epan/dissectors/packet-cisco-marker.c

   1 /* packet-cisco-marker.c
   2  * Routines for CISCO's ERSPAN3 Marker Packet
   3  * See: http://www.cisco.com/c/en/us/products/collateral/switches/nexus-9000-series-switches/white-paper-c11-733921.html#_Toc413144488
   4  * See: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/93x/system-management/b-cisco-nexus-9000-series-nx-os-system-management-configuration-guide-93x/b-cisco-nexus-9000-series-nx-os-system-management-configuration-guide-93x_chapter_011110.html
   5  * Copyright 2015, Peter Membrey
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * Copied from packet-time.c
  12  * Fixed with additional documentation from Cisco and real-life observations
  13  * by Stéphane Lapie <stephane.lapie@darkbsd.org>
  14  *
  15  * SPDX-License-Identifier: GPL-2.0-or-later
  16  */
  17 #include "config.h"
  18
  19 #include <epan/packet.h>
  20
  21 void proto_register_erspan_marker(void);
  22 void proto_reg_handoff_erspan_marker(void);
  23
  24
  25 static dissector_handle_t marker_handle;
  26
  27 static int proto_marker;
  28
  29 static int hf_cisco_erspan_granularity;
  30 static int hf_cisco_erspan_info;
  31 static int hf_cisco_erspan_prop_header;
  32 static int hf_cisco_erspan_reserved;
  33 static int hf_cisco_erspan_sequence_number;
  34 static int hf_cisco_erspan_ssid;
  35 static int hf_cisco_erspan_tail;
  36 static int hf_cisco_erspan_timestamp;
  37 static int hf_cisco_erspan_type;
  38 static int hf_cisco_erspan_utc_sec;
  39 static int hf_cisco_erspan_utc_usec;
  40 static int hf_cisco_erspan_utcoffset;
  41 static int hf_cisco_erspan_version;
  42
  43
  44 static int ett_marker;
  45
  46
  47 static int
  48 dissect_marker(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
  49 {
  50   proto_tree    *marker_tree;
  51   proto_item    *ti;
  52
  53   col_set_str(pinfo->cinfo, COL_PROTOCOL, "CISCO ERSPAN3 MARKER");
  54
  55
  56   if (tree) {
  57
  58     /* Skip the proprietary CISCO header - no docs have been released for this */
  59     uint32_t offset = 20;
  60
  61     ti = proto_tree_add_item(tree, proto_marker, tvb, 0, -1, ENC_NA);
  62     marker_tree = proto_item_add_subtree(ti, ett_marker);
  63
  64     proto_tree_add_item(marker_tree, hf_cisco_erspan_prop_header, tvb, 0, 20, ENC_NA);
  65     proto_tree_add_item(marker_tree, hf_cisco_erspan_info, tvb, offset, 2, ENC_LITTLE_ENDIAN);
  66     offset += 2;
  67
  68     proto_tree_add_item(marker_tree, hf_cisco_erspan_version, tvb, offset, 2, ENC_BIG_ENDIAN);
  69     proto_tree_add_item(marker_tree, hf_cisco_erspan_type, tvb, offset, 2, ENC_BIG_ENDIAN);
  70     proto_tree_add_item(marker_tree, hf_cisco_erspan_ssid, tvb, offset, 2, ENC_BIG_ENDIAN);
  71     offset += 2;
  72
  73     proto_tree_add_item(marker_tree, hf_cisco_erspan_granularity, tvb, offset, 2, ENC_BIG_ENDIAN);
  74     proto_tree_add_item(marker_tree, hf_cisco_erspan_utcoffset, tvb, offset, 2, ENC_BIG_ENDIAN);
  75     offset+= 2;
  76
  77     proto_tree_add_item(marker_tree, hf_cisco_erspan_timestamp, tvb, offset, 8, ENC_BIG_ENDIAN);
  78     offset+=8;
  79
  80     proto_tree_add_item(marker_tree, hf_cisco_erspan_utc_sec, tvb, offset, 4, ENC_BIG_ENDIAN);
  81     offset+=4;
  82
  83     proto_tree_add_item(marker_tree, hf_cisco_erspan_utc_usec, tvb, offset, 4, ENC_BIG_ENDIAN);
  84     offset+=4;
  85
  86     proto_tree_add_item(marker_tree, hf_cisco_erspan_sequence_number, tvb, offset, 4, ENC_LITTLE_ENDIAN);
  87     offset+=4;
  88
  89     proto_tree_add_item(marker_tree, hf_cisco_erspan_reserved, tvb, offset, 4, ENC_LITTLE_ENDIAN);
  90     offset+=4;
  91
  92     proto_tree_add_item(marker_tree, hf_cisco_erspan_tail, tvb, offset, 8, ENC_BIG_ENDIAN);
  93   }
  94   return tvb_captured_length(tvb);
  95 }
  96
  97
  98 void
  99 proto_register_erspan_marker(void)
 100 {
 101   static hf_register_info hf[] = {
