epan/dissectors/packet-rlm.c

   1 /* packet-rlm.c
   2  * Routines for RLM dissection
   3  * Copyright 2004, Duncan Sargeant <dunc-ethereal@rcpt.to>
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  24  */
  25
  26 /*
  27  * RLM is a proprietary Cisco protocol used for centralling managing
  28  * many redundant NASes.  I don't know much about the format, but you
  29  * can read about the feature here:
  30  *
  31  * http://www.cisco.com/en/US/docs/ios/12_0t/12_0t3/feature/guide/rlm_123.html
  32  *
  33  * RLM runs on a UDP port (default 3000) between the MGC and the NAS.
  34  * On port N+1 (default 3001), a Q.931/LAPD/UDP connection is maintained.
  35  * Both sides use the same local port number for the connection, so source
  36  * and dest port are always the same.
  37  *
  38  * In large networks, the links are typically split onto higher ports,
  39  * so anything up to 3015 (or higher) could either be RLM or Q.931 traffic,
  40  * although always the RLM has the one lower port number for that RLM group.
  41  *
  42  * Multiple RLM groups are possible on a single NAS.
  43  *
  44  * I haven't been able to find the protocol documented, so I've
  45  * guessed some of the fields based on the output of debug commands on
  46  * cisco NASes.
  47  *
  48  */
  49
  50 #include "config.h"
  51
  52 #include <glib.h>
  53
  54 #include <epan/packet.h>
  55 #include <epan/xdlc.h>
  56
  57 /* Initialize the protocol and registered fields */
  58 static int proto_rlm = -1;
  59
  60 static int hf_rlm_version = -1;
  61 static int hf_rlm_type = -1;
  62 static int hf_rlm_unknown = -1;
  63 static int hf_rlm_tid = -1;
  64 static int hf_rlm_unknown2 = -1;
  65
  66 /* Initialize the subtree pointers */
  67 static gint ett_rlm = -1;
  68
  69
  70 /* RLM definitions - missing some! */
  71
  72 #define RLM_START_REQUEST       1
  73 #define RLM_START_ACK           2
  74 /* #define ???  3 */
  75 /* #define ???  4 */
  76 #define RLM_ECHO_REQUEST        5
  77 #define RLM_ECHO_REPLY          6
  78 /* #define ???  ?? */
  79
  80
  81 /*
  82   Maybe this isn't the best place for it, but RLM goes hand in hand
  83   with Q.931 traffic on a higher port.
  84 */
  85 static dissector_handle_t lapd_handle;
  86
  87 static gboolean
  88 dissect_udp_lapd(tvbuff_t *tvb, packet_info *pinfo _U_ , proto_tree *tree, void *data _U_)
  89 {
  90         if (pinfo->srcport < 3001 || pinfo->srcport > 3015
  91                 || pinfo->destport < 3001 || pinfo->destport > 3015
  92                 || pinfo->destport != pinfo->srcport)
  93                         return FALSE;
  94
  95         /*
  96          * XXX - check for a valid LAPD address field.
  97          */
  98
  99         /*
 100          * OK, check whether the control field looks valid.
 101          */
 102         if (!check_xdlc_control(tvb, 2, NULL, NULL, FALSE, FALSE))
 103                 return FALSE;
 104
 105         /*
 106          * Loooks OK - call the LAPD dissector.
