Wireshark · Ethereal-dev: [ethereal-dev] Re: resolving implemented AND: new patch

["Hannes R. Boehm" <hannes@xxxxxxxxx>]

On Sun, Sep 06, 1998 at 02:46:37PM +0200, Laurent Deniel wrote:
> Hi,
> 
>  I have implemented network object name resolving.  The current
>  implemented objects are : IP addresses, UDP and TCP ports.
> 
>  All name resolutions use a hash table to optimize lookup time
>  and a mechanism is implemented to avoid long DNS timeout for
>  hostname lookups.

Do you know the NAI Sniffer ?

It does take the RR form DNS packets it has already analyzed instead of
making a lookup itself. This way there is no traffic generated by the sniffer.
(even if not all IPs show up in the DNS packets it is quite usefull)

I have a short patch for ethereal too :)

OSPF: fixed error (occured when capture length was smaller than OSPF packet size)
      -> BTW: the kdbg (KDE graphical gdb frontend) is realy cool :) 
IPv6: started work on IPv6 -> how do I translate 128 bit of NwByteOrder to
      a IPv6 Address String ? (e.g.:  01::A2:23:01 ???)
      -> maybe there is a lib ? -> I dont have a IPv6 capable linux box

!!! -> IPv6 support is far from complete (I just did reserve the  hooks
       within Makefile.in packet.h and ethertype.c so that I don't have
       to merge my changes whenever there is a new release (new IPv6 patches
       will only modify packet-ipv6.[ch])) 

AUTHORS: added my homepage and some Info on what I exactly do for Ethereal
         -> I changed the format -> just take a look

Hannes

-- 
--
"The nice thing about standards is that there's so many to choose from." 
        -- Andrew S. Tanenbaum
!------------------------------------------------------------------!
  Hannes R. Boehm
        email   : hannes@xxxxxxxxx
        www     : http://hannes.boehm.org
        PGP-key : http://hannes.boehm.org/hannes-pgp.asc
!------------------------------------------------------------------!

diff -u --recursive --new-file ethereal-0.3.14/AUTHORS ethereal-0.3.14-hannes/AUTHORS
--- ethereal-0.3.14/AUTHORS	Sun Aug 30 19:59:33 1998
+++ ethereal-0.3.14-hannes/AUTHORS	Sun Sep  6 17:43:53 1998
@@ -5,11 +5,29 @@
 
 Contributors
 ------------
-Gilbert Ramirez Jr.  <gram@xxxxxxxxxxxxxxxxxxx>
-Hannes R. Boehm      <hannes@xxxxxxxxx>
-Mike Hall            <mlh@xxxxxx>
-Bobo Rajec           <bobo@xxxxxxxxxxxxxxxxx>
-cpg                  <cpg@xxxxxxxxxxxxxx>
+Gilbert Ramirez Jr.  <gram@xxxxxxxxxxxxxxxxxxx>{
+    /* add your info here */
+}
+
+Hannes R. Boehm      <hannes@xxxxxxxxx> {
+    http://hannes.boehm.org/
+
+    OSPFv2 
+    RIPv1, RIPv2
+    started IPv6 support
+}
+
+Mike Hall            <mlh@xxxxxx>{
+    /* add your info here */
+}
+
+Bobo Rajec           <bobo@xxxxxxxxxxxxxxxxx>{
+    /* add your info here */
+}
+
+cpg                  <cpg@xxxxxxxxxxxxxx>{
+    /* add your info here */
+}
 