 102     { &hf_cisco_erspan_prop_header,
 103       { "Proprietary CISCO Header", "erspan-marker.prop_header",
 104         FT_BYTES, BASE_NONE, NULL, 0x0,
 105         NULL, HFILL }
 106     },
 107     { &hf_cisco_erspan_info,
 108       { "Header", "erspan-marker.header",
 109         FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 110         NULL, HFILL }
 111     },
 112     { &hf_cisco_erspan_version,
 113       { "Version", "erspan-marker.version",
 114         FT_UINT16, BASE_DEC, NULL, 0x0f00,
 115         NULL, HFILL }
 116     },
 117     { &hf_cisco_erspan_type,
 118       { "Type", "erspan-marker.type",
 119         FT_UINT16, BASE_DEC, NULL, 0xf000,
 120         NULL, HFILL }
 121     },
 122     { &hf_cisco_erspan_ssid,
 123       { "SSID", "erspan-marker.ssid",
 124         FT_UINT16, BASE_DEC, NULL, 0x00ff,
 125         NULL, HFILL }
 126     },
 127     { &hf_cisco_erspan_granularity,
 128       { "Granularity", "erspan-marker.granularity",
 129         FT_UINT16, BASE_DEC, NULL, 0xff00,
 130         NULL, HFILL }
 131     },
 132     { &hf_cisco_erspan_utcoffset,
 133       { "UTC Offset", "erspan-marker.utc_offset",
 134         FT_UINT16, BASE_DEC, NULL, 0x00ff,
 135         NULL, HFILL }
 136     },
 137     /* Timestamp is actually a 48-bit value, packed across 2 32-bit integers
 138      * Timestamp_hi : 0000 ffff (high 16-bits)
 139      * Timestamp_lo : ffff ffff (low 32-bits) */
 140     { &hf_cisco_erspan_timestamp,
 141       { "ASIC 48-bit Timestamp", "erspan-marker.timestamp",
 142         FT_UINT48, BASE_DEC, NULL, 0xffffffffffff,
 143         NULL, HFILL }
 144     },
 145     /* Comparison between the actual packet arrival time and this field
 146      * indicated that the Ethernet packet's arrival time was behind
 147      * the below field value by the value of the  UTC offset
 148      * (37 seconds as of Nov 2021) */
 149     { &hf_cisco_erspan_utc_sec,
 150       { "UTC Seconds", "erspan-marker.utc_sec",
 151         FT_UINT32, BASE_DEC, NULL, 0x0,
 152         NULL, HFILL }
 153     },
 154     { &hf_cisco_erspan_utc_usec,
 155       { "UTC Microseconds", "erspan-marker.utc_usec",
 156         FT_UINT32, BASE_DEC, NULL, 0x0,
 157         NULL, HFILL }
 158     },
 159     { &hf_cisco_erspan_sequence_number,
 160       { "Sequence Number", "erspan-marker.sequence_number",
 161         FT_UINT32, BASE_DEC, NULL, 0x0,
 162         NULL, HFILL }
 163     },
 164     { &hf_cisco_erspan_reserved,
 165       { "Reserved", "erspan-marker.reserved",
 166         FT_UINT32, BASE_HEX, NULL, 0x0,
 167         NULL, HFILL }
 168     },
 169     /* The 32-bit signature is expected to be 0xA5A5A5A5,
 170      * and while the Cisco documentation does not mention packing details,
 171      * it does mention padding values to enforce alignment */
 172     { &hf_cisco_erspan_tail,
 173       { "TAIL", "erspan-marker.tail",
 174         FT_UINT64, BASE_HEX, NULL, 0x00000000ffffffff,
 175         NULL, HFILL }
 176     },
 177   };
 178
 179   static int *ett[] = {
 180     &ett_marker,
 181   };
 182
 183
 184   proto_marker = proto_register_protocol("CISCO ERSPAN3 Marker Packet", "CISCO3 ERSPAN MARKER", "erspan-marker");
 185
 186   proto_register_field_array(proto_marker, hf, array_length(hf));
 187   proto_register_subtree_array(ett, array_length(ett));
 188
 189   marker_handle = register_dissector("erspan-marker", dissect_marker, proto_marker);
 190 }
 191
 192 void
 193 proto_reg_handoff_erspan_marker(void)
 194 {
 195   dissector_add_for_decode_as_with_preference("udp.port", marker_handle);
 196 }
 197
 198 /*
 199  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 200  *
 201  * Local Variables:
 202  * c-basic-offset: 2
 203  * tab-width: 8
 204  * indent-tabs-mode: nil
 205  * End:
 206  *
 207  * ex: set shiftwidth=2 tabstop=8 expandtab:
 208  * :indentSize=2:tabSize=8:noTabs=true:
 209  */