<?xml version="1.0" encoding="utf-8"?>
<netpdl name="nbee.org NetPDL Database" version="0.2" creator="nbee.org" date="29-07-2011">
<protocol name="startproto" longname="Starting Protocol (used for beginning the parsing)" showsumtemplate="startproto">
		<execute-code>
		<init>
			<!-- Alias list -->
			<!-- Please do not change these values, since these are used inside the NetBee code -->
			<alias name="%NOTFOUND" replacewith="0"/>
			<alias name="%FOUND" replacewith="1"/>
			<alias name="%CANDIDATE" replacewith="2"/>
			<alias name="%DEFERRED" replacewith="3"/>

			<!-- NetPDL default variables -->
			<variable name="$linklayer" type="number" validity="static"/>
			<variable name="$framelength" type="number" validity="thispacket"/>
			<variable name="$packetlength" type="number" validity="thispacket"/>
			<variable name="$currentoffset" type="number" validity="thispacket"/>
			<variable name="$currentprotooffset" type="number" validity="thispacket"/>
			<variable name="$timestamp_sec" type="number" validity="thispacket"/>
			<variable name="$timestamp_usec" type="number" validity="thispacket"/>
			<variable name="$packet" type="refbuffer" validity="thispacket"/>
			<variable name="$prevproto" type="protocol" validity="thispacket"/>
			<variable name="$nextproto" type="protocol" validity="thispacket"/>
			<variable name="$protoverify_result" type="number" validity="thispacket"/>

			<!-- Variables for tokenXXX fields; these are updated after each field (of the proper type), so we do not have to reset them at each packet -->
			<variable name="$token_begintlen" type="number" validity="static"/>
			<variable name="$token_fieldlen" type="number" validity="static"/>
			<variable name="$token_endtlen" type="number" validity="static"/>

			<!-- Required configuration variables (usually used for selecting some optional functions in the code) -->
			<variable name="$show_networknames" type="number" validity="static"/>
			<variable name="$enable_servertable" type="number" validity="static" value="0"/>

			<!-- Variables required for L4-L7 processing -->
			<variable name="$ipsrc" type="refbuffer" validity="thispacket"/>
			<variable name="$ipdst" type="refbuffer" validity="thispacket"/>
			<variable name="$L4proto" type="protocol" validity="thispacket"/>
			<variable name="$portsrc" type="refbuffer" validity="thispacket"/>
			<variable name="$portdst" type="refbuffer" validity="thispacket"/>

			<variable name="$firstip" type="refbuffer" validity="thispacket"/>
			<variable name="$secondip" type="refbuffer" validity="thispacket"/>
			<variable name="$firstport" type="refbuffer" validity="thispacket"/>
			<variable name="$secondport" type="refbuffer" validity="thispacket"/>

			<variable name="$type" type="number" validity="thispacket"/>
			<variable name="$proc" type="number" validity="thispacket"/>
			<variable name="$payloadlength" type="number" validity="thispacket" value="0"/>
			
			<variable name="$sess_table_hit" type="number" validity="thispacket" value="0"/>
			<variable name="$ks_table_hit" type="number" validity="thispacket" value="0"/>
			<variable name="$session_hit" type="number" validity="thispacket" value="0"/>

			<!-- Lookup tables for L7 processing -->
			<lookuptable name="$tcpsessiontable" exactentries="50000" maskentries="1000"  validity="dynamic">
				<key name="ipsource" type="buffer" size="16"/>
				<key name="ipdest" type="buffer" size="16"/>
				<key name="tcpsrcport" type="buffer" size="2"/>
				<key name="tcpdstport" type="buffer" size="2"/>
				<data name="nextproto" type="protocol"/>
				<data name="flag" type="number"/>
			</lookuptable>
			<lookuptable name="$udpsessiontable" exactentries="10000" maskentries="1000" validity="dynamic">
				<key name="ipsource" type="buffer" size="16"/>
				<key name="ipdest" type="buffer" size="16"/>
				<key name="tcpsrcport" type="buffer" size="2"/>
				<key name="tcpdstport" type="buffer" size="2"/>
				<data name="nextproto" type="protocol"/>
			</lookuptable>
			<lookuptable name="$rtptable" exactentries="1000" maskentries="0" validity="dynamic">
				<key name="ipsource" type="buffer" size="16"/>
				<key name="ipdest" type="buffer" size="16"/>
				<key name="srcport" type="buffer" size="2"/>
				<key name="dstport" type="buffer" size="2"/>
				<data name="ssrc" type="buffer" size="4"/>
			</lookuptable>
			<lookuptable name="$KnownServerTable" exactentries="10000" maskentries="0" validity="dynamic">
				<key name="ipaddr" type="buffer" size="16"/>
				<key name="port" type="buffer" size="2"/>
				<data name="nextproto" type="protocol"/>				
			</lookuptable>

			<lookuptable name="$CandidateServersTable" exactentries="10000" maskentries="0" validity="dynamic">
				<key name="ipaddr" type="buffer" size="16"/>
				<key name="port" type="buffer" size="2"/>
			</lookuptable>
				
			<lookuptable name="$KnownUDPServerTable" exactentries="10000" maskentries="0" validity="dynamic">
				<key name="ipaddr" type="buffer" size="16"/>
				<key name="port" type="buffer" size="2"/>
				<data name="nextproto" type="protocol"/>				
			</lookuptable>

			<lookuptable name="$skypetempsessiontable" exactentries="10000" maskentries="0" validity="dynamic">
				<key name="ipaddr" type="buffer" size="16"/>
				<key name="port" type="buffer" size="2"/>
				<data name="cnt" type="number" value="0"/>		
				<data name="id" type="buffer" size="2"/>	
			</lookuptable>
			
			<lookuptable name="$SkypeClientTable" exactentries="10000" maskentries="0" validity="dynamic">
				<key name="ipaddr" type="buffer" size="16"/>
				<key name="port" type="buffer" size="2"/>
				<data name="nextproto" type="protocol"/>				
			</lookuptable>

			<lookuptable name="$unknownprotosessiontable" exactentries="50000" maskentries="0" validity="dynamic">
				<key name="ipsource" type="buffer" size="16"/>
				<key name="ipdest" type="buffer" size="16"/>
				<key name="tcpsrcport" type="buffer" size="2"/>
				<key name="tcpdstport" type="buffer" size="2"/>
			</lookuptable>

			<!-- this table contains information about rpc session -->
			<lookuptable name="$rpctable" exactentries="1000" maskentries="0" validity="dynamic">
				<key name="ipsource" type="buffer" size="16"/>
				<key name="ipdest" type="buffer" size="16"/>
				<key name="tcpsrcport" type="buffer" size="2"/>
				<key name="tcpdstport" type="buffer" size="2"/>
				<data name="prog" type="number"/>
				<data name="proc" type="number"/>
				<data name="type" type="number"/>
			</lookuptable>
		</init>
	</execute-code>

	<encapsulation>
			<switch expr="$linklayer">
<!-- Bluetooth -->
<!--
			<case value="1"> <nextproto proto="#hci_packet_type"/> </case>
			<case value="13"> <nextproto proto="#hci"/> </case>
-->
			<case value="1"> <nextproto proto="#ethernet"/> </case>
			<case value="6"> <nextproto proto="#tokenring"/> </case>
			<case value="10"> <nextproto proto="#fddi"/> </case>
			<!-- Some OSes use this for ATM/LLC encapsulation -->
			<case value="11"> <nextproto proto="#llc"/> </case>
			<!-- Encapsulation not supported. Let's use Ethernet, hoping that is correct -->
			<default> <nextproto proto="#ethernet"/> </default>
		</switch>
	</encapsulation>

	<visualization>
		<showsumtemplate name="startproto">
			<section name="NUMBER"/>
			<packethdr value="num"/>

			<section name="TIME"/>
			<packethdr value="timestamp"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="ethernet" longname="Ethernet 802.3" comment="Ethernet DIX has been included in 802.3" showsumtemplate="ethernet">
	<execute-code>
		<!-- If we're on Ethernet IEEE 802.3, update the packet length -->
		<after when="buf2int(type) le 1500">
			<assign-variable name="$packetlength" value="buf2int(type) + 14"/> <!-- 14 is the size of the ethernet header -->
		</after>
	</execute-code>

	<format>
		<fields>
			<field type="fixed" name="dst" longname="MAC Destination" size="6" showtemplate="MACaddressEth"/>
			<field type="fixed" name="src" longname="MAC Source" size="6" showtemplate="MACaddressEth"/>
			<field type="fixed" name="type" longname="Ethertype - Length" size="2" showtemplate="eth.typelength"/>
		</fields>
	</format>

	<encapsulation>
		<!--
		We have four possible incapsulations for IPX:
		  - Ethernet version II
		    ==> type= 0x8137
		  - Novell-specific framing (raw 802.3)
		    ==> directly in Ethernet; we have to check that the IPX checksum is == 0xFFFF
		  - Ethernet 802.3/802.2 without SNAP
		    ==> directly in SNAP; we have to check that the IPX checksum is == 0xFFFF (after the SNAP header)
		  - Ethernet 802.3/802.2 with SNAP
		    ==> type= 0x8137 (in SNAP)
		See the "IPX Ethernet and FDDI Encapsulation Methods" Cisco doc, at:
		  http://www.cisco.com/en/US/tech/tk389/tk224/technologies_q_and_a_item09186a0080093d2e.shtml
		-->

		<if expr="buf2int($packet[$currentoffset:2]) == 0xFFFF">
			<if-true>
				<nextproto proto="#ipx"/>
			</if-true>	
		</if>

		<switch expr="buf2int(type)">
			<case value="0" maxvalue="1500"> <nextproto proto="#llc"/> </case>
			<case value="0x800"> <nextproto proto="#ip"/> </case>
			<case value="0x806"> <nextproto proto="#arp"/> </case>
			<case value="0x8863"> <nextproto proto="#pppoed"/> </case>
			<case value="0x8864"> <nextproto proto="#pppoe"/> </case>
			<case value="0x86DD"> <nextproto proto="#ipv6"/> </case>
			<case value="0x8100"> <nextproto proto="#vlan"/> </case>
			<case value="0x8137"> <nextproto proto="#ipx"/> </case>
			<case value="0x81FD"> <nextproto proto="#ismp"/> </case>
			<case value="0x8847" comment="mpls-unicast"> <nextproto proto="#mpls"/> </case>
			<case value="0x8848" comment="mpls-multicast"> <nextproto proto="#mpls"/> </case>
		</switch>
	</encapsulation>

	<visualization>
		<showsumtemplate name="ethernet">
			<section name="next"/>
			<text value="Eth: "/>
			<protofield name="src" showdata="showvalue"/>
			<text value=" => "/>
			<protofield name="dst" showdata="showvalue"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="fddi" longname="Fiber Distributed Data Interface" showsumtemplate="fddi">
	<format>
		<fields>
			<field type="fixed" name="fc" longname="Frame Control" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="dst" longname="MAC Destination" size="6" showtemplate="MACaddressTR"/>
			<field type="fixed" name="src" longname="MAC Source" size="6" showtemplate="MACaddressTR"/>
		</fields>
	</format>

	<encapsulation>
		<nextproto proto="#llc"/>
	</encapsulation>
	
	<visualization>
		<showsumtemplate name="fddi">
			<section name="next"/>
			<text value="FDDI: "/>
			<protofield name="src" showdata="showvalue"/>
			<text value=" => "/>
			<protofield name="dst" showdata="showvalue"/>
		</showsumtemplate>
	</visualization>

</protocol>

<protocol name="tokenring" longname="Token Ring 802.5" showsumtemplate="tokenring">
	<format>
		<fields>
			<block name="AC" longname="Access Control">
				<field type="bit" name="PPP" longname="Priority Bits" mask="0xE0" size="1" showtemplate="FieldDec"/>
				<field type="bit" name="T" longname="Token Bit" mask="0x10" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="M" longname="Monitor Count" mask="0x08" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="RRR" longname="Reservation Bits" mask="0x07" size="1" showtemplate="FieldHex"/>
			</block>	
			<!-- Warning: the frame control is made of several bitfields, which are not decoded properly here -->
			<block name="FC" longname="Frame Control">
				<field type="bit" name="FT" longname="MAC Frame Type" mask="0xC0" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="OO" longname="Unknown" mask="0x30" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="AT" longname="Attention Code" mask="0x0F" size="1" showtemplate="tokenring.attcode"/>
			</block>
			<field type="fixed" name="dst" longname="MAC Destination" size="6" showtemplate="MACaddressTR"/>
			<field type="fixed" name="src" longname="MAC Source" size="6" showtemplate="MACaddressTR"/>
			
			<if expr="(buf2int(src[0:1]) bitwand 0b10000000) == 0b10000000">
				<!-- Options are valid if the first bit of 'src' is equal to 1 -->
				<if-true>
					<includeblk name="RI"/>
				</if-true>
			</if>
		</fields>
		
		<block name="RI" longname="Routing Information">
			<block name="RC" longname="Routing Control">
				<field type="bit" name="RT" longname="Routing Type" mask="0xE000" size="2" showtemplate="FieldDec"/>
				<field type="bit" name="LTH" longname="Routing Length" mask="0x1F00" size="2" showtemplate="FieldDec"/>
				<field type="bit" name="D" longname="Direction bit" mask="0x0080" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="LF" longname="Largest Frame" mask="0x007E" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="R" longname="Reserved" mask="0x0001" size="2" showtemplate="FieldBin"/>
			</block>

			<block name="RDs" longname="Route Descriptors">
				<loop type="size" expr="buf2int(LTH) - 2">
					<block name="RD" longname="Route Descriptor">
						<field type="bit" name="LANID" longname="LAN Identifier" mask="0xFFF0" size="2" showtemplate="FieldDec"/>
						<field type="bit" name="BN" longname="Bridge Number" mask="0x000F" size="2" showtemplate="FieldDec"/>
					</block>	
				</loop>
			</block>
		</block>

	</format>


	<encapsulation>
		<!-- FULVIO: no idea what these flags means -->
		<if expr="(buf2int(FT) == 0) or (buf2int(FT) == 1)">
			<if-true>
				<nextproto proto="#llc"/>
			</if-true>
		</if>		
	</encapsulation>

	<visualization>
		<showtemplate name="tokenring.attcode" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Express Buffer"/> 
					<case value="2" show="Beacon"/> 
					<case value="3" show="Claim Token"/> 
					<case value="4" show="Ring Purge"/> 
					<case value="5" show="Active Monitor Present"/> 
					<case value="6" show="Stanby Monitor Present"/> 
					<default show="Error in Token Ring Attention code lookup"/> 
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="tokenring">
			<section name="next"/>
			<text value="TR: "/>
			<protofield name="src" showdata="showvalue"/>
			<text value=" => "/>
			<protofield name="dst" showdata="showvalue"/>
		</showsumtemplate>
	</visualization>
	
</protocol>
<protocol name="vlan" longname="Virtual LAN (802.3ac)" showsumtemplate="vlan">
	<format>
		<fields>
			<block name="vlan" size="2" longname="Tag Control Information">
				<field type="bit" name="pri" longname="User Priority" mask="0xE000" size="2" showtemplate="FieldHex"/>
				<field type="bit" name="cfi" longname="CFI" mask="0x1000" size="2" showtemplate="FieldDec"/>
				<field type="bit" name="vlanid" longname="VLAN ID" mask="0x0FFF" size="2" showtemplate="FieldDec"/>
			</block>

			<field type="fixed" name="type" longname="Ethertype - Length" size="2" showtemplate="eth.typelength"/>
		</fields>
	</format>


	<encapsulation>
		<switch expr="buf2int(type)">
			<case value="0" maxvalue="1500"> <nextproto proto="#llc"/> </case>
			<case value="0x800"> <nextproto proto="#ip"/> </case>
			<case value="0x806"> <nextproto proto="#arp"/> </case>
			<case value="0x8100"> <nextproto proto="#vlan" comment="Standard 802.1Q in 802.1Q encapsulation"/> </case>
			<case value="0x9100"> <nextproto proto="#vlan" comment="802.1Q in 802.1Q encapsulation used by Cisco"/> </case>
			<case value="0x8863"> <nextproto proto="#pppoed"/> </case>
			<case value="0x8864"> <nextproto proto="#pppoe"/> </case>
			<case value="0x86DD"> <nextproto proto="#ipv6"/> </case>
		</switch>
	</encapsulation>

	<visualization>
		<showsumtemplate name="vlan">
			<text value=" (VLAN-ID "/>
			<protofield name="vlanid" showdata="showvalue"/>
			<text value=")"/>
		</showsumtemplate>
	</visualization>

</protocol>
<protocol name="llc" longname="IEEE 802.2 Logical Link Control" showsumtemplate="llc">
	<format>
		<fields>
			<field type="fixed" name="dsap" longname="DSAP" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="ssap" longname="SSAP" size="1" showtemplate="FieldHex"/>

			<if expr="(buf2int($packet[$currentoffset:1]) bitwand 0b00000011) == 0b00000011"> <!-- last two bits are '11' -->
				<!-- LLC Unnumbered -->
				<if-true>
					<field type="fixed" name="ctrl" longname="Control (Unnumbered)" size="1" showtemplate="FieldHex">
						<field type="bit" name="mod" longname="Modifier" mask="0xE0" size="1" showtemplate="FieldHex"/>
						<field type="bit" name="pf" longname="Poll / Final" mask="0x10" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="type" longname="Type" mask="0x0C" size="1" showtemplate="FieldHex"/>
						<field type="bit" name="flag" longname="Flag (Unnumbered frame)" mask="0x03" size="1" showtemplate="FieldBin"/>
					</field>
				</if-true>

				<if-false>
					<if expr="(buf2int($packet[$currentoffset:1]) bitwand 0b00000001) == 0b00000000">	<!-- last bit is '0' -->
						<!-- LLC Information -->
						<if-true>
							<!-- Warning: the LLC information ctrl field can be also 16 bits -->
							<field type="fixed" name="ctrl" longname="Control (Information)" size="1" showtemplate="FieldHex">
								<field type="bit" name="nr" longname="Sequence Number (Receiver)" mask="0xE0" size="1" showtemplate="FieldHex"/>
								<field type="bit" name="pf" longname="Poll / Final" mask="0x10" size="1" showtemplate="FieldBin"/>
								<field type="bit" name="type" longname="Type" mask="0x0C" size="1" showtemplate="FieldHex"/>
								<field type="bit" name="flag" longname="Flag (Information frame)" mask="0x03" size="1" showtemplate="FieldBin"/>
							</field>
						</if-true>

						<if-false>
							<if expr="(buf2int($packet[$currentoffset:1]) bitwand 0b00000001) == 0b00000001"> <!-- last two bits are '01' -->
								<!-- LLC Supervisor -->
								<if-true>
									<!-- Warning: the LLC Supervisor ctrl field can be also 16 bits -->
									<field type="fixed" name="ctrl" longname="Control (Supervisor)" size="1" showtemplate="FieldHex">
										<field type="bit" name="nr" longname="Sequence Number (Receiver)" mask="0xE0" size="1" showtemplate="FieldDec"/>
										<field type="bit" name="pf" longname="Poll / Final" mask="0x10" size="1" showtemplate="FieldBin"/>
										<field type="bit" name="ns" longname="Sequence Number (Sender)" mask="0x0E" size="1" showtemplate="FieldDec"/>
										<field type="bit" name="flag" longname="Flag (Supervisor frame)" mask="0x01" size="1" showtemplate="FieldBin"/>
									</field>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-false>
			</if>
		</fields>
	</format>


	<encapsulation>
		<if expr="(dsap == '\xE0') and (ssap == '\xE0') and (ctrl == '\x03') and ($packet[$currentoffset:2] == '\xFF\xFF')">
			<if-true>
				<nextproto proto="#ipx"/>
			</if-true>	
		</if>

		<switch expr="buf2int(dsap)">
			<case value="0x06"> <nextproto proto="#ip"/> </case>
			<case value="0x42"> <nextproto proto="#stp"/> </case>
			<case value="0xAA"> <nextproto proto="#snap"/> </case>
			<case value="0xF0"> <nextproto proto="#netbeui"/></case>
		</switch>
	</encapsulation>

	<visualization>
		<showsumtemplate name="llc">
			<text value=" - "/>
			<if expr="(buf2int(ctrl) bitwand 0b00000011) == 0b00000011">
				<if-true>
					<text value="LLC Unnumbered "/>
				</if-true>

				<if-false>
					<if expr="(buf2int(ctrl) bitwand 0b00000001) == 0b00000000">
						<!-- LLC Information -->
						<if-true>
							<text value="LLC Information "/>
						</if-true>

						<if-false>
							<if expr="(buf2int(ctrl) bitwand 0b00000011) == 0b00000001">
								<!-- LLC Supervisor -->
								<if-true>
									<text value="LLC Supervisor "/>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-false>
			</if>
	
			<text value=": DSAP "/>
			<protofield name="dsap" showdata="showvalue"/>
			<text value=", Ctrl "/>
			<protofield name="ctrl" showdata="showvalue"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="snap" longname="IEEE 802.2 Logical Link Control SNAP" showsumtemplate="snap">
	<format>
		<fields>
			<field type="fixed" name="OUI" longname="Organization Unique Identifier" size="3" showtemplate="FieldHex"/>
			<field type="fixed" name="type" longname="Protocol Type" size="2" showtemplate="snap.type"/>
		</fields>
	</format>

	<encapsulation>
		<if expr="buf2int(OUI) == 0">
			<if-true>
				<switch expr="buf2int(type)">
					<case value="0x0800"> <nextproto proto="#ip"/> </case>
					<case value="0x0806"> <nextproto proto="#arp"/> </case>
					<case value="0x8137"> <nextproto proto="#ipx"/> </case>
				</switch>
			</if-true>
		</if>

		<if expr="buf2int(OUI) == 0x00000C">
			<if-true>
				<switch expr="buf2int(type)">
					<case value="0x2000"> <nextproto proto="#cdp"/> </case>
					<case value="0x010B"> <nextproto proto="#stp"/> </case>
				</switch>
			</if-true>
		</if>

	</encapsulation>

	<visualization>
		<showtemplate name="snap.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x0800" show="IP"/>
					<case value="0x0806" show="ARP"/>
					<case value="0x8137" show="IPX"/>

					<case value="0x2000" show="Cisco Discovery Protocol"/>
					<case value="0x010B" show="Cisco Per-VLAN Spanning Tree"/>

					<default show="Error in snap.type lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="snap">
			<text value=" - SNAP"/>
			<if expr="buf2int(type) == 0x010B">
				<if-true>
					<section name="next"/>
					<text value="Cisco Per-VLAN Spanning Tree"/>
				</if-true>
			</if>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="stp" longname="Spanning Tree Protocol (802.1d)" showsumtemplate="stp">
	<format>
		<fields>
			<field type="fixed" name="ptype" longname="Protocol Type" size="2" showtemplate="stp.ptype"/>
			<field type="fixed" name="version" longname="Protocol Version" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="type" longname="BPDU Type" size="1" showtemplate="stp.type"/>

			<switch expr="buf2int(type)">

				<case value="0">
					<block name="ConfBPDU" longname="Configuration BPDU">
						<field type="fixed" name="Flags" longname="Flags" size="1" showtemplate="FieldBin">
							<field type="bit" name="TCA" longname="Topology change acknowledgement" mask="0x80" size="1" showtemplate="FieldBin"/>
							<field type="bit" name="TC" longname="Topology change" mask="0x01" size="1" showtemplate="FieldBin"/>
						</field>
						<field type="fixed" name="RP" longname="Root ID priority" size="2" showtemplate="FieldHex"/>
						<field type="fixed" name="ROOTID" longname="Root ID MAC address" size="6" showtemplate="MACaddressEth"/>
						<field type="fixed" name="ROOTPATHCOST" longname="Root path cost" size="4" showtemplate="FieldHex"/>
						<field type="fixed" name="BP" longname="Source Bridge priority" size="2" showtemplate="FieldHex"/>
						<field type="fixed" name="BRIDGEID" longname="Source Bridge MAC address" size="6" showtemplate="MACaddressEth"/>
						<field type="fixed" name="PORTPRIORITY" longname="Port priority" size="1" showtemplate="FieldHex"/>
						<field type="fixed" name="PORTNUMBER" longname="Port number" size="1" showtemplate="FieldHex"/>
						<field type="fixed" name="MSGAGE" longname="Message age" size="2" showtemplate="ShortDiv256Dec"/>
						<field type="fixed" name="MAXAGE" longname="Max age" size="2" showtemplate="ShortDiv256Dec"/>
						<field type="fixed" name="HELLOTIME" longname="Hello time" size="2" showtemplate="ShortDiv256Dec"/>
						<field type="fixed" name="FWDELAY" longname="Forward delay" size="2" showtemplate="ShortDiv256Dec"/>
					</block>
				</case>

				<!-- Rapid Spanning Tree: type == 2 -->
				<case value="2">
					<block name="ConfBPDU" longname="Configuration BPDU">
						<field type="fixed" name="Flags" longname="Flags" size="1" showtemplate="FieldBin">
							<field type="bit" name="TCA" longname="Topology change acknowledgement" mask="0x80" size="1" showtemplate="FieldBin"/>
							<field type="bit" name="AG" longname="Agreement" mask="0x40" size="1" showtemplate="FieldBin"/>
							<field type="bit" name="FWD" longname="Forwarding" mask="0x20" size="1" showtemplate="FieldBin"/>
							<field type="bit" name="LRN" longname="Learning" mask="0x10" size="1" showtemplate="FieldBin"/>
							<field type="bit" name="PR" longname="Port Role" mask="0x0C" size="1" showtemplate="FieldBin"/>
							<field type="bit" name="PROP" longname="Proposal" mask="0x02" size="1" showtemplate="FieldBin"/>
							<field type="bit" name="TC" longname="Topology change" mask="0x01" size="1" showtemplate="FieldBin"/>
						</field>
						<field type="fixed" name="RP" longname="Root ID priority" size="2" showtemplate="FieldHex"/>	
						<field type="fixed" name="ROOTID" longname="Root ID MAC address" size="6" showtemplate="MACaddressEth"/>
						<field type="fixed" name="ROOTPATHCOST" longname="Root path cost" size="4" showtemplate="FieldHex"/>
						<field type="fixed" name="BP" longname="Source Bridge priority" size="2" showtemplate="FieldHex"/>
						<field type="fixed" name="BRIDGEID" longname="Source Bridge MAC address" size="6" showtemplate="MACaddressEth"/>
						<field type="fixed" name="PORTPRIORITY" longname="Port priority" size="1" showtemplate="FieldHex"/>
						<field type="fixed" name="PORTNUMBER" longname="Port number" size="1" showtemplate="FieldHex"/>
						<field type="fixed" name="MSGAGE" longname="Message age" size="2" showtemplate="ShortDiv256Dec"/>
						<field type="fixed" name="MAXAGE" longname="Max age" size="2" showtemplate="ShortDiv256Dec"/>
						<field type="fixed" name="HELLOTIME" longname="Hello time" size="2" showtemplate="ShortDiv256Dec"/>
						<field type="fixed" name="FWDELAY" longname="Forward delay" size="2" showtemplate="ShortDiv256Dec"/>
						<field type="fixed" name="VERLEN" longname="Version 1 Length" size="1" showtemplate="FieldDec"/>
					</block>
				</case>
			</switch>
		</fields>

	</format>

	<visualization>
		<showtemplate name="stp.ptype" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Configuration BPDU"/> 
					<case value="128" show="Topology change BPDU"/> 
					<default show="Error in 802.1d code lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="stp.type" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Spanning Tree"/> 
					<case value="2" show="Rapid Spanning Tree"/> 
					<default show="Error in 802.1d protocol code lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="stp">
			<if expr="$prevproto == #snap">
				<if-true>
					<text value=" - "/>
				</if-true>
				<if-false>
					<section name="next"/>
				</if-false>
			</if>

			<if expr="buf2int(type) == 0">
				<if-true>
					<text value="Spanning Tree "/>
				</if-true>
				<if-false>
					<text value="Rapid Spanning Tree "/>
				</if-false>
			</if>

			<protofield name="ptype" showdata="showmap"/>
		</showsumtemplate>
	</visualization>
</protocol>



<protocol name="etherpadding" longname="Ethernet padding">
	<format>
		<fields>
			<field type="variable" name="etherpad" longname="Ethernet Padding (frame less than 64 bytes)" expr="$framelength - $currentoffset" showtemplate="Field4BytesHex"/>
		</fields>
	</format>
</protocol>
<protocol name="mpls" longname="Multi Protocol Label Switching" showsumtemplate="mpls">
	<format>
		<fields>
			<!--
			The CoS field is identified as Exp (Experimental Use) inside RFC 3032
			-->
			<field type="bit" name="label" longname="Label" mask="0xFFFFF000" size="4" showtemplate="FieldDec"/>
			<field type="bit" name="cos" longname="Class of Service" mask="0x00000E00" size="4" showtemplate="FieldDec"/>
			<field type="bit" name="s" longname="Bottom of Stack" mask="0x00000100" size="4" showtemplate="FieldDec"/>
			<field type="bit" name="ttl" longname="Time To Live"  mask="0x000000FF" size="4" showtemplate="FieldDec"/>
		</fields>
	</format>

	<encapsulation>
		<if expr="buf2int(s) == 1">
			<if-true>
				<switch expr="buf2int(label)">
					<case value="0"> <nextproto proto="#ip"/> </case>
					<case value="2"> <nextproto proto="#ipv6"/> </case>
					<default> 
						<nextproto proto="#ip"/>
					</default>		
				</switch>
			</if-true>	
			<if-false>
				<nextproto proto="#mpls"/>
			</if-false>
		</if>
	</encapsulation>

	<visualization>
		<showsumtemplate name="mpls">
			<section name="next"/>
			<text value="LABEL: "/>
			<protofield name="label" showdata="showvalue"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="hci_acl_data" longname="HCI ACL Data">
	<format>
		<fields>
			<field type="fixed" name="acl_connection_handle" longname="Connection Handle" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="acl_data_length" longname="Data Length" size="2" showtemplate="FieldHex"/>
 			<!--
 			<field type="variable" name="acl_data_payload" longname="Data payload" expr="buf2int(acl_data_length)" showtemplate="Field1BytesHex"/>
 			-->
 		</fields>
	</format>

 	 <encapsulation>
		<nextproto proto="#l2cap_command"/>
	</encapsulation>
</protocol>
<protocol name="hci_command" longname="HCI Command" showsumtemplate="hci_command">
	<format>
		<fields>
			<field type="fixed" name="flags" longname="Opcode" size="2" showtemplate="hci_command.flags">
				<field type="bit" name="ocf" longname="Opcode Command Field" mask="0xFFC0" size="2" showtemplate="hci_command.ocf"/>
				<field type="bit" name="ogf" longname="Opcode Group Field" mask="0x003F" size="2" showtemplate="hci_command.ogf"/>
			</field>

			<field type="fixed" name="hci_command_length" longname="Data Length" size="1" showtemplate="FieldDec"/>

			<switch expr="buf2int(flags)">
				<case value="0260" comment="0x0104-HCI Inquiry">						<includeblk name="blk_hci_inquiry"/>						</case>
				<case value="0516" comment="0x204- Inquiry Cancel">						<includeblk name="blk_inquiry_cancel"/>						</case>

				<case value="0722" comment="0x304- Periodic Inquiry Mode">				<includeblk name="blk_periodic_enquiry_mode"/>				</case>
				<case value="1028" comment="0x0404-Exit Periodic Inquiry Mode">			<includeblk name="blk_exit_periodic_inquiry_mode"/>			</case>

				<case value="1284" comment="0x0504-Create_Connection">					<includeblk name="blk_create_connection"/>					</case>

				<case value="1540" comment="0x0604-Disconnect">							<includeblk name="blk_disconnect"/>							</case>

				<case value="1796" comment="0x0704-Add SCO Connection">					<includeblk name="blk_add_sco_connection"/>					</case>
				<case value="2052" comment="0x0804-Accept_Connection_Request">			<includeblk name="blk_accept_connection_request"/>			</case>
				<case value="2308" comment="0x0904-Reject_Connection_Request">			<includeblk name="blk_reject_connection_request"/>			</case>
				<case value="2820" comment="0x0B04-Link_Key_Request_Reply">				<includeblk name="blk_link_key_request_reply"/>				</case>
				<case value="3076" comment="0x0C04-Link_Key_Request_Negative_Reply">	<includeblk name="blk_link_key_request_negative_reply"/>	</case>

 				<case value="3332" comment="0x0D04-PIN_Code_Request_Reply">				<includeblk name="blk_pin_code_request_reply"/>				</case>
				<case value="3588" comment="0x0E04-Pin_Code_Request_Negative_Reply">	<includeblk name="blk_link_key_request_negative_reply"/>	</case>
				<case value="3844" comment="0x0F04-Change_Connection_Packet_Type">		<includeblk name="blk_change_connection_packet_type"/>		</case>
				<case value="4356" comment="0x1104-Authentication_Requested">			<includeblk name="blk_authentication_requested"/>			</case>
				<case value="4868" comment="0x1304-Set_Connection_Encryption">			<includeblk name="blk_set_connection_encryption"/>			</case>
				<case value="5380" comment="0x1504-Change_Connection_Link_Key">			<includeblk name="blk_change_connection_link_key"/>			</case>
				<case value="5892" comment="0x1704-Mastre_Link_Key">					<includeblk name="blk_master_link_key"/>					</case>
				<case value="6404" comment="0x1904-Remote_Name_Request">				<includeblk name="blk_remote_name_request"/>				</case>
				<case value="6916" comment="0x1B04-Read_Remote_Supported_Features">		<includeblk name="blk_read_remote_supported_features"/>		</case>
				<case value="7428" comment="0x1D04-Read_Remote_version_Information">	<includeblk name="blk_read_remote_version_information"/>	</case>
				<case value="7904" comment="0x1F04-Read_Clock_Offset">					<includeblk name="blk_read_clock_offset"/>					</case>

				<case value="0264" comment="0x0108-Hold_Mode">							<includeblk name="blk_hold_mode"/>							</case>
				<case value="0776" comment="0x0308-Sniff_Mode">							<includeblk name="blk_sniff_mode"/>							</case>
				<case value="1032" comment="0x0408-Exit_Sniff_Mode">					<includeblk name="blk_exit_sniff_mode"/>					</case>
				<case value="1288" comment="0x0508-Park_Mode">							<includeblk name="blk_park_mode"/>							</case>
				<case value="1544" comment="0x0608-Exit_Park_Mode">						<includeblk name="blk_exit_park_mode"/>						</case>
				<case value="1800" comment="0x0708-QoS_Setup">							<includeblk name="blk_qos_setup"/>							</case>
				<case value="2312" comment="0x0908-Role_Discovery">						<includeblk name="blk_role_discovery"/>						</case>
				<case value="2824" comment="0x0B08-Switch_Role">						<includeblk name="blk_switch_role"/>						</case>
				<case value="3080" comment="0x0C08-Read_Link_Policy_Settings">			<includeblk name="blk_read_link_policy_settings"/>			</case>
				<case value="3336" comment="0x0D08-write_Link_Policy_Sttings">			<includeblk name="blk_write_link_policy_settings"/>			</case>

				<case value="0268" comment="0x010C-Set_Event_Mask">						<includeblk name="blk_set_eventmask"/>						</case>
				<case value="0780" comment="0x030C-Reset">								<includeblk name="blk_hci_reset"/>							</case>
				<case value="1292" comment="0x050C-Set_Event_Filter">					<includeblk name="blk_hci_set_event_filter"/>				</case>
				<case value="2060" comment="0x080C-Flush">								<includeblk name="blk_hci_flush"/>							</case>
				<case value="2316" comment="0x090C-Read_PIN_Type">						<includeblk name="blk_read_pin_type"/>						</case>
				<case value="2572" comment="0x0A0C-Write PIN Type">						<includeblk name="blk_write_pin_type"/>						</case>
				<case value="2828" comment="0x0B0C-Create_New_Unit_Key">				<includeblk name="blk_create_new_unit_key"/>				</case>
				<case value="3340" comment="0x0D0C-Read_Stroed_Link_Key">				<includeblk name="blk_read_stored_link_key"/>				</case>
				<case value="4364" comment="0x110C-Write_Stored_Link_Key">				<includeblk name="blk_write_stored_link_key"/>				</case>
				<case value="4620" comment="0x120C-Delete_Stored_Link_Key">				<includeblk name="blk_delete_stored_link_key"/>				</case>
 				<case value="4876" comment="0x130C-Change_Local_Name">					<includeblk name="blk_change_local_name"/>					</case>
				<case value="5132" comment="0x140C-Read_Local_Name">					<includeblk name="blk_read_local_name"/>					</case>
				<case value="5388" comment="0x150C-Read_Connection_Accept_Timeout">		<includeblk name="blk_read_connection_accept_timeout"/>		</case>
				<case value="5644" comment="0x160C-Write_Connection_Accept_Timeout">	<includeblk name="blk_write_connection_accept_timeout"/>	</case>
				<case value="5900" comment="0x170C-Read_Page_Timeout">					<includeblk name="blk_read_page_timeout"/>					</case>
				<case value="6156" comment="0x180C-Write_Page_Timeout">					<includeblk name="blk_write_page_timeout"/>					</case>
				<case value="6412" comment="0x190C-Read_Scan_Enable">					<includeblk name="blk_read_scan_enable"/>					</case>
				<case value="6668" comment="0x1A0C-Write_Scan_Enable">					<includeblk name="blk_write_scan_enable"/>					</case>
				<case value="6924" comment="0x1B0C-Read_Page_Scan_Activity">			<includeblk name="blk_read_page_scan_activity"/>			</case>
				<case value="7180" comment="0x1C0C-Write_Page_Scan_Activity">			<includeblk name="blk_write_page_scan_activity"/>			</case>
				<case value="7436" comment="0x1D0C-Read_Inquiry_Scan_Activity">			<includeblk name="blk_read_inquiry_scan_activity"/>			</case>
				<case value="7692" comment="0x1E0C-Write_Inquiry_Scan_Activity">		<includeblk name="blk_write_inquiry_scan_activity"/>		</case>
				<case value="7948" comment="0x1F0C-Read_Authentication_Enable">			<includeblk name="blk_read_authentication_enable"/>			</case>
				<case value="8204" comment="0x200C-Write_Authentication_Enable">		<includeblk name="blk_write_authentication_enable"/>		</case>
				<case value="8460" comment="0x210C-Read_Encryption_Mode">				<includeblk name="blk_read_encryption_mode"/>				</case>
				<case value="8716" comment="0x220C-Write_Encryption_Mode">				<includeblk name="blk_write_encryption_mode"/>				</case>
 				<case value="8972" comment="0x230C-Read_Class_of_Device">				<includeblk name="blk_read_class_of_device"/>				</case>
				<case value="9228" comment="0x240C-Write_Class_of_Device">				<includeblk name="blk_write_class_of_device"/>				</case>
				<case value="9484" comment="0x250C-Read_Voice_Setting">					<includeblk name="blk_read_voice_setting"/>					</case>
				<case value="9740" comment="0x260C-Write_Voice_Setting">				<includeblk name="blk_write_voice_setting"/>				</case>
				<case value="9996" comment="0x270C-Read_Automatic_Flush_Timeout">		<includeblk name="blk_read_automatic_flush_timeout"/>		</case>
				<case value="10252" comment="0x280C-Write_Automatic_Flush_Timeout">		<includeblk name="blk_write_automatic_flush_timeout"/>		</case>
				<case value="10508" comment="0x290C-Read_Num_Broadcast_Retransmission">	<includeblk name="blk_read_num_broadcast_retransmission"/>	</case>
				<case value="10764" comment="0x2A0C-Write_Num_Broadcast_retransmission">	<includeblk name="blk_write_num_broadcast_retransmission"/>	</case>
				<case value="11020" comment="0x2B0C-Read_Hold_Mode_Activity">			<includeblk name="blk_read_hold_mode_activity"/>			</case>
				<case value="11276" comment="0x2C0C-Write_Hold_Mode_Activity">			<includeblk name="blk_write_hold_mode_activity"/>			</case>
				<case value="11532" comment="0x2D0C-Read_Transmit_Power_Level">			<includeblk name="blk_read_transmit_power_level"/>			</case>
				<case value="11788" comment="0x2E0C-Read_SCO_Flow_Control_Enable">		<includeblk name="blk_read_sco_flowcontrol_enable"/>		</case>
				<case value="12044" comment="0x2F0C-Write_SCO_Flow_Control_Enable">		<includeblk name="blk_write_sco_flowcontrol_enable"/>		</case>
				<case value="12556" comment="0x310C-Set_Host_Controller_To_Host_Flow_Control">	<includeblk name="blk_set_host_controller_to_host_flow_control"/>	</case>
 				<case value="13068" comment="0x330C-Host_Buffer_Size">					<includeblk name="blk_host_buffer_size"/>					</case>
				<case value="13580" comment="0x350C-Host_Number_Of_Completed_Packets">	<includeblk name="blk_host_number_of_completed_packets"/>	</case>
				<case value="13836" comment="0x360C-Read_Link_Supervision_Timeout">		<includeblk name="blk_read_link_supervision_timeout"/>		</case>
				<case value="14092" comment="0x370C-Write_Link_Supervision_Timeout">	<includeblk name="blk_write_link_supervision_timeout"/>		</case>
				<case value="14348" comment="0x380C-Read_Number_Of_Supported_IAC">		<includeblk name="blk_read_number_of_supported_iac"/>		</case>
				<case value="14604" comment="0x390C-Read_Current_IAC_LAP">				<includeblk name="blk_read_current_iac_lap"/>				</case>
				<case value="14860" comment="0x3A0C-Write_Current_IAC_LAP">				<includeblk name="blk_write_current_iac_lap"/>				</case>
				<case value="15116" comment="0x3B0C-Read_Page_Scan_Period_Mode">		<includeblk name="blk_read_page_scan_period_mode"/>			</case>
				<case value="15372" comment="0x3C0C-Write_Page_Scan_Period_Mode">		<includeblk name="blk_write_page_scan_period_mode"/>		</case>
				<case value="15628" comment="0x3D0C-Read_Page_Scan_Mode">				<includeblk name="blk_read_page_scan_mode"/>				</case>
				<case value="15884" comment="0x3E0C-Write_Page_Scan_Mode">				<includeblk name="blk_write_page_scan_mode"/>				</case>
				<case value="0272" comment="0x0110-Read_Local_Version_Information">		<includeblk name="blk_read_local_version_information"/>		</case>
				<case value="0784" comment="0x0310-Read_Local_Supported_Features">		<includeblk name="blk_read_local_supported_features"/>		</case>
				<case value="1296" comment="0x0510-Read_Buffer_Size">					<includeblk name="blk_read_buffer_size"/>					</case>
				<case value="1808" comment="0x0710-Read_Country_Code">					<includeblk name="blk_read_country_code"/>					</case>
				<case value="2320" comment="0x0910-Read_BD_ADDR">						<includeblk name="blk_read_bd_addr"/>						</case>
				<case value="0276" comment="0x0114-Read_Faild_Contact_Counter">			<includeblk name="blk_read_failed_contact_counter"/>		</case>
				<case value="0532" comment="0x0214-Reset_Faild_Contact_Counter">		<includeblk name="blk_reset_failed_contact_counter"/>		</case>
				<case value="0788" comment="0x0314-Get_Link_Quality">					<includeblk name="blk_get_link_quality"/>					</case>
				<case value="1300" comment="0x0514-Read_RSSI">							<includeblk name="blk_read_rssi"/>							</case>
				<case value="0280" comment="0x0118-Read_Loopback_Mode">					<includeblk name="blk_read_loopback_mode"/>					</case>
				<case value="0536" comment="0x0218-Write_Loopback_Mode">				<includeblk name="blk_write_loopback_mode"/>				</case>
				<case value="0792" comment="0x0318-Enable_Device_Under_Test_Mode">		<includeblk name="blk_enable_device_under_test_mode"/>		</case>

 				<default>
					<field type="variable" name="payload" longname="Parameters" expr="buf2int(hci_command_length)" showtemplate="Field2BytesHexDash"/>
				</default>
			</switch>

		</fields>


		<!-- Blocks -->
		<block name="blk_hci_inquiry" longname="Parameters">
			<field type="fixed" name="lap" longname="LAP" size="3" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="inquiry_length" longname="Inquiry Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="num_response" longname="Maximum Number of Responses" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_inquiry_cancel" longname="Parameters">
			<!-- Return
			<field type="fixed" name="status" longname="Resturn Status" size="1" showtemplate="FieldDec"/>
			-->
		</block>

		<block name="blk_periodic_enquiry_mode" longname="Parameters">
			<field type="fixed" name="max_period_length" longname="Maximum Period Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="min_period_length" longname="Minimum Period Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="lap" longname="LAP" size="3" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="inquiry_length" longname="Inquiry Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="num_response" longname="Maximum Number of Responses" size="1" showtemplate="FieldDec"/>
			<!-- Ret
			<field type="fixed" name="status" longname="Resturn Status" size="1" showtemplate="FieldDec"/>
			-->
		</block>

		<block name="blk_exit_periodic_inquiry_mode" longname="Parameters">
			<!-- ret
			<field type="fixed" name="status" longname="Resturn Status" size="1" showtemplate="FieldDec"/>
			-->
		</block>

		<block name="blk_create_connection" longname="Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="packet_type" longname="Packet Type" size="2" showtemplate="hci_command.packet_type"/>
			<field type="fixed" name="page_scan_repetition_mode" longname="Page Scan Repetition Mode" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="page_scan_mode" longname="Page Scan Mode" size="1" showtemplate="bluetooth.page_scan_mode"/>
			<field type="fixed" name="clock_offset" longname="Clock Offset" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="allow_role_switch" longname="Allow Role Switch" size="1" showtemplate="hci_command.allow_role_switch"/>
		</block>

		<block name="blk_disconnect" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="reason" longname="Reason" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_add_sco_connection" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="packet_type" longname="Packet Type" size="2" showtemplate="hci_command.packet_type"/>
		</block>

		<block name="blk_accept_connection_request" longname="Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="role" longname="Role" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_reject_connection_request" longname="Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="reason" longname="Reason" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_link_key_request_reply" longname="Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="link_key" longname="Link Key" size="16" showtemplate="Field1BytesHex"/>
			<!-- Ret
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="r_bd_addr" longname="Return BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			-->
		</block>

		<block name="blk_link_key_request_negative_reply" longname="Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<!-- RET
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="r_bd_addr" longname="Return BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			-->
		</block>

		<block name="blk_pin_code_request_reply" longname="Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="pincode_length" longname="PIN Code Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="pincode" longname="PIN Code" size="16" showtemplate="Field1BytesHex"/>
			<!-- RET
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="r_bd_addr" longname="Return BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			-->
		</block>

		<block name="blk_pin_code_request_negative_reply" longname="Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
	 		<!-- RET
	 		<field type="fixed" name="status" longname="Status" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="r_bd_addr" longname="Return BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			-->
		</block>

		<block name="blk_change_connection_packet_type" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="packet_type" longname="Packet Type" size="2" showtemplate="hci_command.packet_type"/>
		</block>

		<block name="blk_authentication_requested" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_set_connection_encryption" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="encryption_enable" longname="Encryption Enable" size="1" showtemplate="bluetooth.encryption_enable"/>
		</block>

		<block name="blk_change_connection_link_key" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_master_link_key" longname="Parameters">
			<field type="fixed" name="key_flag" longname="Key Flag" size="1" showtemplate="hci_command.key_flag"/>
		</block>

		<block name="blk_remote_name_request" longname="Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
	 		<field type="fixed" name="page_scan_repetition_mode" longname="Page Scan Repetetion Mode" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="page_scan_mode" longname="Page Scan Mode" size="1" showtemplate="bluetooth.page_scan_mode"/>
			<field type="fixed" name="clock_offset" longname="Clock Offset" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_remote_supported_features" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_remote_version_information" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_clock_offset" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_hold_mode" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="hold_mode_max_interval" longname="Hold Mode Max Interval" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="hold_mode_min_interval" longname="Hold Mode Min Interval" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_sniff_mode" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="sniff_mode_max_interval" longname="Sniff Mode Max Interval" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="sniff_mode_min_interval" longname="Sniff Mode Min Interval" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="sniff_attempt" longname="Sniff Attempt" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="sniff_timeout" longname="Sniff Timeout" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_exit_sniff_mode" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_park_mode" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="beacon_max_interval" longname="Beacon Max Interval" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="beacon_min_interval" longname="Beacon Min Interval" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_exit_park_mode" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_qos_setup" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="flags" longname="Flags" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="service_type" longname="Service Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="token_rate" longname="Token rate" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="peak_bandwidth" longname="Peak Bandwidth" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="latency" longname="Latency" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="delay_variation" longname="Delay Variation" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="blk_role_discovery" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<!-- RET
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="r_connection_handle" longname="Return Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="current_role" longname="Current Role" size="1" showtemplate="FieldDec"/>
			-->
		</block>

		<block name="blk_switch_role" longname="Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="role" longname="Role" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_link_policy_settings" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<!-- RET
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="r_connection_handle" longname="Return Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="link_policy_settings" longname="Link Polcy Settings" size="2" showtemplate="FieldDec"/>
			-->
		</block>

		<block name="blk_write_link_policy_settings" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="link_policy_settings" longname="Link Polcy Settings" size="2" showtemplate="FieldDec"/>
			<!-- RET
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="r_connection_handle" longname="Return Connection Handle" size="2" showtemplate="FieldDec"/>
			-->
		</block>

		<block name="blk_set_eventmask" longname="Parameters">
			<field type="fixed" name="event_mask" longname="Event Mask" size="1" showtemplate="FieldDec"/>
			<!-- RET
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="FieldDec"/>
			-->
		</block>

		<block name="blk_hci_reset" longname="Parameters">
			<!-- No Params... -->
		</block>

		<block name="blk_hci_set_event_filter" longname="Parameters">
			<field type="fixed" name="filter_type" longname="Filter Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="inquiry_result_filter_condition_type" longname="Inqyuiry Result Filter Condition Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="connection_setup_filter_condition_type" longname="Connection Setup Filter Condition Type" size="1" showtemplate="FieldDec"/>

			<!-- Comment ################### Add and Check it later -->
			<field type="variable" name="condition" longname="Condition" expr="buf2int(hci_command_length) - 3" showtemplate="Field2BytesHexDash"/>
		</block>

		<block name="blk_hci_flush" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_pin_type" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_pin_type" longname="Parameters">
			<field type="fixed" name="pin_type" longname="PIN Type" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_create_new_unit_key" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_read_stored_link_key" longname="Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="read_all_flag" longname="Read All Flag" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_write_stored_link_key" longname="Parameters">
			<field type="fixed" name="num_keys_to_write" longname="Number of Keys to write" size="1" showtemplate="FieldDec"/>

			<block name="key_list" longname="List of Keys">
				<loop type="times2repeat" expr="buf2int(num_keys_to_write)">
					<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
					<field type="fixed" name="link_key" longname="Link Key" size="16" showtemplate="Field1BytesHex"/>
				</loop>
			</block>
		</block>

		<block name="blk_delete_stored_link_key" longname="Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="delete_all_flag" longname="Delete All Flag" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_change_local_name" longname="Parameters">
			<field type="fixed" name="name" longname="Name" size="248" showtemplate="Field1BytesHex"/>
		</block>

		<block name="blk_read_local_name" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_read_connection_accept_timeout" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_connection_accept_timeout" longname="Parameters">
			<field type="fixed" name="connection_accept_timeout" longname="Connection Accept Timeout" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_page_timeout" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_page_timeout" longname="Parameters">
			<field type="fixed" name="page_timeout" longname="Page Timeout" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_scan_enable" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_scan_enable" longname="Parameters">
			<field type="fixed" name="scan_enable" longname="Scan Enable" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_page_scan_activity" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_page_scan_activity" longname="Parameters">
			<field type="fixed" name="page_scan_interval" longname="Page Scan Interval" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="page_scan_window" longname="Page Scan Window" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_inquiry_scan_activity" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_inquiry_scan_activity" longname="Parameters">
			<field type="fixed" name="inquiry_scan_interval" longname="Inquiry Scan Interval" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="inquiry_scan_window" longname="Inquiry Scan Window" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_authentication_enable" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_authentication_enable" longname="Parameters">
			<field type="fixed" name="authentication_enable" longname="Authentication Enable" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_encryption_mode" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_encryption_mode" longname="Parameters">
			<field type="fixed" name="encryption_mode" longname="Encryption Mode" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_class_of_device" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_class_of_device" longname="Parameters">
			<field type="fixed" name="class_of_device" longname="Class of Device" size="3" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_voice_setting" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_voice_setting" longname="Parameters">
			<field type="fixed" name="voice_setting" longname="Voice Settings" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_automatic_flush_timeout" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_write_automatic_flush_timeout" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="flush_timeout" longname="Flush Timeout" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_num_broadcast_retransmission" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_num_broadcast_retransmission" longname="Parameters">
			<field type="fixed" name="num_broadcast_retransmission" longname="Number of Broadcase Retransmission" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_hold_mode_activity" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_hold_mode_activity" longname="Parameters">
			<field type="fixed" name="hold_mode_activity" longname="Hold mode activity" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_transmit_power_level" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_sco_flowcontrol_enable" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_sco_flowcontrol_enable" longname="Parameters">
			<field type="fixed" name="sco_flowcontrol_enable" longname="SCO Flow control Enable" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_set_host_controller_to_host_flow_control" longname="Parameters">
			<field type="fixed" name="flowcontrol_enable" longname="Flow control Enable" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_host_buffer_size" longname="Parameters">
			<field type="fixed" name="host_acl_data_packet_length" longname="Host ACL Data Packet length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="host_sco_data_packet_length" longname="Host SCO Data Packet Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="host_total_num_acl_data_packets" longname="Total Number of ACL Data Packets" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="host_total_num_sco_data_packets" longname="Total Number of SCO Data Packets" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_host_number_of_completed_packets" longname="Parameters">
			<field type="fixed" name="number_of_handles" longname="Number of Handles" size="1" showtemplate="FieldDec"/>

			<block name="key_list" longname="List of Keys">
				<loop type="times2repeat" expr="buf2int(num_keys_to_write)">
					<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
					<field type="fixed" name="host_number_of_completed_packets" longname="Host Number of Completed Packets" size="2" showtemplate="FieldDec"/>
				</loop>
			</block>
		</block>

		<block name="blk_read_link_supervision_timeout" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_write_link_supervision_timeout" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="link_supervision_timeout" longname="Link Supervision Timeout" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_number_of_supported_iac" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_read_current_iac_lap" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_current_iac_lap" longname="Parameters">
			<field type="fixed" name="num_current_iac" longname="Num Current IAC" size="1" showtemplate="FieldDec"/>

			<block name="key_list" longname="List of Keys">
				<loop type="times2repeat" expr="buf2int(num_keys_to_write)">
					<field type="fixed" name="iac_lap" longname="IAC LAP" size="3" showtemplate="FieldDec"/>
				</loop>
			</block>
		</block>

		<block name="blk_read_page_scan_period_mode" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_page_scan_period_mode" longname="Parameters">
			<field type="fixed" name="page_scan_period_mode" longname="Page Scan Period Mode" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_page_scan_mode" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_page_scan_mode" longname="Parameters">
			<field type="fixed" name="page_scan_mode" longname="Page Scan Mode" size="1" showtemplate="bluetooth.page_scan_mode"/>
		</block>

		<!-- ################################################################################ -->
		<block name="blk_read_local_version_information" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_read_local_supported_features" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_read_buffer_size" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_read_country_code" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_read_bd_addr" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_read_failed_contact_counter" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_reset_failed_contact_counter" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_get_link_quality" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_rssi" longname="Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_loopback_mode" longname="Parameters">
			<!-- No Parameters -->
		</block>

		<block name="blk_write_loopback_mode" longname="Parameters">
			<field type="fixed" name="loopback_mode" longname="Loopback Mode" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_enable_device_under_test_mode" longname="Parameters">
			<!-- No Parameters -->
		</block>
	</format>


 	<encapsulation>
		<nextproto proto="#ethernet"/>
	</encapsulation>


	<visualization>
		<showtemplate name="hci_command.flags" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1025" comment="0x0401" show="HCI Inquiry"/>
					<case value="1026" comment="0x0402" show="Inquiry Cancel"/>
					<case value="1027" comment="0x0403" show="Periodic Enquiry Mode"/>
					<case value="1028" comment="0x0404" show="Exit Periodic Inquiry Mode"/>
					<case value="1029" comment="0x0405" show="Create_Connection"/>
					<case value="1030" comment="0x0406" show="Disconnect"/>
					<case value="1031" comment="0x0407" show="Add_SCO_Connection "/>
					<case value="1032" comment="0x0408" show="Accept_Connection_Request"/>
					<case value="1033" comment="0x0409" show="Reject_Connection_Request"/>
					<case value="1035" comment="0x040B" show="Link_Key_Request_Reply"/>
					<case value="1036" comment="0x040C" show="Link_Key_Request_Negative_Reply"/>
					<case value="1037" comment="0x040D" show="PIN_Code_Request_Reply"/>
					<case value="1038" comment="0x040E" show="Pin_Code_Request_Negative_Reply"/>
					<case value="1039" comment="0x040F" show="Change_Connection_Packet_Type"/>
					<case value="1041" comment="0x0411" show="Authentication_Requested"/>
					<case value="1043" comment="0x0413" show="Set_Connection_Encryption"/>
					<case value="1045" comment="0x0415" show="Change_Connection_Link_Key"/>
					<case value="1047" comment="0x0417" show="Mastre_Link_Key"/>
					<case value="1049" comment="0x0419" show="Remote_Name_Request"/>
					<case value="1051" comment="0x041B" show="Read_Remote_Supported_Features"/>
					<case value="1053" comment="0x041D" show="Read_Remote_version_Information"/>
					<case value="1055" comment="0x041F" show="Read_Clock_Offset"/>

					<case value="2049" comment="0x0801" show="Hold_Mode"/>
					<case value="2051" comment="0x0803" show="Sniff_Mode"/>
					<case value="2052" comment="0x0804" show="Exit_Sniff_Mode"/>
					<case value="2053" comment="0x0805" show="Park_Mode"/>
					<case value="2054" comment="0x0806" show="Exit_Park_Mode"/>
					<case value="2055" comment="0x0807" show="QoS_Setup"/>
					<case value="2057" comment="0x0809" show="Role_Discovery"/>
					<case value="2059" comment="0x080B" show="Switch_Role"/>
					<case value="2060" comment="0x080C" show="Read_Link_Policy_Settings"/>
					<case value="2061" comment="0x080D" show="write_Link_Policy_Sttings"/>
		
					<case value="3073" comment="0x0C01" show="Set_Event_Mask"/>
					<case value="2075" comment="0x0C03" show=" Reset"/>
		 			<case value="3077" comment="0x0C05" show="Set_Event_Filter"/>
		 			<case value="3080" comment="0x0C08" show="Flush"/>
		 			<case value="3081" comment="0x0C09" show="Read_PIN_Type"/>
		 			<case value="3082" comment="0x0C0A" show="Write PIN Type"/>
		 			<case value="3083" comment="0x0C0B" show="Create_New_Unit_Key"/>
					<case value="3085" comment="0x0C0D" show="Read_Stroed_Link_Key"/>
		 			<case value="3089" comment="0x0C11" show="Write_Stored_Link_Key"/>
		 			<case value="3090" comment="0x0C12" show="Delete_Stored_Link_Key"/>
					<case value="3091" comment="0x0C13" show="Change_Local_Name"/>
		 			<case value="3092" comment="0x0C14" show="Read_Local_Name"/>
		 			<case value="3093" comment="0x0C15" show="Read_Connection_Accept_Timeout"/>
					<case value="3094" comment="0x0C16" show="Write_Connection_Accept_Timeout"/>
		 			<case value="3095" comment="0x0C17" show="Read_Page_Timeout"/>
		 			<case value="3096" comment="0x0C18" show="Write_Page_Timeout"/>
					<case value="3097" comment="0x0C19" show="Read_Scan_Enable"/>
		 			<case value="3098" comment="0x0C1A" show="Write_Scan_Enable"/>
		 			<case value="3099" comment="0x0C1B" show="Read_Page_Scan_Activity"/>
					<case value="3100" comment="0x0C1C" show="Write_Page_Scan_Activity"/>
		 			<case value="3101" comment="0x0C1D" show="Read_Inquiry_Scan_Activity"/>
		 			<case value="3102" comment="0x0C1E" show="Write_Inquiry_Scan_Activity"/>
					<case value="3103" comment="0x0C1F" show="Read_Authentication_Enable"/>
		 			<case value="3104" comment="0x0C20" show="Write_Authentication_Enable"/>
		 			<case value="3105" comment="0x0C21" show="Read_Encryption_Mode"/>
					<case value="3106" comment="0x0C22" show="Write_Encryption_Mode"/>
		 			<case value="3107" comment="0x0C23" show="Read_Class_of_Device"/>
		 			<case value="3108" comment="0x0C24" show="Write_Class_of_Device"/>
					<case value="3109" comment="0x0C25" show="Read_Voice_Setting"/>
		 			<case value="3110" comment="0x0C26" show="Write_Voice_Setting"/>
		 			<case value="3111" comment="0x0C27" show="Read_Automatic_Flush_Timeout"/>
					<case value="3112" comment="0x0C28" show="Write_Automatic_Flush_Timeout"/>
		 			<case value="3113" comment="0x0C29" show="Read_Num_Broadcast_Retransmission"/>
		 			<case value="3114" comment="0x0C2A" show="Write_Num_Broadcast_retransmission"/>
					<case value="3115" comment="0x0C2B" show="Read_Hold_Mode_Activity"/>
		 			<case value="3116" comment="0x0C2C" show="Write_Hold_Mode_Activity"/>
		 			<case value="3117" comment="0x0C2D" show="Read_Transmit_Power_Level"/>
					<case value="3118" comment="0x0C2E" show="Read_SCO_Flow_Control_Enable"/>
		 			<case value="3119" comment="0x0C2F" show="Write_SCO_Flow_Control_Enable"/>
		 			<case value="3121" comment="0x0C31" show="Set_Host_Control_To_Host_Flow_Control"/>
					<case value="3123" comment="0x0C33" show="Host_Buffer_Size"/>
		 			<case value="3125" comment="0x0C35" show="Host_Number_Of_Completed_Packets"/>
		 			<case value="3126" comment="0x0C36" show="Read_Link_Supervision_Timeout"/>
		 			<case value="3127" comment="0x0C37" show="Write_Link_Supervision_Timeout"/>
		 			<case value="3128" comment="0x0C38" show="Read_Number_Of_Supported_IAC"/>
		 			<case value="3129" comment="0x0C39" show="Read_Current_IAC_LAP"/>
		 			<case value="3130" comment="0x0C3A" show="Write_Current_IAC_LAP"/>
		 			<case value="3131" comment="0x0C3B" show="Read_Page_Scan_Period_Mode"/>
		 			<case value="3132" comment="0x0C3C" show="Write_Page_Scan_Period_Mode"/>
		 			<case value="3133" comment="0x0C3D" show="Read_Page_Scan_Mode"/>
		 			<case value="3134" comment="0x0C3E" show="Write_Page_Scan_Mode"/>

		 			<case value="4097" comment="0x1001" show="Read_Local_Version_Information"/>
		 			<case value="4099" comment="0x1003" show="Read_Local_Supported_Features"/>
		 			<case value="4101" comment="0x1005" show="Read_Buffer_Size"/>
	 			<case value="4103" comment="0x1007" show="Read_Country_Code"/>
		 			<case value="4105" comment="0x1009" show="Read_BD_ADDR"/>
		
		 			<case value="5121" comment="0x1401" show="Read_Faild_Contact_Counter"/>
		 			<case value="5122" comment="0x1402" show="Reset_Faild_Contact_Counter"/>
		 			<case value="5123" comment="0x1403" show="Get_Link_Quality"/>
		 			<case value="5125" comment="0x1405" show="Read_RSSI"/>

		 			<case value="6145" comment="0x1801" show="Read_Loopback_Mode"/>
					<case value="6146" comment="0x1802" show="Write_Loopback_Mode"/>
					<case value="6147" comment="0x1803" show="Enable_Device_Under_Test_Mode"/>

		 			<default show="Unknown Command Packet"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="hci_command.ogf" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="4" comment="Hex 0x04 is BE 1" show="Link Control Commands"/>
					<case value="8" comment="Hex 0x08 is BE 2" show="Link Policy Commands"/>
					<case value="12" comment="Hex 0x0C is BE 3" show="HC Baseband Commands"/>
					<case value="16" comment="Hex 0x10 is BE 4" show="Information Paramters"/>
					<case value="20" comment="Hex 0x14 is BE 5" show="Satus Parameters"/>
					<case value="24" comment="Hex 0x18 is BE 6" show="Testing Commands"/>
					<case value="248" comment="Hex 0xF8 is BE 3E" show="BT Logo Testing"/>
					<case value="252" comment="Hex 0xFC is BE 3F" show="Debug Commands"/>
					<default show="Unknown Command Group"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="hci_command.ocf" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<!-- Fake 'case', otherwise NetBee complains about this -->
					<case value="1" show="Default OCF Map"/>
					<default show="Default OCF Map"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="hci_command.packet_type" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x0800" show="DM1"/>
					<case value="0x1000" show="DH1"/>
					<case value="0x2000" show="HV1"/>
					<case value="0x4000" show="HV2"/>
					<case value="0x8000" show="HV3"/>
					<case value="0x0004" show="DM3"/>
					<case value="0x0008" show="DH3"/>
					<case value="0x0040" show="DM5"/>
					<case value="0x0080" show="DH5"/>
					<default show="Reserved for future use"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="hci_command.allow_role_switch" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Local device will be a master and will not accept a master slave role switch by a remote device"/>
					<case value="1" show="Accepts Master-Slave switcing"/>
					<default show="Reserved"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="hci_command.key_flag" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Use Semin-ermanentLink Keys"/>
					<case value="1" show="Use Temporary Link Keys"/>
					<default show="Invalid Code"/>
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="hci_command">
			<section name="next"/>
			<text value=" OpcodeCommandField: "/>
			<protofield name="ogf" showdata="showmap"/>
			<text value=" OpcodeGroupField: "/>
			<protofield name="ocf" showdata="showmap"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="hci_error_message" longname="HCI Error Code">
	<format>
		<fields>
			<field type="fixed" name="dummy" longname="Dummy Field" size="1" showtemplate="FieldDec"/>
		</fields>
	</format>
</protocol>
<protocol name="hci_event" longname="HCI Event" showsumtemplate="hci_event">
	<format>
		<fields>
			<field type="fixed" name="hci_event_code" longname="Event Code" size="1" showtemplate="hci_event.hci_event_code"/>
			<field type="fixed" name="event_data_length" longname="Length of Data" size="1" showtemplate="FieldDec"/>

			<switch expr="buf2int(hci_event_code)">

<!-- FULVIO: in order to increase readability, I suggest to keep the comment to the minimum, e.g. "0x01" instead of "0x01-Inquiry Complete Event" -->
<!-- In any case, the meaning of that code is very well clear thanks to the very long name you have in the includeblock -->
<!-- This is a general comment related to all the switch-case elements you've implemented in this file. -->

				<case value="1" comment="0x01-Inquiry Complete Event">							<includeblk name="blk_inquiry_complete_event"/>								</case>
				<case value="2" comment="0x02-Inquiry Result Event">							<includeblk name="blk_inquiry_result_event"/>								</case>
				<case value="3" comment="0x03-Connection Complete Event">						<includeblk name="blk_connection_complete_event"/>							</case>
				<case value="4" comment="0x04-Connection Request Event">						<includeblk name="blk_connection_request_event"/>							</case>
				<case value="5" comment="0x05-Disconnection Complete Event">					<includeblk name="blk_disconnection_complete_event"/>						</case>
				<case value="6" comment="0x06-Authentication Complete Event">					<includeblk name="blk_authentication_complete_event"/>						</case>
				<case value="7" comment="0x07-Remote Name Request Complete Event">				<includeblk name="blk_remote_name_request_complete_event"/>					</case>
				<case value="8" comment="0x08-Encryption Change Event">							<includeblk name="blk_encryption_change_event"/>							</case>
				<case value="9" comment="0x09-Change Connection Link Key Complete Event">		<includeblk name="blk_change_connection_link_key_complete_event"/>			</case>
				<case value="10" comment="0x0A-Master Link Key Complete Event">					<includeblk name="blk_master_link_key_complete_event"/>						</case>
	 			<case value="11" comment="0x0B-Read Remote Supported Features Complete Event">	<includeblk name="blk_read_remote_supported_features_complete_event"/>		</case>
				<case value="12" comment="0x0C-Read Remote Version Information Complete Event">		<includeblk name="blk_read_remote_version_information_complete_event"/>	</case>
				<case value="13" comment="0x0D-QoS Setup Complete Event">						<includeblk name="blk_qos_setup_complete_event"/>							</case>
				<case value="14" comment="0x0E-Command Complete Event">							<includeblk name="blk_command_complete_event"/>								</case>
				<case value="15" comment="0x0F-Command Status Event">							<includeblk name="blk_command_status_event"/>								</case>
				<case value="16" comment="0x10-Hardware Error Event">							<includeblk name="blk_hardware_error_event"/>								</case>
				<case value="17" comment="0x11-Flush Occurred Event">							<includeblk name="blk_flush_occured_event"/>								</case>
				<case value="18" comment="0x12-Role Change Event">								<includeblk name="blk_role_change_event"/>									</case>
				<case value="19" comment="0x13-Number of Completed Packets Event">				<includeblk name="blk_number_of_completed_packets_event"/>					</case>
				<case value="20" comment="0x14-Mode Change Event">								<includeblk name="blk_mode_change_event"/>									</case>
	 			<case value="21" comment="0x15-Return Link Keys Event">							<includeblk name="blk_return_link_keys_event"/>								</case>
				<case value="22" comment="0x16-PIN Code Request Event">							<includeblk name="blk_pin_code_request_event"/>								</case>
				<case value="23" comment="0x17-Link Key Request Event">							<includeblk name="blk_link_key_request_event"/>								</case>
				<case value="24" comment="0x18-Link Key Notification Event">					<includeblk name="blk_link_key_notification_event"/>						</case>
				<case value="25" comment="0x19-Loopback Command Event">							<includeblk name="blk_loopback_command_event"/>								</case>
				<case value="26" comment="0x1A-Data Buffer Overflow Event">						<includeblk name="blk_databuffer_overflow_event"/>							</case>
				<case value="27" comment="0x1B-Max Slots Change Event">							<includeblk name="blk_max_slots_change_event"/>								</case>
				<case value="28" comment="0x1C-Read Clock Offset Complete Event">				<includeblk name="blk_read_clock_offset_complete_event"/>					</case>
				<case value="29" comment="0x1D-Connection Packet Type Changed Event">			<includeblk name="blk_connection_packet_type_changed_event"/>				</case>
				<case value="30" comment="0x1E-QoS Violation Event">							<includeblk name="blk_qos_violation_event"/>								</case>
				<case value="31" comment="0x1F-Page Scan Mode Change Event">					<includeblk name="blk_page_scan_mode_change_event"/>						</case>
				<case value="32" comment="0x20-Page Scan Repetition Mode Change Event">			<includeblk name="blk_page_scan_repetition_mode_change_event"/>				</case>

				<default>
 					<field type="variable" name="event_parameters" longname="(Default) Event Parameters" expr="buf2int(event_data_length)" showtemplate="Field2BytesHexDash"/>
 				</default>
 			</switch>
		</fields>


		<block name="blk_inquiry_complete_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
		</block>

		<block name="blk_inquiry_result_event" longname="Event Parameters">
			<field type="fixed" name="num_response" longname="Number of Responses from the Inquiry" size="1" showtemplate="FieldDec"/>

			<block name="result_list" longname="Inquiry Responses">
				<loop type="times2repeat" expr="buf2int(num_response)">
					<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
					<field type="fixed" name="page_scan_repetition_mode" longname="Page Scan Repetition Mode" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="page_scan_period_mode" longname="Page Scan Perod Mode" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="page_scan_mode" longname="Page Scan Mode" size="1" showtemplate="bluetooth.page_scan_mode"/>
					<field type="fixed" name="class_of_device" longname="Class of Device" size="3" showtemplate="FieldDec"/>
					<field type="fixed" name="clock_offset" longname="Clock Offset" size="2" showtemplate="FieldDec"/>
				</loop>
			</block>
		</block>

