2 * Routines for netscaler GSLB metric exchange protocol dissection
3 * Copyright 2006, Ravi Kondamuru <Ravi.Kondamuru@citrix.com>
5 * Wireshark - Network traffic analyzer
6 * By Gerald Combs <gerald@wireshark.org>
7 * Copyright 1998 Gerald Combs
9 * SPDX-License-Identifier: GPL-2.0-or-later
14 #include <epan/packet.h>
15 #include <epan/to_str.h>
16 #include <epan/unit_strings.h>
18 #include <wsutil/array.h>
19 #include "packet-tcp.h"
21 void proto_register_ns_mep(void);
22 void proto_reg_handoff_ns_mep(void);
24 static dissector_handle_t nsmep_handle
;
26 static int proto_ns_mep
;
29 static int ett_nsmep_mfu
;
30 static int ett_nsmep_nwu
;
32 static int hf_nsmep_majver
;
33 static int hf_nsmep_minver
;
34 static int hf_nsmep_msgtype
;
35 static int hf_nsmep_msglen
;
36 static int hf_nsmep_errcode
;
37 static int hf_nsmep_mfu_state
;
40 static int hf_ns_metricUpdate
;
41 static int hf_ns_forceUpdateRequest
;
42 static int hf_ns_forceUpdateResp
;
43 static int hf_ns_currentOpenConn
;
44 static int hf_ns_currentSurgeCount
;
45 static int hf_ns_currentIOHCount
;
46 static int hf_ns_currentReusePool
;
47 static int hf_ns_currentServerConn
;
48 static int hf_ns_currentClientConn
;
49 static int hf_ns_TotalReq
;
50 static int hf_ns_TotalReqBytes
;
51 static int hf_ns_TotalResp
;
52 static int hf_ns_TotalRespBytes
;
53 static int hf_ns_networkMetrics
;
54 static int hf_ns_roundTripTime
;
55 static int hf_ns_hops
;
56 static int hf_ns_persistenceInfo
;
57 static int hf_ns_persistenceGslbServIp
;
58 static int hf_ns_persistenceGslbServPort
;
59 static int hf_ns_persistenceId
;
60 static int hf_ns_sitePersistenceDom
;
61 static int hf_ns_gslbDomNamelen
;
62 static int hf_ns_gslbServPreflen
;
63 static int hf_ns_gslbCookieDomNamelen
;
64 static int hf_ns_gslbCookieTimeout
;
65 static int hf_ns_gslbVidlen
;
66 static int hf_ns_gslbFlags
;
67 static int hf_ns_gslbCookieDomName
;
68 static int hf_ns_gslbVs
;
69 static int hf_ns_gslbPrefix
;
70 static int hf_ns_sitePersistenceFlushDom
;
71 static int hf_ns_gslbDomName
;
72 static int hf_ns_sitePersistenceFlushServ
;
73 static int hf_ns_sitePersisGetServReq
;
74 static int hf_ns_siteDomTTL
;
75 static int hf_ns_sitePersistenceGetServResp
;
79 static int hf_nsmep_mfu_ip
;
80 static int hf_nsmep_mfu_port
;
81 static int hf_nsmep_mfu_svctype
;
82 static int hf_nsmep_mfu_eff_state
;
83 static int hf_nsmep_mfu_mepflag
;
84 static int hf_nsmep_mfu_reqflag
;
86 static int hf_nsmep_adv_ip
;
88 static int hf_nsmep_ldns_ip
;
89 static int hf_nsmep_site_persistence
;
90 dissector_handle_t nsrpc_handle
;
92 /*GSLB MEP message types */
93 #define nslist_gslbmessage_VALUE_STRING_LIST(V) \
94 V(GSLB_MSG_NONE, 0, "NONE")\
95 V(GSLB_MSG_SITE_METRIC_UPDATE, 1, "SITE METRIC UPDATE") \
96 V(GSLB_MSG_SITE_METRIC_FORCE_REQ, 2, "SITE METRIC FORCE REQ")\
97 V(GSLB_MSG_SITE_ADV_IP_ADDR, 3, "SITE ADV IP ADDR")\
98 V(GSLB_MSG_SITE_ADV_IP_ACK, 4, "SITE ADV IP ACK")\
99 V(GSLB_MSG_SITE_ADV_IP_NACK, 5, "SITE ADV IP NACK")\
100 V(GSLB_MSG_SITE_METRIC_FORCE_UPDATE, 6, "SITE METRIC FORCE UPDATE")\
101 V(GSLB_MSG_NETW_METRIC_UPDATE, 7, "NETWORK METRIC UPDATE")\
102 V(GSLB_MSG_PERSIST_RECORD, 8, "PERSIST RECORD")\
103 V(GSLB_MSG_KEEP_ALIVE, 9, "KEEP ALIVE")\
104 V(GSLB_MSG_CNAME_PERSIST_RECORD, 10, "CNAME PERSIST RECORD")\
105 V(GSLB_MSG_LBNODE_DOM_INFO, 11, "DOMAIN INFO")\
106 V(GSLB_MSG_LBNODE_SITE_INFO, 12, "SITE INFO")\
107 V(GSLB_MSG_LBNODE_FLUSH_SVC_INFO, 13, "FLUSH SVC")\
108 V(GSLB_MSG_LBNODE_FLUSH_DOM_INFO, 14, "FLUSH DOMAIN")\
109 V(GSLB_MSG_LBNODE_GETSVC, 15, "GET SVC")\
110 V(GSLB_MSG_LBNODE_GETSVC_RESP, 16, "GET SVC RESP")\
112 VALUE_STRING_ENUM(nslist_gslbmessage);
113 VALUE_STRING_ARRAY(nslist_gslbmessage
);
115 static const value_string ns_entity_state_vals
[] = {