 
 Alain Magloire <alainm@xxxxxxxxxxxxxxxxxx> was kind enough to
diff -u --recursive --new-file ethereal-0.3.14/Makefile.in ethereal-0.3.14-hannes/Makefile.in
--- ethereal-0.3.14/Makefile.in	Sun Sep  6 04:42:22 1998
+++ ethereal-0.3.14-hannes/Makefile.in	Sun Sep  6 15:48:20 1998
@@ -87,6 +87,7 @@
 	packet-llc.c   \
 	packet-lpd.c   \
 	packet-ip.c    \
+	packet-ipv6.c  \
 	packet-ipx.c   \
 	packet-ospf.c  \
 	packet-ppp.c   \
@@ -139,9 +140,9 @@
 LIBS = @LIBS@
 ethereal_OBJECTS =  capture.o ethereal.o ethertype.o file.o filter.o \
 menu.o packet.o packet-arp.o packet-bootp.o packet-data.o packet-dns.o \
-packet-eth.o packet-llc.o packet-lpd.o packet-ip.o packet-ipx.o \
-packet-ospf.o packet-ppp.o packet-raw.o packet-rip.o packet-tcp.o \
-packet-tr.o packet-trmac.o packet-udp.o print.o ps.o util.o
+packet-eth.o packet-llc.o packet-lpd.o packet-ip.o packet-ipv6.o  \
+packet-ipx.o packet-ospf.o packet-ppp.o packet-raw.o packet-rip.o \
+packet-tcp.o packet-tr.o packet-trmac.o packet-udp.o print.o ps.o util.o
 ethereal_LDADD = $(LDADD)
 ethereal_LDFLAGS = 
 CFLAGS = @CFLAGS@
@@ -374,6 +375,7 @@
 packet-dns.o: packet-dns.c config.h packet.h
 packet-eth.o: packet-eth.c config.h packet.h ethereal.h etypes.h
 packet-ip.o: packet-ip.c config.h ethereal.h packet.h etypes.h
+packet-ipv6.o: packet-ipv6.c packet-ipv6.h config.h ethereal.h packet.h etypes.h
 packet-ipx.o: packet-ipx.c config.h ethereal.h packet.h
 packet-llc.o: packet-llc.c config.h packet.h ethereal.h etypes.h
 packet-lpd.o: packet-lpd.c config.h packet.h ethereal.h etypes.h
diff -u --recursive --new-file ethereal-0.3.14/ethertype.c ethereal-0.3.14-hannes/ethertype.c
--- ethereal-0.3.14/ethertype.c	Sun Aug 30 19:59:55 1998
+++ ethereal-0.3.14-hannes/ethertype.c	Sun Sep  6 15:45:21 1998
@@ -53,6 +53,13 @@
       }
       dissect_ip(pd, offset, fd, tree);
       break;
+    case ETHERTYPE_IPv6:
+      if (tree) {
+        add_item_to_tree(fh_tree, offset - 2, 2, "Type: IPv6 (0x%04x)",
+          etype);
+      }
+      dissect_ipv6(pd, offset, fd, tree);
+      break;
     case ETHERTYPE_ARP:
       if (tree) {
         add_item_to_tree(fh_tree, offset - 2, 2,
diff -u --recursive --new-file ethereal-0.3.14/etypes.h ethereal-0.3.14-hannes/etypes.h
--- ethereal-0.3.14/etypes.h	Sun Aug 30 19:59:55 1998
+++ ethereal-0.3.14-hannes/etypes.h	Sun Sep  6 15:45:21 1998
@@ -40,6 +40,10 @@
 #define ETHERTYPE_IP 0x0800
 #endif
 
