4 * Copyright (c) 1991, 1993, 1994, 1995, 1996, 1997
5 * The Regents of the University of California. All rights reserved.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that: (1) source code distributions
9 * retain the above copyright notice and this paragraph in its entirety, (2)
10 * distributions including binary code include the above copyright notice and
11 * this paragraph in its entirety in the documentation or other materials
12 * provided with the distribution, and (3) all advertising materials mentioning
13 * features or use of this software display the following acknowledgement:
14 * ``This product includes software developed by the University of California,
15 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
16 * the University nor the names of its contributors may be used to endorse
17 * or promote products derived from this software without specific prior
19 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
20 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
21 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
24 #include <sys/cdefs.h>
27 static const char rcsid
[] _U_
=
28 "@(#) Header: /tcpdump/master/tcpdump/print-null.c,v 1.53.2.4 2007/02/26 13:31:33 hannes Exp (LBL)";
30 __RCSID("$NetBSD: tcpdump2rcsid.ex,v 1.1 2001/06/25 20:09:58 itojun Exp $");
38 #include <tcpdump-stdinc.h>
44 #include "interface.h"
45 #include "addrtoname.h"
54 * The DLT_NULL packet header is 4 bytes long. It contains a host-byte-order
55 * 32-bit integer that specifies the family, e.g. AF_INET.
57 * Note here that "host" refers to the host on which the packets were
58 * captured; that isn't necessarily *this* host.
60 * The OpenBSD DLT_LOOP packet header is the same, except that the integer
61 * is in network byte order.
67 * Byte-swap a 32-bit number.
68 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on
69 * big-endian platforms.)
72 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
75 null_hdr_print(u_int family
, u_int length
)
78 (void)printf("AF %s (%u)",
79 tok2str(bsd_af_values
,"Unknown",family
),family
);
82 tok2str(bsd_af_values
,"Unknown AF %u",family
));
85 (void)printf(", length %u: ", length
);
89 * This is the top level routine of the printer. 'p' points
90 * to the ether header of the packet, 'h->ts' is the timestamp,
91 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
92 * is the number of bytes actually captured.
95 null_if_print(const struct pcap_pkthdr
*h
, const u_char
*p
)
97 u_int length
= h
->len
;
98 u_int caplen
= h
->caplen
;
101 if (caplen
< NULL_HDRLEN
) {
103 return (NULL_HDRLEN
);
106 memcpy((char *)&family
, (char *)p
, sizeof(family
));
109 * This isn't necessarily in our host byte order; if this is
110 * a DLT_LOOP capture, it's in network byte order, and if
111 * this is a DLT_NULL capture from a machine with the opposite
112 * byte-order, it's in the opposite byte order from ours.
114 * If the upper 16 bits aren't all zero, assume it's byte-swapped.
116 if ((family
& 0xFFFF0000) != 0)
117 family
= SWAPLONG(family
);
120 null_hdr_print(family
, length
);
122 length
-= NULL_HDRLEN
;
123 caplen
-= NULL_HDRLEN
;
129 ip_print(gndo
, p
, length
);
133 case BSD_AFNUM_INET6_BSD
:
134 case BSD_AFNUM_INET6_FREEBSD
:
135 case BSD_AFNUM_INET6_DARWIN
:
136 ip6_print(p
, length
);
141 isoclns_print(p
, length
, caplen
);
144 case BSD_AFNUM_APPLETALK
:
145 atalk_print(p
, length
);
149 ipx_print(p
, length
);
153 /* unknown AF_ value */
155 null_hdr_print(family
, length
+ NULL_HDRLEN
);
156 if (!suppress_default_print
)
157 default_print(p
, caplen
);
160 return (NULL_HDRLEN
);
165 * c-style: whitesmith