116 { 0x01, "SERVER_STATE_DOWN" },
117 { 0x02, "SERVER_STATE_UNKNOWN" },
118 { 0x03, "SERVER_STATE_BUSY" },
119 { 0x04, "SERVER_STATE_OFS" },
120 { 0x05, "SERVER_STATE_TROFS" },
121 { 0x07, "SERVER_STATE_UP" },
122 { 0x08, "SERVER_STATE_TROFS_DOWN" },
128 static const value_string ns_svc_type_vals
[] = {
129 { 0x00, "NSSVC_HTTP"},
130 { 0x01, "NSSVC_FTP"},
131 { 0x02, "NSSVC_TCP"},
132 { 0x03, "NSSVC_UDP"},
133 { 0x04, "NSSVC_SSL_BRIDGE"},
134 { 0x05, "NSSVC_MONITOR"},
135 { 0x06, "NSSVC_MONITOR_UDP"},
136 { 0x07, "NSSVC_NNTP"},
137 { 0x08, "NSSVC_HTTPSVR"},
138 { 0x09, "NSSVC_HTTPCLNT"},
139 { 0x0a, "NSSVC_RPCSVR"},
140 { 0x0b, "NSSVC_RPCCLNT"},
141 { 0x0c, "NSSVC_NAT"},
142 { 0x0d, "NSSVC_ANY"},
143 { 0x0e, "NSSVC_SSL"},
144 { 0x0f, "NSSVC_DNS"},
145 { 0x10, "NSSVC_ADNS"},
146 { 0x11, "NSSVC_SNMP"},
148 { 0x13, "NSSVC_MONITOR_PING"},
149 { 0x14, "NSSVC_SSL_TCP"},
150 { 0x15, "NSSVC_AAA"},
151 { 0x16, "NSSVC_SINCTCP"},
152 { 0x17, "NSSVC_VPN_AFTP"},
153 { 0x18, "NSSVC_MONITORS"},
154 { 0x19, "NSSVC_SSLVPNUDP"},
155 { 0x1a, "NSSVC_SINCUDP"},
156 { 0x1b, "NSSVC_RIP"},
157 { 0x1c, "NSSVC_DNSCLT"},
158 { 0x1d, "NSSVC_SASP"},
159 { 0x1e, "NSSVC_RPCSVRS"},
160 { 0x1f, "NSSVC_RPCCLNTS"},
161 { 0x20, "NSSVC_WINS_RESOLVER"},
162 { 0x21, "NSSVC_DHCPRA"},
163 { 0x22, "NSSVC_ROUTE"},
164 { 0x23, "NSSVC_AUDIT"},
165 { 0x24, "NSSVC_SIP_UDP"},
166 { 0x25, "NSSVC_STA_HTTP"},
167 { 0x26, "NSSVC_STA_SSL"},
168 { 0x27, "NSSVC_DNS_RESOLV"},
169 { 0x28, "NSSVC_RTSP"},
174 static const value_string ns_rpc_errcode_vals
[] = {
175 { 0x000, "SUCCESS" },
177 { 0x101, "PERM ERR" },
179 { 0x135, "CONN ABORTED" },
180 { 0x150, "AUTH ERR" },
182 { 0x154, "NOT SUPERUSER" },
183 { 0x155, "LARGE DATA"},
184 { 0x156, "SMALL DATA" },
185 { 0x160, "LOGIN REQD" },
186 { 0x161, "INVALID ARG" },
187 { 0x162, "INVALID USER/ PASSWD" },
188 { 0x163, "INVALID USER/ PASSWD" },
190 { 0x413, "INTERNAL ERR" },
197 static const value_string value_site_persistence
[] = {
199 { 0x01, "CONN-PROXY"},
200 { 0x02, "HTTP-REDIRECT"},
204 #define GSLIB_EXCHANGE_DATA_SIZE 72
205 #define GSLB_FORCE_VIP_SIZE 12
206 #define GSLIB_NET_MET_TABLE_SIZE 8
208 #define NS_PERSIST_INFO_SIZE 12
209 #define NS_GSLB_DOM_INFO_MIN_SIZE 23
210 #define NS_GSLB_FLUSH_DOM_INFO_MIN_SIZE 9
211 #define Ns_GSLB_MSG_SITE_METRIC_UPDATE_SIZE 16
213 /* XXX - for informational purposes only */
214 typedef struct nsgslb_dom_info
{
216 uint16_t public_port
;
220 uint8_t cookiedomlen
;
221 uint8_t site_persistence
;
222 uint8_t cookietimeout
;
228 /*gslb domain info flag values */
229 #define NSGSLB_DOMINFO_DOGSLB 0x01
230 #define NSGSLB_DOMINFO_REDIRECT 0x02
231 #define NSGSLB_DOMINFO_FLUSH_ALL_GSLBINFO 0x4
234 dissect_ns_mep_v02xx(tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
)
236 uint32_t maj_ver
, min_ver
, mesgtype
, mesglen
, errcode
;
237 uint32_t public_port
, svctype
, domainlen
;
239 proto_tree
*ns_mep_tree
;
240 int offset
= 0, start_offset
;
243 col_set_str(pinfo
->cinfo
, COL_PROTOCOL
, "NS-MEP");
244 col_clear(pinfo
->cinfo
, COL_INFO
);
246 ti
= proto_tree_add_item(tree
, proto_ns_mep
, tvb
, 0, -1, ENC_NA
);
247 ns_mep_tree
= proto_item_add_subtree(ti
, ett_nsmep
);
249 proto_tree_add_item_ret_uint(ns_mep_tree
, hf_nsmep_majver
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
, &maj_ver
);
251 proto_tree_add_item_ret_uint(ns_mep_tree
, hf_nsmep_minver
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
, &min_ver
);
253 proto_tree_add_item_ret_uint(ns_mep_tree
, hf_nsmep_msgtype
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
, &mesgtype
);
255 version_str
= wmem_strdup_printf(pinfo
->pool
, "v%d.%d %s", maj_ver
, min_ver
, val_to_str(mesgtype
, nslist_gslbmessage
, "Unknown Mesg Type: 0x%02X"));
256 proto_item_append_text(ti
, ", %s", version_str
);
