handoff registration routines so that the
sub-dissector table is not stored in the header_field_info struct, but
in a separate namespace. Dissector tables are now registered by name
and not by field ID. For example:
udp_dissector_table = register_dissector_table("udp.port");
Because of this different namespace, dissector tables can have names
that are not field names. This is useful for ethertype, since multiple
fields are "ethertypes".
packet-ethertype.c replaces ethertype.c (the name was changed so that it
would be named in the same fashion as all the filenames passed to make-reg-dotc)
Although it registers no protocol or field, it registers one dissector table:
ethertype_dissector_table = register_dissector_table("ethertype");
All protocols that can be called because of an ethertype field now register
that fact with dissector_add() calls.
In this way, one dissector_table services all ethertype fields
(hf_eth_type, hf_llc_type, hf_null_etype, hf_vlan_etype)
Furthermore, the code allows for names of protocols to exist in the
etype_vals, yet a dissector for that protocol doesn't exist. The name
of the dissector is printed in COL_INFO. You're welcome, Richard. :-)
svn path=/trunk/; revision=1848
2000-04-13 18:18:56 +00:00
}
2014-09-28 23:25:09 +00:00
/*
* Editor modelines - http : //www.wireshark.org/tools/modelines.html
*
* Local Variables :
* c - basic - offset : 2
* tab - width : 8
* indent - tabs - mode : nil
* End :
*
* ex : set shiftwidth = 2 tabstop = 8 expandtab :
* : indentSize = 2 : tabSize = 8 : noTabs = true :
*/