		<block name="blk_connection_complete_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="link_type" longname="Link Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="encryption_mode" longname="Encryption Mode" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_connection_request_event" longname="Event Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="class_of_device" longname="Class of Device" size="3" showtemplate="FieldDec"/>
			<field type="fixed" name="link_type" longname="Link Type" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_disconnection_complete_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="reason" longname="Reason" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_authentication_complete_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_remote_name_request_complete_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="remote_name" longname="Remote Name" size="248" showtemplate="Field1BytesHex"/>
		</block>

		<block name="blk_encryption_change_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="encryption_enable" longname="Encryption Enable" size="1" showtemplate="bluetooth.encryption_enable"/>
		</block>

		<block name="blk_change_connection_link_key_complete_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_master_link_key_complete_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="key_flag" longname="Key Flag" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_remote_supported_features_complete_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="lmp_features" longname="LMP Features" size="8" showtemplate="Field1BytesHex"/>
		</block>

		<block name="blk_read_remote_version_information_complete_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="lmp_version" longname="LMP Version" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="manufacturer_name" longname="Manufacturer Name" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="lmp_subversion" longname="LMP Subversion" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_qos_setup_complete_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="flag" longname="Flag" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="service_type" longname="Service Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="token_rate" longname="Token rate" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="peak_bandwidth" longname="Peak Bandwidth" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="latency" longname="Latency" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="delay_variation" longname="Delay Variation" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="blk_command_complete_event" longname="Event Parameters">
			<field type="fixed" name="num_hci_command_packets" longname="Number of HCI Command Packets" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="command_opcode" longname="Command Opcode" size="2" showtemplate="FieldDec"/>
			<!-- Return Parameters -->
			<field type="variable" name="event_parameters" longname="Event Parameters" expr="buf2int(event_data_length) - 3" showtemplate="Field2BytesHexDash"/>
		</block>

		<block name="blk_command_status_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="num_hci_command_packets" longname="Number of HCI Command Packets" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="command_opcode" longname="Command Opcode" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_hardware_error_event" longname="Event Parameters">
			<field type="fixed" name="hardware_code" longname="Hardware Code" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_flush_occured_event" longname="Event Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_role_change_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="new_role" longname="New Role" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_number_of_completed_packets_event" longname="Event Parameters">
			<field type="fixed" name="number_of_handles" longname="Number of Handles" size="1" showtemplate="FieldDec"/>

			<block name="completed_packets_list" longname="Completed Packets List">
				<loop type="times2repeat" expr="buf2int(number_of_handles)">
					<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
					<field type="fixed" name="hc_num_of_completed_packets" longname="HC Number of Complted Packets" size="2" showtemplate="FieldDec"/>
				</loop>
			</block>
		</block>

		<block name="blk_mode_change_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="current_mode" longname="Current Mode" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="interval" longname="Interval" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_return_link_keys_event" longname="Event Parameters">
			<field type="fixed" name="num_key" longname="Number of Keys" size="1" showtemplate="FieldDec"/>

			<block name="key_list" longname="Completed Packets List">
				<loop type="times2repeat" expr="buf2int(num_key)">
					<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
					<field type="fixed" name="link_key" longname="Link Key" size="16" showtemplate="Field1BytesHex"/>
				</loop>
			</block>
		</block>

		<!-- ************************************************************ -->
		<block name="blk_pin_code_request_event" longname="Event Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
		</block>

		<block name="blk_link_key_request_event" longname="Event Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
		</block>

		<block name="blk_link_key_notification_event" longname="Event Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="link_key" longname="Link Key" size="16" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="key_type" longname="Key Type" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_loopback_command_event" longname="Event Parameters">
	 		<field type="variable" name="hci_command_packet" longname="HCI Command Packet" expr="buf2int(event_data_length)" showtemplate="Field2BytesHexDash"/>
		</block>

		<block name="blk_databuffer_overflow_event" longname="Event Parameters">
			<field type="fixed" name="link_type" longname="Link Type" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_max_slots_change_event" longname="Event Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="lmp_max_slots" longname="LMP Max Slots" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_read_clock_offset_complete_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="clock_offset" longname="Clock Offset" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_connection_packet_type_changed_event" longname="Event Parameters">
			<field type="fixed" name="status" longname="Status" size="1" showtemplate="hci_event.status"/>
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="packet_type" longname="Packet Type" size="2" showtemplate="hci_command.packet_type"/>
		</block>

		<block name="blk_qos_violation_event" longname="Event Parameters">
			<field type="fixed" name="connection_handle" longname="Connection Handle" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="blk_page_scan_mode_change_event" longname="Event Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="page_scan_mode" longname="Page Scan Mode" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="blk_page_scan_repetition_mode_change_event" longname="Event Parameters">
			<field type="fixed" name="bd_addr" longname="BD ADDR" size="6" showtemplate="Field1BytesHex"/>
			<field type="fixed" name="page_scan_repetition_mode" longname="Page Scan Repetition Mode" size="1" showtemplate="FieldDec"/>
		</block>
	</format>


	<visualization>
		<showtemplate name="hci_event.status" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Succeeded"/>
					<default show="Failed"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="hci_event.hci_event_code" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" comment="0x01" show="Inquiry Complete Event"/>
					<case value="2" comment="0x02" show="Inquiry Result Event"/>
					<case value="3" comment="0x03" show="Connection Complete Event"/>
					<case value="4" comment="0x04" show="Connection Request Event"/>
					<case value="5" comment="0x05" show="Disconnection Complete Event"/>
					<case value="6" comment="0x06" show="Authentication Complete Event"/>
					<case value="7" comment="0x07" show="Remote Name Request Complete Event"/>
					<case value="8" comment="0x08" show="Encryption Change Event"/>
					<case value="9" comment="0x09" show="Change Connection Link Key Complete Event"/>
					<case value="10" comment="0x0A" show="Master Link Key Complete Event"/>
					<case value="11" comment="0x0B" show="Read Remote Supported Features Complete Event"/>
					<case value="12" comment="0x0C" show="Read Remote Version Information Complete Event"/>
					<case value="13" comment="0x0D" show="QoS Setup Complete Event"/>
					<case value="14" comment="0x0E" show="Command Complete Event"/>
					<case value="15" comment="0x0F" show="Command Status Event"/>
					<case value="16" comment="0x10" show="Hardware Error Event"/>
					<case value="17" comment="0x11" show="Flush Occurred Event"/>
					<case value="18" comment="0x12" show="Role Change Event"/>
					<case value="19" comment="0x13" show="Number of Completed Packets Event"/>
					<case value="20" comment="0x14" show="Mode Change Event"/>
					<case value="21" comment="0x15" show="Return Link Keys Event"/>
					<case value="22" comment="0x16" show="PIN Code Request Event"/>
					<case value="23" comment="0x17" show="Link Key Request Event"/>
					<case value="24" comment="0x18" show="Link Key Notification Event"/>
					<case value="25" comment="0x19" show="Loopback Command Event"/>
					<case value="26" comment="0x1A" show="Data Buffer Overflow Event"/>
					<case value="27" comment="0x1B" show="Max Slots Change Event"/>
					<case value="28" comment="0x1C" show="Read Clock Offset Complete Event"/>
					<case value="29" comment="0x1D" show="Connection Packet Type Changed Event"/>
					<case value="30" comment="0x1E" show="QoS Violation Event"/>
					<case value="31" comment="0x1F" show="Page Scan Mode Change Event"/>
					<case value="32" comment="0x20" show="Page Scan Repetition Mode Change Event"/>
					<default comment="Default" show="Unknown Event Type"/>
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="hci_event">
				<section name="next"/>
				<text value="Packet Name:"/>
				<protofield name="hci_event_code" showdata="showmap"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="hci_negotiation" longname="HCI Negotiation">
	<format>
		<fields>
			<field type="fixed" name="dummy" longname="Dummy Field" size="1" showtemplate="FieldDec"/>
		</fields>
	</format>
</protocol>

<protocol name="hci_packet_type" longname="Packet Type" showsumtemplate="hci_packet_type">
	<format>
		<fields>
			<field type="fixed" name="bt_packet_type" longname="Packet Type" size="1" showtemplate="hci.bt"/>
		</fields>
	</format>
	
	<encapsulation>
		<switch expr="buf2int(bt_packet_type)">
			<case value="1"> <nextproto proto="#hci_command"/> </case>
			<case value="2"> <nextproto proto="#hci_acl_data"/> </case>
			<case value="3"> <nextproto proto="#hci_sco_data"/> </case>
			<case value="4"> <nextproto proto="#hci_event"/> </case>
			<case value="5"> <nextproto proto="#hci_error_message"/> </case>
			<case value="6"> <nextproto proto="#hci_negotiation"/> </case>
<!-- FULVIO: is it needed this "hci_unknown_type"? Is it not enough to have the NetPDL "default protocol"? -->
			<default comment="Unknown Packet Type"> <nextproto proto="#hci_unknown_type"/> </default>
		</switch>
	</encapsulation>

	<visualization>
		<showtemplate name="hci.bt" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="HCI Command Packet"/>
					<case value="2" show="HCI ACL Data Packet"/>
					<case value="3" show="HCI SCO Data Packet"/>
					<case value="4" show="HCI Event Packet"/>
					<case value="5" show="HCI Error Code"/>
					<case value="6" show="HCI Negotiation Packet"/>
					<default show="Unknown Type Code"/>
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="hci_packet_type">
			<section name="next"/>
			<text value="Packet Type:"/>
			<protofield name="bt_packet_type" showdata="showmap"/>
		</showsumtemplate>
	</visualization>

</protocol>

<protocol name="hci_sco_data" longname="HCI SCO Data">
	<format>
		<fields>
			<field type="fixed" name="sco_connection_handle" longname="Connection Handle" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="sco_data_length" longname="Length of Data" size="1" showtemplate="FieldDec"/>
 			<field type="variable" name="sco_data_payload" longname="Data payload" expr="buf2int(sco_data_length)" showtemplate="Field2BytesHexDash"/>
		</fields>
	</format>
</protocol>
<protocol name="hci_unknown_type" longname="Unknown HCI">
	<format>
		<fields>
			<field type="fixed" name="dummy" longname="Dummy Field" size="1" showtemplate="FieldDec"/>
		</fields>
	</format>
</protocol>
<protocol name="l2cap_command" longname="L2CAP Commands">
	<format>
		<fields>
			<field type="fixed" name="l2cap_length" longname="Length of the Payload" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="l2cap_channel_id" longname="Channel ID" size="2" showtemplate="FieldHex" bigendian="yes"/>

			<switch expr="buf2int(l2cap_channel_id)">
				<case value="1" comment="Signalling Command Packet">	<includeblk name="blk_l2cap_sig_cmd_pkt"/>	</case>
				<case value="2" comment="Connectionless Packet">		<!-- ***************** -->					</case>

				<default comment="Unknown Channel ID">
					<field type="fixed" name="unknown_remove" longname="Error-Channel ID" size="1" showtemplate="FieldDec"/>
				</default>
			</switch>
		</fields>


		<block name="blk_l2cap_sig_cmd_pkt" longname="Signalling Command Packet">
			<field type="fixed" name="l2cap_code" longname="Code" size="1" showtemplate="FieldHex"/>

			<switch expr="buf2int(l2cap_code)">
				<case value="0" comment="RESERVED">						<includeblk name="blk_l2cap_reserved"/>			</case>
				<case value="1" comment="Command Reject">				<includeblk name="blk_command_reject"/>			</case>
				<case value="2" comment="Connection Request">			<includeblk name="blk_connection_request"/>		</case>
				<case value="3" comment="Connection Response">			<includeblk name="blk_connection_response"/>	</case>
				<case value="4" comment="Configure Request">			<includeblk name="blk_configure_request"/>		</case>
				<case value="5" comment="Configure Response">			<includeblk name="blk_configure_response"/>		</case>
				<case value="6" comment="Disconnection Request">		<includeblk name="blk_disconnection_request"/>	</case>
				<case value="7" comment="Disconnection Response">		<includeblk name="blk_disconnection_response"/>	</case>
				<case value="8" comment="Echo Request">					<includeblk name="blk_echo_request"/>			</case>
				<case value="9" comment="Echo Response">				<includeblk name="blk_echo_response"/>			</case>
				<case value="10" comment="Information Request">			<includeblk name="blk_information_request"/>	</case>
				<case value="11" comment="Information Response">		<includeblk name="blk_information_response"/>	</case>
				<default comment="Invalid Command Code">				<includeblk name="blk_invalid_command_code"/>	</default>
			</switch>
		</block>

		<block name="blk_l2cap_reserved" longname="RESERVED">
			<!-- nothing ... -->
		</block>

		<block name="blk_command_reject" longname="Command Reject">
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="length" longname="Payload Length" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="cmd_reject_reason" longname="Command Reject Reason" size="2" showtemplate="hci_event.cmd_reject_reason"/>

			<switch expr="buf2int(cmd_reject_reason)">
				<case value="0" comment="Command Not Understood">
					<!-- No data -->
				</case>

				<case value="256" comment="Signalling MTU Exceeded">
					<field type="fixed" name="max_acceptable_mtu" longname="Data: Maximum Acceptable Signalling MTU" size="2" showtemplate="FieldHex"/>
				</case>

				<case value="512" comment="Invalid CID in request">
					<field type="fixed" name="requested_cid" longname="Local/Remote channel Endpoits" size="4" showtemplate="Field2BytesHexColon"/>
			 		<field type="variable" name="data" longname="Data:(Invalid)" expr="buf2int(length) - 6" showtemplate="Field2BytesHexDash"/>
				</case>

				<default>
			 		<field type="variable" name="data" longname="Data (Invalid Reason)" expr="buf2int(length) - 2" showtemplate="Field2BytesHexDash"/>
				</default>
			</switch>
		</block>

		<block name="blk_connection_request" longname="Connection Request">
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="length" longname="Payload Length" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="psm" longname="Protocol/Service Multiplexor" size="2" showtemplate="hci_event.psm"/>
			<field type="fixed" name="sourec_cid" longname="Source CID" size="2" showtemplate="FieldHex"/>
		</block>

		<block name="blk_connection_response" longname="Connection Response">
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="length" longname="Payload Length" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="destination_cid" longname="Destination CID" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="sourec_cid" longname="Source CID" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="con_res_result" longname="Result" size="2" showtemplate="hci_event.con_res_result"/>
			<field type="fixed" name="con_res_status" longname="Status" size="2" showtemplate="hci_event.con_res_status"/>
		</block>

		<block name="blk_configure_request" longname="Configure Request">
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="length" longname="Payload Length" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="destination_cid" longname="Destination CID" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="flags" longname="Flags" size="2" showtemplate="FieldHex"/>
			<field type="variable" name="conf_options" longname="Configuration Options" expr="buf2int(length) - 4" showtemplate="Field1BytesHex"/>
		</block>

		<block name="blk_configure_response" longname="Configure Response">
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="length" longname="Payload Length" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="destination_cid" longname="Destination CID" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="sourec_cid" longname="Source CID" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="flags" longname="Flags" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="result" longname="Result" size="2" showtemplate="hci_event.result"/>
			<field type="fixed" name="config" longname="Status" size="2" showtemplate="FieldHex"/>
		</block>

		<block name="blk_disconnection_request" longname="Disconnection Request">
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="length" longname="Payload Length" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="destination_cid" longname="Destination CID" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="sourec_cid" longname="Source CID" size="2" showtemplate="FieldHex"/>
		</block>

		<block name="blk_disconnection_response" longname="Disconnection Response">
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="length" longname="Payload Length" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="destination_cid" longname="Destination CID" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="sourec_cid" longname="Source CID" size="2" showtemplate="FieldHex"/>
		</block>

		<block name="blk_echo_request" longname="Echo Request">
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="length" longname="Payload Length" size="2" showtemplate="FieldHex"/>
			<field type="variable" name="data" longname="Data" expr="buf2int(length)" showtemplate="Field1BytesHex"/>
		</block>

		<block name="blk_echo_response" longname="Echo Response">
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="length" longname="Payload Length" size="2" showtemplate="FieldHex"/>
			<field type="variable" name="data" longname="Data" expr="buf2int(length)" showtemplate="Field1BytesHex"/>
		</block>

		<block name="blk_information_request" longname="Information Request">
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="length" longname="Payload Length" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="info_type" longname="Info Type" size="2" showtemplate="hci_event.info_type"/>
		</block>

		<block name="blk_information_response" longname="Information Response">
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="length" longname="Payload Length" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="info_type" longname="Info Type" size="2" showtemplate="hci_event.info_type"/>

<!-- FULVIO: the next field was pointing to a table called "info_res_result_map" which was not present in this file -->
<!-- Therefore, I deleted this reference. -->
			<field type="fixed" name="result" longname="Result" size="2" showtemplate="FieldHex"/>
			<field type="variable" name="data" longname="Data" expr="buf2int(length) - 4" showtemplate="Field1BytesHex"/>
		</block>

		<block name="blk_invalid_command_code" longname="Invalid Command Code">
			<field type="variable" name="invalid_pkt" longname="Invalid L2CAP Packet" expr="buf2int(l2cap_length)" showtemplate="Field1BytesHex"/>
		</block>
	</format>



	<visualization>
		<showtemplate name="hci_event.cmd_reject_reason" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Command Not Understood"/>
					<case value="256" show="Signalling MTU Exceeded"/>
					<case value="512" show="Invalid CID in request"/>
					<default show="Reserved"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="hci_event.psm" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="256" show="Service Discovery Protocol"/>
					<case value="768" show="RFCOMM"/>
					<case value="1280" show="Telephony Control Protocol"/>
					<default show="Reserved"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="hci_event.con_res_result" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Connection Successful"/>
					<case value="256" show="Connection Pending"/>
					<case value="512" show="Connection refused- PSM not supported"/>
					<case value="768" show="Connection refused- Security block"/>
					<case value="1024" show="Connection refused- No resources available"/>
					<default show="Reserved"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="hci_event.con_res_status" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="No further information available"/>
					<case value="256" show="Authentication pending"/>
					<case value="512" show="Authorization pending"/>
					<default show="Reserved"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="hci_event.result" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Success"/>
					<case value="256" show="Failure- Unacceptable Parameters"/>
					<case value="512" show="Failure- Rejected(No reason provided)"/>
					<case value="768" show="Failure- Unknown Options"/>
					<default show="Reserved"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="hci_event.info_type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="256" show="Connectionless MTU"/>
					<default show="Reserved"/>
				</switch>
			</showmap>
		</showtemplate>
	</visualization>

</protocol>
<protocol name="ipx" longname="IPX Internetwork Packet eXchange" showsumtemplate="ipx">
	<!-- We should check that 'checksum' is equal to 'FFFF' -->
	<execute-code>
		<!-- If we're on Ethernet, update the packet length -->
		<after when="$linklayer == 1">
			<assign-variable name="$packetlength" value="$currentoffset + buf2int(len) - 30"/> 	<!-- 30 is the size of the IPX header -->
		</after>
	</execute-code>

	<format>
		<fields>
			<field type="fixed" name="cks" longname="Checksum" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="len" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="tc" longname="Transport Control" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="type" longname="Packet Type" size="1" showtemplate="type"/>
			<field type="fixed" name="netdst" longname="Destination Network" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="noddst" longname="Destination Node" size="6" showtemplate="MACaddressEth"/>
			<field type="fixed" name="skdst" longname="Destination Socket" size="2" showtemplate="socket"/>
			<field type="fixed" name="netsrc" longname="Source Network" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="nodsrc" longname="Source Node" size="6" showtemplate="MACaddressEth"/>
			<field type="fixed" name="sksrc" longname="Source Socket" size="2" showtemplate="FieldHex"/>
		</fields>
	</format>
	
	<encapsulation>
		<switch expr="buf2int(skdst)">
			<case value="0x0452"> <nextproto proto="#ipx_sap"/> </case>
			<case value="0x0453"> <nextproto proto="#ripx"/> </case>
			<case value="0x0455"> <nextproto proto="#netbiosssn"/> </case>
			<case value="0x0451"> <nextproto proto="#ncp"/> </case>
		</switch>

<!--
Please note: it was this before
		<switch expr="buf2int(type)">
			<case value="0x00"> <nextproto proto="#ipx_sap"/> </case>
			<case value="0x01"> <nextproto proto="#ripx"/> </case>
			<case value="0x04"> <nextproto proto="#ipx_sap"/> </case>
			<case value="0x05"> <nextproto proto="#spx"/> </case>
			<case value="0x11"> <nextproto proto="#ncp"/> </case>
		</switch>
-->
	</encapsulation>
	
	<visualization>
		<showtemplate name="socket" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x0247" show="NVT"/>
					<case value="0x0451" show="NCP"/>
					<case value="0x0452" show="SAP"/>
					<case value="0x0453" show="IPX RIP"/>
					<case value="0x0455" show="NetBIOS"/>
					<case value="0x0456" show="Diagnostics"/>
					<case value="0x0457" show="SER"/>
					<case value="0x8063" show="NVT2 Server"/>
					<case value="0x811E" show="Print Server"/>
					<default show="Experimental protocols"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x00" show="Hello or SAP"/>
					<case value="0x01" show="IPX RIP"/>
					<case value="0x02" show="Echo Packet"/>
					<case value="0x03" show="Error Packet"/>
					<case value="0x04" show="SAP"/>
					<case value="0x05" show="SPX"/>
					<case value="0x11" show="NCP"/>
					<case value="0x14" show="NetBios broadcast"/>
					<default show="Experimental protocols"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showsumtemplate name="ipx">
			<section name="next"/>
			<text value="IPX"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="ripx" longname="RIPX" showsumtemplate="ripx">
	<format>
		<fields>
			<field type="fixed" name="oper" longname="Operation" size="2" showtemplate="oper"/>
				<loop type="while" expr="buf2int($packet[$currentoffset:1])!=0">
					<block name="entry" longname="Entry">
						<field type="fixed" name="netno" longname="Network Number" size="4" showtemplate="FieldHex"/>
						<field type="fixed" name="HopCount" longname="Hop Count" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="TickCount" longname="Tick Count" size="2" showtemplate="FieldDec"/>
					</block>	
				</loop>
		</fields>
	</format>
	
	<visualization>
		<showtemplate name="oper" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x01" show="Request"/>
					<case value="0x02" show="Response"/>
					<default show="Unknown operation"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showsumtemplate name="ripx">
			<section name="next"/>
			<text value="RIPX"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="ipx_sap" longname="SAP (Service Advertising Protocol)" showsumtemplate="ipx_sap">
	<format>
		<fields>
			<field type="fixed" name="opr" longname="Operation" size="2" showtemplate="sap.opr"/>
			<field type="fixed" name="srvtype" longname="Server Type" size="2" showtemplate="sap.srvtype"/>
			<field type="fixed" name="srvname" longname="Server Name" size="48" showtemplate="FieldHex"/>
			<field type="fixed" name="netname" longname="Network Address" size="4" showtemplate="MACaddressEth"/>
			<field type="fixed" name="nodeaddr" longname="Node Address" size="6" showtemplate="MACaddressEth"/>
			<field type="fixed" name="skaddr" longname="Socket Address" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="hop2srv" longname="Hops to Server" size="2" showtemplate="FieldHex"/>
		</fields>
	</format>
	
	<visualization>
		<showtemplate name="sap.opr" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x0001" show="General Service Query"/>
					<case value="0x0002" show="General Service Response"/>
					<case value="0x0003" show="Nearest Server Query"/>
					<case value="0x0004" show="Nearest Server Response"/>
					<default show="Unknown"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="sap.srvtype" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x0000" show="Unknown"/>
					<case value="0x0001" show="User"/>
					<case value="0x0002" show="User Group"/>
					<case value="0x0003" show="Print Queue or Print Group"/>
					<case value="0x0004" show="File Server (SLIST source)"/>
					<case value="0x0005" show="Job Server"/>
					<case value="0x0006" show="Gateway"/>
					<case value="0x0007" show="Print Server or Silent Print Server"/>
					<case value="0x0008" show="Archive Queue"/>
					<case value="0x0009" show="Archive Server"/>
					<case value="0x000a" show="Job Queue"/>
					<case value="0x000b" show="Administration"/>
					<case value="0x000F" show="Novell TI-RPC"/>
					<case value="0x0017" show="Diagnostics"/>
					<case value="0x0020" show="NetBIOS"/>
					<case value="0x0021" show="NAS SNA Gateway"/>
					<case value="0x0023" show="NACS Async Gateway or Asynchronous Gateway"/>
					<case value="0x0024" show="Remote Bridge or Routing Service"/>
					<case value="0x0026" show="Bridge Server or Asynchronous Bridge Server"/>
					<case value="0x0027" show="TCP/IP Gateway Server"/>
					<case value="0x0028" show="Point to Point (Eicon) X.25 Bridge Server"/>
					<case value="0x0029" show="Eicon 3270 Gateway"/>
					<case value="0x002a" show="CHI Corp ???"/>
					<case value="0x002c" show="PC Chalkboard"/>
					<case value="0x002d" show="Time Synchronization Server or Asynchronous Timer"/>
					<case value="0x002e" show="ARCserve 5.0"/>
					<case value="0x0045" show="DI3270 Gateway"/>
					<case value="0x0047" show="Advertising Print Server"/>
					<case value="0x004a" show="NetBlazer Modems"/>
					<case value="0x004b" show="Btrieve VAP/NLM 5.0"/>
					<case value="0x004c" show="Netware SQL VAP/NLM Server"/>
					<case value="0x004d" show="Xtree Network Version Netware XTree"/>
					<case value="0x0050" show="Btrieve VAP 4.11"/>
					<case value="0x0052" show="QuickLink (Cubix)"/>
					<case value="0x0053" show="Print Queue User"/>
					<case value="0x0058" show="Multipoint X.25 Eicon Router"/>
					<case value="0x0060" show="STLB/NLM ???"/>
					<case value="0x0064" show="ARCserve"/>
					<case value="0x0066" show="ARCserve 3.0"/>
					<case value="0x0072" show="WAN Copy Utility"/>
					<case value="0x007a" show="TES-Netware for VMS"/>
					<case value="0x0092" show="WATCOM Debugger or Emerald Tape Backup Server"/>
					<case value="0x0095" show="DDA OBGYN ???"/>
					<case value="0x0098" show="Netware Access Server (Asynchronous gateway)"/>
					<case value="0x009a" show="Netware for VMS II or Named Pipe Server"/>
					<case value="0x009b" show="Netware Access Server"/>
					<case value="0x009e" show="Portable Netware Server or SunLink NVT"/>
					<case value="0x00a1" show="Powerchute APC UPS NLM"/>
					<case value="0x00aa" show="LAWserve ???"/>
					<case value="0x00ac" show="Compaq IDA Status Monitor"/>
					<case value="0x0100" show="PIPE STAIL ???"/>
					<case value="0x0102" show="LAN Protect Bindery"/>
					<case value="0x0103" show="Oracle DataBase Server"/>
					<case value="0x0107" show="Netware 386 or RSPX Remote Console"/>
					<case value="0x010f" show="Novell SNA Gateway"/>
					<case value="0x0111" show="Test Server"/>
					<case value="0x0112" show="Print Server (HP)"/>
					<case value="0x0114" show="CSA MUX (f/Communications Executive)"/>
					<case value="0x0115" show="CSA LCA (f/Communications Executive)"/>
					<case value="0x0116" show="CSA CM  (f/Communications Executive)"/>
					<case value="0x0117" show="CSA SMA (f/Communications Executive)"/>
					<case value="0x0118" show="CSA DBA (f/Communications Executive)"/>
					<case value="0x0119" show="CSA NMA (f/Communications Executive)"/>
					<case value="0x011a" show="CSA SSA (f/Communications Executive)"/>
					<case value="0x011b" show="CSA STATUS (f/Communications Executive)"/>
					<case value="0x011e" show="CSA APPC   (f/Communications Executive)"/>
					<case value="0x0126" show="SNA TEST SSA Profile"/>
					<case value="0x012a" show="CSA TRACE  (f/Communications Executive)"/>
					<case value="0x012b" show="Netware for SAA"/>
					<case value="0x012e" show="IKARUS virus scan utility"/>
					<case value="0x0130" show="Communications Executive"/>
					<case value="0x0133" show="NNS Domain Server or Netware Naming Services Domain"/>
					<case value="0x0135" show="Netware Naming Services Profile"/>
					<case value="0x0137" show="Netware 386 Print Queue or NNS Print Queue"/>
					<case value="0x0141" show="LAN Spool Server (Vap, Intel)"/>
					<case value="0x0152" show="IRMALAN Gateway"/>
					<case value="0x0154" show="Named Pipe Server"/>
					<case value="0x0166" show="NetWare Management"/>
					<case value="0x0168" show="Intel PICKIT Comm Server or Intel CAS Talk Server"/>
					<case value="0x0171" show="UNKNOWN???"/>
					<case value="0x0173" show="Compaq"/>
					<case value="0x0174" show="Compaq SNMP Agent"/>
					<case value="0x0175" show="Compaq"/>
					<case value="0x0180" show="XTree Server or XTree Tools"/>
					<case value="0x018A" show="UNKNOWN???	Running on a Novell Server"/>
					<case value="0x01b0" show="GARP Gateway (net research)"/>
					<case value="0x01b1" show="Binfview (Lan Support Group)"/>
					<case value="0x01bc" show="Microsoft NT SNA Server"/>
					<case value="0x01bf" show="Intel LanDesk Manager"/>
					<case value="0x01ca" show="AXTEC ???"/>
					<case value="0x01cb" show="Shiva NetModem/E"/>
					<case value="0x01cc" show="Shiva LanRover/E"/>
					<case value="0x01cd" show="Shiva LanRover/T"/>
					<case value="0x01d8" show="Castelle FAXPress Server"/>
					<case value="0x01da" show="Castelle LANPress Print Server"/>
					<case value="0x01dc" show="Castille FAX/Xerox 7033 Fax Server/Excel Lan Fax"/>
					<case value="0x01f0" show="LEGATO ???"/>
					<case value="0x01f5" show="LEGATO ???"/>
					<case value="0x0233" show="NMS Agent or Netware Management Agent"/>
					<case value="0x0237" show="NMS IPX Discovery or LANtern Read/Write Channel"/>
					<case value="0x0238" show="NMS IP Discovery or LANtern Trap/Alarm Channel"/>
					<case value="0x023a" show="LABtern"/>
					<case value="0x023c" show="MAVERICK ???"/>
					<case value="0x023E" show="UNKNOWN???      Running on a Novell Server"/>
					<case value="0x023f" show="Used by eleven various Novell Servers"/>
					<case value="0x024e" show="Netware Connect"/>
					<case value="0x026a" show="Network Management (NMS) Service Console"/>
					<case value="0x026b" show="Time Synchronization Server (Netware 4.x)"/>
					<case value="0x0278" show="Directory Server (Netware 4.x)"/>
					<case value="0x03dd" show="Banyan ENS for Netware Client NLM"/>
					<case value="0x0304" show="Novell SAA Gateway"/>
					<case value="0x0308" show="COM or VERMED 1 ???"/>
					<case value="0x030a" show="Galacticomm's Worldgroup Server"/>
					<case value="0x030c" show="Intel Netport 2 or HP JetDirect or HP Quicksilver"/>
					<case value="0x0320" show="Attachmate Gateway"/>
					<case value="0x0327" show="Microsoft Diagnostiocs ???"/>
					<case value="0x0328" show="WATCOM SQL server"/>
					<case value="0x0335" show="MultiTech Systems Multisynch Comm Server"/>
					<case value="0x0355" show="Arcada Backup Exec"/>
					<case value="0x0358" show="MSLCD1 ???"/>
					<case value="0x0361" show="NETINELO ???"/>
					<case value="0x037e" show="Twelve Novell file servers in the PC3M family"/>
					<case value="0x037f" show="ViruSafe Notify"/>
					<case value="0x0386" show="HP Bridge"/>
					<case value="0x0387" show="HP Hub"/>
					<case value="0x0394" show="NetWare SAA Gateway"/>
					<case value="0x039b" show="Lotus Notes"/>
					<case value="0x03b7" show="Certus Anti Virus NLM"/>
					<case value="0x03c4" show="ARCserve 4.0 (Cheyenne)"/>
					<case value="0x03c7" show="LANspool 3.5 (Intel)"/>
					<case value="0x03d7" show="lexmark printer server (type 4033-011)"/>
					<case value="0x03d8" show="lexmark XLE printer server (type 4033-301)"/>
					<case value="0x03de" show="Gupta Sequel Base Server or NetWare SQL"/>
					<case value="0x03e1" show="Univel Unixware"/>
					<case value="0x03e4" show="Univel Unixware"/>
					<case value="0x03fc" show="Intel Netport"/>
					<case value="0x03fd" show="Print SErver Queue ???"/>
					<case value="0x04ac" show="On-Time Scheduler NLM"/>
					<case value="0x040A" show="ipnServer???      Running on a Novell Server"/>
					<case value="0x040B" show="UNKNOWN???"/>
					<case value="0x040D" show="LVERRMAN???	Running on a Novell Server"/>
					<case value="0x040E" show="LVLIC???	Running on a Novell Server"/>
					<case value="0x0410" show="UNKNOWN???	Running on a Novell Server"/>
					<case value="0x0414" show="Kyocera"/>
					<case value="0x0429" show="Site Lock Virus (Brightworks)"/>
					<case value="0x0432" show="UFHELP R ???"/>
					<case value="0x0433" show="Synoptics 281x Advanced SNMP Agent"/>
					<case value="0x0448" show="Oracle"/>
					<case value="0x044c" show="ARCserve 5.01"/>
					<case value="0x0457" show="Canon GP55???	Running on a Canon GP55 network printer"/>
					<case value="0x045a" show="QMS Printers"/>
					<case value="0x045b" show="Dell SCSI Array (DSA) Monitor"/>
					<case value="0x0491" show="NetBlazer Modems"/>
					<case value="0x04b0" show="CD-Net (Meridian)"/>
					<case value="0x04C1" show="UNKNOWN???	"/>
					<case value="0x0513" show="Emulux NQA???	Something from Emulex"/>
					<case value="0x0520" show="Site Lock Checks"/>
					<case value="0x0529" show="Site Lock Checks (Brightworks)"/>
					<case value="0x052d" show="Citrix OS/2 App Server"/>
					<case value="0x0535" show="Tektronix"/>
					<case value="0x0536" show="Milan ???"/>
					<case value="0x056b" show="IBM 8235 modem server"/>
					<case value="0x056c" show="Shiva LanRover/E PLUS"/>
					<case value="0x056d" show="Shiva LanRover/T PLUS"/>
					<case value="0x0580" show="McAfee's NetShield anti-virus"/>
					<case value="0x05BA" show="Compatible Systems Routers"/>
					<case value="0x0621" show="IBM AntiVirus NLM"/>
					<case value="0x0623" show="UNKNOWN???      Running on a Novell Server"/>
					<case value="0x076C" show="Xerox"/>
					<case value="0x079b" show="Shiva LanRover/E 115"/>
					<case value="0x079c" show="Shiva LanRover/T 115"/>
					<case value="0x0b29" show="Site Lock"/>
					<case value="0x0c29" show="Site Lock Applications"/>
					<case value="0x0c2c" show="Licensing Server"/>
					<case value="0x2380" show="LAI Site Lock"/>
					<case value="0x238c" show="Meeting Maker"/>
					<case value="0x4808" show="Site Lock Server or Site Lock Metering VAP/NLM"/>
					<case value="0x5555" show="Site Lock User"/>
					<case value="0x6312" show="Tapeware"/>
					<case value="0x6f00" show="Rabbit Gateway (3270)"/>
					<case value="0x7703" show="?? MODEM"/>
					<case value="0x8002" show="NetPort Printers (Intel) or LANport"/>
					<case value="0x8008" show="WordPerfect Network Version"/>
					<case value="0x85BE" show="Cisco Enhanced Interior Routing Protocol (EIGRP)"/>
					<case value="0x8888" show="WordPerfect Network Version or Quick Network Management"/>
					<case value="0x9000" show="McAfee's NetShield anti-virus"/>
					<case value="0x9604" show="?? CSA-NT_MON"/>
					<case value="0xb6a8" show="Ocean Isle Reachout Remote Control"/>
					<case value="0xf11f" show="Site Lock Metering VAP/NLM"/>
					<case value="0xf1ff" show="Site Lock"/>
					<case value="0xF503" show="?? SCA-NT"/>
					<case value="0xfbfb" show="TopCall III fax server"/>
					<case value="0xffff" show="Any Service or Wildcard"/>
					<default show="Unknown"/>
				</switch>
			</showmap>
		</showtemplate>
	
		<showsumtemplate name="ipx_sap">
			<section name="next"/>
			<text value="SAP"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="ncp" longname="Netware Core Protocol" showsumtemplate="ncp">
	<format>
		<fields>
			<field type="fixed" name="reqtype" longname="Request Type" size="2" showtemplate="reqtype"/>
			<field type="fixed" name="seqnum" longname="Sequence Number" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="connumlow" longname="Connection Number Low" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="tasknum" longname="Task Number" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="connumhi" longname="Connection Number High" size="1" showtemplate="FieldHex"/>
			<if expr="buf2int(reqtype) == 0x3333 or buf2int(reqtype) == 0x7777 or buf2int(reqtype) == 0x9999">
				<if-true>
					<field type="fixed" name="complcode" longname="Completion Code" size="1" showtemplate="FieldHex"/>
					<field type="fixed" name="constat" longname="Connection Status" size="1" showtemplate="FieldHex"/>
				</if-true>
			</if>
		</fields>
	</format>
	
	<visualization>
		<showtemplate name="reqtype" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x1111" show="Create Connection"/>
					<case value="0x2222" show="NCP request"/>
					<case value="0x3333" show="NCP reply"/>
					<case value="0x5555" show="Destroy Connection"/>
					<case value="0x7777" show="Burst Mode Packet"/>
					<case value="0x9999" show="Server Busy Packet"/>
					<default show="Unknown"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showsumtemplate name="ncp">
			<section name="next"/>
			<text value="NCP"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="bootp" longname="Boot Protocol" showsumtemplate="bootp">
	<format>
		<fields>
			<field type="fixed" name="code" longname="Code" size="1" showtemplate="dhcp.code"/>
			<field type="fixed" name="htype" longname="Hardware address type" description="Hardware address type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="hlen" longname="Hardware address length" description="Hardware address length (e.g. '6' for 10mb ethernet)" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="hops" longname="hops" description="Client sets to zero, optionally used by relay agents when booting via a relay agent" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="xid" longname="Transation ID" description="a random number chosen by the client, used by the client and server to associate messages and responses between a client and a server" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="secs" longname="Second elapsed" description="Filled in by client, seconds elapsed since client began address acquisition or renewal process" size="2" showtemplate="FieldDec"/>
			<block name="flags" longname="Flags" description="Flags">
				<field type="bit" name="MBZ" longname="Must be zero" description="MUST BE ZERO (reserved for future use)" mask="0xFFFE" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="B" longname="Broadcast flag" description="Broadcast flag" mask="0x0001" size="2" showtemplate="FieldBin"/>
			</block>
			<field type="fixed" name="ciaddr" longname="Client IP address" description="Client IP address; only filled in if client is in BOUND, RENEW or REBINDING state and can respond to ARP requests" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="yiaddr" longname="Your IP Address" description="'your' (client) IP address" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="siaddr" longname="IP of next server to use in bootstrap" description="IP address of next server to use in bootstrap; returned in DHCPOFFER, DHCPACK by server" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="giaddr" longname="Relay agent IP address" description="Relay agent IP address, used in booting via a relay agent." size="4" showtemplate="ip4addr-noplg"/>

			<field type="variable" name="chaddr" longname="Client hardware address" description="Client hardware address" expr="buf2int(hlen)" showtemplate="MAC-colon"/>
			<field type="variable" name="chaddr_realign" longname="Client hardware address realign" expr="16 - buf2int(hlen)" showtemplate="Field4BytesHex"/>

			<field type="fixed" name="sname" longname="Server host name" description="Optional server host name, null terminated string" size="64" showtemplate="FieldAscii"/>
			<field type="fixed" name="file" longname="Boot file name" description="Boot file name, null terminated string; 'generic' name or null in DHCPDISCOVER, fully qualified directory-path name in DHCPOFFER" size="128" showtemplate="FieldAscii"/>

			<field type="fixed" name="magic" longname="Vendor Magic Cookie (often 0x63825363)" size="4" showtemplate="FieldHex" description="This field defines how has to be interpreted next section; the value 0x63825363 ahs been standardized as 'vendor independent' and it is the mostly used value."/>

			<field type="variable" name="vendor" longname="Vendor" description="Length must be 60 bytes" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="bootp">
			<section name="next"/>
			<text value="BOOTP "/>
			<protofield name="code" showdata="showmap"/>
			<text value=": Transaction ID "/>
			<protofield name="xid" showdata="showvalue"/>
		</showsumtemplate>
	</visualization>

</protocol>
<protocol name="dhcp" longname="Dynamic Host Configuration Protocol" showsumtemplate="dhcp">
	<format>
		<fields>
			<field type="fixed" name="code" longname="Code" size="1" showtemplate="dhcp.code"/>
			<field type="fixed" name="htype" longname="Hardware address type" description="Hardware address type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="hlen" longname="Hardware address length" description="Hardware address length (e.g. '6' for 10mb ethernet)" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="hops" longname="Hops" description="Client sets to zero, optionally used by relay agents when booting via a relay agent" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="xid" longname="Transation ID" description="a random number chosen by the client, used by the client and server to associate messages and responses between a client and a server" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="secs" longname="Second elapsed" description="Filled in by client, seconds elapsed since client began address acquisition or renewal process" size="2" showtemplate="FieldDec"/>
			<block name="flags" longname="Flags" description="Flags">
				<field type="bit" name="MBZ" longname="Must be zero" description="MUST BE ZERO (reserved for future use)" mask="0xFFFE" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="B" longname="Broadcast flag" description="Broadcast flag" mask="0x0001" size="2" showtemplate="FieldBin"/>
			</block>
			<field type="fixed" name="ciaddr" longname="Client IP address" description="Client IP address; only filled in if client is in BOUND, RENEW or REBINDING state and can respond to ARP requests" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="yiaddr" longname="Your IP Address" description="'your' (client) IP address" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="siaddr" longname="IP of next server to use in bootstrap" description="IP address of next server to use in bootstrap; returned in DHCPOFFER, DHCPACK by server" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="giaddr" longname="Relay agent IP address" description="Relay agent IP address, used in booting via a relay agent" size="4" showtemplate="ip4addr-noplg"/>
			<field type="variable" name="chaddr" longname="Client hardware address" description="Client hardware address" expr="buf2int(hlen)" showtemplate="MAC-colon" comment="The sum of the size of this field and the next one MUST be 16 bytes"/>
			<field type="variable" name="chaddr_realign" longname="Client hardware address realign" expr=" 16 - buf2int(hlen)" showtemplate="Field4BytesHex" comment="The sum of the size of this field and the previous one MUST be 16 bytes"/>
			<field type="fixed" name="sname" longname="Server host name" description="Optional server host name, null terminated string" size="64" showtemplate="FieldAscii"/>
			<field type="fixed" name="file" longname="Boot file name" description="Boot file name, null terminated string; 'generic' name or null in DHCPDISCOVER, fully qualified directory-path name in DHCPOFFER" size="128" showtemplate="FieldAscii"/>

			<field type="fixed" name="magic" longname="DHCP magic cookie (OK)" size="4" showtemplate="FieldHex"/>

			<loop type="while" expr="1">
				<!-- Loop until we find a 'break' -->

				<switch expr="buf2int($packet[$currentoffset:1])">
					<case value="0"> <includeblk name="pad_option"/>									</case>
					<case value="1"> <includeblk name="subnet_option"/>									</case>
					<case value="2"> <includeblk name="time_option"/>									</case>
					<case value="3"> <includeblk name="router_option"/>									</case>
					<case value="4"> <includeblk name="time_server_option"/>							</case>
					<case value="5"> <includeblk name="name_server_option"/>							</case>
					<case value="6"> <includeblk name="domain_name_server_option"/>						</case>
					<case value="7"> <includeblk name="log_server_option"/>								</case>
					<case value="8"> <includeblk name="cookie_server_option"/>							</case>
					<case value="9"> <includeblk name="lpr_server_option"/>								</case>
					<case value="10"> <includeblk name="impress_server_option"/>						</case>
					<case value="11"> <includeblk name="resource_location_server_option"/>				</case>
					<case value="12"> <includeblk name="host_name_option"/>								</case>
					<case value="13"> <includeblk name="boot_file_size_option"/>						</case>
					<case value="14"> <includeblk name="merit_dump_file_option"/>						</case>
					<case value="15"> <includeblk name="domain_name_option"/>							</case>
					<case value="16"> <includeblk name="swap_server_option"/>							</case>
					<case value="17"> <includeblk name="root_path_option"/>								</case>
					<case value="18"> <includeblk name="extensions_path_option"/>						</case>
					<case value="19"> <includeblk name="ip_forwading_option"/>							</case>
					<case value="20"> <includeblk name="non_local_source_routing_option"/>				</case>
					<case value="21"> <includeblk name="policy_filter_option"/>							</case>
					<case value="22"> <includeblk name="maximum_datagram_reassembly_size_option"/>		</case>
					<case value="23"> <includeblk name="default_ip_ttl_option"/>						</case>
					<case value="24"> <includeblk name="path_mtu_aging_timeout_option"/>		 		</case>
					<case value="25"> <includeblk name="path_mtu_plateau_table_option"/>				</case>
					<case value="26"> <includeblk name="interface_mtu_option"/>							</case>
					<case value="27"> <includeblk name="all_subnets_are_local_option"/>					</case>
					<case value="28"> <includeblk name="broadcast_address_option"/>						</case>
					<case value="29"> <includeblk name="perform_mask_discovery_option"/>				</case>
					<case value="30"> <includeblk name="mask_supplier_option"/>							</case>
					<case value="31"> <includeblk name="perform_router_discovery_option"/> 				</case>
					<case value="32"> <includeblk name="router_solicitation_address_option"/>			</case>
					<case value="33"> <includeblk name="static_route_option"/>							</case>
					<case value="34"> <includeblk name="trailer_encapsulation_option"/>					</case>
					<case value="35"> <includeblk name="arp_cache_timeout_option"/>						</case>
					<case value="36"> <includeblk name="ethernet_encapsulation_option"/>				</case>
					<case value="37"> <includeblk name="tcp_default_ttl_option"/> 						</case>
					<case value="38"> <includeblk name="tcp_keepalive_interval_option"/>				</case>
					<case value="39"> <includeblk name="tcp_keepalive_garbage_option"/>					</case>
					<case value="40"> <includeblk name="network_information_service_domain_option"/>	</case>
					<case value="41"> <includeblk name="network_information_servers_option"/>			</case>
					<case value="42"> <includeblk name="network_time_protocol_servers_option"/>			</case>
					<case value="43"> <includeblk name="vendor_specific_information_option"/>			</case>
					<case value="44"> <includeblk name="netbios_ns_option"/>							</case>
					<case value="45"> <includeblk name="netbios_dds_option"/>							</case>
					<case value="46"> <includeblk name="netbios_node_type_option"/>						</case>
					<case value="47"> <includeblk name="netbios_scope_option"/>							</case>
					<case value="48"> <includeblk name="xwindows_system_font_server_option"/>			</case>
					<case value="49"> <includeblk name="x_window_system_display_manager_option"/>		</case>
					<case value="50"> <includeblk name="requested_ip_address_option"/> 					</case>
					<case value="51"> <includeblk name="ip_address_lease_time_option"/> 				</case>
					<case value="52"> <includeblk name="overload_option"/>								</case>
					<case value="53"> <includeblk name="dhcp_message_type_option"/>						</case>
					<case value="54"> <includeblk name="server_identifier_option"/>						</case>
					<case value="55"> <includeblk name="parameter_request_list_option"/>				</case>
					<case value="56"> <includeblk name="message_option"/>								</case>
					<case value="57"> <includeblk name="maximum_dhcp_message_size_option"/>				</case>
					<case value="58"> <includeblk name="renewal_time_value_option"/>					</case>
					<case value="59"> <includeblk name="rebinding_time_value_option"/>					</case>
					<case value="60"> <includeblk name="vendor_class_identifier_option"/>				</case>
					<case value="61"> <includeblk name="client_identifier_option"/>						</case>
					<case value="62"> <includeblk name="netware_ip_domain_name_option"/>				</case>
					<case value="63"> <includeblk name="the_netware_ip_information_option"/>			</case>
					<case value="64"> <includeblk name="network_information_service_domain_option"/>	</case>
					<case value="65"> <includeblk name="network_information_serivice_servers_option"/>	</case>
					<case value="66"> <includeblk name="tftp_server_name_option"/>						</case>
					<case value="67"> <includeblk name="bootfile_name_option"/>							</case>
					<case value="68"> <includeblk name="mobile_ip_home_agent_option"/>					</case>
					<case value="69"> <includeblk name="smtp_server_option"/>							</case>
					<case value="70"> <includeblk name="pop3_server_option"/>							</case>
					<case value="71"> <includeblk name="nntp_server_option"/>							</case>
					<case value="72"> <includeblk name="default_www_server_option"/>					</case>
					<case value="73"> <includeblk name="default_finger_server_option"/>					</case>
					<case value="74"> <includeblk name="default_irc_server_option"/>					</case>
					<case value="75"> <includeblk name="streettalk_server_option"/>						</case>
					<case value="76"> <includeblk name="stda_server_option"/>							</case>
					<case value="77"> <includeblk name="user_class_option"/>							</case>
					<case value="78"> <includeblk name="slp_directory_agent_option"/>					</case>
					<case value="79"> <includeblk name="slp_service_scope_option"/>						</case>
					<case value="80"> <includeblk name="naming_authority_extension_option"/>			</case>
					<case value="81"> <includeblk name="client_fqdn_option"/>							</case>
					<case value="82"> <includeblk name="relay_agent_information_option"/>				</case>
					<case value="83"> <includeblk name="agent_remote_id_option"/>						</case>
					<case value="85"> <includeblk name="nds_server_option"/>							</case>
					<case value="86"> <includeblk name="nds_tree_name_option"/>							</case>
					<case value="88"> <includeblk name="ieee_1003_1_posix_timezone_specifier_option"/>	</case>
					<case value="90"> <includeblk name="authentication_option"/>						</case>
					<case value="98"> <includeblk name="user_authentication_protocol_option"/>			</case>
					<case value="116"> <includeblk name="auto_configure_option"/>						</case>
					<case value="117"> <includeblk name="name_service_search_option"/>					</case>
					<case value="118"> <includeblk name="subnet_selection_option"/>						</case>
					<case value="120"> <includeblk name="sip_server_dhcp_option"/>						</case>
					<case value="126"> <includeblk name="extension_option"/>							</case>
					<case value="127"> <includeblk name="extension_option"/>							</case>

					<case value="128" maxvalue="254">
						<!-- Options from 128 to 254 are for private use -->
						<includeblk name="private_use_option"/>
					</case>

					<case value="255">
						<includeblk name="end_option"/>
						<loopctrl type="break"/>
					</case>

					<default>
						<includeblk name="unsupported_option"/>
					</default>
				</switch>
			</loop>

			<field type="variable" name="padding" longname="Padding" description="Padding must be a sequence of 0" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
		</fields>


		<block name="unsupported_option" longname="Unsupported Option" description="Unsupported">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="value" longname="Value" expr="buf2int(len)" showtemplate="Field4BytesHex"/>
		</block>

		<block name="extension_option" longname="Extension Option" description="Extension">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="value" longname="Value" expr="buf2int(len)" showtemplate="Field4BytesHex"/>
		</block>

		<block name="pad_option" longname="Pad" description="Pad to align">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="end_option" longname="End of vendor field" description="The end option marks the end of valid information in the vendor field">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="subnet_option" longname="Subnet mask option" description="The subnet mask option specifies the client's subnet mask as per RFC 950">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length of Subnetmask" description="Must be 4. see rfc2132" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="netmask" longname="Subnet Mask" size="4" showtemplate="ip4addr-noplg"/>
		</block>

		<block name="time_option" longname="Time offset option" description="The subnet mask option specifies the client's subnet mask as per RFC 950">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length of time" description="Must be 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="toffset" longname="Time Offset" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="router_option" longname="Router Option" description="The router option specifies a list of IP addresses for routers on the client's subnet. Routers SHOULD be listed in order of preference">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Number of address * 4" description="Must be a multiple of 4" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="time_server_option" longname="Time Server Option" description="The time server option specifies a list of RFC 868 time servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Number of address * 4" description="Must be a multiple of 4" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="name_server_option" longname="Name Server Option" description="The name server option specifies a list of IEN 116 name servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length of Subnetmask" description="Must be 4. see rfc2132" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="domain_name_server_option" longname="Domain Name Server Option" description="The domain name server option specifies a list of Domain Name System (STD 13, RFC 1035) name servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Number of address * 4" description="Must be a multiple of 4" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="log_server_option" longname="Log Server Option" description="The log server option specifies a list of MIT-LCS UDP log servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Number of address * 4" description="Must be a multiple of 4" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="cookie_server_option" longname="Cookie Server Option" description="The cookie server option specifies a list of RFC 865 cookie servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Number of address * 4" description="Must be a multiple of 4" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="lpr_server_option" longname="LPR Server Option" description="The LPR server option specifies a list of RFC 1179 line printer servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Number of address * 4" description="Must be a multiple of 4" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="impress_server_option" longname="Impress Server Option" description="The Impress server option specifies a list of Imagen Impress servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Number of address * 4" description="Must be a multiple of 4" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="resource_location_server_option" longname="Resource Location Server Option" description="This option specifies a list of RFC 887 Resource Location servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Number of address * 4" description="Must be a multiple of 4" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="host_name_option" longname="Host Name Option" description="This option specifies the name of the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum lengthh is 1" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="hname" longname="Host Name" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="boot_file_size_option" longname="Boot File Size Option" description="This option specifies the length in 512-octet blocks of the default boot image for the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length " description="Must be 2" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="filesize" longname="File Size" description="Length in 512-octect blocks" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="merit_dump_file_option" longname="Merit Dump File Option" description="This option specifies the path-name of a file to which the client's core image should be dumped in the event the client crashes">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="String Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="dump" longname="Dump File Pathname" description="The path is formatted as a character string consisting of characters from the NVT ASCII character set" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="domain_name_option" longname="Domain Name Option" description="This option specifies the domain name that client should use when resolving hostnames via the Domain Name System">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="String Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="domain" longname="Domain Name" description="Domain Name" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>


		<block name="swap_server_option" longname="Swap Server Option" description="This specifies the IP address of the client's swap server">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="String Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="address" longname="Swap Server Address" description="IP address of the client's swap server" size="4" showtemplate="ip4addr-noplg"/>
		</block>

		<block name="root_path_option" longname="Root Path Option" description="This option specifies the path-name that contains the client's root disk">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="String Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="pathname" longname="Root Disk Pathname" description="The path is formatted as a character string consisting of characters from the NVT ASCII character set" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="extensions_path_option" longname="Extension Path Option" description="A string to specify a file, retrievable via TFTP">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="String Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="pathname" longname="Extensions Pathname" description="see rfc 2132 3.20" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="ip_forwading_option" longname="IP Forwading Enable/Disable Option" description="This option specifies whether the client should configure its IP layer for packet forwarding">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="String Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="value" longname="Value" description="A value of 0 means disable IP forwarding, and a value of 1 means enable IP forwarding" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="non_local_source_routing_option" longname="Non-Local Source Routing Enable/Disable Option" description="This option specifies whether the client should configure its IP layer to allow forwarding of datagrams with non-local source routes">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="String Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="value" longname="Value" description="A value of 0 means disallow forwarding of such datagrams, and a value of 1 means allow forwarding" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="policy_filter_option" longname="Policy Filter Option" description="This option specifies policy filters for non-local source routing">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Number of address * 8" description="Must be a multiple of 8" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 8">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
					<field type="fixed" name="mask" longname="Mask" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="maximum_datagram_reassembly_size_option" longname="Maximum Datagram Reassembly Size Option" description="This option specifies the maximum size datagram that the client should be prepared to reassemble">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 2" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="size" longname="Size" description="The size is specified as a 16-bit unsigned integer. The minimum value legal value is 576" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="default_ip_ttl_option" longname="Default IP Time-to-live Option" description="This option specifies the default time-to-live that the client should use on outgoing datagrams">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="ttl" longname="Time-to-live" description="The TTL is specified as an octet with a value between 1 and 255" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="path_mtu_aging_timeout_option" longname="Path MTU Aging Timeout Option" description="This option specifies the timeout (in seconds) to use when aging Path MTU values discovered by the mechanism defined in RFC 1191">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="ttl" longname="Time-to-live" description="The timeout is specified as a 32-bit unsigned integer" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="path_mtu_plateau_table_option" longname="Path MTU Plateau Table Option" description="This option specifies a table of MTU sizes to use when performing Path MTU Discovery as defined in RFC 1191">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="MUST be a multiple of 2" size="1" showtemplate="FieldDec"/>

			<!-- Are we sure that the 'address list' contains a list of 'size'? -->
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 2">
					<field type="fixed" name="size" longname="Size" size="2" showtemplate="FieldDec"/>
				</loop>
			</block>
		</block>

		<block name="interface_mtu_option" longname="Interface MTU Option" description="This option specifies the MTU to use on this interface">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 2" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="mtu" longname="MTU" description="The minimum legal value for the MTU is 68" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="all_subnets_are_local_option" longname="All Subnets are Local Option" description="This option specifies whether or not the client may assume that all subnets of the IP network to which the client is connected use the same MTU as the subnet of that network to which the client is directly connected">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="value" longname="Value" description="A value of 1 indicates that all subnets share the same MTU. A value of 0 means that the client should assume that some subnets of the directly connected network may have smaller MTUs" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="broadcast_address_option" longname="Broadcast Adress Option" description="This option specifies the broadcast address in use on the client's subnet">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="baddr" longname="Broadcast Address" size="4" showtemplate="ip4addr-noplg"/>
		</block>

		<block name="perform_mask_discovery_option" longname="Perform Masck Discovery Option" description="This option specifies whether or not the client should perform subnet mask discovery using ICMP">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="value" longname="Value" description="A value of 0 indicates that the client should not perform mask discovery. A value of 1 means that the client should perform mask discovery" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="mask_supplier_option" longname="Mask Supplier Option" description="This option specifies whether or not the client should respond to subnet mask requests using ICMP">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="value" longname="Value" description="A value of 0 indicates that the client should not respond. A value of 1 means that the client should respond" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="perform_router_discovery_option" longname="Perform Router Discovery Option" description="This option specifies whether or not the client should solicit routers using the Router Discovery mechanism defined in RFC 1256">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="value" longname="Value" description="A value of 0 indicates that the client should not perform router discovery. A value of 1 means that the client should perform router discovery" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="router_solicitation_address_option" longname="Router Solicitation Address Option" description="This option specifies the address to which the client should transmit router solicitation requests">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="addr" longname="Address" description="Address" size="4" showtemplate="ip4addr-noplg"/>
		</block>

		<block name="static_route_option" longname="Static Route Option" description="This option specifies a list of static routes that the client should install in its routing cache">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be a multiple of 8" size="1" showtemplate="FieldDec"/>
			<block name="destinations" longname="Destination List">
				<loop type="times2repeat" expr="buf2int(len) div 8">
					<field type="fixed" name="destination" longname="Destination Address" size="4" showtemplate="ip4addr-noplg"/>
					<field type="fixed" name="router" longname="Router Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="trailer_encapsulation_option" longname="Trailer Encapsulation Option" description="This option specifies whether or not the client should negotiate the use of trailers (RFC 893) when using the ARP protocol">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="value" longname="Value" description="A value of 0 indicates that the client should not attempt to use trailers. A value of 1 means that the client should attempt to use trailers" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="arp_cache_timeout_option" longname="ARP Cache Timeout Option" description="This option specifies the timeout in seconds for ARP cache entries">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="time" longname="Time" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="ethernet_encapsulation_option" longname="Ethernet Encapsulation Option" description="This option specifies whether or not the client should use Ethernet Version 2 (RFC 894) or IEEE 802.3 (RFC 1042) encapsulation if the interface is an Ethernet">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="value" longname="Value" description="A value of 0 indicates that the client should use RFC 894 encapsulation. A value of 1 means that the client should use RFC 1042 encapsulation" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="tcp_default_ttl_option" longname="TCP Default TTL Option" description="This option specifies the default TTL that the client should use when sending TCP segments">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="ttl" longname="TTL" description="Time To Live. The minimum value is 1" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="tcp_keepalive_interval_option" longname="TCP Keeplive Intervall Option" description="This option specifies the interval (in seconds) that the client TCP should wait before sending a keepalive message on a TCP connection">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="time" longname="Time" description="A value of zero indicates that the client should not generate keepalive messages on connections unless specifically requested by an application" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="tcp_keepalive_garbage_option" longname="TCP Keeplive Garbage Option" description="This option specifies the whether or not the client should send TCP keepalive messages with a octet of garbage for compatibility with older implementations">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="value" longname="Value" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="network_information_service_domain_option" longname="Network Information Service Domain Option" description="This option specifies the name of the client's NIS domain">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="String Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="nisdn" longname="NIS Domain Name" description="The domain is formatted as a character string consisting of characters from the NVT ASCII character set" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="network_information_servers_option" longname="Network Information Servers Option" description="This option specifies a list of IP addresses indicating NIS servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be a multiple of 4" size="1" showtemplate="FieldDec"/>
			<block name="nis_list" longname="NIS servers list" description="Servers SHOULD be listed in order of preference">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="network_time_protocol_servers_option" longname="Network Time Protocol Servers Option" description="This option specifies a list of IP addresses indicating NTP servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be a multiple of 4" size="1" showtemplate="FieldDec"/>
			<block name="ntp_list" longname="NTP servers list" description="Servers SHOULD be listed in order of preference">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="vendor_specific_information_option" longname="Vendor Specific Information Option" description="This option is used by clients and servers to exchange vendor-specific information">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="sub_options_list" longname="Sub Options List">
				<loop type="size" expr="buf2int(len)">
					<field type="fixed" name="sub_code" longname="Sub Option Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="sub_len" longname="Length" size="1" showtemplate="FieldDec"/>
					<field type="variable" name="data_item" longname="Data item" expr="buf2int(sub_len)" showtemplate="Field4BytesHex"/>
				</loop>
			</block>
		</block>

		<block name="netbios_ns_option" longname="NetBIOS over TCP/IP Name Server Option" description="The NetBIOS name server (NBNS) option specifies a list of RFC 1001/1002 NBNS name servers listed in order of preference">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="nbns_list" longname="NBNS List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="netbios_dds_option" longname="NetBIOS over TCP/IP Datagram Distribution Server Option" description="The NetBIOS datagram distribution server (NBDD) option specifies a list of RFC 1001/1002 NBDD servers listed in order of preference">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="nbdds_list" longname="NBDDS List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="netbios_node_type_option" longname="NetBIOS over TCP/IP Node Type Option" description="The NetBIOS node type option allows NetBIOS over TCP/IP clients which are configurable to be configured as described in RFC 1001/1002">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length of Subnetmask" description="Must be 1" size="1" showtemplate="FieldDec"/>
			<block name="node_type" longname="Node Type">
				<field type="bit" name="b_node" longname="B-node" mask="0x01" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="p_node" longname="P-node" mask="0x02" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="m_node" longname="M-node" mask="0x04" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="h_node" longname="H-node" mask="0x08" size="1" showtemplate="FieldBin"/>
			</block>
		</block>

		<block name="netbios_scope_option" longname="NetBIOS over TCP/IP Scope Option" description="The NetBIOS scope option specifies the NetBIOS over TCP/IP scope parameter for the client as specified in RFC 1001/1002">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum lengthh is 1" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="netbios_scope" longname="NetBIOS Scope" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="xwindows_system_font_server_option" longname="X Window System Font Server Option" description="This option specifies a list of X Window System Font servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="xwsfs_list" longname="XWindows SFS List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="x_window_system_display_manager_option" longname="X Window System Display Manager Option" description="This option specifies a list of IP addresses of systems that are running the X Window System Display Manager and are available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="xwsdm_list" longname="XWindows SDM List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="network_information_service_domain_option" longname="Network Information Service + Domain Option" description="This option specifies the name of the client's NIS+ domain">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum lengthh is 1" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="nis_client_domain_name" longname="NIS Client Domain Name" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="network_information_serivice_servers_option" longname="Network Information Service+ Servers Options" description="This option specifies a list of IP addresses indicating NIS+ servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="NBDDS List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="mobile_ip_home_agent_option" longname="Mobile IP Home Agent Option" description="This option specifies a list of IP addresses indicating mobile IP home agents available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="smtp_server_option" longname="SMTP Server Option" description="The SMTP server option specifies a list of SMTP servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="pop3_server_option" longname="POP3 Server Option" description="The POP3 server option specifies a list of POP3 available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="nntp_server_option" longname="NNTP Server Option" description="The NNTP server option specifies a list of NNTP available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="default_www_server_option" longname="Default WWW Server Option" description="The WWW server option specifies a list of WWW available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="default_finger_server_option" longname="Default Finger Server Option" description="The Finger server option specifies a list of Finger available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="default_irc_server_option" longname="Default IRC Server Option" description="The IRC server option specifies a list of IRC available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="streettalk_server_option" longname="StreetTalk Server Option" description="The StreetTalk server option specifies a list of StreetTalk servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="stda_server_option" longname="STDA Server Option" description="The StreetTalk Directory Assistance (STDA) server option specifies a list of STDA servers available to the client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="requested_ip_address_option" longname="Requested IP Address Option" description="This option is used in a client request (DHCPDISCOVER) to allow the client to request that a particular IP address be assigned">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
		</block>

		<block name="ip_address_lease_time_option" longname="IP Address Lease Time Option" description="This option is used in a client request (DHCPDISCOVER or DHCPREQUEST) to allow the client to request a lease time for the IP address">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="time" longname="Lease Time" description="The time is in units of seconds" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="overload_option" longname="Overload Option" description="This option is used to indicate that the DHCP 'sname' or 'file' fields are being overloaded by using them to carry DHCP options">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="value" longname="Value" description="Must be 1, 2 or 3" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="tftp_server_name_option" longname="TFTP Sever Name Option" description="This option is used to identify a TFTP server when the 'sname' field in the DHCP header has been used for DHCP options">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 1" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="tftp_server" longname="TFTP Server" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="bootfile_name_option" longname="Boot File Name Option" description="This option is used to identify a bootfile when the 'file' field in the DHCP header has been used for DHCP options">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 1" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="bootfile_name" longname="Bootfile Name" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="dhcp_message_type_option" longname="DHCP Message Type Option" description="This option is used to convey the type of the DHCP message" showsumtemplate="dhcp.MessTypeOpt">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="type" longname="DHCP Message Type" size="1" showtemplate="dhcp.type"/>
		</block>

		<block name="server_identifier_option" longname="Server Identifier Option" description="This option is used in DHCPOFFER and DHCPREQUEST messages, and may optionally be included in the DHCPACK and DHCPNAK messages">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
		</block>

		<block name="parameter_request_list_option" longname="Parameter Request List Option" description="This option is used by a DHCP client to request values for specified configuration parameters">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum lengthh is 1" size="1" showtemplate="FieldDec"/>

			<block name="option_codes" longname="Option Codes" description="List of Requested Option">
				<loop type="times2repeat" expr="buf2int(len)">
					<field type="fixed" name="option" longname="Option" size="1" showtemplate="dhcp.option"/>
				</loop>
			</block>
		</block>

		<block name="message_option" longname="Message Option" description="This option is used by a DHCP server to provide an error message to a DHCP client in a DHCPNAK message in the event of a failure">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum lengthh is 1" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="text" longname="Text" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="maximum_dhcp_message_size_option" longname="Maximum DHCP Message Size Option" description="This option specifies the maximum length DHCP message that it is willing to accept">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="msg_size" longname="Message Size" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="renewal_time_value_option" longname="Renewal (T1) Time Value Option" description="This option specifies the time interval from address assignment until the client transitions to the RENEWING state">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="t1" longname="T1 Interval" description="The time is in units of seconds" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="rebinding_time_value_option" longname="Rebinding (T2) Time Value Option" description="This option specifies the time interval from address assignment until the client transitions to the REBINDING state">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="t2" longname="T2 Interval" description="The time is in units of seconds" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="vendor_class_identifier_option" longname="Vendor Class Indentifier Option" description="This option is used by DHCP clients to optionally identify the vendor type and configuration of a DHCP client">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 1" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="vendor_class_id" longname="Vendor Class Identifier" expr="buf2int(len)" showtemplate="Field4BytesHex"/>
		</block>

		<block name="client_identifier_option" longname="Client Identifier Option" description="This option is used by DHCP clients to specify their unique identifier">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="client_id" longname="Client Identifier" expr="buf2int(len) - 1" showtemplate="Field4BytesHex"/>
		</block>

		<block name="nds_server_option" longname="Novell Directory Services Server Option" description="This option specifies one or more NDS servers for the client to contact for access to the NDS database">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be a multiple of 4" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="buf2int(len) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="nds_tree_name_option" longname="Novell Tree Name Option" description="This option specifies the name of the NDS tree the client will be ontacting">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 1" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="nds_tree_name" longname="NDS Tree Name" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="user_authentication_protocol_option" longname="User Authentication Protocol Option" description="This option specifies a list of URLs, each pointing to a user authentication service that is capable of processing authentication requests encapsulated in the User Authentication Protocol (UAP)">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 1" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="url_list" longname="URL List" description="Separed by the ASCII space character (0x20)" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="private_use_option" longname="Private Use Option" description="Private use option">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 1" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="value" longname="Value" description="Value" expr="buf2int(len)" showtemplate="Field4BytesHex"/>
		</block>

		<block name="auto_configure_option" longname="Auto Configure Option" description="This option code is used to ask whether, and be notified if, auto-configuration should be disabled on the local subnet">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="value" longname="Value" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="subnet_selection_option" longname="Subnet Selection Option" description="The option contains a single IPv4 address that is the address of a subnet">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="address" longname="IPv4 Address" size="4" showtemplate="ip4addr-noplg"/>
		</block>

		<block name="netware_ip_domain_name_option" longname="NetWare/IP Domain Name Option" description="This option code is used to convey the NetWare/IP domain name used by the NetWare/IP product">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 1" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="netware_ip_domain_name" longname="NetWare/IP Domain Name" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="the_netware_ip_information_option" longname="The NetWare/IP Information option" description="The NetWare/IP option code will be used to convey all the NetWare/IP related information except for the NetWare/IP domain name">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="sub_options_list" longname="Sub Options List">
				<loop type="size" expr="buf2int(len)">
					<switch expr="buf2int($packet[$currentoffset:1])">
						<case value="1">
							<field type="fixed" name="nwip_does_not_exist" longname="NWIP_DOES_NOT_EXIST" description="The responding DHCP server does not have any NetWare/IP information configured" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" description="Must be 0" size="1" showtemplate="FieldDec"/>
						</case>
						<case value="2">
							<field type="fixed" name="nwip_exist_in_options_area" longname="NWIP_EXIST_IN_OPTIONS_AREA" description="All NetWare/IP information is present in the 'options' area of the DHCP response packet" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" description="Must be 0" size="1" showtemplate="FieldDec"/>
						</case>
						<case value="3">
							<field type="fixed" name="nwip_exist_in_sname_file" longname="NWIP_EXIST_IN_SNAME_FILE" description="All NetWare/IP information is present in the 'sname' and, if necessary, 'file' fields of the DHCP response packet" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" description="Must be 0" size="1" showtemplate="FieldDec"/>
						</case>
						<case value="4">
							<field type="fixed" name="nwip_exist_but_too_big" longname="NWIP_EXIST_BUT_TOO_BIG" description="Neither 'options' area nor 'sname' field can accommodate the NetWare/IP information" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" description="Must be 0" size="1" showtemplate="FieldDec"/>
						</case>
						<case value="5">
							<field type="fixed" name="nsq_broadcast" longname="NSQ_BROADCAST" description="If the value is 1, the client SHOULD perform a NetWare Nearest Server Query to find out its nearest NetWare/IP server" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" description="Must be 1" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="value" longname="Value" description="Must be 0 or 1" size="1" showtemplate="FieldDec"/>
						</case>
						<case value="6">
							<field type="fixed" name="preferred_dss" longname="PREFERRED_DSS" description="The list contains the addresses of N NetWare Domain SAP/RIP Server (DSS)" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
							<loop type="times2repeat" expr="buf2int(len) div 4">
								<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
							</loop>
						</case>
						<case value="7">
							<field type="fixed" name="nearest_nwip_server" longname="NEAREST_NWIP_SERVER" description="The list contains the addresses of n Nearest NetWare/IP servers" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
							<loop type="times2repeat" expr="buf2int(len) div 4">
								<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
							</loop>
						</case>
						<case value="8">
							<field type="fixed" name="autoretries" longname="AUTORETRIES" description="The value is a one byte integer value indicating the number of times a NetWare/IP client should attempt to communicate with a given DSS server at startup" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="value" longname="Value" size="1" showtemplate="FieldDec"/>
						</case>
						<case value="9">
							<field type="fixed" name="autoretry_secs" longname="AUTORETRY_SECS" description="The value is a one byte integer value indicating the amount of delay in seconds in between each NetWare/IP client attempt to communicate with a given DSS server at startup" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="value" longname="Value" size="1" showtemplate="FieldDec"/>
						</case>
						<case value="10">
							<field type="fixed" name="nwip_1_1" longname="NWIP_1_1" description="If the value is 1, the NetWare/IP client SHOULD support NetWare/IP Version 1.1 compatibility" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="value" longname="Value" size="1" showtemplate="FieldDec"/>
						</case>
						<case value="11">
							<field type="fixed" name="primary_dss" longname="PRIMARY_DSS" description="This field identifies the Primary Domain SAP/RIP Service server (DSS) for this NetWare/IP domain" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
						</case>
						<default>
							<field type="fixed" name="unknown" longname="UNKNOWN" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
							<field type="variable" name="value" longname="Value" expr="buf2int(len)" showtemplate="Field4BytesHex"/>
						</default>
					</switch>
				</loop>
			</block>
		</block>

