wiretap/atm.c

   1 /* atm.c
   2  *
   3  * Wiretap Library
   4  * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
   5  *
   6  * SPDX-License-Identifier: GPL-2.0-or-later
   7  */
   8
   9 #include "config.h"
  10 #include "atm.h"
  11 #include "wtap-int.h"
  12
  13 /*
  14  * Routines to use with ATM capture file types that don't include information
  15  * about the *type* of ATM traffic (or, at least, where we haven't found
  16  * that information).
  17  *
  18  * We assume the traffic is AAL5, unless it's VPI 0/VCI 5, in which case
  19  * we assume it's the signalling AAL.
  20  */
  21
  22 void
  23 atm_guess_traffic_type(wtap_rec *rec, const uint8_t *pd)
  24 {
  25         /*
  26          * Start out assuming nothing other than that it's AAL5.
  27          */
  28         rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_5;
  29         rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_UNKNOWN;
  30         rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
  31
  32         if (rec->rec_header.packet_header.pseudo_header.atm.vpi == 0) {
  33                 /*
  34                  * Traffic on some PVCs with a VPI of 0 and certain
  35                  * VCIs is of particular types.
  36                  */
  37                 switch (rec->rec_header.packet_header.pseudo_header.atm.vci) {
  38
  39                 case 5:
  40                         /*
  41                          * Signalling AAL.
  42                          */
  43                         rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_SIGNALLING;
  44                         return;
  45
  46                 case 16:
  47                         /*
  48                          * ILMI.
  49                          */
  50                         rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_ILMI;
  51                         return;
  52                 }
  53         }
  54
  55         /*
  56          * OK, we can't tell what it is based on the VPI/VCI; try
  57          * guessing based on the contents, if we have enough data
  58          * to guess.
  59          */
  60
  61         if (rec->rec_header.packet_header.caplen >= 3) {
  62                 if (pd[0] == 0xaa && pd[1] == 0xaa && pd[2] == 0x03) {
  63                         /*
  64                          * Looks like a SNAP header; assume it's LLC
  65                          * multiplexed RFC 1483 traffic.
  66                          */
  67                         rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_LLCMX;
  68                 } else if ((rec->rec_header.packet_header.pseudo_header.atm.aal5t_len && rec->rec_header.packet_header.pseudo_header.atm.aal5t_len < 16) ||
  69                     rec->rec_header.packet_header.caplen < 16) {
  70                         /*
  71                          * As this cannot be a LANE Ethernet frame (less
  72                          * than 2 bytes of LANE header + 14 bytes of
  73                          * Ethernet header) we can try it as a SSCOP frame.
  74                          */
  75                         rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_SIGNALLING;
  76                 } else if (pd[0] == 0x83 || pd[0] == 0x81) {
  77                         /*
  78                          * MTP3b headers often encapsulate
  79                          * a SCCP or MTN in the 3G network.
  80                          * This should cause 0x83 or 0x81
  81                          * in the first byte.
  82                          */
  83                         rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_SIGNALLING;
  84                 } else {
  85                         /*
  86                          * Assume it's LANE.
  87                          */
  88                         rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_LANE;
  89                         atm_guess_lane_type(rec, pd);
  90                 }
  91         } else {
  92                /*
  93                 * Not only VCI 5 is used for signaling. It might be
  94                 * one of these VCIs.
  95                 */
  96                rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_SIGNALLING;
  97         }
  98 }
  99
 100 void
 101 atm_guess_lane_type(wtap_rec *rec, const uint8_t *pd)
 102 {
 103         if (rec->rec_header.packet_header.caplen >= 2) {
 104                 if (pd[0] == 0xff && pd[1] == 0x00) {
 105                         /*
 106                          * Looks like LE Control traffic.
 107                          */
 108                         rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_LANE_LE_CTRL;
 109                 } else {
 110                         /*
 111                          * XXX - Ethernet, or Token Ring?
 112                          * Assume Ethernet for now; if we see earlier
 113                          * LANE traffic, we may be able to figure out
 114                          * the traffic type from that, but there may
 115                          * still be situations where the user has to
 116                          * tell us.
 117                          */
 118                         rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_LANE_802_3;
 119                 }
 120         }
 121 }
 122
 123 /*
 124  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 125  *
 126  * Local variables:
 127  * c-basic-offset: 8
 128  * tab-width: 8
 129  * indent-tabs-mode: t
 130  * End:
 131  *
 132  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 133  * :indentSize=8:tabSize=8:noTabs=false:
 134  */