+#ifndef ETHERTYPE_IPv6
+#define ETHERTYPE_IPv6 0x086dd
+#endif
+
 #ifndef ETHERTYPE_ARP
 #define ETHERTYPE_ARP 0x0806
 #endif
diff -u --recursive --new-file ethereal-0.3.14/packet-ipv6.c ethereal-0.3.14-hannes/packet-ipv6.c
--- ethereal-0.3.14/packet-ipv6.c	Thu Jan  1 01:00:00 1970
+++ ethereal-0.3.14-hannes/packet-ipv6.c	Sun Sep  6 17:42:53 1998
@@ -0,0 +1,105 @@
+/* packet-ipv6.c
+ * Routines for IPv6 packet disassembly 
+ *
+ * Ethereal - Network traffic analyzer
+ * By Gerald Combs <gerald@xxxxxxxx>
+ * Copyright 1998 Gerald Combs
+ *
+ * 
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <gtk/gtk.h>
+#include <pcap.h>
+
+#include <stdio.h>
+
+#ifdef HAVE_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+
+#ifdef HAVE_NETINET_IN_H
+# include <netinet/in.h>
+#endif
+
+#include "ethereal.h"
+#include "packet.h"
+#include "packet-ipv6.h"
+#include "etypes.h"
+
+void
+dissect_ipv6(const u_char *pd, int offset, frame_data *fd, GtkTree *tree) {
+  GtkWidget *ipv6_tree, *ti;
+
+  e_ipv6_header ipv6;
+
+  memcpy(&ipv6, (void *) &pd[offset], 8); 
+
+  if (fd->win_info[0]) {
+      switch(ipv6.next_header){
+	  /*
+	  case IP_PROTO_ICMP:
+          case IP_PROTO_IGMP:
+          case IP_PROTO_TCP:
+          case IP_PROTO_UDP:
+          case IP_PROTO_OSPF:
+	  */
+          /* Names are set in the associated dissect_* routines */
+	  /*    break; */
+	 default:
+             strcpy(fd->win_info[3], "IPv6");
+             sprintf(fd->win_info[4], "IPv6 support is still under development (%d)", ipv6.next_header);
+      }
+  }
+  if (tree) {
+    /* !!! specify length */
+    ti = add_item_to_tree(GTK_WIDGET(tree), offset, 40,
+      "Internet Protocol Version 6");
+    ipv6_tree = gtk_tree_new();
+    add_subtree(ti, ipv6_tree, ETT_IPv6);
+
+    /* !!! warning: version also contains 4 Bit priority */
+    add_item_to_tree(ipv6_tree, offset,      1, "Version: %d Priority: %d", ipv6.version >> 4 , ipv6.version & 15);
+    add_item_to_tree(ipv6_tree, offset + 6,  1, "Next Header: %d", ipv6.next_header);
+    add_item_to_tree(ipv6_tree, offset + 4,  2, "Payload Length: %d", ntohs(ipv6.payload_length));
+  }
+
+  /* start of the new header (could be a extension header) */
+  offset += 40;
+  switch (ipv6.next_header) {
+      case IP_PROTO_ICMP:
+          dissect_icmp(pd, offset, fd, tree);
+          break;
+      case IP_PROTO_IGMP:
+          dissect_igmp(pd, offset, fd, tree);
+          break;
+      case IP_PROTO_TCP:
+          dissect_tcp(pd, offset, fd, tree);
+          break;
+      case IP_PROTO_UDP:
+          dissect_udp(pd, offset, fd, tree);
+          break;
+      case IP_PROTO_OSPF:
+          dissect_ospf(pd, offset, fd, tree);
+          break;
+      default:
+          dissect_data(pd, offset, fd, tree);
+  }
+}
diff -u --recursive --new-file ethereal-0.3.14/packet-ipv6.h ethereal-0.3.14-hannes/packet-ipv6.h
--- ethereal-0.3.14/packet-ipv6.h	Thu Jan  1 01:00:00 1970
+++ ethereal-0.3.14-hannes/packet-ipv6.h	Sun Sep  6 15:45:21 1998
@@ -0,0 +1,8 @@
+typedef struct _e_ipv6_header{
+    /* the version contains 4-bit version and 4-bit priority */
+    guint8 	version;
+    guint8 	flow_label[3];
+    guint16 	payload_length;
+    guint8	next_header;
+    guint8	hop_limit;
+} e_ipv6_header;
diff -u --recursive --new-file ethereal-0.3.14/packet-ospf.c ethereal-0.3.14-hannes/packet-ospf.c
--- ethereal-0.3.14/packet-ospf.c	Sun Aug 30 20:00:06 1998
+++ ethereal-0.3.14-hannes/packet-ospf.c	Sun Sep  6 15:45:21 1998
@@ -97,6 +97,7 @@
 	add_item_to_tree(ospf_header_tree, offset + 2 , 2, "Packet Legth: %d", 
 	                                                   ntohs(ospfh->length));
 	add_item_to_tree(ospf_header_tree, offset + 4 , 4, "Source OSPF Router ID: %s", 
+
 	                                                   ip_to_str((guint8 *) &(ospfh->routerid)));
 	if (!(ospfh->area)) {
 	   add_item_to_tree(ospf_header_tree, offset + 8 , 4, "Area ID: Backbone");
@@ -168,7 +169,6 @@
 	add_item_to_tree(ospf_hello_tree, offset , 4, "Network Mask: %s",  ip_to_str((guint8 *) &ospfhello->network_mask));
 	add_item_to_tree(ospf_hello_tree, offset + 4, 2, "Hello Intervall: %d seconds",  ntohs(ospfhello->hellointervall));
 
-
 	/* ATTENTION !!! no check for length of options string */
 	options_offset=0;
 	if(( ospfhello->options & OSPF_OPTIONS_E ) == OSPF_OPTIONS_E){
@@ -198,8 +198,10 @@
 	add_item_to_tree(ospf_hello_tree, offset + 12, 4, "Designated Router: %s",  ip_to_str((guint8 *) &ospfhello->drouter));
 	add_item_to_tree(ospf_hello_tree, offset + 16, 4, "Backup Designated Router: %s",  ip_to_str((guint8 *) &ospfhello->bdrouter));
 