		<block name="user_class_option" longname="User Class option" description="This option is used by a DHCP client to optionally identify the type or category of user or applications it represents">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<block name="uc_option_list" longname="User Class Option List">
				<loop type="size" expr="buf2int(len)">
					<field type="fixed" name="uc_len" longname="User Class Data Length" size="1" showtemplate="FieldDec"/>
					<field type="variable" name="user_class_data" longname="User Class Data" expr="buf2int(uc_len)" showtemplate="Field4BytesHex"/>
				</loop>
			</block>
		</block>

		<block name="slp_directory_agent_option" longname="SLP Directory Agent Option" description="This option specifies the location of one or more SLP Directory Agents">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be a multiple of 4 + 1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="mandatory" longname="Mandatory" size="1" showtemplate="FieldDec"/>
			<block name="address_list" longname="Address List">
				<loop type="times2repeat" expr="(buf2int(len) - 1) div 4">
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="slp_service_scope_option" longname="SLP Service Scope Option" description="The scope list is a comma delimited list which indicates the scopes that a SLP Agent is configured to use">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 2" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="mandatory" longname="Mandatory" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="scopelist" longname="Scope List" expr="buf2int(len) - 1" showtemplate="FieldAscii"/>
		</block>

		<block name="client_fqdn_option" longname="The Client FQDN Option" description="To update the IP address to FQDN mapping a DHCP server needs to know the FQDN of the client to which the server leases the address">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 4" size="1" showtemplate="FieldDec"/>
			<block name="flags" longname="Flags" description="Flags">
				<field type="bit" name="MBZ" longname="Must be zero" description="MUST BE ZERO (reserved for future use)" mask="0xF0" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="N" longname="N" mask="0x08" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="E" longname="E" mask="0x04" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="O" longname="O" mask="0x02" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="S" longname="S" mask="0x01" size="1" showtemplate="FieldBin"/>
			</block>
			<field type="fixed" name="rcode1" longname="rcode1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="rcode2" longname="rcode2" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="domain_name" longname="Domain Name" expr="buf2int(len) - 3" showtemplate="FieldAscii"/>
		</block>

		<block name="relay_agent_information_option" longname="Relay Agent Information Option" description="It is a 'container' option for specific agent=supplied sub=options">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>

			<block name="agent_information_field" longname="Agent Information Field">
				<loop type="size" expr="buf2int(len)">
					<switch expr="buf2int($packet[$currentoffset:1])">
						<case value="1">
							<field type="fixed" name="agent_circuit_id_sub_option" longname="Agent Circuit ID Sub-option" description="It encodes an agent-local identifier of the circuit from which a DHCP client-to-server packet was received" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
							<field type="variable" name="circuit_id" longname="Circuit Id" expr="buf2int(len)" showtemplate="Field4BytesHex"/>
						</case>
						<case value="2">
							<field type="fixed" name="agent_remote_id_sub_option" longname="Agent Remote ID Sub-option" description="This sub-option MAY be added by DHCP relay agents which terminate switched or permanent circuits and have mechanisms to identify the remote host end of the circuit" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
							<field type="variable" name="agent_remote_id" longname="Agent Remote ID" expr="buf2int(len)" showtemplate="Field4BytesHex"/>
						</case>
						<case value="4">
							<field type="fixed" name="docsis_device_class_sub_option" longname="DOCSIS Device Class Sub-option" description="The DOCSIS RFI specification specifies the Device Class encoding within the payload of the Device Class Identification Request (DCI-REQ) message" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" description="Must be 4" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="device_class" longname="Device Class" description="Device Class" size="4" showtemplate="FieldDec"/>
						</case>
						<default>
							<field type="fixed" name="unknown_sub_option" longname="Unknown Sub Option" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
							<field type="variable" name="data" longname="Data" expr="buf2int(len)" showtemplate="Field4BytesHex"/>
						</default>
					</switch>
				</loop>
			</block>
		</block>

		<block name="name_service_search_option" longname="Name Service Search Option" description="A DHCP server SHOULD return, in its preferred order, the 16-bit, network byte order (big-endian) integer option code for the name services (the earlier in the list, the more preferred the name service)">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Must be a multiple of 4 + 1" size="1" showtemplate="FieldDec"/>
			<block name="name_service_search_list" longname="Name Service Search Order in Sequence">
				<loop type="times2repeat" expr="buf2int(len) div 2">
					<field type="fixed" name="ns" longname="Name Service" size="2" showtemplate="FieldDec"/>
				</loop>
			</block>
		</block>

		<block name="sip_server_dhcp_option" longname="SIP Server DHCP Option" description="The SIP server DHCP option carries either a 32-bit (binary) IPv4 address or, preferably, a DNS (RFC 1035) fully-qualified domain name to be used by the SIP client to locate a SIP server">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="enc" longname="Encoding" size="1" showtemplate="FieldDec"/>

			<switch expr="buf2int(enc)">
				<case value="0">
					<field type="variable" name="dns_name_of_sip_server" longname="DNS name of SIP server" expr="buf2int(len) - 1" showtemplate="FieldAscii"/>
				</case>
				<case value="1">
					<block name="address_list" longname="IPv4 Address List">
						<loop type="times2repeat" expr="(buf2int(len) - 1) div 4">
							<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
						</loop>
					</block>
				</case>
			</switch>
		</block>

		<block name="authentication_option" longname="Authentication Option" description="The code for the authentication option is 90, and the length field contains the length of the protocol, RDM, algorithm, Replay Detection fields and authentication information fields in octets">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="protocol" longname="Protocol" description="The protocol field defines the particular technique for authentication used in the option" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="algorithm" longname="Algorithm" description="The algorithm field defines the specific algorithm within the technique identified by the protocol field" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="rdm" longname="Replay Detection Method" description="The Replay Detection Method (RDM) field determines the type of replay detection used in the Replay Detection field" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="rd" longname="Replay Detection" description="The Replay Detection field is per the RDM, and the authentication information field is per the protocol in use" size="8" showtemplate="Field4BytesHex"/>
			<field type="variable" name="authentication_information" longname="Authentication Information" expr="buf2int(len) - 1" showtemplate="Field4BytesHex"/>
		</block>

		<block name="naming_authority_extension_option" longname="Naming Authority Extension Option" description="This extension indicates a naming authority (which specifies the syntax for schemes that may be used in URLs) for use by entities with the Service Location Protocol">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 1" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="naming_authority" longname="Naming Authority" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="ieee_1003_1_posix_timezone_specifier_option" longname="IEEE 1003.1 POSIX Timezone specifier Option" description="This NVT ASCII string represents the IEEE 1003.1 POSIX Timezone specification that a client is to use to set its timezone">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 1" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="posix_timezone_string" longname="POSIX Timezone string" expr="buf2int(len)" showtemplate="FieldAscii"/>
		</block>

		<block name="agent_remote_id_option" longname="Agent Remote ID Option" description="This option MAY be added by DHCP relay agents which terminate switched or permanent circuits and have mechanisms to identify the remote host end of the circuit">
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Length" description="Minimum length is 1" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="agent_remote_id" longname="Agent Remote ID" expr="buf2int(len)" showtemplate="Field4BytesHex"/>
		</block>
	</format>


	<visualization>
		<showsumtemplate name="dhcp">
			<section name="next"/>
			<text value="DHCP "/>
			<protofield name="code" showdata="showmap"/>
			<text value=": Transaction ID "/>
			<protofield name="xid" showdata="showvalue"/>
		</showsumtemplate>

		<showsumtemplate name="dhcp.MessTypeOpt">
			<text value=" "/>
			<protofield name="type" showdata="showmap"/>
		</showsumtemplate>
 
		<showtemplate name="dhcp.type" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="DHCP Discovery"/>
					<case value="2" show="DHCP Offer"/>
					<case value="3" show="DHCP Request"/>
					<case value="4" show="DHCP Decline"/>
					<case value="5" show="DHCP Acknowledgement"/>
					<case value="6" show="DHCP Negative Acknowledgement"/>
					<case value="7" show="DHCP Release"/>
					<case value="8" show="DHCP Inform"/>
					<default show="Error in DHCP type lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="dhcp.option" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Pad"/>
					<case value="1" show="Subnet Mask"/>
					<case value="2" show="Time Offset in seconds from UTC"/>
					<case value="3" show="Router addresses"/>
					<case value="4" show="Timeserver addresses"/>
					<case value="5" show="IEN-116 Server addresses"/>
					<case value="6" show="DNS Server addresses"/>
					<case value="7" show="Logging Server addresses"/>
					<case value="8" show="Quotes Server addresses"/>
					<case value="9" show="Printer Server addresses"/>
					<case value="10" show="Impress Server addresses"/>
					<case value="11" show="RLP Server addresses"/>
					<case value="12" show="Hostname string"/>
					<case value="13" show="Size of boot file in 512 byte chunks"/>
					<case value="14" show="Client to dump and name the file to dump it to"/>
					<case value="15" show="The DNS domain name of the client"/>
					<case value="16" show="Swap Server addeess"/>
					<case value="17" show="Path name for root disk"/>
					<case value="18" show="Path name for more BOOTP info"/>
					<case value="19" show="Enable/Disable IP Forwarding"/>
					<case value="20" show="Enable/Disable Source Routing"/>
					<case value="21" show="Routing Policy Filters"/>
					<case value="22" show="Max Datagram Reassembly Size"/>
					<case value="23" show="Default IP Time to Live"/>
					<case value="24" show="Path MTU Aging Timeout"/>
					<case value="25" show="Path MTU Plateau Table"/>
					<case value="26" show="Interface MTU Size"/>
					<case value="27" show="All Subnets are Local"/>
					<case value="28" show="Broadcast Address"/>
					<case value="29" show="Perform Mask Discovery"/>
					<case value="30" show="Provide Mask to Others"/>
					<case value="31" show="Perform Router Discovery"/>
					<case value="32" show="Router Solicitation Address"/>
					<case value="33" show="Static Routing Table"/>
					<case value="34" show="Trailer Encapsulation"/>
					<case value="35" show="ARP Cache Timeout"/>
					<case value="36" show="Ethernet Encapsulation"/>
					<case value="37" show="Default TCP Time to Live"/>
					<case value="38" show="TCP Keepalive Interval"/>
					<case value="39" show="TCP Keepalive Garbage"/>
					<case value="40" show="NIS Domain Name"/>
					<case value="41" show="NIS Server Addresses"/>
					<case value="42" show="NTP Server Addresses"/>
					<case value="43" show="Vendor Specific Information"/>
					<case value="44" show="NETBIOS Name Servers"/>
					<case value="45" show="NETBIOS Datagram Distribution"/>
					<case value="46" show="NETBIOS Node Type"/>
					<case value="47" show="NETBIOS Scope"/>
					<case value="48" show="X Window Font Server"/>
					<case value="49" show="X Window Display Manager"/>
					<case value="50" show="Requested IP Address"/>
					<case value="51" show="IP Address Lease Time"/>
					<case value="52" show="Overload 'sname' or 'file'"/>
					<case value="53" show="DHCP Message Type"/>
					<case value="54" show="DHCP Server Identification"/>
					<case value="55" show="Parameter Request List"/>
					<case value="56" show="DHCP Error Message"/>
					<case value="57" show="DHCP Maximum Message Size"/>
					<case value="58" show="DHCP Renewal (T1) Time"/>
					<case value="59" show="DHCP Rebinding (T2) Time"/>
					<case value="60" show="Class Identifier"/>
					<case value="61" show="Client Identifier"/>
					<case value="62" show="Netware/IP Domain Name"/>
					<case value="63" show="Netware/IP sub Options"/>
					<case value="64" show="NIS+ v3 Client Domain Name"/>
					<case value="65" show="NIS+ v3 Server Addresses"/>
					<case value="66" show="TFTP Server Name"/>
					<case value="67" show="Boot File Name"/>
					<case value="68" show="Home Agent Addresses"/>
					<case value="69" show="Simple Mail Server Addresses"/>
					<case value="70" show="Post Office Server Addresses"/>
					<case value="71" show="Network News Server Addresses"/>
					<case value="72" show="WWW Server Addresses"/>
					<case value="73" show="Finger Server Addresses"/>
					<case value="74" show="Chat Server Addresses"/>
					<case value="75" show="StreetTalk Server Addresses"/>
					<case value="76" show="ST Directory Assist Addresses"/>
					<case value="77" show="User Class Information"/>
					<case value="78" show="Directory Agent Information"/>
					<case value="79" show="Service Location Agent Scope"/>
					<case value="80" show="Naming Authority"/>
					<case value="81" show="Fully Qualified Domain Name"/>
					<case value="82" show="Relay Agent Information"/>
					<case value="83" show="Agent Remote ID"/>
					<case value="84" show="Agent Subnet Mask"/>
					<case value="85" show="Novell Directory Services"/>
					<case value="86" show="Novell Directory Services"/>
					<case value="87" show="Novell Directory Services"/>
					<case value="88" show="IEEE 1003.1 POSIX Timezone"/>
					<case value="89" show="Fully Qualified Domain Name"/>
					<case value="90" show="Authentication"/>
					<case value="91" show="Vines TCP/IP Server Option"/>
					<case value="92" show="Server Selection Option"/>
					<case value="93" show="Client System Architecture"/>
					<case value="94" show="Client Network Device Interface"/>
					<case value="95" show="Lightweight Directory Access Protocol"/>
					<case value="96" show="IPv6 Transitions"/>
					<case value="97" show="UUID/GUID-based Client Identifier"/>
					<case value="98" show="Open Group's User Authentication"/>
					<case value="99" show="Printer Name"/>
					<case value="100" show="DHCP multicast address"/>
					<case value="108" show="Swap Path Option"/>
					<case value="110" show="IPX Compatability"/>
					<case value="112" show="NetInfo Parent Server Address"/>
					<case value="113" show="NetInfo Parent Server Tag"/>
					<case value="114" show="URL"/>
					<case value="115" show="DHCP Failover Protocol"/>
					<case value="116" show="DHCP Auto-Configuration"/>
					<case value="117" show="Name Service Search"/>
					<case value="118" show="Subnet Selection Option"/>
					<case value="119" show="DNS domain search list"/>
					<case value="120" show="SIP Servers DHCP Option"/>
					<case value="121" show="Classless Static Route Option"/>
					<case value="126" show="Extension"/>
					<case value="127" show="Extension"/>
					<case value="255" show="None"/>
					<case value="128" maxvalue="254" show="Private Use"/> 
					<default show="Error in DHCP parameter lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
	</visualization>

</protocol>
<protocol name="icmp" longname="ICMP (Internet Control Message Protocol)" showsumtemplate="icmp">
	<format>
		<fields>
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="icmp.type"/>

			<!-- fields switch -->
			<switch expr="buf2int(type)">
				<case value="0">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="echoreply"/>
				</case>

				<case value="3">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="icmp.DestUnreachCode"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="destunreach"/>
				</case>

				<case value="4">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="squence"/>
				</case>

				<case value="5">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="icmp.RedirectCode"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="redirect"/>
				</case>

				<case value="8">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="echoreq"/>
				</case>

				<case value="9">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="radv"/>
				</case>

				<case value="10">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="rsol"/>
				</case>

				<case value="11">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="timeex"/>
				</case>

				<case value="12">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="paramprob"/>
				</case>

				<case value="13">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="tsreq"/>
				</case>

				<case value="14">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="tsreply"/>
				</case>

				<case value="17">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="maskreq"/>
				</case>

				<case value="18">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="maskreply"/>
				</case>

			</switch>
		</fields>

		<block name="echoreq" longname="Echo Request">
			<field type="fixed" name="identifier" longname="Identifier" size="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="seqn" longname="Sequence number" size="2" showtemplate="FieldDec"/> 
			<field type="variable" name="data" longname="Padding Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</block>

		<block name="echoreply" longname="Echo Reply">
			<field type="fixed" name="identifier" longname="Identifier" size="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="seqn" longname="Sequence number" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="data" longname="Padding Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</block>

		<block name="redirect" longname="Redirect">
			<field type="fixed" name="address" longname="IP address" size="4" showtemplate="ip4addr-noplg"/> 
		</block>

		<block name="destunreach" longname="Destination Unreachable">
			<field type="fixed" name="unused" longname="Unused (must be zero)" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="squence" longname="Source Quence">
			<field type="fixed" name="unused" longname="Unused (must be zero)" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="timeex" longname="Time Exceeded for a Datagram">
			<field type="fixed" name="unused" longname="Unused (must be zero)" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="paramprob" longname="Parameter Problem for a Datagram">
			<field type="bit" name="pointer" longname="Pointer" mask="0xFF000000" size="4" showtemplate="FieldBin"/>
			<field type="bit" name="unused" longname="Unused" mask="0x00FFFFFF" size="4" showtemplate="FieldBin"/>
		</block>

		<block name="tsreq" longname="Timestamp Request">
			<field type="fixed" name="identifier" longname="Identifier" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="sequenum" longname="Sequence Number" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="otimestamp" longname="Originate Timestamp" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="rtimestamp" longname="Receive Timestamp" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="ttimestamp" longname="Transmit Timestamp" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="tsreply" longname="Timestamp Reply">
			<field type="fixed" name="identifier" longname="Identifier" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="sequenum" longname="Sequence Number" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="otimestamp" longname="Originate Timestamp" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="rtimestamp" longname="Receive Timestamp" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="ttimestamp" longname="Transmit Timestamp" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="maskreq" longname="Address Mask Request">
			<field type="fixed" name="identifier" longname="Identifier" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="sequenum" longname="Sequence Number" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="addmask" longname="Address Mask" size="4" showtemplate="ip4addr-noplg"/>
		</block>

		<block name="maskreply" longname="Address Mask Reply">
			<field type="fixed" name="identifier" longname="Identifier" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="sequenum" longname="Sequence Number" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="addmask" longname="Address Mask" size="4" showtemplate="ip4addr-noplg"/>
		</block>

		<block name="radv" longname="Router Advertisement">
			<field type="fixed" name="reserved" longname="Reserved" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="rsol" longname="Router Solicitation">
			<field type="fixed" name="numadd" longname="NumAddr" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="addrsize" longname="AddrSize" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="lifetime" longname="LifeTime" size="2" showtemplate="FieldDec"/>
			<block name="Address" longname="Address">
				<loop type="times2repeat" expr="buf2int(numadd)">
					<field type="fixed" name="routeaddr" longname="Router Address" size="4" showtemplate="ip4addr-noplg"/> 
					<field type="fixed" name="preflevel" longname="Preference Level" size="4" showtemplate="FieldDec"/> 
				</loop>
			</block>
		</block>
	</format>


	<encapsulation>
		<!-- The ICMP packet can carry the IP datagram that caused the error -->
		<nextproto proto="#ip"/>
	</encapsulation>


	<visualization>
		<showtemplate name="icmp.type" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Echo Reply"/>
					<case value="3" show="Destination Unreachable"/>
					<case value="4" show="Source Quence"/>
					<case value="5" show="Redirect"/>
					<case value="8" show="Echo Request"/>
					<case value="9" show="Router Advertisement"/>
					<case value="10" show="Router Solicitation"/>
					<case value="11" show="Time exceeded for a Datagram"/>
					<case value="12" show="Parameter Problem on a Datagram"/>
					<case value="13" show="Timestamp Request"/>
					<case value="14" show="Timestamp Reply"/>
					<case value="15" show="Information Request (obsolete)"/>
					<case value="16" show="Information Reply (obsolete)"/>
					<case value="17" show="Address Mask Request"/>
					<case value="18" show="Address Mask Reply"/>
					<default show="Error in ICMP Type lookup"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="icmp.DestUnreachCode" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Network Unreachable"/>
					<case value="1" show="Host Unreachable"/>
					<case value="2" show="Protocol Unreachable"/>
					<case value="3" show="Port Unreachable"/>
					<case value="4" show="Fragmentation needed and DF set"/>
					<case value="5" show="Source routed failed"/>
					<case value="6" show="Destination network failed"/>
					<case value="7" show="Destination host failed"/>
					<case value="8" show="Source host isolated"/>
					<case value="9" show="Communication with destination network administratively prohibited"/>
					<case value="10" show="Communication with destination host administratively prohibited"/>
					<case value="11" show="Network unreachable for type of service"/>
					<case value="12" show="Host unreachable for type of service"/>
					<default show="Error in ICMP Destination Unreachable code lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="icmp.RedirectCode" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Redirect datagrams for the Network"/>
					<case value="1" show="Redirect datagrams for the Host"/>
					<case value="2" show="Redirect datagrams for the Type of Service and Network"/>
					<case value="3" show="Redirect datagrams for the Type of Service and Host"/>
					<default show="Error in ICMP Redirect code lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="icmp">
			<section name="next"/>
			<text value="ICMP "/>
			<protofield name="type" showdata="showmap"/>
		</showsumtemplate>

	</visualization>
</protocol>
<protocol name="igmp" longname="IGMP (Internet Group Management Protocol)" showsumtemplate="igmp">
	<format>
		<fields>
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="igmp.type"/>

			<switch expr="buf2int(type)">
				<case value = "17">
					<!-- Come faccio a dividere maxres per 10 -->
					<!-- Se maxres > 128 devo fare qualche cosa? -->
					<field type="fixed" name="maxres" longname="Max Response Time" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="IGMP Checksum" size="2" showtemplate="FieldHex"/>
					<field type="fixed" name="gaddress" longname="Group Address" size="4" showtemplate="ip4addr-noplg"/>
					<block name="flags" longname="Flags">
						<field type="bit" name="resv" longname="Reserved" size="1" mask="0xF0" showtemplate="FieldBin"/>
						<field type="bit" name="s_flag" longname="Suppress Router-Side Processing" size="1" mask="0x08" showtemplate="FieldBin"/>
						<field type="bit" name="qrv" longname="Querier's Robustness Variable" size="1" mask="0x07" showtemplate="FieldBin"/>
					</block>
					
					<!-- Se qqic > 128 devo fare qualche cosa? -->
					<field type="fixed" name="qqic" longname="Querier's Query Interval Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="nsources" longname="Number Of Sources" size="1" showtemplate="FieldDec"/>
					<!-- Posso mettere come nome di Source Address il numero? -->
					<loop type="times2repeat" expr="buf2int(nsources)">
						<field type="fixed" name="source_addr" longname="Source Address" size="4" showtemplate="ip4addr-noplg"/>
					</loop>
				</case>

				<case value = "18">
					<field type="fixed" name="unused" longname="Ununsed" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<field type="fixed" name="gaddress" longname="Group Address" size="4" showtemplate="ip4addr-noplg"/>
				</case>

				<case value = "22">
					<field type="fixed" name="maxres" longname="Max Response Time" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<field type="fixed" name="gaddress" longname="Group Address" size="4" showtemplate="ip4addr-noplg"/>
				</case>

				<case value = "23">
					<field type="fixed" name="maxres" longname="Max Response Time" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<field type="fixed" name="gaddress" longname="Group Address" size="4" showtemplate="ip4addr-noplg"/>
				</case>

				<case value = "34">
					<field type="fixed" name="reserved" longname="Reserved" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<field type="fixed" name="reserved" longname="Reserved" size="2" showtemplate="FieldDec"/>
					<field type="fixed" name="nrecords" longname="Number Of Group Records" size="2" showtemplate="FieldDec"/>
					<loop type="times2repeat" expr="buf2int(nrecords)">
						<includeblk name="group_records"/>
					</loop>
				</case>
			</switch>
		</fields>

		<!-- E' possibile inserire il numero dopo Group Records? -->
		<block name="group_records" longname="Group Records">
			<field type="fixed" name="rec_type" longname="Record Type" size="1" showtemplate="FieldDec"/>
			<!-- Ad ogni record type corrisponde un modo diverso: devo specificarlo qui? -->
			<field type="fixed" name="aux_data_len" longname="Auxiliary Data Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="num_sources" longname="Number Of Sources" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="m_address" longname="Multicast Address" size="4" showtemplate="ip4addr-noplg"/>
			<loop type="times2repeat" expr="buf2int(num_sources)">
				<!-- E' possibile inserire il numero dopo Source Address? -->
				<field type="fixed" name="s_address" longname="Source Address" size="4" showtemplate="ip4addr-noplg"/>
			</loop>
			<field type="variable" name="aux_data" longname="Auxiliary Data" expr="buf2int(aux_data_len)" showtemplate="FieldDec"/>
		</block>	
	</format>

	<encapsulation> 
		<switch expr = "buf2int(type)">
			<case value="19">
				<nextproto proto = "#dvmrp" />
			</case>

<!--
			<case value="48">
				<nextproto proto = "#mrd" />
			</case>

			<case value="49">
				<nextproto proto = "#mrd" />
			</case>

			<case value="50">
				<nextproto proto = "#mrd" />
			</case>
-->
		</switch>
	</encapsulation>

	<visualization>
		<showtemplate name="igmp.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="17" comment="0x11" show="V2 Group Membership Query"/>
					<case value="18" comment="0x12" show="V1 Membership Report"/>
					<case value="19" comment="0x13" show="DVMRP"/>
					<case value="20" comment="0x14" show="V1 PIM"/>
					<case value="21" comment="0x15" show="Cisco Trace Message"/>
					<case value="22" comment="0x16" show="V2 Membership Report"/>
					<case value="23" comment="0x17" show="V2 Leave Group"/>
					<case value="30" comment="0x1E" show="Multicast Traceroute Response"/>
					<case value="31" comment="0x1F" show="Multicast Traceroute"/>
					<case value="34" comment="0x22" show="V3 Membership Report"/>
					<case value="48" comment="0x30" show="Multicast Router Advertisement"/>
					<case value="49" comment="0x31" show="Multicast Router Solicitation"/>
					<case value="50" comment="0x32" show="Multicast Router Termination"/>
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="igmp">
			<section name="next"/>
			<text value="IGMP"/>
			<section name="next"/>
			<protofield name="type" showdata="showmap"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="arp" longname="ARP (Address Resolution Protocol)" comment="This protocol has been 'hardwired' to IP. In fact, we do not know any other network protocol that uses ARP." showsumtemplate="arp">
	<execute-code>
		<!-- If we're on Ethernet, update the packet length -->
		<after when="$linklayer == 1">
			<assign-variable name="$packetlength" value="$currentoffset"/>
		</after>
	</execute-code>

	<format>
		<fields>
			<field type="fixed" name="hType" longname="Hardware type" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="pType" longname="Protocol type" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="hLen" longname="Hardware address length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="pLen" longname="Protocol address length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="op" longname="Operation code" size="2" showtemplate="arp.code"/>
			<field type="fixed" name="sHwAddr" longname="Sender MAC address" size="6" showtemplate="MACaddressEth"/>
			<field type="fixed" name="sIPAddr" longname="Sender IP address" size="4" showtemplate="ip4addr"/>
			<field type="fixed" name="dHwAddr" longname="Destination MAC address" size="6" showtemplate="MACaddressEth"/>
			<field type="fixed" name="dIPAddr" longname="Destination IP address" size="4" showtemplate="ip4addr"/>
		</fields>
	</format>

	<visualization>
		<showtemplate name="arp.code" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Request"/> 
					<case value="2" show="Reply"/> 
					<default show="Error in ARP code lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
		
		<showsumtemplate name="arp">
			<section name="next"/>
			<text value="ARP "/>
			<protofield name="op" showdata="showmap"/>
			<text value=": "/>
			<if expr="buf2int(op) == 1">
				<if-true>
					<text value="who has "/>
					<protofield name="dIPAddr" showdata="showvalue"/>
					<text value=" tell "/>
					<protofield name="sIPAddr" showdata="showvalue"/>
				</if-true>

				<if-false>
					<protofield name="sIPAddr" showdata="showvalue"/>
					<text value=" is at "/>
					<protofield name="sHwAddr" showdata="showvalue"/>
				</if-false>
			</if>
		</showsumtemplate>
	</visualization>

</protocol>
<protocol name="ip" longname="IPv4 (Internet Protocol version 4)" showsumtemplate="ipv4">
	<!-- We should check that 'version' is equal to '4' -->
	<execute-code>
		<after>
			<!-- Store ipsrc and ipdst in a couple of variables for the sake of speed -->
			<!-- This aims at hiding differences between IPv4 and IPv6 for session tracking -->
			<assign-variable name="$ipsrc" value="src"/>
			<assign-variable name="$ipdst" value="dst"/>
			
			<if expr="$ipsrc lt $ipdst" >
				<if-true>
					<assign-variable name="$firstip" value="src"/>
					<assign-variable name="$secondip" value="dst"/>
				</if-true>
				<if-false>
					<assign-variable name="$firstip" value="dst"/>
					<assign-variable name="$secondip" value="src"/>
				</if-false>
			</if>
		</after>

		<!-- If we're on Ethernet, update the packet length -->
		<after when="$linklayer == 1">
			<assign-variable name="$packetlength" value="$currentoffset + buf2int(tlen) - buf2int(hlen) * 4"/>
		</after>
	</execute-code>

	<format>
		<fields>
			<field type="bit" name="ver" longname="Version" mask="0xF0" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="hlen" longname="Header length" comment="The length is in multiple of 4 bytes" mask="0x0F" size="1" showtemplate="FieldMul4Dec"/>
			<field type="fixed" name="tos" longname="Type of service" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="tlen" longname="Total length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="identification" longname="Identification" size="2" showtemplate="FieldDec"/>
			<block name="ffo" longname="Flags and Fragment offset">
				<field type="bit" name="unused" longname="Unused" mask="0x8000" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="df" longname="Don't fragment" mask="0x4000" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="mf" longname="More fragments" mask="0x2000" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="foffset" longname="Fragment offset" comment="This is in multiple of 8 bytes" mask="0x1FFF" size="2" showtemplate="ShortMul8Dec"/>
			</block>
			<field type="fixed" name="ttl" longname="Time to live" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="nextp" longname="Next protocol" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="hchecksum" longname="Header Checksum" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="src" longname="Source address" size="4" showtemplate="ip4addr"/>
			<field type="fixed" name="dst" longname="Destination address" size="4" showtemplate="ip4addr"/>

			<!-- Options loop -->
			<block name="option" longname="IP Options">
				<loop type="size" expr="(buf2int(hlen) * 4) - 20">
					<switch expr="buf2int($packet[$currentoffset:1]) bitwand 0x1F">
						<case value="0"> <includeblk name="IP_OPT_EOL"/> </case>
						<case value="1"> <includeblk name="IP_OPT_NOP"/> </case>
						<case value="2"> <includeblk name="IP_OPT_SEC"/> </case>
						<case value="3"> <includeblk name="IP_OPT_LSR"/> </case>
						<case value="4"> <includeblk name="IP_OPT_TS"/> </case>
						<case value="5"> <includeblk name="IP_OPT_EX_SEC"/> </case>
						<case value="7"> <includeblk name="IP_OPT_RR"/> </case>
						<case value="8"> <includeblk name="IP_OPT_SID"/> </case>
						<case value="9"> <includeblk name="IP_OPT_SSR"/> </case>
						<case value="18"> <includeblk name="IP_OPT_TR"/> </case>
						<case value="20"> <includeblk name="IP_OPT_RA"/> </case>
						<default> <includeblk name="IP_OPT_UNK"/> </default>
					</switch>
				</loop>
			</block>
		</fields>


		<!-- IP options -->
		<block name="IP_OPT_EOL" longname="End of Options List">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="ipv4.opttype">
				<field type="bit" name="copy" longname="Copied flag" mask="0x80" size="1" showtemplate="ipv4.optcopytype"/>
				<field type="bit" name="class" longname="Option Class" mask="0x60" size="1" showtemplate="ipv4.optclass"/>
				<field type="bit" name="number" longname="Option Number" mask="0x1F" size="1" showtemplate="FieldDec"/>
			</field>
			<field type="padding" name="padding" longname="Padding" align="4" showtemplate="FieldHex"/>
		</block>

		<block name="IP_OPT_NOP" longname="No Operation Option">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="ipv4.opttype">
				<field type="bit" name="copy" longname="Copied flag" mask="0x80" size="1" showtemplate="ipv4.optcopytype"/>
				<field type="bit" name="class" longname="Option Class" mask="0x60" size="1" showtemplate="ipv4.optclass"/>
				<field type="bit" name="number" longname="Option Number" mask="0x1F" size="1" showtemplate="FieldDec"/>
			</field>
		</block>

		<block name="IP_OPT_SEC" longname="Security Option">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="ipv4.opttype">
				<field type="bit" name="copy" longname="Copied flag" mask="0x80" size="1" showtemplate="ipv4.optcopytype"/>
				<field type="bit" name="class" longname="Option Class" mask="0x60" size="1" showtemplate="ipv4.optclass"/>
				<field type="bit" name="number" longname="Option Number" mask="0x1F" size="1" showtemplate="FieldDec"/>
			</field>
			<field type="fixed" name="length" longname="Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="sec" longname="Security" size="2" showtemplate="ipv4.secsec"/>
			<field type="fixed" name="comp" longname="Compartments" size="2" showtemplate="ipv4.seccomp"/>
			<field type="fixed" name="hr" longname="Handling Restrictions" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="tcc" longname="Transmission Control Code" size="3" showtemplate="FieldAscii"/>
		</block>

		<block name="IP_OPT_EX_SEC" longname="Extended Security Option">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="ipv4.opttype">
				<field type="bit" name="copy" longname="Copied flag" mask="0x80" size="1" showtemplate="ipv4.optcopytype"/>
				<field type="bit" name="class" longname="Option Class" mask="0x60" size="1" showtemplate="ipv4.optclass"/>
				<field type="bit" name="number" longname="Option Number" mask="0x1F" size="1" showtemplate="FieldDec"/>
			</field>
			<field type="fixed" name="length" longname="Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="asecfc" longname="Additional Security Info Format Code" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="asec" longname="Additional Security Info" expr="buf2int(length) - 3" showtemplate="Field4BytesHex"/>
			<!-- This expression is wrong; we'll check it later -->
		</block>

		<block name="IP_OPT_LSR" longname="Loose Source Routing Option">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="ipv4.opttype">
				<field type="bit" name="copy" longname="Copied flag" mask="0x80" size="1" showtemplate="ipv4.optcopytype"/>
				<field type="bit" name="class" longname="Option Class" mask="0x60" size="1" showtemplate="ipv4.optclass"/>
				<field type="bit" name="number" longname="Option Number" mask="0x1F" size="1" showtemplate="FieldDec"/>
			</field>

			<field type="fixed" name="length" longname="Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="pointer" longname="Pointer" size="1" showtemplate="FieldDec"/>

			<!-- Loop to print the addresses -->
			<block name="LSR_alist" longname="Address list">
				<loop type="size" expr="buf2int(length) - 3">
					<field type="fixed" name="raddr" longname="Router Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="IP_OPT_SSR" longname="Strict Source Routing Option">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="ipv4.opttype">
				<field type="bit" name="copy" longname="Copied flag" mask="0x80" size="1" showtemplate="ipv4.optcopytype"/>
				<field type="bit" name="class" longname="Option Class" mask="0x60" size="1" showtemplate="ipv4.optclass"/>
				<field type="bit" name="number" longname="Option Number" mask="0x1F" size="1" showtemplate="FieldDec"/>
			</field>

			<field type="fixed" name="length" longname="Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="pointer" longname="Pointer" size="1" showtemplate="FieldDec"/>

			<!-- Loop to print the addresses -->
			<block name="SRR_alist" longname="Address list">
				<loop type="size" expr="buf2int(length) - 3">
					<field type="fixed" name="raddr" longname="Router Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="IP_OPT_RR" longname="Record Route Option">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="ipv4.opttype">
				<field type="bit" name="copy" longname="Copied flag" mask="0x80" size="1" showtemplate="ipv4.optcopytype"/>
				<field type="bit" name="class" longname="Option Class" mask="0x60" size="1" showtemplate="ipv4.optclass"/>
				<field type="bit" name="number" longname="Option Number" mask="0x1F" size="1" showtemplate="FieldDec"/>
			</field>

			<field type="fixed" name="length" longname="Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="pointer" longname="Pointer" size="1" showtemplate="FieldDec"/>

			<!-- Loop to print the addresses -->
			<block name="RR_alist" longname="Address list">
				<loop type="size" expr="buf2int(length) - 3">
					<field type="fixed" name="raddr" longname="Router Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="IP_OPT_SID" longname="Stream Identifier Option">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="ipv4.opttype">
				<field type="bit" name="copy" longname="Copied flag" mask="0x80" size="1" showtemplate="ipv4.optcopytype"/>
				<field type="bit" name="class" longname="Option Class" mask="0x60" size="1" showtemplate="ipv4.optclass"/>
				<field type="bit" name="number" longname="Option Number" mask="0x1F" size="1" showtemplate="FieldDec"/>
			</field>
			<field type="fixed" name="length" longname="Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="sid" longname="Stream ID" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="IP_OPT_RA" longname="Router Alert Option">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="ipv4.opttype">
				<field type="bit" name="copy" longname="Copied flag" mask="0x80" size="1" showtemplate="ipv4.optcopytype"/>
				<field type="bit" name="class" longname="Option Class" mask="0x60" size="1" showtemplate="ipv4.optclass"/>
				<field type="bit" name="number" longname="Option Number" mask="0x1F" size="1" showtemplate="FieldDec"/>
			</field>
			<field type="fixed" name="len" longname="Length" comment="The value of this field must be 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="value" longname="Value" size="2" showtemplate="ipv4.optralert"/>
		</block>


		<block name="IP_OPT_TR" longname="Trace Route Option">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="ipv4.opttype">
				<field type="bit" name="copy" longname="Copied flag" mask="0x80" size="1" showtemplate="ipv4.optcopytype"/>
				<field type="bit" name="class" longname="Option Class" mask="0x60" size="1" showtemplate="ipv4.optclass"/>
				<field type="bit" name="number" longname="Option Number" mask="0x1F" size="1" showtemplate="FieldDec"/>
			</field>

			<field type="fixed" name="len" longname="Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="id" longname="ID Number" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="ohc" longname="Outbound Hop Count" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="rhc" longname="Return Hop Count" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="TR_addr" longname="Originator IP Address" size="4" showtemplate="ip4addr-noplg"/>
		</block>


		<block name="IP_OPT_TS" longname="Timestamp Option">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="ipv4.opttype">
				<field type="bit" name="copy" longname="Copied flag" mask="0x80" size="1" showtemplate="ipv4.optcopytype"/>
				<field type="bit" name="class" longname="Option Class" mask="0x60" size="1" showtemplate="ipv4.optclass"/>
				<field type="bit" name="number" longname="Option Number" mask="0x1F" size="1" showtemplate="FieldDec"/>
			</field>

			<field type="fixed" name="length" longname="Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="pointer" longname="Pointer" size="1" showtemplate="FieldDec"/>
			<block name="ovf_flags" longname="Overflow and flag">
				<field type="bit" name="ts_ovf" longname="Overflow" mask="0xF0" size="1" showtemplate="FieldHex"/>
				<field type="bit" name="ts_flag" longname="Flag" mask="0x0F" size="1" showtemplate="ipv4.opttimestamp"/>
			</block>

			<!-- Loop to print the timestamps and addresses -->
			<block name="TS_list" longname="Timestamps">
				<loop type="size" expr="buf2int(length) - 4">
					<switch expr="buf2int(ts_flag)">
						<case value="1">
							<field type="fixed" name="TS_addr" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
							<field type="fixed" name="TS_tstamp" longname="Time Stamp" size="4" showtemplate="FieldDec"/>
						</case>
						<default>
							<field type="fixed" name="TS_tstamp" longname="Time Stamp" size="4" showtemplate="FieldDec"/>
						</default>
					</switch>
				</loop>
			</block>
		</block>

		<!-- Unknown Option, shown if no other options match -->
		<block name="IP_OPT_UNK" longname="Unknown or Unsupported Option">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="ipv4.opttype">
				<field type="bit" name="copy" longname="Copied flag" mask="0x80" size="1" showtemplate="ipv4.optcopytype"/>
				<field type="bit" name="class" longname="Option Class" mask="0x60" size="1" showtemplate="ipv4.optclass"/>
				<field type="bit" name="number" longname="Option Number" mask="0x1F" size="1" showtemplate="FieldDec"/>
			</field>
			<field type="fixed" name="length" longname="Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="OptionData" longname="Option Data" expr="buf2int(length)" showtemplate="Field4BytesHex"/>
		</block>
	</format>


	<encapsulation>
		<if expr="buf2int(foffset) == 0">			
			<if-true>
				<switch expr="buf2int(nextp)">
					<case value="1"> <nextproto proto="#icmp"/> </case>
					<case value="2"> <nextproto proto="#igmp"/> </case>
					<case value="4"> <nextproto proto="#ip"/> </case>
					<case value="6"> <nextproto proto="#tcp"/> </case>
					<case value="17"> <nextproto proto="#udp"/> </case>
					<case value="41"> <nextproto proto="#ipv6"/> </case>
					<case value="47"> <nextproto proto="#gre"/> </case>
					<case value="88"> <nextproto proto="#eigrp"/> </case>
					<case value="89"> <nextproto proto="#ospf"/> </case>
					<case value="103"> <nextproto proto="#pim"/> </case>
					<case value="112"> <nextproto proto="#vrrp"/> </case>

					<case value="9">
						<!-- IGRP has protocol type = 9; EIGRP has 88; however, we can have some EIGRP with 9 (for -->
						<!-- compatibility with IGRP; IGRP is present only if the 'version' bit is equal to '1' -->
						<if expr="(buf2int($packet[$currentoffset:1]) bitwand 0xF0) == 0x10">
							<if-true>
								<nextproto proto="#igrp"/>
							</if-true>
							<if-false>
								<nextproto proto="#eigrp"/>
							</if-false>
						</if>
					</case>
				</switch>
			</if-true>
			<if-false>
				<nextproto proto="#ipfrag"/>
			</if-false>
		</if>
	</encapsulation>


	<visualization>
		<showtemplate name="ipv4.opttype" showtype="dec">	<!-- Option type -->
			<showmap>
				<switch expr="buf2int(this)"> 	
					<case value="0" show="End of Options List"/>
					<case value="1" show="No Operation"/>
					<case value="7" show="Record Route"/>
					<case value="10" show="Experimental Measurement"/>
					<case value="68" show="Time Stamp"/>
					<case value="82" show="Traceroute"/>
					<case value="130" show="Security"/>
					<case value="131" show="Loose Source Routing"/>
					<case value="133" show="Extended Security"/>
					<case value="134" show="Commercial Security"/>
					<case value="136" show="Stream ID"/>
					<case value="137" show="Strict Source Routing"/>
					<case value="142" show="Expermental Access Control"/>
					<case value="144" show="IMI Traffic Descriptor"/>
					<case value="145" show="Extended Internet Protocol"/>
					<case value="147" show="Address Extension"/>
					<case value="148" show="Router Alert"/>
					<case value="149" show="Selective Directed Broadcast"/>
					<case value="150" show="NSAP Addresses"/>
					<case value="151" show="Dynamic Packet State"/>
					<case value="152" show="Upstream Multicast Pkt."/>
					<case value="205" show="Experimental Flow Control"/>
					<default show="Unknown option"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="ipv4.optcopytype" showtype="bin">	<!-- Option Copy type -->
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="not copied into all fragments"/>
					<case value="1" show="copied into all fragments"/>
					<default show="Unknown"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="ipv4.optclass" showtype="bin">	<!-- Option Class type -->
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="control"/>
					<case value="1" show="reserved for future use"/>
					<case value="2" show="debugging and measurement"/>
					<case value="3" show="reserved for future use"/>
					<default show="Unknown"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="ipv4.secsec" showtype="dec">	<!-- Security level -->
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Unclassified"/>
					<case value="61749" show="Confidential"/>
					<case value="30874" show="EFTO"/>
					<case value="48205" show="MMMM"/>
					<case value="24102" show="PROG"/>
					<case value="44819" show="Restricted"/>
					<case value="55176" show="Secret"/>
					<case value="27589" show="Top Secret"/>
					<default show="Unknown"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="ipv4.seccomp" showtype="dec">	<!-- Security Compartment -->
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Not Compartmented"/>
					<default show="Unknown Compartment" comment="Every compartment different from 0 is unknown"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="ipv4.optralert" showtype="dec">	<!-- Routing Alert Value -->
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Router shall examine packet"/>
					<default show="reserved"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="ipv4.opttimestamp" showtype="bin">	<!-- Timestamp Flag -->
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Time stamps only"/>
					<case value="1" show="Time stamps and addresses"/>
					<case value="3" show="Time stamps for prespecified addresses"/>
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="ipv4">
			<if expr="($prevproto == #ip) or ($prevproto == #ipv6) or ($prevproto == #ppp) or ($prevproto == #pppoe) or ($prevproto == #gre)">
				<if-true>
					<text value=" - "/>
				</if-true>
				<if-false>
					<section name="next"/>
				</if-false>
			</if>

			<text value="IP: "/>
			<protofield name="src" showdata="showvalue"/>
			<text value=" => "/>
			<protofield name="dst" showdata="showvalue"/>
			<text value=" (Len "/>
			<protofield name="tlen" showdata="showvalue"/>
			<text value=")"/>
			<if expr="(buf2int(mf) == 1) or (buf2int(foffset) != 0)">
				<if-true>
					<text value=" Fragment " expr="buf2int(foffset)*8"/>

					<!-- the packet ends at: fragment offset * 8 + (total length - header length * 4 - 1) -->
					<text value=":" expr="buf2int(foffset) * 8 + buf2int(tlen) - 1 - buf2int(hlen) * 4"/>
				</if-true>
			</if>
		</showsumtemplate>
	</visualization>
</protocol>


<protocol name="ipfrag" longname="IPv4 Fragment Payload" comment="Fake protocol, that contains the fragmented payload of an IPv4 packet" showsumtemplate="ipfrag">
	<format>
		<fields>
			<field type="variable" name="payload" longname="Data payload" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="ipfrag">
			<text value="IP Fragmented Payload"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="ipv6" longname="IPv6 (Internet Protocol version 6)" showsumtemplate="ipv6">
	<!-- We should check that 'version' is equal to '6' -->
	<execute-code>
		<after>
			<!-- Store ipsrc and ipdst in a couple of variables for the sake of speed -->
			<!-- This aims at hiding differences between IPv4 and IPv6 for session tracking -->
			<assign-variable name="$ipsrc" value="src"/>
			<assign-variable name="$ipdst" value="dst"/>
			
			<if expr="$ipsrc lt $ipdst" >
				<if-true>
					<assign-variable name="$firstip" value="src"/>
					<assign-variable name="$secondip" value="dst"/>
				</if-true>
				<if-false>
					<assign-variable name="$firstip" value="dst"/>
					<assign-variable name="$secondip" value="src"/>
				</if-false>
			</if>
		</after>

		<!-- If we're on Ethernet, update the packet length -->
		<after when="$linklayer == 1">
			<assign-variable name="$packetlength" value="$currentoffset + buf2int(plen)"/>
		</after>
	</execute-code>

	<format>
		<fields>
			<field type="bit" name="ver" longname="Version" mask="0xF0000000" size="4" showtemplate="FieldDec"/>
			<field type="bit" name="tos" longname="Type of service" mask="0x0F000000" size="4" showtemplate="FieldHex"/>
			<field type="bit" name="flabel" longname="Flow label" mask="0x00FFFFFF" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="plen" longname="Payload Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="nexthdr" longname="Next Header" size="1" showtemplate="ipv6.nexthdr"/>
			<field type="fixed" name="hop" longname="Hop limit" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="src" longname="Source address" size="16" showtemplate="ip6addr"/>
			<field type="fixed" name="dst" longname="Destination address" size="16" showtemplate="ip6addr"/>

			<loop type="while" expr="1">
				<!-- Loop until we find a 'break' -->
				<switch expr="buf2int(nexthdr)">
					<case value="0">
						<includeblk name="HBH"/>
					</case>
					<case value="43">
						<includeblk name="RH"/>
					</case>
					<case value="44">
						<includeblk name="FH"/>
					</case>
					<case value="51">
						<includeblk name="AH"/>
					</case>
					<case value="60">
						<includeblk name="DOH"/>
					</case>
					<default>
						<loopctrl type="break"/>
					</default>
				</switch>
			</loop>
		</fields>


		<block name="HBH" longname="Hop By Hop Option">
			<field type="fixed" name="nexthdr" longname="Next Header" size="1" showtemplate="ipv6.nexthdr"/>
			<field type="fixed" name="helen" longname="Length (multiple of 8 bytes, not including the first 8)" size="1" showtemplate="ipv6.hbhlen"/>
			<loop type="size" expr="(buf2int(helen) * 8) + 6">	<!-- '6' because the first two bytes are nexthdr and helen -->
				<includeblk name="Option"/>
			</loop>
		</block>

		<block name="FH" longname="Fragment Header">
			<field type="fixed" name="nexthdr" longname="Next Header" size="1" showtemplate="ipv6.nexthdr"/>
			<field type="fixed" name="reserved" longname="Reserved (multiple of 8 bytes)" comment="This is in multiple of 8 bytes" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="fragment offset" longname="Fragment Offset" mask="0xFFF0" size="2" showtemplate="FieldDec"/>
			<field type="bit" name="res" longname="Res" mask="0x0004" size="2" showtemplate="FieldHex"/>
			<field type="bit" name="m" longname="M" mask="0x0001" size="2" showtemplate="FieldBin"/>
			<field type="fixed" name="identification" longname="Identification" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="AH" longname="Authentication Header">
			<field type="fixed" name="nexthdr" longname="Next Header" size="1" showtemplate="ipv6.nexthdr"/>
			<field type="fixed" name="payload len" longname="Payload Len" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="reserved" longname="Reserved" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="spi" longname="Security Parameters Index" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="snf" longname="Sequence Number Field" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="DOH" longname="Destination Option Header">
			<field type="fixed" name="nexthdr" longname="Next Header" size="1" showtemplate="ipv6.nexthdr"/>
			<field type="fixed" name="helen" longname="Length (multiple of 8 bytes, not including the first 8)" size="1" showtemplate="ipv6.hbhlen"/>
			<loop type="size" expr="(buf2int(helen) * 8)+6"> <!-- '6' because the first two bytes are nexthdr and helen -->
				<includeblk name="Option"/>
			</loop>
		</block>

		<block name="RH" longname="Routing Header">
			<field type="fixed" name="nexthdr" longname="Next Header" size="1" showtemplate="ipv6.nexthdr"/>
			<field type="fixed" name="hlen" longname="Length (multiple of 8 bytes)" comment="This is in multiple of 8 bytes" size="1" showtemplate="FieldDec"/>	
			<field type="fixed" name="rtype" longname="Routing Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="segment left" longname="Segment Left" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="res" longname="Reserved (must be zero)" size="4" showtemplate="FieldDec"/>

			<switch expr="buf2int(rtype)">
				<case value="0">
					<loop type="times2repeat" expr="(buf2int(hlen) div 2)">
						<field type="fixed" name="address" longname="Address" size="16" showtemplate="ip6addr"/>
					</loop>
				</case>
				<default>
					<field type="variable" name="tsd" longname="Type Specific Data" expr="(buf2int(hlen) * 8)" showtemplate="Field4BytesHex"/>
				</default>
			</switch>
		</block>


		<block name="Option" longname="Option">
			<field type="fixed" name="opttype" longname="Option Type" size="1" showtemplate="ipv6.opttype">
				<field type="bit" name="act" longname="Action (action if Option Type is unrecognized)" mask="0xC0" size="1" showtemplate="ipv6.optact"/> 
				<field type="bit" name="chg" longname="Change (whether or not option data can change while packet is en-route)" mask="0x20" size="1" showtemplate="ipv6.optchg"/> 
				<field type="bit" name="res" longname="Option Code" mask="0x1F" size="1" showtemplate="FieldDec"/> 
			</field>

			<switch expr="buf2int(opttype)">
				<case value="0">
					<!-- No fields are present if the option is not 'Pad1'-->
				</case>

				<case value="5">	<!-- Router Alert -->
					<field type="fixed" name="optlen" longname="Option Length" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="value" size="2" longname="Option Value" showtemplate="ipv6.optroutalert"/>
				</case>

				<default>
					<field type="fixed" name="optlen" longname="Option Length" size="1" showtemplate="FieldDec"/>
					<field type="variable" name="optval" longname="Option Value" expr="buf2int(optlen)" showtemplate="Field4BytesHex"/>
				</default>
			</switch>
		</block>
	</format>


	<encapsulation>
		<switch expr="buf2int(nexthdr)">
			<case value="4"> <nextproto proto="#ip"/> </case>
			<case value="6"> <nextproto proto="#tcp"/> </case>
			<case value="17"> <nextproto proto="#udp"/> </case>
<!--			<case value="29"> <nextproto proto="#TP4"/> </case> -->
<!--			<case value="45"> <nextproto proto="#IDRP"/> </case> -->
			<case value="50"> <nextproto proto="#esp"/> </case>
			<case value="58"> <nextproto proto="#icmp6"/> </case>
			<case value="89"> <nextproto proto="#ospf6"/> </case>
			<case value="103"> <nextproto proto="#pim6"/> </case>
		</switch>
	</encapsulation>


	<visualization>
		<showtemplate name="ipv6.nexthdr" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Hop By Hop Option Header"/>
					<case value="43" show="Fragment Header"/>
					<case value="44" show="Authentication Header"/>
					<case value="51" show="Destination Option Header"/>
					<case value="60" show="Routing Header"/>
					<case value="50" show="Encapsulating Security Payload"/>
					<case value="58" show="Internet Control Message Protocol (ICMPv6)"/>
					<case value="59" show="No next Header"/>
					<default show="Upper Layer Header"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="ipv6.opttype" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Pad1 Option"/>
					<case value="1" show="PadN Option"/>
					<case value="5" show="Router Alert Option"/>
					<default show="Error in IPv6 Option Type lookup"/> 
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="ipv6.optact" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Skip over option"/>
					<case value="1" show="Discard packet silently"/>
					<case value="2" show="Discard packet and send ICMP"/>
					<case value="3" show="Discard packet and send ICMP if packet was unicast"/>
					<default show="Error in IPv6 Option Action lookup"/> 
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="ipv6.optchg" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Option data does not change en-route"/>
					<case value="1" show="Option data may change en-route"/>
					<default show="Error in IPv6 Option Change lookup"/> 
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="ipv6.optroutalert" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Datagram contains a Multicast Listener Discovery message"/>
					<case value="1" show="Datagram contains RSVP message"/>
					<case value="2" show="Datagram contains an Active Networks message"/> 
					<default show="Error in IPv6 Router Alert Option lookup"/> 
				</switch>
			</showmap>
		</showtemplate>


		<!-- Length of the hop by hop option header -->
		<showtemplate name="ipv6.hbhlen" showtype="dec">
			<showdtl>
				<text expr="(buf2int(this) * 8) + 8"/>
				<text value=" (field value = "/>
				<protofield showdata="showvalue"/>
				<text value=")"/>
			</showdtl>
		</showtemplate>


		<showsumtemplate name="ipv6">
			<if expr="($prevproto == #ip) or ($prevproto == #ipv6) or ($prevproto == #ppp) or ($prevproto == #pppoe) or ($prevproto == #gre)">
				<if-true>
					<text value=" - "/>
				</if-true>
				<if-false>
					<section name="next"/>
				</if-false>
			</if>

			<text value="IPv6: "/>
			<protofield name="src" showdata="showvalue"/>
			<text value=" => "/>
			<protofield name="dst" showdata="showvalue"/>
			<text value=" (Len " expr="buf2int(plen) + 40"/>
			<text value=")"/>
		</showsumtemplate>
	</visualization>

</protocol>

<protocol name="icmp6" longname="ICMPv6 (Internet Control Message Protocol version 6)" showsumtemplate="icmp6">
	<format>
		<fields>
			<!-- The first three fields are common for every ICMPv6 message -->
			<!-- 'Code' ad 'Checksum' are common among all the headers; however the meaning of the 'Code' is different -->
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="icmp6.type"/>

			<switch expr="buf2int(type)">
				<!-- Error messages -->
				<case value="1">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="icmp6.code1"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="Error"/>
				</case>
				<case value="2">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="Error"/>
				</case>
				<case value="3">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="icmp6.code3"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="Error"/>
				</case>
				<case value="4">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="icmp6.code4"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="Error"/>
				</case>

				<!-- Informational messages -->
				<case value="128">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="Echo"/>
				</case>
				<case value="129">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="Echo"/>
				</case>

				<!-- Group Management messages -->
				<case value="130">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="Group"/>
				</case>
				<case value="131">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="Group"/>
				</case>
				<case value="132">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="Group"/>
				</case>

				<!-- Router / Neighbor Advertisement / Solicitation -->
				<case value="133">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="RoutSol"/>
				</case>
				<case value="134">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="RoutAdv"/>
				</case>
				<case value="135">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="NeighSol"/>
				</case>
				<case value="136">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="NeighAdv"/>
				</case>
		
				<!-- Other messages -->
				<case value="137">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="Redir"/>
				</case>
		
				<case value="138">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="icmp6.code138"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="RoutRen"/>
				</case>
		
				<case value="141">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="INDS"/>
				</case>
		
				<case value="142">
					<field type="fixed" name="code" longname="Code" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
					<includeblk name="INDA"/>
				</case>
			</switch>
		</fields>

		<block name="Error" longname="Error Packet">
			<field type="fixed" name="unused" size="4" longname="Unused" showtemplate="FieldHex"/>
			<!-- Here you can find the fragment of the IPv6 packet that caused the error -->
		</block>

		<block name="Echo" longname="Echo Packet">
			<field type="fixed" name="id" size="2" longname="Identifier" showtemplate="FieldDec"/>
			<field type="fixed" name="sequence_number" size="2" longname="Sequence Number" showtemplate="FieldDec"/>
			<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
		</block>

		<block name="Group" longname="Group Membership">
			<field type="fixed" name="maximum_response_delay" size="2" longname="Maximum Response Delay" showtemplate="FieldDec"/>
			<field type="fixed" name="unused" size="2" longname="unused" showtemplate="FieldDec"/>
			<field type="fixed" name="multicast_address" longname="Multicast Address" size="16" showtemplate="ip6addr-noplg"/>
		</block>

		<block name="RoutSol" longname="Router Solicitation">
			<field type="fixed" name="reserved" longname="Reserved" size="4" showtemplate="FieldDec"/>
			<loop type="size" expr="$packetlength - $currentoffset">
				<includeblk name="NDO"/>
			</loop>
		</block>

		<block name="RoutAdv" longname="Router Advertisement">
			<field type="fixed" name="cur_hop_limit" longname="Current Hop Limit" size="1" showtemplate="FieldDec"/>
			<block name="flags" longname="Flags">
				<field type="bit" name="managed_address_configuration" mask="0x80" size="1" longname="Managed Address Configuration" showtemplate="FieldBin"/>
				<field type="bit" name="other_stateful_configuration" mask="0x40" size="1" longname="Other Stateful Configuration" showtemplate="FieldBin"/>
				<field type="bit" name="reserved" mask="0x3F" size="1" longname="Reserved" showtemplate="FieldBin"/>
			</block>
			<field type="fixed" name="router_lifetime" size="2" longname="Router Lifetime" showtemplate="FieldDec"/>
			<field type="fixed" name="reachable_time" size="4" longname="Reachable Time" showtemplate="FieldDec"/>
			<field type="fixed" name="retrans_time" size="4" longname="Retransmission Time" showtemplate="FieldDec"/>
			<loop type="size" expr="$packetlength - $currentoffset">
				<includeblk name="NDO"/>
			</loop>
		</block>

		<block name="NeighSol" longname="Neighbor Solicitation" showsumtemplate="icmp6.neighsol">
			<field type="fixed" size="4" name="reserved" longname="Reserved" showtemplate="FieldDec"/>
			<field type="fixed" name="target_address" longname="Target Address" size="16" showtemplate="ip6addr-noplg"/>
			<loop type="size" expr="$packetlength - $currentoffset">
				<includeblk name="NDO"/>
			</loop>
		</block>

		<block name="NeighAdv" longname="Neighbor Advertisement" showsumtemplate="icmp6.neighadv">>
			<block name="flags" longname="Flags">
				<field type="bit" name="router_flag" mask="0x80000000" size="4" longname="Router Flag" showtemplate="FieldBin"/>
				<field type="bit" name="solicited_flag" mask="0x40000000" size="4" longname="Solicited Flag" showtemplate="FieldBin"/>
				<field type="bit" name="override_flag" mask="0x20000000" size="4" longname="Override Flag" showtemplate="FieldBin"/>
				<field type="bit" name="reserved" mask="0x1FFFFFFF" size="4" longname="Reserved" showtemplate="FieldBin"/>
			</block>
			<field type="fixed" name="target_address" longname="Target Address" size="16" showtemplate="ip6addr-noplg"/>
			<loop type="size" expr="$packetlength - $currentoffset">
				<includeblk name="NDO"/>
			</loop>
		</block>

		<block name="Redir" longname="Redirect">
			<field type="fixed" name="reserved" longname="Reserved" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="target_address" longname="Target Address" size="16" showtemplate="ip6addr-noplg"/>
			<field type="fixed" name="destination_address" longname="Destination Address" size="4" showtemplate="ip6addr-noplg"/>
			<loop type="size" expr="$packetlength - $currentoffset">
				<includeblk name="NDO"/>
			</loop>
		</block>

		<block name="RoutRen" longname="Router Renumbering">
			<field type="fixed" name="sequence_number" size="4" longname="Sequence Number" showtemplate="FieldDec"/>
			<field type="fixed" name="segment_number" longname="Segment Number" size="1" showtemplate="FieldDec"/>
			<block name="flags" longname="Flags">
				<field type="bit" name="test_command" mask="0x80" size="1" longname="Test Command" showtemplate="FieldBin"/>
				<field type="bit" name="result_requested" mask="0x40" size="1" longname="Result Requested" showtemplate="FieldBin"/>
				<field type="bit" name="all_interfaces" mask="0x20" size="1" longname="All Interfaces" showtemplate="FieldBin"/>
				<field type="bit" name="site_specific" mask="0x10" size="1" longname="Site Specific" showtemplate="FieldBin"/>
				<field type="bit" name="processed_previously" mask="0x08" size="1" longname="Processed Previously" showtemplate="FieldBin"/>
				<field type="bit" name="reserved" mask="0x07" size="1" longname="Reserved" showtemplate="FieldBin"/>
			</block>
			<field type="fixed" name="maximum_delay" size="2" longname="Maximum Delay" showtemplate="FieldDec"/>
			<field type="fixed" name="reserved" size="4" longname="Reserved" showtemplate="FieldHex"/>
			<loop type="size" expr="$packetlength - $currentoffset">
				<includeblk name="RR_command" type="continue" longname="Router Renumbering Command"/>
				<includeblk name="RR_result" type="continue" longname="Router Renumbering Result"/>
			</loop>
		</block>

		<block name="INDS" longname="Inverse Neighbor Discovery Solicitation">
			<field type="fixed" name="reserved" size="4" longname="Reserved" showtemplate="FieldDec"/>
			<loop type="size" expr="$packetlength - $currentoffset">
				<includeblk name="NDO"/>
			</loop>
		</block>

		<block name="INDA" longname="Inverse Neighbor Discovery Advertisement">
			<field type="fixed" name="reserved" size="4" longname="Reserved" showtemplate="FieldDec"/>
			<loop type="size" expr="$packetlength - $currentoffset">
				<includeblk name="NDO"/>
			</loop>
		</block>


		<!-- Common Options; these are called several times from within other options -->
<!--
		<block name="NDO" longname="Neighbor Discovery Option" showtemplate="icmp6.ndo">
-->
		<block name="NDO" longname="Neighbor Discovery Option">
			<field type="fixed" name="ndotype" longname="Type" size="1" showtemplate="icmp6.ndotype"/>
			<field type="fixed" name="length" longname="Length" size="1" showtemplate="FieldDec"/>

			<switch expr="buf2int(ndotype)">
				<case value="1" name="source_link_layer_address" longname="Source Link Layer Address">
					<field type="fixed" name="link_layer_address" longname="Link Layer Address" size="6" showtemplate="MAC-dash"/>
				</case>

				<case value="2" name="target_link_layer_address" longname="Target Link Layer Address">
					<field type="fixed" name="link_layer_address" longname="Link Layer Address" size="6" showtemplate="MAC-dash"/>
				</case>

				<case value="3" name="prefix_information" longname="Prefix Information">
					<field type="fixed" name="prefix_length" longname="Prefix Length" size="1" showtemplate="FieldDec"/>
					<block name="flags" longname="Flags">
						<field type="bit" name="L" mask="0x80" size="1" longname="On-link" showtemplate="FieldBin"/>
						<field type="bit" name="A" mask="0x40" size="1" longname="Autonomous address-configuration" comment="Can be used as a prefix for interface auto-configuration" showtemplate="FieldBin"/>
						<field type="bit" name="reserved_1" mask="0x3F" size="1" longname="Reserved" showtemplate="FieldBin"/>
					</block>
					<field type="fixed" name="valid_lifetime" size="4" longname="Valid Lifetime" showtemplate="FieldDec"/>
					<field type="fixed" name="preferred_lifetime" size="4" longname="Preferred Lifetime" showtemplate="FieldDec"/>
					<field type="fixed" name="reserved_2" size="4" longname="Reserved" showtemplate="FieldDec"/>
					<field type="fixed" name="prefix" longname="Prefix" size="16" showtemplate="ip6addr-noplg"/>
				</case>

				<case value="4" name="redirect_header" longname="Redirect Header">
					<field type="fixed" name="reserved" size="6" longname="Reserved" showtemplate="FieldDec"/>
					<!-- Here you can find the IPv6 original packet -->
				</case>

				<case value="5" name="MTU" longname="MTU Option">
					<field type="fixed" name="reserved" size="2" longname="Reserved" showtemplate="FieldDec"/>
					<field type="fixed" name="MTU" size="4" longname="MTU (Maximum Transfer Unit)" showtemplate="FieldDec"/>
				</case>

				<case value="9" name="source_address_list" longname="Source Address List">
					<field type="fixed" name="reserved" size="6" longname="Reserved" showtemplate="FieldDec"/>
					<loop type="times2repeat" expr="(buf2int(length) - 1) div 2">
						<field type="fixed" name="IPv6_address" longname="IPv6 Address" size="16" showtemplate="ip6addr-noplg"/>
					</loop>
				</case>

				<case value="10" name="target_address_list" longname="Target Address List">
					<field type="fixed" name="reserved" size="6" longname="Reserved" showtemplate="FieldDec"/>
					<loop type="times2repeat" expr="(buf2int(length) - 1) div 2">
						<field type="fixed" name="IPv6_address" longname="IPv6 Address" size="16" showtemplate="ip6addr-noplg"/>
					</loop>
				</case>
			</switch>
		</block>

		<block name="RR_command" longname="Router Renumbering Command">
			<field type="fixed" name="opcode" longname="Opcode" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="oplength" longname="Oplength" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="ordinal" longname="Ordinal" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="matchlength" longname="Match Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="minlength" longname="Minimum Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="maxlength" longname="Maximum Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="reserved" size="2" longname="Reserved" showtemplate="FieldHex"/>
			<field type="fixed" name="match-prefix" longname="Match-Prefix" size="16" showtemplate="ip6addr-noplg"/>

			<block name="use-prefix_part" longname="Use-Prefix Part">
				<loop type="times2repeat" expr="(buf2int(oplength) - 3) div 2">
					<field type="fixed" name="uselength" longname="Use Length" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="keeplength" longname="Keep Length" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="flagmask" longname="Flagmask" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="RAFlags" longname="RA Flags" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="valid_lifetime" size="4" longname="Valid Lifetime" showtemplate="FieldDec"/>
					<field type="fixed" name="preferred_lifetime" size="4" longname="Preferred Lifetime" showtemplate="FieldDec"/>
					<block name="flags" longname="Flags">
						<field type="bit" name="V" mask="0x80000000" size="4" longname="V" showtemplate="FieldBin"/>
						<field type="bit" name="P" mask="0x40000000" size="4" longname="P" showtemplate="FieldBin"/>
						<field type="bit" name="reserved" mask="0x3FFFFFFF" size="4" longname="Reserved" showtemplate="FieldBin"/>
					</block>
					<field type="fixed" name="userprefix" longname="User Prefix" size="16" showtemplate="ip6addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="RR_result" longname="Router Renumbering Result">
			<block name="flags" longname="Flags">
				<field type="bit" name="reserved" mask="0xFFFC" size="2" longname="Reserved" showtemplate="FieldBin"/>
				<field type="bit" name="B" mask="0x0002" size="2" longname="B" showtemplate="FieldBin"/>
				<field type="bit" name="F" mask="0x0001" size="2" longname="F" showtemplate="FieldBin"/>
			</block>
			<field type="fixed" name="ordinal" longname="Ordinal" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="matchedlength" longname="Matched Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="interfaceindex" size="4" longname="Interface Index" showtemplate="FieldDec"/>
			<field type="fixed" name="matchedprefix" longname="Matched Prefix" size="16" showtemplate="ip6addr-noplg"/>
		</block>
	</format>


	<encapsulation>
		<!-- Just in case; if the ICMPv6 has still data, this will be the IPv6 packet generating the error -->
		<nextproto proto="#ipv6"/>
	</encapsulation>

	<visualization>
		<showtemplate name="icmp6.type" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Destination Unreachable"/>
					<case value="2" show="Packet Too Big"/>
					<case value="3" show="Time Exceeded"/>
					<case value="4" show="Parameter Problem"/>
					<case value="128" show="Echo Request"/>
					<case value="129" show="Echo Reply"/>
					<case value="130" show="Group Membership Query"/>
					<case value="131" show="Group Membership Report"/>
					<case value="132" show="Group Membership Reduction"/>
					<case value="133" show="Router Solicitation"/>
					<case value="134" show="Router Advertisement"/>
					<case value="135" show="Neighbor Solicitation"/>
					<case value="136" show="Neighbor Advertisement"/>
					<case value="137" show="Redirect"/>
					<case value="138" show="Router Renumbering"/>
					<case value="141" show="Inverse Neighbor Discovery Solicitation"/>
					<case value="142" show="Inverse Neighbor Discovery Advertisement"/>
					<default show="Error in ICMP6 type lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="icmp6.code1" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="No Route To Destination"/>
					<case value="1" show="Communication With Destination Administratively Prohibited"/>
					<case value="2" show="Not A Neighbor"/>
					<case value="3" show="Address Unreachable"/>
					<case value="4" show="Port Unreachable"/>
					<default show="Error in ICMP6 Code 1 lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="icmp6.code3" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Hop Limit Exceeded In Transit"/>
					<case value="1" show="Fragment Reassembly Time Exceeded"/>
					<default show="Error in ICMP6 Code 3 lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="icmp6.code4" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Erroneous Header Field"/>
					<case value="1" show="Unrecognized Next Header"/>
					<case value="2" show="Unrecognized IPv6 Option"/>
					<default show="Error in ICMP6 Code 4 lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="icmp6.code138" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Router Renumbering Command"/>
					<case value="1" show="Router Renumbering Result"/>
					<case value="255" show="Sequence Number Reset"/>
					<default show="Error in ICMP6 Code 138 lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="icmp6.ndotype" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Source Link Layer Address"/>
					<case value="2" show="Target Link Layer Address"/>
					<case value="3" show="Prefix Information"/>
					<case value="4" show="Redirect Header"/>
					<case value="5" show="MTU"/>
					<case value="6" show="NBMA Shortcut Limit Option"/>
					<case value="7" show="Advertisement Interval"/>
					<case value="8" show="Home Agent Information"/>
					<case value="9" show="Source Address List"/>
					<case value="10" show="Target Address List"/>
					<default show="Error in ICMP6 NDO Type lookup"/> 
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="icmp6">
			<section name="next"/>
			<text value="ICMP6: "/>
			<protofield name="type" showdata="showmap"/>
			<if expr="(buf2int(type) == 1) or (buf2int(type) == 3) or (buf2int(type) == 4) or (buf2int(type) == 138)">
				<!-- In this case, print the 'code' as well -->				
				<if-true>
					<text value=" ("/>
					<protofield name="code" showdata="showmap"/>
					<text value=")"/>
				</if-true>
			</if>
		</showsumtemplate>