 107          */
 108         call_dissector(lapd_handle, tvb, pinfo, tree);
 109         return TRUE;
 110 }
 111
 112
 113 /* Code to actually dissect the packets */
 114 static gboolean
 115 dissect_rlm(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
 116 {
 117         proto_item *ti;
 118         proto_tree *rlm_tree;
 119         guint8 rlm_type, version;
 120         const char *type_str = NULL;
 121
 122         if (pinfo->srcport < 3000 || pinfo->srcport > 3015
 123                         || pinfo->destport < 3000 || pinfo->destport > 3015
 124                         || pinfo->destport != pinfo->srcport)
 125                 return FALSE;
 126
 127         version = tvb_get_guint8(tvb, 0);
 128         rlm_type = tvb_get_guint8(tvb, 1);
 129
 130         /* we only know about version 2, and I've only seen 8 byte packets */
 131         if (tvb_length(tvb) != 8 || version != 2) {
 132                 return FALSE;
 133         }
 134
 135         col_set_str(pinfo->cinfo, COL_PROTOCOL, "RLM");
 136
 137         switch (rlm_type) {
 138                 case RLM_START_REQUEST:
 139                         type_str = "Start request";
 140                         break;
 141
 142                 case RLM_START_ACK:
 143                         type_str = "Start acknowledgement";
 144                         break;
 145
 146                 case RLM_ECHO_REQUEST:
 147                         type_str = "Echo request";
 148                         break;
 149
 150                 case RLM_ECHO_REPLY:
 151                         type_str = "Echo reply";
 152                         break;
 153
 154                 default:
 155                         type_str = "Unknown type";
 156                         break;
 157         }
 158
 159         col_set_str(pinfo->cinfo, COL_INFO, type_str);
 160
 161         if (tree) {
 162                 /* proto_tree_add_protocol_format(tree, proto_rlm, tvb, 0,
 163                         16, "Cisco Session Management"); */
 164                 ti = proto_tree_add_item(tree, proto_rlm, tvb, 0, 8, ENC_NA);
 165                 rlm_tree = proto_item_add_subtree(ti, ett_rlm);
 166                 proto_tree_add_item(rlm_tree, hf_rlm_version, tvb, 0, 1, ENC_BIG_ENDIAN);
 167                 proto_tree_add_uint_format_value(rlm_tree, hf_rlm_type, tvb, 1, 1, rlm_type, "%u (%s)", rlm_type, type_str);
 168                 proto_tree_add_item(rlm_tree, hf_rlm_unknown, tvb, 2, 2, ENC_BIG_ENDIAN);
 169                 proto_tree_add_item(rlm_tree, hf_rlm_tid, tvb, 4, 2, ENC_BIG_ENDIAN);
 170                 proto_tree_add_item(rlm_tree, hf_rlm_unknown2, tvb, 6, 2, ENC_BIG_ENDIAN);
 171         }
 172
 173         return TRUE;
 174 }
 175
 176
 177 /* Register the protocol with Wireshark */
 178
 179 /* this format is require because a script is used to build the C function
 180    that calls all the protocol registration.
 181 */
 182
 183 void
 184 proto_reg_handoff_rlm(void)
 185 {
 186         /*
 187          * Find a handle for the LAPD dissector.
 188          */
 189         lapd_handle = find_dissector("lapd");
 190
 191         heur_dissector_add("udp", dissect_rlm, proto_rlm);
 192         heur_dissector_add("udp", dissect_udp_lapd, proto_get_id_by_filter_name("lapd"));
 193 }
 194
 195 void
 196 proto_register_rlm(void)
 197 {
 198
 199 /* Setup list of header fields  See Section 1.6.1 for details*/
 200         static hf_register_info hf[] = {
 201                 { &hf_rlm_version,
 202                         { "Version",           "rlm.version",
 203                         FT_UINT8, BASE_DEC, NULL, 0x0,
 204                         NULL, HFILL }
 205                 },
 206                 { &hf_rlm_type,
 207                         { "Type",           "rlm.type",
 208                         FT_UINT8, BASE_DEC, NULL, 0x0,
 209                         NULL, HFILL }
 210                 },
 211                 { &hf_rlm_unknown,
 212                         { "Unknown",           "rlm.unknown",
 213                         FT_UINT16, BASE_HEX, NULL, 0x0,
 214                         NULL, HFILL }
 215                 },
 216                 { &hf_rlm_tid,
 217                         { "Transaction ID",           "rlm.tid",
 218                         FT_UINT16, BASE_DEC, NULL, 0x0,
 219                         NULL, HFILL }
 220                 },
 221                 { &hf_rlm_unknown2,
 222                         { "Unknown",           "rlm.unknown2",
 223                         FT_UINT16, BASE_HEX, NULL, 0x0,
 224                         NULL, HFILL }
 225                 },
 226         };
 227
 228 /* Setup protocol subtree array */
 229         static gint *ett[] = {
 230                 &ett_rlm,
 231         };
 232
 233 /* Register the protocol name and description */
 234         proto_rlm = proto_register_protocol("Redundant Link Management Protocol",
 235             "RLM", "rlm");
 236
 237 /* Required function calls to register the header fields and subtrees used */
 238         proto_register_field_array(proto_rlm, hf, array_length(hf));
 239         proto_register_subtree_array(ett, array_length(ett));
 240 }