epan/dissectors/packet-vssmonitoring.c

   1 /* packet-vssmonitoring.c
   2  * Routines for dissection of VSS Monitoring timestamp and portstamp
   3  *
   4  * Copyright VSS Monitoring 2011
   5  *
   6  * 20111205 - First edition by Sake Blok (sake.blok@SYN-bit.nl)
   7  *
   8  * Wireshark - Network traffic analyzer
   9  * By Gerald Combs <gerald@wireshark.org>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * SPDX-License-Identifier: GPL-2.0-or-later
  13  */
  14
  15 #include "config.h"
  16
  17 #include <epan/packet.h>
  18 #include <epan/prefs.h>
  19
  20
  21 #define VSS_NS_MASK     0x3fffffff
  22 #define CLKSRC_SHIFT    30
  23
  24 #define CLKSRC_LOCAL    0
  25 #define CLKSRC_NTP      1
  26 #define CLKSRC_GPS      2
  27 #define CLKSRC_PTP      3
  28
  29 static const value_string clksrc_vals[] = {
  30   { CLKSRC_LOCAL,       "Not Synced" },
  31   { CLKSRC_NTP,         "NTP" },
  32   { CLKSRC_GPS,         "GPS" },
  33   { CLKSRC_PTP,         "PTP" },
  34   { 0,                  NULL }
  35 };
  36
  37 void proto_register_vssmonitoring(void);
  38 void proto_reg_handoff_vssmonitoring(void);
  39
  40 static int proto_vssmonitoring;
  41
  42 static int hf_vssmonitoring_time;
  43 static int hf_vssmonitoring_clksrc;
  44 static int hf_vssmonitoring_srcport;
  45
  46 static int ett_vssmonitoring;
  47
  48 static bool vss_dissect_portstamping_only;
  49 static bool vss_two_byte_portstamps;
  50
  51 static bool
  52 dissect_vssmonitoring(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
  53 {
  54   proto_tree    *ti = NULL;
  55   proto_tree    *vssmonitoring_tree = NULL;
  56   unsigned      offset = 0;
  57
  58   unsigned      trailer_len;
  59   unsigned      portstamp_len = (vss_two_byte_portstamps) ? 2 : 1;
  60   nstime_t      vssmonitoring_time;
  61   uint8_t       vssmonitoring_clksrc = 0;
  62   uint32_t      vssmonitoring_srcport = 0;
  63
  64   struct tm     *tmp;
  65
  66
  67   /* First get the length of the trailer */
  68   trailer_len = tvb_reported_length(tvb);
  69
  70   /* The trailer length is a sum (of any combination) of:
  71    * timestamp (8 bytes)
  72    * port stamp (1 or 2 bytes)
  73    * fcs (4 bytes)
  74    *
  75    * Our caller might pass in the trailer with FCS included, so we check for
  76    * a trailer with a length that includes one or more of a time stamp,
  77    * a 1-byte or 2-byte port stamp, and optionally an FCS.
  78    *
  79    * See
  80    *
  81    *    https://web.archive.org/web/20160402091604/http://www.vssmonitoring.com/resources/feature-brief/Port-and-Time-Stamping.pdf
  82    *
  83    * which speaks of 2-byte port stamps as being for a "future release".
  84    *
  85    * Iris Packet Broker user manuals when VSS Monitoring was owned by
  86    * Tektronix also mentioned only a 1-byte port stamp.
  87    *
  88    * VSS Monitoring has since been acquired by NetScout.
  89    * Products released in 2019:
  90    * https://www.netscout.com/sites/default/files/2019-01/PFSPDS_002_EN-1803-nGenius-4200-Series-Packet-Flow-Switch.pdf
  91    * https://www.netscout.com/sites/default/files/2019-12/PFSPDS_003_EN-1901%20-%20nGenius%206010%20Packet%20Flow%20Switch.pdf
  92    * mention both Port Stamping and VLAN tagging under "traffic port tagging,"
  93    * and also note separately that up to _256_ ports can be meshed together
  94    * across hardware to act as a single device.
