wiki:llc
Running NetPDL parser failed a:
0, PHP Deprecated: Comments starting with '#' are deprecated in /etc/php5/cli/conf.d/idn.ini on line 1 in Unknown on line 0 /usr/local/netpdl/parser.php

NetPDL dissector..........VALIDATED !!

Original XML source
  1. <protocol name="llc" longname="IEEE 802.2 Logical Link Control" showsumtemplate="llc">
  2.   <format>
  3.     <fields>
  4.       <field type="fixed" name="dsap" longname="DSAP" size="1" showtemplate="FieldHex"/>
  5.       <field type="fixed" name="ssap" longname="SSAP" size="1" showtemplate="FieldHex"/>
  6.  
  7.       <if expr="(buf2int($packet[$currentoffset:1]) bitwand 0b00000011) == 0b00000011"> <!-- last two bits are '11' -->
  8.         <!-- LLC Unnumbered -->
  9.         <if-true>
  10.           <field type="fixed" name="ctrl" longname="Control (Unnumbered)" size="1" showtemplate="FieldHex">
  11.             <field type="bit" name="mod" longname="Modifier" mask="0xE0" size="1" showtemplate="FieldHex"/>
  12.             <field type="bit" name="pf" longname="Poll / Final" mask="0x10" size="1" showtemplate="FieldBin"/>
  13.             <field type="bit" name="type" longname="Type" mask="0x0C" size="1" showtemplate="FieldHex"/>
  14.             <field type="bit" name="flag" longname="Flag (Unnumbered frame)" mask="0x03" size="1" showtemplate="FieldBin"/>
  15.           </field>
  16.         </if-true>
  17.  
  18.         <if-false>
  19.           <if expr="(buf2int($packet[$currentoffset:1]) bitwand 0b00000001) == 0b00000000"> <!-- last bit is '0' -->
  20.             <!-- LLC Information -->
  21.             <if-true>
  22.               <!-- Warning: the LLC information ctrl field can be also 16 bits -->
  23.               <field type="fixed" name="ctrl" longname="Control (Information)" size="1" showtemplate="FieldHex">
  24.                 <field type="bit" name="nr" longname="Sequence Number (Receiver)" mask="0xE0" size="1" showtemplate="FieldHex"/>
  25.                 <field type="bit" name="pf" longname="Poll / Final" mask="0x10" size="1" showtemplate="FieldBin"/>
  26.                 <field type="bit" name="type" longname="Type" mask="0x0C" size="1" showtemplate="FieldHex"/>
  27.                 <field type="bit" name="flag" longname="Flag (Information frame)" mask="0x03" size="1" showtemplate="FieldBin"/>
  28.               </field>
  29.             </if-true>
  30.  
  31.             <if-false>
  32.               <if expr="(buf2int($packet[$currentoffset:1]) bitwand 0b00000001) == 0b00000001"> <!-- last two bits are '01' -->
  33.                 <!-- LLC Supervisor -->
  34.                 <if-true>
  35.                   <!-- Warning: the LLC Supervisor ctrl field can be also 16 bits -->
  36.                   <field type="fixed" name="ctrl" longname="Control (Supervisor)" size="1" showtemplate="FieldHex">
  37.                     <field type="bit" name="nr" longname="Sequence Number (Receiver)" mask="0xE0" size="1" showtemplate="FieldDec"/>
  38.                     <field type="bit" name="pf" longname="Poll / Final" mask="0x10" size="1" showtemplate="FieldBin"/>
  39.                     <field type="bit" name="ns" longname="Sequence Number (Sender)" mask="0x0E" size="1" showtemplate="FieldDec"/>
  40.                     <field type="bit" name="flag" longname="Flag (Supervisor frame)" mask="0x01" size="1" showtemplate="FieldBin"/>
  41.                   </field>
  42.                 </if-true>
  43.               </if>
  44.             </if-false>
  45.           </if>
  46.         </if-false>
  47.       </if>
  48.      
  49.       <!-- Ivano: snap -->
  50.       <if expr="buf2int(dsap) == 0xAA">
  51.         <if-true>
  52.           <field type="fixed" name="OUI" longname="Organization Unique Identifier" size="3" showtemplate="FieldHex"/>
  53.           <field type="fixed" name="pType" longname="Protocol Type" size="2" showtemplate="snap.pType"/>
  54.         </if-true>
  55.       </if>
  56.     </fields>
  57.   </format>
  58.  
  59.  