257 proto_tree_add_item_ret_uint(ns_mep_tree
, hf_nsmep_msglen
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
, &mesglen
);
259 proto_tree_add_item_ret_uint(ns_mep_tree
, hf_nsmep_errcode
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
, &errcode
);
262 col_add_fstr(pinfo
->cinfo
, COL_INFO
, "Mesg: %s; Len: %d", version_str
, mesglen
);
266 case GSLB_MSG_SITE_METRIC_UPDATE
:
269 proto_tree
*ns_mep_mfu_tree
;
271 while (tvb_reported_length_remaining(tvb
, offset
) >= Ns_GSLB_MSG_SITE_METRIC_UPDATE_SIZE
)
273 tf
= proto_tree_add_item(ns_mep_tree
, hf_ns_metricUpdate
, tvb
, offset
, Ns_GSLB_MSG_SITE_METRIC_UPDATE_SIZE
, ENC_NA
);
274 ns_mep_mfu_tree
= proto_item_add_subtree(tf
, ett_nsmep_mfu
);
276 /* proto_tree_add_item(ns_mep_mfu_tree, hf_nsmep_mfu_cmd, tvb, offset, 2, ENC_LITTLE_ENDIAN); */
278 proto_tree_add_item(ns_mep_mfu_tree
, hf_nsmep_mfu_state
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
);
280 proto_tree_add_item(ns_mep_mfu_tree
, hf_nsmep_mfu_ip
, tvb
, offset
, 4, ENC_BIG_ENDIAN
);
282 proto_tree_add_item_ret_uint(ns_mep_mfu_tree
, hf_nsmep_mfu_port
, tvb
, offset
, 2, ENC_BIG_ENDIAN
, &public_port
);
284 proto_tree_add_item_ret_uint(ns_mep_mfu_tree
, hf_nsmep_mfu_svctype
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
, &svctype
);
287 proto_item_append_text(tf
, " for %s:%d:%s", tvb_address_to_str(pinfo
->pool
, tvb
, FT_IPv4
, offset
-8), public_port
, val_to_str(svctype
, ns_svc_type_vals
, "0x%02X"));
288 if ((maj_ver
> 2) || ((maj_ver
==2) && (min_ver
> 2)))
290 proto_tree_add_item(ns_mep_mfu_tree
, hf_nsmep_mfu_eff_state
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
);
292 proto_tree_add_item(ns_mep_mfu_tree
, hf_nsmep_mfu_mepflag
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
);
302 case GSLB_MSG_SITE_METRIC_FORCE_REQ
:
305 proto_tree
*ns_mep_mfr_tree
;
307 while (tvb_reported_length_remaining(tvb
, offset
) >= GSLB_FORCE_VIP_SIZE
)
309 tf
= proto_tree_add_item(ns_mep_tree
, hf_ns_forceUpdateRequest
, tvb
, offset
, GSLB_FORCE_VIP_SIZE
, ENC_NA
);
310 ns_mep_mfr_tree
= proto_item_add_subtree(tf
, ett_nsmep_mfu
);
312 proto_tree_add_item(ns_mep_mfr_tree
, hf_nsmep_mfu_ip
, tvb
, offset
, 4, ENC_BIG_ENDIAN
);
314 proto_tree_add_item_ret_uint(ns_mep_mfr_tree
, hf_nsmep_mfu_port
, tvb
, offset
, 2, ENC_BIG_ENDIAN
, &public_port
);
316 proto_tree_add_item_ret_uint(ns_mep_mfr_tree
, hf_nsmep_mfu_svctype
, tvb
, offset
, 4, ENC_LITTLE_ENDIAN
, &svctype
);
319 proto_item_append_text(tf
, " for %s:%d:%s", tvb_address_to_str(pinfo
->pool
, tvb
, FT_IPv4
, offset
-8), public_port
, val_to_str(svctype
, ns_svc_type_vals
, "0x%02X"));
321 if ((maj_ver
> 2) || ((maj_ver
==2) && (min_ver
> 2)))
323 proto_tree_add_item(ns_mep_mfr_tree
, hf_nsmep_mfu_reqflag
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
);
333 case GSLB_MSG_SITE_ADV_IP_ADDR
:
334 proto_tree_add_item(ns_mep_tree
, hf_nsmep_adv_ip
, tvb
, offset
, 4, ENC_BIG_ENDIAN
);
336 case GSLB_MSG_SITE_ADV_IP_ACK
:
338 case GSLB_MSG_SITE_ADV_IP_NACK
:
340 case GSLB_MSG_SITE_METRIC_FORCE_UPDATE
:
343 proto_tree
*ns_mep_mfu_tree
;
345 while (tvb_reported_length_remaining(tvb
, offset
) >= GSLIB_EXCHANGE_DATA_SIZE
)
347 tf
= proto_tree_add_item(ns_mep_tree
, hf_ns_forceUpdateResp
, tvb
, offset
, GSLIB_EXCHANGE_DATA_SIZE
, ENC_NA
);
348 ns_mep_mfu_tree
= proto_item_add_subtree(tf
, ett_nsmep_mfu
);
350 /* proto_tree_add_item(ns_mep_mfu_tree, hf_nsmep_mfu_cmd, tvb, offset, 2, ENC_LITTLE_ENDIAN); */
352 proto_tree_add_item(ns_mep_mfu_tree
, hf_nsmep_mfu_state
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
);
354 proto_tree_add_item(ns_mep_mfu_tree
, hf_nsmep_mfu_ip
, tvb
, offset
, 4, ENC_BIG_ENDIAN
);
356 proto_tree_add_item_ret_uint(ns_mep_mfu_tree
, hf_nsmep_mfu_port
, tvb
, offset
