wiki:llc

Version 2 (modified by ivano, 11 months ago) (diff)

the fields dsap, ssap and ctrl, in the ecapsulation section, are considered as numbers

Running NetPDL parser failed a:
0, PHP Deprecated: Comments starting with '#' are deprecated in /etc/php5/cli/conf.d/idn.ini on line 1 in Unknown on line 0 /usr/local/netpdl/parser.php

NetPDL dissector..........VALIDATED !!

Original XML source
  1. <protocol name="llc" longname="IEEE 802.2 Logical Link Control" showsumtemplate="llc">
  2.   <format>
  3.     <fields>
  4.       <field type="fixed" name="dsap" longname="DSAP" size="1" showtemplate="FieldHex"/>
  5.       <field type="fixed" name="ssap" longname="SSAP" size="1" showtemplate="FieldHex"/>
  6.  
  7.       <if expr="(buf2int($packet[$currentoffset:1]) bitwand 0b00000011) == 0b00000011"> <!-- last two bits are '11' -->
  8.         <!-- LLC Unnumbered -->
  9.         <if-true>
  10.           <field type="fixed" name="ctrl" longname="Control (Unnumbered)" size="1" showtemplate="FieldHex">
  11.             <field type="bit" name="mod" longname="Modifier" mask="0xE0" size="1" showtemplate="FieldHex"/>
  12.             <field type="bit" name="pf" longname="Poll / Final" mask="0x10" size="1" showtemplate="FieldBin"/>
  13.             <field type="bit" name="type" longname="Type" mask="0x0C" size="1" showtemplate="FieldHex"/>
  14.             <field type="bit" name="flag" longname="Flag (Unnumbered frame)" mask="0x03" size="1" showtemplate="FieldBin"/>
  15.           </field>
  16.         </if-true>
  17.  
  18.         <if-false>
  19.           <if expr="(buf2int($packet[$currentoffset:1]) bitwand 0b00000001) == 0b00000000"> <!-- last bit is '0' -->
  20.             <!-- LLC Information -->
  21.             <if-true>
  22.               <!-- Warning: the LLC information ctrl field can be also 16 bits -->
  23.               <field type="fixed" name="ctrl" longname="Control (Information)" size="1" showtemplate="FieldHex">
  24.                 <field type="bit" name="nr" longname="Sequence Number (Receiver)" mask="0xE0" size="1" showtemplate="FieldHex"/>
  25.                 <field type="bit" name="pf" longname="Poll / Final" mask="0x10" size="1" showtemplate="FieldBin"/>
  26.                 <field type="bit" name="type" longname="Type" mask="0x0C" size="1" showtemplate="FieldHex"/>
  27.                 <field type="bit" name="flag" longname="Flag (Information frame)" mask="0x03" size="1" showtemplate="FieldBin"/>
  28.               </field>
  29.             </if-true>
  30.  
  31.             <if-false>
  32.               <if expr="(buf2int($packet[$currentoffset:1]) bitwand 0b00000001) == 0b00000001"> <!-- last two bits are '01' -->
  33.                 <!-- LLC Supervisor -->
  34.                 <if-true>
  35.                   <!-- Warning: the LLC Supervisor ctrl field can be also 16 bits -->
  36.                   <field type="fixed" name="ctrl" longname="Control (Supervisor)" size="1" showtemplate="FieldHex">
  37.                     <field type="bit" name="nr" longname="Sequence Number (Receiver)" mask="0xE0" size="1" showtemplate="FieldDec"/>
  38.                     <field type="bit" name="pf" longname="Poll / Final" mask="0x10" size="1" showtemplate="FieldBin"/>
  39.                     <field type="bit" name="ns" longname="Sequence Number (Sender)" mask="0x0E" size="1" showtemplate="FieldDec"/>
  40.                     <field type="bit" name="flag" longname="Flag (Supervisor frame)" mask="0x01" size="1" showtemplate="FieldBin"/>
  41.                   </field>
  42.                 </if-true>
  43.               </if>
  44.             </if-false>
  45.           </if>
  46.         </if-false>
  47.       </if>
  48.     </fields>
  49.   </format>
  50.  
  51.  
  52.   <encapsulation>
  53.     <if expr="(buf2int(dsap) == 0xE0) and (buf2int(ssap) == 0xE0) and (buf2int(ctrl) == 0x03) and ($packet[$currentoffset:2] == '\xFF\xFF')">
  54.       <if-true>
  55.         <nextproto proto="#ipx"/>
  56.       </if-true> 
  57.     </if>
  58.  
  59.     <switch expr="buf2int(dsap)">
  60.       <case value="0x06"> <nextproto proto="#ip"/> </case>
  61.       <case value="0x42"> <nextproto proto="#stp"/> </case>
  62.       <case value="0xAA"> <nextproto proto="#snap"/> </case>
  63.       <case value="0xF0"> <nextproto proto="#netbeui"/></case>
  64.     </switch>
  65.   </encapsulation>
  66.  
  67.   <visualization>
  68.     <showsumtemplate name="llc">
  69.       <text value=" - "/>
  70.       <if expr="(buf2int(ctrl) bitwand 0b00000011) == 0b00000011">
  71.         <if-true>
  72.           <text value="LLC Unnumbered "/>
  73.         </if-true>
  74.  
  75.         <if-false>
  76.           <if expr="(buf2int(ctrl) bitwand 0b00000001) == 0b00000000">
  77.             <!-- LLC Information -->
  78.             <if-true>
  79.               <text value="LLC Information "/>
  80.             </if-true>
  81.  
  82.             <if-false>
  83.               <if expr="(buf2int(ctrl) bitwand 0b00000011) == 0b00000001">
  84.                 <!-- LLC Supervisor -->
  85.                 <if-true>
  86.                   <text value="LLC Supervisor "/>
  87.                 </if-true>
  88.               </if>
  89.             </if-false>
  90.           </if>
  91.         </if-false>
  92.       </if>
  93.  
  94.       <text value=": DSAP "/>
  95.       <protofield name="dsap" showdata="showvalue"/>
  96.       <text value=", Ctrl "/>
  97.       <protofield name="ctrl" showdata="showvalue"/>
  98.     </showsumtemplate>
  99.   </visualization>
  100. </protocol>
  101.  
Processing time: 0.034