		<showsumtemplate name="icmp6.neighsol">
			<text value=": who has "/>
			<protofield name="target_address" showdata="showvalue"/>
			<if expr="ispresent(link_layer_address)">
				<if-true>
					<!-- Source MA address is optional -->
					<text value="? I am at "/>
					<protofield name="link_layer_address" showdata="showvalue"/>
				</if-true>
				<if-false>
					<text value="?"/>
				</if-false>
			</if>
		</showsumtemplate>

		<showsumtemplate name="icmp6.neighadv">
			<text value=": I am "/>
			<protofield name="target_address" showdata="showvalue"/>
			<text value=" at "/>
			<protofield name="link_layer_address" showdata="showvalue"/>
		</showsumtemplate>

<!--
		<showtemplate name="icmp6.ndo">
			<protofield name="NDO" showdata="longname"/>
			<text value=" "/>
			<protofield name="ndotype" showdata="showmap"/>
		</showsumtemplate>
-->
	</visualization>
	
</protocol>
<protocol name="dns" longname="DNS (Domain Name System)" showsumtemplate="dns">
	<format>
		<fields>
			<field type="fixed" name="ID" size="2" longname="Identifier" showtemplate="FieldDec"/>
			<block name="flags" longname="Flags">
				<field type="bit" name="Query" mask="0x8000" size="2" longname="Message type" showtemplate="dns.query"/>
				<field type="bit" name="Opcode" mask="0x7800" size="2" longname="Type of query" showtemplate="dns.opcode"/>
				<field type="bit" name="AuthAnsw" mask="0x0400" size="2" longname="Authoritative answer" showtemplate="FieldBin"/>
				<field type="bit" name="Truncation" mask="0x0200" size="2" longname="Truncation" showtemplate="FieldBin"/>
				<field type="bit" name="Recursive" mask="0x0100" size="2" longname="Recursion desired" showtemplate="FieldBin"/>
				<field type="bit" name="AvlRecur" mask="0x0080" size="2" longname="Recursion available" showtemplate="FieldBin"/>
				<field type="bit" name="checking" mask="0x0070" size="2" longname="Checking disabled" showtemplate="FieldBin"/>
				<field type="bit" name="RCode" mask="0x000F" size="2" longname="Response code" showtemplate="dns.rcode"/>
			</block>		
			
			<field type="fixed" name="QuestionCount" size="2" longname="Number of questions" showtemplate="FieldDec"/>
			<field type="fixed" name="AnswerCount" size="2" longname="Number of answers" showtemplate="FieldDec"/>
			<field type="fixed" name="NameServerCount" size="2" longname="Number of name server resource records" showtemplate="FieldDec"/>
			<field type="fixed" name="AdditionalCount" size="2" longname="Number of additional resource records" showtemplate="FieldDec"/>

			<block name="QuestionsLoop" longname="Question Records">
				<loop type="times2repeat" expr="buf2int(QuestionCount)">
					<includeblk name="Question"/>
				</loop>
			</block>

			<block name="AnswersLoop" longname="Answer Records">
				<loop type="times2repeat" expr="buf2int(AnswerCount)">
					<includeblk name="Answer"/>
				</loop>
			</block>

			<block name="NSRRLoop" longname="Name Server Resource Records">
				<loop type="times2repeat" expr="buf2int(NameServerCount)">
					<includeblk name="NameServerResourceRecord"/>
				</loop>
			</block>

			<block name="ARRLoop" longname="Additional Resource Records">
				<loop type="times2repeat" expr="buf2int(AdditionalCount)">
					<includeblk name="AdditionalResourceRecord"/>
				</loop>
			</block>
		</fields>

		<block name="Question" longname="Question">
			<field type="plugin" name="dname" longname="Domain Name" plugin="DomainName" showtemplate="dns.dname"/>
			<field type="fixed" name="qtype" size="2" longname="Question type" showtemplate="dns.type"/>
			<field type="fixed" name="qclass" size="2" longname="Question class" showtemplate="dns.class"/>
		</block>

		<block name="Answer" longname="Answer">
			<field type="plugin" name="dname" longname="Domain Name" plugin="DomainName" showtemplate="dns.dname"/>
		 	<field type="fixed" name="type" size="2" longname="Answer type" showtemplate="dns.type"/>
			<field type="fixed" name="class" size="2" longname="Answer class" showtemplate="dns.class"/>
			<field type="fixed" name="ttl" size="4" longname="Time to live" showtemplate="FieldDec"/>
			<field type="fixed" name="rdlength" size="2" longname="Resource data length" showtemplate="FieldDec"/>

			<switch expr="buf2int(type)">
				<case value="1"> <field type="fixed" name="ip4addr" longname="IPv4 address" size="4" showtemplate="ip4addr-noplg"/> </case>	
				<case value="2"> <field type="variable" name="nameserver" longname="Name server" expr="buf2int(rdlength)" showtemplate="dns.dname"/> </case>	
				<case value="3"> <includeblk name="MD"/> </case>	
				<case value="4"> <includeblk name="MF"/> </case>	
				<case value="5"> <field type="variable" name="cname" longname="Canonical name" expr="buf2int(rdlength)" showtemplate="dns.dname"/> </case>
				<case value="6"> <includeblk name="SOA"/> </case>	
				<case value="7"> <includeblk name="MB"/> </case>	
				<case value="8"> <includeblk name="MG"/> </case>	
				<case value="9"> <includeblk name="MR"/> </case>	
				<case value="10"> <field type="variable" name="null" longname="NULL" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/> </case>
				<case value="11"> <includeblk name="WKS"/> </case>
				<case value="12"> <field type="variable" name="ptrname" longname="Domain name" expr="buf2int(rdlength)" showtemplate="dns.dname"/> </case>
				<case value="13"> <includeblk name="HINFO"/> </case>	
				<case value="14"> <includeblk name="MINFO"/> </case>	
				<case value="15"> <includeblk name="MX"/> </case>	
				<case value="16"> <includeblk name="TXT"/> </case>
				<case value="28"> <field type="fixed" name="ip6addr" longname="IPv6 address" size="16" showtemplate="ip6addr"/> </case>	
				<case value="33"> <includeblk name="SRV"/> </case>
				<case value="35"> <includeblk name="NAPTR"/> </case>
				<case value="38"> <includeblk name="A6"/> </case>
				<default> <field type="variable" name="rddata" longname="Resource Data" expr="buf2int(rdlength)" showtemplate="Field4BytesHex"/> </default>
			</switch>			
		</block>

		<block name="NameServerResourceRecord" longname="NS Resource Record">
			<field type="plugin" name="dname" longname="Domain Name" plugin="DomainName" showtemplate="dns.dname"/>		
		 	<field type="fixed" name="type" size="2" longname="Answer type" showtemplate="dns.type"/>
			<field type="fixed" name="class" size="2" longname="Answer class" showtemplate="dns.class"/>
			<field type="fixed" name="ttl" size="4" longname="Time to live" showtemplate="FieldDec"/>
			<field type="fixed" name="rdlength" size="2" longname="Resource data length" showtemplate="FieldDec"/>

			<switch expr="buf2int(type)">
				<case value="1"> <field type="fixed" name="ip4addr" longname="IPv4 address" size="4" showtemplate="ip4addr-noplg"/> </case>	
				<case value="2"> <field type="variable" name="nameserver" longname="Name server" expr="buf2int(rdlength)" showtemplate="dns.dname"/> </case>	
				<case value="3"> <includeblk name="MD"/> </case>	
				<case value="4"> <includeblk name="MF"/> </case>	
				<case value="5"> <field type="variable" name="cname" longname="Canonical name" expr="buf2int(rdlength)" showtemplate="dns.dname"/> </case>
				<case value="6"> <includeblk name="SOA"/> </case>	
				<case value="7"> <includeblk name="MB"/> </case>	
				<case value="8"> <includeblk name="MG"/> </case>	
				<case value="9"> <includeblk name="MR"/> </case>	
				<case value="10"> <field type="variable" name="null" longname="NULL" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/> </case>
				<case value="11"> <includeblk name="WKS"/> </case>
				<case value="12"> <field type="variable" name="ptrname" longname="Domain name" expr="buf2int(rdlength)" showtemplate="dns.dname"/> </case>
				<case value="13"> <includeblk name="HINFO"/> </case>	
				<case value="14"> <includeblk name="MINFO"/> </case>	
				<case value="15"> <includeblk name="MX"/> </case>	
				<case value="16"> <includeblk name="TXT"/> </case>	
				<case value="28"> <field type="fixed" name="ip6addr" longname="IPv6 address" size="16" showtemplate="ip6addr"/> </case>	
				<case value="33"> <includeblk name="SRV"/> </case>
				<case value="35"> <includeblk name="NAPTR"/> </case>
				<case value="38"> <includeblk name="A6"/> </case>
				<default> <field type="variable" name="rddata" longname="Resource Data" expr="buf2int(rdlength)" showtemplate="Field4BytesHex"/> </default>
			</switch>			
		</block>	

		<block name="AdditionalResourceRecord" longname="Additional Resource Records">
			<field type="plugin" name="dname" longname="Domain Name" plugin="DomainName" showtemplate="dns.dname"/>
		 	<field type="fixed" name="type" size="2" longname="Answer type" showtemplate="dns.type"/>
			<field type="fixed" name="class" size="2" longname="Answer class" showtemplate="dns.class"/>
			<field type="fixed" name="ttl" size="4" longname="Time to live" showtemplate="FieldDec"/>
			<field type="fixed" name="rdlength" size="2" longname="Resource data length" showtemplate="FieldDec"/>

			<switch expr="buf2int(type)">
				<!-- For a ,ist of types, check http://www.networksorcery.com/enp/protocol/dns.htm#Answer%20RRs -->
				<case value="1"> <field type="fixed" name="ip4addr" longname="IPv4 address" size="4" showtemplate="ip4addr-noplg"/> </case>	
				<case value="2"> <field type="variable" name="nameserver" longname="Name server" expr="buf2int(rdlength)" showtemplate="dns.dname"/> </case>	
				<case value="3"> <includeblk name="MD"/> </case>	
				<case value="4"> <includeblk name="MF"/> </case>	
				<case value="5"> <field type="variable" name="cname" longname="Canonical name" expr="buf2int(rdlength)" showtemplate="dns.dname"/> </case>
				<case value="6"> <includeblk name="SOA"/> </case>	
				<case value="7"> <includeblk name="MB"/> </case>	
				<case value="8"> <includeblk name="MG"/> </case>	
				<case value="9"> <includeblk name="MR"/> </case>	
				<case value="10"> <field type="variable" name="null" longname="NULL" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/> </case>
				<case value="11"> <includeblk name="WKS"/> </case>
				<case value="12"> <field type="variable" name="ptrname" longname="Domain name" expr="buf2int(rdlength)" showtemplate="dns.dname"/> </case>
				<case value="13"> <includeblk name="HINFO"/> </case>	
				<case value="14"> <includeblk name="MINFO"/> </case>	
				<case value="15"> <includeblk name="MX"/> </case>	
				<case value="16"> <includeblk name="TXT"/> </case>	
				<case value="28"> <field type="fixed" name="ip6addr" longname="IPv6 address" size="16" showtemplate="ip6addr"/> </case>	
				<case value="33"> <includeblk name="SRV"/> </case>
				<case value="35"> <includeblk name="NAPTR"/> </case>
				<case value="38"> <includeblk name="A6"/> </case>
				<default> <field type="variable" name="rddata" longname="Resource Data" expr="buf2int(rdlength)" showtemplate="Field4BytesHex"/> </default>
			</switch>			
		</block>

		<block name="A6" longname="A6 Resource Record">
			<field type="fixed" name="prefixlen" size="1" longname="Prefix length" showtemplate="FieldDec"/>
			<field type="variable" name="suffix" longname="Address suffix" expr="(buf2int(prefixlen) + 7) div 8" showtemplate="FieldAscii"/>
			
			<if expr="(buf2int(prefixlen) != 0) and (buf2int(prefixlen) != 128)">
				<if-true>
					<field type="plugin" name="dname" longname="Domain Name" plugin="DomainName" showtemplate="dns.dname"/>
				</if-true>
			</if>
		</block>

		<block name="HINFO" longname="HINFO Resource Record">
			<field type="fixed" name="cpulen" longname="CPU string length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="CPU" description="CPU type" longname="CPU type" expr="buf2int(cpulen)" showtemplate="FieldAscii"/>
			<field type="fixed" name="oslen" longname="OS string length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="OS" description="Operating System" longname="Operating system" expr="buf2int(oslen)" showtemplate="FieldAscii"/>			
		</block>

		<block name="MB" longname="MB Resource Record">
			<field type="plugin" name="dname" longname="Domain Name" plugin="DomainName" showtemplate="dns.dname"/>
		</block>

		<block name="MD" longname="MD Resource Record">
			<field type="plugin" name="dname" longname="Domain Name" plugin="DomainName" showtemplate="dns.dname"/>
		</block>

		<block name="MF" longname="MF Resource Record">
			<field type="plugin" name="dname" longname="Domain Name" plugin="DomainName" showtemplate="dns.dname"/>
		</block>

		<block name="MG" longname="MG Resource Record">
			<field type="plugin" name="dname" longname="Domain Name" plugin="DomainName" showtemplate="dns.dname"/>
		</block>

		<block name="MINFO" longname="MINFO Resource Record">
			<field type="plugin" name="RMAILBX" longname="RMAILBX Domain Name" plugin="DomainName" showtemplate="dns.dname"/>
			<field type="plugin" name="EMAILBX" longname="EMAILBX Domain Name" plugin="DomainName" showtemplate="dns.dname"/>
		</block>

		<block name="MR" longname="MR Resource Record">
			<field type="plugin" name="dname" longname="Domain Name" plugin="DomainName" showtemplate="dns.dname"/>
		</block>

		<block name="MX" longname="MX Resource Record">
			<field type="fixed" name="preference" size="2" longname="Preference" showtemplate="FieldDec"/>
			<field type="plugin" name="exchange" longname="Mail Exchanger (SMTP)" plugin="DomainName" showtemplate="dns.dname"/>
		</block>

		<block name="SOA" longname="SOA Resource Record">
			<field type="plugin" name="mname" longname="Primary name server" plugin="DomainName" showtemplate="dns.dname"/>
			<field type="plugin" name="rname" longname="Responsible autority's mailbox" description="Mailbox of the person responsible for this zone" plugin="DomainName" showtemplate="dns.dname"/>
			<field type="fixed" name="SERIAL" size="4" longname="Serial" showtemplate="FieldDec"/>
			<field type="fixed" name="REFRESH" size="4" longname="Refresh" showtemplate="FieldDec"/>
			<field type="fixed" name="RETRY" size="4" longname="Retry" showtemplate="FieldDec"/>
			<field type="fixed" name="EXPIRE" size="4" longname="Expire" showtemplate="FieldDec"/>
			<field type="fixed" name="MINIMUM" size="4" longname="Minimum" showtemplate="FieldDec"/>
		</block>

		<block name="TXT" longname="TXT Resource Record">
			<field type="fixed" name="txtlen" longname="TXT-DATA string length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="TXT-DATA" description="TXT-DATA" longname="TXT-DATA" expr="buf2int(txtlen)" showtemplate="FieldAscii"/>
		</block>

		<block name="WKS" longname="WKS Resource Record">
			<field type="fixed" name="ADDRESS" longname="Internet address" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="PROTOCOL" longname="IP Protocol Number" size="1" showtemplate="FieldDec"/>
			<!-- TODO: what about that hell of bitmasks????? -->
		</block>

		<block name="SRV" longname="SRV Resource Record">
			<field type="fixed" name="priority" longname="Priority" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="weight" longname="Weight" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="port" longname="Port" size="2" showtemplate="FieldDec"/>
			<field type="plugin" name="tname" longname="Target Name" plugin="DomainName" showtemplate="dns.dname"/>
		</block>

		<block name="NAPTR" longname="NAPTR Resource Record">
			<field type="fixed" name="order" longname="Order" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="preference" longname="Preference" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="flagslen" longname="Flags Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="flags" longname="Flags" expr="buf2int(flagslen)" showtemplate="FieldAscii"/>
			<field type="fixed" name="servicelen" longname="Service Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="service" longname="Service" expr="buf2int(servicelen)" showtemplate="FieldAscii"/>
			<field type="fixed" name="regexplen" longname="RegExp Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="regexp" longname="Regular Expression" expr="buf2int(regexplen)" showtemplate="FieldAscii"/>
			<field type="plugin" name="rname" longname="Replacement Name" plugin="DomainName" showtemplate="dns.dname"/>
		</block>
	</format>


	<visualization>
		<showtemplate name="dns.query" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Query"/>
					<default show="Response"/> 
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="dns.opcode" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Standard query"/>
					<case value="1" show="Inverse query"/>
					<case value="2" show="Service status request"/>
					<default show="Reserved"/> 
				</switch>
			</showmap>
		</showtemplate>


		<showtemplate name="dns.rcode" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="No error"/>
					<case value="1" show="Format error"/>
					<case value="2" show="Server failure"/>
					<case value="3" show="Name error"/>
					<case value="4" show="Not implemented"/>
					<case value="5" show="Refused"/>
					<default show="Reserved"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="dns.type" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<!-- http://www.iana.org/assignments/dns-parameters -->
					<case value="0" show="Reserved (should not be used)"/>
					<case value="1" show="A - IPv4 host address"/>
					<case value="2" show="NS - Authoritative name server"/>
					<case value="3" show="MD - Mail destination; obsolete"/>
					<case value="4" show="MF - Mail forwarder; obsolete"/>
					<case value="5" show="CNAME - Canonical name for an alias"/>
					<case value="6" show="SOA - Start of a zone of authority"/>
					<case value="7" show="MB - Mailbox domain name; experimental"/>
					<case value="8" show="MG - Mail group member; experimental"/>
					<case value="9" show="MR - Mail rename domain name; experimental"/>
					<case value="10" show="NULL - Null RR; experimental"/>
					<case value="11" show="WKS - Well known service description"/>
					<case value="12" show="PTR - Domain name pointer"/>
					<case value="13" show="HINFO - Host information"/>
					<case value="14" show="MINFO - Mailbox or mail list information"/>
					<case value="15" show="MX - Mail exchange"/>
					<case value="16" show="TXT - Text strings"/>
					<case value="28" show="AAAA - IPv6 host address"/>
					<case value="33" show="SRV - Service location"/>
					<case value="35" show="NAPTR - Naming authority pointer"/>
					<case value="38" show="A6 - IPv6 host address"/>
					<case value="41" show="OPT"/>
					<case value="252" show="AFXR - Request for a transfer of an entire zone"/>
					<case value="253" show="MAILB - Request for mailbox-related records"/>
					<case value="254" show="MAILA - Request for mail agent RRs;obsolete"/>
					<case value="255" show="* - Request for all records"/>
					<default show="DNS Query type not recognized"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="dns.class" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Reserved IANA"/>
					<case value="1" show="IN - Internet"/>
					<case value="2" show="CS - CSNET class - obsolete"/>
					<case value="3" show="CH - CHAOS class"/>
					<case value="4" show="HS - Hesiod"/>
					<case value="255" show="* - Any class"/>
					<default show="DNS class not recognized"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="dns.dname" showtype="hex" showplg="DomainName"/>

		<showsumtemplate name="dns">
			<section name="next"/>
			<text value="DNS "/>
			<protofield name="Query" showdata="showmap"/>
		</showsumtemplate>

	</visualization>

</protocol>
<protocol name="dns_tcp" longname="DNS over TCP" showsumtemplate="dns_tcp">
		<execute-code>
		<verify>
			<!-- check this signature -->
			<if expr="(($packetlength - $currentoffset - 2 )==(buf2int($packet[$currentoffset : 2])))">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>	
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#dns_tcp"/>
				<lookupdata value="0"/>
			</update-lookuptable>	

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#dns_tcp"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#dns_tcp"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>		
	</execute-code>
	<format>
		<fields>
			<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="dns_tcp">
			<section name="next"/>
			<text value="DNS over TCP"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="tcp" longname="TCP (Transmission Control Protocol)" showsumtemplate="tcp">
	<execute-code>
		<after>
			<assign-variable name="$L4proto" value="#tcp"/>
			<!-- Stores tcp src and dst port in a couple of variables for the sake of speed -->
			<!-- By the way, the same method can be used to hide differences between IPv4 and IPv6 -->
			<assign-variable name="$portsrc" value="sport"/>
			<assign-variable name="$portdst" value="dport"/>

			<assign-variable name="$payloadlength" value="$packetlength - $currentoffset"/>

			<if expr="$ipsrc lt $ipdst" >
				<if-true>
					<assign-variable name="$firstport" value="sport"/>
					<assign-variable name="$secondport" value="dport"/>
				</if-true>
				<if-false>
					<assign-variable name="$firstport" value="dport"/>
					<assign-variable name="$secondport" value="sport"/>
				</if-false>
			</if>
		</after>

		<!-- This section is enabled when we have to do application-layer full check -->
		<after>
			<!-- Let's update the 'timestamp' of current seervice so that it does not expire -->
			<if expr="$enable_servertable">
				<!-- Server is active so we need to update KnownServer entry-->
				<if-true>
					<if expr="updatelookuptable($KnownServerTable, $firstip, $firstport)"><if-true></if-true></if>
					<if expr="updatelookuptable($KnownServerTable, $secondip,$secondport)"><if-true></if-true></if>
				</if-true>
			</if>

			<!-- Let's update the 'timestamp' of current session so that it does not expire -->
			<!-- due to the lifetime (the current packet confirms that the session is still active) -->
			<if expr="updatelookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
				<if-true>

					<!-- This code is pretty simple and it does not take into account any TCP state -->
					<!-- Please be careful if you want to to replace "obsolete" with "purge": -->
					<!--  (a) packets following this one (e.g. ACK packets, after the FIN) -->
					<!--  (b) the payload of the current packet (if one) -->
					<!-- won't be recognized as belonging to the correct protocol, since the entry is deleted from the session table -->
					<if expr="buf2int(fin) == 1">
						<if-true>
							<update-lookuptable name="$tcpsessiontable" action="obsolete">
								<lookupkey value="$firstip"/>
								<lookupkey value="$secondip"/>
								<lookupkey value="$firstport"/>
								<lookupkey value="$secondport"/>
							</update-lookuptable>						
						</if-true>
					</if>

					<!-- If case of RST, let's make obsolete both sides of the session -->
					<if expr="buf2int(rst) == 1">
						<if-true>
							<update-lookuptable name="$tcpsessiontable" action="obsolete">
								<lookupkey value="$firstip"/>
								<lookupkey value="$secondip"/>
								<lookupkey value="$firstport"/>
								<lookupkey value="$secondport"/>						
							</update-lookuptable>
						</if-true>
					</if>

				</if-true>
			</if>
		</after>

		<!-- Let's check if this connection belongs to a well-known server. If not, we have to update the server list -->
		<!-- with the data related to the the server itself (this is contained in the CandidateServersTable). -->
		<!-- The CandidateServersTable contains only the info related to the server, but it does not know the protocol associated to it. -->
		<!-- This data is moved into the KnownServerTable when we finally know the protocol associated to this server. -->
		<!-- Please note that we may have also the infortunate case in which this packet is lost. -->
		<after when="(buf2int(syn) == 1) and (buf2int(ackf) == 0) and ($enable_servertable)">
			<if expr="not checklookuptable ($KnownServerTable, $ipdst, $portdst)">
				<if-true>
					<if expr="not checklookuptable ($CandidateServersTable, $ipdst, $portdst)">
						<if-true>
							<update-lookuptable name="$CandidateServersTable" action="add" validity="updateonhit" keeptime="10" hittime="10">
								<lookupkey value="$ipdst"/>
								<lookupkey value="$portdst"/>
							</update-lookuptable>		
						</if-true>
					</if>
				</if-true>
				<if-false>
					<if expr="updatelookuptable($KnownServerTable, $ipdst, $portdst)"><if-true></if-true></if>
				</if-false>
			</if>
		</after>

	</execute-code>
	<format>
		<fields>
			<field type="fixed" name="sport" longname="Source port" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="dport" longname="Destination port" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="seq" longname="Sequence number" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="ack" longname="Acknowledgement Number" size="4" showtemplate="FieldDec"/>
			<field type="bit" name="hlen" longname="Header length" mask="0xF000" size="2" comment="This field is in multiple of 4 bytes" showtemplate="FieldMul4Dec"/>
			<field type="bit" name="res" longname="Reserved (must be zero)" mask="0x0FC0" size="2" showtemplate="FieldHex"/>
			<field type="bit" name="flags" longname="Flags" mask="0x003F" size="2" showtemplate="FieldHex">
				<field type="bit" name="urg" longname="Urgent pointer" mask="0x0020" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="ackf" longname="Ack valid" mask="0x0010" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="push" longname="Push requested" mask="0x0008" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="rst" longname="Reset requested" mask="0x0004" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="syn" longname="Syn requested" mask="0x0002" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="fin" longname="Fin requested" mask="0x0001" size="2" showtemplate="FieldBin"/>
			</field>
			<field type="fixed" name="win" longname="Window size" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="crc" longname="Checksum" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="urg" longname="Urgent Pointer" size="2" showtemplate="FieldHex"/>

			<!-- TCP Options -->
			<block name="options" longname="TCP Options">
				<loop type="size" expr="(buf2int(hlen) * 4) - 20">

					<switch expr="buf2int($packet[$currentoffset:1])">
						<case value="0">
							<includeblk name="eol"/>
							<field type="padding" name="padf" longname="Padding" description="Field used to re-align the PDU to a word" align="4" showtemplate="FieldDec"/>
						</case>
						<case value="1"> <includeblk name="noperation"/> </case>
						<case value="2"> <includeblk name="mss"/> </case>
						<case value="3"> <includeblk name="winscale"/> </case>
						<case value="4"> <includeblk name="sackpermitted"/> </case>
						<case value="5"> <includeblk name="sackformat"/> </case>
						<case value="8"> <includeblk name="timestamp"/> </case>
						<case value="19"> <includeblk name="md5signature"/> </case>
						<default> <includeblk name="unknown"/> </default>
					</switch>
				</loop>
			</block>
		</fields>

		<block name="eol" longname="End of Option List">
			<field type="fixed" name="endopt" longname="End of Option" size="1" description="Indicates the end of the option list" showtemplate="FieldDec"/>
		</block>
			
		<block name="noperation" longname="No Operation">
			<field type="fixed" name="type" longname="Type" description="This option code may be used between options" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="mss" longname="Maximum Segment Size">
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="length" longname="Option length" description="must be 4" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="maxssize" longname="Maximum Segment Size" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="winscale" longname="TCP Windows Scale Option">
			<field type="fixed" name="type" longname="Type" description="Used to enable window scaling" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="length" longname="Option Length" description="must be 3" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="shift.cnt" longname="Shift Count" description="If window scaling is enabled the sender will right-shift its receive window values by 'shift.cnt'" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="sackpermitted" longname="Sack-Permitted Option">
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="length" longname="Option Length" description="must be 2" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="sackformat" longname="Sack Option Format">
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="length" longname="Option Length" description="(8 x n_blocks) + 2" size="1" showtemplate="FieldDec"/>
			<block name="Blocks Received" longname="Blocks Received">
				<loop type="times2repeat" expr="(buf2int(length) - 2) div 8">
					<field type="fixed" name="leftedge" longname="Left Edge of Block" size="4" showtemplate="FieldDec"/>
					<field type="fixed" name="rightedge" longname="Right Edge of Block" size="4" showtemplate="FieldDec"/>
				</loop>
			</block>
		</block>

		<block name="timestamp" longname="TCP Timestamp Option">
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="length" longname="Option length" description="must be 10" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="tsval" longname="Timestamp Value" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="tsechoreply" longname="Timestamp Echo Reply" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="md5signature" longname="MD5 Signature Option">
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="length" longname="Option length" comment="must be 18" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="md5digest" longname="MD5 Digest" size="16" showtemplate="Field4BytesHex"/>
		</block>

		<block name="unknown" longname="Unknown TCP Option">
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="length" longname="Option length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="value" longname="Value" expr="buf2int(length)" showtemplate="Field4BytesHex"/>
		</block>
	</format>

	<encapsulation>
		<if expr="$enable_servertable">
			<if-true>
				<if expr="checklookuptable($KnownServerTable, $ipsrc, $portsrc) or checklookuptable($KnownServerTable, $ipdst, $portdst)">
					<if-true>
						<!-- Take care: we're classifying the session, but this session is not in the $tcpsessiontable -->
						<assign-variable name="$ks_table_hit" value="1"/>

						<!--
							Uncomment the following line if you want to add the flow
							to the tcpsessiontable upon detection with "known service algorithm"
						-->
						<!--<assign-variable name="$protoverify_result" value="%FOUND"/>-->
						<nextproto proto="$KnownServerTable.nextproto"/>
					</if-true>
				</if>

				<!-- to identify Skype pkts over TCP -->
				<if expr="checklookuptable($SkypeClientTable, $ipsrc, $portsrc) or checklookuptable($SkypeClientTable, $ipdst, $portdst)">
					<if-true>
						<!-- Take care: we're classifying the session, but this session is not in the $tcpsessiontable -->
						<assign-variable name="$ks_table_hit" value="1"/>

						<!--
							Uncomment the following line if you want to add the flow
							to the tcpsessiontable upon detection with "known service algorithm"
						-->
						<!--<assign-variable name="$protoverify_result" value="%FOUND"/>-->
						<nextproto proto="$SkypeClientTable.nextproto"/>
					</if-true>
				</if>
			</if-true>
		</if>

		<if expr="checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
			<if-true>
				<assign-variable name="$sess_table_hit" value="1"/>
				<nextproto proto="$tcpsessiontable.nextproto"/>
			</if-true>
		</if>

		<!-- 
			Let's check well-known ports < 1024 first (otherwise, a connection from port 1214 to 80 appears to be 
			"FastTrack" instead of HTTP, while probably it's just a client who chose randomly that port
		-->
		<switch expr="buf2int(sport)">
			<case value="20"> <nextproto proto="#ftpdata"/> </case>
			<case value="21"> <nextproto-candidate proto="#ftp"/> </case>
			<case value="22"> <nextproto-candidate proto="#ssh"/> </case>
			<case value="23"> <nextproto-candidate proto="#telnet"/> </case>
			<case value="25"> <nextproto-candidate proto="#smtp"/> </case>
			<case value="42"> <nextproto-candidate proto="#wins"/> </case>
			<case value="53"> <nextproto-candidate proto="#dns_tcp"/> </case>
			<case value="80"> <nextproto-candidate proto="#http"/> </case>
			<case value="88"> <nextproto-candidate proto="#kerberos"/> </case>
			<case value="110"> <nextproto-candidate proto="#pop3"/> </case>
			<case value="113"> <nextproto-candidate proto="#auth"/> </case>
			<case value="118"> <nextproto-candidate proto="#sql"/> </case>
			<case value="139"> <nextproto-candidate proto="#netbiosssn"/> </case>
			<case value="143"> <nextproto-candidate proto="#imap"/> </case>
			<case value="161"> <nextproto-candidate proto="#snmp"/> </case>
			<case value="162"> <nextproto-candidate proto="#snmp"/> </case>
			<case value="179"> <nextproto-candidate proto="#bgp"/> </case>
			<case value="389"> <nextproto-candidate proto="#ldap"/> </case>
			<case value="411"> <nextproto-candidate proto="#dcpp"/> </case>
			<case value="443"> <nextproto-candidate proto="#ssl"/> </case>
			<case value="445"> <nextproto-candidate proto="#samba"/> </case>
			<case value="465"> <nextproto-candidate proto="#ssmtp"/> </case>
			<case value="554"> <nextproto-candidate proto="#rtsp"/> </case>
			<case value="993"> <nextproto-candidate proto="#simap4"/> </case>
			<case value="995"> <nextproto-candidate proto="#spop3"/> </case>
		</switch>
		<switch expr="buf2int(dport)">
			<case value="20"> <nextproto proto="#ftpdata"/> </case>
			<case value="21"> <nextproto-candidate proto="#ftp"/> </case>
			<case value="22"> <nextproto-candidate proto="#ssh"/> </case>
			<case value="23"> <nextproto-candidate proto="#telnet"/> </case>
			<case value="25"> <nextproto-candidate proto="#smtp"/> </case>
			<case value="42"> <nextproto-candidate proto="#wins"/> </case>
			<case value="53"> <nextproto-candidate proto="#dns_tcp"/> </case>
			<case value="80"> <nextproto-candidate proto="#http"/> </case>
<case value="80"><nextproto-candidate proto="#edonk"/></case> <!--It can be emule on port 80-->
			<case value="88"> <nextproto-candidate proto="#kerberos"/> </case>
			<case value="110"> <nextproto-candidate proto="#pop3"/> </case>
			<case value="113"> <nextproto-candidate proto="#auth"/> </case>
			<case value="118"> <nextproto-candidate proto="#sql"/> </case>
			<case value="139"> <nextproto-candidate proto="#netbiosssn"/> </case>
			<case value="143"> <nextproto-candidate proto="#imap"/> </case>
			<case value="161"> <nextproto-candidate proto="#snmp"/> </case>
			<case value="162"> <nextproto-candidate proto="#snmp"/> </case>
			<case value="179"> <nextproto-candidate proto="#bgp"/> </case>
			<case value="389"> <nextproto-candidate proto="#ldap"/> </case>
			<case value="411"> <nextproto-candidate proto="#dcpp"/> </case>
			<case value="443"> <nextproto-candidate proto="#ssl"/> </case>
			<case value="445"> <nextproto-candidate proto="#samba"/> </case>
			<case value="465"> <nextproto-candidate proto="#ssmtp"/> </case>
			<case value="554"> <nextproto-candidate proto="#rtsp"/> </case>
			<case value="993"> <nextproto-candidate proto="#simap4"/> </case>
			<case value="995"> <nextproto-candidate proto="#spop3"/> </case>
		</switch>

		<switch expr="buf2int(sport)">
			<case value="1214"> <nextproto-candidate proto="#fasttrack"/></case>
			<case value="1433"> <nextproto-candidate proto="#ms_sql_server"/></case>
			<case value="1526"> <nextproto-candidate proto="#oracle_sql"/> </case>
			<case value="1723"> <nextproto-candidate proto="#pptp"/> </case>
			<case value="1863"> <nextproto-candidate proto="#msnmsg"/> </case>
			<case value="2002"> <nextproto-candidate proto="#rpcap"/> </case>
			<case value="2240"> <nextproto-candidate proto="#slsk"/> </case>
			<case value="2401"> <nextproto-candidate proto="#cvs"/> </case>
			<case value="3389"> <nextproto-candidate proto="#rdp"/> </case>
			<case value="5060"> <nextproto-candidate proto="#sip"/> </case>
			<case value="5061"> <nextproto-candidate proto="#sip"/> </case>
			<!-- edonkey uses 4661 to connect to server and 4662 to connect another client -->
			<case value="4661"> <nextproto-candidate proto="#edonk"/> </case>
			<case value="4662"> <nextproto-candidate proto="#edonk"/> </case>
			<case value="5222"> <nextproto-candidate proto="#xmpp"/></case>
			<case value="5269"> <nextproto-candidate proto="#xmpp"/></case>
			<case value="5631"> <nextproto-candidate proto="#pcanywhere"/></case>
			<case value="5900"> <nextproto-candidate proto="#rfb"/> </case>
			<case value="6667"> <nextproto-candidate proto="#irc"/></case>
		</switch>
		<switch expr="buf2int(dport)">
			<case value="1214"> <nextproto-candidate proto="#fasttrack"/></case>
			<case value="1433"> <nextproto-candidate proto="#ms_sql_server"/></case>
			<case value="1526"> <nextproto-candidate proto="#oracle_sql"/> </case>
			<case value="1723"> <nextproto-candidate proto="#pptp"/> </case>
			<case value="1863"> <nextproto-candidate proto="#msnmsg"/> </case>
			<case value="2002"> <nextproto-candidate proto="#rpcap"/> </case>
			<case value="2240"> <nextproto-candidate proto="#slsk"/> </case>			
			<case value="2401"> <nextproto-candidate proto="#cvs"/> </case>
			<case value="3389"> <nextproto-candidate proto="#rdp"/> </case>
			<!-- edonkey uses 4661 to connect to server and 4662 to connect another client -->
			<case value="4661"> <nextproto-candidate proto="#edonk"/> </case>
			<case value="4662"> <nextproto-candidate proto="#edonk"/> </case>
			<case value="5060"> <nextproto-candidate proto="#sip"/> </case>
			<case value="5061"> <nextproto-candidate proto="#sip"/> </case>
			<case value="5222"> <nextproto-candidate proto="#xmpp"/></case>
			<case value="5269"> <nextproto-candidate proto="#xmpp"/></case>
			<case value="5631"> <nextproto-candidate proto="#pcanywhere"/></case>
			<case value="5900"> <nextproto-candidate proto="#rfb"/> </case>
			<case value="1214"> <nextproto-candidate proto="#fasttrack"/></case>
			<case value="6667"> <nextproto-candidate proto="#irc"/></case>
		</switch>


		<!-- Try and See section -->
		<nextproto-candidate proto="#dce_rpc_tcp"/>
		<nextproto-candidate proto="#onc_rpc_udp"/>
		<nextproto-candidate proto="#jrmi"/>
		<nextproto-candidate proto="#yahoomsg"/>
		<nextproto-candidate proto="#telnet"/>
		<nextproto-candidate proto="#ssl"/>
		<nextproto-candidate proto="#oracle_sql"/>                                
		<nextproto-candidate proto="#irc"/>
		<nextproto-candidate proto="#smtp"/>
		<nextproto-candidate proto="#dcpp"/>
		<!--<nextproto-candidate proto="#msnmsg"/>-->
		<!--<nextproto-candidate proto="#winmx"/>-->
		<nextproto-candidate proto="#edonk"/>
		<nextproto-candidate proto="#gnutella"/>
		<nextproto-candidate proto="#bittorrent"/>
		<nextproto-candidate proto="#ares"/>
		<nextproto-candidate proto="#skype"/>
		<nextproto-candidate proto="#fasttrack"/>
		<nextproto-candidate proto="#http"/>
	        <if expr="buf2int(dport)==8080">
		   <if-true>
		      <nextproto-candidate proto="#msnmsg"/>
		   </if-true>
	        </if>	

	</encapsulation>


	<visualization>
		<showsumtemplate name="tcp">
			<section name="next"/>
			<text value="TCP: port "/>
			<protofield name="sport" showdata="showvalue"/>
			<text value=" => "/>
			<protofield name="dport" showdata="showvalue"/>
			<text value=" ("/>
			<if expr="buf2int(syn) == 1">
				<if-true>
					<text value="SYN "/>
				</if-true>
			</if>
			<if expr="buf2int(fin) == 1">
				<if-true>
					<text value="FIN "/>
				</if-true>
			</if>
			<if expr="buf2int(ackf) == 1">
				<if-true>
					<text value="ACK "/>
				</if-true>
			</if>
			<if expr="buf2int(rst) == 1">
				<if-true>
					<text value="RST "/>
				</if-true>
			</if>
			<if expr="buf2int(push) == 1">
				<if-true>
					<text value="PUSH "/>
				</if-true>
			</if>
			<if expr="buf2int(urg) == 1">
				<if-true>
					<text value="URG "/>
				</if-true>
			</if>
			<text value=")"/>
			<text value=" Seq "/>
			<protofield name="seq" showdata="showvalue"/>
			<text value=", Ack "/>
			<protofield name="ack" showdata="showvalue"/>
			<text value=", Win "/>
			<protofield name="win" showdata="showvalue"/>
		</showsumtemplate>
	</visualization>
</protocol>


<protocol name="udp" longname="UDP (User Datagram protocol)" showsumtemplate="udp">
	<execute-code>
		<after>
			<assign-variable name="$L4proto" value="#udp"/>
			<!-- Stores tcp src and dst port in a couple of variables for the sake of speed -->
			<!-- By the way, the same method can be used to hide differences between IPv4 and IPv6 -->
			<assign-variable name="$portsrc" value="sport"/>
			<assign-variable name="$portdst" value="dport"/>

			<assign-variable name="$payloadlength" value="$packetlength - $currentoffset"/>


			<if expr="$ipsrc lt $ipdst" >
				<if-true>
					<assign-variable name="$firstport" value="sport"/>
					<assign-variable name="$secondport" value="dport"/>
				</if-true>
				<if-false>
					<assign-variable name="$firstport" value="dport"/>
					<assign-variable name="$secondport" value="sport"/>
				</if-false>
			</if>

			<!-- Let's update the 'timestamp' of current session so that it does not expire -->
			<!-- due to the lifetime (the current packet confirms that the session is still active) -->
			<if expr="updatelookuptable($udpsessiontable, $ipsrc, $ipdst, $portsrc, $portdst)"><if-true></if-true></if>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="updatelookuptable($KnownUDPServerTable, $ipsrc, $portsrc)"><if-true></if-true></if>
					<if expr="updatelookuptable($KnownUDPServerTable, $ipdst, $portdst)"><if-true></if-true></if>
				</if-true>
			</if>
		</after>
	</execute-code>

	<format>
		<fields>
			<field type="fixed" name="sport" longname="Source port" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="dport" longname="Destination port" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="len" longname="Payload length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="crc" longname="Checksum" size="2" showtemplate="FieldHex"/>
		</fields>
	</format>

	<encapsulation>
		<if expr="$enable_servertable">
			<if-true>
				<if expr="checklookuptable($KnownUDPServerTable, $ipsrc, $portsrc) or checklookuptable($KnownUDPServerTable, $ipdst, $portdst)">
					<if-true>
						<assign-variable name="$ks_table_hit" value="1"/>

						<!--
							Uncomment the following line if you want to add
							the flow to the udpsessiontable upon detection with "known service algorithm"
						-->
						<!--<assign-variable name="$protoverify_result" value="%FOUND"/>-->
						<nextproto proto="$KnownUDPServerTable.nextproto"/>
					</if-true>
				</if>

				<if expr="checklookuptable($SkypeClientTable, $ipsrc, $portsrc) or checklookuptable($SkypeClientTable, $ipdst, $portdst)">
					<if-true>
						<assign-variable name="$ks_table_hit" value="1"/>

						<!--
							Uncomment the following line if you want to add
							the flow to the udpsessiontable upon detection with "known service algorithm"
						-->
						<!--<assign-variable name="$protoverify_result" value="%FOUND"/>-->
						<nextproto proto="#skype"/>
					</if-true>
				</if>
			</if-true>
		</if>

		<if expr="checklookuptable($skypetempsessiontable, $ipsrc, $portsrc)">
			<if-true>
				<assign-variable name="$ks_table_hit" value="1"/>
				<nextproto-candidate proto="#skype"/>
			</if-true>
		</if>


		<if expr="checklookuptable($udpsessiontable, $ipsrc, $ipdst, $portsrc, $portdst)">
			<if-true>
				<assign-variable name="$sess_table_hit" value="1"/>
				<nextproto proto="$udpsessiontable.nextproto"/>
			</if-true>
		</if>
		<!--
			Let's check well-known ports < 1024 first (otherwise, a connection from port 3635 to 53 appears to be
			"Edonkey" instead of DNS, while probably it's just a client who choose randomly that port
		-->		
		<switch expr="buf2int(sport)">
			<case value="53"> <nextproto proto="#dns"/> </case>
			<case value="88"> <nextproto proto="#kerberos"/> </case>
			<case value="111"> <nextproto-candidate proto="#onc_rpc_udp"/> </case>		<!-- RPCBIND protocol runs over ONC RPC -->
			<case value="123"> <nextproto-candidate proto="#ntp"/> </case>
			<case value="137"> <nextproto proto="#netbios"/> </case>
			<case value="138"> <nextproto-candidate proto="#netbiosdgm"/> </case>
			<case value="161"> <nextproto-candidate proto="#snmp"/> </case>
			<case value="162"> <nextproto-candidate proto="#snmp"/> </case>
			<case value="370"> <nextproto-candidate proto="#fsecure"/></case>
			<case value="371"> <nextproto-candidate proto="#fsecure"/></case>
			<case value="389"> <nextproto-candidate proto="#cldap"/></case>
			<case value="445"> <nextproto-candidate proto="#netbiosdgm"/> </case>
			<case value="500"> <nextproto proto="#isakmp"/></case>
			<case value="520">
				<!-- RIP has source and destination port equal to 520 -->
				<if expr="buf2int(dport) == 520">
					<if-true> <nextproto proto="#rip"/> </if-true>
				</if>
			</case>
			<case value="514"> <nextproto-candidate proto="#syslog"/> </case>
			<case value="521"> <nextproto proto="#rip6"/> </case>
			<case value="631"> <nextproto proto="#ipp"/> </case>
			<case value="800"> <nextproto-candidate proto="#onc_rpc_udp"/> </case>
		</switch>
		<switch expr="buf2int(dport)">
			<case value="53"> <nextproto proto="#dns"/> </case>
			<case value="88"> <nextproto proto="#kerberos"/> </case>
			<case value="111"> <nextproto-candidate proto="#onc_rpc_udp"/> </case>		<!-- RPCBIND protocol runs over ONC RPC -->
			<case value="123"> <nextproto-candidate proto="#ntp"/> </case>
			<case value="137"> <nextproto proto="#netbios"/> </case>
			<case value="138"> <nextproto-candidate proto="#netbiosdgm"/> </case>
			<case value="161"> <nextproto-candidate proto="#snmp"/> </case>
			<case value="162"> <nextproto-candidate proto="#snmp"/> </case>
			<case value="370"> <nextproto-candidate proto="#fsecure"/></case>
			<case value="371"> <nextproto-candidate proto="#fsecure"/></case>
			<case value="389"> <nextproto-candidate proto="#cldap"/></case>
			<case value="445"> <nextproto-candidate proto="#netbiosdgm"/> </case>
			<case value="500"> <nextproto proto="#isakmp"/></case>
			<case value="514"> <nextproto-candidate proto="#syslog"/> </case>
			<case value="521"> <nextproto proto="#rip6"/> </case>
			<case value="631"> <nextproto proto="#ipp"/> </case>
			<case value="800"> <nextproto-candidate proto="#onc_rpc_udp"/> </case>
		</switch>

		<switch expr="buf2int(dport)">
			<case value="1434"> <nextproto-candidate proto="#ms_sql_monitor"/> </case>
			<case value="1812"> <nextproto-candidate proto="#radius"/> </case>
			<case value="1813"> <nextproto-candidate proto="#radius"/> </case>
			<case value="1900"> <nextproto-candidate proto="#ssdp"/> </case>
			<case value="1985"> <nextproto-candidate proto="#hsrp"/> </case>
			<case value="3130"> <nextproto-candidate proto="#icp"/> </case>
			<case value="3478"> <nextproto-candidate proto="#stun"/> </case>
			<case value="3531"> <nextproto-candidate proto="#peerenabler"/> </case>
			<case value="3635"> <nextproto-candidate proto="#edonkudp"/> </case>
			<case value="5060"> <nextproto-candidate proto="#sip"/> </case>
			<case value="5100"> <nextproto-candidate proto="#nt_security_log"/> </case>
			<case value="9573"> <nextproto-candidate proto="#edonkudp"/> </case>
		</switch>
		<switch expr="buf2int(sport)">
			<case value="1434"> <nextproto-candidate proto="#ms_sql_monitor"/> </case>
			<case value="1812"> <nextproto-candidate proto="#radius"/> </case>
			<case value="1813"> <nextproto-candidate proto="#radius"/> </case>
			<case value="1900"> <nextproto-candidate proto="#ssdp"/> </case>
			<case value="1985"> <nextproto-candidate proto="#hsrp"/> </case>
			<case value="3130"> <nextproto-candidate proto="#icp"/> </case>
			<case value="3478"> <nextproto-candidate proto="#stun"/> </case>
			<case value="3531"> <nextproto-candidate proto="#peerenabler"/> </case>
			<case value="3635"> <nextproto-candidate proto="#edonkudp"/> </case>
			<case value="5060"> <nextproto-candidate proto="#sip"/> </case>
			<case value="5100"> <nextproto-candidate proto="#nt_security_log"/> </case>
			<case value="9573"> <nextproto-candidate proto="#edonkudp"/> </case>
		</switch>

		<if expr="(buf2int(dport) == 67) or (buf2int(dport) == 68)">
			<if-true>
				<!-- Port 67 are messages from client to server (which receives on port 67) -->
				<!-- Port 68 are messages from server to client (which receives on port 68) -->
				
				<!-- Please note that DHCP and BOOTP have the same magic number mostly of the time (hence are not really distinguishable) -->	
				<!-- BOOTP does not have any code to verify this is the correct proto. Fortunately, this protocol is not usually deployed, and DHCP is used instead. -->
				<!-- However please note that the magic number specified fot DHCP (0x63825363) is a valid magic also for BOOTP, and it is the value it used most. -->

				<if expr="buf2int($packet[($currentoffset + 236) : 4]) == 0x63825363">
					<if-true>
						<nextproto proto="#dhcp"/>
					</if-true>
					<if-false>
						<nextproto proto="#bootp"/>
					</if-false>
				</if>
			</if-true>
		</if>

		<!-- Try and See section -->	
		<nextproto-candidate proto="#edonkudp"/>	
		<nextproto-candidate proto="#sip"/>
		<nextproto-candidate proto="#gnutella"/>
		<nextproto-candidate proto="#bittorrent"/>
		<nextproto-candidate proto="#pplive"/>
		<nextproto-candidate proto="#sopcast"/>
		<nextproto-candidate proto="#tvants"/>
		<nextproto-candidate proto="#skype"/>
		<nextproto-candidate proto="#onc_rpc_udp"/>
		<nextproto-candidate proto="#fasttrack"/>				
		<nextproto-candidate proto="#dce_rpc_udp"/>
		<nextproto-candidate proto="#ares"/>
								
		<!-- This is the last resort; if it doesn't match anything, let's try with RTP/RTCP -->
		<!-- Let's check that the port is an even number -->
		<if expr="(buf2int(dport) mod 2) == 0">
			<if-true>
				<nextproto-candidate proto="#rtp"/>
			</if-true>
			<!-- We do not add any entry for RTCP; RTCP sessions are added to the session table as -->
			<!-- soon as an RTP session is detected (hence these entries are managed by the RTP dissector) -->
		</if>
	</encapsulation>

	<visualization>
		<showsumtemplate name="udp">
			<section name="next"/>
			<text value="UDP: port "/>
			<protofield name="sport" showdata="showvalue"/>
			<text value=" => "/>
			<protofield name="dport" showdata="showvalue"/>
		</showsumtemplate>
	</visualization>
</protocol>


<protocol name="rip" longname="RIP (Routing Information Protocol)" showsumtemplate="rip">
	<format>
		<fields>
			<field type="fixed" name="cmd" longname="Command" size="1" showtemplate="rip.cmd"/>
			<field type="fixed" name="ver" longname="Version" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="mbz" longname="Not Used" description="The value of this field is 0" size="2" showtemplate="FieldDec"/>

			<switch expr="buf2int(ver)">
				<case value="1">
					<!-- There is the first option -->
					<loop type="size" expr="$packetlength - $currentoffset">
						<block name="Routing Information" longname="Routing Information Item">
							<field type="fixed" name="AFI" longname="Address Family Identifier" size="2" showtemplate="FieldDec"/>
							<field type="fixed" name="mbz2" longname="Not Used" description="This must be 0" size="2" showtemplate="FieldDec"/>
							<field type="fixed" name="Netaddr" longname="Network address" size="4" showtemplate="ip4addr-noplg"/>
							<field type="fixed" name="mbz3" longname="Not Used" description="The value of this field is 0" size="4" showtemplate="FieldDec"/>
							<field type="fixed" name="mbz4" longname="Not Used" description="The value of this field is 0" size="4" showtemplate="FieldDec"/>
							<field type="fixed" name="Metric" longname="Metric" description="this is the path cost of forwarding" size="4" showtemplate="FieldDec"/>
						</block>
					</loop>
				</case>
				<case value="2">
					<!-- There is the second option -->
					<loop type="size" expr="$packetlength - $currentoffset">
						<block name="Routing Information" longname="Routing Information Item">
							<field type="fixed" name="AFI" longname="Address Family Identifier" size="2" showtemplate="FieldDec"/>
							<field type="fixed" name="Route Tag" longname="Route Tag" description="Is used by other routing protocols" size="2" showtemplate="FieldDec"/>
							<field type="fixed" name="Netaddr" longname="Network address" size="4" showtemplate="ip4addr-noplg"/>
							<field type="fixed" name="Netmask" longname="Network mask" description="Is used to know the subnet adress" size="4" showtemplate="ip4addr-noplg"/>
							<field type="fixed" name="NextHop" longname="Next Hop Router" size="4" showtemplate="ip4addr-noplg"/>
							<field type="fixed" name="Metric" longname="Metric" description="this is the path cost of forwarding" size="4" showtemplate="FieldDec"/>
						</block>
					</loop>
				</case>
			</switch>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="rip">
			<section name="next"/>
			<text value="RIPv. "/>
			<protofield name="ver" showdata="showvalue"/>
			<text value=" "/>
			<protofield name="cmd" showdata="showmap"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="rip6" longname="RIPng (Routing Information Protocol new generation)" showsumtemplate="ripng">
	<format>
		<fields>
			<field type="fixed" name="cmd" longname="command" size="1" showtemplate="rip.cmd"/>
			<field type="fixed" name="ver" longname="version" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="mbz" longname="must_be_zero" size="2" showtemplate="FieldDec"/>
			<block name="RTE" longname="RTE">
				<loop type="size" expr="$packetlength - $currentoffset">
					<field type="fixed" name="IPv6pfx" longname="IPv6 prefix" size="16" showtemplate="ip6addr-noplg"/>
					<field type="fixed" name="rttg" longname="Route tag" size="2" showtemplate="FieldDec"/>
					<field type="fixed" name="pfxl" longname="Prefix length" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="mtc" longname="Metric" size="1" showtemplate="FieldDec"/>
				</loop>
			</block>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="ripng">
			<section name="next"/>
			<text value="RIP6v. "/>
			<protofield name="ver" showdata="showvalue"/>
			<text value=" "/>
			<protofield name="cmd" showdata="showmap"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="igrp" longname="Interior Gateway Routing Protocol" showsumtemplate="igrp">
	<format>
		<fields>
			<field type="bit" name="ver" longname="Version" mask="0xF0" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="opcode" longname="Option Code" mask="0x0F" size="1" showtemplate="igrp.opcode"/>
			<field type="fixed" name="Updaterelease" longname="Update Release" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Asystem" longname="Autonomous System Number" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="ninterior" longname="Interior Routers" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="nsystem" longname="System Routers" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="nexterior" longname="Exterior Routers" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="Checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>

			<block name="payload" longname="Payload">
				<!-- This block will keep all the remaining data of the packet -->
				<loop type="size" expr="$packetlength - $currentoffset">
					<field type="fixed" name="Description" longname="Description" size="3" showtemplate="FieldDec"/>
					<field type="fixed" name="delay" longname="delay" size="2" showtemplate="FieldDec"/>
					<field type="fixed" name="bandwidth" longname="bandwidth" size="4" showtemplate="FieldDec"/>
					<field type="fixed" name="mtu" longname="mtu" size="2" showtemplate="FieldDec"/>
					<field type="fixed" name="reliability" longname="reliability" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="load" longname="load" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="hop_count" longname="hop_count" size="1" showtemplate="FieldDec"/>
				</loop>
			</block>
		</fields>	
	</format>

	<visualization>
		<showtemplate name="igrp.opcode" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Update"/> 
					<case value="2" show="Request"/> 
					<default show="Error in IGRP code lookup"/> 
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="igrp">
			<section name="next"/>
			<text value="IGMP: "/>
			<protofield name="opcode" showdata="showmap"/>
		</showsumtemplate>

	</visualization>
	
</protocol>
<protocol name="eigrp" longname="Enhanced Interior Gateway Routing Protocol" showsumtemplate="eigrp">
	<format>
		<fields>
			<field type="fixed" name="Version" longname="Version" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="opcode" longname="Option Code" size="1" showtemplate="eigrp.opcode"/>
			<field type="fixed" name="Checksum" longname="Checksum" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="Flags" longname="Flags" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="Sequence" longname="Sequence" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="Ack" longname="Acknowledge" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="as" longname="Autonomous System" size="4" showtemplate="FieldDec"/>

			<block name="payload" longname="Payload">
				<!-- This block will keep all the remaining data of the packet -->
				<loop type="size" expr="$packetlength - $currentoffset">
					<block name="Parameters" longname="Parameters">
						<field type="bit" name="Type" longname="Type" mask="0xFFFF0000" size="4" showtemplate="FieldHex"/>
						<field type="bit" name="Size" longname="Size" mask="0x0000FFFF" size="4" showtemplate="FieldDec"/>
					</block>
					<field type="fixed" name="K1" longname="K1" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="K2" longname="K2" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="K3" longname="K3" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="K4" longname="K4" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="K5" longname="K5" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="Reserved" longname="Reserved" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="Hold time" longname="Hold time" size="2" showtemplate="FieldDec"/> 
					<block name="Software Version" longname="Software Version">
						<field type="bit" name="type" longname="type" mask="0xFFFF0000" size="4" showtemplate="FieldHex"/>
						<field type="bit" name="size" longname="size" mask="0x0000FFFF" size="4" showtemplate="FieldDec"/>
					</block>
					<field type="fixed" name="IOS release version" longname="IOS release version" size="2" showtemplate="eigrp.relversion"/> 
					<field type="fixed" name="EIGRP release version" longname="EIGRP release version" size="2" showtemplate="eigrp.relversion"/>
				</loop>
			</block>
		</fields>			
	</format>

	<visualization>
		<showtemplate name="eigrp.opcode" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Update"/> 
					<case value="2" show="Reserved"/> 
					<case value="3" show="Query"/> 
					<case value="4" show="IPX-SAP"/> 
					<case value="5" show="Hello"/> 
					<default show="Error in EIGRP code lookup"/> 
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="eigrp.relversion" showtype="dec" showgrp="1" showsep="."/>
	
		<showsumtemplate name="eigrp">
			<section name="next"/>
			<text value="EIGRP: "/>
			<protofield name="opcode" showdata="showmap"/>
		</showsumtemplate>
	</visualization>

</protocol>

<protocol name="ospf" longname="OSPF (Open Shortest Path First)" description="OSPF (Open Shortest Path First)" showsumtemplate="ospf">
	<!-- We should check that 'version' is equal to '2' -->
	<format>
		<fields>
			<field type="fixed" name="ver" longname="Version Number" description="The OSPF version number" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="type" longname="Type" description="Packet Type" size="1" showtemplate="ospf.type"/>
			<field type="fixed" name="plen" longname="Packet Length" description="The length of the OSPF protocol packet in bytes" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="rid" longname="Router ID" description="The Router ID of the packet's source" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="aid" longname="Area ID" description="A 32 bit number identifying the area that this packet belongs to" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="checksum" longname="CheckSum" description="The standard IP checksum of the entire contents of the packet" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="auty" longname="Authentication Type" description="Identifies the authentication procedure to be used for the packet" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="Auth" longname="Authentication" description="A 64-bit field for use by the authentication scheme" size="8" showtemplate="Field4BytesHex"/>

			<switch expr="buf2int(type)">
				<case value="1"> <includeblk name="Hello"/> </case>
				<case value="2"> <includeblk name="Database_D"/> </case>
				<case value="3"> <includeblk name="LS_Request"/> </case>
				<case value="4"> <includeblk name="LS_Update"/> </case>
				<case value="5"> <includeblk name="LS_Ack"/> </case>
			</switch>
		</fields>

		<block name="Hello" longname="Hello">
			<field type="fixed" name="netmask" longname="Network Mask" description="The network mask associated with this interface" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="helloint" longname="Hello Interval (sec)" description="Time between the router's hello packets" size="2" showtemplate="FieldDec"/>
			<block name="opt" longname="Options" description="The optional capabilities supported by the router">
				<field type="bit" name="DN" longname="DN-bit" mask="0x80" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="O" longname="O bit" mask="0x40" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="DC" longname="Demand Circuits" mask="0x20" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="EA" longname="EA-bit" mask="0x10" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="N/P" longname="NSSA" mask="0x08" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="MC" longname="Multicast Capable" mask="0x04" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="E" longname="External Routing Capability" mask="0x02" size="1" showtemplate="FieldBin"/>
			</block>
			<field type="fixed" name="RtrPri" longname="Router Priority" description="This router's Router Priority" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="RtrDeadInt" longname="Router Dead Interval" description="The number of seconds before declaring a silent router down" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="DesigRtr" longname="Designated Router" description="The identity of the Designated Router for this network" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="BackDesRtr" longname="Backup Designated Router" description=" The identity of the Backup Designated Router for this network" size="4" showtemplate="ip4addr-noplg"/>
			<block name="NR" longname="Neighbor List">
				<loop type="size" expr="$packetlength - $currentoffset">
					<field type="fixed" name="Neighbor" longname="Active Neighbor" description="The Router IDs of each router from whom valid Hello packets have been seen recently on the network" size="4" showtemplate="ip4addr-noplg"/>
 				</loop>
 			</block>
		</block>

		<block name="Database_D" longname="Database Description">
			<field type="fixed" name="intMTU" longname="Interface MTU" description="The size in bytes of the largest IP datagram that can be sent out the associated interface" size="2" showtemplate="FieldDec"/>
			<block name="options" longname="Options">
				<field type="bit" name="DN" longname="DN-bit" mask="0x80" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="O" longname="O bit" mask="0x40" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="DC" longname="Demand Circuits" mask="0x20" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="EA" longname="EA-bit" mask="0x10" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="N/P" longname="NSSA" mask="0x08" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="MC" longname="Multicast Capable" mask="0x04" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="E" longname="External Routing Capability" mask="0x02" size="1" showtemplate="FieldBin"/>
			</block>
			<block name="bts" longname="BTS">
				<field type="bit" name="res" longname="reserved" mask="0xF8" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="I-bit" longname="Init" mask="0x04" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="M-bit" longname="More" mask="0x02" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="MS-bit" longname="Master - Slave" mask="0x01" size="1" showtemplate="FieldBin"/>
			</block>
			<field type="fixed" name="DD" longname="Database Description Sequence Number" description="Used to sequence the collection of Database Description Packets" size="4" showtemplate="FieldDec"/>
			<block name="Link State Header" longname="Link State Headers">
				<loop type="size" expr="$packetlength - $currentoffset">
					<includeblk name="LSAHeader"/>
				</loop>
			</block>
		</block>

		<block name="LSAHeader" longname="LSA Header">
			<field type="fixed" size="2" name="lsage" longname="LS age" description="The time in seconds since the link state advertisement was originated" showtemplate="FieldDec"/>
			<block name="options" longname="Options">
				<field type="bit" name="DN" longname="DN-bit" mask="0x80" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="O" longname="O bit" mask="0x40" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="DC" longname="Demand Circuits" mask="0x20" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="EA" longname="EA-bit" mask="0x10" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="N/P" longname="NSSA" mask="0x08" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="MC" longname="Multicast Capable" mask="0x04" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="E" longname="External Routing Capability" mask="0x02" size="1" showtemplate="FieldBin"/>
			</block>
			<field type="fixed" name="lstype" longname="LS type" description="The type of the link state advertisement" size="1" showtemplate="ospf.lstype"/>
			<field type="fixed" name="lsid" longname="LS ID" size="4" description="Identifies the portion of the internet environment that is being described by the advertisement" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="advr" longname="Advertising router" size="4" description="The Router ID of the router that originated the link state advertisement" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="lsseq" longname="LS sequence number" description="Detects old or duplicate link state advertisements" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="lschk" longname="LS checksum" description="Fletcher checksum of the complete contents of the link state advertisement, including the link state advertisement header but excepting the LS age field" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="lslen" longname="LS length" description="Length in bytes of the link state advertisement" size="2" showtemplate="FieldDec"/>
		</block>

		<block name="LS_Ack" longname="Link State Acknowledgement">
			<loop type="size" expr="$packetlength - $currentoffset">
				<includeblk name="LSAHeader"/>
			</loop>
		</block>

		<block name="LS_Request" longname="Link State Request">
			<loop expr="$packetlength - $currentoffset" type="size">
				<field type="fixed" name="reqlstype" longname="LS Type" description="The type of the LSA" size="4" showtemplate="FieldHex"/>
				<field type="fixed" name="reqlsid" longname="LS ID" description="This field identifies the portion of the internet environment that is being described by the LSA" size="4" showtemplate="ip4addr-noplg"/>
				<field type="fixed" name="reqadvr" longname="Advertising Router" description="The Router ID of the router that originated the LSA" size="4" showtemplate="ip4addr-noplg"/>
			</loop>
		</block>

		<block name="TOS" longname="TOS">
			<field type="bit" name="MBZ" longname="Reserved" mask="0x80" size="1" showtemplate="FieldBin"/>
			<field type="bit" name="mindelay" longname="Minimum Delay" mask="0x40" size="1" showtemplate="FieldBin"/>
			<field type="bit" name="maxthroughput" longname="Maximum Throughput" mask="0x20" size="1" showtemplate="FieldBin"/>
			<field type="bit" name="maxreliability" longname="Maximum Reliability" mask="0x10" size="1" showtemplate="FieldBin"/>
			<field type="bit" name="minmonetarycost" longname="Minimum Moneraty Cost" mask="0x08" size="1" showtemplate="FieldBin"/>
			<field type="bit" name="precedence" longname="Precedence" mask="0x07" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="LS_Update" longname="Link State Update">
			<field type="fixed" name="nLSAs" longname="Number of LSAs" description="The number of LSAs included in this update" size="4" showtemplate="FieldDec"/>

			<block name="LSAcomplete" longname="Link State">
				<loop type="times2repeat" expr="buf2int(nLSAs)">

					<includeblk name="LSAHeader"/>

					<switch expr="buf2int(lstype)">
						<!-- Router link advertisment -->
						<case value="1">
							<block name="flags" longname="Flags">
								<field type="bit" name="reserved" longname="Reserved" mask="0xF800" size="2" showtemplate="FieldBin"/>
								<field type="bit" name="V" longname="Virtual Link Endpoint" mask="0x0100" size="2" showtemplate="FieldBin"/>
								<field type="bit" name="E" longname="External Router" mask="0x0200" size="2" showtemplate="FieldBin"/>
								<field type="bit" name="B" longname="Border Router" mask="0x0400" size="2" showtemplate="FieldBin"/>
								<field type="bit" name="reserved" longname="Reserved" mask="0x00FF" size="2" showtemplate="FieldBin"/>
							</block>

							<field type="fixed" name="nlink" longname="Number of links" size="2" showtemplate="FieldDec"/>

							<loop type="times2repeat" expr="buf2int(nlink)">
								<block name="link" longname="Router Link">
									<field type="fixed" name="linkid" longname="Link ID" size="4" showtemplate="ip4addr-noplg"/>
									<field type="fixed" name="linkd" longname="Link Data" size="4" showtemplate="ip4addr-noplg"/>
									<field type="fixed" name="linktype" longname="Link Type" size="1" showtemplate="ospf.linktype"/>
									<field type="fixed" name="ntos" longname="TOS" size="1" showtemplate="FieldDec"/>
									<field type="fixed" name="mtrc" longname="Metric" size="2" showtemplate="FieldDec"/>
									<block name="tos" longname="TOS List">
										<loop type="times2repeat" expr="buf2int(ntos)">
											<includeblk name="TOS"/>
											<field type="fixed" name="reserved" longname="Reserved" size="1" showtemplate="FieldDec"/>
											<field type="fixed" name="metric" longname="TOS metric" size="2" description="The cost of using this outbound router link, for traffic of the specified TOS" showtemplate="FieldHex"/>
										</loop>
									</block>
								</block>
							</loop>
						</case>

						<!-- Network link advertisement -->
						<case value="2">
							<field type="fixed" name="nmask" longname="Network Mask" size="4" showtemplate="ip4addr-noplg"/>
<!--								<block name="Attached routers" longname="Attached Routers"> -->
								<loop type="size" expr="$packetlength - $currentoffset">
									<field type="fixed" name="attachedr" longname="Attached router" size="4" description="The Router IDs of each of the routers attached to the network" showtemplate="ip4addr-noplg"/>
									</loop>
<!--								</block>  -->
						</case>

						<!-- Summary link advertisement (destination is an IP network) -->
						<case value="3">
							<field type="fixed" name="netmask" longname="Network Mask" size="4" showtemplate="ip4addr-noplg"/>
							<loop type="size" expr="$packetlength - $currentoffset">
								<includeblk name="TOS"/>
								<field type="fixed" name="metric" longname="TOS metric" description="The cost of this route" size="3" showtemplate="FieldDec"/>
							</loop>
						</case>

						<!-- Summary link advertisement (destination is an AS boundary router) -->
						<case value="4">
							<field type="fixed" name="netmask" longname="Network Mask" size="4" showtemplate="ip4addr-noplg"/>
							<loop type="size" expr="$packetlength - $currentoffset">
								<includeblk name="TOS"/>
								<field type="fixed" name="metric" longname="TOS metric" description="The cost of this route" size="3" showtemplate="FieldDec"/>
							</loop>
						</case>

						<!-- AS external link advertisement -->
						<case value="5">
							<field type="fixed" name="netmask" longname="Network Mask" size="4" showtemplate="ip4addr-noplg"/>
							<loop type="size" expr="$packetlength - $currentoffset">
								<includeblk name="TOS"/>
								<field type="fixed" name="metric" longname="TOS metric" description="The cost of this route" size="3" showtemplate="FieldDec"/>
								<field type="fixed" name="forwardaddr" longname="Forwarding Address" size="4" description="Data traffic for the advertised destination will be forwarded to this address" showtemplate="ip4addr-noplg"/>
								<field type="fixed" name="ertag" longname="External Route Tag" description="A 32-bit field attached to each external route" size="4" showtemplate="FieldDec"/>
							</loop>
						</case>
					</switch>
				</loop>
			</block>
		</block>
	</format>


	<visualization>
		<showtemplate name="ospf.type" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Hello"/>
					<case value="2" show="Database Description"/>
					<case value="3" show="Link State Request"/>
					<case value="4" show="Link State Update"/>
					<case value="5" show="Link State Acnowledgement"/>
					<default show="Error in OSPF Type lookup"/> 
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="ospf.lstype" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Router Link"/>
					<case value="2" show="Network Link"/>
					<case value="3" show="Summary Link to an IP Network"/>
					<case value="4" show="Summary Link to a border router"/>
					<case value="5" show="External Link"/>
					<default show="Error in OSPF Link State Type lookup"/> 
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="ospf.linktype" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Point-to-point connection to another router"/>
					<case value="2" show="Connection to a transit network"/>
					<case value="3" show="Connection to a stub network"/>
					<case value="4" show="Virtual link"/>
					<case value="5" show="External Link"/>
					<default show="Error in OSPF Link Type lookup"/> 
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="ospf">
			<section name="next"/>
			<text value="OSPFv. "/>
			<protofield name="ver" showdata="showvalue"/>
			<text value=": "/>
			<protofield name="type" showdata="showmap"/>
			<text value=", Router ID "/>
			<protofield name="rid" showdata="showvalue"/>
		</showsumtemplate>	
	</visualization>
</protocol>

<protocol name="ospf6" longname="OSPFv6 (Open Shortest Path First for IPv6)" showsumtemplate="ospf6">
	<format>
		<fields>
			<field type="fixed" name="version" longname="Version number" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="packetlength" longname="OSPF Packet Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="routerID" longname="Router ID" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="areaID" longname="Area ID" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="instanceID" longname="Instance ID" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="0" longname="Reserved" size="1" showtemplate="FieldDec"/>