, 2, ENC_BIG_ENDIAN
, &public_port
);
358 proto_tree_add_item_ret_uint(ns_mep_mfu_tree
, hf_nsmep_mfu_svctype
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
, &svctype
);
361 proto_item_append_text(tf
, " for %s:%d:%s", tvb_address_to_str(pinfo
->pool
, tvb
, FT_IPv4
, offset
-8), public_port
, val_to_str(svctype
, ns_svc_type_vals
, "0x%02X"));
363 if ((maj_ver
> 2) || ((maj_ver
==2) && (min_ver
> 2)))
365 proto_tree_add_item(ns_mep_mfu_tree
, hf_nsmep_mfu_eff_state
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
);
367 proto_tree_add_item(ns_mep_mfu_tree
, hf_nsmep_mfu_mepflag
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
);
375 /* All the counters */
376 proto_tree_add_item(ns_mep_mfu_tree
, hf_ns_currentOpenConn
, tvb
, offset
, 4, ENC_LITTLE_ENDIAN
);
379 proto_tree_add_item(ns_mep_mfu_tree
, hf_ns_currentSurgeCount
, tvb
, offset
, 4, ENC_LITTLE_ENDIAN
);
382 proto_tree_add_item(ns_mep_mfu_tree
, hf_ns_currentIOHCount
, tvb
, offset
, 4, ENC_LITTLE_ENDIAN
);
385 proto_tree_add_item(ns_mep_mfu_tree
, hf_ns_currentReusePool
, tvb
, offset
, 4, ENC_LITTLE_ENDIAN
);
388 proto_tree_add_item(ns_mep_mfu_tree
, hf_ns_currentServerConn
, tvb
, offset
, 4, ENC_LITTLE_ENDIAN
);
391 proto_tree_add_item(ns_mep_mfu_tree
, hf_ns_currentClientConn
, tvb
, offset
, 4, ENC_LITTLE_ENDIAN
);
394 proto_tree_add_item(ns_mep_mfu_tree
, hf_ns_TotalReq
, tvb
, offset
, 8, ENC_LITTLE_ENDIAN
);
397 proto_tree_add_item(ns_mep_mfu_tree
, hf_ns_TotalReqBytes
, tvb
, offset
, 8, ENC_LITTLE_ENDIAN
);
400 proto_tree_add_item(ns_mep_mfu_tree
, hf_ns_TotalResp
, tvb
, offset
, 8, ENC_LITTLE_ENDIAN
);
403 proto_tree_add_item(ns_mep_mfu_tree
, hf_ns_TotalRespBytes
, tvb
, offset
, 8, ENC_LITTLE_ENDIAN
);
408 case GSLB_MSG_NETW_METRIC_UPDATE
:
411 proto_tree
*ns_mep_nwu_tree
;
413 while (tvb_reported_length_remaining(tvb
, offset
) >= GSLIB_NET_MET_TABLE_SIZE
)
415 tf
= proto_tree_add_item(ns_mep_tree
, hf_ns_networkMetrics
, tvb
, offset
, GSLIB_NET_MET_TABLE_SIZE
, ENC_NA
);
416 proto_item_append_text(tf
, " of %s", tvb_address_to_str(pinfo
->pool
, tvb
, AT_IPv4
, offset
));
417 ns_mep_nwu_tree
= proto_item_add_subtree(tf
, ett_nsmep_nwu
);
419 proto_tree_add_item(ns_mep_nwu_tree
, hf_nsmep_ldns_ip
, tvb
, offset
, 4, ENC_LITTLE_ENDIAN
);
422 proto_tree_add_item(ns_mep_tree
, hf_ns_roundTripTime
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
);
425 proto_tree_add_item(ns_mep_tree
, hf_ns_hops
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
);
431 case GSLB_MSG_PERSIST_RECORD
:
434 proto_tree
*ns_mep_pr_tree
;
436 while (tvb_reported_length_remaining(tvb
, offset
) >= NS_PERSIST_INFO_SIZE
)
438 tf
= proto_tree_add_item(ns_mep_tree
, hf_ns_persistenceInfo
, tvb
, offset
, NS_PERSIST_INFO_SIZE
, ENC_NA
);
439 proto_item_append_text(tf
, " %s", tvb_address_to_str(pinfo
->pool
, tvb
, AT_IPv4
, offset
));
440 ns_mep_pr_tree
= proto_item_add_subtree(tf
, ett_nsmep_nwu
);
442 proto_tree_add_item(ns_mep_pr_tree
, hf_nsmep_ldns_ip
, tvb
, offset
, 4, ENC_LITTLE_ENDIAN
);
445 proto_tree_add_item(ns_mep_tree
, hf_ns_persistenceGslbServIp
, tvb
, offset
, 4, ENC_BIG_ENDIAN
);
448 proto_tree_add_item(ns_mep_tree
, hf_ns_persistenceGslbServPort
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
);
451 proto_tree_add_item(ns_mep_tree
, hf_ns_persistenceId
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
);
456 case GSLB_MSG_LBNODE_DOM_INFO
:
459 proto_tree
*ns_mep_di_tree
;
460 uint32_t prefixlen
, cookiedomlen
, flags
, vidlen
;
462 while (tvb_reported_length_remaining(tvb
, offset
) >= NS_GSLB_DOM_INFO_MIN_SIZE
)
464 tf
= proto_tree_add_item(ns_mep_tree
, hf_ns_sitePersistenceDom
, tvb
, offset
, NS_GSLB_DOM_INFO_MIN_SIZE
, ENC_NA
);
465 ns_mep_di_tree
= proto_item_add_subtree(tf
, ett_nsmep_nwu
);
