317 lines
9.9 KiB
C
317 lines
9.9 KiB
C
/* packet-extreme-internal-eth.c
|
|
* Routines for the disassembly of Extreme Networks internal
|
|
* Ethernet capture headers
|
|
*
|
|
* Copyright 2021 Joerg Mayer (see AUTHORS file)
|
|
*
|
|
* Wireshark - Network traffic analyzer
|
|
* By Gerald Combs <gerald@wireshark.org>
|
|
* Copyright 1998 Gerald Combs
|
|
*
|
|
* SPDX-License-Identifier: GPL-2.0-or-later
|
|
*/
|
|
|
|
/*
|
|
* It is possible to create internal capture in EXOS with
|
|
* debug packet capture ...
|
|
*
|
|
* List of interfaces on all VRs:
|
|
* run script shell.py cat /proc/net/dev
|
|
* on older software the following should work as well:
|
|
* debug packet capture on cmd-args "-D -1"
|
|
*
|
|
* See:
|
|
* https://extremeportal.force.com/ExtrArticleDetail?an=000079573
|
|
* https://extremeportal.force.com/ExtrArticleDetail?an=000082238
|
|
* https://extremeportal.force.com/ExtrArticleDetail?an=000079220
|
|
*
|
|
* This capture begins with an internal header (maybe containing some HiGig variant?),
|
|
* followed by the "original" Ethernet frame.
|
|
*/
|
|
|
|
/*
|
|
* TODO
|
|
* 00 - 01: Unknown
|
|
* always zero for incoming(?)
|
|
* often non-zero for outgoing
|
|
* 10 - 23: Unknown (traffic properties?)
|
|
* 28 - 29: Unknown
|
|
* always zero(?)
|
|
* 32 - 33: Unknown
|
|
* always zero(?)
|
|
*/
|
|
|
|
#include "config.h"
|
|
|
|
#include <epan/packet.h>
|
|
#include <epan/etypes.h>
|
|
#include <epan/expert.h>
|
|
|
|
void proto_register_exeh(void);
|
|
void proto_reg_handoff_exeh(void);
|
|
|
|
static dissector_handle_t ethnofcs_handle;
|
|
|
|
static int proto_exeh = -1;
|
|
/* EXEH data */
|
|
static int hf_exeh_unknown_00_01 = -1;
|
|
static int hf_exeh_module1 = -1;
|
|
static int hf_exeh_port1 = -1;
|
|
static int hf_exeh_module2 = -1; /* m2 + p2 always zero for outgoing(?) */
|
|
static int hf_exeh_port2 = -1;
|
|
static int hf_exeh_unknown_10_16 = -1;
|
|
static int hf_exeh_unknown_17_0xfd = -1;
|
|
static int hf_exeh_unknown_17_0x02 = -1;
|
|
static int hf_exeh_unknown_18_21 = -1;
|
|
static int hf_exeh_unknown_22_23 = -1;
|
|
static int hf_exeh_incoming_framesource = -1;
|
|
static int hf_exeh_outgoing_framesource = -1;
|
|
static int hf_exeh_vlan = -1;
|
|
static int hf_exeh_unknown_28_29 = -1;
|
|
static int hf_exeh_dir = -1;
|
|
static int hf_exeh_unknown_32_33 = -1;
|
|
static int hf_exeh_etype = -1;
|
|
static int hf_exeh_etypelen = -1;
|
|
static int hf_exeh_etypedata = -1;
|
|
|
|
static expert_field ei_exeh_unexpected_value = EI_INIT;
|
|
static expert_field ei_exeh_unequal_ports = EI_INIT;
|
|
static expert_field ei_exeh_incoming_framesource = EI_INIT;
|
|
static expert_field ei_exeh_outgoing_framesource = EI_INIT;
|
|
|
|
static gint ett_exeh = -1;
|
|
|
|
#define PROTO_SHORT_NAME "EXEH"
|
|
#define PROTO_LONG_NAME "EXtreme extra Eth Header"