			<switch expr="buf2int(type)">
				<case value="1">
					<!-- hello packet-->
					<field type="fixed" name="interfaceID" longname="Interface ID" size="4" showtemplate="ip4addr-noplg"/>
					<field type="fixed" name="rtrPri" longname="Router Priority" size="1" showtemplate="FieldDec"/>
					<block name="options1" longname="Optional capabilities supported by the router">
						<field type="bit" name="res" longname="Reserved (must be zero)" mask="0xFFFF" size="2" showtemplate="FieldHex"/>
					</block>
					<block name="options2" longname="Optional capabilities supported by the router">
						<field type="bit" name="DCbit" longname="Demand Circuits" mask="0x20" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="Rbit" longname="Router Bit" mask="0x10" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="Nbit" longname="N bit" mask="0x08" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="MCbit" longname="Multicast Bit" mask="0x04" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="Ebit" longname="Rxternal bit" mask="0x02" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="V6bit" longname="IPv6 bit" mask="0x01" size="1" showtemplate="FieldBin"/>
					</block>
					<field type="fixed" name="helloInterval" longname="Hello Interval (sec)" size="2" showtemplate="FieldDec"/>
					<field type="fixed" name="routerDeadInterval" longname="Router Dead Interval (sec)" size="2" showtemplate="FieldDec"/>
					<field type="fixed" name="designatedRouterID" longname="Designated Router ID" size="4" showtemplate="ip4addr-noplg"/>
					<field type="fixed" name="backupDesignatedRouterID" longname="Backup Designated Router ID" size="4" showtemplate="ip4addr-noplg"/>
					<block name="payload" longname="Neighbor List">
						<loop type="size" expr="$packetlength - 36">
							<field type="fixed" name="neighborID" longname="Neighbor ID" size="4" showtemplate="ip4addr-noplg"/>
						</loop>
					</block>
				</case>

				<case value="2">
					<!-- database description packet -->
					<field type="fixed" name="0" longname="00 00" size="1" showtemplate="FieldDec"/>
					<block name="options1" longname="optional capabilities supported by the router">
						<field type="bit" name="res" longname="Reserved (must be zero)" mask="0xFFFF" size="2" showtemplate="FieldHex"/>
					</block>
					<block name="options2" longname="optional capabilities supported by the router">
						<field type="bit" name="DCbit" longname="Demand Circuits" mask="0x20" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="Rbit" longname="Router Bit" mask="0x10" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="Nbit" longname="N bit" mask="0x08" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="MCbit" longname="Multicast Bit" mask="0x04" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="Ebit" longname="External bit" mask="0x02" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="V6bit" longname="IPv6 bit" mask="0x01" size="1" showtemplate="FieldBin"/>
					</block>
					<field type="fixed" name="interfaceMTU" longname="Interface MTU" size="2" showtemplate="FieldDec"/>
					<field type="fixed" name="0" longname="00 00" size="1" showtemplate="FieldDec"/>
					<block name="DDoptions" longname="Database Description Option">
						<field type="bit" name="res" longname="Reserved (must be zero)" mask="0xF8" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="Ibit" longname="Init bit" mask="0x04" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="Mbit" longname="More bit" mask="0x02" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="MSbit" longname="MasterSlave bit" mask="0x01" size="1" showtemplate="FieldBin"/>
					</block>
					<field type="fixed" name="DDsequenceNumber" longname="Sequence Number" size="4" showtemplate="FieldDec"/>
					<block name="LSAh" longname="Link State Headers List">
						<loop type="size" expr="$packetlength - 28">
							<includeblk name="LSAheaders"/>
						</loop>
					</block>
				</case>

				<case value="3">
				<!-- link state request packet-->
					<block name="payload" longname="Link State Request List">
						<loop type="size" expr="$packetlength - 16">
							<includeblk name="LSArequest"/>
						</loop>
					</block>
				</case>

				<case value="4">
					<!-- link state update packet-->
					<field type="fixed" name="numberLSA" longname="Number of LSAs" size="4" showtemplate="FieldDec"/>
					<block name="Lsapayload" longname="Link State Data">
						<loop type="times2repeat" expr="buf2int(numberLSA)">
							<includeblk name="LSAdata"/>
						</loop>
					</block>
				</case>

				<case value="5">
					<!-- link state ack packet -->
					<block name="LSAh" longname="Link State Headers List">
						<loop type="size" expr="$packetlength - 16">
							<includeblk name="LSAheaders"/>
						</loop>
					</block>
				</case>

			</switch>
		</fields>


		<!-- Options -->
		<block name="LSArequest" longname="LSA request">
			<field type="fixed" name="0" longname="00 00 00 00" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="LStype" longname="Link State type" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="LSID" longname="Link State ID" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="advertisingRouter" longname="Advertising Router" size="4" showtemplate="ip4addr-noplg"/>
		</block>

		<block name="LSAheaders" longname="LSA header">
			<field type="fixed" name="LSage" longname="LS age in second" size="2" showtemplate="FieldDec"/>
			<block name="DDoptions" longname="Database Description Option">
				<field type="bit" name="Ubit" longname="U bit" mask="0x8000" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="S2bit" longname="S2 bit" mask="0x4000" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="S1bit" longname="S1 bit" mask="0x2000" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="LSAfunctionCode" longname="LSA Function Code" mask="0x1FFF" size="2" showtemplate="FieldHex"/>
			</block>
			<field type="fixed" name="linkStateID" longname="Link State ID" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="advertisingRouter" longname="Advertising Router" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="LSsequence" longname="LS sequence" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="LSchecksum" longname="LS checksum" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="length" longname="Length of LSA" size="2" showtemplate="FieldDec"/>
		</block>
						
		<block name="LSAdata" longname="LSA packet">
			<field type="fixed" name="LSage" longname="LS age in second" size="2" showtemplate="FieldDec"/>
			<block name="DDoptions" longname="Database Description Option">
				<field type="bit" name="Ubit" longname="U bit" mask="0x8000" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="S2bit" longname="S2 bit" mask="0x4000" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="S1bit" longname="S1 bit" mask="0x2000" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="LSAfunctionCode" longname="LSA Function Code" mask="0x1FFF" size="2" showtemplate="FieldHex"/>
			</block>
			<field type="fixed" name="linkStateID" longname="Link State ID" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="advertisingRouter" longname="Advertising Router" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="LSsequence" longname="LS sequence" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="LSchecksum" longname="LS checksum" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="length" longname="Length of LSA" size="2" showtemplate="FieldDec"/>

			<switch expr="buf2int(LSAfunctionCode)">
				<case value="1">
					<!-- Router - LSA 1 -->
					<block name="options" longname="Options">
						<field type="bit" name="res" longname="Reserved (must be zero)" mask="0xF0" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="Wbit" longname="Wildcard multicast reciver" mask="0x08" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="Vbit" longname="virtula link endpoint" mask="0x04" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="Ebit" longname="External" mask="0x02" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="Bbit" longname="Border Router" mask="0x01" size="1" showtemplate="FieldBin"/>
					</block>
					<includeblk name="ocsr"/>
					<block name="RouterPayl" longname="Router Payload">
						<loop type="size" expr="buf2int(length) - 24">
							<includeblk name="RouterPayload"/>
						</loop>
					</block>
				</case>

				<case value="2">
					<!-- Network - LSA 2 -->
					<field type="fixed" name="0" longname="Reserved (must be zero)" size="1" showtemplate="FieldDec"/>
					<includeblk name="ocsr"/>
					<block name="NetworkPayload" longname="Attached Routers">
						<loop type="size" expr="buf2int(length) - 24">
							<field type="fixed" name="attachedRouter" longname="Attached Router" size="4" showtemplate="ip4addr-noplg"/>
						</loop>
					</block>
				</case>
						
				<case value="3">
					<!-- Inter Area Prefix - LSA 3 -->
					<field type="fixed" name="0" longname="Reserved (must be zero)" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="metrics" longname="cost of route" size="3" showtemplate="FieldDec"/>
					<field type="fixed" name="prefixLength" longname="Prefix Lengh" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="prefixOptions" longname="Prefix Options" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="0" longname="Reserved (must be zero)" size="2" showtemplate="FieldDec"/>
					<field type="variable" name="addressPrefix" longname="Address Prefix" expr="buf2int(prefixLength)" showtemplate="Field4BytesHex"/>
				</case>

				<case value="4">
					<!-- Inter Area Router - LSA 4 -->
					<field type="fixed" name="0" longname="Reserved (must be zero)" size="1" showtemplate="FieldDec"/>
					<includeblk name="ocsr"/>
					<field type="fixed" name="0" longname="Reserved (must be zero)" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="metrics" longname="Cost of route" size="3" showtemplate="FieldDec"/>
					<field type="fixed" name="destinationRouterID" longname="Destination Router ID" size="4" showtemplate="ip4addr-noplg"/>
				</case>

				<case value="5">
					<!-- AS external - LSA 5 -->
					<block name="options" longname="Options">
						<field type="bit" name="Ebit" longname="External metric" mask="0x04" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="Fbit" longname="Forwarding Address" mask="0x02" size="1" showtemplate="FieldBin"/>
						<field type="bit" name="Tbit" longname="External Route Tag" mask="0x01" size="1" showtemplate="FieldBin"/>
					</block>
					<field type="fixed" name="metrics" longname="Cost of route" size="3" showtemplate="FieldDec"/>
					<field type="fixed" name="prefixLength" longname="Prefix Lengh" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="prefixOptions" longname="Prefix Options" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="ReferenceLStype" longname="Reference LS Type" size="2" showtemplate="FieldDec"/>
					<field type="variable" name="addresPrefix" expr="buf2int(prefixLength)" showtemplate="Field4BytesHex"/>

					<if expr="buf2int(Fbit) == 1">
						<if-true>
							<field type="fixed" name="forwardingAddres" longname="Forwarding Address" size="16" showtemplate="FieldDec"/>
						</if-true>
					</if>

					<if expr="buf2int(Tbit) == 1">
						<if-true>
							<field type="fixed" name="ExternalRouteTag" longname="External Route Tag" size="4" showtemplate="FieldDec"/>
						</if-true>
					</if>

					<if expr="buf2int(ReferenceLStype) != 0">
						<if-true>
							<field type="fixed" name="referenceLink" longname="Reference Link State ID" size="4" showtemplate="FieldDec"/>
						</if-true>
					</if>
				</case>

				<case value="8">
					<!-- Link - LSA 8 -->
					<field type="fixed" name="rtrPri" longname="Router s Router Priority" size="1" showtemplate="FieldDec"/>
					<includeblk name="ocsr"/>
					<field type="fixed" name="LLIA" longname="Link Local Interface Address" size="16" showtemplate="Field4BytesHex"/>
					<field type="fixed" name="numPrefix" longname="Number Of prefix" size="4" showtemplate="FieldDec"/>
					<block name="LsaLinkpayload" longname="LSA Links Payloads">
						<loop type="size" expr="buf2int(numPrefix)">
							<field type="fixed" name="prefixLength" longname="Prefix Lengh" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="prefixOptions" longname="Prefix Options" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="0" longname="Reserved (must be zero)" size="2" showtemplate="FieldDec"/>
							<field type="variable" name="addresPrefix" expr="buf2int(prefixLength)" showtemplate="Field4BytesHex"/>
	 					</loop>
	 				</block>
				</case>

				<case value="9">
					<!-- Intra Area prefix - LSA 9 -->
					<field type="fixed" name="numPrefix" longname="Number of Prefix" size="2" showtemplate="FieldDec"/>
					<field type="fixed" name="ReferenceLStype" longname="Reference LS Type" size="2" showtemplate="FieldDec"/>
					<field type="fixed" name="referenceLinkStateID" longname="Reference Link State ID" size="4" showtemplate="FieldDec"/>
					<field type="fixed" name="referenceAdvertisingRouter" longname="Reference Advertising Router" size="4" showtemplate="FieldDec"/>
					<block name="LsaIntrPayload" longname="LSAIntrPayload">
						<loop type="size" expr="buf2int(numPrefix)">
							<field type="fixed" name="prefixLength" longname="Prefix Lengh" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="prefixOptions" longname="Prefix Options" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="metrics" longname="cost of route" size="2" showtemplate="FieldDec"/>
							<field type="variable" name="addressPrefix" longname="Address Prefix" expr="buf2int(prefixLength)" showtemplate="Field4BytesHex"/>
	 					</loop>
	 				</block>
				</case>
			</switch>
		</block>

		<block name="RouterPayload" longname="Router Payload">
			<field type="fixed" name="type" longname="type of interface" size="1" showtemplate="ospf.linktype"/>
			<field type="fixed" name="0" longname="Reserved (must be zero)" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="metrics" longname="cost of using interface" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="interfaceID" longname="Interface ID" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="neighborInterface" longname="Neighbor Interface ID" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="neighborRouterInterface" longname="Neighbor Router Interface" size="4" showtemplate="ip4addr-noplg"/>
		</block>
			
		<block name="ocsr" longname="optional capabilities supported by the router">
			<field type="fixed" name="option1" longname="optional capabilities supported by the router (reserved)" size="2" showtemplate="FieldDec"/>
			<block name="options2" longname="optional capabilities supported by the router (valid)">
				<field type="bit" name="DCbit" longname="Demand Circuits" mask="0x20" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="Rbit" longname="Router Bit" mask="0x10" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="Nbit" longname="N bit" mask="0x08" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="MCbit" longname="Multicast Bit" mask="0x04" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="Ebit" longname="Rxternal bit" mask="0x02" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="V6bit" longname="IPv6 bit" mask="0x01" size="1" showtemplate="FieldBin"/>
			</block>
		</block>
	</format>

	<visualization>
		<showsumtemplate name="ospf6">
			<section name="next"/>
			<text value="ospf6"/>
		</showsumtemplate>

		<showtemplate name="ospf.linktype" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Point-to-point connection to another router"/>
					<case value="2" show="Connection to a transit network"/>
					<case value="3" show="Connection to a stub network"/>
					<case value="4" show="Virtual link"/>
					<default show="Error in OSPF LinkType lookup"/> 
				</switch>
			</showmap>
		</showtemplate>

	</visualization>

</protocol>

<protocol name="bgp" longname="BGP4 (Border Gateway Protocol v.4)" showsumtemplate="bgp">
	<!--
		# From the L7-filter database
		# "After a transport protocol connection is established, the first
		# message sent by each side is an OPEN message."
		# "If the Type of the message is OPEN, or if the Authentication Code used
		# in the OPEN message of the connection is zero, then the Marker must be
		# all ones."
		# Then the 2 byte length field, then the 1 byte type field (1 = OPEN).
		# Then the BGP version: 3 was RFC'd in 1991, 4 was RFC'd in 1995.
		# Could keep going, but that should be sufficient.
		^\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff..?\x01[\x03\x04]
	-->
	<execute-code>
		<verify>
				<if expr="hasstring($packet[$currentoffset:0], '^\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff..?\x01[\x03\x04]',0)">
					<if-true>
						<assign-variable name="$protoverify_result" value="%FOUND"/>
					</if-true>
				</if>
		</verify>
		
		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#bgp"/>
				<lookupdata value="0"/>				
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#bgp"/>
							</update-lookuptable>
							<!-- delete that entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#bgp"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>


	<format>
		<fields>
			<field type="fixed" name="aut" longname="Authentication" size="16" showtemplate="Field4BytesHex"/>
			<field type="fixed" name="len" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="bgp.type"/>

			<switch expr="buf2int(type)">
				<case value="1">
					<includeblk name="BGPOpen"/>
				</case>
				<case value="2">
					<includeblk name="BGPUpdate"/>
				</case>
				<case value="3">
					<includeblk name="BGPNotification"/>
				</case>
			</switch>
		</fields>


		<block name="BGPOpen" longname="BGPOpen" showsumtemplate="BGPOpenBlock">
			<field type="fixed" name="ver" longname="Version" size="1" showtemplate="FieldHex"/> 
			<field type="fixed" name="asi" longname="My Autonomous System" size="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="hot" longname="Hold Time" size="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="bid" longname="BGP ID" size="4" showtemplate="ip4addr-noplg"/> 
			<field type="fixed" name="opl" longname="Optional Parameter Length" size="1" showtemplate="FieldDec"/>
		
			<loop type="size" expr="buf2int(opl)">
				<switch expr="buf2int($packet[$currentoffset:1])">
					<case value="1">
						<includeblk name="Authentication"/>
					</case>
					<case value="2">
						<includeblk name="Capabilities"/>
					</case>
					<default>
						<field type="fixed" name="opc" longname="Optional Parameters type" size="1" showtemplate="bgp.optparamtype"/>
						<field type="fixed" name="opp" longname="Optional Parameters length param" size="1" showtemplate="FieldHex"/> 
						<field type="variable" name="opv" longname="Optional parameters value" expr="buf2int(opp)" showtemplate="Field4BytesHex"/>
					</default> 
				</switch>
			</loop> 
		</block>

		<block name="Authentication" longname="Authentication">
			<field type="fixed" name="opc" longname="Optional Parameters code" size="1" showtemplate="bgp.optparamtype"/>
			<field type="fixed" name="opp" longname="Optional Parameters length param" size="1" showtemplate="FieldDec"/> 
			<field type="fixed" name="auc" longname="Authentication Code" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="aud" longname="Authentication Data" expr="buf2int(opp) - 1" showtemplate="Field4BytesHex"/>
		</block>

		<block name="Capabilities" longname="Capability advertisement">
			<field type="fixed" name="opp" longname="Optional Parameters length param" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="capc" longname="Capability code" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="capl" longname="Capability length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="capv" longname="Capability value" expr="buf2int(capl)" showtemplate="Field4BytesHex"/>
		</block>

		<block name="BGPUpdate" longname="BGPUpdate">
			<field type="fixed" name="url" longname="Unfeasible Routes Length" size="2" showtemplate="FieldHex"/> 

			<loop type="size" expr="buf2int(url)">
				<field type="fixed" name="wrl" longname="Withdrawn Route length" size="1" showtemplate="FieldHex"/>
				<field type="variable" name="wrp" longname="Withdrawn Route prefix" expr="(buf2int(wrl) + 7) div 8" showtemplate="Field4BytesHex"/>
			</loop>
		
			<field type="fixed" name="tpa" longname="Total Path Attribute Length" size="2" showtemplate="FieldHex"/> 

			<loop type="size" expr="buf2int(tpa)">
				<block name="paf" longname="Path Flags">
					<field type="bit" name="paO" longname="Path Attributes Flags Option" description="It defines whether the attribute is optional (if set to 1) or well-known (if set to 0)" mask="0x80" size="1" showtemplate="FieldBin"/>
					<field type="bit" name="paT" longname="Path Attributes Flags Transitive " description="It defines whether an optional attribute is transitive (if set to 1) or non-transitive (if set to 0)" mask="0x40" size="1" showtemplate="FieldBin"/>
					<field type="bit" name="paP" longname="Path Attributes Flags Partial" description="It defines whether the information contained in the optional transitive attribute is partial (if set to 1) or complete (if set to 0)" mask="0x20" size="1" showtemplate="FieldBin"/>
					<field type="bit" name="paE" longname="Path Attributes Flags Extended Length " description="It defines whether the Attribute Length is one octet (if set to 0) or two octets (if set to 1)" mask="0x10" size="1" showtemplate="FieldBin"/>
					<field type="bit" name="pau" longname="Path Attributes Flags unused or well-known (if set to 0)" mask="0x0F" size="1" showtemplate="FieldBin"/>	
				</block> 
		
				<field type="fixed" name="path" longname="Path Attr. Type Code" size="1" showtemplate="bgp.path"/> 

				<switch expr="buf2int(paE)">
					<case value="0">
						<field type="fixed" name="pal" longname="Path Attribute Length" size="1" showtemplate="FieldHex"/>
					</case>
					<case value="1">
						<field type="fixed" name="pal" longname="Path Attribute Length" size="2" showtemplate="FieldHex"/>
					</case>
				</switch>

				<switch expr="buf2int(pat)">
					<case value="1">
						<field type="fixed" name="patt" size="1" showtemplate="bgp.patt"/>
					</case>

					<case value="2">
						<loop type="size" expr="buf2int(pal)">
							<field type="fixed" name="pst" longname="Path Segment Type" size="1" showtemplate="bgp.pst"/>
							<field type="fixed" name="psl" longname="Path Segment Length" size="1" showtemplate="FieldHex"/>	
							<loop type="size" expr="buf2int(psl)">
								<field type="fixed" name="asn" longname="AS Number" size="2" showtemplate="FieldHex"/>
							</loop>
						</loop>
					</case>

					<case value="3">
						<field type="fixed" name="nhop" longname="Next Hop" size="4" showtemplate="ip4addr-noplg"/>
					</case>
					<case value="4">
						<field type="fixed" name="mexit" size="4" showtemplate="FieldHex"/>
					</case>
					<case value="5">
						<field type="fixed" name="locpref" size="4" showtemplate="FieldHex"/>
					</case>
					<case value="7">
						<field type="fixed" name="asn" longname="AS number" size="2" showtemplate="FieldHex"/>
						<field type="fixed" name="ipaddr" longname="IP Address" size="4" showtemplate="ip4addr-noplg"/>
					</case>
				</switch>
			</loop>
		
<!-- TEMP FULVIO: This code may be wrong; it seems to me that this loop depends also on 'url' and 'tpa' -->
			<loop type="size" expr="buf2int(len) - 23">
				<field type="fixed" name="nlr" longname="Network Reachable length" size="1" showtemplate="FieldHex"/>
				<field type="variable" name="nlp" longname="Network Reachable prefix" expr="buf2int(nlr)" showtemplate="Field4BytesHex"/>
			</loop>
		</block>

			
		<block name="BGPNotification" longname="BGPNotification">
			<switch expr="buf2int($packet[$currentoffset:1])">
				<case value="1"> <includeblk name="msghdrerr"/> </case>
				<case value="2"> <includeblk name="OPENmsgerr"/> </case>
				<case value="3"> <includeblk name="UPDATEmsgerr"/> </case>
				<case value="4"> <includeblk name="generr"/> </case>
				<case value="5"> <includeblk name="generr"/> </case>
				<case value="6"> <includeblk name="generr"/> </case>
			</switch>
		</block>
		
		<block name="msghdrerr" longname="Message Header Error">
			<field type="fixed" name="ercode" longname="Message Header Error" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="hdrerrcode" longname="Error subcode" size="1" showtemplate="bgp.hdrerrcode"/>
			<field type="variable" name="data" longname="Data" expr="buf2int(len) - 21" showtemplate="Field4BytesHex"/>
		</block>

		<block name="OPENmsgerr" longname="OPEN Message Error">
			<field type="fixed" name="ercode" longname="OPEN Message Error" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="openerrcode" longname="Error subcode" size="1" showtemplate="bgp.openerrcode"/>
			<field type="variable" name="data" longname="Data" expr="buf2int(len) - 21" showtemplate="Field4BytesHex"/>
		</block>

		<block name="UPDATEmsgerr" longname="UPDATE Message Error">
			<field type="fixed" name="ercode" longname="UPDATE Message Error" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="upderrcode" longname="Error subcode" size="1" showtemplate="bgp.upderrcode"/>
			<field type="variable" name="data" longname="Data" expr="buf2int(len) - 21" showtemplate="Field4BytesHex"/>
		</block>

		<block name="generr">
			<field type="fixed" name="ercode" longname="Error Code" size="1" showtemplate="bgp.generrcode"/>
			<field type="fixed" name="ersub" longname="Error subcode" size="1" showtemplate="FieldHex"/>
			<field type="variable" name="data" longname="Data" expr="buf2int(len) - 21" showtemplate="Field4BytesHex"/>
		</block>
	</format>

	<visualization>
		<showtemplate name="bgp.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Open"/> 
					<case value="2" show="Update"/> 
					<case value="3" show="Notification"/> 
					<case value="4" show="Keepalive"/> 
					<default show="Error in BGP Type lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="bgp.optparamtype" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Authentication"/>
					<case value="2" show="Capability advertisement"/>
					<default show="Optional parameter"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="bgp.path" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Origin"/>
					<case value="2" show="AS Path"/>
					<case value="3" show="Next Hop"/>
					<case value="4" show="Multi Exit Disc"/>
					<case value="5" show="Local Pref"/>
					<case value="6" show="Atomic Aggregate"/>
					<case value="7" show="Aggregator"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="bgp.patt" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="IGP - Network Layer Reachability Information is interior to the originating AS"/>
					<case value="1" show="EGP - Network Layer Reachability Information learned via EGP"/>
					<case value="2" show="INCOMPLETE - Network Layer Reachability Information learned by some other means"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="bgp.pst" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="AS Set - unordered set of ASs a route in the UPDATE message has traversed"/>
					<case value="2" show="AS_SEQUENCE - ordered set of ASs a route in the UPDATE message has traversed"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="bgp.hdrerrcode" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Connection not synchronized"/>
					<case value="2" show="Bad message length"/>
					<case value="3" show="Bad message type"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="bgp.openerrcode" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Unsupported version number"/>
					<case value="2" show="Bad peer AS"/>
					<case value="3" show="Bad BGP Identifier"/>
					<case value="4" show="Unsupported optional parameter"/>
					<case value="5" show="Authentication failure"/>
					<case value="6" show="Unacceptable hold time"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="bgp.upderrcode" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Malformed attribute list"/>
					<case value="2" show="Unrecognized well-known attribute"/>
					<case value="3" show="Missing well-known attribute"/>
					<case value="4" show="Attribute flags error"/>
					<case value="5" show="Attribute length error"/>
					<case value="6" show="Invalid origin attribute"/>
					<case value="7" show="AS routing loop"/>
					<case value="8" show="Invalid NEXT_HOP attribute"/>
					<case value="9" show="Optional attribute error"/>
					<case value="10" show="Invalid network field"/>
					<case value="11" show="Malformed AS_PATH"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="bgp.generrcode" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="4" show="Hold timer expired"/>
					<case value="5" show="Finite state machine error"/>
					<case value="6" show="Cease"/>
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="bgp">
			<section name="next"/>
			<text value="BGP: "/>
			<protofield name="type" showdata="showmap"/>
			<text value=", Auth "/>
			<protofield name="aut" showdata="showvalue"/>
		</showsumtemplate>
		
		<showsumtemplate name="BGPOpenBlock">
			<text value=" AS: "/>
			<protofield name="asi" showdata="showvalue"/>
		</showsumtemplate>

	</visualization>
</protocol>

<protocol name="dvmrp" longname="Distance Vector Multicast Routing Protocol" comment="RFC1075 - November 1988 - Experimental">
	<format>
		<fields>
			<loop type="size" expr="$packetlength - $currentoffset">
				<switch expr="buf2int($packet[$currentoffset:1])">
					<case value="0"> <includeblk name="NULL"/> </case>
					<case value="2"> <includeblk name="AFI"/> </case>
					<case value="3"> <includeblk name="Subnet"/> </case>
					<case value="4"> <includeblk name="Metric"/> </case>
					<case value="5"> <includeblk name="Flags0"/> </case>
					<case value="6"> <includeblk name="Infinity"/> </case>
					<case value="7"> <includeblk name="DA"/> </case>
					<case value="8"> <includeblk name="RDA"/> </case>
					<case value="9"> <includeblk name="NMR"/> </case>
					<case value="10"> <includeblk name="NMRC"/> </case>
				</switch>
			</loop>
		</fields>


		<block name="NULL" longname="NULL Command">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="dvmrp.type"/>
			<field type="fixed" name="ignored" longname="ignored" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="AFI" longname="AFI Optional Command">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="dvmrp.type"/>
			<field type="fixed" name="family" longname="Value" description="Default=2" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="Subnet" longname="Subnet Mask Optional Command">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="dvmrp.type"/>
			<field type="fixed" name="count" longname="Count" description="Possible value=[0,1]" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="mask" longname="Subnet Mask" expr="buf2int(count) * 4" showtemplate="ip4addr-noplg"/>
		</block>

		<block name="Metric" longname="Metric Optional Command">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="dvmrp.type"/>
			<field type="fixed" name="value" longname="Value" description="Possible value=[1,255]" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="Flags0" longname="Flags0 Optional Command">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="dvmrp.type"/>
			<field type="fixed" name="value" longname="Bit6: Split Horizon concealed route; Bit7: Destination unreachable" size="1" description="Default: all bits 0" showtemplate="FieldHex"/>
		</block>

		<block name="Infinity" longname="Infinity Optional Command">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="dvmrp.type"/>
			<field type="fixed" name="value" longname="Value" description="Possible value=[1,255]; Default=16" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="DA" longname="DA Optional Command">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="dvmrp.type"/>
			<field type="fixed" name="count" longname="Count" description="Possible value=[1,255]" size="1" showtemplate="FieldDec"/>
			<block name="Destination Addresses" longname="Destination Addresses">
				<loop type="times2repeat" expr="buf2int(count)">
					<field type="fixed" name="Destination Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="RDA" longname="RDA Optional Command">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="dvmrp.type"/>
			<field type="fixed" name="count" longname="Count" description="Possible value=[1,255]" size="1" showtemplate="FieldDec"/>
			<block name="Requested Destination Addresses" longname="Requested Destination Addresses">
				<loop type="times2repeat" expr="buf2int(count)">
					<field type="fixed" name="Requested Destination Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="NMR" longname="NMR Optional Command">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="dvmrp.type"/>
			<field type="fixed" name="count" longname="Count" description="Possible value=[1,255]" size="1" showtemplate="FieldDec"/>
			<block name="Multicast Addresses" longname="Multicast Addresses">
				<loop type="times2repeat" expr="buf2int(count)">
					<field type="fixed" name="Multicast Address" description="Address" size="4" showtemplate="ip4addr-noplg"/>
					<field type="fixed" name="Hold Down Time" description="Time" size="4" showtemplate="FieldDec"/>
				</loop>
			</block>
		</block>

		<block name="NMRC" longname="NMR Cancel Optional Command">
			<field type="fixed" name="type" longname="Option Type" size="1" showtemplate="dvmrp.type"/>
			<field type="fixed" name="count" longname="Count" description="Possible value=[1,255]" size="1" showtemplate="FieldDec"/>
			<block name="Multicast Addresses" longname="Multicast Addresses">
				<loop type="times2repeat" expr="buf2int(count)">
					<field type="fixed" name="Multicast Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>
	</format>


	<visualization>
		<showtemplate name="dvmrp.type" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Null Command"/>
					<case value="2" show="Address Family Indicator Command"/>
					<case value="3" show="Subnet Mask Command"/>
					<case value="4" show="Metric Command"/>
					<case value="5" show="Flags0 Command"/>
					<case value="6" show="Infinity Command"/>
					<case value="7" show="Destination Address Command"/>
					<case value="8" show="Requested Destination Address Command"/>
					<case value="9" show="Non Membership Report Command"/>
					<case value="10" show="Non Membership Report Cancel"/>
					<default show="Error in DVMRP type lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
	</visualization>
</protocol>
<protocol name="pim" longname="PIM v.2 (Protocol Indipendent Multicast)" showsumtemplate="pim">
	<format>
		<fields>
			<field type="bit" name="ver" longname="Version" description="Version must be 2" mask="0xF0" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="type" longname="Type" description="Numeric ID of PIM message" mask="0x0F" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="reserved" longname="Reserved byte" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="PimCheck" longname="Checksum" description="Message Checksum" size="2" showtemplate="FieldHex"/>

			<switch expr="buf2int(type)">
				<case value="0"> <includeblk name="PimHello"/> </case>
				<case value="1"> <includeblk name="PimRegister"/> </case>
				<case value="2"> <includeblk name="PimRegisterStop"/> </case>
				<case value="3"> <includeblk name="PimJoinPrune"/> </case>
				<case value="4"> <includeblk name="PimBootstrap"/> </case>
				<case value="5"> <includeblk name="PimAssert"/> </case>
				<case value="6"> <includeblk name="PimGraft"/> </case>
				<case value="7"> <includeblk name="PimGraftAck"/> </case>
				<case value="8"> <includeblk name="PimCandidateRPAdvertisement"/> </case>
				<case value="9"> <includeblk name="PimStateRefresh"/> </case>
			</switch>
		</fields>
		
		<block name="PimHello" longname="PIM Hello Message" showsumtemplate="pim.hello">
			<switch expr="buf2int($packet[$currentoffset:2])">

				<case value="1">
					<block name="HelloOldTime" longname="Hello Hold Time">
						<field type="fixed" name="OType" longname="Type: HoldTime" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Length" longname="Length of option" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Value" longname="Hold Time" size="2" showtemplate="FieldDec"/>
					</block>
				</case>

				<case value="2">
					<block name="LanPruneDelay" longname="Lan Prune Delay">
						<field type="fixed" name="OType" longname="Type : PruneDelay" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Length" longname="Length of option" size="2" showtemplate="FieldDec"/>
						<block name="delay" longname="Delay">
							<field type="bit" name="T" longname="Disable join suppression" mask="0x8000" size="2" showtemplate="FieldBin"/>
							<field type="bit" name="LanDelay" longname="Lan delay" mask="0x7FFF" size="2" showtemplate="FieldDec"/>
						</block>
						<field type="fixed" name="OverrideInterval" longname="Override Interval" size="2" showtemplate="FieldDec"/>
					</block>
				</case>

				<case value="19">
					<block name="DRPriority" longname="DR Priority">
						<field type="fixed" name="OType" longname="Type: DR priority" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Length" longname="Length of option" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Priority" longname="Priority" size="4" showtemplate="FieldDec"/>
					</block>
				</case>

				<case value="20">
					<block name="GenerationID" longname="Generation ID">
						<field type="fixed" name="OType" longname="Type: Generation ID" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Length" longname="Length of option" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Id" longname="Id" size="4" showtemplate="FieldDec"/>
					</block>
				</case>

				<case value="21">
					<block name="StateRefreshCapable" longname="State Refresh Capable">
						<field type="fixed" name="OType" longname="Type: State refresh cap" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Length" longname="Length of option" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Version" longname="Version" size="1" showtemplate="FieldDec"/>
						<field type="fixed" name="Interval" longname="Interval" size="1" showtemplate="FieldDec"/>
						<field type="fixed" name="Reserved" longname="Reserved" size="2" showtemplate="FieldDec"/>
					</block>
				</case>
			</switch>
		</block>

		<block name="PimRegister" longname="PIM Register Message" showsumtemplate="pim.register">
			<block name="bnres" longname="PIM Register Flags">
				<field type="bit" name="B" longname="Border Bit" mask="0x80000000" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="N" longname="Null Register Bit" mask="0x40000000" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="Reserved" longname="Reserved" mask="0x30000000" size="2" showtemplate="FieldHex"/>
			</block>
		</block>

		<block name="PimRegisterStop" longname="PIM Register Stop Message" showsumtemplate="pim.registerstop">
			<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="Reserved" longname="Reserved" mask="0xFE" size="1" showtemplate="FieldHex"/>
			<field type="bit" name="Z" longname="Admin Scope Zone" mask="0x01" size="1" showtemplate="FieldBin"/>
			<field type="fixed" name="MaskLen" longname="Mask Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="MulticastAddress" longname="Multicast Address" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="4" showtemplate="ip4addr-noplg"/>
		</block>

		<block name="PimJoinPrune" longname="PIM Join Prune Message" showsumtemplate="pim.joinprune">
			<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="Reserved" longname="Reserved" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="NumGroups" longname="Number of groups in message" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="HoldTime" longname="Hold time" size="2" showtemplate="FieldDec"/>
			<includeblk name="MulticastGroups"/>
		</block>

		<block name="PimBootstrap" longname="PIM Bootstrap Message" showsumtemplate="pim.bootstrap">
			<field type="fixed" name="FragmentTag" longname="Fragment tag identifier" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="HashMaskLen" longname="Hash mask len" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="BSRP" longname="Bootstrap Router priority" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="4" showtemplate="ip4addr-noplg"/>
		</block>

		<block name="PimAssert" longname="PIM Assert Message" showsumtemplate="pim.assert">
			<field type="fixed" name="MAddrFamily" longname="Multicast Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="MEncodingType" longname="Multicast Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="Reserved" longname="Reserved" mask="0xFE" size="1" showtemplate="FieldHex"/>
			<field type="bit" name="MZ" longname="Admin Scope Zone" mask="0x01" size="1" showtemplate="FieldBin"/>
			<field type="fixed" name="MMaskLen" longname="Multicast Mask Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="MulticastAddress" longname="Multicast Address" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="SAddrFamily" longname="Source Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="SEncodingType" longname="Source Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="SourceAddress" longname="Source Address" size="4" showtemplate="ip4addr-noplg"/>
			<block name="MetricR" longname="Masked Metric/R">
				<field type="bit" name="R" longname="Rendezvous" description="Rendezvous Point Tree bit" mask="0x80000000" size="4" showtemplate="FieldBin"/>
				<field type="bit" name="MetricPreference" longname="Metric Preference" mask="0x7FFFFFFF" size="4" showtemplate="FieldDec"/>
			</block>
			<field type="fixed" name="Metric" longname="Cost Metric" description="The cost metric of the unicast route to the source" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="PimGraft" longname="PIM Graft Message" showsumtemplate="pim.graft">
			<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="Reserved" longname="Reserved" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="NumGroups" longname="Number of groups in message" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="HoldTime" longname="Hold time" size="2" showtemplate="FieldDec"/>
			<includeblk name="MulticastGroups"/>
		</block>

		<block name="PimGraftAck" longname="PIM Graft Ack Message" showsumtemplate="pim.graftack">
			<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="Reserved" longname="Reserved" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="NumGroups" longname="Number of groups in message" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="HoldTime" longname="Hold time" size="2" showtemplate="FieldDec"/>
			<includeblk name="MulticastGroups"/>
		</block>

		<block name="PimCandidateRPAdvertisement" longname="PIM Candidate RP Advertisement Message" showsumtemplate="pim.candidaterp">
			<field type="fixed" name="PrefixCnt" longname="Prefix Cnt" description="number of encoded group addresses included in the message" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Priority" longname="Priority" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Holdtime" longname="Holdtime" description="amount of time the advertisement is valid" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="4" showtemplate="ip4addr-noplg"/>
			<block name="GroupAddresses" longname="Multicast Groups">
				<loop type="times2repeat" expr="buf2int(PrefixCnt)">
					<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
					<field type="bit" name="Reserved" longname="Reserved" mask="0xFE" size="1" showtemplate="FieldHex"/>
					<field type="bit" name="Z" longname="Admin Scope Zone" mask="0x01" size="1" showtemplate="FieldBin"/>
					<field type="fixed" name="MaskLen" longname="Mask Length" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="MulticastAddress" longname="Multicast Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>

		<block name="PimStateRefresh" longname="PIM State Refresh Message" showsumtemplate="pim.staterefresh">
			<field type="fixed" name="MAddrFamily" longname="Multicast Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="MEncodingType" longname="Multicast Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="Reserved" longname="Reserved" mask="0xFE" size="1" showtemplate="FieldHex"/>
			<field type="bit" name="MZ" longname="Admin Scope Zone" mask="0x01" size="1" showtemplate="FieldBin"/>
			<field type="fixed" name="MMaskLen" longname="Multicast Mask Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="MulticastAddress" longname="Multicast Address" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="SAddrFamily" longname="Source Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="SEncodingType" longname="Source Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="SourceAddress" longname="Source Address" size="4" showtemplate="ip4addr-noplg"/>
			<field type="fixed" name="OAddrFamily" longname="Originator Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="OEncodingType" longname="Originator Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="OriginatorAddress" longname="Originator Address" size="4" showtemplate="ip4addr-noplg"/>
			<block name="MetricR" longname="Masked Metric/R">
				<field type="bit" name="R" longname="Rendezvous bit" description="Rendezvous Point Tree bit" mask="0x80000000" size="4" showtemplate="FieldBin"/>
				<field type="bit" name="MetricPreference" longname="Metric Preference" mask="0x7FFFFFFF" size="4" showtemplate="FieldDec"/>
			</block>
			<field type="fixed" name="Metric" longname="Cost Metric" description="The cost metric of the unicast route to the source" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="Masklen" longname="Mask Length" description="length of the address mask of the unicast route to the source" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="TTL" longname="Time To Live" description="Time To Live of the State Refresh message" size="1" showtemplate="FieldDec"/>
			<block name="flags" longname="Flags">
				<field type="bit" name="P" longname="Prune" description="Prune indicator flag" mask="0x80" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="N" longname="PNow" description="Prune now Flag" mask="0x40" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="O" longname="Assert" description="Assert Override flag" mask="0x20" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="Reserved" longname="Reserved" description="Reserved bits" mask="0x1F" size="1" showtemplate="FieldBin"/>
			</block>
			<field type="fixed" name="Interval" longname="Interval" description="seconds between consecutive State Refresh messages" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="MulticastGroups" longname="Multicast Groups">
			<loop type="times2repeat" expr="buf2int(NumGroups)">
				<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
				<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
				<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="4" showtemplate="ip4addr-noplg"/>
				<field type="fixed" name="NumJoined" longname="Number of joined sources" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="NumPruned" longname="Number of pruned sources" size="2" showtemplate="FieldDec"/>
				<block name="JoinedSources" longname="Joined Sources">
					<loop type="times2repeat" expr="buf2int(NumJoined)">
						<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
						<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
						<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="4" showtemplate="ip4addr-noplg"/>
					</loop>
				</block>
				<block name="PrunedSources" longname="Pruned Sources">
					<loop type="times2repeat" expr="buf2int(NumPruned)">
						<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
						<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
						<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="4" showtemplate="ip4addr-noplg"/>
					</loop>
				</block>
			</loop>
		</block>
	</format>

	<visualization>
		<showsumtemplate name="pim">
			<section name="next"/>
			<text value="PIMv2"/>
		</showsumtemplate>

		<showsumtemplate name="pim.hello">
			<text value=" Hello"/>
		</showsumtemplate>
		<showsumtemplate name="pim.register">
			<text value=" Register"/>
		</showsumtemplate>
		<showsumtemplate name="pim.registerstop">
			<text value=" Stop Register"/>
		</showsumtemplate>
		<showsumtemplate name="pim.joinprune">
			<text value=" Join / Prune"/>
		</showsumtemplate>
		<showsumtemplate name="pim.bootstrap">
			<text value=" Bootstrap"/>
		</showsumtemplate>
		<showsumtemplate name="pim.assert">
			<text value=" Assert"/>
		</showsumtemplate>
		<showsumtemplate name="pim.graft">
			<text value=" Graft"/>
		</showsumtemplate>
		<showsumtemplate name="pim.graftack">
			<text value=" Graft Ack"/>
		</showsumtemplate>
		<showsumtemplate name="pim.candidaterp">
			<text value=" Candidate RP Advertisement"/>
		</showsumtemplate>
		<showsumtemplate name="pim.staterefresh">
			<text value=" State Refresh"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="pim6" longname="PIM v.2 for IPv6 (Protocol Indipendent Multicast)" showsumtemplate="pim6">
	<format>
		<fields>
			<field type="bit" name="PimVer" longname="Version" description="Version must be 2" mask="0xF0" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="PimType" longname="Type" description="Numeric id of PIM message" mask="0x0F" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="reserved" longname="Reserved byte" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="PimCheck" longname="Checksum" description="Message Checksum" size="2" showtemplate="FieldHex"/>

			<switch expr="buf2int(PimType)">
				<case value="0"> <includeblk name="PimHellov6"/> </case>
				<case value="1"> <includeblk name="PimRegisterv6"/> </case>
				<case value="2"> <includeblk name="PimRegisterStopv6"/> </case>
				<case value="3"> <includeblk name="PimJoinPrunev6"/> </case>
				<case value="4"> <includeblk name="PimBootstrapv6"/> </case>
				<case value="5"> <includeblk name="PimAssertv6"/> </case>
				<case value="6"> <includeblk name="PimGraftv6"/> </case>
				<case value="7"> <includeblk name="PimGraftAckv6"/> </case>
				<case value="8"> <includeblk name="PimCandidateRPAdvertisementv6"/> </case>
				<case value="9"> <includeblk name="PimStateRefreshv6"/> </case>
			</switch>
		</fields>

		<block name="PimHellov6" longname="PIM Hello Message ipv6" showsumtemplate="pim6.hello">
			<switch expr="buf2int($packet[$currentoffset:2])">
				<case value="1">
					<block name="HelloOldTime" longname="Hello Hold Time">
						<field type="fixed" name="Type" longname="Type: HoldTime" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Length" longname="Length of option" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Value" longname="Hold Time" size="2" showtemplate="FieldDec"/>
					</block>
				</case>

				<case value="2">
					<block name="LanPruneDelay" longname="Lan Prune Delay">
						<field type="fixed" name="Type" longname="Type: PruneDelay" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Length" longname="Length of option" size="2" showtemplate="FieldDec"/>
						<block name="delay" longname="Masked Delay">
							<field type="bit" name="T" longname="Disable join suppression" mask="0x8000" size="2" showtemplate="FieldBin"/>
							<field type="bit" name="LanDelay" longname="Lan delay" mask="0x7FFF" size="2" showtemplate="FieldDec"/>
						</block>
						<field type="fixed" name="OverrideInterval" longname="Override Interval" size="2" showtemplate="FieldDec"/>
					</block>
				</case>

				<case value="19">
					<block name="DRPriority" longname="DR Priority">
						<field type="fixed" name="Type" longname="Type: DR priority" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Length" longname="Length of option" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Priority" longname="Priority" size="4" showtemplate="FieldDec"/>
					</block>
				</case>

				<case value="20">
					<block name="GenerationID" longname="Generation ID">
						<field type="fixed" name="Type" longname="Type: Generation ID" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Length" longname="Length of option" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Id" longname="Id" size="4" showtemplate="FieldDec"/>
					</block>
				</case>

				<case value="21">
					<block name="StateRefreshCapable" longname="State Refresh Capable">
						<field type="fixed" name="Type" longname="Type: State refresh cap" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Length" longname="Length of option" size="2" showtemplate="FieldDec"/>
						<field type="fixed" name="Version" longname="Version" size="1" showtemplate="FieldDec"/>
						<field type="fixed" name="Interval" longname="Interval" size="1" showtemplate="FieldDec"/>
						<field type="fixed" name="Reserved" longname="Reserved" size="2" showtemplate="FieldDec"/>
					</block>
				</case>
			</switch>
		</block>

		<block name="PimRegisterv6" longname="PIM Register Message" showsumtemplate="pim6.register">
			<block name="bnres" longname="PIM Register Flags">
				<field type="bit" name="B" longname="Border Bit" mask="0x80000000" size="4" showtemplate="FieldBin"/>
				<field type="bit" name="N" longname="Null Register Bit" mask="0x40000000" size="4" showtemplate="FieldBin"/>
				<field type="bit" name="Reserved" longname="Reserved" mask="0x3FFFFFFF" size="4" showtemplate="FieldHex"/>
			</block>
		</block>

		<block name="PimRegisterStopv6" longname="PIM Register Stop Message" showsumtemplate="pim6.registerstop">
			<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="Reserved" longname="Reserved" mask="0xFE" size="1" showtemplate="FieldHex"/>
			<field type="bit" name="Z" longname="Admin Scope Zone" mask="0x01" size="1" showtemplate="FieldBin"/>
			<field type="fixed" name="MaskLen" longname="Mask Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="MulticastAddress" longname="Multicast Address" size="16" showtemplate="ip6addr-noplg"/>
			<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="16" showtemplate="ip6addr-noplg"/>
		</block>

		<block name="PimJoinPrunev6" longname="PIM Join Prune Message ipv6" showsumtemplate="pim6.joinprune">
			<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="16" showtemplate="ip6addr-noplg"/>
			<field type="fixed" name="Reserved" longname="Reserved" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="NumGroups" longname="Number of groups in message" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="HoldTime" longname="Hold time" size="2" showtemplate="FieldDec"/>
			<includeblk name="MulticastGroups"/>
		</block>


		<block name="PimBootstrapv6" longname="PIM Bootstrap Message ipv6" showsumtemplate="pim6.bootstrap">
			<field type="fixed" name="FragmentTag" longname="Fragment tag identifier" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="HashMaskLen" longname="Hash mask len" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="BSRP" longname="Bootstrap Router priority" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="16" showtemplate="ip6addr-noplg"/>
		</block>

		<block name="PimAssertv6" longname="PIM Assert Message ipv6" showsumtemplate="pim6.assert">
			<field type="fixed" name="MAddrFamily" longname="Multicast Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="MEncodingType" longname="Multicast Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="Reserved" longname="Reserved" mask="0xFE" size="1" showtemplate="FieldHex"/>
			<field type="bit" name="MZ" longname="Admin Scope Zone" mask="0x01" size="1" showtemplate="FieldBin"/>
			<field type="fixed" name="MMaskLen" longname="Multicast Mask Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="MulticastAddress" longname="Multicast Address" size="16" showtemplate="ip6addr-noplg"/>
			<field type="fixed" name="SAddrFamily" longname="Source Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="SEncodingType" longname="Source Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="SourceAddress" longname="Source Address" size="16" showtemplate="ip6addr-noplg"/>
			<block name="MetricR" longname="Metric/R">
				<field type="bit" name="R" longname="Rendezvous" description="Rendezvous Point Tree bit" mask="0x80000000" size="4" showtemplate="FieldBin"/>
				<field type="bit" name="MetricPreference" longname="Metric Preference" mask="0x7FFFFFFF" size="4" showtemplate="FieldHex"/>
			</block>
			<field type="fixed" name="Metric" longname="Cost Metric" description="The cost metric of the unicast route to the source" size="4" showtemplate="FieldDec"/>
		</block>

		<block name="PimGraftv6" longname="PIM Graft Message ipv6" showsumtemplate="pim6.graft">
			<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="16" showtemplate="ip6addr-noplg"/>
			<field type="fixed" name="Reserved" longname="Reserved" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="NumGroups" longname="Number of groups in message" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="HoldTime" longname="Hold time" size="2" showtemplate="FieldDec"/>
			<includeblk name="MulticastGroups"/>
		</block>

		<block name="PimGraftAckv6" longname="PIM Graft Ack Message ipv6" showsumtemplate="pim6.graftack">
			<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="16" showtemplate="ip6addr-noplg"/>
			<field type="fixed" name="Reserved" longname="Reserved" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="NumGroups" longname="Number of groups in message" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="HoldTime" longname="Hold time" size="2" showtemplate="FieldDec"/>
			<includeblk name="MulticastGroups"/>
		</block>

		<block name="PimCandidateRPAdvertisementv6" longname="PIM Candidate RP Advertisement Message ipv6" showsumtemplate="pim6.candidaterp">
			<field type="fixed" name="PrefixCnt" longname="Prefix Cnt" description="number of encoded group addresses included in the message" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Priority" longname="Priority" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Holdtime" longname="Holdtime" description="amount of time the advertisement is valid" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="16" showtemplate="ip6addr-noplg"/>
			<loop type="times2repeat" expr="buf2int(PrefixCnt)">
				<block name="GroupAddresses" longname="Multicast Groups">
					<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
					<field type="bit" name="Reserved" longname="Reserved" mask="0xFE" size="1" showtemplate="FieldHex"/>
					<field type="bit" name="Z" longname="Admin Scope Zone" mask="0x01" size="1" showtemplate="FieldBin"/>
					<field type="fixed" name="MaskLen" longname="Mask Length" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="MulticastAddress" longname="Multicast Address" size="16" showtemplate="ip6addr-noplg"/>
				</block>
			</loop>
		</block>

		<block name="PimStateRefreshv6" longname="PIM State Refresh Message ipv6" showsumtemplate="pim6.staterefresh">
			<field type="fixed" name="MAddrFamily" longname="Multicast Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="MEncodingType" longname="Multicast Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="Reserved" longname="Reserved" mask="0xFE" size="1" showtemplate="FieldHex"/>
			<field type="bit" name="MZ" longname="Admin Scope Zone" mask="0x01" size="1" showtemplate="FieldBin"/>
			<field type="fixed" name="MMaskLen" longname="Multicast Mask Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="MulticastAddress" longname="Multicast Address" size="16" showtemplate="ip6addr-noplg"/>
			<field type="fixed" name="SAddrFamily" longname="Source Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="SEncodingType" longname="Source Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="SourceAddress" longname="Source Address" size="16" showtemplate="ip6addr-noplg"/>
			<field type="fixed" name="OAddrFamily" longname="Originator Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="OEncodingType" longname="Originator Encoding Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="OriginatorAddress" longname="Originator Address" size="16" showtemplate="ip6addr-noplg"/>
			<block name="MetricR" longname="Masked Matric/R">
				<field type="bit" name="R" longname="Rendezvous bit" description="Rendezvous Point Tree bit" mask="0x80000000" size="4" showtemplate="FieldBin"/>
				<field type="bit" name="MetricPreference" longname="Metric Preference" mask="0x7FFFFFFF" size="4" showtemplate="FieldHex"/>
			</block>
			<field type="fixed" name="Metric" longname="Cost Metric" description="The cost metric of the unicast route to the source" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="Masklen" longname="Mask Length" description="length of the address mask of the unicast route to the source" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="TTL" longname="Time To Live" description="Time To Live of the State Refresh message" size="1" showtemplate="FieldDec"/>
			<block name="flags" longname="Flags">
				<field type="bit" name="P" longname="Prune" description="Prune indicator flag" mask="0x80" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="N" longname="PNow" description="Prune now Flag" mask="0x40" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="O" longname="Assert" description="Assert Override flag" mask="0x20" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="Reserved" longname="Reserved" description="Reserved bits" mask="0x1F" size="1" showtemplate="FieldBin"/>
			</block>
			<field type="fixed" name="Interval" longname="Interval" description="seconds between consecutive State Refresh messages" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="MulticastGroups" longname="Multicast Groups">
			<loop type="times2repeat" expr="buf2int(NumGroups)">
				<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
				<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
				<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="4" showtemplate="ip4addr-noplg"/>
				<field type="fixed" name="NumJoined" longname="Number of joined sources" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="NumPruned" longname="Number of pruned sources" size="2" showtemplate="FieldDec"/>
				<block name="JoinedSources" longname="Joined Sources">
					<loop type="times2repeat" expr="buf2int(NumJoined)">
						<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
						<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
						<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="4" showtemplate="ip4addr-noplg"/>
					</loop>
				</block>
				<block name="PrunedSources" longname="Pruned Sources">
					<loop type="times2repeat" expr="buf2int(NumPruned)">
						<field type="fixed" name="AddrFamily" longname="Address Family" description="The PIM address family" size="1" showtemplate="FieldDec"/>
						<field type="fixed" name="EncodingType" longname="Encoding Type" size="1" showtemplate="FieldDec"/>
						<field type="fixed" name="UnicastAddress" longname="Unicast Address" size="4" showtemplate="ip4addr-noplg"/>
					</loop>
				</block>
			</loop>
		</block>
	</format>

	<visualization>
		<showsumtemplate name="pim6">
			<section name="next"/>
			<text value="PIM6"/>
		</showsumtemplate>

		<showsumtemplate name="pim6.hello">
			<text value=" Hello"/>
		</showsumtemplate>
		<showsumtemplate name="pim6.register">
			<text value=" Register"/>
		</showsumtemplate>
		<showsumtemplate name="pim6.registerstop">
			<text value=" Stop Register"/>
		</showsumtemplate>
		<showsumtemplate name="pim6.joinprune">
			<text value=" Join / Prune"/>
		</showsumtemplate>
		<showsumtemplate name="pim6.bootstrap">
			<text value=" Bootstrap"/>
		</showsumtemplate>
		<showsumtemplate name="pim6.assert">
			<text value=" Assert"/>
		</showsumtemplate>
		<showsumtemplate name="pim6.graft">
			<text value=" Graft"/>
		</showsumtemplate>
		<showsumtemplate name="pim6.graftack">
			<text value=" Graft Ack"/>
		</showsumtemplate>
		<showsumtemplate name="pim6.candidaterp">
			<text value=" Candidate RP Advertisement"/>
		</showsumtemplate>
		<showsumtemplate name="pim6.staterefresh">
			<text value=" State Refresh"/>
		</showsumtemplate>
	</visualization>
	
</protocol>
<protocol name="ares" longname="Ares Protocol (File Sharing)" showsumtemplate="ares"> 
	<execute-code>
		<verify>
			<!--<if expr="hasstring($packet[$currentoffset:0], '(ares|\x09[\x01\x03\x05\x06\x07\x08]\x0F..\x14|\xE9\x70...\x14)', 0)">-->
			<if expr="hasstring($packet[$currentoffset:0],'^(\x03\0\x5A|\x09[\0\x01\x03\x05\x06\x07\x08]\x0F)',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="($protoverify_result == %FOUND) and ($L4proto == #tcp)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#ares"/>
				<lookupdata value="0"/>
			</update-lookuptable>
		</before>
		<before when="($protoverify_result == %FOUND) and ($L4proto == #udp)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#ares"/>
			</update-lookuptable>

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#ares"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#ares"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#ares"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>

	<format>
		<fields>
			<field type="variable" name="aresData" longname="Ares Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="ares">
			<section name="next"/>
			<text value="ARES"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="winmx" longname="WinMx v3.54 (File Sharing)" showsumtemplate="winmx"> 
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '(^\xE3\x88|\x22\x20\x4D$|^.j0%.r0%|^.i0%.q0%|^.q0%.y0%|Macrovision|^GET$|^SEND$|winmx)', 0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#winmx"/>
				<lookupdata value="0"/>
			</update-lookuptable>
		</before>
	</execute-code>
	<format>
		<fields>
			<field type="variable" name="WinMxData" longname="WinMx Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="winmx">
			<section name="next"/>
			<text value="WINMX"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="bittorrent" longname="BitTorrent Protocol (File Sharing)" showsumtemplate="bittorrent"> 
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '^(\x13bittorrent protocol|azver\x01$|get /scrape\?info_hash=)|d1:ad2:id20:|\x08\x277P\)[RP]', 0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>

			<!-- Old pattern.. seems very wrong....
			<if expr="hasstring($packet[$currentoffset:0],'(\x13bittorrent|torrentportal)|(BT-SEARCH|find_node|:ping1:|:id:|get_peers|info_hash|announce_peer|token|values|e1:t4)',0)">
			-->
		</verify>

	
		<before when="$protoverify_result == %FOUND">
		
			<if expr="checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
				<!-- elemento presente -->
				<if-true>
					<if expr="(buf2int($packet[$currentoffset + 4 : 1]) == 0x07) and  (buf2int($packet[$currentoffset  : 4]) gt 0x09)">
						<if-true>
							<assign-lookuptable name="$tcpsessiontable.flag" value="1"/>
						</if-true>
					</if>
					
					<if expr="(((buf2int($packet[$currentoffset + 4 : 1]) == 0x00) or (buf2int($packet[$currentoffset + 4 : 1]) == 0x01) or (buf2int($packet[$currentoffset + 4 : 1]) == 0x02) or (buf2int($packet[$currentoffset + 4 : 1]) == 0x03)) and buf2int($packet[$currentoffset  : 4]) == 0x01 ) or ( buf2int($packet[$currentoffset + 4 : 1]) == 0x04 and buf2int($packet[$currentoffset  : 4]) == 0x05 ) or ( buf2int($packet[$currentoffset + 4 : 1]) == 0x05 and buf2int($packet[$currentoffset  : 4]) gt 0x01 ) or ( buf2int($packet[$currentoffset + 4 : 1]) == 0x06 and buf2int($packet[$currentoffset  : 4]) == 0x0D ) ">
						<if-true>
							<assign-lookuptable name="$tcpsessiontable.flag" value="0"/>
							<if expr="checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
								<if-true>
									<assign-lookuptable name="$tcpsessiontable.flag" value="0"/>
								</if-true>
							</if>
						</if-true>
					</if>
					
				</if-true>
				
				<!-- the element is not present -->
				<if-false>
					<assign-variable name="$session_hit" value="1"/>
					<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
						<lookupkey value="$firstip"/>
						<lookupkey value="$secondip"/>
						<lookupkey value="$firstport"/>
						<lookupkey value="$secondport"/>
						<lookupdata value="#bittorrent"/>
						<lookupdata value="0"/>
					</update-lookuptable>
				</if-false>
			</if>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#bittorrent"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#bittorrent"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>

	<format>
		<fields>
			<if expr="hasstring($packet[$currentoffset:0], '\x13bittorrent', 0)">
				<if-true>
					<!-- handshake -->
					<field type="fixed" name="pstrlen" longname="Protocol string lentgh" size="1" showtemplate="FieldAscii"/>
					<field type="variable" name="pstr" longname="Protocol" expr="buf2int(pstrlen)" showtemplate="FieldAscii"/>
					<field type="fixed" name="reserved" longname="Reserved" size="8" showtemplate="FieldAscii"/>
					<field type="fixed" name="infohash" longname="Hash" size="20" showtemplate="FieldAscii"/>
					<field type="fixed" name="peerid" longname="Peer ID" size="20" showtemplate="FieldAscii"/>
				</if-true>				
			</if>
			
			<loop type="size" expr="$packetlength - $currentoffset">
				<block name="message" longname="Message">
					<switch expr="buf2int($packet[$currentoffset+4:1])">					
						<case value="0x00">
						<!-- we need this check, because a sequence such as 0x0000000000 is seen as a message  
						whe the 5th byte is 0x00, then the message length must be equal to 1 -->
							<if expr="buf2int($packet[$currentoffset:4])==1">
								<if-true>
									<field type="fixed" name="len" longname="Len" size="4" showtemplate="FieldAscii"/>
									<field type="fixed" name="id" longname="ID" size="1" showtemplate="FieldAscii"/> 
								</if-true>
								<if-false>
									<field type="variable" name="bittorrentdata" longname="bitTorrent Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
									<!--<field type="variable" name="bittorrentDownload" longname="bitTorrent Download" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>-->
								</if-false>
							</if>		
						</case>
			
						<case value="0x01">
							<field type="fixed" name="len" longname="Len" size="4" showtemplate="FieldAscii"/>
							<field type="fixed" name="id" longname="ID" size="1" showtemplate="bittorrent.id"/> 
						</case>
						
						<case value="0x02">
							<field type="fixed" name="len" longname="Len" size="4" showtemplate="FieldAscii"/>
							<field type="fixed" name="id" longname="ID" size="1" showtemplate="bittorrent.id"/> 
						</case>
						
						<case value="0x03">
							<field type="fixed" name="len" longname="Len" size="4" showtemplate="FieldAscii"/>
							<field type="fixed" name="id" longname="ID" size="1" showtemplate="bittorrent.id"/> 
						</case>
						
						<case value="0x04">
							<field type="fixed" name="len" longname="Len" size="4" showtemplate="FieldAscii"/> 
							<field type="fixed" name="id" longname="ID" size="1" showtemplate="bittorrent.id"/> 
							<field type="fixed" name="pieceindex" longname="Piece index" size="4" showtemplate="FieldAscii"/>
						</case>

						<case value="0x05">
							<field type="fixed" name="len" longname="Len" size="4" showtemplate="FieldAscii"/>
							<field type="fixed" name="id" longname="ID" size="1" showtemplate="bittorrent.id"/> 
							<field type="variable" name="bitfield" longname="Bitfield" expr="buf2int(len)-1" showtemplate="FieldAscii"/> 
						</case>

						<case value="0x06">
							<field type="fixed" name="len" longname="Len" size="4" showtemplate="FieldAscii"/>
							<field type="fixed" name="id" longname="ID" size="1" showtemplate="bittorrent.id"/> 
							<field type="fixed" name="index" longname="Index" size="4" showtemplate="FieldAscii"/> 
							<field type="fixed" name="begin" longname="Begin" size="4" showtemplate="FieldAscii"/> 
							<field type="fixed" name="length" longname="Length" size="4" showtemplate="FieldAscii"/> 
						</case>

						<case value="0x07">
							<field type="fixed" name="len" longname="Len" size="4" showtemplate="FieldAscii"/>
							<field type="fixed" name="id" longname="ID" size="1" showtemplate="bittorrent.id"/> 
							<field type="fixed" name="index" longname="Index" size="4" showtemplate="FieldAscii"/> 
							<field type="fixed" name="begin" longname="Begin" size="4" showtemplate="FieldAscii"/> 
							<field type="variable" name="block" longname="Block" expr="buf2int(len)-9" showtemplate="FieldAscii"/> 
						</case>

						<default>
							<field type="variable" name="bittorrentdata" longname="bitTorrent Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/> -->
						</default>	
					</switch> 
				</block>	
			</loop>
			
			<field type="variable" name="bittorrentdata" longname="bitTorrent Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/> -->
<!--			<field type="variable" name="bittorrentDownload" longname="bitTorrent Download" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>-->

		</fields>
	</format>

	<visualization>
		<showtemplate name="bittorrent.id" showtype="hex">
			<showmap>
				<switch expr="buf2int(this[0:1])">
					<case value="0x00" show="Choke"></case>
					<case value="0x01" show="Unchoke"></case>
					<case value="0x02" show="Interested"></case>
					<case value="0x03" show="Not Interested"></case>
					<case value="0x04" show="Have"></case>
					<case value="0x05" show="Bitfield"></case>
					<case value="0x06" show="Request"></case>
					<case value="0x07" show="Piece"></case>	
					<default show="Unkown messagge"/>
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="bittorrent">
			<section name="next"/>
			<text value="bitTorrent"/>
<!--			<if expr="ispresent(id) and buf2int(id)==0x07">
				<if-true>
					<text value=" download"/>
				</if-true>
			</if>	
-->
		<if expr ="checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
			<if-true>
				<if expr="$tcpsessiontable.flag == 1">
					<if-true>
						<text value=" download"/>
					</if-true>
				</if>
			</if-true>
		</if>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="edonk" longname="eDonkey (File Sharing)" showsumtemplate="edonk"> 
		<execute-code>
		<verify>
			<!-- All message are encoded in little-endian -->
			<!-- check if length of messagge is egual to four bytes after the marker -->
			<if expr="($packetlength - $currentoffset - 5) == buf2int(changebyteorder($packet[$currentoffset+1:4]))"> 
				<if-true>
					<if expr="hasstring($packet[$currentoffset:0], '(\xe3|\xc5).{4}[\x01\x02\x05\x14\x15\x16\x18\x19\x1a\x1b\x1c\x20\x21\x23\x32\x33\x34\x35\x36\x38\x40\x41\x42\x43\x44\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x60\x81\x82\x85\x87]',0)"> 
					
					<!--<if expr="hasstring($packet[$currentoffset:0], '[\xe3\xc5].{4}[\x01\x38\x4c]',0)">-->
						<if-true>
							<assign-variable name="$protoverify_result" value="%FOUND"/>
						</if-true>
					</if>
				</if-true>
			</if>
			<if expr="hasstring($packet[$currentoffset:0],'User-Agent: eMule',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>
		
		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#edonk"/>
				<lookupdata value="0"/>				
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#edonk"/>
							</update-lookuptable>
							<!-- delete entry from KnowServerTempTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#edonk"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
		
		<before when="hasstring($packet[$currentoffset:0],'^(\xe3....\x46)',0)">

			<if expr="checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
				<if-true>
					<assign-lookuptable name="$tcpsessiontable.flag" value="1"/>
				</if-true>
			</if>
		</before>
		
		<before when="hasstring($packet[$currentoffset:0],'^\xe3....[^\x46]',0)">
			<if expr="checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
				<if-true>
					<assign-lookuptable name="$tcpsessiontable.flag" value="0"/>
				</if-true>
			</if>
		</before>
	</execute-code>


   <format>
         <fields>
			<!-- check length of message instead of signature-->
			<!-- riesco a riconoscere anche i messaggi che hanno un tipo sconosciuto -->
			<!-- i messaggi "Sending part" non rispettano il vincolo sulla lunghezza del messaggio -->
			<!--<if expr="(($packetlength - $currentoffset - 5) == buf2int(changebyteorder($packet[$currentoffset+1:4])) or (buf2int($packet[$currentoffset : 1]) == 0xe3 and buf2int($packet[$currentoffset+ 5 :1]) == 0x46))"> -->
			
			<if expr="checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport) and $tcpsessiontable.flag == 1">
				<if-true>
					<field type="variable" name="eDonkeyDownload" longname="eDonkey Download" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
				</if-true>
			</if>
			<loop type="while" expr="$packetlength - $currentoffset">
				<if expr="buf2int($packet[$currentoffset :1]) == 0xe3 or buf2int($packet[$currentoffset :1]) == 0xc5"> 
					<if-true>
						<block name="header" longname="Header">
							<field type="fixed" size="1" name="marker" longname="Marker" showtemplate="FieldHex"/>
							<field type="fixed" size="4" name="messagelength"  longname="Length message" showtemplate="FieldHex"/> 
							<field type="fixed" size="1" name="typemessage" longname="Type message" showtemplate="edonk.type"/>
						</block>
						<switch expr="buf2int(typemessage)">
							<case value="0x01"> <includeblk name="login"/></case>
							<case value="0x38"> <includeblk name="server_message"/></case>
							<case value="0x32"> <includeblk name="server_list"/></case>
							<case value="0x41"> <includeblk name="server_info"/></case>
							<case value="0x46"> <includeblk name="sending_part"/></case>
							<case value="0x47"> <includeblk name="request_file_part"/></case>
							<case value="0x48"> <includeblk name="file_not_found"/></case>
							<case value="0x4c"> <includeblk name="hello_answer"/></case>
							<case value="0x4f"> <includeblk name="file_status_request"/></case>
							<case value="0x50"> <includeblk name="file_status"/></case>
							<case value="0x51"> <includeblk name="hashset_request"/></case>
							<case value="0x52"> <includeblk name="hashset_answer"/></case>
							<case value="0x54"> <includeblk name="slot_request"/></case>
							<case value="0x58"> <includeblk name="file_request"/></case>
							<case value="0x59"> <includeblk name="file_request_answer"/></case>
							<case value="0x5c"> <includeblk name="queue_rank"/></case>
							<default>
								<field type="variable" name="edonkey_data" longname="eDonkey Data" expr="buf2int(changebyteorder(messagelength)) -1" showtemplate="FieldAscii"/>
							</default>
						</switch>
					</if-true>
					
					<if-false>
						<field type="variable" name="eDonkeyDownload" longname="eDonkey Download" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
					</if-false>
				</if>			
			</loop>
	
		</fields>
		
		<block name="login" longname="Login">
			<field type="fixed" name="user_hash" longname="User Hash" size="16" showtemplate="FieldHex"/>
			<field type="fixed" name="client_id" longname="Client ID" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="tcp_port" longname="TCP Port" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="tags" longname="Tags" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>					
		</block>

		<block name="hello_answer" longname="Hello Answer">
			<field type="fixed" name="user_hash" longname="User Hash" size="16" showtemplate="FieldHex"/>
			<field type="fixed" name="client_id" longname="Client ID" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="tcp_port" longname="TCP Port" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="tags" longname="Tags" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>					
		</block>
	
		<block name="server_message" longname="Server Message">
			<field type="fixed" name="size" longname="Size" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="message" longname="Message" expr="buf2int(changebyteorder(size))" showtemplate="FieldAscii"/>					
		</block>
		
		<block name="file_request" longname="File Request">
			<field type="fixed" name="file_hash" longname="File Hash" size="16" showtemplate="FieldHex"/>
		</block>
		
		<block name="file_status_request" longname="File Status Request">
			<field type="fixed" name="file_hash" longname="File Hash" size="16" showtemplate="FieldHex"/>
		</block>
		
		<block name="file_request_answer" longname="File Request Answer">
			<field type="fixed" name="file_hash" longname="File Hash" size="16" showtemplate="FieldHex"/>
			<field type="fixed" name="name_length" longname="Name Length" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="file_name" longname="File Name" expr="buf2int(changebyteorder(name_length))" showtemplate="FieldAscii"/>					
		</block>
		
		<block name="file_status" longname="File Status">
			<field type="fixed" name="file_hash" longname="File Hash" size="16" showtemplate="FieldHex"/>
			<field type="variable" name="part_status_list" longname="Part Status List" expr="buf2int(changebyteorder(messagelength))- 16 -1" showtemplate="FieldAscii"/>					
		</block>
		
		<block name="slot_request" longname="Slot Request">
			<field type="fixed" name="file_hash" longname="File Hash" size="16" showtemplate="FieldHex"/>
		</block>

		<block name="hashset_request" longname="Hashset Request">
			<field type="fixed" name="file_hash" longname="File Hash" size="16" showtemplate="FieldHex"/>
		</block>
				
		<block name="file_not_found" longname="File Not Found">
			<field type="fixed" name="file_hash" longname="File Hash" size="16" showtemplate="FieldHex"/>
		</block>
		
		<block name="queue_rank" longname="Queue Rank">
			<field type="fixed" name="queue" longname="Queue" size="4" showtemplate="FieldDec"/>
		</block>
		
