epan/dissectors/packet-hpteam.c

   1 /* packet-hpteam.c
   2  * Routines for HP Teaming heartbeat dissection
   3  * Copyright 2009, Nathan Hartwell <nhartwell@gmail.com>
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301,
  24  * USA.
  25  */
  26
  27 #include "config.h"
  28
  29 #include <glib.h>
  30
  31 #include <epan/packet.h>
  32 #include <epan/to_str.h>
  33 #include <epan/oui.h>
  34 #include <packet-llc.h>
  35
  36
  37 static int proto_hpteam = -1;
  38
  39 /* Known HP NIC teaming PID values */
  40 static const value_string hpteam_pid_vals[] = {
  41         { 0x0002,       "HP Teaming heartbeat" },
  42         { 0,            NULL }
  43 };
  44
  45 static gint hf_hpteam = -1;
  46 static gint hf_llc_hpteam_pid = -1;
  47
  48 /* These are the ids of the subtrees that we may be creating */
  49 static gint ett_hpteam = -1;
  50
  51 /*
  52  * According to the HP document at
  53  *
  54  *      http://www.hp.com/sbso/bus_protect/teaming.pdf
  55  *
  56  * the heartbeats are sent to 03-00-C7-00-00-EE in SNAP frames
  57  * in unnumbered TEST frames.  It says that the LLC header is
  58  * followed by 63 bytes of "Insignificant data" and the FCS.
  59  * This means that the SNAP header is part of the "Insignificant
  60  * data".
  61  *
  62  * The SNAP specification (section 10.3 "Subnetwork Access Protocol"
  63  * of IEEE Std 802-2001) says that *all* SNAP PDUs have an LLC
  64  * payload that starts with the 5-octet Protocol Identification
  65  * field, i.e. the OUI and PID.
  66  *
  67  * At least some Teaming heartbeat packets have an OUI of 00-80-5F,
  68  * which belongs to HP, and a protocol ID of 0x0002.
  69  *
  70  * If all heartbeat packets have that OUI/PID combination, and no other
  71  * packets have it, the right way to recognize them is by registering
  72  * the PID of 0x0002 in the dissector table for that OUI; there is no
  73  * need to check the destination MAC address.
  74  *
  75  * If not all heartbeat packets have that OUI/PID combination and/or other
  76  * packets have it, the only way to recognize them would be to add
  77  * support for heuristic dissectors to the SNAP dissector, register this
  78  * as a heuristic dissector for that table, and have it compare pinfo->dl_dst
  79  * against an address structure with a type of AT_ETHER, a length of 6,
  80  * and data of 03-00-C7-00-00-EE.  It is *not* sufficient to just check
  81  * pinfo->dl_dst.data, as there is no guarantee that it will be a MAC
  82  * address - SNAP frames can also be captured with "Linux cooked mode"
  83  * headers, e.g. on the "any" device, and those only have a destination
  84  * address for packets sent by the machine capturing the traffic, not for
  85  * packets received by the machine.
  86  */
  87
  88 static void
  89 dissect_hpteam(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
  90 {
  91
  92         col_set_str(pinfo->cinfo, COL_PROTOCOL, "HP NIC Team");
  93         col_add_fstr(pinfo->cinfo, COL_INFO, "HP NIC Teaming Heartbeat; Port MAC = %s",
  94             ep_address_to_str(&pinfo->dl_src));
  95
  96         if (tree) { /* we are being asked for details */
  97                 proto_item *hpteam_item;
  98                 proto_tree *hpteam_tree;
  99                 hpteam_item = proto_tree_add_item(tree, proto_hpteam, tvb, 0, -1, ENC_NA);
 100                 hpteam_tree = proto_item_add_subtree(hpteam_item, ett_hpteam);
 101                 proto_tree_add_item(hpteam_tree, hf_hpteam, tvb, 0, -1, ENC_NA);
 102         }
 103 }
 104
 105 void proto_register_hpteam(void)
 106 {
 107         static hf_register_info hf_pid = {
 108                 &hf_llc_hpteam_pid,
 109                 { "PID", "llc.hpteam_pid",
 110                   FT_UINT16, BASE_HEX, VALS(hpteam_pid_vals),
 111                   0x0, NULL, HFILL }
 112         };
 113
 114         static hf_register_info hf_data[] = {
 115                 {&hf_hpteam,
 116                  { "Proprietary Data", "hpteam.data",
 117                    FT_BYTES, BASE_NONE, NULL, 0x0,
 118                    NULL, HFILL }
 119                 }
 120         };
 121
 122         static gint *ett[] = {
 123                 &ett_hpteam
 124         };
 125
 126         proto_hpteam = proto_register_protocol ("HP NIC Teaming Heartbeat", "HPTEAM", "hpteam");
 127
 128         /*Tied into the LLC dissector so register the OUI with LLC*/
 129         llc_add_oui(OUI_HP_2, "llc.hpteam_pid", "LLC Hewlett Packard OUI PID", &hf_pid);
 130         proto_register_field_array(proto_hpteam, hf_data, array_length(hf_data));
 131         proto_register_subtree_array(ett, array_length(ett));
 132         register_dissector("hpteam", dissect_hpteam, proto_hpteam);
 133 }
 134
 135 void proto_reg_handoff_hpteam(void)
 136 {
 137         dissector_handle_t hpteam_handle;
 138
 139         hpteam_handle = find_dissector("hpteam");
 140         /* Register dissector to key off of known PID / OUI combination */
 141         dissector_add_uint("llc.hpteam_pid", 0x0002, hpteam_handle);
 142 }