|
|
|
|
static const value_string exeh_direction_vals[] = {
|
|
{0x07, "Incoming"},
|
|
{0xff, "Outgoing"},
|
|
|
|
{0, NULL},
|
|
};
|
|
|
|
static const value_string exeh_outgoing_vlanid_vals[] = {
|
|
{0x0000, "No tag or VLAN ID = 0"},
|
|
{0x000f, "Has VLAN ID"},
|
|
|
|
{0, NULL},
|
|
};
|
|
|
|
static const value_string exeh_incoming_framesource_vals[] = {
|
|
{0x0000, "N/A"},
|
|
|
|
{0, NULL},
|
|
};
|
|
|
|
static const value_string exeh_outgoing_framesource_vals[] = {
|
|
{0x0000, "CPU"},
|
|
{0x4248, "Broadcom Hardware"},
|
|
|
|
{0, NULL},
|
|
};
|
|
|
|
|
|
static int
|
|
dissect_exeh(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
|
|
{
|
|
proto_item *ti;
|
|
proto_tree *exeh_tree;
|
|
guint32 offset = 0;
|
|
guint32 etype, module1, port1, module2, port2, direction, framesource;
|
|
gint32 databytes;
|
|
tvbuff_t *frame_tvb;
|
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, PROTO_SHORT_NAME);
|
|
col_set_str(pinfo->cinfo, COL_INFO, PROTO_SHORT_NAME ":");
|
|
|
|
ti = proto_tree_add_item(tree, proto_exeh, tvb, offset, -1,
|
|
ENC_NA);
|
|
exeh_tree = proto_item_add_subtree(ti, ett_exeh);
|
|
|
|
direction = tvb_get_ntohs(tvb, 30);
|
|
proto_tree_add_item(exeh_tree, hf_exeh_unknown_00_01, tvb, offset, 2, ENC_NA);
|
|
offset += 2;
|
|
proto_tree_add_item_ret_uint(exeh_tree, hf_exeh_module1, tvb, offset, 2, ENC_BIG_ENDIAN, &module1);
|
|
offset += 2;
|
|
proto_tree_add_item_ret_uint(exeh_tree, hf_exeh_port1, tvb, offset, 2, ENC_BIG_ENDIAN, &port1);
|
|
offset += 2;
|
|
proto_tree_add_item_ret_uint(exeh_tree, hf_exeh_module2, tvb, offset, 2, ENC_BIG_ENDIAN, &module2);
|
|
offset += 2;
|
|
ti = proto_tree_add_item_ret_uint(exeh_tree, hf_exeh_port2, tvb, offset, 2, ENC_BIG_ENDIAN, &port2);
|
|
if ( !(direction == 255 && module2 == 0) && (module1 != module2 || port1 != port2) )
|
|
expert_add_info(pinfo, ti, &ei_exeh_unequal_ports);
|
|
offset += 2;
|
|
proto_tree_add_item(exeh_tree, hf_exeh_unknown_10_16, tvb, offset, 7, ENC_NA);
|
|
offset += 7;
|
|
proto_tree_add_item(exeh_tree, hf_exeh_unknown_17_0xfd, tvb, offset, 1, ENC_NA);
|
|
proto_tree_add_item(exeh_tree, hf_exeh_unknown_17_0x02, tvb, offset, 1, ENC_NA);
|
|
offset += 1;
|
|
proto_tree_add_item(exeh_tree, hf_exeh_unknown_18_21, tvb, offset, 4, ENC_NA);
|
|
offset += 4;
|
|
proto_tree_add_item(exeh_tree, hf_exeh_unknown_22_23, tvb, offset, 2, ENC_BIG_ENDIAN);
|
|
offset += 2;
|
|
if ( direction == 7 ) {
|
|
ti = proto_tree_add_item_ret_uint(exeh_tree, hf_exeh_incoming_framesource, tvb, offset, 2, ENC_BIG_ENDIAN, &framesource);
|
|
if ( framesource != 0 )
|
|
expert_add_info(pinfo, ti, &ei_exeh_incoming_framesource);
|
|
} else { /* Direction == 255 */
|
|
ti = proto_tree_add_item_ret_uint(exeh_tree, hf_exeh_outgoing_framesource, tvb, offset, 2, ENC_BIG_ENDIAN, &framesource);