		<block name="sending_part" longname="Sending Part">
			<field type="fixed" name="file_hash" longname="File Hash" size="16" showtemplate="FieldHex"/>
			<field type="fixed" name="start_offset" longname="Start Offeset" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="end_offset" longname="End Offeset" size="4" showtemplate="FieldDec"/>
			
			<field type="variable" name="eDonkeyDownload" longname="eDonkey Download" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
			
		</block>
		
		<block name="request_file_part" longname="Request File Part">
			<field type="fixed" name="file_hash" longname="File Hash" size="16" showtemplate="FieldHex"/>
			<field type="variable" name="parts" longname="Parts" expr="buf2int(changebyteorder(messagelength)) - 16 -1" showtemplate="FieldHex"/>
		</block>
		
		<block name="hashset_answer" longname="Hashset Answer">
			<field type="fixed" name="file_hash" longname="File Hash" size="16" showtemplate="FieldHex"/>
			<field type="variable" name="part_hash_list" longname="Part Hash List" expr="buf2int(changebyteorder(messagelength)) - 16 -1" showtemplate="FieldHex"/>
		</block>
		
		<block name="server_list" longname="Server List">
			<field type="fixed" name="entry_count" longname="Entry count" size="1" showtemplate="FieldDec"/>
			<loop type="size" expr="buf2int(entry_count)*6">
				<block name="server" longname="Server">
					<field type="fixed" name="ip_server" longname="IP server" size="4" showtemplate="ip4addr"/>
					<field type="fixed" name="Port_server" longname="Port server" size="2" showtemplate="FieldDec"/>
				</block>
			</loop>
		</block>
		
		<block name="server_info" longname="Server Info">
			<field type="fixed" name="server_hash" longname="Server Hash" size="16" showtemplate="FieldHex"/>
			<field type="fixed" name="server_ip" longname="Server IP" size="4" showtemplate="ip4addr"/>
			<field type="fixed" name="server_port" longname="Server Port" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="tags" longname="Tags" expr="buf2int(changebyteorder(messagelength)) - 1 - 16 - 4 - 2"  showtemplate="FieldHex"/>
		</block>
	</format>

	<visualization>
		<showtemplate name="edonk.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this[0:1])">
					<case value="0x01" show="Hello"></case>
					<case value="0x14" show="Get list"></case>
					<case value="0x15" show="Offer file"></case>
					<case value="0x16" show="Search message"></case>
					<case value="0x19" show="Get source"></case>
					<case value="0x32" show="List of server"></case>
					<case value="0x33" show="Result search"></case>
					<case value="0x38" show="Login answer"></case>
					<case value="0x41" show="Server Info"></case>
					<case value="0x42" show="Found source"></case>
					<case value="0x46" show="Sending part"></case>
					<case value="0x47" show="Request file part"></case>
					<case value="0x48" show="File not found"></case>
					<case value="0x4C" show="Hello answer"></case>
					<case value="0x4F" show="File status request"></case>
					<case value="0x50" show="File status"></case>
					<case value="0x51" show="Hashset Request"></case>
					<case value="0x52" show="Hashset Answer"></case>
					<case value="0x54" show="Slot request"></case>
					<case value="0x55" show="Accept upload request"></case>
					<case value="0x56" show="Slot release"></case>
					<case value="0x57" show="Slot taken"></case>
					<case value="0x58" show="File request"></case>
					<case value="0x59" show="File request answer"></case>
					<case value="0x5c" show="Queue rank"></case>
					<default show="Unkown messagge"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showsumtemplate name="edonk">
			<section name="next"/>
			<text value="eDonkey "/>

			
			<if expr="ispresent(header)">
				<if-true>
					<text value=" ("/>
					<protofield name="typemessage" showdata="showmap"/>
					<text value=")"/>
				</if-true>
			</if>
			
			<if expr="checklookuptable ($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
				<if-true>
					<if expr="$tcpsessiontable.flag == 1">
						<if-true>
							<text value=" download"/>
						</if-true>
					</if>
				</if-true>
			</if>			

		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="edonkudp" longname="eDonkey (UDP)" showsumtemplate="edonkudp">
	<execute-code>
		<verify>
			<!-- client to client messages and client to server messages have different format -->
			<!-- client to client: marker length type message -->
			<!-- client to server: marker type message -->
			<!--<if expr="(hasstring($packet[$currentoffset:0],'^(\xe3|\xc5)([\0-\x0e]|\x90|\x96|\x97|\x98|\x92|\x99|\x9a|\x9b|\x9c|\x9e|\xa2|\xa3)',0)  or ((($packetlength - $currentoffset - 5) == buf2int(changebyteorder($packet[$currentoffset+1:4]))) and hasstring($packet[$currentoffset:0],'^\xc5(\x90|\x91|\x93)',0)))">-->
			<if expr="hasstring($packet[$currentoffset : 0],'^\xe4[\x01\09\x10\x11\x18\x19\x20\x21\x28\x29\x30\x34\x40\x48\x52]',0) or (hasstring($packet[$currentoffset:0],'^[\xe3\xc5][\x90\x94\x96\x97\x98\x92\x99\x9a\x9b\x9c\x9e\xa2\xa3]',0)  or ((($packetlength - $currentoffset - 5) == buf2int(changebyteorder($packet[$currentoffset+1:4]))) and hasstring($packet[$currentoffset:0],'^\xc5[\x90\x91\x93]',0)))">
				
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>				
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#edonkudp"/>
			</update-lookuptable>	

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#edonkudp"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<update-lookuptable name="$KnownUDPServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
						<lookupkey value="$ipsrc"/>
						<lookupkey value="$portsrc"/>
						<lookupdata value="#edonkudp"/>
					</update-lookuptable>

					<update-lookuptable name="$KnownUDPServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
						<lookupkey value="$ipdst"/>
						<lookupkey value="$portdst"/>
						<lookupdata value="#edonkudp"/>
					</update-lookuptable>
				</if-true>
			</if>
		</before>			
	</execute-code>
	
	<format>
		<fields>
			<block name="header" longname="Header">
				<field type="fixed" name="marker" size="1" longname="Marker" showtemplate="FieldHex"/>
				<field type="fixed" name="typemessage" size="1" longname="Type message" showtemplate="FieldHex"/>
			</block>
			<field type="variable" name="eDonkeyData" longname="eDonkey Data" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="edonkudp">
			<section name="next"/>
			<text value="eDonkey"/>
			<if expr="ispresent(marker) and marker=='\xe4'">
				<if-true>
					<text value=" 0xE4"/>
				</if-true>
			</if>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="fasttrack" longname="FastTrack" showsumtemplate="fasttrack">
		<execute-code>
		<verify>
		<!-- this signature identify only download sessions -->
		<!-- signaling sessions are encrypted except first two messages -->
		<!-- session establishement message have not a known format -->
			<if expr="hasstring($packet[$currentoffset:0], 'get (/.download/.*|/.supernode.|/.status.|/.network.*|/.files|/.file[0-9]{4}-[0-9a-zA-Z]{34}|/.hash=[0-9a-f]) http/1.1|user-agent: kazaa|x-kazaa(-username|-network|-ip|-supernodeip|-xferid|-xferuid|tag)|give [0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]?[0-9]?[0-9]?',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
			<if expr="hasstring($packet[$currentoffset:0], '[\x27\x28].{4}[\x80]\x4b\x61\x5a\x61\x41',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="($protoverify_result == %FOUND) and ($L4proto == #tcp)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#fasttrack"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#fasttrack"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#fasttrack"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
		
		<before when="($protoverify_result == %FOUND) and ($L4proto == #udp)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#fasttrack"/>
			</update-lookuptable>

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#fasttrack"/>
			</update-lookuptable>
		</before>	
	</execute-code>
	
	<format>
		<fields>
			<if expr="$L4proto == #tcp">
				<if-true>
					<if expr="$packet[$currentoffset:3] == 'GET'">
						<if-true>
							<field type="tokenended" name="method" longname="Method" endtoken=" " showtemplate="FieldAscii"/>
							<field type="tokenended" name="resource" longname="Resource" endtoken=" " showtemplate="FieldAscii"/>
							<field type="line" name="version" longname="Version" showtemplate="FieldAscii"/>
							
							<field type="tokenended" name="headers" longname="Headers" endtoken="\x0D\x0A\x0D\x0A" showtemplate="FieldAscii"/>					
						</if-true>
					</if>
					
					<if expr="$packet[$currentoffset:4] == 'HTTP'">
						<if-true>
							<field type="tokenended" name="version" longname="Version" endtoken=" " showtemplate="FieldAscii"/>
							<field type="tokenended" name="response" longname="Response" endtoken="\x0D\x0A" showtemplate="FieldAscii"/>
							<field type="tokenended" name="headers" longname="Headers" endtoken="\x0D\x0A\x0D\x0A" showtemplate="FieldAscii"/>					
							
						</if-true>
					</if>
				</if-true>
				
				<!--<if-false>-->
				<!--UDP-->
				<!--</if-false>-->
			</if>
			<field type="variable" name="fasttrackData" longname="Fasttrack Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="fasttrack">
			<section name="next"/>

					<text value="Fasttrack"/>
					
					<if expr="$L4proto == #udp">
						<if-true>
							<text value=" UDP"/>
						</if-true>
						<if-false>
							<if expr="ispresent(method)">
								<if-true>
									<text value=" Request"/>
								</if-true>
								<if-false>
									<text value=" Download"/>
								</if-false>
							</if>						
						</if-false>
					</if>
			
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="gnutella" longname="Gnutella" showsumtemplate="gnutella"> 
	<execute-code>
		<verify>
		<!-- Description at http://www9.limewire.com/developer/gnutella_protocol_0.4.pdf -->
		<!-- in questo modo se il messaggio contiene bearshare viene classificato come gnutella -->
		<!-- The message must contain "GNUTELLA CONNECT or "GNUTELLA OK" or "GET", with the "user-agent" associated to a known value -->
			<if expr="hasstring($packet[$currentoffset:0],'connect back|gnutella conne|gnutella/0\.[0-9] [1-5][0-9][0-9]|(user-agent: (bearshare|gnutella|limewire|frostwire|foxy|mxie|360share))',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
			<if expr="hasstring($packet[$currentoffset:0], '^.{16}[\0\x01\x31\x80\x81]',0) and (($packetlength - $currentoffset - 23) == buf2int(changebyteorder($packet[$currentoffset+19:4]))) "> 
				<if-true>
						<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		        <if expr="hasstring($packet[$currentoffset:0], '^gnd[\0\x01\x02]',0)"> 
				<if-true>
						<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
		
			<if expr="checklookuptable ($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
				<if-true>
					<if expr="$packet[$currentoffset : 3] == 'GET'">
					<if-true>
							<assign-lookuptable name="$tcpsessiontable.flag" value="1"/>
					</if-true>					
					</if> 
				</if-true>
				
				<if-false>
					<assign-variable name="$session_hit" value="1"/>
					<if expr="$packet[$currentoffset : 3] == 'GET'">
						<if-true>
							<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$firstip"/>
								<lookupkey value="$secondip"/>
								<lookupkey value="$firstport"/>
								<lookupkey value="$secondport"/>
								<lookupdata value="#gnutella"/>
								<lookupdata value="1"/>
							</update-lookuptable>
						</if-true>
						<if-false>
							<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$firstip"/>
								<lookupkey value="$secondip"/>
								<lookupkey value="$firstport"/>
								<lookupkey value="$secondport"/>
								<lookupdata value="#gnutella"/>
								<lookupdata value="0"/>
							</update-lookuptable>
						</if-false>
					</if>
				</if-false>
			</if>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#gnutella"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#gnutella"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>

	<format>
		<fields>
			<if expr="$packet[$currentoffset : 3] == 'GET'">
				<if-true>
					<field type="tokenended" name="method" longname="Method" endtoken=" " showtemplate="FieldAscii"/>
					<field type="tokenended" name="resource" longname="Resource" endtoken=" " showtemplate="FieldAscii"/>
					<field type="line" name="version" longname="Version" showtemplate="FieldAscii"/>
					
					<field type="tokenended" name="headers" longname="Headers" endtoken="\x0D\x0A\x0D\x0A" showtemplate="FieldAscii"/>
					
				</if-true>
			</if>
			
			<if expr="hasstring($packet[$currentoffset:0],'gnutella',0)">
				<if-true>
					<field type="tokenended" name="connection" longname="Connection" endtoken="\x0D\x0A" showtemplate="FieldAscii"/>
					<field type="tokenended" name="headers" longname="Headers" endtoken="\x0D\x0A\x0D\x0A" showtemplate="FieldAscii"/>					
				</if-true>
			</if>
			
			<field type="variable" name="message" longname="Message" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
			<!--<field type="variable" name="bearshData" longname="BearShare Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>-->
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="gnutella">
			<section name="next"/>
			<text value="Gnutella"/>
	
			<if expr="checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
				<if-true>
					<!--<text expr="$tcpsessiontable.flag"/>-->
					<if expr="$tcpsessiontable.flag == 1">
						<if-true>
							<text value=" download"/>
						</if-true>
					</if>
				</if-true>
			</if>			
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="dcpp" longname="Direct Connect Plus Plus Protocol (File Sharing)" showsumtemplate="dcpp"> 
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '^(\$(MyNick|Lock|Key|Direction|GetListLen|ListLen|MaxedOut|Error|Send|Get|FileLength|Canceled|HubName|ValidateNick|ValidateDenide|GetPass|Mypass|BadPass|Version|Hello|Logedin|MyINFO|GetINFO|GetNickList|NickList|OpList|To|ConnectToMe|MultiConnectToMe|RevConnectToMe|Search|MultiSearch|SR|Kick|OpForceMove|ForceMove|Quit))', 0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>
		
		<before when="$protoverify_result == %FOUND">
<!--
			<if expr="$packet[$currentoffset : 6] == '$ADCSND'">
				<if-true>
-->

					<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
						<lookupkey value="$firstip"/>
						<lookupkey value="$secondip"/>
						<lookupkey value="$firstport"/>
						<lookupkey value="$secondport"/>
						<lookupdata value="#dcpp"/>
						<lookupdata value="1"/>
					</update-lookuptable>

<!--
				</if-true>
			</if>
-->

<!--
			<if expr="checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
-->
				<!-- it exists -->
<!--
				<if-true>
					<if expr="$tcpsessiontable.flag != 1">
						<if-true>
							<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$firstip"/>
								<lookupkey value="$secondip"/>
								<lookupkey value="$firstport"/>
								<lookupkey value="$secondport"/>
								<lookupdata value="#dcpp"/>
								<lookupdata value="0"/>
							</update-lookuptable>
						</if-true>
					</if>
				</if-true>
-->
				
				<!-- it doesn't exist -->
<!--
				<if-false>
					<assign-variable name="$session_hit" value="1"/>
					<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
						<lookupkey value="$firstip"/>
						<lookupkey value="$secondip"/>
						<lookupkey value="$firstport"/>
						<lookupkey value="$secondport"/>
						<lookupdata value="#dcpp"/>
						<lookupdata value="0"/>
					</update-lookuptable>
				</if-false>
			</if>

			<if expr="$packet[$currentoffset : 6] == '$ADCSND'">
				<if-true>
					<assign-lookuptable name="$tcpsessiontable.flag" value="1"/>	
				</if-true>
			</if>
-->

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#dcpp"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#dcpp"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>


	<format>
		<fields>
			<if expr="hasstring($packet[$currentoffset:0], '^(\$(MyN|ADC|Loc|Key|Dir|Get|Lis|Max|Err|Sen|Fil|Can|Hub|Val|Val|Myp|Bad|Ver|Hel|Log|MyI|Nic|OpL|To|Con|Mul|Rev|Sea|SR|Kic|OpFo|For|Qui))', 0)">
				<if-true>
					<!-- packet starts with command -->
					<loop type="size" expr="$packetlength - $currentoffset">
						<field type="tokenended" name="command" longname="Command" endtoken="\x7C" showtemplate="FieldAscii"/>
					</loop>
				</if-true>
				
				<if-false>

					<if expr="checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
						<if-true>
						
							<!--<if expr="$dcppdownload == 0">-->
							<if expr="$tcpsessiontable.flag == 0">
								<if-true> 

									<!-- at most take whole packet -->
									<field type="tokenended" name="DCdata" longname="DC data" endtoken="\x7C" showtemplate="FieldAscii"/>
									<!-- comandi rimanenti -->
									<loop type="size" expr="$packetlength - $currentoffset">
										<field type="tokenended" name="command" longname="Command" endtoken="\x7C" showtemplate="FieldAscii"/>
									</loop>							
								</if-true>
							</if>
							
							<if expr="$tcpsessiontable.flag == 1">						
								<if-true>
									<field type="variable" name="DCdownload" longname="DC download" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
								</if-true>
							</if>
						</if-true>

						<if-false>
							<field type="variable" name="Data" longname="Unknown data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
						</if-false>
					</if>

				</if-false>
			</if>	
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="dcpp">
			<section name="next"/>
			<text value="DCPP "/>
									
			<if expr="ispresent(command)">
				<if-true>
				
					<if expr="command[0:3] == '$Search' ">
						<if-true>
							<text value=" search"/>
						</if-true>
					</if>

					<if expr="command[0:3] == '$SR' ">
						<if-true>
							<text value=" search result"/>
						</if-true>
					</if>						
					
				</if-true>
			</if>

			<if expr="ispresent(DCdownload)">
				<if-true>
					<text value=" download"/>
				</if-true>
			</if>

		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="peerenabler" longname="Peer Enabler" showsumtemplate="peer">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0],'^\x43\x4c',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>
		
		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#peerenabler"/>
			</update-lookuptable>

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#peerenabler"/>
			</update-lookuptable>
		</before>		
	</execute-code>
	
	<format>
		<fields>
			<field type="variable" name="peerdata" longname="PeerEnabler Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="peer">
			<section name="next"/>
			<text value="PeerEnabler"/>
		</showsumtemplate>
	</visualization>	
	
</protocol>

<protocol name="slsk" longname="SoulSeek" showsumtemplate="slsk">
	<execute-code>
		<verify>
			<!--<if expr="hasstring($packet[$currentoffset : 0],'^(\x05..?|.\x01.[ -~]+\x01F..?.?.?.?.?.?.?)$',0) and (buf2int(changebyteorder($packet[$currentoffset + 4 : 4]))==0x01 and hasstring($packet[$currentoffset:0],'^............[a-zA-Z].*',0))">-->
			<if expr="(buf2int(changebyteorder($packet[$currentoffset + 4 : 4]))==0x01 and hasstring($packet[$currentoffset:0],'^............[a-zA-Z].*',0))">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>
		
		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#slsk"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#slsk"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable-->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#slsk"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>

	<format>
		<fields>
			<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="slsk">
			<section name="next"/>
			<text value="SoulSeek"/>
		</showsumtemplate>
	</visualization>			
</protocol>
<protocol name="tvants" longname="TVants P2PTV" showsumtemplate="tvants">
<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '^\x04\0[\x07\x05]\0..\0\0[\x53\x44]\x53\0[\x11\x12\x13]\0',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="($protoverify_result == %FOUND) and ($L4proto == #udp)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#tvants"/>
			</update-lookuptable>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#tvants"/>
			</update-lookuptable>
		</before>

		<before when="($L4proto == #tcp) and ($protoverify_result == %FOUND)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#tvants"/>
				<lookupdata value="0"/>
			</update-lookuptable>
		</before>	
</execute-code>
	<format>
		<fields>
			<field type="variable" name="tvdata" longname="tvants data" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="tvants">
			<section name="next"/>
			<text value="tvants"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="sopcast" longname="Sopcast P2PTV" showsumtemplate="sopcast">
<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '^\0.\x01.....(\x06\x01|\x01\x01|\x01\xff|\x03\xff)',0)">
				<if-true>
					<if expr="$payloadlength+8 == buf2int(changebyteorder($packet[$currentoffset+10:2]))+16">
						<if-true>
							<assign-variable name="$protoverify_result" value="%FOUND"/>
						</if-true>
					</if>
				</if-true>
			</if>
			<if expr="hasstring($packet[$currentoffset:0], '^\xff\xff\x01.......\0',0)">
				<if-true>
					<if expr="$payloadlength+8 == buf2int($packet[$currentoffset+11:1])+16">
						<if-true>
							<assign-variable name="$protoverify_result" value="%FOUND"/>
						</if-true>
					</if>
				</if-true>
			</if>
		</verify>

		<before when="($protoverify_result == %FOUND) and ($L4proto == #udp)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#sopcast"/>
			</update-lookuptable>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#sopcast"/>
			</update-lookuptable>
		</before>

		<before when="($L4proto == #tcp) and ($protoverify_result == %FOUND)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#sopcast"/>
				<lookupdata value="0"/>
			</update-lookuptable>
		</before>	
</execute-code>
	<format>
		<fields>
			<field type="variable" name="sopcastdata" longname="sopcast data" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="sopcast">
			<section name="next"/>
			<text value="sopcast"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="pplive" longname="PPLive P2PTV" showsumtemplate="pplive">
<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '^\xe9\x03..\x98\xab\x01\x02',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="($protoverify_result == %FOUND) and ($L4proto == #udp)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#pplive"/>
			</update-lookuptable>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#pplive"/>
			</update-lookuptable>
		</before>

		<before when="($L4proto == #tcp) and ($protoverify_result == %FOUND)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#pplive"/>
				<lookupdata value="0"/>
			</update-lookuptable>
		</before>	
</execute-code>
	<format>
		<fields>
			<field type="variable" name="ppdata" longname="pplive data" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="pplive">
			<section name="next"/>
			<text value="pplive"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="skype" longname="Skype" showsumtemplate="skype"> 
	<execute-code>
		<verify>
			<if expr="($L4proto == #udp) and hasstring($packet[$currentoffset:0],'^..[\x02\x03\x07\x0f\x0d\x63\x77].............',0)">
				<if-true>	
					<if expr="checklookuptable($skypetempsessiontable,$ipsrc, $portsrc)">
						<if-true>
							<if expr="(buf2int($skypetempsessiontable.id)) lt (buf2int($packet[$currentoffset : 2]))">
								<if-true>						
									<if expr="$skypetempsessiontable.cnt == 3">
										<if-true>
											<assign-variable name="$protoverify_result" value="%FOUND"/>	
										</if-true>
										<if-false>
											<assign-variable name="$protoverify_result" value="%DEFERRED"/>
										</if-false>
									</if>	
								</if-true>
								
								<if-false>
									<assign-variable name="$protoverify_result" value="%NOTFOUND"/>				 
								</if-false>
							</if>
						</if-true>

						<if-false>
							<assign-variable name="$protoverify_result" value="%DEFERRED"/>
						</if-false>
					</if>
				</if-true>
				<if-false>
					<assign-variable name="$protoverify_result" value="%NOTFOUND"/>
				</if-false>
			</if>		
			
			<!-- login fase -->
			<if expr="($L4proto == #tcp) and hasstring($packet[$currentoffset : 0],'get .*getlatestversion',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<!-- notfound -->
		<before when="($protoverify_result == %NOTFOUND) and ($L4proto == #udp)">
			<update-lookuptable name="$skypetempsessiontable" action="purge">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portsrc"/>											
			</update-lookuptable>
		</before>

		<!-- found -->
		<before when="($protoverify_result == %FOUND) and ($L4proto == #udp)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#skype"/>
			</update-lookuptable>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#skype"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="not checklookuptable($SkypeClientTable,$ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$SkypeClientTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#skype"/>				
							</update-lookuptable>			
						</if-true>
					</if>
				</if-true>
			</if>
			
			<update-lookuptable name="$skypetempsessiontable" action="purge">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portsrc"/>											
			</update-lookuptable>
		</before>


		<!-- deferred -->
		<before when="($protoverify_result == %DEFERRED) and ($L4proto == #udp)">	
			<if expr="checklookuptable($skypetempsessiontable,$ipsrc, $portsrc)">
				<if-true>
					<assign-lookuptable name="$skypetempsessiontable.cnt" value="$skypetempsessiontable.cnt + 1"/>
					<assign-lookuptable name="$skypetempsessiontable.id" value="$packet[$currentoffset : 2]"/>
				</if-true>
				<if-false>
					<if expr="checklookuptable($skypetempsessiontable,$ipdst,$portdst)">
						<if-true></if-true>
						<if-false>
							<assign-variable name="$session_hit" value="1"/>
						</if-false>
					</if>
					<update-lookuptable name="$skypetempsessiontable" action="add" validity="updateonhit" keeptime="10" hittime="10">
						<lookupkey value="$ipsrc"/>
						<lookupkey value="$portsrc"/>
						<lookupdata value="1"/>  
						<lookupdata value="$packet[$currentoffset : 2]"/> 
					</update-lookuptable>
				</if-false>
			</if>
		</before>

		<!-- fast identification -->
		<before when="($enable_servertable) and ($L4proto == #udp)">
			<if expr="checklookuptable($SkypeClientTable, $ipsrc, $portsrc) and (not checklookuptable($SkypeClientTable, $ipdst, $portdst))">
				<if-true>
					<update-lookuptable name="$SkypeClientTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
						<lookupkey value="$ipdst"/>
						<lookupkey value="$portdst"/>
						<lookupdata value="#skype"/>				
					</update-lookuptable>			
				</if-true>
			</if>
			<if expr="checklookuptable($SkypeClientTable, $ipdst, $portdst) and (not checklookuptable($SkypeClientTable, $ipsrc, $portsrc))">
				<if-true>
					<update-lookuptable name="$SkypeClientTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
						<lookupkey value="$ipsrc"/>
						<lookupkey value="$portsrc"/>
						<lookupdata value="#skype"/>				
					</update-lookuptable>
				</if-true>
			</if>
		</before>

		<before when="($L4proto == #tcp) and ($protoverify_result == %FOUND)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#skype"/>
				<lookupdata value="0"/>
			</update-lookuptable>
		</before>	

		<!-- Update timestamp in the SkypeClientTable -->
		<before>
			<if expr="$enable_servertable">
				<if-true>
					<if expr="updatelookuptable($SkypeClientTable, $ipsrc, $portsrc)"><if-true></if-true></if>
					<if expr="updatelookuptable($SkypeClientTable, $ipdst, $portdst)"><if-true></if-true></if>
				</if-true>
			</if>

			<!-- Probably this is required only if we're in UDP -->
			<if expr="($L4proto == #udp) and updatelookuptable($skypetempsessiontable, $ipsrc, $portsrc)"><if-true></if-true></if>
		</before>
	</execute-code>

	<format>
		<fields>
			<if expr="$L4proto == #udp">
				<if-true>
					<field type="fixed" name="id" longname="ID" size="2" showtemplate="FieldHex"/>
					<field type="fixed" name="type" longname="Type" size="1" showtemplate="FieldHex"/>
				</if-true>
			</if>
			<field type="variable" name="skypeData" longname="skypeData" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="skype">
			<section name="next"/>
			<text value="Skype"/>
			<if expr="$L4proto == #udp">
				<if-true>
					<text value=", ID 0x"/>
					<protofield name="id" showdata="value"/>	
					<text value=" ["/>	<text expr="buf2int(id)"/> <text value="]"/>

					<if expr="$protoverify_result == %DEFERRED">
						<if-true>
							<text value=" ("/>
							<text expr="buf2int($ipsrc[0:1])"/> <text value="."/> 
							<text expr="buf2int($ipsrc[1:1])"/> <text value="."/> 
							<text expr="buf2int($ipsrc[2:1])"/> <text value="."/> 
							<text expr="buf2int($ipsrc[3:1])"/>
							<text value=" is Candidate, pkt "/>
							
							<if expr="checklookuptable($skypetempsessiontable, $ipsrc, $portsrc)">
								<if-true>
									<text expr="$skypetempsessiontable.cnt"/>
								</if-true>
							</if>
							<text value=")"/>
						</if-true>
					</if>
					
					<if expr="$protoverify_result == %FOUND">
						<if-true>
							<text value=" (Found) "/>
						</if-true>
					</if>
				</if-true>
				
				
				<if-false>
					<if expr="checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
						<if-true>
							<text value=" Login"/>
						</if-true>
						<if-false>
							<text value=" over TCP "/>
						</if-false>
					</if>
				
				<!--	<if expr="checklookuptable($tcpsessiontable, $ipsrc, $ipdst, $portsrc, $portdst) and ($tcpsessiontable.flag == 1)">
						<if-true>
							<text value=" Login"/>
						</if-true>
						<if-false>
							<text value=" over TCP "/>
						</if-false>
					</if>-->
				</if-false>
			</if>					
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="yahoomsg" longname="Yahoo Messenger" showsumtemplate="yahoomsg">
	<execute-code>
		<verify>
			<!--<if expr="hasstring($packet[$currentoffset : 0], '^(ymsg|ypns|yhoo).?.?.?.?.?.?.?[lwt].*\xc0\x80',0)">-->
			<if expr="hasstring($packet[$currentoffset : 0], '^(ymsg|ypns|yhoo).?.?.?.?.?.?.?[lwt]',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>	
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#yahoomsg"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#yahoomsg"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#yahoomsg"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>		
	</execute-code>

	<format>
		<fields>
			<field type="variable" name="yahoodata" longname="Yahoo Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="yahoomsg">
			<section name="next"/>
			<text value="Yahoo Messenger"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="msnmsg" longname="Microsoft MSN Messenger (Instant Messaging Chat)" showsumtemplate="msnmsg"> 
	<execute-code>
		<verify>
			<!--<if expr="hasstring($packet[$currentoffset:0], '(^[2-9][0-9][0-9]\x20[0-9]{1,3}|^MSG [0-9][0-9]* (U|N) [0-9][0-9]*|^(VER|XFR|CVR|USR|CAL|JOI|ILN|NLN|CHG|QRY|PRO|QNG) [0-9]*|LST (11 0|3 0|11 3|3 3)$|^OUT)', 0)">-->
			<if expr="hasstring($packet[$currentoffset:0], 'ver [0-9]+ msnp[1-9][0-9]? [\x09-\x0d -~]*cvr0\x0d\x0a$|usr [0-9]+ .*\x0d\x0a$|ans [0-9]+ .*\x0d\x0a$', 0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		<if expr="hasstring($packet[$currentoffset:0], '^CONNECT.*(passport|live)',0) or hasstring($packet[$currentoffset:0], 'MSMSGS',0) or hasstring($packet[$currentoffset:0], 'messenger.msn.com',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>

		</verify>
		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#msnmsg"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#msnmsg"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#msnmsg"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>

	<format>
		<fields>
<!--			<if expr="hasstring($packet[$currentoffset:0],'^[2-9][0-9][0-9]',0)">
				<if-true>
					<field type="variable" name="error" longname="Error" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
				</if-true>		

				<if-false>
					<field type="tokenended" name="command" longname="Command" endtoken="\x20" showtemplate="msn.command"/>
					<if expr="hasstring(command,'VER',0) or hasstring(command,'CVR',0) or hasstring(command,'USR',0) or hasstring(command,'XFR',0) or hasstring(command,'CHG',0)" >
						<if-true>
							<field type="tokenended" name="trID" longname="Transaction ID" endtoken="\x20" showtemplate="FieldAscii"/>
						</if-true>
					</if>
					
					<field type="tokenended" name="parameter" longname="Parameter" endtoken="\x0D\x0A" showtemplate="FieldAscii"/>
					<field type="variable" name="MsnMsgData" longname="MSN Messenger Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
				</if-false>
			</if>
-->
			<field type="variable" name="MsnMsgData" longname="MSN Messenger Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showtemplate name="msn.command" showtype="ascii" showgrp="1">
			<showmap>
				<switch expr="buf2int(this[0:3])">
					<case value="0x564552" show="Authentication"></case>
					<case value="0x435652" show="Authentication"></case>
					<case value="0x555352" show="Authentication"></case>
					<case value="0x584652" show="Authentication"></case>
					
					<case value="0x555352" show="Synchronization"></case>
					<case value="0x475443" show="Synchronization"></case>
					<case value="0x424C50" show="Synchronization"></case>
					<case value="0x505250" show="Synchronization"></case>
					<case value="0x4C5347" show="Synchronization"></case>
					<case value="0x53594E" show="Synchronization"></case>

					<case value="0x4C5354" show="List"></case>					
					
					<case value="0x425945" show="Logout"></case>
					<case value="0x4F5554" show="Logout"></case>
					
					<default show="Unkown command"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showsumtemplate name="msnmsg">
			<section name="next"/>
			<text value="MSN Messenger "/>
			
<!--			<if expr="ispresent(error)">
				<if-true>
					<text value=" Error"/>
				</if-true>
			</if>
			<if expr="hasstring(command,'MSG',0) or hasstring(command,'CAL',0) or hasstring(command,'JOI',0)">
				<if-true>
					<text value=" Chat"/>
				</if-true>
				
				<if-false>
					<protofield name="command" showdata="showmap"/>
				</if-false>
			</if>
-->
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="irc" longname="IRC" showsumtemplate="irc">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset : 0],'^(pass[\x09-\x0d -~]*\x0d\x0a|nick[\x09-\x0d -~]*user[\x09-\x0d -~]*:|user[\x09-\x0d -~]*:[\x02-\x0d -~]*nick[\x09-\x0d -~]*\x0d\x0a)',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>	
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#irc"/>
				<lookupdata value="0"/>
			</update-lookuptable>	

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#irc"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#irc"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>		
	</execute-code>

	<format>
		<fields>
			<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="irc">
			<section name="next"/>
			<text value="IRC"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="imap" longname="Internet Mail Access Protocol (IMAP)" showsumtemplate="imap">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '^(\* ok|a[0-9]+ noop)',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#imap"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#imap"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#imap"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>		
	

	<format>
		<fields>
			<!--<field type="variable" name="IMAPdata" longname="IMAP Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>-->
			<!--<if expr="hasstring($packet[$currentoffset : 0],'^(\*|[0-9a-zA-Z][0-9a-zA-Z][0-9a-zA-Z][0-9a-zA-Z]).*(ok|no|bad|preauth|bye )',0)">-->
			<if expr="hasstring($packet[$currentoffset : 0],'^[\*] (.*\x0d\x0a)*([0-9a-zA-Z][0-9a-zA-Z][0-9a-zA-Z][0-9a-zA-Z]) (ok|no|bad|preauth|bye )|^(\*|([0-9a-zA-Z][0-9a-zA-Z][0-9a-zA-Z][0-9a-zA-Z])).*(ok|no|bad|preauth|bye )',0)">
			<!--<if expr="hasstring($packet[$currentoffset : 0],'ok|no|bad|preauth|bye ',0)">-->
				<if-true>
					<field type="variable" name="response" longname="Response" expr="$packetlength - $currentoffset" showtemplate="FieldAscii">
						
						<!--<field type="tokenended" name="response" longname="Response" endtoken="\x0d\x0a" showtemplate="FieldAscii"/>-->
						<loop type="while" expr="$packetlength - $currentoffset">
							<if expr="$packet[$currentoffset :1 ] != '*'">
								<if-true>
									<loopctrl type="break"/>
								</if-true>
							</if>
							<field type="tokenended" name="tag" longname="Tag" endtoken=" " showtemplate="FieldAscii"/>
							<field type="tokenended" name="response" longname="Response" endtoken="\x0d\x0a" showtemplate="FieldAscii"/>
						</loop>
						
						<field type="variable" name="result" longname="Result Command" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
					</field>
				</if-true>
				<if-false>
					<if expr="hasstring($packet[$currentoffset : 0], '^([0-9a-zA-Z][0-9a-zA-Z][0-9a-zA-Z][0-9a-zA-Z]) ([a-zA-Z])*',0)">
						<if-true>
							<field type="variable" name="command" longname="Command" expr="$packetlength - $currentoffset" showtemplate="FieldAscii">
								<field type="tokenended" name="tag" longname="Tag" endtoken=" " showtemplate="FieldAscii"/>
								<field type="tokenended" name="cmd" longname="Command" endtoken=" " showtemplate="FieldAscii"/>						
								<field type="variable" name="arg" longname="Arguments" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
							</field>
						</if-true>
						<if-false>
							<field type="variable" name="message" longname="Message" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
						</if-false>
					</if>
				</if-false>
			</if>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="imap">
			<section name="next"/>
			<text value="IMAP"/>
			<if expr="ispresent(response)">
				<if-true>
					<text value=" response"/>
				</if-true>
			</if>

			<if expr="ispresent(command)">
				<if-true>
					<text value=" command"/>
				</if-true>
			</if>
			
			<if expr="ispresent(message)">
				<if-true>
					<text value=" message"/>
				</if-true>
			</if>			
		</showsumtemplate>
	</visualization>	
</protocol>

<protocol name="pop3" longname="POP3 (Post Office Protocol - Version 3)" showsumtemplate="pop3">
	<execute-code>
		<verify>
			<!--<if expr="hasstring($packet[$currentoffset:0], '^(.?.?\x16\x03.*\x16\x03|.?.?\x01\x03\x01?.*\x0b)',0)"> -->
			<if expr="hasstring($packet[$currentoffset:0], '(\+ok |-err )',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#pop3"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#pop3"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#pop3"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
		
		
		<before when="hasstring($packet[$currentoffset:0],'^(USER|PASS|STAT|LIST|UIDL|QUIT|CAPA|STLS|RETR|DELE|NOOP|RSET|APOP|TOP)',0)">
			<if expr="checklookuptable ($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
				<if-true>
					<assign-lookuptable name="$tcpsessiontable.flag" value="0"/>
				</if-true>
			</if>
		</before>
		
		<after when="ispresent (command) and hasstring(command,'STLS',0) ">
			<if expr="checklookuptable ($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
				<if-true>
					<assign-lookuptable name="$tcpsessiontable.flag" value="1"/>
				</if-true>
			</if>
		</after>
		
		<after when="ispresent (command) and hasstring(command,'RETR',0) ">
			<if expr="checklookuptable ($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
				<if-true>
					<assign-lookuptable name="$tcpsessiontable.flag" value="2"/>
				</if-true>
			</if>
		</after>
		
	</execute-code>
	
	<format>
		<fields>
			<if expr="checklookuptable ($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
				<if-true>
					<if expr="$tcpsessiontable.flag == 1">
						<if-true>
							<field type="variable" name="encrypted" longname="POP3 overTLS" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
						</if-true>
					</if>
				</if-true>
			</if>
			
			<if expr="checklookuptable ($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
				<if-true>
					<if expr="$tcpsessiontable.flag == 2">
						<if-true>
							<field type="variable" name="message" longname="Message" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
						</if-true>
					</if>
				</if-true>
			</if>
			
			
			<loop type="size" expr="$packetlength - $currentoffset">
				<if expr="hasstring($packet[$currentoffset : 0], '\+ok|-err',0)">
					<if-true>
						<field type="tokenended" name="response" longname="Response" endtoken="(\x0d\x0a)" showtemplate="FieldAscii"/>
					</if-true>
					
					<if-false>
						<if expr="hasstring($packet[$currentoffset:0],'^(USER|PASS|STAT|LIST|UIDL|QUIT|CAPA|STLS|RETR|DELE|NOOP|RSET|APOP|TOP)',0)">
							<if-true>
								<field type="tokenended" name="command" longname="Command" endtoken="\x0d\x0d" showtemplate="FieldAscii"/>
							</if-true>
							<if-false>
								<field type="variable" name="unknow_commnad" longname="Unknown Command" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
							</if-false>
						</if>
					</if-false>
				</if>
			</loop>
			
		</fields>
	</format>

	<visualization>	
		<showsumtemplate name="pop3">
			<section name="next"/>
			<text value="POP3 "/>
			
			<if expr="ispresent(encrypted)">
				<if-true>
					<text value=" over TLS"/>
				</if-true>
			</if>

			<if expr="ispresent(message)">
				<if-true>
					<text value=" Message"/>
				</if-true>
			</if>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="simap4" longname="Secure IMAP" showsumtemplate="simap4">
	<format>
		<fields>
			<field type="variable" name="simap4data" longname="Secure IMAP Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="simap4">
			<section name="next"/>
			<text value="Secure IMAP4"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="smtp" longname="SMTP (Simple Mail Transfer Protocol)" showsumtemplate="smtp">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '^220[\x09-\x0d -~]* (e?smtp|simple mail)|^(HELO|EHLO) .*\x0d\x0a', 0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#smtp"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#smtp"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#smtp"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>
	
	<format>
		<fields>
			<if expr="hasstring($packet[$currentoffset:0], '^((HE|EH)LO|MAIL|RCPT|QUIT|DATA|RSET|HELP|NOOP|VRFY|EXPN)', 0)">
				<!-- command message -->
				<if-true>
					<if expr="hasstring($packet[$currentoffset:0], 'MAIL FROM', 0)">
						<if-true>
							<field type="line" name="mailfrom" longname="Mail From" showtemplate="SmtpAddress">
								<field type="tokenwrapped" begintoken="\x22" endtoken="\x22" name="alias" longname="Email alias" showtemplate="FieldAscii" />
								<field type="tokenwrapped" begintoken="\x3C" endtoken="\x3E" name="email" longname="Email address" showtemplate="FieldAscii" />
							</field>
						</if-true>
					</if>			
						
					<if expr="hasstring($packet[$currentoffset:0], 'HELO', 0)">
						<if-true>
							<field type="tokenended" endtoken=" " name="command" longname="Command" showtemplate="SmtpCommand" />
							<field type="line" name="domain" longname="Domain" showtemplate="FieldAscii" />
						</if-true>
					</if>
						
					<if expr="hasstring($packet[$currentoffset:0], 'EHLO', 0)">
						<if-true>
							<field type="tokenended" endtoken=" " name="command" longname="Command" showtemplate="SmtpCommand" />
							<field type="line" name="domain" longname="Domain" showtemplate="FieldAscii" />	
						</if-true>
					</if>
						
					<if expr="hasstring($packet[$currentoffset:0], 'VRFY', 0)">
						<if-true>
							<field type="tokenended" endtoken=" " name="command" longname="Command" showtemplate="SmtpCommand" />
							<field type="line" name="user" longname="User" showtemplate="FieldAscii" />
						</if-true>
					</if>
						
					<if expr="hasstring($packet[$currentoffset:0], 'RCPT TO', 0)">
						<if-true>
							<!-- one rctp field per recipient -->
							<field type="line" name="recipient" longname="Recipient" showtemplate="SmtpAddress">
								<field type="tokenwrapped" begintoken="\x22" endtoken="\x22" name="alias" longname="Email alias" showtemplate="FieldAscii" />
								<field type="tokenwrapped" begintoken="\x3C" endtoken="\x3E" name="email" longname="Email address" showtemplate="FieldAscii" />
							</field>
						</if-true>
						
						<if-false>
							<!--  other command without value -->
							<field type="line" name="command" longname= "Command" showtemplate="FieldAscii"/>
						</if-false>
					</if>
				<!-- command message/ -->	
				</if-true>
				
				<if-false>
					<if expr="hasstring($packet[$currentoffset:0], '^([1-5][0-9][0-9])', 0)">
						<if-true>
							<!--  reply message -->
							<loop type="size" expr="$packetlength - $currentoffset">
								<!--<field type="line" name="reply" longname = "Reply" showtemplate="FieldAscii"/>-->
								<block name="replymessage" longname="Reply Message">
								<!-- code number -->
									<field type="variable" name="codenumber" longname="Code Number" expr="3" showtemplate="SmtpReplay"/> 
								<!-- string -->
									<field type="line" name="stringmessage" longname="String Message" showtemplate="SmtpReplay"/>
								</block>
							</loop>	
							<!--  reply message/ -->
						</if-true>
						
						<if-false>

<!--
<fieldset type="tokenended" endregex="\r\n[^\t ]">

	<field type="tokenwrapped" name="from" longname="From" begintoken="from:" endregex="\r\n[^\t ]" endoffset="curroff-1" showtemplate="FieldAscii">
		<loop type="while" expr="1">
			<field type="tokenended" name="recipient" longname="Destination address" endtoken="," showtemplate="FieldAscii">
				<field type="tokenwrapped" begintoken="\x22" endtoken="\x22" name="alias" longname="Email alias" showtemplate="FieldAscii" />
				<field type="tokenwrapped" begintoken="\x3C" endtoken="\x3E" name="email" longname="Email address" showtemplate="FieldAscii" />
			</field>
		</loop>
	</field>

	<fieldset-default>
	</fieldset-default>
</fieldset>
-->
							<!-- email header -->
							<!-- Here we have several fields terminated by CRLF, unless thecase of field folding/unfolfing (RFC2822, section 2.2.3) -->
							<!-- In this case, fields may be split on multiple lines, but there must be a SP or HTAB after the CRLF ==> CRLF[.^\xSP\xHTAB] -->
		
							<loop type= "size" expr= "$packetlength - $currentoffset">
								<if expr="buf2int($packet [$currentoffset : 2]) == 0x0D0A">
									<if-true>
										<loopctrl type="break"/>
									</if-true>
								</if>
								
								<!-- extract from, to, subject,...  field -->				
								<!-- <field type="line" name="data" longname="Data" showtemplate="FieldAscii"/> -->
								<switch expr="extractstring($packet[$currentoffset: 0], '[^:]*', 1, 0)">
		
									<case value="'From'">
										<!-- From pattern ==> From: ("nome" )?<mail_address>0x0d0a  -->
										<field type="line" name="from" longname="From" showtemplate="SmtpFrom"/>
									</case>
									
									<case value="'To'">
										<!--  one or more recipients -->
										<!-- recipient pattern: ([<address>[,]0x0D0A09])+[<address>0D0A] -->
										<!-- non posso prendere tutti i destinatari e inserirli in un solo campo -->

										<field type="line" name="mailto" longname="To" showtemplate="FieldAscii" />
											
										
										<!--
											The internal loop go out of buffer when a packet contain a field like this
											To: foo@foo.com

											instead of
											To: My incredible alias <foo@foo.com>
										<field type="tokenended" name="mailto" longname="To" endregex="\r\n[^\t ]" endoffset="$token_fieldlen + $token_endtlen - 1" showtemplate="FieldAscii">
											<loop type="while" expr="1">
												<field type="tokenwrapped" name="recipient" longname="Destination address" beginregex="[\t ]" endtoken="," beginoffset="$token_begintlen" endoffset="$token_begintlen + $token_fieldlen" showtemplate="FieldAscii">
													<field type="tokenended" endtoken="\x3C" endoffset="$token_fieldlen" name="alias" longname="Email alias" showtemplate="FieldAscii"/>
													<field type="tokenwrapped" begintoken="\x3C" endtoken="\x3E" beginoffset="1" endoffset="$token_begintlen + $token_fieldlen" name="email" longname="Email address" showtemplate="FieldAscii"/>
												</field>
											</loop>
										</field>
										-->
									</case>
									<case value="'Subject'">
										<field type="line" name="subject" longname="Subject" showtemplate="SmtpField"/>
									</case>
									<case value="'Date'">
										<field type="line" name="date" longname="Date" showtemplate="SmtpField"/>
									</case>
								
									<!-- attachment -->
									<case value="'MIME-Version'">
										<field type="line" name="mimever" longname="MIME-Version" showtemplate="SmtpField"/>
									</case>
									<case value="'Content-Type'">
										<field type="line" name="contenttype" longname="Content Type" showtemplate="SmtpField"/>
									</case>
									<default>
										<field type="line" name="data" longname="Data" showtemplate="FieldAscii"/>
									</default>
								</switch>
							</loop>
							<!-- end email header -->

							<!-- body of mail -->
							<loop type= "size" expr= "$packetlength - $currentoffset">
								<if expr="buf2int($packet [$currentoffset : 3]) == 0x2E0D0A">  <!-- .\r\n -->
									<if-true>
										<field type="line" name="endofdata" longname ="End of Data" showtemplate="FieldAscii"/>
										<loopctrl type="break" />
									</if-true>
								</if>

								<field type="line" name="body" longname ="Body" showtemplate="FieldAscii"/>
							</loop>
						</if-false>
					</if>	
				</if-false>
			</if>	

			<!-- The quality of this decoder is rather poor; it happens that we need to add this field at the end to consume --> 
			<!-- all the data that is still in the packet buffer -->
			<field type="variable" name="otherdata" longname="Other data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/> 
		</fields>
	</format>

	
	<visualization>
		<showsumtemplate name="smtp">
			<section name="next"/>
			<text value="SMTP"/>
			
<!--
			<if expr="ispresent(data)">
				<if-true>
					<text value=" body of mail"/>
				</if-true>
			</if>
-->
		</showsumtemplate>
	
		<showtemplate name="SmtpField" showtype="ascii" showgrp="1"> 
			<showdtl>
				<text expr="extractstring(this, ': ([[:print:]]*)', 1, 1)"/>
			</showdtl>
		</showtemplate>
		
		<showtemplate name="SmtpAddress" showtype="ascii" showgrp="1"> 
			<showdtl>
				<text expr="extractstring(this, '&lt;([[:print:]]*)&gt;', 1, 1)"/>
			</showdtl>
		</showtemplate>
		
		<showtemplate name="SmtpReplay" showtype="ascii" showgrp="1"> 
			<showdtl>
				<text expr="extractstring(this, '-([[:print:]]*)', 1, 1)"/>
			</showdtl>
		</showtemplate>
		
		<showtemplate name="SmtpCommand" showtype="ascii" showgrp="1"/> 
			
		<showtemplate name="SmtpFrom" showtype="ascii" showgrp="1"> 
			<showdtl>
				<!-- extraction of username -->
				<text expr="extractstring(this,'&quot;([[:print:]]*)&quot;',1,1)"/>
				<text value=" "/>
				<!-- extraction of email address -->
				<text expr="extractstring(this, '&lt;([[:print:]]*)&gt;', 1, 1)"/>
			</showdtl>
		</showtemplate>
	</visualization>
</protocol>

<protocol name="spop3" longname="Secure POP3 (Post Office Protocol - Version 3)" showsumtemplate="spop3">
	<execute-code>
		<verify>
			<!-- SSL v2 Hello client | SSLv3 hello client, hello server, hello request -->
			<if expr="hasstring($packet[$currentoffset:0],'^(...?\x01\x03(\0|\x01))|^(\x16\x03(\0|\x01)..(\0|\x01|\x02))',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#spop3"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#spop3"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#spop3"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>


	<format>
		<fields>
			<field type="variable" name="HeaderField" longname="Mail Data" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="spop3">
			<section name="next"/>
			<text value="Secure POP3"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="ssmtp" longname="Secure SMTP (Simple Mail Transfer Protocol)" showsumtemplate="ssmtp">
	<format>
		<fields>
			<field type="variable" name="data" longname="Mail Data" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="ssmtp">
			<section name="next"/>
			<text value="Secure SMTP"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="dce_rpc_tcp" longname="Remote Call Procedure" showsumtemplate="rpc">
	<execute-code>
		<init>
			<variable name="$len" type="number" validity="thispacket"/>			
			<variable name="$len_auth" type="number" validity="thispacket"/>			
		</init>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0],'^\x05[\0\x01][\0-\x13]',0) and (($packetlength - $currentoffset ) le buf2int(changebyteorder($packet[$currentoffset+8:2])))">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>
		
			<!-- little endian -->
<!--		<before when="(buf2int($packet[$currentoffset + 4 : 1]) bitwand 0xf0) == 0x10" > -->
<!--			<assign-variable name="$len" value="buf2int(changebyteorder($packet[$currentoffset + 8 : 2]))"/> -->
<!--			<assign-variable name="$len_auth" value="buf2int(changebyteorder($packet[$currentoffset + 10 : 2]))"/> -->
<!--		</before> -->

		<before>
			<if expr="(buf2int($packet[$currentoffset + 4 : 1]) bitwand 0xf0) == 0x10">
				<if-true>
					<!-- little endian -->
					<assign-variable name="$len" value="buf2int(changebyteorder($packet[$currentoffset + 8 : 2]))"/>
					<assign-variable name="$len_auth" value="buf2int(changebyteorder($packet[$currentoffset + 10 : 2]))"/>

				</if-true>
			</if>
		</before>

		
		<!-- fix me --> <!-- change byte order -->
<!--		<before when="(buf2int($packet[$currentoffset + 4 : 1]) bitwand 0xf0) == 0x00" > -->
<!--			<assign-variable name="$len" value="buf2int(($packet[$currentoffset + 8 : 2]))"/> -->
<!--			<assign-variable name="$len_auth" value="buf2int(($packet[$currentoffset + 10 : 2]))"/>-->
<!--		</before> -->

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#dce_rpc_tcp"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#dce_rpc_tcp"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#dce_rpc_tcp"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>		
	</execute-code>


	<format>
		<fields>
			<if expr="(buf2int($packet[$currentoffset + 2: 1]) != 0x00) and (buf2int($packet[$currentoffset + 2: 1]) != 0x02) and (buf2int($packet[$currentoffset + 2: 1]) != 0x03) and (buf2int($packet[$currentoffset + 2: 1]) != 0x0b) and(buf2int($packet[$currentoffset + 2: 1]) != 0x0c) and (buf2int($packet[$currentoffset + 2: 1]) != 0x0d) and (buf2int($packet[$currentoffset + 2: 1]) != 0x0e) and (buf2int($packet[$currentoffset + 2: 1]) != 0x11) and (buf2int($packet[$currentoffset + 2: 1]) != 0x12) and (buf2int($packet[$currentoffset + 2: 1]) != 0x12) and (buf2int($packet[$currentoffset + 2: 1]) != 0x13)">
				<if-true>
					<field type="variable" name="rpcdata" longname="RPC Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
				</if-true>
			</if>
			<field type="fixed" name="ver" longname="Version" size="2" showtemplate="FieldAscii"/>
			<field type="fixed" name="ptype" longname="PType" size="1" showtemplate="rpc.type"/>
			<field type="fixed" name="pfc_flags" longname="PFC Flags" size="1" showtemplate="FieldAscii">
				<field type="bit" name="object_uuid"		longname="PFC_OBJECT_UUID"		mask="0x80" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="maybe"				longname="PFC_MAYBE"			mask="0x40" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="did_not_execute"	longname="PFC_DID_NOT_EXECUTE"	mask="0x20" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="conc_mpx"			longname="PFC_CONC_MPX"			mask="0x10" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="reserved1"			longname="PFC_RESERVED1"		mask="0x08" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="pending_cancel"		longname="PFC_PENDING_CANCEL"	mask="0x04" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="last_frag"			longname="PFC_LAST_FRAG"		mask="0x02" size="1" showtemplate="FieldBin"/>
				<field type="bit" name="first_frag"			longname="PFC_FIRST_FRAG"		mask="0x01" size="1" showtemplate="FieldBin"/>
			</field>				
			<field type="fixed" name="packed_drep" longname="Packed Drep" size="4" showtemplate="FieldAscii"/>
			<field type="fixed" name="frag_length" longname="Fragment Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="auth_length" longname="Auth Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="call_id" longname="Call ID" size="4" showtemplate="FieldDec"/>
			
			<switch expr="buf2int(ptype)">
				<case value="0x00"> <includeblk name="request"/></case>
				<case value="0x02"> <includeblk name="response"/></case>
				<case value="0x03"> <includeblk name="fault"/></case>
				<case value="0x0b"> <includeblk name="bind"/></case>
				<case value="0x0c"> <includeblk name="bind_ack"/></case>
				<case value="0x0d"> <includeblk name="bind_nack"/></case>
				<case value="0x0e"> <includeblk name="alter_context"/></case>
				<case value="0x0f"> <includeblk name="alter_context_resp"/></case>
				<case value="0x12"> <includeblk name="cancel"/></case>
				<case value="0x13"> <includeblk name="orphaned"/></case>
			</switch>
			<field type="variable" name="rpcdata" longname="RPC Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
		
		<block name="alter_context" longname="Alter Context">
			<field type="fixed" name="max_ximt_frag" longname="Max Ximt Frag" size="2" showtemplate="FieldAscii"/>
			<field type="fixed" name="max_recv_frag" longname="Max Recv Frag" size="2" showtemplate="FieldAscii"/>
			<field type="fixed" name="assoc_group_id" longname="Assoc Group ID" size="4" showtemplate="FieldAscii"/>
			
			<block name="context_list" longname="Context List">
				<field type="fixed" name="n_context_elem" longname="Number of Item" size="1" showtemplate="FieldDec"/>
				<field type="fixed" name="reserved1" longname="Reserved1" size="1" showtemplate="FieldHex"/>
				<field type="fixed" name="reserved2" longname="Reserved2" size="1" showtemplate="FieldHex"/>
				<field type="variable" name="p_cont_elem" longname="Content Element" expr="buf2int(n_context_elem)" showtemplate="FieldHex"/>			
			</block>
			
			<if expr="buf2int(auth_length)">
				<if-true>
					<field type="variable" name="auth_verifier" longname="Authentication Verifier" expr="$len_auth" showtemplate="FieldAscii"/>
				</if-true>
			</if>
		</block>
		
		<block name="alter_context_resp" longname="Alter Context Response">
			<field type="fixed" name="max_ximt_frag" longname="Max Ximt Frag" size="2" showtemplate="FieldAscii"/>
			<field type="fixed" name="max_recv_frag" longname="Max Recv Frag" size="2" showtemplate="FieldAscii"/>
			<field type="fixed" name="assoc_group_id" longname="Assoc Group ID" size="4" showtemplate="FieldAscii"/>
			
			<block name="sec_addr" longname="Secondary Address">
				<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
				<field type="variable" name="port" longname="Port" expr="buf2int(length)" showtemplate="FieldAscii"/>				
			</block>
			
			<block name="result_list" longname="Result List">
				<field type="fixed" name="n_result" longname="Number of Result" size="1" showtemplate="FieldDec"/>
				<field type="fixed" name="reserved1" longname="Reserved1" size="1" showtemplate="FieldHex"/>
				<field type="fixed" name="reserved2" longname="Reserved2" size="2" showtemplate="FieldHex"/>
				<field type="variable" name="p_result" longname="Result List" expr="buf2int(n_result)" showtemplate="FieldHex"/>			
			</block>
			
			<if expr="buf2int(auth_length)">
				<if-true>
					<field type="variable" name="auth_verifier" longname="Authentication Verifier" expr="$len_auth" showtemplate="FieldAscii"/>
				</if-true>
			</if>		
		</block>
		
		<block name="bind" longname="Bind">
			<field type="fixed" name="max_ximt_frag" longname="Max Ximt Frag" size="2" showtemplate="FieldAscii"/>
			<field type="fixed" name="max_recv_frag" longname="Max Recv Frag" size="2" showtemplate="FieldAscii"/>
			<field type="fixed" name="assoc_group_id" longname="Assoc Group ID" size="4" showtemplate="FieldAscii"/>
			
			<block name="context_list" longname="Context List">
				<field type="fixed" name="n_context_elem" longname="Number of Item" size="1" showtemplate="FieldDec"/>
				<field type="fixed" name="reserved1" longname="Reserved1" size="1" showtemplate="FieldHex"/>
				<field type="fixed" name="reserved2" longname="Reserved2" size="1" showtemplate="FieldHex"/>
				<field type="variable" name="p_cont_elem" longname="Content Element" expr="buf2int(n_context_elem)" showtemplate="FieldHex"/>			
			</block>
			
			<if expr="buf2int(auth_length)">
				<if-true>
					<field type="variable" name="auth_verifier" longname="Authentication Verifier" expr="$len_auth" showtemplate="FieldAscii"/>
				</if-true>
			</if>		
		</block>
		
		<block name="bind_ack" longname="Bind ACK">
			<field type="fixed" name="max_ximt_frag" longname="Max Ximt Frag" size="2" showtemplate="FieldAscii"/>
			<field type="fixed" name="max_recv_frag" longname="Max Recv Frag" size="2" showtemplate="FieldAscii"/>
			<field type="fixed" name="assoc_group_id" longname="Assoc Group ID" size="4" showtemplate="FieldAscii"/>
			
			<block name="sec_addr" longname="Secondary Address">
				<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
				<field type="variable" name="port" longname="Port" expr="buf2int(length)" showtemplate="FieldAscii"/>				
			</block>
			
			<block name="result_list" longname="Result List">
				<field type="fixed" name="n_result" longname="Number of Result" size="1" showtemplate="FieldDec"/>
				<field type="fixed" name="reserved1" longname="Reserved1" size="1" showtemplate="FieldHex"/>
				<field type="fixed" name="reserved2" longname="Reserved2" size="2" showtemplate="FieldHex"/>
				<field type="variable" name="p_result" longname="Result List" expr="buf2int(n_result)" showtemplate="FieldHex"/>			
			</block>
			
			<if expr="buf2int(auth_length)">
				<if-true>
					<field type="variable" name="auth_verifier" longname="Authentication Verifier" expr="$len_auth" showtemplate="FieldAscii"/>
				</if-true>
			</if>	
		</block>
		
		<block name="bind_nack" longname="Bind NACK">
			<field type="fixed" name="reject_reasone" longname="Reject Reasone" size="2" showtemplate="FieldAscii"/>
			<block name="versions" longname="Versions">
				<field type="fixed" name="n_protocols" longname="# Protocols" size="1" showtemplate="FieldDec"/>
				<field type="variable" name="protocols" longname="Protocols" expr="buf2int(n_protocols)" showtemplate="FieldAscii"/>
			</block>
		</block>
		
		<block name="cancel" longname="Cancel">
			<if expr="buf2int(auth_length)">
				<if-true>
					<field type="variable" name="auth_verifier" longname="Authentication Verifier" expr="$len_auth" showtemplate="FieldAscii"/>
				</if-true>
			</if>
		</block>
		
		<block name="fault" longname="Fault">
			<field type="fixed" name="alloc_hint" longname="Allocation Hint" size="4" showtemplate="FieldAscii"/>
			<field type="fixed" name="pres_context" longname="Pres Context" size="2" showtemplate="FieldAscii"/>
			
			<field type="fixed" name="cancel_count" longname="Cancel Count" size="1" showtemplate="FieldAscii"/>
			<field type="fixed" name="reserved" longname="Reserved" size="1" showtemplate="FieldAscii"/>
			
			<field type="fixed" name="fault_code" longname="Fault Code" size="4" showtemplate="FieldAscii"/>
			<field type="fixed" name="reserved2" longname="Reserved2" size="4" showtemplate="FieldAscii"/>
			
			<if expr="buf2int(auth_length)">
				<if-true>
					<field type="variable" name="auth_verifier" longname="Authentication Verifier" expr="$len_auth" showtemplate="FieldAscii"/>
				</if-true>
			</if>
		</block>
		
		<block name="orphaned" longname="Orphaned">
			<if expr="buf2int(auth_length)">
				<if-true>
					<field type="variable" name="auth_verifier" longname="Authentication Verifier" expr="$len_auth" showtemplate="FieldAscii"/>
				</if-true>
			</if>
		</block>
		
		<block name="request" longname="Request">
			<field type="fixed" name="alloc_hint" longname="Allocation Hint" size="4" showtemplate="FieldAscii"/>
			<field type="fixed" name="pres_context" longname="Pres Context" size="2" showtemplate="FieldAscii"/>
			<field type="fixed" name="opnum" longname="Operation Number" size="2" showtemplate="FieldAscii"/>
			
			<if expr="buf2int(object_uuid)">
				<if-true>
					<field type="fixed" name="object" longname="Object" size="16" showtemplate="FieldAscii"/>
					<field type="variable" name="stub_data" longname="Stub Data" expr="buf2int(changebyteorder(frag_length)) - 16 - 8 - $len_auth -16" showtemplate="FieldAscii"/>
				</if-true>
				<if-false>
					<field type="variable" name="stub_data" longname="Stub Data" expr="buf2int(changebyteorder(frag_length)) - 16 - 8 - $len_auth" showtemplate="FieldAscii"/>
				</if-false>
			</if>
			
			
			<if expr="buf2int(auth_length)">
				<if-true>
					<field type="variable" name="auth_verifier" longname="Authentication Verifier" expr="$len_auth" showtemplate="FieldAscii"/>
				</if-true>
			</if>			
		</block>
		
		<block name="response" longname="Response">
			<field type="fixed" name="alloc_hint" longname="Allocation Hint" size="4" showtemplate="FieldAscii"/>
			<field type="fixed" name="pres_context" longname="Pres Context" size="2" showtemplate="FieldAscii"/>
			
			<field type="fixed" name="cancel_count" longname="Cancel Count" size="1" showtemplate="FieldAscii"/>
			<field type="fixed" name="reserved" longname="Reserved" size="1" showtemplate="FieldAscii"/>
					
			<field type="variable" name="stub_data" longname="Stub Data" expr="buf2int(changebyteorder(frag_length))- 16 - 8 - $len_auth" showtemplate="FieldAscii"/>	
			
			<if expr="buf2int(auth_length)">
				<if-true>
					<field type="variable" name="auth_verifier" longname="Authentication Verifier" expr="$len_auth" showtemplate="FieldAscii"/>
				</if-true>
			</if>	
		</block>
		
	</format>
	
	<visualization>
		<showtemplate name="rpc.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this[0:1])">
					<case value="0x00" show="Request"></case>
					<case value="0x01" show="Ping"></case>
					<case value="0x02" show="Response"></case>
					<case value="0x03" show="Fault"></case>
					<case value="0x04" show="Working"></case>
					<case value="0x05" show="No call"></case>
					<case value="0x06" show="Reject"></case>
					<case value="0x07" show="Ack"></case>
					<case value="0x08" show="Cl_Cancel"></case>
					<case value="0x09" show="Fack"></case>
					<case value="0x0a" show="Cancel_ack"></case>
					<case value="0x0b" show="Bind"></case>
					<case value="0x0c" show="Bind_ack"></case>
					<case value="0x0d" show="Bind_nack"></case>
					<case value="0x0e" show="Alter_context"></case>
					<case value="0x0f" show="Alter_context_resp"></case>
					<case value="0x11" show="Shoutdown"></case>
					<case value="0x12" show="Co_Cancel"></case>
					<case value="0x13" show="Orphaned"></case>
					<default show="Unkown messagge"/>
				</switch>
			</showmap>
		</showtemplate>
			
		
		<showsumtemplate name="rpc">
			<section name="next"/>
			<text value="DCE RPC "/>
			<protofield name="ptype" showdata="showmap"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="dce_rpc_udp" longname="Remote Call Procedure over UDP" showsumtemplate="rpcudp">
	<execute-code>
		<verify>
			<!--<if expr="hasstring($packet[$currentoffset:0],'^\x04[\0-\x10]',0) and (($packetlength - $currentoffset - 80) == buf2int(changebyteorder($packet[$currentoffset+74:2])))">-->
			<if expr="hasstring($packet[$currentoffset:0],'^\x04[\0-\x10]',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#dce_rpc_udp"/>
			</update-lookuptable>

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#dce_rpc_udp"/>
			</update-lookuptable>
		</before>		
	</execute-code>

	<format>
		<fields>
			<block name="header" longname="Header">
				<field type="fixed" name="ver" longname="Version" size="1" showtemplate="FieldAscii"/>
				<field type="fixed" name="type" longname="Type" size="1" showtemplate="rpc.type"/>
				<field type="fixed" name="flag1" longname="Flag1" size="1" showtemplate="FieldHex"/>
				<field type="fixed" name="flag2" longname="Flag2" size="1" showtemplate="FieldHex"/>
				<field type="fixed" name="drep" longname="Drep" size="3" showtemplate="FieldHex"/>
				<field type="fixed" name="serial_hi" longname="Serial High" size="1" showtemplate="FieldHex"/>
				<field type="fixed" name="object" longname="Object" size="16" showtemplate="FieldHex"/>
				<field type="fixed" name="if_id" longname="Interface ID" size="16" showtemplate="FieldHex"/>
				<field type="fixed" name="act_id" longname="Activity ID" size="16" showtemplate="FieldHex"/>
				<field type="fixed" name="server_boot" longname="Server Boot" size="4" showtemplate="FieldHex"/>
				<field type="fixed" name="if_ver" longname="Interface Versione" size="4" showtemplate="FieldHex"/>
				<field type="fixed" name="seqnum" longname="Sequence Number" size="4" showtemplate="FieldHex"/>
				<field type="fixed" name="opnum" longname="Operation Number" size="2" showtemplate="FieldHex"/>
				<field type="fixed" name="ihint" longname="Interface Hint" size="2" showtemplate="FieldHex"/>
				<field type="fixed" name="ahint" longname="Activity Hint" size="2" showtemplate="FieldHex"/>
				<field type="fixed" name="len" longname="Length" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="fragnum" longname="Fragment Number" size="2" showtemplate="FieldHex"/>
				<field type="fixed" name="auth_proto" longname="Authentication Protocol" size="1" showtemplate="FieldHex"/>
				<field type="fixed" name="serial_lo" longname="Serial Low" size="1" showtemplate="FieldHex"/>
			</block>
			
			<switch expr="buf2int(type)">
				<case value="0x00"> <includeblk name="request"/>  </case>
				<case value="0x02"> <includeblk name="response"/> </case>
				<case value="0x03"> <includeblk name="fault"/> </case>
				<case value="0x05"> <includeblk name="nocall"/> </case>
				<case value="0x06"> <includeblk name="reject"/> </case>
				<case value="0x08"> <includeblk name="cancel"/> </case>
				<case value="0x09"> <includeblk name="fack"/> </case>
				<case value="0x0a"> <includeblk name="cancel_ack"/> </case>
			</switch>
		</fields>
		
		<block name="request" longname="Request">
			<field type="variable" name="input" longname="Input Parameter" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/> 
		</block>
		
		<block name="response" longname="Response">
			<field type="variable" name="output" longname="Output Parameter" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/> 
		</block>
		
		<block name="cancel_ack" longname="Cancel ACK">
			<field type="fixed" name="version" longname="Version" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="cancel_id" longname="Cancel ID" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="server_is_accepting" longname="Server is Accepting" size="1" showtemplate="FieldDec"/>-->
		</block>
	
		<block name="cancel" longname="Cancel">
			<field type="fixed" name="version" longname="Version" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="cancel_id" longname="Cancel ID" size="4" showtemplate="FieldDec"/>
		</block>
		
		<block name="fack" longname="Fack">
			<field type="fixed" name="vers" longname="Vers" size="1" showtemplate="FieldAscii"/>
			<field type="fixed" name="pad1" longname="PAD1" size="1" showtemplate="FieldAscii"/>
			<field type="fixed" name="window_size" longname="Window Size" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="max_tsdu" longname="Max TSDU" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="max_frag_size" longname="Max Fragment Size" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="serial_num" longname="Serial Number" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="selack_len" longname="# Selack Array" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="selack" longname="Selack Array" size="4" showtemplate="FieldDec"/>
		</block>
		
		<block name="fault" longname="Fault">
			<field type="fixed" name="st" longname="Status Code" size="4" showtemplate="FieldAscii"/>
		</block>
		
		<block name="nocall" longname="No Call">
			<if expr="$packetlength - $currentoffset">
				<if-true>
					<includeblk name="fack"/>
				</if-true>
			</if>
		</block>
		
		<block name="reject" longname="Reject">
			<includeblk name="fault"/>
		</block>

	</format>
	
	<visualization>
		<showtemplate name="rpc.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this[0:1])">
					<case value="0x00" show="Request"></case>
					<case value="0x01" show="Ping"></case>
					<case value="0x02" show="Response"></case>
					<case value="0x03" show="Fault"></case>
					<case value="0x04" show="Working"></case>
					<case value="0x05" show="No call"></case>
					<case value="0x06" show="Reject"></case>
					<case value="0x07" show="Ack"></case>
					<case value="0x08" show="Cl_Cancel"></case>
					<case value="0x09" show="Fack"></case>
					<case value="0x0a" show="Cancel_ack"></case>
					<case value="0x0b" show="Bind"></case>
					<case value="0x0c" show="Bind_ack"></case>
					<case value="0x0d" show="Bind_nack"></case>
					<case value="0x0e" show="Alter_context"></case>
					<case value="0x0f" show="Alter_context_resp"></case>
					<case value="0x11" show="Shoutdown"></case>
					<case value="0x12" show="Co_Cancel"></case>
					<case value="0x13" show="Orphaned"></case>
					<default show="Unkown messagge"/>
				</switch>
			</showmap>
		</showtemplate>
			
		
		<showsumtemplate name="rpcudp">
			<section name="next"/>
			<text value="DCE RPC over UDP "/>
			<protofield name="type" showdata="showmap"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="onc_rpc_udp" longname="ONC RPC" showsumtemplate="oncrpc">
	<execute-code>
		<verify>
			<!-- (header)      xid     type_call    version -->
			<if expr="hasstring($packet[$currentoffset:0], '^(....)?....\0\0\0\0\0\0\0\x02', 0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>
		
		<before when="($protoverify_result == %FOUND) and ($L4proto == #udp)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#onc_rpc_udp"/>
			</update-lookuptable>

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#onc_rpc_udp"/>
			</update-lookuptable>
		</before>
		