  60.   <encapsulation>
  61.     <if expr="(buf2int(dsap) == 0xE0) and (buf2int(ssap) == 0xE0) and (buf2int(ctrl) == 0x03) and (buf2int($packet[$currentoffset:2]) == 0xFFFF)">
  62.       <if-true>
  63.         <nextproto proto="#ipx"/>
  64.       </if-true> 
  65.     </if>
  66.    
  67.     <!-- Ivano: snap -->
  68.     <if expr="buf2int(dsap) == 0xAA">
  69.       <if-true>
  70.         <if expr="buf2int(OUI) == 0">
  71.           <if-true>
  72.             <switch expr="buf2int(pType)">
  73.               <case value="0x0800"> <nextproto proto="#ip" preferred="true"/> </case>
  74.               <case value="0x0806"> <nextproto proto="#arp" preferred="true"/> </case>
  75.               <case value="0x8137"> <nextproto proto="#ipx"/> </case>
  76.             </switch>
  77.           </if-true>
  78.         </if>
  79.  
  80.         <if expr="buf2int(OUI) == 0x00000C">
  81.           <if-true>
  82.             <switch expr="buf2int(pType)">
  83.               <case value="0x2000"> <nextproto proto="#cdp"/> </case>
  84.               <case value="0x010B"> <nextproto proto="#stp"/> </case>
  85.             </switch>
  86.           </if-true>
  87.         </if>
  88.       </if-true>
  89.       <if-false>
  90.         <switch expr="buf2int(dsap)">
  91.           <case value="0x06"> <nextproto proto="#ip" preferred="true"/> </case>
  92.           <case value="0x42"> <nextproto proto="#stp"/> </case>
  93.         <!--  <case value="0xAA"> <nextproto proto="#snap"/> </case>-->
  94.           <case value="0xF0"> <nextproto proto="#netbeui"/></case>
  95.         </switch>
  96.       </if-false>
  97.     </if>
  98.   </encapsulation>
  99.  
  100.   <visualization>
  101.     <showsumtemplate name="llc">
  102.       <text value=" - "/>
  103.       <if expr="(buf2int(ctrl) bitwand 0b00000011) == 0b00000011">
  104.         <if-true>
  105.           <text value="LLC Unnumbered "/>
  106.         </if-true>
  107.  
  108.         <if-false>
  109.           <if expr="(buf2int(ctrl) bitwand 0b00000001) == 0b00000000">
  110.             <!-- LLC Information -->
  111.             <if-true>
  112.               <text value="LLC Information "/>
  113.             </if-true>
  114.  
  115.             <if-false>
  116.               <if expr="(buf2int(ctrl) bitwand 0b00000011) == 0b00000001">
  117.                 <!-- LLC Supervisor -->
  118.                 <if-true>
  119.                   <text value="LLC Supervisor "/>
  120.                 </if-true>
  121.               </if>
  122.             </if-false>
  123.           </if>
  124.         </if-false>
  125.       </if>
  126.  
  127.       <text value=": DSAP "/>
  128.       <protofield name="dsap" showdata="showvalue"/>
  129.       <text value=": SSAP "/>
  130.       <protofield name="ssap" showdata="showvalue"/>
  131.       <text value=", Ctrl "/>
  132.       <protofield name="ctrl" showdata="showvalue"/>
  133.  
  134.       <!-- Ivano: snap -->
  135.       <if expr="buf2int(dsap) == 0xAA">
  136.         <if-true>
  137.           <text value=", OUI "/>
  138.           <protofield name="OUI" showdata="showvalue"/>
  139.           <text value=", Type "/>
  140.           <protofield name="pType" showdata="showmap"/>
  141.           <text value="("/>
  142.           <protofield name="pType" showdata="showvalue"/>
  143.           <text value=")"/>
  144.         </if-true>
  145.       </if>
  146.     </showsumtemplate>
  147.    
  148.     <!-- Ivano: snap -->
  149.     <showtemplate name="snap.pType" showtype="hex">
  150.       <showmap>
  151.         <switch expr="buf2int(this)">
  152.           <case value="0x0800" show="IP"/>
  153.           <case value="0x0806" show="ARP"/>
  154.           <case value="0x8137" show="IPX"/>
  155.  
  156.           <case value="0x2000" show="Cisco Discovery Protocol"/>
  157.           <case value="0x010B" show="Cisco Per-VLAN Spanning Tree"/>
  158.  
  159.           <default show="Error in snap.pType lookup"/>
  160.         </switch>
  161.       </showmap>
  162.     </showtemplate>
  163.  
  164.   </visualization>
  165. </protocol>
  166.  
Processing time: 0.051