|
|
if ( framesource != 0 && framesource != 0x4248 )
|
|
expert_add_info(pinfo, ti, &ei_exeh_outgoing_framesource);
|
|
}
|
|
offset += 2;
|
|
proto_tree_add_item(exeh_tree, hf_exeh_vlan, tvb, offset, 2, ENC_BIG_ENDIAN);
|
|
offset += 2;
|
|
proto_tree_add_item(exeh_tree, hf_exeh_unknown_28_29, tvb, offset, 2, ENC_NA);
|
|
offset += 2;
|
|
proto_tree_add_item(exeh_tree, hf_exeh_dir, tvb, offset, 2, ENC_BIG_ENDIAN);
|
|
offset += 2;
|
|
proto_tree_add_item(exeh_tree, hf_exeh_unknown_32_33, tvb, offset, 2, ENC_NA);
|
|
offset += 2;
|
|
proto_tree_add_item_ret_uint(exeh_tree, hf_exeh_etype, tvb, offset, 2, ENC_BIG_ENDIAN, &etype);
|
|
switch (etype) {
|
|
case 0x8100: /* VLAN/VMAN Tag */
|
|
ti = proto_tree_add_item_ret_int(exeh_tree, hf_exeh_etypelen, tvb, offset+2, 2, ENC_BIG_ENDIAN, &databytes);
|
|
if (tvb_reported_length_remaining(tvb, offset) != databytes)
|
|
expert_add_info(pinfo, ti, &ei_exeh_unexpected_value);
|
|
break;
|
|
default:
|
|
proto_tree_add_item(exeh_tree, hf_exeh_etypedata, tvb, offset+2, 2, ENC_BIG_ENDIAN);
|
|
}
|
|
offset += 4;
|
|
|
|
frame_tvb = tvb_new_subset_remaining(tvb, offset);
|
|
call_dissector(ethnofcs_handle, frame_tvb, pinfo, tree);
|
|
|
|
return tvb_captured_length(tvb);
|
|
}
|
|
|
|
void
|
|
proto_register_exeh(void)
|
|
{
|
|
static hf_register_info hf[] = {
|
|
|
|
/* EXEH data */
|
|
{ &hf_exeh_unknown_00_01,
|
|
{ "Unknown_00", "exeh.unknown00", FT_BYTES, BASE_NONE, NULL,
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_module1,
|
|
{ "Module", "exeh.module1", FT_UINT16, BASE_DEC, NULL,
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_port1,
|
|
{ "Port", "exeh.port1", FT_UINT16, BASE_DEC, NULL,
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_module2,
|
|
{ "Module", "exeh.module2", FT_UINT16, BASE_DEC, NULL,
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_port2,
|
|
{ "Port", "exeh.port2", FT_UINT16, BASE_DEC, NULL,
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_unknown_10_16,
|
|
{ "Unknown_10 (incoming specific?)", "exeh.unknown10", FT_BYTES, BASE_NONE, NULL,
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_unknown_17_0xfd,
|
|
{ "Unknown_17", "exeh.unknown17", FT_UINT8, BASE_HEX, NULL,
|
|
0xfd, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_unknown_17_0x02,
|
|
{ "Unknown_17 (Add dot1Q?)", "exeh.unknown17.dot1q", FT_BOOLEAN, 8, TFS(&tfs_no_yes),
|
|
0x02, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_unknown_18_21,
|
|
{ "Unknown_18 (outgoing specific?)", "exeh.unknown18", FT_BYTES, BASE_NONE, NULL,
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_unknown_22_23,
|
|
{ "Add VLAN ID?", "exeh.unknown22", FT_UINT16, BASE_NONE, VALS(exeh_outgoing_vlanid_vals),
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_incoming_framesource,
|
|
