summaryrefslogtreecommitdiff
path: root/usr.sbin/tcpdump
AgeCommit message (Collapse)Author
2020-08-17add geneve option printing.David Gwynne
mostly modelled on the nsh md2 printing.
2020-08-17don't need to shift the vxlan vni twice.David Gwynne
2020-08-17add initial support for handling geneve packets.David Gwynne
it's like vxlan, but different. the most interesting difference to vxlan is that the protocol adds support for adding optional metadata to packets (like nsh). this diff currently just skips that stuff and just handles the payload. for now.
2020-07-21Avoid integer underflow due to tiny snaplenkn
For DLT_NULL and DLT_LOOP interfaces, print-null.c passes `caplen - NULL_HDRLEN' as length to default_print() which takes an unsigned integer, hence if caplen is smaller than the header itself (four octets), this difference wraps around. Exit early in such cases and print the expected truncation marker "[|null]" instead. Feedback OK dlg
2020-07-20Remove unused variable "caplen"kn
No object change.
2020-06-21Add RCS markerTheo Buehler
2020-06-21wire the wireguard packet printer into tcpdump.David Gwynne
from Matt Dunwoodie and Jason A. Donenfeld
2020-06-21don't claim packets as wg if there's not enough captured bytes to read.David Gwynne
2020-06-21cope with a truncated capture of a packet. this avoids reading invalid mem.David Gwynne
2020-06-21add a printer for wireguard messages, but not hooked up just yet.David Gwynne
from Matt Dunwoodie and Jason A. Donenfeld
2020-05-20properly pass the number of strings in an array to gtp_print_str.David Gwynne
from miod
2020-04-15add support for printing RfC 2332 NBMA Next Hop Resolution Protocol (NHRP)remi
ok dlg@
2020-03-23Spell "status" correctly.Patrick Wildt
ok jasper@ mpi@
2020-02-24extend decoding of control transfers:Jasper Lievisse Adriaanse
- print the stage name - print additional information about the request for Setup packets - GET_DESCRIPTOR requests are further decoded tweaks and ok mpi@
2020-02-22fix a crash when printing the contents of a malformed packet where the packetJasper Lievisse Adriaanse
length was smaller than the sizeof the usbpcap header. we'd end up passing a negative value as the length to default_print(). found with afl-fuzz ok mpi@
2020-02-12- print 'dlen=' to make it more clear what that number indicatesJasper Lievisse Adriaanse
- add missing rcs id - use 'goto trunc' as is common with other printers ok mpi@
2020-01-24- (void)printf() -> printf(); the cast adds clutter for little value.Richard Procter
- fprintf(stdout, ...) -> printf() - fputs(x, stdout) -> printf(); for consistency. fputs is twice as fast on atom x5-Z8300@1.44GHz but Amdahl sees a pure printf tcpdump only 2% slower than a pure fputs (for constant strings) tcpdump to /dev/null across a 20MB/~170k packet pcap file. ok dlg@ for fputs and ok tedu@ krw@ deraadt@ a2k19 for the rest
2019-12-03add support for printing RFC 8300 Network Service Header (NSH)David Gwynne
ok deraadt@
2019-12-02add support for VXLAN-GPE as per draft-ietf-nvo3-vxlan-gpe-08.David Gwynne
it's nicely backwards compatible, so we can use the same code for both vxlan and vxlan-gpe.
2019-12-02the dhcp6 printing doesn't need these files anymore.David Gwynne
they were based on draft-ietf-dhc-dhcpv6-14, which was not what ended up in the dhcpv6 rfc(s). the current printing code is a lot smaller and self contained. ok deraadt@
2019-12-02rewrite dhcpv6 parsing so it follows the rfc, not an incompat draft.David Gwynne
it looks like this code was using draft-ietf-dhc-dhcpv6-14 from 1999. there were 27 drafts, and by the time it got to draft 23 and the rfc it was significantly different. this code for draft 14 cannot handle actual dhcpv6 messages. im kind of surprised (disappointed?) that noone noticed before. i only noticed cos the code was segfaulting on sparc64, and when i tried to fix it the resulting messages looked nothing like what stock tcpdump produced. the main difference between the early drafts and what ended up in the rfc is that the base dhcpv6 messages in early drafts were large structure with a lot of fixed fields, while the rfc settled on a 4 byte header that contains a 1 byte message type and a 3 byte transaction id. the rest of the messages are built from dhcp options fields. this cuts all the old handling out, and fixes the fault in the options handling by using EXTRACT_16BITS to get at the code and length fields instead of using ntohs. dhcpv6 explicitly states that it does not align options, so this is necessary to avoid faults on strict alignment archs anyway. no options are pretty printed at the moment, you just get a numeric type, a length, and a hexdump of the value. this is still better than the garbage that the draft parsing produced. if someone is interested in making this easier to read, it would be a straightforward and well contained project to better handle option printing. ok deraadt@
2019-11-27OpenFlow 1.3 defines packet header patterns of interest using TLVs (OXMs)akoshibe
that represent various header fields. One place where OXMs are used is in the sef_field action, which contains one OXM representing the header field to set, followed by padding to align the action in the OpenFlow message to 64 bits. Currently, we assume that a set_field action can contain multiple OXMs and that they do not need to be padded. This matches the way we handle OpenFlow messages that contain set_field actions so that we follow the specs. OK ori claudio
2019-11-06mention in tcpdump(8) description of -i that one can use either a networkStuart Henderson
or a USB device. ok mpi
2019-10-31fix inconsistency; from tim kuijstenJason McIntyre
agreed by deraadt
2019-09-25pcap-filter now section 5: adjust XrJason McIntyre
2019-09-19print the IPs on ESP packets.David Gwynne
this was lost when tcpdump learnt to look inside udpencap. found by, and ok markus@
2019-09-11CDP's Native-VLAN-ID does not need a substraction.Martijn van Duren
While here add a link to the documentation. OK sthen@
2019-09-03pcap-filter is now section 7;Jason McIntyre
2019-08-30one more ethers.3 -> ether_aton.3;Jason McIntyre
2019-08-30catch up to ethers(3)->ether_aton(3) renamingTheo de Raadt
2019-08-30mop up for the pcap.3 rename;Jason McIntyre
help/ok deraadt
2019-07-03snprintf/vsnprintf return < 0 on error, rather than -1.Theo de Raadt
2019-06-28When system calls indicate an error they return -1, not some arbitraryTheo de Raadt
value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
2019-05-26support -T erspan so arbitrary gre protocols can be seen as erspanDavid Gwynne
this lets me configure a custom gre protocol on a dell s4810 or s5048 and see what's inside it when it lands on an openbsd box. ok lteo@
2019-05-17handle ERSPAN type IDavid Gwynne
type I and II share their GRE protocol, but you tell them apart by checking if a sequence number is used. type I does not use a sequence number and contains a bare ethernet frame. type II contains a sequence number and a shim header that is already handled by the code. tested with a Dell S5048F-ON and an encapsulated remote port mirror setup.
2019-05-11Support extended shutdown communications in tcpdump as well.Claudio Jeker
OK sthen@ deraadt@
2019-04-14md5 auth has useful information on the wire that helps when fixing issuesDavid Gwynne
print at least the key-id, and seq when -v is set, and the offset and len when -vv is set. ok sthen@ bluhm@
2019-04-05print the gre protocol number as hex when vflag is enabledDavid Gwynne
this is useful for telling the MPLSes apart, and generally understanding what you're seeing.
2019-04-05support printing cdp over gre and pppDavid Gwynne
ok deraadt@ mpi@ sthen@
2019-04-02print MPLS_MCAST as mpls, rather than unknownDavid Gwynne
The caveat with this is that MPLS and MPLS_MCAST look exactly the same. I could prefix the MCAST line with "multicast" or something, but like everything else in MPLS the meaning of that protocol type is supposed to have changed. It's no longer meant to indicate multicast mpls, but mpls with a label selected by an upstream. So what's the right thing to do? noticed by Mitchell Krome, who used this breakage to identify another problem, which won't happen anymore.
2019-03-18tweak previous;Jason McIntyre
2019-03-18support configuring BIOCSFILDROP with tcpdump.David Gwynne
this allows tcpdump to be used a quick and dirty firewall. it also looks like an amazing foot-gun, so be careful. for example `tcpdump -B drop -i ix1 udp and port 7` lets you completely drop discard packets in the hardware interrupt handler. ok sthen@ mikeb@ claudio@ visa@
2019-02-05handle Cisco's Encapsulated Remote Switch Port Analyzer (ERSPAN) protocolDavid Gwynne
ERSPAN II is an 8 byte header before an ethernet payload. the switch at work doesnt produce erspan III, so I haven't handled that yet. this at least let's me see what's on the wire so i can contemplate how i want to deal with the payload. based on draft-foschiano-erspan-03
2019-01-26fix microsecond output of timestamp deltas (-tttt)Richard Procter
2019-01-03Add snmpv3 support.Martijn van Duren
Standard output should remain the same. Additional information is placed under the -v flag. -vv can be used to retrieve the asn1 dumps. Input and OK jmatthew@
2018-12-28print well-known SAFI name instead of valuedenis
OK claudio@ sthen@
2018-12-20LLDP has it's own group address, so teach tcpdump about it.David Gwynne
ok deraadt@
2018-11-18later versions of 802.1Q replaced the vlan CFI field with DEIDavid Gwynne
CFI stood for canonical format indicator, and basically said whether the payload was ethernet of fddi (with 0 meaning ethernet). DEI stands for drop eligibility indicator
2018-11-18handle the 802.1Q i-tag format for provider backbone bridges.David Gwynne
2018-11-17tcpdump(8) monitor process privdropBryan Steele
The privsep monitor process handles all privileged operations on behalf of the unprivileged "packet parser" process. Once it enters its runtime state, it only needs to: * Perform DNS and other "numbers to names" lookups, sending results back over a pipe/socketpair. * Display the final packet statistics on ^C. We can finally now drop root privileges in this process as well, as bpf BIOCGSTATS is still permitted by non-root on open descriptors after it has been permanently locked with BIOCLOCK. This provides some additional protection, to go along with the already tight unveil(2) and pledge(2) restrictions. With this change tcpdump(8) completely drops root privileges at runtime. ok mestre@, deraadt@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-29 11:39:55 +0000