466 start_offset
= offset
;
468 proto_tree_add_item(ns_mep_di_tree
, hf_nsmep_mfu_ip
, tvb
, offset
, 4, ENC_BIG_ENDIAN
);
470 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_nsmep_mfu_port
, tvb
, offset
, 2, ENC_BIG_ENDIAN
, &public_port
);
472 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_nsmep_mfu_svctype
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
, &svctype
);
475 proto_item_append_text(tf
, " for %s:%d:%s", tvb_address_to_str(pinfo
->pool
, tvb
, FT_IPv4
, offset
-8), public_port
, val_to_str(svctype
, ns_svc_type_vals
, "0x%02X"));
477 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_ns_gslbDomNamelen
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
, &domainlen
);
479 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_ns_gslbServPreflen
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
, &prefixlen
);
481 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_ns_gslbCookieDomNamelen
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
, &cookiedomlen
);
483 proto_tree_add_item(ns_mep_di_tree
, hf_nsmep_site_persistence
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
);
485 proto_tree_add_item(ns_mep_di_tree
, hf_ns_gslbCookieTimeout
, tvb
, offset
, 4, ENC_LITTLE_ENDIAN
);
487 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_ns_gslbVidlen
, tvb
, offset
, 4, ENC_LITTLE_ENDIAN
, &vidlen
);
489 tf
= proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_ns_gslbFlags
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
, &flags
);
490 if (flags
== NSGSLB_DOMINFO_FLUSH_ALL_GSLBINFO
)
492 proto_item_append_text(tf
, "Flush all gslb information");
496 proto_item_append_text(tf
, "Undefined");
499 offset
+= 2; /* Skip reserved */
501 proto_tree_add_item(ns_mep_di_tree
, hf_ns_gslbDomName
, tvb
, offset
, domainlen
, ENC_NA
|ENC_ASCII
);
505 proto_tree_add_item(ns_mep_di_tree
, hf_ns_gslbCookieDomName
, tvb
, offset
, cookiedomlen
, ENC_NA
|ENC_ASCII
);
506 offset
+= cookiedomlen
;
509 proto_tree_add_item(ns_mep_di_tree
, hf_ns_gslbVs
, tvb
, offset
, vidlen
, ENC_NA
|ENC_ASCII
);
513 proto_tree_add_item(ns_mep_di_tree
, hf_ns_gslbPrefix
, tvb
, offset
, prefixlen
, ENC_NA
|ENC_ASCII
);
516 proto_item_set_len(tf
, offset
-start_offset
);
520 case GSLB_MSG_LBNODE_FLUSH_DOM_INFO
:
523 proto_tree
*ns_mep_di_tree
;
525 while (tvb_reported_length_remaining(tvb
, offset
) >= NS_GSLB_FLUSH_DOM_INFO_MIN_SIZE
)
527 tf
= proto_tree_add_item(ns_mep_tree
, hf_ns_sitePersistenceFlushDom
, tvb
, offset
, 9, ENC_NA
);
528 ns_mep_di_tree
= proto_item_add_subtree(tf
, ett_nsmep_nwu
);
529 start_offset
= offset
;
531 proto_tree_add_item(ns_mep_di_tree
, hf_nsmep_mfu_ip
, tvb
, offset
, 4, ENC_BIG_ENDIAN
);
533 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_nsmep_mfu_port
, tvb
, offset
, 2, ENC_BIG_ENDIAN
, &public_port
);
535 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_nsmep_mfu_svctype
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
, &svctype
);
538 proto_item_append_text(tf
, " for %s:%d:%s", tvb_address_to_str(pinfo
->pool
, tvb
, FT_IPv4
, offset
-8), public_port
, val_to_str(svctype
, ns_svc_type_vals
, "0x%02X"));
540 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_ns_gslbDomNamelen
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
, &domainlen
);
542 proto_tree_add_item(ns_mep_di_tree
, hf_ns_gslbDomName
, tvb
, offset
, domainlen
, ENC_NA
|ENC_ASCII
);
545 proto_item_set_len(tf
, offset
-start_offset
);
547 /* XXX - Do we really have a full domain info message here? */
551 case GSLB_MSG_LBNODE_FLUSH_SVC_INFO
:
554 proto_tree
*ns_mep_di_tree
;
556 tf
= proto_tree_add_item(ns_mep_tree
, hf_ns_sitePersistenceFlushServ
, tvb
, offset
, 8, ENC_NA
);
557 ns_mep_di_tree
= proto_item_add_subtree(tf
, ett_nsmep_nwu
);