{ "Frame source", "exeh.framesource", FT_UINT16, BASE_HEX, VALS(exeh_incoming_framesource_vals),
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_outgoing_framesource,
|
|
{ "Frame source", "exeh.framesource", FT_UINT16, BASE_HEX, VALS(exeh_outgoing_framesource_vals),
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_vlan,
|
|
{ "Transport VLAN", "exeh.vlan", FT_UINT16, BASE_DEC, NULL,
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_unknown_28_29,
|
|
{ "Unknown_28", "exeh.unknown28", FT_BYTES, BASE_NONE, NULL,
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_dir,
|
|
{ "Direction", "exeh.direction", FT_UINT16, BASE_HEX, VALS(exeh_direction_vals),
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_unknown_32_33,
|
|
{ "Unknown_32", "exeh.unknown32", FT_BYTES, BASE_NONE, NULL,
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_etype,
|
|
{ "Etype", "exeh.etype", FT_UINT16, BASE_HEX, NULL,
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_etypedata,
|
|
{ "Etype data", "exeh.etypedata", FT_UINT16, BASE_HEX, NULL,
|
|
0x0, NULL, HFILL }},
|
|
|
|
{ &hf_exeh_etypelen,
|
|
{ "Length", "exeh.etypelen", FT_INT16, BASE_DEC, NULL,
|
|
0x0, "Bytes from 8100 to end of frame", HFILL }},
|
|
};
|
|
|
|
|
|
static gint *ett[] = {
|
|
&ett_exeh,
|
|
};
|
|
|
|
static ei_register_info ei[] = {
|
|
{ &ei_exeh_unexpected_value, { "exeh.unexpected_value", PI_PROTOCOL, PI_WARN, "Unexpected length", EXPFILL }},
|
|
{ &ei_exeh_unequal_ports, { "exeh.unequal_ports", PI_PROTOCOL, PI_WARN, "Unequal ports", EXPFILL }},
|
|
{ &ei_exeh_incoming_framesource, { "exeh.incoming_framesource", PI_PROTOCOL, PI_WARN, "Incoming framesource non-zero", EXPFILL }},
|
|
{ &ei_exeh_outgoing_framesource, { "exeh.outgoing_framesource", PI_PROTOCOL, PI_WARN, "Outgoing framesource unknown magic", EXPFILL }},
|
|
};
|
|
|
|
expert_module_t* expert_exeh;
|
|
|
|
proto_exeh = proto_register_protocol(PROTO_LONG_NAME, PROTO_SHORT_NAME, "exeh");
|
|
proto_register_field_array(proto_exeh, hf, array_length(hf));
|
|
proto_register_subtree_array(ett, array_length(ett));
|
|
expert_exeh = expert_register_protocol(proto_exeh);
|
|
expert_register_field_array(expert_exeh, ei, array_length(ei));
|
|
}
|
|
|
|
void
|
|
proto_reg_handoff_exeh(void)
|
|
{
|
|
dissector_handle_t exeh_handle;
|
|
|
|
ethnofcs_handle = find_dissector_add_dependency("eth_withoutfcs", proto_exeh);
|
|
|
|
exeh_handle = create_dissector_handle(dissect_exeh, proto_exeh);
|
|
dissector_add_uint("ethertype", ETHERTYPE_EXEH, exeh_handle);
|
|
}
|
|
|
|
/*
|
|
* Editor modelines - https://www.wireshark.org/tools/modelines.html
|
|
*
|
|
* Local variables:
|
|
* c-basic-offset: 8
|
|
* tab-width: 8
|
|
* indent-tabs-mode: t
|
|
* End:
|
|
*
|
|
* vi: set shiftwidth=8 tabstop=8 noexpandtab:
|
|
* :indentSize=8:tabSize=8:noTabs=false:
|
|
*/
|