		<before when="($protoverify_result == %FOUND) and ($L4proto == #tcp)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#onc_rpc_udp"/>
				<lookupdata value="buf2int($packet[$currentoffset + 4 :4])"/>	<!-- xid -->
			</update-lookuptable>
		</before>
		
		<after>		
			<if expr="not checklookuptable($rpctable, $ipsrc, $ipdst, $portsrc, $portdst)">
				<if-true>
					<update-lookuptable name="$rpctable" action="add" validity="updateonhit" keeptime="300" hittime="300">
						<lookupkey value="$ipsrc"/>
						<lookupkey value="$ipdst"/>
						<lookupkey value="$portsrc"/>
						<lookupkey value="$portdst"/>
						<lookupdata value="buf2int(prog)"/>
						<lookupdata value="buf2int(proc)"/>
						<lookupdata value="buf2int(mtype)"/>
					</update-lookuptable>					
				</if-true>
				
				<if-false>
					<if expr="ispresent(mtype)">
						<if-true>
							<assign-lookuptable name="$rpctable.type" value="buf2int(mtype)"/>
						</if-true>
					</if>
					<if expr="ispresent(proc)">
						<if-true>
							<assign-lookuptable name="$rpctable.proc" value="buf2int(proc)"/>
						</if-true>
					</if>
				</if-false> 
			</if>

			<if expr="not checklookuptable($rpctable, $ipdst, $ipsrc, $portdst, $portsrc)">
				<if-true>
					<update-lookuptable name="$rpctable" action="add" validity="updateonhit" keeptime="300" hittime="300">
						<lookupkey value="$ipdst"/>
						<lookupkey value="$ipsrc"/>
						<lookupkey value="$portdst"/>
						<lookupkey value="$portsrc"/>
						<lookupdata value="buf2int(prog)"/>
						<lookupdata value="buf2int(proc)"/>
						<lookupdata value="buf2int(mtype)"/>
					</update-lookuptable>					
				</if-true>
				
				<if-false>
					<if expr="ispresent(mtype)">
						<if-true>
							<assign-lookuptable name="$rpctable.type" value="buf2int(mtype)"/>
						</if-true>
					</if>
					<if expr="ispresent(proc)">
						<if-true>
							<assign-lookuptable name="$rpctable.type" value="buf2int(proc)"/>
						</if-true>
					</if>
				</if-false>
			</if>
		</after> 
	</execute-code>	

	<format>
		<fields>
			<!-- if packet start with a rpc header then bytes from 4 to 8 is equal to value store into flag of tcpsessiontable -->
			<!-- else is a generic data of rpc protocol -->
			<if expr="$L4proto == #udp or ($L4proto == #tcp and checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport) and (buf2int($packet[$currentoffset + 4 :4]) == $tcpsessiontable.flag ))">
				<if-true>
					<if expr="$L4proto == #tcp">
						<if-true>
							<field type="fixed" name="fragment_header" longname="Fragment Header" size="4" showtemplate="FieldHex">
								<field type="bit" name="last_fragment" longname="Last Fragment" mask="0x80000000" size="4" showtemplate="FieldBin"/>
								<field type="bit" name="fragment_length" longname="Fragment Length" mask="0x7FFFFFFF" size="4" showtemplate="FieldDec"/>
							</field>
						</if-true>
					</if>

					<field type="fixed" name="xid" longname="Transaction Identifier" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="mtype" longname="Message Type" size="4" showtemplate="oncrpc.type"/>
					<switch expr="buf2int(mtype)">
						<case value="0x00000000">
							<includeblk name="call_body"/>
						</case>
						<default>
							<includeblk name="replay_body"/>
						</default>
					</switch>				
				</if-true>
				
				<if-false>
					<field type="variable" name="data" longname="RPC Generic Data " expr="$packetlength - $currentoffset" showtemplate="FieldHex"/>
				</if-false>
			</if>

		</fields>
		
		<block name="call_body" longname="Call Body">
			<field type="fixed" name="rpc_ver" longname="RPC Version" size="4" showtemplate="FieldDec"/>
			<block name="remote_program" longname="Remote Program">
				<field type="fixed" name="prog" longname="Program" size="4" showtemplate="oncrpc.prog"/>
				<field type="fixed" name="ver" longname="Version" size="4" showtemplate="FieldDec"/>
				<!-- procedure depending on program -->
				<switch expr="buf2int (prog)">
					<case value="100000">
						<field type="fixed" name="proc" longname="Procedure" size="4" showtemplate="oncrpc.proc.rpcbind"/>
					</case>
					<case value="100003">
						<field type="fixed" name="proc" longname="Procedure" size="4" showtemplate="oncrpc.proc.nfs"/>
					</case>
					<case value="100005">
						<field type="fixed" name="proc" longname="Procedure" size="4" showtemplate="oncrpc.proc.mnt"/>
					</case>
					<default>
						<field type="fixed" name="proc" longname="Procedure" size="4" showtemplate="FieldDec"/>
					</default>
				</switch>

			</block>		
			<includeblk name="credential"/>
			<includeblk name="verifier"/>			
		</block>

		<block name="credential" longname="Credential">
			<field type="fixed" name="flavor" longname="Flavor" size="4" showtemplate="FieldAscii"/>
			<field type="fixed" name="length_body" longname="Length_body" size="4" showtemplate="FieldDec"/>
			<field type="variable" name="body" longname="Body" expr="buf2int(length_body)" showtemplate="FieldAscii"/>
		</block>
				
		<block name="verifier" longname="Verifier">
			<field type="fixed" name="flavor" longname="Flavor" size="4" showtemplate="FieldAscii"/>
			<field type="fixed" name="length_body" longname="Length_body" size="4" showtemplate="FieldDec"/>
			<field type="variable" name="body" longname="Body" expr="buf2int(length_body)" showtemplate="FieldAscii"/>
		</block>
		
		<block name="replay_body" longname="Replay Body">
			<field type="fixed" name="replay_stat" longname="Replay Status" size="4" showtemplate="oncrpc.replay_stat"/>
			<switch expr="buf2int(replay_stat)">
				<case value="0x00000000">	<!-- msg accepted -->
					<includeblk name="verifier"/>				
					<field type="fixed" name="accept_stat" longname="Accept Status" size="4" showtemplate="oncrpc.accept_stat"/>
					<switch expr="buf2int(accept_stat)">
						<!--<case value="0x00000000">
							<field type="variable" name="procedure_results" longname="Procedure Results" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
						</case>-->
						<case value="x00000002">
							<field type="fixed" name="low" longname="Low" size="4" showtemplate="FieldDec"/>
							<field type="fixed" name="high" longname="High" size="4" showtemplate="FieldDec"/>
						</case>
						<default>
							<!-- void data 0 byte -->
						</default>
					</switch>
				</case>
				<case value="0x00000001">  <!-- msg denied-->
					<field type="fixed" name="reject_stat" longname="Reject Status" size="4" showtemplate="oncrpc.reject_stat"/>
					<switch expr="buf2int(reject_stat)">
						<case value="0x00000000">		<!-- rpc mismatch"-->
							<field type="fixed" name="low" longname="Low" size="4" showtemplate="FieldDec"/>
							<field type="fixed" name="high" longname="High" size="4" showtemplate="FieldDec"/>
						</case>
						<case value="0x00000001">  <!-- authehtication error -->
							<field type="fixed" name="auth_stat" longname="Authentication Status" size="4" showtemplate="oncrpc.auth_stat"/>
						</case>
					</switch>
				</case>
			</switch>
		</block>
	</format>

	<encapsulation>
		<if expr="checklookuptable($rpctable, $ipsrc, $ipdst, $portsrc, $portdst)">
			<if-true>
				<switch expr="$rpctable.prog">
					<case value="100000"><nextproto proto="#rpcbind"/></case>
					<case value="100003"><nextproto proto="#nfs"/></case>
					<case value="100005"><nextproto proto="#mnt"/></case>
				</switch>
			</if-true>
		</if>
	</encapsulation>
	
	<visualization>
	
		<showtemplate name="oncrpc.replay_stat" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x00000000" show="MSG_ACCEPTED"/>
					<case value="0x00000001" show="MSG_DENIED"/>
					<default show="Unknown"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="oncrpc.prog" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="100000" show="RPCBIND"/>
					<case value="100003" show="NFS"/>
					<case value="100005" show="MNT"/>
					<default show="Unknown"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="oncrpc.proc.nfs" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="NFSPROC3_NULL"/>
					<case value="1" show="NFSPROC3_GETATTR"/>
					<case value="2" show="NFSPROC3_SETATTR"/>
					<case value="3" show="NFSPROC3_LOOKUP"/>
					<case value="4" show="NFSPROC3_ACCESS"/>
					<case value="5" show="NFSPROC3_READLINK"/>
					<case value="6" show="NFSPROC3_READ"/>
					<case value="7" show="NFSPROC3_WRITE"/>
					<case value="8" show="NFSPROC3_CREATE"/>
					<case value="9" show="NFSPROC3_MKDIR"/>
					<case value="10" show="NFSPROC3_SYMLINK"/>
					<case value="11" show="NFSPROC3_MKNOD"/>
					<case value="12" show="NFSPROC3_REMOVE"/>
					<case value="13" show="NFSPROC3_RMDIR"/>
					<case value="14" show="NFSPROC3_RENAME"/>
					<case value="15" show="NFSPROC3_LINK"/>
					<case value="16" show="NFSPROC3_READDIR"/>
					<case value="17" show="NFSPROC3_READDIRPLUS"/>
					<case value="18" show="NFSPROC3_FSSTAT"/>
					<case value="19" show="NFSPROC3_FSINFO"/>
					<case value="20" show="NFSPROC3_PATHCONF"/>
					<case value="21" show="NFSPROC3_COMMIT"/>				
					<default show="Unknown"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="oncrpc.proc.mnt" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="MOUNTPROC_NULL"/>
					<case value="1" show="MOUNTPROC_MNT"/>
					<case value="2" show="MOUNTPROC_DUMP"/>
					<case value="3" show="MOUNTPROC_UMNT"/>
					<case value="4" show="MOUNTPROC_UMNTALL"/>
					<case value="5" show="MOUNTPROC_EXPORT"/>				
					<default show="Unknown"/>
				</switch>
			</showmap>
		</showtemplate>
	
		<showtemplate name="oncrpc.proc.rpcbind" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="RPCBPROC_SET"/>
					<case value="2" show="RPCBPROC_UNSET"/>
					<case value="3" show="RPCBPROC_GETADDR"/>
					<case value="4" show="RPCBPROC_DUMP"/>
					<case value="5" show="RPCBPROC_CALLIT"/>				
					<case value="6" show="RPCBPROC_GETTIME"/>				
					<case value="7" show="RPCBPROC_UADDR2TADDR"/>			
					<case value="8" show="RPCBPROC_TADDR2UADDR"/>					
					<default show="Unknown"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="oncrpc.accept_stat" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x00000000" show="SUCCESS"/>
					<case value="0x00000001" show="PROG_UNVAIL"/>
					<case value="0x00000002" show="PROG_MISMATCH"/>
					<case value="0x00000003" show="PROC_UNVAIL"/>
					<case value="0x00000004" show="GARBAGE_ARGS"/>
					<case value="0x00000005" show="SYSTEM_ERR"/>
					<default show="Unknown"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="oncrpc.reject_stat" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x00000000" show="RPC_MISMATCH"/>
					<case value="0x00000001" show="AUTH_ERROR"/>
					<default show="Unknown"/>
				</switch>
			</showmap>
		</showtemplate>	
		
		
		<showtemplate name="oncrpc.auth_stat" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x00000000" show="AUTH_OK"/>
					<case value="0x00000001" show="AUTH_BADCRED"/>
					<case value="0x00000002" show="AUTH_REJECTEDCRED"/>
					<case value="0x00000003" show="AUTH_BADVERF"/>
					<case value="0x00000004" show="AUTH_REJECTEDVERF"/>
					<case value="0x00000005" show="AUTH_TOOWEAK"/>
					<case value="0x00000006" show="AUTH_INVALIDRESP"/>
					<case value="0x00000007" show="AUTH_FAILED"/>
					<default show="Unknown"/>		
				</switch>
			</showmap>
		</showtemplate>	
		
		<showtemplate name="oncrpc.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x00" show="Call"></case>
					<case value="0x01" show="Replay"></case>
					<default show="Unkown messagge"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showsumtemplate name="oncrpc">
			<section name="next"/>
			<text value="ONC RPC "/>
			<if expr="not ispresent(data)">
				<if-true>
					<protofield name="mtype" showdata="showmap"/>
					<text value=", Transaction ID:" />
					<protofield name="xid" showdata="showvalue"/>
					<text value=" "/>
				</if-true>
			</if>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="mnt" longname="MNT" showsumtemplate="mnt">
	<format>
		<fields>
			<if expr="checklookuptable($rpctable, $ipsrc, $ipdst, $portsrc, $portdst) and $rpctable.type==0">	<!-- is a call -->
				<if-true>
					<switch expr="$rpctable.proc">
						<case value="0x01"> <includeblk name="MNTargs"/> </case>
						<case value="0x03"> <includeblk name="UMNTargs"/> </case>
						<default>
							<field type="variable" name="data" longname="Input" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
						</default>
					</switch>
					
				</if-true>
			</if>
			<if expr="checklookuptable($rpctable, $ipsrc, $ipdst, $portsrc, $portdst) and $rpctable.type==1">  <!-- is a reply -->
				<if-true>
					<switch expr="$rpctable.proc">
						<case value="0x01"> <includeblk name="MNTres"/> </case>
						<!--<case value="0x03"> <includeblk name="UMNTres"/> </case> --> <!-- return void -->
						<default>
							<field type="variable" name="data" longname="Output" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
						</default>
					</switch>
					
				</if-true>
			</if>
			<!--<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>-->
		</fields>

		<block name="MNTargs" longname="MNT Arguments">
			<includeblk name="dir_path"/>
		</block>

		<block name="UMNTargs" longname="UMNT Arguments">
			<includeblk name="dir_path"/>
		</block>
		
		<block name="MNTres" longname="MNT Results">
			<includeblk name="fhstatus"/>
		</block>
		
		<block name="fhstatus" longname="File Handle Status">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="FieldHex"/>
			<if expr="not buf2int(status)">
				<if-true>
					<field type="fixed" name="length_fhandle" longname="Length File Handle" size="4" showtemplate="FieldDec"/>
					<field type="variable" name="fhandle" longname="File Handle" expr="buf2int(length_fhandle)" showtemplate="FieldHex"/>
					<if expr="(buf2int(length_fhandle) mod 4) != 0">
						<if-true>
							<field type="variable" name="filling" longname="Filling" expr="((buf2int(length_fhandle) div 4)+1)*4 - buf2int(length_fhandle)" showtemplate="FieldHex"/> 
						</if-true>
					</if>
					<field type="fixed" name="number_auth_flavors" longname="# Auth Flavors" size="4" showtemplate="FieldDec"/>
					<block name="auth_flavors" longname="Auth_Flavors">
						<loop type="times2repeat" expr="buf2int(number_auth_flavors)">
							<field type="fixed" name="auth_flavor" longname="Auth Flavor" size="4" showtemplate="FieldHex"/>
						</loop>
					</block>
					
				</if-true>
			</if>
			
		</block>
		<block name="dir_path" longname="DirPath">
			<field type="fixed" name="length_path" longname="Length Path" size="4" showtemplate="FieldDec"/>
			<field type="variable" name="path" longname="Path" expr="buf2int(length_path)" showtemplate="FieldAscii"/>
			<!--<if expr="debug(buf2int(length_path) div 4)"><if-true></if-true></if>-->
			<if expr="(buf2int(length_path) mod 4) != 0">
				<if-true>
					<field type="variable" name="filling" longname="Filling" expr="((buf2int(length_path) div 4)+1)*4 - buf2int(length_path)" showtemplate="FieldHex"/> 
				</if-true>
			</if>
		</block>
	</format>
	
	<visualization>	
		<showsumtemplate name="mnt">
			<section name="next"/>
			<text value=" MNT"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="rpcbind" longname="RPCBIND" showsumtemplate="rpcbind">
	<format>
		<fields>
			<if expr="checklookuptable($rpctable, $ipsrc, $ipdst, $portsrc, $portdst) and $rpctable.type==0">	<!-- is a call -->
				<if-true>
					<switch expr="$rpctable.proc">
						<case value="0x03"> <includeblk name="getaddr_args"/> </case>
					</switch>
				</if-true>
			</if>

			<if expr="checklookuptable($rpctable, $ipsrc, $ipdst, $portsrc, $portdst) and $rpctable.type==1">	<!-- is a reply -->
				<if-true>
					<switch expr="$rpctable.proc">
						<case value="0x03"> <includeblk name="getaddr_res"/> </case>
					</switch>
				</if-true>
			</if>
			<field type="variable" name="data" longname="Data" expr="$packetlength -$currentoffset" showtemplate="Field4BytesHex"/>
		</fields>

		<block name="getaddr_args" longname="GETADDR Arguments">
			<includeblk name="rpcb"/>
		</block>
		
		<block name="rpcb" longname="RPCB">
			<field type="fixed" name="r_program" longname="Program" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="r_vers" longname="Version" size="4" showtemplate="FieldDec"/>

			<field type="fixed" name="lenght_r_netid" longname="Length NetID" size="4" showtemplate="FieldDec"/>
			<field type="variable" name="r_netid" longname="NetID" expr="buf2int(lenght_r_netid)" showtemplate="FieldAscii"/>
			<if expr="(buf2int(lenght_r_netid) mod 4) != 0">
				<if-true>
					<field type="variable" name="filling" longname="Filling" expr="((buf2int(lenght_r_netid) div 4)+1)*4 - buf2int(lenght_r_netid)" showtemplate="FieldHex"/> 
				</if-true>
			</if>
			
			<field type="fixed" name="lenght_r_addr" longname="Length Addr" size="4" showtemplate="FieldDec"/>
			<field type="variable" name="r_addr" longname="Addr" expr="buf2int(lenght_r_addr)" showtemplate="FieldAscii"/>
			<if expr="(buf2int(lenght_r_addr) mod 4) != 0">
				<if-true>
					<field type="variable" name="filling" longname="Filling" expr="((buf2int(lenght_r_addr) div 4)+1)*4 - buf2int(lenght_r_addr)" showtemplate="FieldHex"/> 
				</if-true>
			</if>


			<field type="fixed" name="lenght_r_owner" longname="Length Owner" size="4" showtemplate="FieldDec"/>
			<field type="variable" name="r_owner" longname="Owner" expr="buf2int(lenght_r_owner)" showtemplate="FieldAscii"/>
			<if expr="(buf2int(lenght_r_owner) mod 4) != 0">
				<if-true>
					<field type="variable" name="filling" longname="Filling" expr="((buf2int(lenght_r_owner) div 4)+1)*4 - buf2int(lenght_r_owner)" showtemplate="FieldHex"/> 
				</if-true>
			</if>
		</block>
		
		<block name="getaddr_res" longname="GETADDR Results">
			<field type="fixed" name="lenght_string" longname="Length String" size="4" showtemplate="FieldDec"/>
			<field type="variable" name="universal_address" longname="Universal Address" expr="buf2int(lenght_string)" showtemplate="FieldAscii"/>
			<if expr="(buf2int(lenght_string) mod 4) != 0">
				<if-true>
					<field type="variable" name="filling" longname="Filling" expr="((buf2int(lenght_string) div 4)+1)*4 - buf2int(lenght_string)" showtemplate="FieldHex"/> 
				</if-true>
			</if>
		</block>
	</format>
	
	<visualization>	
		<showsumtemplate name="rpcbind">
			<section name="next"/>
			<text value=" RPCBIND"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="ftp" longname="FTP (File Transfer Protocol) - Control connection" showsumtemplate="ftpcontrol">
	<execute-code>
		<init>
			<variable name="$ftpdataport" type="buffer" validity="static" size="2"/>
		</init>

		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '^220.*ftp|^220.*(\x0d\x0a)$',0)"> 
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
<!--
			<if expr="hasstring($packet[$currentoffset : 0], '^(USER|PASS|ACCT|CWD|CDUP|SMNT|REIN|QUIT|PORT|PASV|PASS|TYPE|STRU|MODE|RETR|STOR|STOU|APPE|ALLO|REST|RNFR|RNTO|ABOR|DELE|RMD|MKD|PWD|LIST|NLST|SITE|SYST|STAT|HELP|NOOP)',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
-->
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#ftp"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#ftp"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#ftp"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
		

		<after when="ispresent(port)">
			<!-- Add a session entry related to the FTP data connection -->

			<if expr="ispresent(command) and command == 'PORT'">
				<if-true>
					<!-- Active mode: client always uses port specified in the message; server uses port 20 -->
					<assign-variable name="$ftpdataport[0:1]" value="int2buf( ascii2int(port1), 1)" />
					<assign-variable name="$ftpdataport[1:1]" value="int2buf( ascii2int(port2), 1)" />

					<if expr="$ipsrc lt $ipdst">
						<if-true>
							<update-lookuptable name="$tcpsessiontable" action="add" validity="replaceonhit" keeptime="300" newhittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$ipdst"/>
								<lookupkey value="$ftpdataport"/>
								<lookupkey value="'\x00\x00'" mask="0x0000"/>
								<lookupdata value="#ftpdata"/>
								<lookupdata value="0"/>
							</update-lookuptable>
						</if-true>

						<if-false>
							<update-lookuptable name="$tcpsessiontable" action="add" validity="replaceonhit" keeptime="300" newhittime="300">
								<lookupkey value="$ipdst"/>
								<lookupkey value="$ipsrc"/>
								<lookupkey value="'\x00\x00'" mask="0x0000"/>
								<lookupkey value="$ftpdataport"/>
								<lookupdata value="#ftpdata"/>
								<lookupdata value="0"/>
							</update-lookuptable>
						</if-false>
					</if>
				</if-true>
			</if>
			
			<if expr="ispresent(code) and code == '227'">
				<if-true>
					<!-- Passive mode: server always uses port specified in the message; client port is unknown -->
					<assign-variable name="$ftpdataport[0:1]" value="int2buf( ascii2int(port1), 1)" />
					<assign-variable name="$ftpdataport[1:1]" value="int2buf( ascii2int(port2), 1)" />

					<if expr="$ipsrc lt $ipdst">
						<if-true>
							<update-lookuptable name="$tcpsessiontable" action="add" validity="replaceonhit" keeptime="300" newhittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$ipdst"/>
								<lookupkey value="$ftpdataport"/>
								<lookupkey value="'\x00\x00'" mask="0x0000"/>
								<lookupdata value="#ftpdata"/>
								<lookupdata value="0"/>
							</update-lookuptable>
						</if-true>
						
						<if-false>
							<update-lookuptable name="$tcpsessiontable" action="add" validity="replaceonhit" keeptime="300" newhittime="300">
								<lookupkey value="$ipdst"/>
								<lookupkey value="$ipsrc"/>
								<lookupkey value="'\x00\x00'" mask="0x0000"/>
								<lookupkey value="$ftpdataport"/>
								<lookupdata value="#ftpdata"/>	
								<lookupdata value="0"/>
							</update-lookuptable>				
						</if-false>
					</if>
				</if-true>
			</if>
		</after>
	</execute-code>

	<format>
		<fields>
			<loop type="size" expr="$packetlength - $currentoffset">
			
				<!--<if expr= "hasstring($packet[$currentoffset : 0], '^[^0-9].{3,4}',0)">-->
				<if expr="hasstring($packet[$currentoffset : 0], '^(USER|PASS|ACCT|CWD|CDUP|SMNT|REIN|QUIT|PORT|PASV|PASS|TYPE|STRU|MODE|RETR|STOR|STOU|APPE|ALLO|REST|RNFR|RNTO|ABOR|DELE|RMD|MKD|PWD|LIST|NLST|SITE|SYST|STAT|HELP|NOOP)',0)">
					<if-true>
						<if expr="$packet[$currentoffset:4] == 'PORT'">
							<if-true>
								<field type="line" name="port" longname="Data connection port" showtemplate="FieldAscii">
									<field type="tokenended" name="command" longname="Command" endtoken=" " endoffset="$token_fieldlen" showtemplate="FieldAscii"/>
									<field type="tokenended" name="host1" longname="Host (1st part)" endtoken="," endoffset="$token_fieldlen" enddiscard="1" showtemplate="FieldAscii"/>
									<field type="tokenended" name="host2" longname="Host (2nd part)" endtoken="," endoffset="$token_fieldlen" enddiscard="1" showtemplate="FieldAscii"/>
									<field type="tokenended" name="host3" longname="Host (3rd part)" endtoken="," endoffset="$token_fieldlen" enddiscard="1" showtemplate="FieldAscii"/>
									<field type="tokenended" name="host4" longname="Host (4th part)" endtoken="," endoffset="$token_fieldlen" enddiscard="1" showtemplate="FieldAscii"/>
									<field type="tokenended" name="port1" longname="Port (1st part)" endtoken="," endoffset="$token_fieldlen" enddiscard="1" showtemplate="FieldAscii"/>
									<field type="tokenended" name="port2" longname="Port (2nd part)" endtoken="\x0D" endoffset="$token_fieldlen" showtemplate="FieldAscii"/>		
								</field>
							</if-true>
							
							<if-false>
								<field type="line" name="commandftp" longname="Command FTP" showtemplate="FieldAscii">
									<field type="tokenended" name="command" longname="Command" endtoken=" " showtemplate="FieldAscii"/>
									<field type="tokenended" name="argument" longname="Argument" endtoken="x0Dx0A" showtemplate="FieldAscii"/>
								</field>
							</if-false>
						</if>
					</if-true>
					
					<if-false>	
						<if expr="$packet[$currentoffset:3] == '227'">
							<if-true>
								<field type="line" name="port" longname="Data connection port" showtemplate="FieldAscii">
									<field type="fixed" name="code" longname="Code" size="3" showtemplate="FieldAscii"/>
									<field type="tokenended" name="string" longname="String" endtoken="(" endoffset="$token_fieldlen" enddiscard="1" showtemplate="FieldAscii"/>
									<field type="tokenended" name="host1" longname="Host (1st part)" endtoken="," endoffset="$token_fieldlen" enddiscard="1" showtemplate="FieldAscii"/>
									<field type="tokenended" name="host2" longname="Host (2nd part)" endtoken="," endoffset="$token_fieldlen" enddiscard="1" showtemplate="FieldAscii"/>
									<field type="tokenended" name="host3" longname="Host (3rd part)" endtoken="," endoffset="$token_fieldlen" enddiscard="1" showtemplate="FieldAscii"/>
									<field type="tokenended" name="host4" longname="Host (4th part)" endtoken="," endoffset="$token_fieldlen" enddiscard="1" showtemplate="FieldAscii"/>
									<field type="tokenended" name="port1" longname="Port (1st part)" endtoken="," endoffset="$token_fieldlen" enddiscard="1" showtemplate="FieldAscii"/>
									<field type="tokenended" name="port2" longname="Port (2nd part)" endtoken=")" endoffset="$token_fieldlen" showtemplate="FieldAscii"/>
								</field>
							</if-true>
							<if-false>
								<field type="fixed" name="code" longname="Code" size="3" showtemplate="FieldAscii"/>
								<field type="tokenended" name="string" longname="String" endtoken="\x0D\x0A" showtemplate="FieldAscii"/>
							</if-false>
							<missing-packetdata>
								<field type="variable" name="truncdata" longname="Truncated Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
							</missing-packetdata>
						</if>
					</if-false>
				</if>
			</loop>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="ftpcontrol">
			<section name="next"/>
			<text value="FTP Control"/>
			<if expr="ispresent(code)">
				<if-true>
					<text value=" reply"/>
				</if-true>
			</if>
			<if expr="ispresent(command)">
				<if-true>
					<text value=" command"/>
				</if-true>
			</if>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="ftpdata" longname="FTP (File Transfer Protocol) - Data connection" showsumtemplate="ftpdata">
	<format>
		<fields>
			<field type="variable" name="data" longname="FTP Data" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="ftpdata">
			<section name="next"/>
			<text value="FTP Data"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="http" longname="HTTP (Hyper Text Transfer Protocol)" showsumtemplate="http">
	<execute-code>
		<verify>
			<!-- <if expr="hasstring($packet[$currentoffset:0], 'http/(0\.9|1\.0|1\.1) [1-5][0-9][0-9]|(post|get|head|propfind|mkcol|delete|put|copy|move|lock|unlock) [\x09-\x0d -~]* http/[01]\.[019]', 0)"> -->
			<if expr="hasstring($packet[$currentoffset:0], 'http/(0\.9|1\.0|1\.1) [1-5][0-9][0-9]|(connect|post|get|head|propfind|mkcol|delete|put|copy|move|lock|unlock) [\x09-\x0d -~]* http/[01]\.[019]', 0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%CANDIDATE"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %CANDIDATE or $protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#http"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#http"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#http"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>

	<format>
		<fields>

			<!-- Check if this packet contains an header -->
			<if expr="($packet[$currentoffset : 3] == 'GET') or ($packet[$currentoffset : 4] == 'POST') or ($packet[$currentoffset : 4] == 'HTTP')">
				<if-true>

					<block name="header" longname="HTTP Header">

						<!-- Requestline and statusline-->
						<if expr="($packet[$currentoffset : 3] == 'GET') or ($packet[$currentoffset : 4] == 'POST')">
							<if-true>
								<field type="line" name="cmdline" longname="Command Line" showtemplate="FieldAscii">
									<field type="tokenended" name="method" longname="Method" endtoken=" " showtemplate="FieldAscii"/>
									<field type="tokenended" name="url" longname="URL" endtoken=" " showtemplate="FieldAscii"/>
									<field type="line" name="version" longname="Version" showtemplate="FieldAscii"/>
								</field>
							</if-true>
							
							<if-false>
								<field type="line" name="statusline" longname="Status Line" showtemplate="FieldAscii">
									<field type="tokenended" name="version" longname="Version" endtoken=" " showtemplate="FieldAscii"/>
									<field type="tokenended" name="statuscode" longname="Status Code" endtoken=" " showtemplate="FieldAscii"/>
									<field type="line" name="reasonphrase" longname="Reason Phrase" showtemplate="FieldAscii"/>
								</field>
							</if-false>
						</if>

						<loop type="size" expr="$packetlength - $currentoffset">

							<switch expr="extractstring($packet[$currentoffset: 0], '[^:\n]*', 1, 0)" 
										comment="Field names are case-insensitive in HTTP; however, field-values may be case sensitive.">

								<case value="'User-Agent'">
									<field type="line" name="useragent" longname="User Agent" showtemplate="HttpField"/>
								</case>
								<case value="'Accept'">
									<field type="line" name="accept" longname="Accept MIME Types" showtemplate="HttpField"/>
								</case>
								<case value="'Accept-Language'">
									<field type="line" name="acceptlanguage" longname="Accept Language" showtemplate="HttpField"/>
								</case>
								<case value="'Server'">
									<field type="line" name="server" longname="Server" showtemplate="HttpField" />
								</case>
								<case value="'Content-Type'">
									<field type="line" name="contenttype" longname="Content Type" showtemplate="HttpField" />
								</case>
								<case value="'Host'">
									<field type="line" name="host" longname="Host" showtemplate="HttpField" />
								</case>
								<case value="'Content-Encoding'">
									<field type="line" name="contentencoding" longname="Content Encoding" showtemplate="HttpField" />
								</case>
								<case value="'Content-Length'">
									<field type="line" name="contentlength" longname="Content Length" showtemplate="HttpField" />
								</case>
								<case value="'Date'">
									<field type="line" name="date" longname="Date" showtemplate="HttpField" />
								</case>
								<case value="'Expires'">
									<field type="line" name="expires" longname="Expires" showtemplate="HttpField" />
								</case>
								<case value="'From'">
									<field type="line" name="from" longname="From" showtemplate="HttpField" />
								</case>
								<case value="'If-Modified-Since'">
									<field type="line" name="ifmodifiedsince" longname="If Modified Since" showtemplate="HttpField" />
								</case>
								<case value="'Last-Modified'">
									<field type="line" name="lastmodified" longname="Last Modified" showtemplate="HttpField" />
								</case>
								<case value="'Location'">
									<field type="line" name="location" longname="Location" showtemplate="HttpField" />
								</case>
								<case value="'Pragma'">
									<field type="line" name="pragma" longname="Pragma" showtemplate="HttpField" />
								</case>
								<case value="'Referer'">
									<field type="line" name="referer" longname="Referer" showtemplate="HttpField" />
								</case>	
								<case value="'WWW-Authenticate'">
									<field type="line" name=" wwwauthenticate" longname="WWW Authenticate" showtemplate="HttpField" />
								</case>	

								<!-- other options will follow -->

								<!-- This is an other way to say 'stop, the HTTP header is ended -->
								<case value="'\x0D'">
									<field type="line" name="endheader" longname="End Of Header" showtemplate="FieldAscii"/>
									<loopctrl type="break"/>
								</case>

								<default>
									<field type="line" name="option" longname="Option" showtemplate="FieldAscii"/>
								</default>
							</switch>

						</loop>
					</block>
				</if-true>
				<missing-packetdata>
					<field type="variable" name="truncdata" longname="Truncated Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
				</missing-packetdata>
			</if>

			<block name="header" longname="HTTP Object">
				<loop type="size" expr="$packetlength - $currentoffset">
					<field type="line" name="data" longname="HTTP data" showtemplate="FieldAscii"/>
				</loop>
			</block>

		</fields>
	</format>

	<visualization>
		<showsumtemplate name="http">
			<section name="next"/>
			<if expr="ispresent(method)">
				<if-true>
					<text value="HTTP request"/>
				</if-true>
				
				<if-false>
					<text value="HTTP response"/>
				</if-false>	
			</if>
		</showsumtemplate>

		<!-- This template aims at showing only the part of the field which is after the ": " delimiter, -->
		<!-- which corresponds to the field value (hence the last '1' as parameter). -->
		<showtemplate name="HttpField" showtype="ascii" showgrp="1"> 
			<showdtl>
				<text expr="extractstring(this, ': ([[:print:]]*)', 1, 1)"/>
			</showdtl>
		</showtemplate>

	</visualization>
</protocol>

<protocol name="rtsp" longname="Real Time Streaming Protocol" showsumtemplate="rtsp">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], 'rtsp/1\.0 200 ok', 0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>	
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#rtsp"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#rtsp"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#rtsp"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>
	<format>
		<fields>
			<field type="variable" name="data" longname="Data"  expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="rtsp">
			<section name="next"/>
			<text value="RTSP"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="sip" longname="Session Initiation Protocol" showsumtemplate="sip">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '^(invite|register|cancel|message|subscribe|notify) sip[\x09-\x0d -~]*sip/[0-2]\.[0-9]', 0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="($L4proto == #tcp) and ($protoverify_result == %FOUND)">	
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#sip"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#sip"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#sip"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>

		<before when="($L4proto == #udp) and ($protoverify_result == %FOUND)">	
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#sip"/>
			</update-lookuptable>

			<!-- SIP has bidirectional connections, so let's insert also the other direction -->
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#sip"/>
			</update-lookuptable>
		</before>
	</execute-code>
	<format>
		<fields>
			<field type="line" name="cmd" longname="Command" showtemplate="FieldAscii"/>
			<loop type="size" expr="$packetlength - $currentoffset">
				<field type="line" name="HeaderField" longname="Header Field" showtemplate="FieldAscii"/>
			</loop>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="sip">
			<section name="next"/>
			<text value="SIP: "/>
			<protofield name="cmd" showdata="showvalue"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="stun" longname="STUN" showsumtemplate="stun">
	<execute-code>
		<verify>
			<!-- STUN uses TCP to change a shared secret -->
			<!-- header has fixed length (20 bytes)-->
			<if expr="hasstring($packet[$currentoffset:0],'^(\0\x01|\x01\x01|\x01\x11|\0\x02|\x01\x02|\x01\x12)',0) and (buf2int($packet[$currentoffset +2 : 2]) == ($packetlength -$currentoffset -20))">
			<!--<if expr="1">-->
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#stun"/>
			</update-lookuptable>

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#stun"/>
			</update-lookuptable>
		</before>
	</execute-code>
	
	<format>
		<fields>
			<field type="fixed" name="message_type" longname="Message Type" size="2" showtemplate="stun.message.type"/> -->
			<field type="fixed" name="message_length" longname="Message Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="transaction_id" longname="Transaction ID" size="16" showtemplate="FieldHex"/>
			<!--<field type="variable" name="attributes" longname="Attributes" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>-->
			<block name="attributes" longname="Attributes">
				<loop type="while" expr="$packetlength - $currentoffset">
					<includeblk name="attribute"/>
				</loop>
			</block>

		</fields>
		
		
		<block name="attribute" longname="Attribute">
			<field type="fixed" name="type" longname="Type" size="2" showtemplate="stun.attribute.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			
			<switch expr="buf2int(type)">
				<case value="0x0001"> <includeblk name="mapped_address"/></case>
				<case value="0x0002"> <includeblk name="response_address"/></case>
				<case value="0x0003"> <includeblk name="change_request"/></case>
				<case value="0x0004"> <includeblk name="source_address"/></case>
				<case value="0x0005"> <includeblk name="changed_address"/></case>
				<case value="0x0006"> <includeblk name="username"/></case>
				<case value="0x0007"> <includeblk name="password"/></case>
				<case value="0x0008"> <includeblk name="message_integrity"/></case>
				<case value="0x0009"> <includeblk name="error_code"/></case>
				<case value="0x000a"> <includeblk name="unknown_attributes"/></case>
				<case value="0x000b"> <includeblk name="reflected_from"/></case>
				<default> 
					<field type="variable" name="value" longname="Value" expr="buf2int(length)" showtemplate="FieldAscii"/>
				</default>
			</switch>
			
			
		</block>
		
		<block name="mapped_address" longname="Mapped Addres">
			<field type="fixed" name="xxx" longname="XXX" size="1" showtemplate="FieldAscii"/>
			<field type="fixed" name="family" longname="Family" size="1" showtemplate="FieldAscii"/>
			<field type="fixed" name="port" longname="Port" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr"/>
		</block>	
		
		<block name="response_address" longname="Response Addres">
			<field type="fixed" name="xxx" longname="XXX" size="1" showtemplate="FieldAscii"/>
			<field type="fixed" name="family" longname="Family" size="1" showtemplate="FieldAscii"/>
			<field type="fixed" name="port" longname="Port" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr"/>
		</block>	

		<block name="changed_address" longname="Change Addres">
			<field type="fixed" name="xxx" longname="XXX" size="1" showtemplate="FieldAscii"/>
			<field type="fixed" name="family" longname="Family" size="1" showtemplate="FieldAscii"/>
			<field type="fixed" name="port" longname="Port" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr"/>
		</block>		
		
		<block name="change_request" longname="Change Request">
			<field type="bit" name="change_ip" longname="Change IP" mask="0x00000004" size="4" showtemplate="FieldBin"/>
			<field type="bit" name="change_port" longname="Change Port" mask="0x00000002" size="4" showtemplate="FieldBin"/>
		</block>
		
		<block name="source_address" longname="Source Address">
			<field type="fixed" name="xxx" longname="XXX" size="1" showtemplate="FieldAscii"/>
			<field type="fixed" name="family" longname="Family" size="1" showtemplate="FieldAscii"/>
			<field type="fixed" name="port" longname="Port" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr"/>		
		</block>
		
		<block name="username" longname="Username">
			<field type="variable" name="username" longname="Username" expr="buf2int(length)" showtemplate="FieldAscii"/>
		</block>
		
		<block name="password" longname="Password">
			<field type="variable" name="password" longname="Password" expr="buf2int(length)" showtemplate="FieldAscii"/>
		</block>
		
		<block name="message_integrity" longname="Message Integrity">
			<field type="fixed" name="hmac" longname="HAMC" size="20" showtemplate="FieldHex"/>
		</block>
		
		<block name="error_code" longname="Error Code">
			<field type="bit" name="zeros" longname="Zeros" mask="0xfffff800" size="4" showtemplate="FieldBin"/>
			<field type="bit" name="class" longname="Class" mask="0x00000700" size="4" showtemplate="FieldDec"/>
			<field type="bit" name="number" longname="Number" mask="0x000000ff" size="4" showtemplate="FieldDec"/>
			<field type="variable" name="reason" longname="Reason" expr="buf2int(length) -4" showtemplate="FieldAscii"/>
		</block>
		
		<block name="unknown_attributes" longname="Unknow Attributes">
			<field type="variable" name="list_attribute" longname="List Attributes" expr="buf2int(length)" showtemplate="FieldAscii"/>
		</block>
		
		<block name="reflected_from" longname="Reflected Fromm">
			<field type="fixed" name="xxx" longname="XXX" size="1" showtemplate="FieldAscii"/>
			<field type="fixed" name="family" longname="Family" size="1" showtemplate="FieldAscii"/>
			<field type="fixed" name="port" longname="Port" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr"/>
		</block>
	</format>
	

	
	<visualization>	
		<showtemplate name="stun.message.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x0001" show="Binding Request"/>
					<case value="0x0101" show="Binding Response"/>
					<case value="0x0111" show="Binding Error Response"/>
					<case value="0x0002" show="Shared Secret Request"/>
					<case value="0x0102" show="Shared Secret Response"/>
					<case value="0x0112" show="Shared Secret ErrorResponse"/>
					<default show="Message type not recognized"/>
				</switch>		
			</showmap>
		</showtemplate>
		
		<showtemplate name="stun.attribute.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x0001" show="MAPPED-ADDRESS"/>
					<case value="0x0002" show="RESPONSE-ADDRESS"/>
					<case value="0x0003" show="CHANGE-REQUEST"/>
					<case value="0x0004" show="SOURCE-ADDRESS"/>
					<case value="0x0005" show="CHANGED-ADDRESS"/>
					<case value="0x0006" show="USERNAME"/>
					<case value="0x0007" show="PASSWORD"/>
					<case value="0x0008" show="MESSAGE-INTEGRITY"/>
					<case value="0x0009" show="ERROR-CODE"/>
					<case value="0x000a" show="UNKNOWN-ATTRIBUTES"/>
					<case value="0x000b" show="REFLECTED-FROM"/>
					<default show="Attribute type not recognized"/>
				</switch>		
			</showmap>
		</showtemplate>

		<showsumtemplate name="stun">
			<section name="next"/>
			<text value="STUN"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="snmp" longname="SNMP (Simple Network Management Protocol)" showsumtemplate="snmp">
<!--	BOOLEAN = 0x01
		INTEGER = 0x02
		BIT_STRING = 0x03
		OCTET_STRING = 0x04
		NULL = 0x05
		OBJECT_ID = 0x06
		REAL = 0x09
		ENUMERATION = 0x0A
		UTF8_STRING = 0x0C
		GENERAL_STRING = 0x1B
		SEQUENCE = 0x10
		SET = 0x11
-->
	<execute-code>
		<verify>
			<!--<if expr="hasstring($packet[$currentoffset:0],'^\x30.*\x02\x01(\0|\0x1)',0) and (($packetlength - $currentoffset - 2) == buf2int($packet[$currentoffset +1:1]))">-->
			<if expr="hasstring($packet[$currentoffset:0],'^\x30.*\x02\x01(\0|\0x1)',0) and ((($packetlength - $currentoffset - 2) == buf2int($packet[$currentoffset +1:1])) or (((buf2int($packet[$currentoffset+1 : 1]) bitwand 0x80  !=0) and (($packetlength - $currentoffset - 2 - (buf2int ($packet[$currentoffset +1 : 1]) bitwand 0x7F)) == buf2int ($packet[$currentoffset + 2 : buf2int($packet[$currentoffset + 1 : 1]) bitwand 0x7F ])))))">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>
		
		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#snmp"/>
			</update-lookuptable>

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#snmp"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#snmp"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#snmp"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>
<!--
	<execute-code>
		<init>
			<variable name="$SNMPtmp" type="number" validity="thispacket"/>
		</init>
	</execute-code>
-->
<!--	<format>

		<fields>
			<includeblk name="ASN1Enc"/>
			<field type="variable" name="length" longname="Message Length" expr="$SNMPtmp" showtemplate="Field4BytesHex"/>

			<includeblk name="ASN1Enc"/>
			<field type="variable" name="ver" longname="Message Version" expr="$SNMPtmp" showtemplate="Field4BytesHex"/>

			<if expr="buf2int(ver) == 3">	-->	<!-- Just if version is equal to 3 -->
<!--				<if-true>
					<includeblk name="GlobHdr"/>
					<includeblk name="SecHdr"/>
				</if-true>
			</if>


			<loop type="while" expr="1">
				<switch expr="buf2int($packet[$currentoffset:1])">
-->
					<!-- FULVIO: we have to define a 'fake' case, otherwise NetBee complains -->
<!--					<case value="1">
						<includeblk name="TEMP"/>
						<loopctrl type="break"/>
					</case>

					<default>
						<includeblk name="TEMP"/>
						<loopctrl type="break"/>
					</default>
				</switch>
			</loop>
		</fields>


		<block name="TEMP" longname="Unknown Option">
			<includeblk name="ASN1Enc"/>
			<field type="variable" name="value" longname="Value" expr="$SNMPtmp" showtemplate="Field4BytesHex"/>
		</block>

		<block name="GlobHdr" longname="Global Header">
			<includeblk name="ASN1Enc"/>
			<field type="variable" name="hlen" longname="Message Header Length" expr="$SNMPtmp" showtemplate="Field4BytesHex"/>

			<includeblk name="ASN1Enc"/>
			<field type="variable" name="msgid" longname="Message ID" expr="$SNMPtmp" showtemplate="Field4BytesHex"/>

			<includeblk name="ASN1Enc"/>
			<field type="variable" name="msgmaxs" longname="Message Max Size" expr="$SNMPtmp" showtemplate="Field4BytesHex"/>

			<includeblk name="ASN1Enc"/>
			<field type="variable" name="msgflags" longname="Message Flags" expr="$SNMPtmp" showtemplate="Field4BytesHex"/>

			<includeblk name="ASN1Enc"/>
			<field type="variable" name="msgsec" longname="Message Security Model" expr="$SNMPtmp" showtemplate="Field4BytesHex"/>
		</block>

		<block name="SecHdr" longname="Security Parameters">
			<includeblk name="ASN1Enc"/> -->
<!--
			<field type="variable" name="hlen" longname="Message Header Length" expr="$SNMPtmp" showtemplate="Field4BytesHex"/>
-->
<!--			<includeblk name="ASN1Enc"/>
			<field type="variable" name="autheng" longname="Authoritative Engine ID" expr="$SNMPtmp" showtemplate="Field4BytesHex"/>

			<includeblk name="ASN1Enc"/>
			<field type="variable" name="engboots" longname="Engine Boots" expr="$SNMPtmp" showtemplate="Field4BytesHex"/>

			<includeblk name="ASN1Enc"/>
			<field type="variable" name="endtime" longname="Engine Time" expr="$SNMPtmp" showtemplate="Field4BytesHex"/>

			<includeblk name="ASN1Enc"/>
			<field type="variable" name="usrname" longname="User Name" expr="$SNMPtmp" showtemplate="FieldAscii"/>

			<includeblk name="ASN1Enc"/>
			<field type="variable" name="authpar" longname="Authentication Parameter" expr="$SNMPtmp" showtemplate="Field4BytesHex"/>

			<includeblk name="ASN1Enc"/>
			<field type="variable" name="pripar" longname="Privacy Parameter" expr="$SNMPtmp" showtemplate="Field4BytesHex"/>
		</block>

		<block name="ASN1Enc" longname="ASN1 Encoding Internal Info">
			<field type="fixed" name="asn1type" longname="ASN.1 Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="asn1len" longname="ASN.1 Number of Bytes to Encode Length and Length" size="1" showtemplate="FieldDec"/>
-->
<!--
			<assign-variable name="$SNMPtmp" value="buf2int(asn1len) bitwand 0x7F"/>
			<if expr="(buf2int(asn1len) bitwand 0x80) != 0">
				<if-true>
					<assign-variable name="$SNMPtmp" scope="local" value="buf2int(asn1len) bitwand 0x7F"/>
				</if-true>
				
				<if-false>
					<assign-variable name="$SNMPtmp" scope="local" value="buf2int(asn1len) bitwand 0x7F"/>
				</if-false>
			</if>
-->
<!--		</block>-->
	<format>
		<fields>
			<field type="variable" name="snmpdata" longname="SNMP Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="snmp">
			<section name="next"/>
			<text value="snmp"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="telnet" longname="Telnet" showsumtemplate="telnet">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '^\xff[\xfb-\xfe].\xff[\xfb-\xfe].\xff[\xfb-\xfe]',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#telnet"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#telnet"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#telnet"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>
	
	<format>
		<fields>
			<field type="variable" name="Data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="telnet">
			<section name="next"/>
			<text value="Telnet"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="netbeui" longname="NetBios Extended User Interface" showsumtemplate="netbeui">
	<format>
		<fields>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="delimitator" longname="Delimitator" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="command" longname="Command" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="data1" longname="Data1" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="data2" longname="Data2" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="XMIT Cor" longname="Xmit Correlator" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="RSP Cor" longname="Response Correlator" size="2" showtemplate="FieldDec"/>
			<block name="recv_name" longname="Receiver's Name">
				<!--<field type="plugin" name="name" longname="Name" plugin="DomainName" showtemplate="netbios-name"/>-->
				
				<field type="fixed" name="name" longname="Receiver's Name" size="15" showtemplate="FieldAscii"/>
				<field type="fixed" name="type" longname="Type" size="1" showtemplate="FieldHex"/>
			</block>
			
			<block name="send_name" longname="Sender's Name">
				<field type="fixed" name="name" longname="Sender's Name" size="15" showtemplate="FieldAscii"/>
				<field type="fixed" name="type" longname="Type" size="1" showtemplate="FieldHex"/>
				
			</block>
		</fields>
	</format>
	
	<encapsulation>
		<nextproto proto="#smb"/>
	</encapsulation>
	
	<visualization>
		<showsumtemplate name="netbeui">
			<section name="next"/>
			<text value="NetBEUI"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="smb" longname="Server Message Block">
	<format>
		<fields>
			<block name="header" longname="SMB Header">
				<field type="fixed" name="type" longname="Type" size="1" showtemplate="FieldHex"/>
				<field type="fixed" name="proto" longname="Server Component" size="3" showtemplate="FieldAscii"/>
				<field type="fixed" name="command" longname="SMB Command" size="1" showtemplate="smb.command_flag"/>
				<block name="status" longname="SMB status">
					<field type="fixed" name="error_class" longname="Error Class" size="1" showtemplate="smb.err_class"/>
					<field type="fixed" name="reserved" longname="Reserved" size="1" showtemplate="FieldHex"/>
					<field type="fixed" name="error_code" longname="Error Code" size="2" showtemplate="smb.err_code"/>
				</block> 
				
				<block name="flag1" longname="Flag 1">
					<field type="bit" name="flag_req" longname="Requeste/Response" mask="0x80" size="1" showtemplate="smb.rr_status"/>
					<field type="bit" name="flag_batch" longname="Request Batch Oplock" mask="0x40" size="1" showtemplate="smb.batch_status"/>
					<field type="bit" name="flag_oplock" longname="OpLock Request" mask="0x20" size="1" showtemplate="smb.oplock_status"/>
					<field type="bit" name="flag_canpath" longname="Canonical Pathnames" mask="0x10" size="1" showtemplate="smb.path_status"/>
					<field type="bit" name="flag_case" longname="Case Sensitivity" mask="0x04" size="1" showtemplate="smb.case_status"/>
					<field type="bit" name="flag_rbuffer" longname="Receive Buffer Posted" mask="0x02" size="1" showtemplate="smb.buf_status"/>
					<field type="bit" name="flag_lockread" longname="Support Lock Read" mask="0x01" size="1" showtemplate="smb.lr_status"/>
				</block>
				
				<block name="flag2" longname="Flags 2">
					<field type="bit" name="flag_unicoe" longname="Unicode Strings" mask="0x8000" size="2" showtemplate="smb.string_flag"/>
					<field type="bit" name="flag_errcode" longname="Error Code Types" mask="0x4000" size="2" showtemplate="smb.err_flag"/>
					<field type="bit" name="flag_exonly" longname="Execute-only Reads" mask="0x2000" size="2" showtemplate="smb.read_flag"/>
					<field type="bit" name="flag_pathname" longname="Pathname" mask="0x1000" size="2" showtemplate="smb.path_flag"/>
					<field type="bit" name="flag_security" longname="Security" mask="0x0800" size="2" showtemplate="smb.sec_flag"/>
					<field type="bit" name="flag_pathlen" longname="Pathname Length" mask="0x0040" size="2" showtemplate="smb.length_flag"/>
					<field type="bit" name="flag_secsign" longname="Security Signature" mask="0x0004" size="2" showtemplate="smb.sign_flag"/>
					<field type="bit" name="flag_extattr" longname="Extended Attributes" mask="0x0002" size="2" showtemplate="smb.ea_flag"/>
					<field type="bit" name="flag_plenreq" longname="Pathname Length Request" mask="0x0001" size="2" showtemplate="smb.req_flag"/>
				</block>
				
				<field type="fixed" name="pid_h" longname="Process ID High" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="signature" longname="Signature" size="8" showtemplate="Field4BytesHex"/>
				<field type="fixed" name="rsv" longname="Reserved" size="2" showtemplate="FieldBin"/>
				<field type="fixed" name="tid" longname="Tree ID" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="pid" longname="Process ID" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="uid" longname="User ID" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="mid" longname="Multiplex ID" size="2" showtemplate="FieldDec"/>
			</block>
			
			<block name="t_req" longname="Trans Request">
				<field type="fixed" name="wct" longname="Word Count" size="1" showtemplate="FieldDec"/>
				<field type="fixed" name="tpc" longname="Total Parameter Count" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="tdc" longname="Total Data Count" size="2" bigendian="yes" showtemplate="FieldDec"/>
				<field type="fixed" name="mpc" longname="Max Parameter Count" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="mdc" longname="Max Data Count" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="msc" longname="Max Setup Count" size="1" showtemplate="FieldDec"/>
				<field type="fixed" name="rsv" longname="Reserved" size="1" showtemplate="FieldDec"/>
				<block name="flag" longname="Flags">
					<field type="bit" name="transaction" longname="One Way Transaction" mask="0x2" size="2" showtemplate="smb.trans_flag"/>
					<field type="bit" name="disc_tid" longname="Disconnect TID" mask="0x1" size="2" showtemplate="smb.tid_flag"/>
				</block>
				<!--non so in che formato mettere il timeout: in wireshark il timeout e' di 1 sec, mentre NetPDL fornisce un valore altissimo-->
				<field type="fixed" name="timeout" longname="Timeout" size="4" showtemplate="FieldDec"/>
				<field type="fixed" name="rsv" longname="Reserved" size="2" showtemplate="FieldBin"/>
				<field type="fixed" name="param_count" longname="Parameter Count" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="param_offset" longname="Parametere Offset" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="d_count" longname="Data Count" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="d_offset" longname="Data Offset" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="s_count" longname="Setup Count" size="1" showtemplate="FieldDec"/>
				<field type="fixed" name="rsv1" longname="Reserved" size="1" showtemplate="FieldBin"/>
				<field type="fixed" name="rsv2" longname="Reserved2" size="6"  showtemplate="FieldHex"/>
				<field type="fixed" name="b_count" longname="Byte Count" size="2" showtemplate="FieldDec"/>
				<field type="variable" name="t_name" longname="Transaction Name" expr="buf2int(wct)" showtemplate="FieldAscii"/>
			</block>
		</fields>
	</format>
	
	<encapsulation>
		<nextproto proto="#cifs_browser"/>
	</encapsulation>
	
	<visualization>
		<showtemplate name="smb.tid_flag" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Don't disconnect TID"/>
					<case value="1" show="TID disconnection is possible"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.command_flag" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<!--Field name-->
					<case value="0x00" show="Create directory"/>
					<case value="0x01" show="Delete directory"/>
					<case value="0x02" show="Open file"/>
					<case value="0x03" show="Create file"/>
					<case value="0x04" show="Close file"/>
					<case value="0x05" show="Commit all files"/>
					<case value="0x06" show="Delete file"/>
					<case value="0x07" show="Rename file"/>
					<case value="0x08" show="Get file attribute"/>
					<case value="0x09" show="Set file attribute"/>
					<case value="0x0a" show="Read byte block"/>
					<case value="0x0b" show="Write byte block"/>
					<case value="0x0c" show="Lock byte block"/>
					<case value="0x0d" show="Unlock byte block"/>
					<case value="0x0f" show="Create new file"/>
					<case value="0x10" show="Check directory"/>
					<case value="0x11" show="End of process"/>
					<case value="0x12" show="LSEEK"/>
					<case value="0x70" show="Start connection"/>
					<case value="0x71" show="End connection"/>
					<case value="0x72" show="Verify dialect"/>
					<case value="0x80" show="Get disk attributes"/>
					<case value="0x81" show="Search multiple files"/>
					<case value="0xc0" show="Create spool file"/>
					<case value="0xc1" show="Spool byte block"/>
					<case value="0xc2" show="Close spool file"/>
					<case value="0xc3" show="Return print queue"/>
					<case value="0xd0" show="Send message"/>
					<case value="0xd1" show="Send broadcast"/>
					<case value="0xd2" show="Forward user name"/>
					<case value="0xd3" show="Cancel forward"/>
					<case value="0xd4" show="Get machine name"/>
					<case value="0xd5" show="Start multi-block message"/>
					<case value="0xd6" show="End multi-block message"/>
					<case value="0xd7" show="Multi-block message text"/>
					<case value="0xfe" show="Invalid"/>
					<case value="0xff" show="Implementation-dependant"/>
					<!--Core plus commands-->
					<case value="0x13" show="Lock then read data"/>
					<case value="0x14" show="Write then unlock data"/>
					<case value="0x1a" show="Read block raw"/>
					<case value="0x1d" show="Write block raw"/>
					<!--LANMAN 1.0 SMB commands-->
					<case value="0x1b" show="Read block multiplexed"/>
					<case value="0x1c" show="Read block (secondary response)"/>
					<case value="0x1e" show="Write block multiplexed"/>
					<case value="0x1f" show="Write block (secondary response)"/>
					<case value="0x20" show="Write complete response"/>
					<case value="0x22" show="Set file attributes expanded"/>
					<case value="0x23" show="Get file attributes expanded"/>
					<case value="0x24" show="Lock/unlock byte ranges and X"/>
					<case value="0x25" show="Transaction (name, bytes in/out)"/>
					<case value="0x26" show="Transaction (secondary request/response)"/>
					<case value="0x27" show="Passes the IOCTL to the server"/>
					<case value="0x28" show="IOCTL (secondary request/response)"/>
					<case value="0x29" show="Copy"/>
					<case value="0x2a" show="Move"/>
					<case value="0x2b" show="Echo"/>
					<case value="0x2c" show="Write and Close"/>
					<case value="0x2d" show="Open and X"/>
					<case value="0x2e" show="Read and X"/>
					<case value="0x2f" show="Write and X"/>
					<case value="0x73" show="Session Set Up and X (including User Logon)"/>
					<case value="0x75" show="Tree connect and X"/>
					<case value="0x82" show="Find first"/>
					<case value="0x83" show="Find unique"/>
					<case value="0x84" show="Find close"/>
					<case value="0xfe" show="Invalid command"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.trans_flag" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Only Two Way Transaction is possible"/>
					<case value="1" show="One Way Transaction is possible"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.req_flag" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Client wants 8.3 Format Pathnames"/>
					<case value="1" show="Client wants Longnames path"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.ea_flag" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="No Extended Attributes are supported"/>
					<case value="1" show="Extended Attributes are supported"/>
				</switch>
			</showmap>
		</showtemplate>
	
		<showtemplate name="smb.length_flag" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="8.3 Format"/>
					<case value="1" show="Longnames"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.sign_flag" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="No Signature"/>
					<case value="1" show="Message Authentication Codes"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.sec_flag" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Normal Security"/>
					<case value="1" show="Extended Security"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.path_flag" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Normal Pathname"/>
					<case value="1" show="DFS (Distributed File System) Pathname"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.read_flag" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Don't permit reads if execute only"/>
					<case value="1" show="Permit reads if execute only"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.err_flag" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="DOS Error Code"/>
					<case value="1" show="NT_STATUS Code"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.string_flag" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Strings are ASCII"/>
					<case value="1" show="Strings are Unicode"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.rr_status" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Message is a Request to Server"/>
					<case value="1" show="Message is a Response to Server"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.batch_status" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Exclusive OpLock"/>
					<case value="1" show="Batch OpLock"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.oplock_status" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="No OpLock requested/granted"/>
					<case value="1" show="OpLock requested/granted"/>
				</switch>
			</showmap>
		</showtemplate>	

		<showtemplate name="smb.path_status" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Pathname has a host format"/>
					<case value="1" show="Pathname has a canonical format"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.case_status" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Pathnames are case sensitive"/>
					<case value="1" show="Pathnames are not case sensitive"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.lr_status" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="The Read and Write Lock is not supported"/>
					<case value="1" show="The Read and Write Lock is supported"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.buf_status" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Receive Buffer has not been posted"/>
					<case value="1" show="Receive Buffer has been posted"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="smb.err_class" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x00" show="SUCCESS"/>
					<case value="0x02" show="ERRSRV"/>
					<default show="Error in Error Class Flag"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="smb.err_code" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x00" show="No Error"/>
					<case value="0x54" show="The Message was buffered"/>
					<case value="0x55" show="The Message was logged"/>
					<case value="0x56" show="The Message was displayed"/>
					<case value="0x01" show="Non-specific error code"/>
					<case value="0x02" show="Bad password"/>
					<case value="0x03" show="Reserved"/>
					<default show="Error in Error Code Flag"/>
				</switch>
			</showmap>
		</showtemplate>
	</visualization>
</protocol>

<protocol name="cifs_browser" longname="CIFS/E Browser Protocol" showsumtemplate="cifs_browser">
	<format>
		<fields>
			<field type="fixed" name="opcode" longname="Opcode" size="1" showtemplate="cifs.opcode"/>
			<field type="fixed" name="count_up" longname="Update Count" size="1" showtemplate="FieldDec"/>
			<if expr="buf2int(opcode) == 12">
				<if-true>
					<field type="fixed" name="period_up" longname="Update Periodicity" size="4" showtemplate="FieldDec"/>
					<field type="fixed" name="domain" longname="Domain/Workgroup" size="16" showtemplate="FieldAscii"/>
					<field type="fixed" name="os_max" longname="OS Major Version" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="os_min" longname="OS Minor Version" size="1" showtemplate="FieldDec"/>
					<includeblk name="srv_type"/>
					<field type="fixed" name="mystery" longname="Misterious Field" size="4" showtemplate="FieldHex"/>
					<field type="variable" name="mastername" longname="Master Browser Server Name" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
				</if-true>
				<if-false>
					<includeblk name="srv_type"/>
					<field type="fixed" name="os_max" longname="OS Major Version" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="os_min" longname="OS Minor Version" size="1" showtemplate="FieldDec"/>
					<field type="fixed" name="period_up" longname="Update Periodicity" size="2" showtemplate="FieldDec"/>
					<field type="fixed" name="srv" longname="Server Name" size="10" showtemplate="FieldAscii"/>
					<field type="fixed" name="comment" longname="Host Comment" size="1" showtemplate="FieldAscii"/>
				</if-false>
			</if>
		</fields>

		<block name="srv_type" longname="Server Type">
			<field type="bit" name="op_domain" longname="Domain Enum Request"         mask="0x80000000" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_reqonly" longname="Local List Only Request"    mask="0x40000000" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_w95" longname="Windows 95 or above host"       mask="0x00400000" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_vms" longname="VMS host"                       mask="0x00200000" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_osf" longname="OSF host"                       mask="0x00100000" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_domain" longname="Domain Master Browser"       mask="0x00080000" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_master" longname="Master Browser"              mask="0x00040000" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_backup" longname="Backup Browser"              mask="0x00020000" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_potential" longname="Potential Browser"        mask="0x00010000" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_nt" longname="NT Server"                       mask="0x00008000" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_wfw" longname="Wfw Host"                       mask="0x00002000" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_ntworkstation" longname="NT Workstation"       mask="0x00001000" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_xenix" longname="Xenix Server"                 mask="0x00000800" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_dialin" longname="Dialin Server"               mask="0x00000400" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_print" longname="Print Queue Server"           mask="0x00000200" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_domainmember" longname="Domain Member Server"  mask="0x00000100" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_novell" longname="Novell Server"               mask="0x00000080" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_apple" longname="Apple host"                   mask="0x00000040" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_timesource" longname="Time Source"             mask="0x00000020" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_backupcontr" longname="Backup Controller"      mask="0x00000010" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_domaincontr" longname="Domain Controller"      mask="0x00000008" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_sqlserver" longname="SQL Server"               mask="0x00000004" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_server" longname="Server"                      mask="0x00000002" size="4" showtemplate="TrueFalse"/>
			<field type="bit" name="op_workstation" longname="Workstation"            mask="0x00000001" size="4" showtemplate="TrueFalse"/>
		</block>
	</format>
	
	<visualization>
		<showsumtemplate name="cifs_browser">
			<section name="next"/>
			<text value="CIFS Browser"/>
		</showsumtemplate>

		<showtemplate name="cifs.opcode" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x01" show="Host Announcement"/>
					<case value="0x02" show="Announcement Request"/>
					<case value="0x08" show="Request Election"/>
					<case value="0x09" show="Get Backup List Request"/>
					<case value="0x0a" show="Get Backup List Response"/>
					<case value="0x0b" show="Become Backup"/>
					<case value="0x0c" show="Domain Announcement"/>
					<case value="0x0d" show="Master Announcement"/>
					<case value="0x0f" show="Local Master Announcement"/>
					<default show="Unknown opcode"/>
				</switch>
			</showmap>
		</showtemplate>
	</visualization>
</protocol>

<protocol name="netbios" longname="NetBios Name Service" showsumtemplate="netbiosname">
	<format>
		<fields>
			<field type="fixed" name="TRNID" longname="Transaction ID" size="2" showtemplate="FieldHex"/>

			<field type="bit" name="typecode" longname="Packet Type Code" size="2" mask="0xF800" showtemplate="FieldHex">
				<field type="bit" name="rflag" longname="Response Flag" mask="0x8000" size="2" showtemplate="netbios.rflag"/>
				<field type="bit" name="opcode" longname="Operation Specifier" mask="0x7800" size="2" showtemplate="netbios.opcode"/>
			</field>

			<field type="bit" name="nmflags" longname="Flags" size="2" mask="0x07F0" showtemplate="FieldHex">
				<field type="bit" name="Auth" longname="Authoritative Answer Flag" mask="0x0400" size="2" showtemplate="netbios.aaflag"/>
				<field type="bit" name="tcflag" longname="Truncation Flag" mask="0x0200" size="2" showtemplate="netbios.tcflag"/>
				<field type="bit" name="rdflag" longname="Recursion Desired Flag" mask="0x0100" size="2" showtemplate="netbios.rdflag"/>
				<field type="bit" name="raflag" longname="Recursion Available Flag" mask="0x0080" size="2" showtemplate="netbios.raflag"/>
				<field type="bit" name="bflag" longname="Broadcast Flag" mask="0x0010" size="2" showtemplate="netbios.bflag"/>
			</field>

			<field type="bit" name="rcode" longname="Result Codes Of Request" mask="0x000F" size="2" showtemplate="netbios.rcode"/>

			<field type="fixed" name="qdcount" longname="Number Entries Question Section" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="ancount" longname="Number Resource Records Answer Section" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="nscount" longname="Number Resource Records Authority Section" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="arcount" longname="Number Resource Records Additional Section" size="2" showtemplate="FieldDec"/>
			
			<if expr="buf2int(rflag) == 0">
				<if-true>
					<loop type="times2repeat" expr="buf2int(qdcount)">
						<includeblk name="QEntries"/>
					</loop>
				</if-true>
			</if>
			
			<if expr="buf2int(ancount) != 0">
				<if-true>
					<loop type="times2repeat" expr="buf2int(ancount)">
						<includeblk name="AnswerEntries"/>
					</loop>
				</if-true>
			</if>
			
			<if expr="buf2int(nscount) != 0">
				<if-true>
					<loop type="times2repeat" expr="buf2int(nscount)">
						<includeblk name="AuthorityEntries"/>
					</loop>
				</if-true>
			</if>
			
			<if expr="buf2int(arcount) != 0">
				<if-true>
					<loop type="times2repeat" expr="buf2int(arcount)">
						<includeblk name="AdditionalEntries"/>
					</loop>
				</if-true>
			</if>
		</fields>
		
		<block name="AdditionalEntries" longname="Additional Resource Section">
			<!-- Field format is the same of DNS names; however, the visualization is different, so we need to use a different template -->
			<field type="plugin" name="name" longname="Name" plugin="DomainName" showtemplate="netbios-name"/>

			<field type="fixed" name="type" longname="Resource Type" size="2" showtemplate="netbios.ttype"/>
			<field type="fixed" name="class" longname="Resource Class" size="2" showtemplate="netbios.ctype"/>
			<field type="fixed" name="TTL" longname="Time To Live" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="RDLength" longname="Record Data Length" size="2" showtemplate="FieldDec"/>
			<block name="RData" longname="Resource Data">
				<loop type="times2repeat" expr="buf2int(RDLength)">
					<block name="nbflag" longname="Flags">
						<field type="bit" name="g" longname="Group NetBios Name" size="2" mask="0x8000" showtemplate="netbios.gtype"/>
						<field type="bit" name="ont" longname="Owner Node Type" size="2" mask="0x6000" showtemplate="netbios.onttype"/>
					</block>
					
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>
		
		<!--non e' stato testato poiche' non c'erano pacchetti di questo tipo-->
		<block name="AuthorityEntries" longname="Authority Resource Section" showsumtemplate="AuthorityName">
			<!-- Field format is the same of DNS names; however, the visualization is different, so we need to use a different template -->
			<field type="plugin" name="name" longname="Name" plugin="DomainName" showtemplate="netbios-name"/>

			<field type="fixed" name="type" longname="Resource Type" size="2" showtemplate="netbios.ttype"/>
			<field type="fixed" name="class" longname="Resource Class" size="2" showtemplate="netbios.ctype"/>
			<field type="fixed" name="TTL" longname="Time To Live" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="RDLength" longname="Record Data Length" size="2" showtemplate="FieldDec"/>
			<block name="RData" longname="Resource Data">
				<loop type="times2repeat" expr="buf2int(RDLength)">
					<block name="nbflag" longname="Flags">
						<field type="bit" name="g" longname="Group NetBios Name" size="2" mask="0x8000" showtemplate="netbios.gtype"/>
						<field type="bit" name="ont" longname="Owner Node Type" size="2" mask="0x6000" showtemplate="netbios.onttype"/>
					</block>
					
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>
		
		<block name="AnswerEntries" longname="Answer Resource Section" showsumtemplate="AnswerName">
			<!-- Field format is the same of DNS names; however, the visualization is different, so we need to use a different template -->
			<field type="plugin" name="name" longname="Name" plugin="DomainName" showtemplate="netbios-name"/>

			<field type="fixed" name="type" longname="Resource Type" size="2" showtemplate="netbios.ttype"/>
			<field type="fixed" name="class" longname="Resource Class" size="2" showtemplate="netbios.ctype"/>
			<field type="fixed" name="TTL" longname="Time To Live" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="RDLength" longname="Record Data Length" size="2" showtemplate="FieldDec"/>
			<block name="RData" longname="Resource Data">
				<loop type="times2repeat" expr="buf2int(RDLength)">
					<block name="nbflag" longname="Flags">
						<field type="bit" name="g" longname="Group NetBios Name" size="2" mask="0x8000" showtemplate="netbios.gtype"/>
						<field type="bit" name="ont" longname="Owner Node Type" size="2" mask="0x6000" showtemplate="netbios.onttype"/>
					</block>
					
					<field type="fixed" name="address" longname="Address" size="4" showtemplate="ip4addr-noplg"/>
				</loop>
			</block>
		</block>
		
		<block name="QEntries" longname="Queries Resource Section" showsumtemplate="QueryName">
			<!-- Field format is the same of DNS names; however, the visualization is different, so we need to use a different template -->
			<field type="plugin" name="name" longname="Name" plugin="DomainName" showtemplate="netbios-name"/>
			<field type="fixed" name="type" longname="Question Type" size="2" showtemplate="netbios.ttype"/>
			<field type="fixed" name="class" longname="Question Class" size="2" showtemplate="netbios.ctype"/>
		</block>
	</format>