559 proto_tree_add_item(ns_mep_di_tree
, hf_nsmep_mfu_ip
, tvb
, offset
, 4, ENC_BIG_ENDIAN
);
561 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_nsmep_mfu_port
, tvb
, offset
, 2, ENC_BIG_ENDIAN
, &public_port
);
563 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_nsmep_mfu_svctype
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
, &svctype
);
566 proto_item_append_text(tf
, " for %s:%d:%s", tvb_address_to_str(pinfo
->pool
, tvb
, FT_IPv4
, offset
-8), public_port
, val_to_str(svctype
, ns_svc_type_vals
, "0x%02X"));
569 case GSLB_MSG_LBNODE_GETSVC
:
572 proto_tree
*ns_mep_di_tree
;
574 tf
= proto_tree_add_item(ns_mep_tree
, hf_ns_sitePersisGetServReq
, tvb
, offset
, 9, ENC_NA
);
575 ns_mep_di_tree
= proto_item_add_subtree(tf
, ett_nsmep_nwu
);
576 start_offset
= offset
;
578 proto_tree_add_item(ns_mep_di_tree
, hf_nsmep_mfu_ip
, tvb
, offset
, 4, ENC_BIG_ENDIAN
);
580 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_nsmep_mfu_port
, tvb
, offset
, 2, ENC_BIG_ENDIAN
, &public_port
);
582 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_nsmep_mfu_svctype
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
, &svctype
);
585 proto_item_append_text(tf
, " for %s:%d:%s", tvb_address_to_str(pinfo
->pool
, tvb
, FT_IPv4
, offset
-8), public_port
, val_to_str(svctype
, ns_svc_type_vals
, "0x%02X"));
587 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_ns_gslbDomNamelen
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
, &domainlen
);
589 proto_tree_add_item(ns_mep_di_tree
, hf_ns_gslbDomName
, tvb
, offset
, domainlen
, ENC_NA
|ENC_ASCII
);
592 proto_item_set_len(tf
, start_offset
- offset
);
593 /* XXX - Do we really have a full domain info message here? */
596 case GSLB_MSG_LBNODE_GETSVC_RESP
:
599 proto_tree
*ns_mep_di_tree
;
601 tf
= proto_tree_add_item(ns_mep_tree
, hf_ns_sitePersistenceGetServResp
, tvb
, offset
, 9, ENC_NA
);
602 ns_mep_di_tree
= proto_item_add_subtree(tf
, ett_nsmep_nwu
);
603 start_offset
= offset
;
605 proto_tree_add_item(ns_mep_di_tree
, hf_nsmep_mfu_ip
, tvb
, offset
, 4, ENC_BIG_ENDIAN
);
607 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_nsmep_mfu_port
, tvb
, offset
, 2, ENC_BIG_ENDIAN
, &public_port
);
609 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_nsmep_mfu_svctype
, tvb
, offset
, 2, ENC_LITTLE_ENDIAN
, &svctype
);
612 proto_item_append_text(tf
, " for %s:%d:%s", tvb_address_to_str(pinfo
->pool
, tvb
, FT_IPv4
, offset
-8), public_port
, val_to_str(svctype
, ns_svc_type_vals
, "0x%02X"));
614 proto_tree_add_item_ret_uint(ns_mep_di_tree
, hf_ns_gslbDomNamelen
, tvb
, offset
, 1, ENC_LITTLE_ENDIAN
, &domainlen
);
616 proto_tree_add_item(ns_mep_di_tree
, hf_ns_siteDomTTL
, tvb
, offset
, 4, ENC_LITTLE_ENDIAN
);
618 proto_tree_add_item(ns_mep_di_tree
, hf_ns_gslbDomName
, tvb
, offset
, domainlen
, ENC_NA
|ENC_ASCII
);
621 proto_item_set_len(tf
, start_offset
- offset
);
624 case GSLB_MSG_KEEP_ALIVE
:
631 dissect_ns_mep_pdu(tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
, void* data _U_
)
634 uint8_t maj_ver
, min_ver
;
636 ver
= tvb_get_letohs(tvb
, 0);
637 maj_ver
= tvb_get_uint8(tvb
, 0);
638 min_ver
= tvb_get_uint8(tvb
, 1);
648 dissect_ns_mep_v02xx(tvb
, pinfo
, tree
);
649 return tvb_captured_length(tvb
);
652 /* It is netscaler mep packet of unknown mep version. */
653 col_set_str(pinfo
->cinfo
, COL_PROTOCOL
, "NS-MEP");
654 col_clear(pinfo
->cinfo
, COL_INFO
);
655 col_add_fstr(pinfo
->cinfo
, COL_INFO
, "The v%d.%d MEP Dissector unavailable", maj_ver
, min_ver
);
659 return tvb_captured_length(tvb
);
663 get_ns_mep_pdu_len(packet_info
*pinfo _U_
, tvbuff_t
*tvb
, int offset
, void *data _U_
)
665 /* Get the length of the data from the header. */
666 return tvb_get_letohs(tvb
, offset
+ 4);
