Ethereal-dev: Re: [Ethereal-dev] resolving of well-known mac-addresses

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Mon, 9 Sep 2002 13:12:03 -0700
On Fri, Aug 30, 2002 at 10:31:36AM +0200, Joerg Mayer wrote:
> On Fri, Aug 30, 2002 at 09:02:16AM +0200, Hannes Gredler wrote:
> > | 01:00:5e:00:01/40       IETF-VRRP
> 
> currently, 01:00:5e IETF
> and 01:00:5e:00:01:1b will resolve to IETF_00:01:1b.
> With my idea things should resolve to NAME_ remaining bytes in
> the above notation bytes that are only partially used should be
> displayed either completely or maybe in the form IETF-SOME_x3:44
> if the line was 01:00:5e:88:88:00/37

I've checked in an implementation of that, along with:

	a "wka.tmpl" file containing a bunch of well-known MAC addresses
	and address ranges;

	an updated to "make-manuf" to append that file to the end of
	"manuf";

	an updated "manuf" file (which, being the result of
	"make-manuf", includes some updates to the OUIs).

Currently, the bytes not completely covered by the netmask have those
bits not covered by the netmask appended to the string from the file,
with a "_" as a separator.

However, currently, names for MAC addresses, MAC address ranges, and
vendors can contain no spaces - the first space and everything after it
is ignored.

It might be nice, for OUIs, to be able to display the full vendor name,
although I'm not sure how that would best be done - something such as

	Source: 00:e0:52:66:66:66 (FOUNDRY_66:66:66 - FOUNDRY NETWORKS, INC.)

might do it, but that does run the risk of making the line too long.

Furthermore, for the well-known addresses, just chopping off the first
token from the description wouldn't be enough; for example, two of the
well-known addresses I added to "wka.tmpl" from the cavebear.com list
are

	01-00-10-00-00-20       Hughes Lan Systems Terminal Server S/W download
	01-00-10-FF-FF-20       Hughes Lan Systems Terminal Server S/W request

but I had to replace the spaces in the description with hyphens
(underscores would also have worked; I guess, on some platforms with
some fonts, ISO 8859/x non-breaking space would have worked as well, but
that wouldn't necessarily work everywhere you'd want it to) so that
those addresses didn't just show up as "Hughes".

It might be nice to allow those to display as "Hughes Lan Systems
Terminal Server S/W download" and "Hughes Lan Systems Terminal Server
S/W request".

Furthermore, it might be nice to have well-known address ranges have a
printf-style format string as the name, e.g.

	00-00-5E-00-01/40       IETF VRRP virtual router VRID=%u

(or %x, if people prefer the VRID to display in hex).  Whether we should
have a format item for each byte not completely covered by the netmask,
or combine those bytes into an up-to-64-bit number and just print that
number, is another matter; the latter is trickier, as not all compilers
with which Ethereal is built support 64-bit integral data types *AND*
the formats used for those data types aren't standardized, so to make
that work we'd have to parse the format string ourselves rather than
having the OS's printf routines do it.