+
 	offset+=20;
-	while((fd->cap_len - offset) >= 4){
+	while(((int)(fd->cap_len - offset)) >= 4){
+	    printf("%d", fd->cap_len - offset);
 	    ospfneighbor=(guint32 *) &pd[offset];
 	    add_item_to_tree(ospf_hello_tree, offset, 4, "Active Neighbor: %s",  ip_to_str((guint8 *) ospfneighbor));
 	    offset+=4;
@@ -272,7 +274,7 @@
     /* LS Headers will be processed here */
     /* skip to the end of DB-Desc header */
     offset+=8;
-    while( (fd->cap_len - offset) >= OSPF_LSA_HEADER_LENGTH ) {
+    while( ((int) (fd->cap_len - offset)) >= OSPF_LSA_HEADER_LENGTH ) {
        dissect_ospf_lsa(pd, offset, fd, (GtkTree *) tree, FALSE);
        offset+=OSPF_LSA_HEADER_LENGTH;
     }
@@ -288,7 +290,7 @@
     /* zero or more LS requests may be within a LS Request */
     /* we place every request for a LSA in a single subtree */
     if (tree) {
-	while( ( fd->cap_len - offset) >= OSPF_LS_REQ_LENGTH ){
+	while( ((int) ( fd->cap_len - offset)) >= OSPF_LS_REQ_LENGTH ){
              ospf_lsr = (e_ospf_ls_req *) &pd[offset]; 
 	     ti = add_item_to_tree(GTK_WIDGET(tree), offset, OSPF_LS_REQ_LENGTH, "Link State Request"); 
 	     ospf_lsr_tree = gtk_tree_new(); 
@@ -359,7 +361,7 @@
 dissect_ospf_ls_ack(const u_char *pd, int offset, frame_data *fd, GtkTree *tree) {
 
     /* the body of a LS Ack packet simply contains zero or more LSA Headers */
-    while( (fd->cap_len - offset) >= OSPF_LSA_HEADER_LENGTH ) {
+    while( ((int)(fd->cap_len - offset)) >= OSPF_LSA_HEADER_LENGTH ) {
        dissect_ospf_lsa(pd, offset, fd, (GtkTree *) tree, FALSE);
        offset+=OSPF_LSA_HEADER_LENGTH;
     }
@@ -520,7 +522,7 @@
                                                  ip_to_str((guint8 *) &(network_lsa->network_mask)));
 		offset += 4;
 
-		while((fd->cap_len - offset) >= 4){
+		while( ((int) (fd->cap_len - offset)) >= 4){
 		    attached_router = (guint32 *) &pd[offset];
 		    add_item_to_tree(ospf_lsa_tree, offset, 4, "Attached Router: %s", 
                                                  ip_to_str((guint8 *) attached_router));
diff -u --recursive --new-file ethereal-0.3.14/packet.h ethereal-0.3.14-hannes/packet.h
--- ethereal-0.3.14/packet.h	Sat Sep  5 22:25:06 1998
+++ ethereal-0.3.14-hannes/packet.h	Sun Sep  6 15:49:28 1998
@@ -281,9 +281,10 @@
 #define ETT_RAW          30
 #define ETT_BOOTP        31
 #define ETT_BOOTP_OPTION 32
+#define ETT_IPv6	 33
 
 /* Should be the last item number plus one */
-#define NUM_TREE_TYPES 32
+#define NUM_TREE_TYPES 34
 
 /* Utility routines used by packet*.c */
 gchar*     ether_to_str(guint8 *);
@@ -321,6 +322,7 @@
 void dissect_icmp(const u_char *, int, frame_data *, GtkTree *);
 void dissect_igmp(const u_char *, int, frame_data *, GtkTree *);
 void dissect_ip(const u_char *, int, frame_data *, GtkTree *);
+void dissect_ipv6(const u_char *, int, frame_data *, GtkTree *);
 void dissect_ipx(const u_char *, int, frame_data *, GtkTree *);
 void dissect_llc(const u_char *, int, frame_data *, GtkTree *);
 void dissect_lpd(const u_char *, int, frame_data *, GtkTree *);