670 dissect_ns_mep(tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
, void* data _U_
)
674 if (tvb_reported_length(tvb
) >= 6)
676 /* Get the signature */
677 ns_rpc_sig
= tvb_get_letohs(tvb
, 4);
678 if (ns_rpc_sig
== 0xA5A5)
680 /* If the signature is present, it is a netscaler-rpc connection. call
681 the nsrpc dissector. */
682 call_dissector(nsrpc_handle
, tvb
, pinfo
, tree
);
683 return tvb_captured_length(tvb
);
687 tcp_dissect_pdus(tvb
, pinfo
, tree
, true, 6, get_ns_mep_pdu_len
, dissect_ns_mep_pdu
, data
);
688 return tvb_captured_length(tvb
);
692 proto_register_ns_mep(void)
694 static hf_register_info hf_nsmep
[] = {
696 { "Major Version", "nstrace.mep.maj", FT_UINT8
, BASE_DEC
, NULL
, 0x0,
700 { "Minor Version", "nstrace.mep.min", FT_UINT8
, BASE_DEC
, NULL
, 0x0,
704 { "Message Type", "nstrace.mep.type", FT_UINT16
, BASE_HEX
, VALS(nslist_gslbmessage
), 0x0,
708 { "Message Length", "nstrace.mep.len", FT_UINT16
, BASE_DEC
, NULL
, 0x0,
712 { "Status Code", "nstrace.mep.errcode", FT_UINT16
, BASE_HEX
, VALS(ns_rpc_errcode_vals
), 0x0,
716 { &hf_ns_metricUpdate
,
717 { "Metric Update", "nstrace.mep.mfu.metricUpdate", FT_NONE
, BASE_NONE
, NULL
, 0x0,
719 { &hf_ns_forceUpdateRequest
,
720 { "Force Update Request", "nstrace.mep.mfu.forceUpdateRequest", FT_NONE
, BASE_NONE
, NULL
, 0x0,
722 { &hf_ns_forceUpdateResp
,
723 { "Force Update Response", "nstrace.mep.mfu.mep_mfu_force_update", FT_NONE
, BASE_NONE
, NULL
, 0x0,
725 { &hf_ns_currentOpenConn
,
726 { "Current Open Estd Conn", "nstrace.mep.mfu.currentOpenConn", FT_UINT32
, BASE_DEC
, NULL
, 0x0,
728 { &hf_ns_currentSurgeCount
,
729 { "Current Surge Count", "nstrace.mep.mfu.currentSurgeCount", FT_UINT32
, BASE_DEC
, NULL
, 0x0,
731 { &hf_ns_currentIOHCount
,
732 { "Current IOH Count", "nstrace.mep.mfu.currentIOHCount", FT_UINT32
, BASE_DEC
, NULL
, 0x0,
734 { &hf_ns_currentReusePool
,
735 { "Current Reuse pool", "nstrace.mep.mfu.currentReusePool", FT_UINT32
, BASE_DEC
, NULL
, 0x0,
737 { &hf_ns_currentServerConn
,
738 { "Current Server Conn", "nstrace.mep.mfu.currentServerConn", FT_UINT32
, BASE_DEC
, NULL
, 0x0,
740 { &hf_ns_currentClientConn
,
741 { "Current Client Conn", "nstrace.mep.mfu.currentClientConn", FT_UINT32
, BASE_DEC
, NULL
, 0x0,
744 { "Total Requests", "nstrace.mep.mfu.TotalReq", FT_UINT64
, BASE_DEC
, NULL
, 0x0,
746 { &hf_ns_TotalReqBytes
,
747 { "Total Requests Bytes", "nstrace.mep.mfu.TotalReqBytes", FT_UINT64
, BASE_DEC
, NULL
, 0x0,
750 { "Total Responses", "nstrace.mep.mfu.TotalResp", FT_UINT64
, BASE_DEC
, NULL
, 0x0,
752 { &hf_ns_TotalRespBytes
,
753 { "Total Responses Bytes", "nstrace.mep.mfu.TotalRespBytes", FT_UINT64
, BASE_DEC
, NULL
, 0x0,
755 { &hf_ns_networkMetrics
,
756 { "Network Metrics", "nstrace.mep.mfu.networkMetrics", FT_NONE
, BASE_NONE
, NULL
, 0x0,
758 { &hf_ns_roundTripTime
,
759 { "Round Trip Time", "nstrace.mep.mfu.roundTripTime", FT_UINT16
, BASE_DEC
|BASE_UNIT_STRING
, UNS(&units_milliseconds
), 0x0,
762 { "Hops", "nstrace.mep.mfu.hops", FT_UINT8
, BASE_DEC
, NULL
, 0x0,
764 { &hf_ns_persistenceInfo
,
765 { "Persistence Info for LDNS IP", "nstrace.mep.mfu.persistenceInfo", FT_NONE
, BASE_NONE
, NULL
, 0x0,
767 { &hf_ns_persistenceGslbServIp
,
768 { "Persistence GSLB Service IP", "nstrace.mep.mfu.persistenceGslbServIp", FT_IPv4
, BASE_NONE
, NULL
, 0x0,
770 { &hf_ns_persistenceGslbServPort
,
771 { "Persistence GSLB Service Port", "nstrace.mep.mfu.persistenceGslbServPort", FT_UINT16
, BASE_DEC
, NULL
, 0x0,
773 { &hf_ns_persistenceId
,
774 { "Persistence Id", "nstrace.mep.mfu.persistenceId", FT_UINT16
, BASE_DEC
, NULL
, 0x0,
776 { &hf_ns_sitePersistenceDom
,
777 { "Site persistence Domain Info", "nstrace.mep.mfu.sitePersistenceDom", FT_NONE
, BASE_NONE
, NULL
, 0x0,
779 { &hf_ns_gslbDomNamelen
,
