Here is a patch to decode Multicast DNS -- it uses the same packet
format as the regular DNS but uses the port 5353 instead of 53. See
http://www.multicastdns.org/ for more info about Multicast DNS.
Vincent Lubet
[EMAIL PROTECTED]
PS: This is my first contribution to an open source project besides
Darwin, yeah!
Index: nameser.h
===================================================================
RCS file: /tcpdump/master/tcpdump/nameser.h,v
retrieving revision 1.10
diff -d -u -b -r1.10 nameser.h
--- nameser.h 2002/06/11 17:08:40 1.10
+++ nameser.h 2002/08/16 20:11:04
@@ -75,6 +75,7 @@
* Internet nameserver port number
*/
#define NAMESERVER_PORT 53
+#define MULTICASTDNS_PORT 5353
/*
* Currently defined opcodes
Index: print-tcp.c
===================================================================
RCS file: /tcpdump/master/tcpdump/print-tcp.c,v
retrieving revision 1.98
diff -d -u -b -r1.98 print-tcp.c
--- print-tcp.c 2002/08/01 08:53:31 1.98
+++ print-tcp.c 2002/08/16 20:11:05
@@ -606,7 +606,8 @@
else if (sport == BEEP_PORT || dport == BEEP_PORT)
beep_print(bp, length);
else if (length > 2 &&
- (sport == NAMESERVER_PORT || dport ==
NAMESERVER_PORT)) {
+ (sport == NAMESERVER_PORT || dport ==
NAMESERVER_PORT ||
+ sport == MULTICASTDNS_PORT || dport ==
MULTICASTDNS_PORT)) {
/*
* TCP DNS query has 2byte length at the head.
* XXX packet could be unaligned, it can go
strange
Index: print-udp.c
===================================================================
RCS file: /tcpdump/master/tcpdump/print-udp.c,v
retrieving revision 1.106
diff -d -u -b -r1.106 print-udp.c
--- print-udp.c 2002/08/01 08:53:33 1.106
+++ print-udp.c 2002/08/16 20:11:07
@@ -594,7 +594,7 @@
if (!qflag) {
#define ISPORT(p) (dport == (p) || sport == (p))
- if (ISPORT(NAMESERVER_PORT))
+ if (ISPORT(NAMESERVER_PORT) ||
ISPORT(MULTICASTDNS_PORT))
ns_print((const u_char *)(up + 1), length);
else if (ISPORT(TIMED_PORT))
timed_print((const u_char *)(up + 1), length);
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
