Re: tcpdump: print nhrp packets
> On 14 Apr 2020, at 8:15 pm, Remi Locherer wrote: > > On Tue, Apr 14, 2020 at 01:49:32PM +1000, David Gwynne wrote: >> >> >>> On 13 Apr 2020, at 19:03, Remi Locherer wrote: >>> >>> Hi, >>> >>> I recently looked into NHRP (RFC 2332) and noticed that our tcpdump does >>> not have a printer for it. So I added support for NHRP to tcpdump. >>> >>> Initially I was surprised: I expected a simpler protocol! But it is from >>> the 90's with all the protocols from then in mind (frame relay, ATM, ...). >>> >>> I tested with public available pcap files and compared the output with >>> wirshark. >>> https://packetlife.net/captures/protocol/nhrp/ >>> https://www.networkingwithfish.com/fun-in-the-lab-sniffer-tracing-a-dmvpn-tunnel-startup/ >>> >>> The output looks like this: >>> >>> 08:34:45.647483 172.16.25.2 > 172.16.15.2: gre NHRP: reg request, id 7 [tos >>> 0xc0] >>> 08:34:45.671422 172.16.15.2 > 172.16.25.2: gre NHRP: reg reply, id 7 [tos >>> 0xc0] >>> >>> 08:47:16.138679 172.16.15.2 > 172.16.25.2: gre NHRP: res request, id 6 [tos >>> 0xc0] >>> 08:47:16.148863 172.16.25.2 > 172.16.15.2: gre NHRP: res reply, id 6 [tos >>> 0xc0] >>> >>> With -v set: >>> >>> 08:34:45.647483 172.16.25.2 > 172.16.15.2: gre [] 2001 NHRP: reg request, >>> id 7, hopcnt 255, src nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.1 (code 0, >>> pl 255, mtu 1514, htime 7200, pref 0) [tos 0xc0] (ttl 254, id 22, len 116) >>> 08:34:45.671422 172.16.15.2 > 172.16.25.2: gre [] 2001 NHRP: reg reply, id >>> 7, hopcnt 255, src nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.1 (code 0, pl >>> 255, mtu 1514, htime 7200, pref 0) [tos 0xc0] (ttl 255, id 7, len 136) >>> >>> 08:47:16.138679 172.16.15.2 > 172.16.25.2: gre [] 2001 NHRP: res request, >>> id 6, hopcnt 254, src nbma 172.16.45.2, 192.168.0.4 -> 192.168.0.2 (code 0, >>> pl 0, mtu 1514, htime 7200, pref 0) [tos 0xc0] (ttl 254, id 20, len 116) >>> 08:47:16.148863 172.16.25.2 > 172.16.15.2: gre [] 2001 NHRP: res reply, id >>> 6, hopcnt 255, src nbma 172.16.45.2, 192.168.0.4 -> 192.168.0.2 (code 0, pl >>> 32, mtu 1514, htime 7199, pref 0, nbma 172.16.25.2, proto 192.168.0.2) [tos >>> 0xc0] (ttl 255, id 31, len 144) >>> >>> Extensions are not parsed and printed. >>> >>> It would be nice to get pcaps with expamles that use address or protocol >>> combinations other than GRE and IPv4. >>> >>> Comments, OKs? >> >> Can you print the addresses when -v is not set too? >> >> Otherwise I'm keen. >> > > Like this? yes. ok by me. > tcpdump -n: > 08:47:16.068855 172.16.25.2 > 172.16.15.2: gre NHRP: res request, id 8, src > nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.4 (code 0) [tos 0xc0] > 08:47:16.150679 172.16.15.2 > 172.16.25.2: gre NHRP: res reply, id 8, src > nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.4 (code 0, nbma 172.16.45.2, proto > 192.168.0.4) [tos 0xc0] > > tcpdump -nv: > 08:47:16.068855 172.16.25.2 > 172.16.15.2: gre [] 2001 NHRP: res request, id > 8, hopcnt 255, src nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.4 (code 0, pl > 0, mtu 1514, htime 7200, pref 0) [tos 0xc0] (ttl 255, id 29, len 96) > 08:47:16.150679 172.16.15.2 > 172.16.25.2: gre [] 2001 NHRP: res reply, id 8, > hopcnt 254, src nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.4 (code 0, pl 32, > mtu 1514, htime 7199, pref 0, nbma 172.16.45.2, proto 192.168.0.4) [tos 0xc0] > (ttl 254, id 21, len 164) > > > > Index: Makefile > === > RCS file: /cvs/src/usr.sbin/tcpdump/Makefile,v > retrieving revision 1.64 > diff -u -p -r1.64 Makefile > --- Makefile 3 Dec 2019 01:43:33 - 1.64 > +++ Makefile 28 Mar 2020 17:07:22 - > @@ -48,7 +48,7 @@ SRCS= tcpdump.c addrtoname.c privsep.c p > print-bgp.c print-ospf6.c print-ripng.c print-rt6.c print-stp.c \ > print-etherip.c print-lwres.c print-lldp.c print-cdp.c print-pflog.c \ > print-pfsync.c pf_print_state.c print-ofp.c ofp_map.c \ > - print-udpencap.c print-carp.c \ > + print-udpencap.c print-carp.c print-nhrp.c \ > print-802_11.c print-iapp.c print-mpls.c print-slow.c print-usbpcap.c \ > gmt2local.c savestr.c setsignal.c in_cksum.c > > Index: interface.h > === > RCS file: /cvs/src/usr.sbin/tcpdump/interface.h,v > retrieving revision 1.83 > diff -u -p -r1.83 interface.h > --- interface.h 3 Dec 2019 01:43:33 - 1.83 > +++ interface.h 28 Mar 2020 17:07:22 - > @@ -217,6 +217,7 @@ extern void ppp_ether_if_print(u_char *, > extern void gre_print(const u_char *, u_int); > extern void vxlan_print(const u_char *, u_int); > extern void nsh_print(const u_char *, u_int); > +extern void nhrp_print(const u_char *, u_int); > extern void icmp_print(const u_char *, u_int, const u_char *); > extern void ieee802_11_if_print(u_char *, const struct pcap_pkthdr *, > const u_char *); > Index: print-ether.c > === >
Re: tcpdump: print nhrp packets
On Tue, Apr 14, 2020 at 01:49:32PM +1000, David Gwynne wrote: > > > > On 13 Apr 2020, at 19:03, Remi Locherer wrote: > > > > Hi, > > > > I recently looked into NHRP (RFC 2332) and noticed that our tcpdump does > > not have a printer for it. So I added support for NHRP to tcpdump. > > > > Initially I was surprised: I expected a simpler protocol! But it is from > > the 90's with all the protocols from then in mind (frame relay, ATM, ...). > > > > I tested with public available pcap files and compared the output with > > wirshark. > > https://packetlife.net/captures/protocol/nhrp/ > > https://www.networkingwithfish.com/fun-in-the-lab-sniffer-tracing-a-dmvpn-tunnel-startup/ > > > > The output looks like this: > > > > 08:34:45.647483 172.16.25.2 > 172.16.15.2: gre NHRP: reg request, id 7 [tos > > 0xc0] > > 08:34:45.671422 172.16.15.2 > 172.16.25.2: gre NHRP: reg reply, id 7 [tos > > 0xc0] > > > > 08:47:16.138679 172.16.15.2 > 172.16.25.2: gre NHRP: res request, id 6 [tos > > 0xc0] > > 08:47:16.148863 172.16.25.2 > 172.16.15.2: gre NHRP: res reply, id 6 [tos > > 0xc0] > > > > With -v set: > > > > 08:34:45.647483 172.16.25.2 > 172.16.15.2: gre [] 2001 NHRP: reg request, > > id 7, hopcnt 255, src nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.1 (code 0, > > pl 255, mtu 1514, htime 7200, pref 0) [tos 0xc0] (ttl 254, id 22, len 116) > > 08:34:45.671422 172.16.15.2 > 172.16.25.2: gre [] 2001 NHRP: reg reply, id > > 7, hopcnt 255, src nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.1 (code 0, pl > > 255, mtu 1514, htime 7200, pref 0) [tos 0xc0] (ttl 255, id 7, len 136) > > > > 08:47:16.138679 172.16.15.2 > 172.16.25.2: gre [] 2001 NHRP: res request, > > id 6, hopcnt 254, src nbma 172.16.45.2, 192.168.0.4 -> 192.168.0.2 (code 0, > > pl 0, mtu 1514, htime 7200, pref 0) [tos 0xc0] (ttl 254, id 20, len 116) > > 08:47:16.148863 172.16.25.2 > 172.16.15.2: gre [] 2001 NHRP: res reply, id > > 6, hopcnt 255, src nbma 172.16.45.2, 192.168.0.4 -> 192.168.0.2 (code 0, pl > > 32, mtu 1514, htime 7199, pref 0, nbma 172.16.25.2, proto 192.168.0.2) [tos > > 0xc0] (ttl 255, id 31, len 144) > > > > Extensions are not parsed and printed. > > > > It would be nice to get pcaps with expamles that use address or protocol > > combinations other than GRE and IPv4. > > > > Comments, OKs? > > Can you print the addresses when -v is not set too? > > Otherwise I'm keen. > Like this? tcpdump -n: 08:47:16.068855 172.16.25.2 > 172.16.15.2: gre NHRP: res request, id 8, src nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.4 (code 0) [tos 0xc0] 08:47:16.150679 172.16.15.2 > 172.16.25.2: gre NHRP: res reply, id 8, src nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.4 (code 0, nbma 172.16.45.2, proto 192.168.0.4) [tos 0xc0] tcpdump -nv: 08:47:16.068855 172.16.25.2 > 172.16.15.2: gre [] 2001 NHRP: res request, id 8, hopcnt 255, src nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.4 (code 0, pl 0, mtu 1514, htime 7200, pref 0) [tos 0xc0] (ttl 255, id 29, len 96) 08:47:16.150679 172.16.15.2 > 172.16.25.2: gre [] 2001 NHRP: res reply, id 8, hopcnt 254, src nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.4 (code 0, pl 32, mtu 1514, htime 7199, pref 0, nbma 172.16.45.2, proto 192.168.0.4) [tos 0xc0] (ttl 254, id 21, len 164) Index: Makefile === RCS file: /cvs/src/usr.sbin/tcpdump/Makefile,v retrieving revision 1.64 diff -u -p -r1.64 Makefile --- Makefile3 Dec 2019 01:43:33 - 1.64 +++ Makefile28 Mar 2020 17:07:22 - @@ -48,7 +48,7 @@ SRCS= tcpdump.c addrtoname.c privsep.c p print-bgp.c print-ospf6.c print-ripng.c print-rt6.c print-stp.c \ print-etherip.c print-lwres.c print-lldp.c print-cdp.c print-pflog.c \ print-pfsync.c pf_print_state.c print-ofp.c ofp_map.c \ - print-udpencap.c print-carp.c \ + print-udpencap.c print-carp.c print-nhrp.c \ print-802_11.c print-iapp.c print-mpls.c print-slow.c print-usbpcap.c \ gmt2local.c savestr.c setsignal.c in_cksum.c Index: interface.h === RCS file: /cvs/src/usr.sbin/tcpdump/interface.h,v retrieving revision 1.83 diff -u -p -r1.83 interface.h --- interface.h 3 Dec 2019 01:43:33 - 1.83 +++ interface.h 28 Mar 2020 17:07:22 - @@ -217,6 +217,7 @@ extern void ppp_ether_if_print(u_char *, extern void gre_print(const u_char *, u_int); extern void vxlan_print(const u_char *, u_int); extern void nsh_print(const u_char *, u_int); +extern void nhrp_print(const u_char *, u_int); extern void icmp_print(const u_char *, u_int, const u_char *); extern void ieee802_11_if_print(u_char *, const struct pcap_pkthdr *, const u_char *); Index: print-ether.c === RCS file: /cvs/src/usr.sbin/tcpdump/print-ether.c,v retrieving revision 1.37 diff -u -p -r1.37 print-ether.c --- print-ether.c 24 Jan 2020 22:46:36 - 1.37 +++
Re: tcpdump: print nhrp packets
> On 13 Apr 2020, at 19:03, Remi Locherer wrote: > > Hi, > > I recently looked into NHRP (RFC 2332) and noticed that our tcpdump does > not have a printer for it. So I added support for NHRP to tcpdump. > > Initially I was surprised: I expected a simpler protocol! But it is from > the 90's with all the protocols from then in mind (frame relay, ATM, ...). > > I tested with public available pcap files and compared the output with > wirshark. > https://packetlife.net/captures/protocol/nhrp/ > https://www.networkingwithfish.com/fun-in-the-lab-sniffer-tracing-a-dmvpn-tunnel-startup/ > > The output looks like this: > > 08:34:45.647483 172.16.25.2 > 172.16.15.2: gre NHRP: reg request, id 7 [tos > 0xc0] > 08:34:45.671422 172.16.15.2 > 172.16.25.2: gre NHRP: reg reply, id 7 [tos > 0xc0] > > 08:47:16.138679 172.16.15.2 > 172.16.25.2: gre NHRP: res request, id 6 [tos > 0xc0] > 08:47:16.148863 172.16.25.2 > 172.16.15.2: gre NHRP: res reply, id 6 [tos > 0xc0] > > With -v set: > > 08:34:45.647483 172.16.25.2 > 172.16.15.2: gre [] 2001 NHRP: reg request, id > 7, hopcnt 255, src nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.1 (code 0, pl > 255, mtu 1514, htime 7200, pref 0) [tos 0xc0] (ttl 254, id 22, len 116) > 08:34:45.671422 172.16.15.2 > 172.16.25.2: gre [] 2001 NHRP: reg reply, id 7, > hopcnt 255, src nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.1 (code 0, pl 255, > mtu 1514, htime 7200, pref 0) [tos 0xc0] (ttl 255, id 7, len 136) > > 08:47:16.138679 172.16.15.2 > 172.16.25.2: gre [] 2001 NHRP: res request, id > 6, hopcnt 254, src nbma 172.16.45.2, 192.168.0.4 -> 192.168.0.2 (code 0, pl > 0, mtu 1514, htime 7200, pref 0) [tos 0xc0] (ttl 254, id 20, len 116) > 08:47:16.148863 172.16.25.2 > 172.16.15.2: gre [] 2001 NHRP: res reply, id 6, > hopcnt 255, src nbma 172.16.45.2, 192.168.0.4 -> 192.168.0.2 (code 0, pl 32, > mtu 1514, htime 7199, pref 0, nbma 172.16.25.2, proto 192.168.0.2) [tos 0xc0] > (ttl 255, id 31, len 144) > > Extensions are not parsed and printed. > > It would be nice to get pcaps with expamles that use address or protocol > combinations other than GRE and IPv4. > > Comments, OKs? Can you print the addresses when -v is not set too? Otherwise I'm keen. > > Remi > > > Index: Makefile > === > RCS file: /cvs/src/usr.sbin/tcpdump/Makefile,v > retrieving revision 1.64 > diff -u -p -r1.64 Makefile > --- Makefile 3 Dec 2019 01:43:33 - 1.64 > +++ Makefile 28 Mar 2020 17:07:22 - > @@ -48,7 +48,7 @@ SRCS= tcpdump.c addrtoname.c privsep.c p > print-bgp.c print-ospf6.c print-ripng.c print-rt6.c print-stp.c \ > print-etherip.c print-lwres.c print-lldp.c print-cdp.c print-pflog.c \ > print-pfsync.c pf_print_state.c print-ofp.c ofp_map.c \ > - print-udpencap.c print-carp.c \ > + print-udpencap.c print-carp.c print-nhrp.c \ > print-802_11.c print-iapp.c print-mpls.c print-slow.c print-usbpcap.c \ > gmt2local.c savestr.c setsignal.c in_cksum.c > > Index: interface.h > === > RCS file: /cvs/src/usr.sbin/tcpdump/interface.h,v > retrieving revision 1.83 > diff -u -p -r1.83 interface.h > --- interface.h 3 Dec 2019 01:43:33 - 1.83 > +++ interface.h 28 Mar 2020 17:07:22 - > @@ -217,6 +217,7 @@ extern void ppp_ether_if_print(u_char *, > extern void gre_print(const u_char *, u_int); > extern void vxlan_print(const u_char *, u_int); > extern void nsh_print(const u_char *, u_int); > +extern void nhrp_print(const u_char *, u_int); > extern void icmp_print(const u_char *, u_int, const u_char *); > extern void ieee802_11_if_print(u_char *, const struct pcap_pkthdr *, > const u_char *); > Index: print-ether.c > === > RCS file: /cvs/src/usr.sbin/tcpdump/print-ether.c,v > retrieving revision 1.37 > diff -u -p -r1.37 print-ether.c > --- print-ether.c 24 Jan 2020 22:46:36 - 1.37 > +++ print-ether.c 28 Mar 2020 17:07:22 - > @@ -303,6 +303,13 @@ recurse: > ether_pbb_print(p, length, caplen); > return (1); > > +#ifndef ETHERTYPE_NHRP > +#define ETHERTYPE_NHRP 0x2001 > +#endif > + case ETHERTYPE_NHRP: > + nhrp_print(p, length); > + return (1); > + > #ifdef PPP > case ETHERTYPE_PPPOEDISC: > case ETHERTYPE_PPPOE: > Index: print-gre.c > === > RCS file: /cvs/src/usr.sbin/tcpdump/print-gre.c,v > retrieving revision 1.30 > diff -u -p -r1.30 print-gre.c > --- print-gre.c 24 Jan 2020 22:46:36 - 1.30 > +++ print-gre.c 28 Mar 2020 17:07:22 - > @@ -289,6 +289,12 @@ gre_print_0(const u_char *p, u_int lengt > case 0x2000: > cdp_print(p, length, l, 0); > break; > +#ifndef ETHERTYPE_NHRP > +#define ETHERTYPE_NHRP 0x2001 > +#endif > +
tcpdump: print nhrp packets
Hi,
I recently looked into NHRP (RFC 2332) and noticed that our tcpdump does
not have a printer for it. So I added support for NHRP to tcpdump.
Initially I was surprised: I expected a simpler protocol! But it is from
the 90's with all the protocols from then in mind (frame relay, ATM, ...).
I tested with public available pcap files and compared the output with
wirshark.
https://packetlife.net/captures/protocol/nhrp/
https://www.networkingwithfish.com/fun-in-the-lab-sniffer-tracing-a-dmvpn-tunnel-startup/
The output looks like this:
08:34:45.647483 172.16.25.2 > 172.16.15.2: gre NHRP: reg request, id 7 [tos
0xc0]
08:34:45.671422 172.16.15.2 > 172.16.25.2: gre NHRP: reg reply, id 7 [tos 0xc0]
08:47:16.138679 172.16.15.2 > 172.16.25.2: gre NHRP: res request, id 6 [tos
0xc0]
08:47:16.148863 172.16.25.2 > 172.16.15.2: gre NHRP: res reply, id 6 [tos 0xc0]
With -v set:
08:34:45.647483 172.16.25.2 > 172.16.15.2: gre [] 2001 NHRP: reg request, id 7,
hopcnt 255, src nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.1 (code 0, pl 255,
mtu 1514, htime 7200, pref 0) [tos 0xc0] (ttl 254, id 22, len 116)
08:34:45.671422 172.16.15.2 > 172.16.25.2: gre [] 2001 NHRP: reg reply, id 7,
hopcnt 255, src nbma 172.16.25.2, 192.168.0.2 -> 192.168.0.1 (code 0, pl 255,
mtu 1514, htime 7200, pref 0) [tos 0xc0] (ttl 255, id 7, len 136)
08:47:16.138679 172.16.15.2 > 172.16.25.2: gre [] 2001 NHRP: res request, id 6,
hopcnt 254, src nbma 172.16.45.2, 192.168.0.4 -> 192.168.0.2 (code 0, pl 0, mtu
1514, htime 7200, pref 0) [tos 0xc0] (ttl 254, id 20, len 116)
08:47:16.148863 172.16.25.2 > 172.16.15.2: gre [] 2001 NHRP: res reply, id 6,
hopcnt 255, src nbma 172.16.45.2, 192.168.0.4 -> 192.168.0.2 (code 0, pl 32,
mtu 1514, htime 7199, pref 0, nbma 172.16.25.2, proto 192.168.0.2) [tos 0xc0]
(ttl 255, id 31, len 144)
Extensions are not parsed and printed.
It would be nice to get pcaps with expamles that use address or protocol
combinations other than GRE and IPv4.
Comments, OKs?
Remi
Index: Makefile
===
RCS file: /cvs/src/usr.sbin/tcpdump/Makefile,v
retrieving revision 1.64
diff -u -p -r1.64 Makefile
--- Makefile3 Dec 2019 01:43:33 - 1.64
+++ Makefile28 Mar 2020 17:07:22 -
@@ -48,7 +48,7 @@ SRCS= tcpdump.c addrtoname.c privsep.c p
print-bgp.c print-ospf6.c print-ripng.c print-rt6.c print-stp.c \
print-etherip.c print-lwres.c print-lldp.c print-cdp.c print-pflog.c \
print-pfsync.c pf_print_state.c print-ofp.c ofp_map.c \
- print-udpencap.c print-carp.c \
+ print-udpencap.c print-carp.c print-nhrp.c \
print-802_11.c print-iapp.c print-mpls.c print-slow.c print-usbpcap.c \
gmt2local.c savestr.c setsignal.c in_cksum.c
Index: interface.h
===
RCS file: /cvs/src/usr.sbin/tcpdump/interface.h,v
retrieving revision 1.83
diff -u -p -r1.83 interface.h
--- interface.h 3 Dec 2019 01:43:33 - 1.83
+++ interface.h 28 Mar 2020 17:07:22 -
@@ -217,6 +217,7 @@ extern void ppp_ether_if_print(u_char *,
extern void gre_print(const u_char *, u_int);
extern void vxlan_print(const u_char *, u_int);
extern void nsh_print(const u_char *, u_int);
+extern void nhrp_print(const u_char *, u_int);
extern void icmp_print(const u_char *, u_int, const u_char *);
extern void ieee802_11_if_print(u_char *, const struct pcap_pkthdr *,
const u_char *);
Index: print-ether.c
===
RCS file: /cvs/src/usr.sbin/tcpdump/print-ether.c,v
retrieving revision 1.37
diff -u -p -r1.37 print-ether.c
--- print-ether.c 24 Jan 2020 22:46:36 - 1.37
+++ print-ether.c 28 Mar 2020 17:07:22 -
@@ -303,6 +303,13 @@ recurse:
ether_pbb_print(p, length, caplen);
return (1);
+#ifndef ETHERTYPE_NHRP
+#define ETHERTYPE_NHRP 0x2001
+#endif
+ case ETHERTYPE_NHRP:
+ nhrp_print(p, length);
+ return (1);
+
#ifdef PPP
case ETHERTYPE_PPPOEDISC:
case ETHERTYPE_PPPOE:
Index: print-gre.c
===
RCS file: /cvs/src/usr.sbin/tcpdump/print-gre.c,v
retrieving revision 1.30
diff -u -p -r1.30 print-gre.c
--- print-gre.c 24 Jan 2020 22:46:36 - 1.30
+++ print-gre.c 28 Mar 2020 17:07:22 -
@@ -289,6 +289,12 @@ gre_print_0(const u_char *p, u_int lengt
case 0x2000:
cdp_print(p, length, l, 0);
break;
+#ifndef ETHERTYPE_NHRP
+#define ETHERTYPE_NHRP 0x2001
+#endif
+ case ETHERTYPE_NHRP:
+ nhrp_print(p, length);
+ break;
default:
printf("unknown-proto-%04x", proto);
}
Index: print-nhrp.c
===
RCS file: print-nhrp.c
diff -N print-nhrp.c
--- /dev/null 1 Jan 1970 00:00:00 -
+++