  95    *
  96    * Products released in 2021:
  97    * https://www.netscout.com/sites/default/files/2021-07/PFSPDS_021_EN-2102%20-%20nGenius%207000%20Series%20Packet%20Flow%20Switches.pdf
  98    * https://www.netscout.com/sites/default/files/2021-07/PFSPDS_022_EN-2102%20-%20nGenius%205000%20Series%20Packet%20Flow%20Switches.pdf
  99    * mention only VLAN tagging, and not Port Stamping in the port tagging
 100    * feature section.
 101    *
 102    * VSS Monitoring has apparently never released a product with 2 byte
 103    * port stamps, and it seems going forward that port stamping is going
 104    * to be deprecrated in favor of VLAN tagging.
 105    *
 106    * So by default we'll assume port stamps are 1 byte, with 2 bytes
 107    * port stamps supported via preference (disabled by default.)
 108    *
 109    * This means a trailer length must not be more than 14 bytes,
 110    * and:
 111    *
 112    *    must not be 3 modulo 4 (as it can't have both a 1-byte
 113    *    and a 2-byte port stamp);
 114    *
 115    *    can only be either 1 or 2 module 4, depending on the size
 116    *    of port stamp we accept;
 117    *
 118    *    if it's less than 8 bytes, must not be 0 modulo 4 (as
 119    *    it must have a 1-byte or 2-byte port stamp, given that
 120    *    it has no timestamp).
 121    */
 122   if ( trailer_len > 12 + portstamp_len )
 123     return false;
 124
 125   if ( (trailer_len & 3) != 0 && (trailer_len & 3) != portstamp_len )
 126     return false;
 127
 128   /*
 129    * If we have a time stamp, check it for validity.
 130    */
 131   if ( trailer_len >= 8 ) {
 132     vssmonitoring_time.secs  = tvb_get_ntohl(tvb, offset);
 133     vssmonitoring_time.nsecs = tvb_get_ntohl(tvb, offset + 4);
 134     vssmonitoring_clksrc     = (uint8_t)(((uint32_t)vssmonitoring_time.nsecs) >> CLKSRC_SHIFT);
 135     vssmonitoring_time.nsecs &= VSS_NS_MASK;
 136
 137       /* Probably padding passed to this dissector (e.g., a 802.1Q tagged
 138        * packet where the minimum frame length was increased to account
 139        * for the tag, see IEEE Std 802.1Q-2014 G.2.3 "Minimum PDU Size")
 140        * FIXME: Should be made even stricter.
 141        */
 142       if (vssmonitoring_time.secs == 0)
 143         return false;
 144       /* The timestamp will be based on the uptime until the TAP is completely
 145        * booted, this takes about 60s, but use 1 hour to be sure
 146        */
 147       if (vssmonitoring_time.secs > 3600) {
 148
 149         /* Check whether the timestamp in the PCAP header and the VSS-Monitoring
 150          * differ less than 30 days, otherwise, this might not be a VSS-Monitoring
 151          * timestamp
 152          */
 153         if ( vssmonitoring_time.secs > pinfo->abs_ts.secs ) {
 154           if ( vssmonitoring_time.secs - pinfo->abs_ts.secs > 2592000 ) /* 30 days */
 155             return false;
 156         } else {
 157           if ( pinfo->abs_ts.secs - vssmonitoring_time.secs > 2592000 ) /* 30 days */
 158             return false;
 159         }
 160       }
 161
 162       /* The nanoseconds field should be less than 1000000000
 163        */
 164       if ( vssmonitoring_time.nsecs >= 1000000000 )
 165         return false;
 166   } else if (!vss_dissect_portstamping_only || (trailer_len & 3) == 0) {
 167     /* No timestamp, so we need a port stamp and be willing to accept
 168      * packets with port stamping but not time stamping.
 169      *
 170      * Unfortunately, the port stamp can be zero or any other value, so
 171      * this means that a one-byte or two-byte all-zero trailer that's just
 172      * padding can be misinterpreted as a VSS monitoring trailer, among
 173      * other false positives, so we disable that by default.
 174      */
 175     return false;
 176   }
 177
 178   /* All systems are go, lets dissect the VSS-Monitoring trailer */
 179   if (tree) {
 180     ti = proto_tree_add_item(tree, proto_vssmonitoring,
 181              tvb, 0, (trailer_len & 0xb), ENC_NA);
 182     vssmonitoring_tree = proto_item_add_subtree(ti, ett_vssmonitoring);
 183   }
 184
 185   /* Do we have a timestamp? */
 186   if ( trailer_len >= 8 ) {
 187     if (tree) {
 188       proto_tree_add_time(vssmonitoring_tree, hf_vssmonitoring_time, tvb, offset, 8, &vssmonitoring_time);
 189       proto_tree_add_uint(vssmonitoring_tree, hf_vssmonitoring_clksrc, tvb, offset + 4, 1, vssmonitoring_clksrc);
 190
 191       tmp = localtime(&vssmonitoring_time.secs);
 192       if (tmp)
 193         proto_item_append_text(ti, ", Timestamp: %02d:%02d:%02d.%09ld",
 194             tmp->tm_hour, tmp->tm_min, tmp->tm_sec,(long)vssmonitoring_time.nsecs);
 195       else
 196         proto_item_append_text(ti, ", Timestamp: <Not representable>");
 197     }
 198     offset += 8;
 199   }
 200
 201   /* Do we have a port stamp? */
 202   if ( (trailer_len & 3) == portstamp_len) {
 203     if (tree) {
 204       proto_tree_add_item_ret_uint(vssmonitoring_tree, hf_vssmonitoring_srcport, tvb, offset, portstamp_len, ENC_BIG_ENDIAN, &vssmonitoring_srcport);
 205       proto_item_append_text(ti, ", Source Port: %d", vssmonitoring_srcport);
 206     }
 207     /*offset += portstamp_len;*/
 208   }
 209
 210   return true;
 211 }
 212
 213 void
 214 proto_register_vssmonitoring(void)
 215 {
 216   static hf_register_info hf[] = {
 217     { &hf_vssmonitoring_time, {
 218         "Time Stamp", "vssmonitoring.time",
 219         FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
 220         "VSS Monitoring Time Stamp", HFILL }},
 221
 222     { &hf_vssmonitoring_clksrc, {
 223         "Clock Source", "vssmonitoring.clksrc",
 224         FT_UINT8, BASE_DEC, VALS(clksrc_vals), 0x0,
 225         "VSS Monitoring Clock Source", HFILL }},
 226
 227     { &hf_vssmonitoring_srcport, {
 228         "Src Port", "vssmonitoring.srcport",
 229         FT_UINT16, BASE_DEC, NULL, 0x0,
 230         "VSS Monitoring Source Port", HFILL }}
 231   };
 232
 233   static int *ett[] = {
 234     &ett_vssmonitoring
 235   };
 236
 237   module_t *vssmonitoring_module;
 238
 239   proto_vssmonitoring = proto_register_protocol("VSS Monitoring Ethernet trailer", "VSS Monitoring", "vssmonitoring");
 240   proto_register_field_array(proto_vssmonitoring, hf, array_length(hf));
 241   proto_register_subtree_array(ett, array_length(ett));
 242
 243   vssmonitoring_module = prefs_register_protocol(proto_vssmonitoring, NULL);
 244
 245   prefs_register_obsolete_preference(vssmonitoring_module, "use_heuristics");
 246   prefs_register_bool_preference(vssmonitoring_module, "dissect_portstamping_only",
 247       "Dissect trailers with only port stamping",
 248       "Whether the VSS Monitoring dissector should attempt to dissect trailers with no timestamp, only port stamping.  Note that this can result in a large number of false positives.",
 249       &vss_dissect_portstamping_only);
 250   prefs_register_bool_preference(vssmonitoring_module, "two_byte_portstamps",
 251       "Two byte port stamps",
 252       "Whether the VSS Monitoring dissector should assume that the port stamp is two bytes, instead of the standard one byte.",
 253       &vss_two_byte_portstamps);
 254 }
 255
 256 void
 257 proto_reg_handoff_vssmonitoring(void)
 258 {
 259   heur_dissector_add("eth.trailer", dissect_vssmonitoring, "VSS Monitoring ethernet trailer", "vssmonitoring_eth", proto_vssmonitoring, HEURISTIC_ENABLE);
 260 }
 261
 262 /*
 263  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 264  *
 265  * Local Variables:
 266  * c-basic-offset: 2
 267  * tab-width: 8
 268  * indent-tabs-mode: nil
 269  * End:
 270  *
 271  * ex: set shiftwidth=2 tabstop=8 expandtab:
 272  * :indentSize=2:tabSize=8:noTabs=true:
 273  */