780 { "GSLB Domain Name length", "nstrace.mep.mfu.gslbDomNamelen", FT_UINT8
, BASE_DEC
, NULL
, 0x0,
782 { &hf_ns_gslbServPreflen
,
783 { "GSLB Service Prefix length", "nstrace.mep.mfu.gslbServPreflen", FT_UINT8
, BASE_DEC
, NULL
, 0x0,
785 { &hf_ns_gslbCookieDomNamelen
,
786 { "GSLB Cookie domain name length", "nstrace.mep.mfu.gslbCookieDomNamelen", FT_UINT8
, BASE_DEC
, NULL
, 0x0,
788 { &hf_ns_gslbCookieTimeout
,
789 { "GSLB cookie timeout", "nstrace.mep.mfu.gslbCookieTimeout", FT_UINT32
, BASE_DEC
, NULL
, 0x0,
792 { "GSLB vserver ID length", "nstrace.mep.mfu.gslbVidlen", FT_UINT32
, BASE_DEC
, NULL
, 0x0,
795 { "Flags", "nstrace.mep.mfu.flags", FT_UINT8
, BASE_HEX
, NULL
, 0x0,
797 { &hf_ns_gslbCookieDomName
,
798 { "GSLB Cookie Domain Name", "nstrace.mep.mfu.gslbCookieDomName", FT_STRING
, BASE_NONE
, NULL
, 0x0,
801 { "GSLB Vserver ID", "nstrace.mep.mfu.gslbVs", FT_STRING
, BASE_NONE
, NULL
, 0x0,
804 { "GSLB service prefix", "nstrace.mep.mfu.gslbPrefix", FT_STRING
, BASE_NONE
, NULL
, 0x0,
806 { &hf_ns_sitePersistenceFlushDom
,
807 { "Site persistence Flush Domain Info", "nstrace.mep.mfu.sitePersistenceFlushDom", FT_NONE
, BASE_NONE
, NULL
, 0x0,
809 { &hf_ns_gslbDomName
,
810 { "GSLB Domain Name", "nstrace.mep.mfu.gslbDomName", FT_STRING
, BASE_NONE
, NULL
, 0x0,
812 { &hf_ns_sitePersistenceFlushServ
,
813 { "Site persistence Flush Service", "nstrace.mep.mfu.sitePersistenceFlushServ", FT_NONE
, BASE_NONE
, NULL
, 0x0,
815 { &hf_ns_sitePersisGetServReq
,
816 { "Site persistence Get Service request", "nstrace.mep.mfu.sitePersisGetServReq", FT_NONE
, BASE_NONE
, NULL
, 0x0,
818 { &hf_ns_sitePersistenceGetServResp
,
819 { "Site persistence Get Service response", "nstrace.mep.mfu.sitePersistenceGetServResp", FT_NONE
, BASE_NONE
, NULL
, 0x0,
822 { "Site Domain TTL", "nstrace.mep.mfu.siteDomTTL", FT_UINT32
, BASE_DEC
, NULL
, 0x0,
825 { &hf_nsmep_mfu_state
,
826 { "Service State", "nstrace.mep.mfu.state", FT_UINT16
, BASE_HEX
, VALS(ns_entity_state_vals
), 0x0,
829 { &hf_nsmep_mfu_eff_state
,
830 { "Service Effective State", "nstrace.mep.mfu.effstate", FT_UINT8
, BASE_HEX
, VALS(ns_entity_state_vals
), 0x0,
833 { &hf_nsmep_mfu_mepflag
,
834 { "MEP Flags", "nstrace.mep.mfu.mepflag", FT_UINT8
, BASE_HEX
, NULL
, 0x0,
838 { "Service IP Address", "nstrace.mep.mfu.ip", FT_IPv4
, BASE_NONE
, NULL
, 0x0,
841 { &hf_nsmep_mfu_port
,
842 { "Service Port", "nstrace.mep.mfu.port", FT_UINT16
, BASE_DEC_HEX
, NULL
, 0x0,
845 { &hf_nsmep_mfu_svctype
,
846 { "Service Type", "nstrace.mep.mfu.svctype", FT_UINT32
, BASE_HEX
, VALS(ns_svc_type_vals
), 0x0,
849 { &hf_nsmep_mfu_reqflag
,
850 { "Request Flags", "nstrace.mep.mfu.reqflag", FT_UINT8
, BASE_HEX
, NULL
, 0x0,
854 { "Advertise Local IP Address", "nstrace.mep.adv.ip", FT_IPv4
, BASE_NONE
, NULL
, 0x0,
858 { "LDNS IP Address", "nstrace.mep.ldns.ip", FT_IPv4
, BASE_NONE
, NULL
, 0x0,
861 { &hf_nsmep_site_persistence
,
862 { "Site Persistence", "nstrace.mep.mfu.sitepers", FT_UINT16
, BASE_HEX
, VALS(value_site_persistence
), 0x0,
866 static int *ett
[] = {
872 proto_ns_mep
= proto_register_protocol("NetScaler Metric Exchange Protocol", "NetScaler MEP", "nstrace.mep");
873 proto_register_field_array(proto_ns_mep
, hf_nsmep
, array_length(hf_nsmep
));
874 proto_register_subtree_array(ett
, array_length(ett
));
876 nsmep_handle
= register_dissector("nstrace.mep", dissect_ns_mep
, proto_ns_mep
);
879 void proto_reg_handoff_ns_mep(void)
881 nsrpc_handle
= find_dissector_add_dependency("nsrpc", proto_ns_mep
);
882 dissector_add_for_decode_as("tcp.port", nsmep_handle
);
886 * Editor modelines - https://www.wireshark.org/tools/modelines.html
891 * indent-tabs-mode: t
894 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
895 * :indentSize=8:tabSize=8:noTabs=false: