epan/dissectors/packet-peekremote.c

   1 /* packet-peekremote.c
   2  *
   3  * Routines for the disassembly of packets sent from Cisco WLAN
   4  * Controllers, possibly other Cisco access points, and possibly
   5  * other devices such as Aruba access points.  See
   6  *
   7  *      http://www.wildpackets.com/elements/omnipeek/OmniPeek_UserGuide.pdf
   8  *
   9  * which speaks of Aruba access points supporting remote capture and
  10  * defaulting to port 5000 for this, and also speaks of Cisco access
  11  * points supporting remote capture without any reference to a port
  12  * number.  The two types of remote capture are described separately;
  13  * there's no indication of whether they use the same protocol for
  14  * streaming packets but perhaps other protocols for, for example,
  15  * discovery and setup, or whether they use different protocols
  16  * for streaming packets.
  17  *
  18  * Tested with frames captured from a Cisco WCS.
  19  *
  20  * $Id$
  21  *
  22  * Copyright 2007 Joerg Mayer (see AUTHORS file)
  23  *
  24  * Wireshark - Network traffic analyzer
  25  * By Gerald Combs <gerald@wireshark.org>
  26  * Copyright 1998 Gerald Combs
  27  *
  28  * This program is free software; you can redistribute it and/or
  29  * modify it under the terms of the GNU General Public License
  30  * as published by the Free Software Foundation; either version 2
  31  * of the License, or (at your option) any later version.
  32  *
  33  * This program is distributed in the hope that it will be useful,
  34  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  35  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  36  * GNU General Public License for more details.
  37  *
  38  * You should have received a copy of the GNU General Public License
  39  * along with this program; if not, write to the Free Software
  40  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  41  */
  42
  43 /*
  44  * TODO: Decode meta information.
  45  *       Check on fillup bytes in capture (fcs sometimes wrong)
  46  * From:
  47  * http://www.cisco.com/univercd/cc/td/doc/product/wireless/pahcont/oweb.pdf
  48  * "It will include information on timestamp, signal strength, packet size
  49  *  and so on"
  50  */
  51
  52 #include "config.h"
  53
  54 #include <glib.h>
  55 #include <epan/packet.h>
  56
  57 static int proto_peekremote = -1;
  58 static gint hf_peekremote_unknown1 = -1;
  59 static gint hf_peekremote_unknown2 = -1;
  60 static gint hf_peekremote_unknown3 = -1;
  61 static gint hf_peekremote_unknown4 = -1;
  62 static gint hf_peekremote_unknown5 = -1;
  63 static gint hf_peekremote_unknown6 = -1;
  64 static gint hf_peekremote_channel = -1;
  65 static gint hf_peekremote_timestamp = -1;
  66 static gint ett_peekremote = -1;
  67
  68 static dissector_handle_t ieee80211_handle;
  69
  70 static void
  71 dissect_peekremote(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
  72 {
  73   tvbuff_t *next_tvb;
  74   proto_tree *peekremote_tree = NULL;
  75   proto_item *ti = NULL;
  76
  77   col_set_str(pinfo->cinfo, COL_PROTOCOL, "AIROPEEK");
  78   col_clear(pinfo->cinfo, COL_INFO);
  79
  80   if (tree) {
  81     ti = proto_tree_add_item(tree, proto_peekremote, tvb, 0, -1, ENC_NA);
  82     peekremote_tree = proto_item_add_subtree(ti, ett_peekremote);
  83
  84     proto_tree_add_item(peekremote_tree, hf_peekremote_unknown1, tvb, 0, 2,  ENC_NA);
  85     proto_tree_add_item(peekremote_tree, hf_peekremote_unknown2, tvb, 2, 2,  ENC_BIG_ENDIAN);
  86     proto_tree_add_item(peekremote_tree, hf_peekremote_unknown3, tvb, 4, 2,  ENC_BIG_ENDIAN);
  87     proto_tree_add_item(peekremote_tree, hf_peekremote_unknown4, tvb, 6, 5, ENC_NA);
  88     proto_tree_add_item(peekremote_tree, hf_peekremote_timestamp, tvb, 11, 4, ENC_BIG_ENDIAN);
  89     proto_tree_add_item(peekremote_tree, hf_peekremote_unknown5, tvb, 15, 2, ENC_NA);
  90     proto_tree_add_item(peekremote_tree, hf_peekremote_channel, tvb, 17, 1, ENC_BIG_ENDIAN);
  91     proto_tree_add_item(peekremote_tree, hf_peekremote_unknown6, tvb, 18, 2, ENC_NA);
  92   }
  93   next_tvb = tvb_new_subset_remaining(tvb, 20);
  94   pinfo->pseudo_header->ieee_802_11.fcs_len = 4;
  95   call_dissector(ieee80211_handle, next_tvb, pinfo, tree);
  96 }
  97
  98 void
  99 proto_register_peekremote(void)
 100 {
 101   static hf_register_info hf[] = {
 102     { &hf_peekremote_unknown1,
 103       { "Unknown1",      "peekremote.unknown1", FT_BYTES, BASE_NONE, NULL,
 104         0x0, NULL, HFILL }},
 105
 106     { &hf_peekremote_unknown2,
 107       { "caplength1",      "peekremote.unknown2", FT_UINT16, BASE_DEC, NULL,
 108         0x0, NULL, HFILL }},
 109
 110     { &hf_peekremote_unknown3,
 111       { "caplength2",      "peekremote.unknown3", FT_UINT16, BASE_DEC, NULL,
 112         0x0, NULL, HFILL }},
 113
 114     { &hf_peekremote_unknown4,
 115       { "Unknown4",      "peekremote.unknown4", FT_BYTES, BASE_NONE, NULL,
 116         0x0, NULL, HFILL }},
 117
 118     { &hf_peekremote_unknown5,
 119       { "Unknown5",      "peekremote.unknown5", FT_BYTES, BASE_NONE, NULL,
 120         0x0, NULL, HFILL }},
 121
 122     { &hf_peekremote_unknown6,
 123       { "Unknown6",      "peekremote.unknown6", FT_BYTES, BASE_NONE, NULL,
 124         0x0, NULL, HFILL }},
 125
 126     { &hf_peekremote_timestamp,
 127       { "Timestamp?",       "peekremote.timestamp", FT_UINT32, BASE_DEC, NULL,
 128         0x0, NULL, HFILL }},
 129
 130     { &hf_peekremote_channel,
 131       { "Channel",       "peekremote.channel", FT_UINT8, BASE_DEC, NULL,
 132         0x0, NULL, HFILL }},
 133
 134   };
 135   static gint *ett[] = {
 136     &ett_peekremote,
 137   };
 138
 139   proto_peekremote = proto_register_protocol(
 140     "AiroPeek/OmniPeek encapsulated IEEE 802.11", "PEEKREMOTE", "peekremote");
 141   proto_register_field_array(proto_peekremote, hf, array_length(hf));
 142   proto_register_subtree_array(ett, array_length(ett));
 143 }
 144
 145 void
 146 proto_reg_handoff_peekremote(void)
 147 {
 148   dissector_handle_t peekremote_handle;
 149
 150   ieee80211_handle = find_dissector("wlan_datapad");
 151
 152   peekremote_handle = create_dissector_handle(dissect_peekremote, proto_peekremote);
 153   dissector_add_uint("udp.port", 5000, peekremote_handle);
 154 }