	<visualization>
		<showtemplate name="netbios.bflag" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Packet was broadcast or multicast"/>
					<case value="0" show="Packet was unicast"/>
					<default show="Error in NetBios Name Broadcast Flag lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="netbios.onttype" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="B Node"/>
					<case value="1" show="P Node"/>
					<case value="2" show="M Node"/>
					<case value="3" show="H Node"/>
					<default show="Error in Netbios Name Owner Node Type lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="netbios.gtype" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Unique NetBios Name"/>
					<case value="1" show="Group NetBios Name"/>
					<default show="Error in NetBios Group Name Flag lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="netbios.ctype" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">	
					<case value="1" show="IN - Internet Class"/>
					<default show="Error in NetBios Name Question Class lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="netbios.ttype" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1"  comment="0x01" show="A - IP Address Resource Record"/>
					<case value="2"  comment="0x02" show="NS - Name Server Resource Record"/>
					<case value="10" comment="0x0A" show="NULL - Null Resource Record"/>
					<case value="32" comment="0x20" show="NB - NetBios General Name Service Resource Record"/>
					<case value="33" comment="0x21" show="NBSTAT - NetBios Node Status Resource Record"/>
					<default show="Error in NetBios Name Question Type lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="netbios.rcode" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Success"/>
					<case value="1" show="Format Error"/>
					<case value="2" show="Server Failure"/>
					<case value="3" show="Name Error"/>
					<case value="4" show="Unsupported Request Error"/>
					<case value="5" show="Refused Error"/>
					<case value="6" show="Active Error"/>
					<case value="7" show="Name in Conflict Error"/>
					<case value="11" show="Requested name does not exist"/>
					<default show="Error in NetBIOS Name RCode lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="netbios.raflag" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Server can't do recursive queries"/>
					<case value="1" show="Server can do recursive queries"/>
					<default show="Error in NetBios Name Recursion Available Flag lookup"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="netbios.rdflag" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Don't do query recursively"/>
					<case value="1" show="Do query recursively"/>
					<default show="Error in NetBios Name Recursion Desired Flag lookup"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="netbios.tcflag" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Message is not truncated"/>
					<case value="1" show="Message is truncated"/>
					<default show="Error in NetBios Name Truncation Flag lookup"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="netbios.aaflag" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="The node responding is an authority for the domain name"/>
					<case value="0" show="The node responding is not an authority for the domain name"/> 
					<default show="Error in NetBios Name Authority Answer Flag lookup"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="netbios.rflag" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Request Packet"/>
					<case value="1" show="Response Packet"/>
					<default show="Error in NetBios Name Response Flag lookup"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="netbios.opcode" showtype="bin">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Name query"/>
					<case value="5" show="Name registration"/>
					<case value="6" show="Name release"/>
					<case value="7" show="Wait for Acknowledgement"/>
					<case value="8" show="Name refresh"/>
					<default show="Error in NetBIOS Name OpCode lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
		
		<showsumtemplate name="netbiosname">
			<section name="next"/>
			
			<protofield name="opcode" showdata="showmap"/>
			
			<if expr="buf2int(rflag)==1">
				<if-true>
					<text value=" Response"/>
				</if-true>
			</if>
			
			<if expr="buf2int(qdcount)==0">
				<if-true>
					<if expr="buf2int(ancount)==0">
						<if-true>
							<if expr="buf2int(nscount)==0">
								<if-true>
									<if expr="buf2int(arcount)==0">
										<if-true>	
											<text value=" Requested Name Does Not Exists "/>
										</if-true>
									</if>
								</if-true>
							</if>
						</if-true>
					</if>
				</if-true>
			</if>
		</showsumtemplate>
	
		<showsumtemplate name="QueryName">
			<text value="; Question Type: "/>
			
			<protofield name="type" showdata="showmap"/>
			<text value="; Name: "/>
			<protofield name="name" showdata="showvalue"/>
		</showsumtemplate>
		
		<showsumtemplate name="AnswerName">
			<text value="; Resource Type: "/>
			<protofield name="type" showdata="showmap"/>
			<text value="; Name: "/>
			<protofield name="name" showdata="showvalue"/>
		</showsumtemplate>
		
		<showsumtemplate name="AuthorityName">
			<text value="; Resource Type: "/>
			<protofield name="type" showdata="showmap"/>
			<text value="; Name: "/>
			<protofield name="name" showdata="showvalue"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="netbiosdgm" longname="Netbios Datagram Service" showsumtemplate="netbiosdgm">
	<execute-code>
		<verify>
			<!-- check value of type message and flag -->
			<!--       1 2 3 4 5 6 7 8  -->
			<!-- flag [0|0|0|0|SNT|F|M] some packet have fourth byte equals to 1 !!!! -->
			<if expr="hasstring($packet[$currentoffset : 0], '^[\x10-\x16]',0) and (buf2int($portsrc)== buf2int($packet[$currentoffset+8:2]) )">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>
		
		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#netbiosdgm"/>
			</update-lookuptable>

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#netbiosdgm"/>
			</update-lookuptable>
		</before>
	</execute-code>
	<format>
		<fields>
			<field type="fixed" name="msgtype" longname="Message Type" size="1" showtemplate="netbiosdgm.type"/>
			<field type="fixed" name="flags" longname="Flags" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="dmgid" longname="Datagram ID" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="sourceip" longname="Source IP" size="4" showtemplate="ip4addr"/>
			<field type="fixed" name="sourceport" longname="Source Port" size="2" showtemplate="FieldDec"/>
			<if expr="buf2int(msgtype) == 0x10 or buf2int(msgtype) == 0x11 or buf2int(msgtype) == 0x12">
				<if-true>
					<field type="fixed" name="dmglegth" longname="Datagram Length" size="2" showtemplate="FieldDec"/>
					<field type="fixed" name="packetoffset" longname="Packet Offset" size="2" showtemplate="FieldDec"/>
									
					<field type="fixed" name="source_name_len" longname="Name Length" size="1" showtemplate="FieldDec"/>
					<field type="variable" name="source_name" longname="Source Name" expr="buf2int(source_name_len) + 1" showtemplate="netbios-name"/>
					
					<!--<field type="tokenended" name="destinantionname" longname="Destination Name" endtoken="\x00" showtemplate="FieldAscii"/>	-->
					<field type="fixed" name="destination_name_len" longname="Name Length" size="1" showtemplate="FieldDec"/>
					<field type="variable" name="destination_name" longname="Destination Name" expr="buf2int(destination_name_len) + 1" showtemplate="netbios-name"/>
					<field type="variable" name="userdata" longname="User Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
				</if-true>
				
				<if-false>
					<if expr="buf2int(msgtype) == 0x13">
						<if-true>
							<field type="fixed" name="errorcode" longname="Error Code" size="1" showtemplate="FieldHex"/>
						</if-true>
						
						<if-false>
							<if expr="buf2int(msgtype) == 0x14 or buf2int(msgtype) == 0x15 or buf2int(msgtype) == 0x16">
								<if-true>
									<field type="variable" name="destinationname" longname="Destination Name" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-false>
			</if>
			<field type="variable" name="netbiosddata" longname="NetBios Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	
	
	<visualization>
		<showtemplate name="netbiosdgm.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this[0:1])">
					<case value="0x10" show="Direct Unique Datagram"></case>
					<case value="0x11" show="Direct Group Datagram"></case>
					<case value="0x12" show="Broadcast Datagram"></case>
					<case value="0x13" show="Datagram Error"></case>
					<case value="0x14" show="Datagram Query Request"></case>
					<case value="0x15" show="Datagram Positive Query Response"></case>
					<case value="0x16" show="Datagram Negative Query Response"></case>
					<default show="Unkown Messagge Type"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showsumtemplate name="netbiosdgm">
			<section name="next"/>
			<text value="NetBios Datagram Service "/>
			<protofield name="msgtype" showdata="showmap"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="netbiosssn" longname="NetBios Session Service" showsumtemplate="netbiossession">
	<execute-code>
		<verify>
			<!--<if expr="($packet[$currentoffset :1 ] == '\x00' or $packet[$currentoffset :1 ] == '\x81' or $packet[$currentoffset :1 ] == '\x82' or $packet[$currentoffset :1 ] == '\x83' or $packet[$currentoffset :1 ] == '\x84' or $packet[$currentoffset :1 ] == '\x85') and (($packetlength - $currentoffset - 4) == buf2int($packet[currentoffset + 2 : 2])">-->
			<if expr="($packet[$currentoffset :1 ] == '\x00' or $packet[$currentoffset :1 ] == '\x81' or $packet[$currentoffset :1 ] == '\x82' or $packet[$currentoffset :1 ] == '\x83' or $packet[$currentoffset :1 ] == '\x84' or $packet[$currentoffset :1 ] == '\x85') and (($packetlength - $currentoffset - 4) == buf2int($packet[$currentoffset + 2 : 2]))">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>
		
		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#netbiosssn"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#netbiosssn"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#netbiosssn"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>
	
	<format>
		<fields>
			<if expr="$packet[$currentoffset :1 ] == '\x00' or $packet[$currentoffset :1 ] == '\x81' or $packet[$currentoffset :1 ] == '\x82' or $packet[$currentoffset :1 ] == '\x83' or $packet[$currentoffset :1 ] == '\x84' or $packet[$currentoffset :1 ] == '\x85'">
				<if-true>
					<field type="fixed" name="type" longname="Type" size="1" showtemplate="netbiosssn.type"/>
					<field type="fixed" name="flags" longname="Flags" size="1" showtemplate="FieldHex"/>
					<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
					
					<switch expr="buf2int(type)">
						<case value = "129">  <!-- 0x81-->
							<if expr="$L4proto == #tcp ">
								<!-- NetBios over TCP uses different name rappresentation	-->
								<if-true>
									<block name="called" longname="Called Name">
										<loop type="while" expr="buf2int($packet[$currentoffset : 1]) != 0x00">
											<field type="fixed" name="labelLength" longname="Label Length" size="1" showtemplate="FieldHex"/>
											<field type="variable" name="label" longname="Label" expr="buf2int(labelLength)" showtemplate="FieldHex"/>			
										</loop>
										<field type="fixed" name="root" longname="Root" size="1" showtemplate="FieldHex"/>	
									</block>
									
									<block name="calling" longname="Calling Name">
										<loop type="while" expr="buf2int($packet[$currentoffset : 1]) != 0x00">
											<field type="fixed" name="labelLength" longname="Label Length" size="1" showtemplate="FieldHex"/>
											<field type="variable" name="label" longname="Label" expr="buf2int(labelLength)" showtemplate="FieldHex"/>
										</loop>	
										<field type="fixed" name="root" longname="Root" size="1" showtemplate="FieldHex"/>	
									</block>						
								</if-true>
								
								<if-false>
									<field type="fixed" name="called" longname="Called Name" size="4" showtemplate="FieldHex"/>
									<field type="fixed" name="calling" longname="Calling Name" size="4" showtemplate="FieldHex"/>
								</if-false>
							</if>
							
						</case>
					
						<case value ="131">  <!-- 0x83 -->
							<field type="fixed" name="errcode" longname="Error code" size="1" showtemplate="FieldAscii"/>
						</case>
						
						<case value ="131">  <!-- 0x84 -->
							<field type="fixed" name="retargetIP" longname="Retarget IP Adrres" size="4" showtemplate="FieldAscii"/>
							<field type="fixed" name="port" longname="Port" size="2" showtemplate="FieldAscii"/>
						</case>
						
						<case value="0">    <!-- 0x00 -->
							<field type="variable" name="userdata" longname="User data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
						</case> 
					</switch>
			
					<field type="variable" name="netbiosdata" longname="NetBios Data" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
				</if-true>
				
				<if-false>
					<field type="variable" name="netbiosdata" longname="NetBios Data" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
				</if-false>
			</if>

		</fields>
	</format>
	
	<visualization>
	
		<showtemplate name="netbiosssn.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this[0:1])">
					<case value="0x00" show="Message"></case>
					<case value="0x81" show="Request"></case>
					<case value="0x82" show="Positive Response"></case>
					<case value="0x83" show="Negative Response"></case>
					<case value="0x84" show="Retarget Response"></case>
					<case value="0x85" show="Keep Alive"></case>
					<default show="Unkown Message Type"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showsumtemplate name="netbiossession">
			<section name="next"/>
			<text value="NetBios Session Service ("/>
			<protofield name="type" showdata="showmap"/>
			<text value=")"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="samba" longname="SAMBA" showsumtemplate="samba">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '\xffsmb[\x72\x25]',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#samba"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#samba"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#samba"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>				
	<format>
		<fields>
			<if expr="hasstring($packet[$currentoffset : 0], '....SMB',0)">
				<if-true>
					<field type="fixed" name="block_length" longname="Block Length" size="4" showtemplate="FieldDec"/>
					<block name="header" longname="Header">
						<field type="fixed" name="protocol" longname="Protocol" size="4" showtemplate="FieldAscii"/>
						<field type="fixed" name="command" longname="Command" size="1" showtemplate="samba.command"/>
						<field type="fixed" name="status" longname="Status" size="4" showtemplate="FieldHex">
							<field type="fixed" name="error_class" longname="Error Class" size="1" showtemplate="FieldHex"/>
							<field type="fixed" name="reserved" longname="Reserved" size="1" showtemplate="FieldHex"/>
							<field type="fixed" name="error_code" longname="Error Code" size="2" showtemplate="FieldHex"/>
						</field>
						<field type="fixed" name="flag" longname="Flag" size="1" showtemplate="FieldHex">
							<field type="bit" name="smb_flag_server_to_redir"		longname="SMB_FLAGS_SERVER_TO_REDIR"		size="1" mask="0x80" showtemplate="FieldBin"/>
							<field type="bit" name="smb_flag_request_batch_opclock" longname="SMB_FLAGS_REQUEST_BATCH_OPLOCK"	size="1" mask="0x40" showtemplate="FieldBin"/>
							<field type="bit" name="smb_flag_request_opclock"		longname="SMB_FLAGS_REQUEST_OPLOCK"			size="1" mask="0x20" showtemplate="FieldBin"/>
							<field type="bit" name="smb_flag_canonical_pathnames"	longname="SMB_FLAGS_CANONICAL_PATHNAMES"	size="1" mask="0x10" showtemplate="FieldBin"/>
							<field type="bit" name="smb_flag_caseless_pathnames"	longname="SMB_FLAGS_CASELESS_PATHNAMES"		size="1" mask="0x08" showtemplate="FieldBin"/>
							<field type="bit" name="reserved"						longname="Reserved"							size="1" mask="0x04" showtemplate="FieldBin"/>
							<field type="bit" name="smb_flag_client_buf_avail"		longname="SMB_FLAGS_CLIENT_BUF_AVAIL"		size="1" mask="0x02" showtemplate="FieldBin"/>
							<field type="bit" name="smb_flag_support_lockread"		longname="SMB_FLAGS_SUPPORT_LOCKREAD"		size="1" mask="0x01" showtemplate="FieldBin"/>
						</field>
						<field type="fixed" name="flag2" longname="Flag2" size="2" showtemplate="FieldHex">
							<field type="bit" name="smb_flag2_unicode_strings"			longname="SMB_FLAGS2_UNICODE_STRINGS"		size="2" mask="0x8000" showtemplate="FieldBin"/>
							<field type="bit" name="smb_flag2_32bit_status"				longname="SMB_FLAGS2_32BIT_STATUS"			size="2" mask="0x4000" showtemplate="FieldBin"/>
							<field type="bit" name="smb_flag2_read_if_execute"			longname="SMB_FLAGS2_READ_IF_EXECUTE"		size="2" mask="0x2000" showtemplate="FieldBin"/>
							<field type="bit" name="smb_flag2_dfs_pathname"				longname="SMB_FLAGS2_DFS_PATHNAME"			size="2" mask="0x1000" showtemplate="FieldBin"/>
							<field type="bit" name="smb_flag2_extended_security"		longname="SMB_FLAGS2_EXTENDED_SECURITY"		size="2" mask="0x0800" showtemplate="FieldBin"/>
							<field type="bit" name="reserved"							longname="Reserved"							size="2" mask="0x0400" showtemplate="FieldBin"/>
							<field type="bit" name="reserved"							longname="Reserved"							size="2" mask="0x0200" showtemplate="FieldBin"/>
							<field type="bit" name="reserved"							longname="Reserved"							size="2" mask="0x0100" showtemplate="FieldBin"/>
							<field type="bit" name="reserved"							longname="Reserved"							size="2" mask="0x0080" showtemplate="FieldBin"/>
							<field type="bit" name="smb_flag2_is_long_name"				longname="SMB_FLAGS2_IS_LONG_NAME"			size="2" mask="0x0040" showtemplate="FieldBin"/>
							<field type="bit" name="reserved"							longname="Reserved"							size="2" mask="0x0020" showtemplate="FieldBin"/>
							<field type="bit" name="reserved"							longname="Reserved"							size="2" mask="0x0010" showtemplate="FieldBin"/>
							<field type="bit" name="reserved"							longname="Reserved"							size="2" mask="0x0008" showtemplate="FieldBin"/>
							<field type="bit" name="smb_flag2_security_signature"		longname="SMB_FLAGS2_SECURITY_SIGNATURE"	size="2" mask="0x0004" showtemplate="FieldBin"/>
							<field type="bit" name="smb_flag2_aes"						longname="SMB_FLAGS2_EAS"				size="2" mask="0x0002" showtemplate="FieldBin"/>
							<field type="bit" name="smb_flag2_knows_long_names"			longname="SMB_FLAGS2_KNOWS_LONG_NAMES"		size="2" mask="0x0001" showtemplate="FieldBin"/>
						</field>
						<field type="fixed" name="extra" longname="Extra" size="12" showtemplate="FieldHex">
							<field type="fixed" name="pid_high" longname="PID High" size="2" showtemplate="FieldHex"/>
							<field type="fixed" name="signature" longname="Signature" size="8" showtemplate="FieldHex"/>
							<field type="fixed" name="unused" longname="Unused" size="2" showtemplate="FieldHex"/>
						</field>
						<field type="fixed" name="tid" longname="TID" size="2" showtemplate="FieldHex"/>
						<field type="fixed" name="pid" longname="PID" size="2" showtemplate="FieldHex"/>
						<field type="fixed" name="uid" longname="UID" size="2" showtemplate="FieldHex"/>
						<field type="fixed" name="mid" longname="MID" size="2" showtemplate="FieldHex"/>			
					</block>
					<block name="parameter_block" longname="Parameter Block">
						<field type="fixed" name="word_count" longname="Word Count" size="1" showtemplate="FieldDec"/>
						<if expr="buf2int(word_count)">
							<if-true>
								<field type="variable" name="parameters" longname="Paramenters" expr="2*buf2int(word_count)" showtemplate="FieldHex"/>
							</if-true>
						</if>
					</block>

					<block name="message_block" longname="Message Block">
						<if expr="buf2int(command) == 0xA2 or buf2int(command) == 0xA4">	<!-- check data format of this command -->
							<if-true>
								<field type="variable" name="message" longname="Message" expr="$packetlength - $currentoffset" showtemplate="FieldHex"/>
							</if-true>
							<if-false>
								<field type="fixed" name="byte_count" longname="Byte Count" size="2" showtemplate="FieldDec"/>	<!-- little endian -->
								<if expr="buf2int(byte_count) gt ($packetlength - $currentoffset)">
									<if-true>
										<field type="variable" name="message" longname="Message" expr="$packetlength - $currentoffset" showtemplate="FieldHex"/>
									</if-true>
									<if-false>
										<if expr="buf2int(byte_count)">
											<if-true>
												<field type="variable" name="message" longname="Message" expr="buf2int(changebyteorder(byte_count))" showtemplate="FieldHex"/>
											</if-true>
										</if>
									</if-false>
								</if>
									
							</if-false>
						</if>
					</block>
				</if-true>
				<if-false>
					<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
				</if-false>
			</if>

			<!--<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>-->
		</fields>
	</format>

	<visualization>
		<showtemplate name="samba.command" showtype="hex">
			<showmap>
				<switch expr="buf2int(this[0:1])">
					<case value="0x00"	show="SMB_COM_CREATE_DIRECTORY"/>
					<case value="0x01"	show="SMB_COM_DELETE_DIRECTORY"/>
					<case value="0x02"	show="SMB_COM_OPEN"/>
					<case value="0x03"	show="SMB_COM_CREATE"/>
					<case value="0x04"	show="SMB_COM_CLOSE"/>
					<case value="0x05"	show="SMB_COM_FLUSH"/>
					<case value="0x06"	show="SMB_COM_DELETE"/>
					<case value="0x07"	show="SMB_COM_RENAME"/>
					<case value="0x08"	show="SMB_COM_QUERY_INFORMATION"/>
					<case value="0x09"	show="SMB_COM_SET_INFORMATION"/>
					<case value="0x0A"	show="SMB_COM_READ"/>
					<case value="0x0B"	show="SMB_COM_WRITE"/>
					<case value="0x0C"	show="SMB_COM_LOCK_BYTE_RANGE"/>
					<case value="0x0D"	show="SMB_COM_UNLOCK_BYTE_RANGE"/>
					<case value="0x0E"	show="SMB_COM_CREATE_TEMPORARY"/>
					<case value="0x0F"	show="SMB_COM_CREATE_NEW"/>
					<case value="0x10"	show="SMB_COM_CHECK_DIRECTORY"/>
					<case value="0x11"	show="SMB_COM_PROCESS_EXIT"/>
					<case value="0x12"	show="SMB_COM_SEEK"/>
					<case value="0x13"	show="SMB_COM_LOCK_AND_READ"/>
					<case value="0x14"	show="SMB_COM_WRITE_AND_UNLOCK"/>
					<case value="0x1A"	show="SMB_COM_READ_RAW"/>
					<case value="0x1B"	show="SMB_COM_READ_MPX"/>
					<case value="0x1C"	show="SMB_COM_READ_MPX_SECONDARY"/>
					<case value="0x1D"	show="SMB_COM_WRITE_RAW"/>
					<case value="0x1E"	show="SMB_COM_WRITE_MPX"/>
					<case value="0x1F"	show="SMB_COM_WRITE_MPX_SECONDARY"/>
					<case value="0x20"	show="SMB_COM_WRITE_COMPLETE"/>
					<case value="0x21"	show="SMB_COM_QUERY_SERVER"/>
					<case value="0x22"	show="SMB_COM_SET_INFORMATION2"/>
					<case value="0x23"	show="SMB_COM_QUERY_INFORMATION2"/>
					<case value="0x24"	show="SMB_COM_LOCKING_ANDX"/>
					<case value="0x25"	show="SMB_COM_TRANSACTION"/>
					<case value="0x26"	show="SMB_COM_TRANSACTION_SECONDARY"/>
					<case value="0x27"	show="SMB_COM_IOCTL"/>
					<case value="0x28"	show="SMB_COM_IOCTL_SECONDARY"/>
					<case value="0x29"	show="SMB_COM_COPY"/>
					<case value="0x2A"	show="SMB_COM_MOVE"/>
					<case value="0x2B"	show="SMB_COM_ECHO"/>
					<case value="0x2C"	show="SMB_COM_WRITE_AND_CLOSE"/>
					<case value="0x2D"	show="SMB_COM_OPEN_ANDX"/>
					<case value="0x2E"	show="SMB_COM_READ_ANDX"/>
					<case value="0x2F"	show="SMB_COM_WRITE_ANDX"/>
					<case value="0x30"	show="SMB_COM_NEW_FILE_SIZE"/>
					<case value="0x31"	show="SMB_COM_CLOSE_AND_TREE_DISC"/>
					<case value="0x32"	show="SMB_COM_TRANSACTION2"/>
					<case value="0x33"	show="SMB_COM_TRANSACTION2_SECONDARY"/>
					<case value="0x34"	show="SMB_COM_FIND_CLOSE2"/>
					<case value="0x35"	show="SMB_COM_FIND_NOTIFY_CLOSE"/>
					<case value="0x70"	show="SMB_COM_TREE_CONNECT"/>
					<case value="0x71"	show="SMB_COM_TREE_DISCONNECT"/>
					<case value="0x72"	show="SMB_COM_NEGOTIATE"/>
					<case value="0x73"	show="SMB_COM_SESSION_SETUP_ANDX"/>
					<case value="0x74"	show="SMB_COM_LOGOFF_ANDX"/>
					<case value="0x75"	show="SMB_COM_TREE_CONNECT_ANDX"/>
					<case value="0x80"	show="SMB_COM_QUERY_INFORMATION_DISK"/>
					<case value="0x81"	show="SMB_COM_SEARCH"/>
					<case value="0x82"	show="SMB_COM_FIND"/>
					<case value="0x83"	show="SMB_COM_FIND_UNIQUE"/>
					<case value="0x84"	show="SMB_COM_FIND_CLOSE"/>
					<case value="0xA0"	show="SMB_COM_NT_TRANSACT"/>
					<case value="0xA1"	show="SMB_COM_NT_TRANSACT_SECONDARY"/>
					<case value="0xA2"	show="SMB_COM_NT_CREATE_ANDX"/>
					<case value="0xA4"	show="SMB_COM_NT_CANCEL"/>
					<case value="0xA5"	show="SMB_COM_NT_RENAME"/>
					<case value="0xC0"	show="SMB_COM_OPEN_PRINT_FILE"/>
					<case value="0xC1"	show="SMB_COM_WRITE_PRINT_FILE"/>
					<case value="0xC2"	show="SMB_COM_CLOSE_PRINT_FILE"/>
					<case value="0xC3"	show="SMB_COM_GET_PRINT_QUEUE"/>
					<case value="0xD8"	show="SMB_COM_READ_BULK"/>
					<case value="0xD9"	show="SMB_COM_WRITE_BULK"/>
					<case value="0xDA"	show="SMB_COM_WRITE_BULK_DATA"/>
					
					<default show="Unknown Command"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showsumtemplate name="samba">
			<section name="next"/>
			<text value="SAMBA "/>
			<protofield name="command" showdata="showmap"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="nfs" longname="NFS" showsumtemplate="nfs">
	<format>
		<fields>
			<if expr="checklookuptable($rpctable, $ipsrc, $ipdst, $portsrc, $portdst) and $rpctable.type==0">	<!-- is a call -->
				<if-true>
					<switch expr="$rpctable.proc">
						<case value="0x11"> <includeblk name="READDIRPLUS3args"/></case>
						<case value="0x08"> <includeblk name="CREATE3args"/></case>
						<!-- Casi non testati -->
						<case value="0x00"> <includeblk name="NULLargs"/></case>
						<case value="0x01"> <includeblk name="GETATTR3args"/></case>
						<case value="0x02"> <includeblk name="SETATTR3args"/></case>
						<case value="0x03"> <includeblk name="LOOKUP3args"/></case>
						<case value="0x04"> <includeblk name="ACCESS3args"/></case>
						<case value="0x05"> <includeblk name="READLINK3args"/></case>
						<case value="0x06"> <includeblk name="READ3args"/></case>
						<case value="0x07"> <includeblk name="WRITE3args"/></case>
						<case value="0x09"> <includeblk name="MKDIR3args"/></case>
						<case value="0x0A"> <includeblk name="SYMLINK3args"/></case>
						<case value="0x0B"> <includeblk name="MKNOD3args"/></case>
						<case value="0x0C"> <includeblk name="REMOVE3args"/></case>
						<case value="0x0D"> <includeblk name="RMDIR3args"/></case>
						<case value="0x0E"> <includeblk name="RENAME3args"/></case>
						<case value="0x0F"> <includeblk name="LINK3args"/></case>
						<case value="0x10"> <includeblk name="READDIR3args"/></case>
						<case value="0x12"> <includeblk name="FSSTAT3args"/></case>
						<case value="0x13"> <includeblk name="FSINFO3args"/></case>
						<case value="0x14"> <includeblk name="PATHCONF3args"/></case>
						<case value="0x15"> <includeblk name="COMMIT3args"/></case>
						<default>
							<field type="variable" name="data" longname="Input" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
						</default>
					</switch>
					
				</if-true>
			</if>
			<if expr="checklookuptable($rpctable, $ipsrc, $ipdst, $portsrc, $portdst) and $rpctable.type==1">  <!-- is a reply -->
				<if-true>
					<switch expr="$rpctable.proc">
						<case value="0x11"> <includeblk name="READDIRPLUS3res"/></case>
						<case value="0x08"> <includeblk name="CREATE3res"/></case>
						<!-- Casi non testati -->
						<case value="0x00"> <includeblk name="NULLres"/></case>
						<case value="0x01"> <includeblk name="GETATTR3res"/></case>
						<case value="0x02"> <includeblk name="SETATTR3res"/></case>
						<case value="0x03"> <includeblk name="LOOKUP3res"/></case>
						<case value="0x04"> <includeblk name="ACCESS3res"/></case>
						<case value="0x05"> <includeblk name="READLINK3res"/></case>
						<case value="0x06"> <includeblk name="READ3res"/></case>
						<case value="0x07"> <includeblk name="WRITE3res"/></case>
						<case value="0x09"> <includeblk name="MKDIR3res"/></case>
						<case value="0x0A"> <includeblk name="SYMLINK3res"/></case>
						<case value="0x0B"> <includeblk name="MKNOD3res"/></case>
						<case value="0x0C"> <includeblk name="REMOVE3res"/></case>
						<case value="0x0D"> <includeblk name="RMDIR3res"/></case>
						<case value="0x0E"> <includeblk name="RENAME3res"/></case>
						<case value="0x0F"> <includeblk name="LINK3res"/></case>
						<case value="0x10"> <includeblk name="READDIR3res"/></case>
						<case value="0x12"> <includeblk name="FSSTAT3res"/></case>
						<case value="0x13"> <includeblk name="FSINFO3res"/></case>
						<case value="0x14"> <includeblk name="PATHCONF3res"/></case>
						<case value="0x15"> <includeblk name="COMMIT3res"/></case>
						<default>
							<field type="variable" name="data" longname="Output" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
						</default>
					</switch>
					
				</if-true>
			</if>
			<!--<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>-->
		</fields>
		
		<block name="READDIRPLUS3args" longname="READDIRPLUS3 Argument">
			<block name="dir" longname="Dir">
				<includeblk name="opaque"/>
			</block>
			<field type="fixed" name="cookie" longname="Cookie" size="8" showtemplate="FieldDec"/>
			<field type="fixed" name="verf" longname="Verf" size="8" showtemplate="FieldDec"/>
			<field type="fixed" name="dircount" longname="DirCount" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="maxcount" longname="MaxCount" size="4" showtemplate="FieldDec"/>
		<!--	<field type="variable" name="data" longname="Iutput" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/> -->
		</block>
		
		<block name="READDIRPLUS3res" longname="READDIRPLUS3 Results">
			<if expr="buf2int($packet[$currentoffset : 4] ) == 0">
				<if-true>
					<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
					<if expr="buf2int(status)==0">
						<if-true>
							<block name="dir_attributes" longname="Directory Attributes">
								<includeblk name="post_op_attr"/>
							</block>
							<field type="fixed" name="cookieverf" longname="Cookieverf" size="8" showtemplate="FieldHex"/>
							<block name="reply" longname="Reply">
								<loop type="while" expr="buf2int($packet[$currentoffset:4])==1">
									<field type="fixed" name="follow" longname="Follow" size="4" showtemplate="FieldHex"/>
									<if expr="buf2int(follow)==1">
										<if-true>
											<includeblk name="entryplus"/>
										</if-true>
									</if>
								</loop>
							</block>
						</if-true>
						<if-false>
							<includeblk name="post_op_attr"/>
						</if-false>
					</if>
				</if-true>
			</if>
			<field type="variable" name="data" longname="Output" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</block>

		<block name="CREATE3args" longname="CREATE3 Argument">
			<block name="where" longname="Where">
				<includeblk name="diropargs3"/>
			</block>
			<block name="how" longname="How">
				<field type="fixed" name="mode" longname="Create Mode" size="4" showtemplate="cmode"/>
				<switch expr="buf2int(mode)">
					<case value="0x0000">
						<block name="obj_attributes" longname="Object Attributes">
							<includeblk name="sattr3"/>
						</block>
					</case>
					<case value="0x0001">
						<block name="obj_attributes" longname="Object Attributes">
							<includeblk name="sattr3"/>
						</block>
					</case>
					<case value="0x0002">
						<field type="fixed" name="createverf" longname="Create Verifier" size="8" showtemplate="FieldDec"/>
					</case>
					<default>
					</default>
				</switch>
			</block>
		</block>
		
		<block name="CREATE3res" longname="CREATE3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="object" longname="Object">
						<includeblk name="post_op_fh3"/>
					</block>
					<block name="obj_attributes" longname="Object Attributes">
						<includeblk name="post_op_attr"/>
					</block>
					<block name="dir_wcc" longname="Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-true>
				<if-false>
					<block name="dir_wcc" longname="Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="entryplus" longname="EntryPlus">
			<field type="fixed" name="fileid" longname="Fileid" size="8" showtemplate="FieldHex"/>
			<field type="fixed" name="filenamelen" longname="Filename Length" size="4" showtemplate="FieldDec"/>
			<field type="variable" name="filename" longname="filename" expr="buf2int(filenamelen)" showtemplate="FieldAscii"/>
			<if expr="(buf2int(filenamelen) mod 4)!=0">
				<if-true>
					<field type="variable" name="fill" longname="Fill" expr="4-(buf2int(filenamelen) mod 4)" showtemplate="FieldHex"/>
				</if-true>
			</if>
			<field type="fixed" name="cookie" longname="Cookie" size="8" showtemplate="FieldHex"/>
			<block name="name_attributes" longname="Name Attributes">
				<includeblk name="post_op_attr"/>
			</block>
			<block name="name_handle" longname="Name Handle">
				<includeblk name="post_op_fh3"/>
			</block>
		</block>
		
		<block name="entry" longname="Entry">
			<field type="fixed" name="fileid" longname="Fileid" size="8" showtemplate="FieldHex"/>
			<field type="fixed" name="filenamelen" longname="Filename Length" size="4" showtemplate="FieldDec"/>
			<field type="variable" name="filename" longname="filename" expr="buf2int(filenamelen)" showtemplate="FieldAscii"/>
			<if expr="(buf2int(filenamelen) mod 4)!=0">
				<if-true>
					<field type="variable" name="fill" longname="Fill" expr="4-(buf2int(filenamelen) mod 4)" showtemplate="FieldHex"/>
				</if-true>
			</if>
			<field type="fixed" name="cookie" longname="Cookie" size="8" showtemplate="FieldHex"/>
		</block>

		<block name="post_op_attr" longname="Post Op Attr">
			<field type="fixed" name="attributes_follow" longname="Attributes Follow" size="4" showtemplate="FieldHex"/>
			<if expr="buf2int(attributes_follow)==1">
				<if-true>
					<block name="attributes" longname="Attributes">
						<includeblk name="fattr3"/>
					</block>
				</if-true>
			</if>
		</block>
		
		<block name="fattr3" longname="Fattr3">
			<field type="fixed" name="type" longname="Type" size="4" showtemplate="ftype"/>
			<field type="fixed" name="mode" longname="Mode" size="4" showtemplate="mode"/>
			<field type="fixed" name="nlink" longname="Nlink" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="uid" longname="Uid" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="gid" longname="Gid" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="size" longname="Size" size="8" showtemplate="FieldHex"/>
			<field type="fixed" name="used" longname="Used" size="8" showtemplate="FieldHex"/>
			<field type="fixed" name="rdev" longname="Rdev" size="8" showtemplate="FieldHex">
				<field type="fixed" name="specdata1" longname="specdata1" size="4" showtemplate="FieldHex"/>
				<field type="fixed" name="specdata2" longname="specdata2" size="4" showtemplate="FieldHex"/>
			</field>
			<field type="fixed" name="fsid" longname="Fsid" size="8" showtemplate="FieldHex"/>
			<field type="fixed" name="fileid" longname="Fileid" size="8" showtemplate="FieldHex"/>
			<field type="fixed" name="atime" longname="aTime" size="8" showtemplate="FieldHex">
				<field type="fixed" name="second" longname="Second" size="4" showtemplate="FieldHex"/>
				<field type="fixed" name="usecond" longname="Usecond" size="4" showtemplate="FieldHex"/>
			</field>
			<field type="fixed" name="mtime" longname="mTime" size="8" showtemplate="FieldHex">
				<field type="fixed" name="second" longname="Second" size="4" showtemplate="FieldHex"/>
				<field type="fixed" name="usecond" longname="Usecond" size="4" showtemplate="FieldHex"/>
			</field>
			<field type="fixed" name="ctime" longname="cTime" size="8" showtemplate="FieldHex">
				<field type="fixed" name="second" longname="Second" size="4" showtemplate="FieldHex"/>
				<field type="fixed" name="usecond" longname="Usecond" size="4" showtemplate="FieldHex"/>
			</field>
		</block>
		
		<block name="diropargs3" longname="Diropargs3">
			<block name="dir" longname="Dir">
				<includeblk name="opaque"/>
			</block>
			
			<block name="name" longname="Name">
				<field type="fixed" name="filenamelen" longname="Filename Length" size="4" showtemplate="FieldDec"/>
				<field type="variable" name="filename" longname="filename" expr="buf2int(filenamelen)" showtemplate="FieldAscii"/>
				<if expr="(buf2int(filenamelen) mod 4)!=0">
					<if-true>
						<field type="variable" name="fill" longname="Fill" expr="4-(buf2int(filenamelen) mod 4)" showtemplate="FieldHex"/>
					</if-true>
				</if>
			</block>
		</block>
		
		<block name="post_op_fh3" longname="Post Op Fh3">
			<field type="fixed" name="handle_follows" longname="Handle Follows" size="4" showtemplate="FieldHex"/>
			<if expr="buf2int(handle_follows)==1">
				<if-true>
					<field type="fixed" name="namelen" longname="Name Length" size="4" showtemplate="FieldHex"/>
					<field type="variable" name="namehandle" longname="Name Handle" expr="buf2int(namelen)" showtemplate="FieldAscii"/>
				</if-true>
			</if>
		</block>
		
		<block name="sattr3" longname="Sattr3">
			<field type="fixed" name="smode" longname="Set Mode" size="4" showtemplate="FieldHex"/>
			<if expr="buf2int(smode)==1">
				<if-true>
					<field type="fixed" name="mode" longname="Mode" size="4" showtemplate="FieldHex"/>
				</if-true>
			</if>
			<field type="fixed" name="suid" longname="Set Uid" size="4" showtemplate="FieldHex"/>
			<if expr="buf2int(suid)==1">
				<if-true>
					<field type="fixed" name="uid" longname="Uid" size="4" showtemplate="FieldHex"/>
				</if-true>
			</if>
			<field type="fixed" name="sgid" longname="Set Gid" size="4" showtemplate="FieldHex"/>
			<if expr="buf2int(sgid)==1">
				<if-true>
					<field type="fixed" name="gid" longname="Gid" size="4" showtemplate="FieldHex"/>
				</if-true>
			</if>					
			<field type="fixed" name="ssize" longname="Set Size" size="8" showtemplate="FieldHex"/>
			<if expr="buf2int(ssize)==1">
				<if-true>
					<field type="fixed" name="size" longname="Size" size="8" showtemplate="FieldHex"/>
				</if-true>
			</if>
			<field type="fixed" name="satime" longname="Set ATime" size="8" showtemplate="time"/>
			<if expr="buf2int(satime)==2">
				<if-true>
					<field type="fixed" name="seconds" longname="Seconds" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="nseconds" longname="NSeconds" size="4" showtemplate="FieldHex"/>
				</if-true>
			</if>
			<field type="fixed" name="smtime" longname="Set MTime" size="8" showtemplate="time"/>
			<if expr="buf2int(smtime)==2">
				<if-true>
					<field type="fixed" name="seconds" longname="Seconds" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="nseconds" longname="NSeconds" size="4" showtemplate="FieldHex"/>
				</if-true>
			</if>
		</block>
		
		<block name="wcc_data" longname="Wcc data">
			<block name="before" longname="Before">
				<field type="fixed" name="attributes_follow" longname="Attributes Follow" size="4" showtemplate="FieldHex"/>
				<if expr="buf2int(attributes_follow)==1">
					<if-true>
						<field type="fixed" name="size" longname="Size" size="8" showtemplate="FieldHex"/>
						<field type="fixed" name="mtime" longname="mTime" size="8" showtemplate="FieldHex">
							<field type="fixed" name="second" longname="Second" size="4" showtemplate="FieldHex"/>
							<field type="fixed" name="usecond" longname="Usecond" size="4" showtemplate="FieldHex"/>
						</field>
						<field type="fixed" name="ctime" longname="cTime" size="8" showtemplate="FieldHex">
							<field type="fixed" name="second" longname="Second" size="4" showtemplate="FieldHex"/>
							<field type="fixed" name="usecond" longname="Usecond" size="4" showtemplate="FieldHex"/>
						</field>
					</if-true>
				</if>
			</block>
			
			<block name="after" longname="After">
				<includeblk name="post_op_attr"/>
			</block>
		</block>
		
		<block name="opaque" longname="Opaque">
			<field type="fixed" name="len" longname="Length" size="4" showtemplate="FieldDec"/>
			<field type="variable" name="filehandle" longname="File Handle" expr="buf2int(len)" showtemplate="FieldHex"/>
		</block>
		
		<block name="NULLargs" longname="NULL Argument">
		</block>
		
		<block name="NULLres" longname="NULL Results">
		</block>
		
		<block name="GETATTR3args" longname="GETATTR3 Argument">
		<block name="object" longname="Object">
			<includeblk name="opaque"/>
		</block>
		</block>
		
		<block name="GETATTR3res" longname="GETATTR3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="obj_attributes" longname="Object Attributes">
						<includeblk name="fattr3"/>
					</block>
				</if-true>
			</if>
		</block>
		
		<block name="SETATTR3args" longname="SETATTR3 Argument">
			<block name="object" longname="Object">
				<includeblk name="opaque"/>
			</block>
			<block name="new_attributes" longname="New Attributes">
				<includeblk name="sattr3"/>
			</block>
			<block name="guard" longname="Guard">
				<field type="fixed" name="check" longname="Check" size="4" showtemplate="FieldHex"/>
				<if expr="buf2int(check)==1">
					<if-true>
						<field type="fixed" name="ctime" longname="cTime" size="8" showtemplate="FieldHex">
							<field type="fixed" name="second" longname="Second" size="4" showtemplate="FieldHex"/>
							<field type="fixed" name="usecond" longname="Usecond" size="4" showtemplate="FieldHex"/>
						</field>
					</if-true>
				</if>
			</block>
		</block>
		
		<block name="SETATTR3res" longname="SETATTR3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="obj_wcc" longname="Object Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-true>
				<if-false>
					<block name="obj_wcc" longname="Object Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="LOOKUP3args" longname="LOOKUP3 Argument">
			<block name="what" longname="What">
				<includeblk name="diropargs3"/>
			</block>
		</block>
		
		<block name="LOOKUP3res" longname="LOOKUP3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="object" longname="Object">
						<includeblk name="opaque"/>
					</block>
					<block name="obj_attributes" longname="Object Attributes">
						<includeblk name="post_op_attr"/>
					</block>
					<block name="dir_attributes" longname="Directory Attributes">
						<includeblk name="post_op_attr"/>
					</block>
				</if-true>
				<if-false>
					<block name="dir_attributes" longname="Directory Attributes">
						<includeblk name="post_op_attr"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="ACCESS3args" longname="ACCESS3 Argument">
			<block name="object" longname="Object">
				<includeblk name="opaque"/>
			</block>
			<field type="fixed" name="access" longname="Access" size="2" showtemplate="access"/>
		</block>
		
		<block name="ACCESS3res" longname="ACCESS3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="obj_attributes" longname="Object Attributes">
						<includeblk name="post_op_attr"/>
					</block>
					<field type="fixed" name="access" longname="Access" size="2" showtemplate="access"/>
				</if-true>
				<if-false>
					<block name="obj_attributes" longname="Object Attributes">
						<includeblk name="post_op_attr"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="READLINK3args" longname="READLINK3 Argument">
			<block name="symlink" longname="Symbolic Link">
				<includeblk name="opaque"/>
			</block>
		</block>
		
		<block name="READLINK3res" longname="READLINK3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="symlink_attributes" longname="Symbolic Link Attributes">
						<includeblk name="post_op_attr"/>
					</block>
					<block name="data" longname="Data">
						<field type="fixed" name="datalen" longname="Data Length" size="4" showtemplate="FieldDec"/>
						<field type="variable" name="data" longname="Data" expr="buf2int(datalen)" showtemplate="FieldAscii"/>
						<if expr="(buf2int(datalen) mod 4)!=0">
							<if-true>
								<field type="variable" name="fill" longname="Fill" expr="4-(buf2int(datalen) mod 4)" showtemplate="FieldHex"/>
							</if-true>
						</if>
					</block>
				</if-true>
				<if-false>
					<block name="symlink_attributes" longname="Symbolic Link Attributes">
						<includeblk name="post_op_attr"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="READ3args" longname="READ3 Argument">
			<block name="file" longname="File">
				<includeblk name="opaque"/>
			</block>
			<field type="fixed" name="offset" longname="Offset" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="count" longname="Count" size="2" showtemplate="FieldHex"/>
		</block>
		
		<block name="READ3res" longname="READ3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="file_attributes" longname="File Attributes">
						<includeblk name="post_op_attr"/>
					</block>
					<field type="fixed" name="count" longname="Count" size="2" showtemplate="FieldHex"/>
					<field type="fixed" name="eof" longname="Eof" size="2" showtemplate="FieldHex"/>
					<field type="variable" name="data" longname="Opaque Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
				</if-true>
				<if-false>
					<block name="file_attributes" longname="File Attributes">
						<includeblk name="post_op_attr"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="WRITE3args" longname="WRITE3 Argument">
			<block name="file" longname="File">
				<includeblk name="opaque"/>
			</block>
			<field type="fixed" name="offset" longname="Offset" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="count" longname="Count" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="stable" longname="Stable" size="2" showtemplate="stable"/>
			<field type="variable" name="data" longname="Opaque Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</block>
		
		<block name="WRITE3res" longname="WRITE3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="file_wcc" longname="File Wcc">
						<includeblk name="wcc_data"/>
					</block>
					<field type="fixed" name="count" longname="Count" size="2" showtemplate="FieldHex"/>
					<field type="fixed" name="committed" longname="Committed" size="2" showtemplate="stable"/>
					<field type="fixed" name="writeverf" longname="Write Verifier" size="8" showtemplate="FieldDec"/>
				</if-true>
				<if-false>
					<block name="file_wcc" longname="File Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="MKDIR3args" longname="MKDIR3 Argument">
			<block name="where" longname="Where">
				<includeblk name="diropargs3"/>
			</block>
			<block name="attributes" longname="Initial Attributes">
				<includeblk name="sattr3"/>
			</block>
		</block>
		
		<block name="MKDIR3res" longname="MKDIR3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="object" longname="Object">
						<includeblk name="post_op_fh3"/>
					</block>
					<block name="obj_attributes" longname="Object Attributes">
						<includeblk name="post_op_attr"/>
					</block>
					<block name="dir_wcc" longname="Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-true>
				<if-false>
					<block name="dir_wcc" longname="Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="SYMLINK3args" longname="SYMLINK3 Argument">
			<block name="_attributes" longname=" Attributes">
				<includeblk name="diropargs3"/>
			</block>
			<block name="symlink" longname="Symbolic Link">
				<block name="symlink_attributes" longname="Symbolic Link Attributes">
					<includeblk name="sattr3"/>
				</block>
				<block name="symlink_data" longname="Symbolic Link Data">
					<includeblk name="opaque"/>
				</block>
			</block>
		</block>
		
		<block name="SYMLINK3res" longname="SYMLINK3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="object" longname="Object">
						<includeblk name="post_op_fh3"/>
					</block>
					<block name="obj_attributes" longname="Object Attributes">
						<includeblk name="post_op_attr"/>
					</block>
					<block name="dir_wcc" longname="Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-true>
				<if-false>
					<block name="dir_wcc" longname="Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="MKNOD3args" longname="MKNOD3 Argument">
			<block name="where" longname="Where">
				<includeblk name="diropargs3"/>
			</block>
			<block name="what" longname="What">
				<field type="fixed" name="ftype3" longname="ftype3" size="4" showtemplate="ftype"/>
				<switch expr="buf2int(mode)">
					<case value="0x0003">
						<includeblk name="sattr3"/>
						<field type="fixed" name="spec" longname="Spec" size="8" showtemplate="FieldHex">
							<field type="fixed" name="specdata1" longname="specdata1" size="4" showtemplate="FieldHex"/>
							<field type="fixed" name="specdata2" longname="specdata2" size="4" showtemplate="FieldHex"/>
						</field>
					</case>
					<case value="0x0004">
						<includeblk name="sattr3"/>
						<field type="fixed" name="specdata" longname="Specdata1" size="8" showtemplate="FieldHex">
							<field type="fixed" name="specdata1" longname="specdata1" size="4" showtemplate="FieldHex"/>
							<field type="fixed" name="specdata2" longname="specdata2" size="4" showtemplate="FieldHex"/>
						</field>
					</case>
					<case value="0x0006">
						<includeblk name="sattr3"/>
					</case>
					<case value="0x0007">
						<includeblk name="sattr3"/>
					</case>
					<default>
					</default>
				</switch>
			</block>
		</block>
		
		<block name="MKNOD3res" longname="MKNOD3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="object" longname="Object">
						<includeblk name="post_op_fh3"/>
					</block>
					<block name="obj_attributes" longname="Object Attributes">
						<includeblk name="post_op_attr"/>
					</block>
					<block name="dir_wcc" longname="Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-true>
				<if-false>
					<block name="dir_wcc" longname="Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="REMOVE3args" longname="REMOVE3 Argument">
			<block name="object" longname="Object">
				<includeblk name="diropargs3"/>
			</block>
		</block>
		
		<block name="REMOVE3res" longname="REMOVE3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="dir_wcc" longname="Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-true>
				<if-false>
					<block name="dir_wcc" longname="Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="RMDIR3args" longname="RMDIR3 Argument">
			<block name="object" longname="Object">
				<includeblk name="diropargs3"/>
			</block>
		</block>
		
		<block name="RMDIR3res" longname="RMDIR3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="dir_wcc" longname="Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-true>
				<if-false>
					<block name="dir_wcc" longname="Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="RENAME3args" longname="RENAME3 Argument">
			<block name="from" longname="From">
				<includeblk name="diropargs3"/>
			</block>
			<block name="to" longname="To">
				<includeblk name="diropargs3"/>
			</block>
		</block>
		
		<block name="RENAME3res" longname="RENAME3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="fromdir_wcc" longname="From Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
					<block name="todir_wcc" longname="To Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-true>
				<if-false>
					<block name="fromdir_wcc" longname="From Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
					<block name="todir_wcc" longname="To Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="LINK3args" longname="LINK3 Argument">
			<block name="file" longname="File">
				<includeblk name="opaque"/>
			</block>
			<block name="link" longname="Link">
				<includeblk name="diropargs3"/>
			</block>
		</block>
		
		<block name="LINK3res" longname="LINK3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="file_attributes" longname="File Attributes">
						<includeblk name="post_op_attr"/>
					</block>
					<block name="linkdir_wcc" longname="Link Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-true>
				<if-false>
					<block name="file_attributes" longname="File Attributes">
						<includeblk name="post_op_attr"/>
					</block>
					<block name="linkdir_wcc" longname="Link Directory Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="READDIR3args" longname="READDIR3 Argument">
			<block name="dir" longname="Dir">
				<includeblk name="opaque"/>
			</block>
			<field type="fixed" name="cookie" longname="Cookie" size="8" showtemplate="FieldDec"/>
			<field type="fixed" name="verf" longname="Verf" size="8" showtemplate="FieldDec"/>
			<field type="fixed" name="count" longname="Count" size="4" showtemplate="FieldDec"/>
		</block>
		
		<block name="READDIR3res" longname="READDIR3 Results">
			<if expr="buf2int($packet[$currentoffset : 4] ) == 0">
				<if-true>
					<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
					<if expr="buf2int(status)==0">
						<if-true>
							<block name="dir_attributes" longname="Directory Attributes">
								<includeblk name="post_op_attr"/>
							</block>
							<field type="fixed" name="cookieverf" longname="Cookieverf" size="8" showtemplate="FieldHex"/>
							<block name="reply" longname="Reply">
								<loop type="while" expr="buf2int($packet[$currentoffset:4])==1">
									<field type="fixed" name="follow" longname="Follow" size="4" showtemplate="FieldHex"/>
									<if expr="buf2int(follow)==1">
										<if-true>
											<includeblk name="entry"/>
										</if-true>
									</if>
								</loop>
							</block>
						</if-true>
						<if-false>
							<block name="dir_attributes" longname="Directory Attributes">
								<includeblk name="post_op_attr"/>
							</block>
						</if-false>
					</if>
				</if-true>
			</if>
			<field type="variable" name="data" longname="Output" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</block>
		
		<block name="FSSTAT3args" longname="FSSTAT3 Argument">
			<block name="fsroot" longname="FSroot">
				<includeblk name="opaque"/>
			</block>
		</block>
		
		<block name="FSSTAT3res" longname="FSSTAT3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="obj_attributes" longname="Object Attributes">
						<includeblk name="post_op_attr"/>
					</block>
					<field type="fixed" name="tbytes1" longname="Tbytes1" size="8" showtemplate="FieldHex"/>
					<field type="fixed" name="fbytes1" longname="Fbytes1" size="8" showtemplate="FieldHex"/>
					<field type="fixed" name="abytes1" longname="Abytes1" size="8" showtemplate="FieldHex"/>
					<field type="fixed" name="tbytes2" longname="Tbytes2" size="8" showtemplate="FieldHex"/>
					<field type="fixed" name="fbytes2" longname="Fbytes2" size="8" showtemplate="FieldHex"/>
					<field type="fixed" name="abytes2" longname="Abytes2" size="8" showtemplate="FieldHex"/>
					<field type="fixed" name="invarsec" longname="Invarsec" size="4" showtemplate="FieldHex"/>
				</if-true>
				<if-false>
					<block name="obj_attributes" longname="Object Attributes">
						<includeblk name="post_op_attr"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="FSINFO3args" longname="FSINFO3 Argument">
			<block name="fsroot" longname="FSroot">
				<includeblk name="opaque"/>
			</block>
		</block>
		
		<block name="FSINFO3res" longname="FSINFO3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="obj_attributes" longname="Object Attributes">
						<includeblk name="post_op_attr"/>
					</block>
					<field type="fixed" name="rtmax" longname="RTmax" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="rtpref" longname="RTpref" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="rtmult" longname="RTmult" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="wtmax" longname="WTmax" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="wtpref" longname="WTpref" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="wtmult" longname="WTmult" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="dtpref" longname="DTpref" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="maxfilesize" longname="Maxfilesize" size="8" showtemplate="FieldHex"/>
					<field type="fixed" name="time_delta" longname="Time delta" size="8" showtemplate="FieldHex">
						<field type="fixed" name="second" longname="Second" size="4" showtemplate="FieldHex"/>
						<field type="fixed" name="usecond" longname="Usecond" size="4" showtemplate="FieldHex"/>
					</field>
					<field type="fixed" name="properties" longname="Properties" size="4" showtemplate="fsf3"/>
				</if-true>
				<if-false>
					<block name="obj_attributes" longname="Object Attributes">
						<includeblk name="post_op_attr"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="PATHCONF3args" longname="PATHCONF3 Argument">
			<block name="object" longname="Object">
				<includeblk name="opaque"/>
			</block>
		</block>
		
		<block name="PATHCONF3res" longname="PATHCONF3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="obj_attributes" longname="Object Attributes">
						<includeblk name="post_op_attr"/>
					</block>
					<field type="fixed" name="linkmax" longname="Link Max" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="name_max" longname="Name Max" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="no_trunc" longname="No Trunc" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="chown_restricted" longname="Chown Restricted" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="case_insensitive" longname="Case Insensitive" size="4" showtemplate="FieldHex"/>
					<field type="fixed" name="case_preserving" longname="Case Preserving" size="4" showtemplate="FieldHex"/>
				</if-true>
				<if-false>
					<block name="obj_attributes" longname="Object Attributes">
						<includeblk name="post_op_attr"/>
					</block>
				</if-false>
			</if>
		</block>
		
		<block name="COMMIT3args" longname="COMMIT3 Argument">
			<block name="file" longname="File">
				<includeblk name="opaque"/>
			</block>
			<field type="fixed" name="offset" longname="Offset" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="count" longname="Count" size="2" showtemplate="FieldHex"/>
		</block>
		
		<block name="COMMIT3res" longname="COMMIT3 Results">
			<field type="fixed" name="status" longname="Status" size="4" showtemplate="nfsstat3"/>
			<if expr="buf2int(status)==0">
				<if-true>
					<block name="file_wcc" longname="File Wcc">
						<includeblk name="wcc_data"/>
					</block>
					<field type="fixed" name="writeverf" longname="Write Verifier" size="8" showtemplate="FieldDec"/>
				</if-true>
				<if-false>
					<block name="file_wcc" longname="File Wcc">
						<includeblk name="wcc_data"/>
					</block>
				</if-false>
			</if>
		</block>
		
	</format>	
	<visualization>
		<showtemplate name="nfsstat3" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x0000" show="NFS3_OK"/>
					<case value="0x0001" show="NFS3ERR_PERM"/>
					<case value="0x0002" show="NFS3ERR_NOENT"/>
					<case value="0x0005" show="NFS3ERR_IO"/>
					<case value="0x0006" show="NFS3ERR_NXIO"/>
					<case value="0x000D" show="NFS3ERR_ACCES"/>
					<case value="0x0011" show="NFS3ERR_EXIST"/>
					<case value="0x0012" show="NFS3ERR_XDEV"/>
					<case value="0x0013" show="NFS3ERR_NODEV"/>
					<case value="0x0014" show="NFS3ERR_NOTDIR"/>
					<case value="0x0015" show="NFS3ERR_ISDIR"/>
					<case value="0x0016" show="NFS3ERR_INVAL"/>
					<case value="0x001B" show="NFS3ERR_FBIG"/>
					<case value="0x001C" show="NFS3ERR_NOSPC"/>
					<case value="0x001E" show="NFS3ERR_ROFS"/>
					<case value="0x001F" show="NFS3ERR_MLINK"/>
					<case value="0x003F" show="NFS3ERR_NAMETOOLONG"/>
					<case value="0x0042" show="NFS3ERR_NOTEMPTY"/>
					<case value="0x0045" show="NFS3ERR_DQUOT"/>
					<case value="0x0046" show="NFS3ERR_STALE"/>
					<case value="0x0047" show="NFS3ERR_REMOTE"/>
					<case value="0x2711" show="NFS3ERR_BADHANDLE"/>
					<case value="0x2712" show="NFS3ERR_NOT_SYNC"/>
					<case value="0x2713" show="NFS3ERR_BAD_COOKIE"/>
					<case value="0x2714" show="NFS3ERR_NOTSUPP"/>
					<case value="0x2715" show="NFS3ERR_TOOSMALL"/>
					<case value="0x2716" show="NFS3ERR_SERVERFAULT"/>
					<case value="0x2717" show="NFS3ERR_BADTYPE"/>
					<case value="0x2718" show="NFS3ERR_JUKEBOX"/>
					<default show="unknown"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="time" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x00" show="DONT_CHANGE"/>
					<case value="0x01" show="SET_TO_SERVER_TIME"/>
					<case value="0x02" show="SET_TO_CLIENT_TIME"/>
					<default show="unknown"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="cmode" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x00" show="UNCHECKED"/>
					<case value="0x01" show="GUARDED"/>
					<case value="0x02" show="EXCLUSIVE"/>
					<default show="unknown"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="access" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x0001" show="ACCESS3_READ"/>
					<case value="0x0002" show="ACCESS3_LOOKUP"/>
					<case value="0x0004" show="ACCESS3_MODIFY"/>
					<case value="0x0008" show="ACCESS3_EXTEND"/>
					<case value="0x0010" show="ACCESS3_DELETE"/>
					<case value="0x0020" show="ACCESS3_EXECUTE"/>
					<default show="unknown"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="stable" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x00" show="UNSTABLE"/>
					<case value="0x01" show="DATA_SYNC"/>
					<case value="0x02" show="FILE_SYNC"/>
					<default show="unknown"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="ftype" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x0001" show="NF3REG"/>
					<case value="0x0002" show="NF3DIR"/>
					<case value="0x0003" show="NF3BLK"/>
					<case value="0x0004" show="NF3CHR"/>
					<case value="0x0005" show="NF3LNK"/>
					<case value="0x0006" show="NF3SOCK"/>
					<case value="0x0007" show="NF3FIFO"/>
					<default show="unknown"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="mode" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x00001000" show="Execute permission for others on a file"/>
					<case value="0x00002000" show="Write permission for others"/>
					<case value="0x00004000" show="Read permission for others"/>
					<case value="0x00008000" show="Execute permission for group on a file"/>
					<case value="0x00010000" show="Write permission for group"/>
					<case value="0x00020000" show="Read permission for group"/>
					<case value="0x00040000" show="Execute permission for owner on a file"/>
					<case value="0x00080000" show="Write permission for owner"/>
					<case value="0x00100000" show="Read permission for owner"/>
					<case value="0x00200000" show="Save swapped text (not defined in POSIX)"/>
					<case value="0x00400000" show="Set group ID on execution"/>
					<case value="0x00800000" show="Set user ID on execution"/>
					<default show="unknown"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="fsf3" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x0001" show="FSF3_LINK"/>
					<case value="0x0002" show="FSF3_SYMLINK"/>
					<case value="0x0008" show="FSF3_HOMOGENEOUS"/>
					<case value="0x0010" show="FSF3_CANSETTIME"/>
					<default show="unknown"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showsumtemplate name="nfs">
			<section name="next"/>
			<text value=" NFS"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="ismp" longname="Cabletron Interswitch Message Protocol" showsumtemplate="ismp">
	<format>
		<fields>
			<field type="fixed" name="version" longname="ISMP Version" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="message type" longname="ISMP Message Type" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="sequence number" longname="Sequence Number" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="length" longname="Code Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="code" longname="Authentication Code" expr="buf2int(length)" showtemplate="FieldBin"/>
			
			<block name="discovery protocol" longname="Enterasys Discovery Protocol">
				<field type="fixed" name="version" longname="Version" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="switchIp" longname="Switch IP Address" size="4" showtemplate="ip4addr-noplg"/>
				<field type="fixed" name="switchMac" longname="Module Mac Address" size="6" showtemplate="MACaddressEth"/>
				<field type="fixed" name="switchPort" longname="Module Port" size="4" showtemplate="FieldDec"/>
				<field type="fixed" name="chassisMac" longname="Chassis Mac Address" size="6" showtemplate="MACaddressEth"/>
				<field type="fixed" name="chassisIp" longname="Chassis IP Address" size="4" showtemplate="ip4addr-noplg"/>
				<field type="fixed" name="switchType" longname="Switch Type" size="2" showtemplate="ismp.switchtype"/>
				<field type="fixed" name="level" longname="Functional Level" size="4" showtemplate="ismp.level"/>
				
				<block name="opt" longname="Options">
					<field type="bit" name="op_flood" longname="Uplink Flood Support" mask="0x8000" size="4" showtemplate="FieldDec"/>
					<field type="bit" name="op_upport" longname="Uplink Port" mask="0x4000" size="4" showtemplate="FieldDec"/>
					<field type="bit" name="op_upcore" longname="Uplink Core" mask="0x2000" size="4" showtemplate="FieldDec"/>
					<field type="bit" name="op_upswitch" longname="Uplink Switch" mask="0x1000" size="4" showtemplate="FieldDec"/>
					<field type="bit" name="op_isolswitch" longname="Isolated Switch" mask="0x400" size="4" showtemplate="FieldDec"/>
					<field type="bit" name="op_redundaccess" longname="Redundant Access Capability Switch" mask="0x200" size="4" showtemplate="FieldDec"/>
					<field type="bit" name="op_connectcapab" longname="Message Connection Capability Switch" mask="0x100" size="4" showtemplate="FieldDec"/>
					<field type="bit" name="op_tapcapab" longname="Tap Capability Switch" mask="0x80" size="4" showtemplate="FieldDec"/>
					<field type="bit" name="op_floodcapab" longname="Tag-based Flood Capability Switch" mask="0x40" size="4" showtemplate="FieldDec"/>
					<field type="bit" name="op_unused" longname="Unused" mask="0x20" size="4" showtemplate="FieldDec"/>
					<field type="bit" name="op_resolvecapab" longname="Resolve Capability Switch" mask="0x10" size="4" showtemplate="FieldDec"/>
					<field type="bit" name="op_loopfreecapab" longname="Loop-free Flood Path Capability Switch" mask="0x08" size="4" showtemplate="FieldDec"/>
					<field type="bit" name="op_linkstatecapab" longname="Link State Capability Switch" mask="0x04" size="4" showtemplate="FieldDec"/>
					<field type="bit" name="op_vlanswitch" longname="VLAN Switch" mask="0x02" size="4" showtemplate="FieldDec"/>
					<field type="bit" name="op_unused2" longname="Unused" mask="0x01" size="4" showtemplate="FieldDec"/>
				</block>
				
				<!-- Questi campi sono presenti nella rfc 2641 ma la codifica in wireshark e' diversa -->
				<!--<field type="fixed" name="count" longname="Base Mac Count" size="2" showtemplate="FieldDec"/>
				
				<loop type="times2repeat" expr="buf2int(count)">
					<includeblk name="MacEntries"/>-->
					<!--nei pacchetti questo valore e' sempre 0, quindi non ci dovrebbero essere campi successivi, invece nei pacchetti in esame ci sono
					e quindi nella decodifica rimangono 2 byte come non decodificati-->
				<!--</loop>-->
				
				<field type="fixed" name="count1" longname="Number Of Known Neighbors" size="2" showtemplate="FieldDec"/>
				<field type="fixed" name="count2" longname="Number Of Tuples" size="2" showtemplate="FieldDec"/>
			</block>
		</fields>
		
		<block name="MacEntries" longname="Base Mac Entries">
			<field type="fixed" name="macAddr" longname="Switch Mac Address" size="6" showtemplate="MACaddressEth"/>
			<field type="fixed" name="state" longname="Assigned neighbor state" size="4" showtemplate="ismp.state"/>
		</block>
	</format>
	
	<visualization>
		<showsumtemplate name="ismp">
			<section name="next"/>
			<text value="Cabletron-PC-OV-PC-discover-(on-demand)"/>
			<section name="next"/>
			<text value="EDP Message"/>
		</showsumtemplate>

		<showtemplate name="ismp.state" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="3" show="State Of Network"/>
					<default show="Error in Assigned neighbor state lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="ismp.level" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Running version of SFVLAN prior to Version 1.8"/>
					<case value="2" show="Running version of SFVLAN 1.8 or greater"/>
					<default show="Error in Running version of SFVLAN lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="ismp.switchtype" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="2" show="SFVLAN switch"/>
					<default show="Error in Switch Type lookup"/>
				</switch>
			</showmap>
		</showtemplate>
	</visualization>
</protocol>

<!-- Service Discovery Protocol -->
<protocol name="btsdp" longname="Service Discovery Protocol">
	<format>
		<fields>
			<field type="fixed" name="sdp_pdu_id" longname="PDU ID" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="sdp_transaction_id" longname="Transaction ID" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="sdp_parameter_length" longname="Parameter Length" size="2" showtemplate="FieldDec"/>

			<switch expr="buf2int(sdp_pdu_id)">
				<case value="0" comment="Reserved">									<!-- nothing???? -->										</case>
				<case value="1" comment="SDP Error Response">						<includeblk name="sdp_error_response"/>						</case>
				<case value="2" comment="SDP Service Search Request">				<includeblk name="sdp_service_search_request"/>				</case>
				<case value="3" comment="SDP Service Search Response">				<includeblk name="sdp_searvice_search_response"/>			</case>
				<case value="4" comment="SDP Service Attribute Request">			<includeblk name="sdp_service_attribute_request"/>			</case>
				<case value="5" comment="SDP Service Attribute Response">			<includeblk name="sdp_service_attribute_response"/>			</case>
				<case value="6" comment="SDP Service Search Attribute Request">		<includeblk name="sdp_service_search_attribute_request"/>	</case>
				<case value="7" comment="SDP Service Search Attribute Response">	<includeblk name="sdp_service_search_attribute_response"/>	</case>
				<default comment="Reserved">										<!-- What is this??? <includeblk name=""/>	-->				</default>
			</switch>
		</fields>


		<block name="sdp_error_response" longname="SDP Error Response">
			<field type="fixed" name="error_code" longname="Error Code" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="error_info" longname="Error Info" expr="buf2int(sdp_parameter_length) - 2" showtemplate="Field1BytesHex"/>
		</block>

		<block name="sdp_service_search_request" longname="SDP Service Search Request">
			<!-- Service Search Pattern var -->
			<!-- Maximum Service Record Count (2 B) -->
			<!-- Continuation State 1-17 B -->
			<field type="variable" name="search_req_params" longname="Parameters" expr="buf2int(sdp_parameter_length)" showtemplate="Field1BytesHex"/>
		</block>

		<block name="sdp_searvice_search_response" longname="SDP Service Search Response ">
			<field type="fixed" name="total_service_record_count" longname="Total Service Record Count" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="current_service_record_count" longname="Current Service Record Count" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="service_record_handle_list" longname="Service Record Handle List" expr="buf2int(current_service_record_count) * 4" showtemplate="Field4BytesHex"/>
			<field type="variable" name="continuation_state" longname="Continuation State" expr="buf2int(sdp_parameter_length) - 4 + (buf2int(current_service_record_count) * 4)" showtemplate="Field1BytesHex"/>
		</block>

		<block name="sdp_service_attribute_request" longname="SDP Service Attribute Request">
			<field type="fixed" name="service_record_handle" longname="Service Record Handle" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="maximum_attribute_count" longname="Maximum Attribute Count" size="2" showtemplate="FieldDec"/>

			<!-- Attribute ID List -->
			<!-- Continuation List -->
			<field type="variable" name="AttributeId_Continuation_Lists" longname="Attribute Id list and Continuation List" expr="buf2int(sdp_parameter_length) - 6" showtemplate="Field1BytesHex"/>	
		</block>

		<block name="sdp_service_attribute_response" longname="SDP Service Attribute Responce">
			<field type="fixed" name="attribute_list_byte_count" longname="Attribute List Byte Count" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="attribute_lists" longname="Attribute list" expr="buf2int(attribute_list_byte_count)" showtemplate="Field1BytesHex"/>
			<field type="variable" name="continuation_state" longname="Continuation State" expr="buf2int(sdp_parameter_length) - (buf2int(attribute_list_byte_count) + 2)" showtemplate="Field1BytesHex"/>
		</block>

		<block name="sdp_service_search_attribute_request" longname="SDP Service Serach Attribute Request">
			<!-- Service Search Pattern var -->
			<!-- Maximum Attribute Byte Count -->
			<!-- Attribute ID List -->
			<!-- Continuation State -->
			<field type="variable" name="parameters" longname="Parameters" expr="buf2int(sdp_parameter_length)" showtemplate="Field1BytesHex"/>
		</block>

		<block name="sdp_service_search_attribute_response" longname="SDP Service Search Attribute Response">
			<field type="fixed" name="attribute_list_byte_count" longname="Attribute List Byte Count" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="attribute_lists" longname="Attribute list" expr="buf2int(attribute_list_byte_count)" showtemplate="Field1BytesHex"/>
			<field type="variable" name="continuation_state" longname="Continuation State" expr="buf2int(sdp_parameter_length) - (buf2int(attribute_list_byte_count) + 2)" showtemplate="Field1BytesHex"/>
		</block>

		<!-- What is this block?? -->
		<block name="sdp_" longname="SDP ">
		</block>
	</format>

</protocol>


<!--
FULVIO: Here there are some showmap which are not used in the bluetooth dissector.
Could you please check if these are going to be used somewhere?
-->

<!--
	<showdtl name="assignTest">
		<text value="SHDTL:"/>
	</showdtl>

	<showmap name="hci_pagescan_reposition_mode_map">
		<switch expr="buf2int(this)">
			<case value="0" show="R0"/>
			<case value="1" show="R1"/>
			<case value="2" show="R2"/>
			<default show="Reserved"/>
		</switch>
	</showmap>

	<showmap name="hci_service_type_map">
		<switch expr="buf2int(this)">
			<case value="0" show="No Traffic"/>
			<case value="1" show="Best effort"/>
			<case value="2" show="Guaranteed"/>
			<default show="Reserved"/>
		</switch>
	</showmap>

	<showmap name="hci_current_role_map">
		<switch expr="buf2int(this)">
			<case value="0" show="Master for this Connection Handle"/>
			<case value="1" show="Slave for this Connection Handle"/>
			<default show="Invalid Code"/>
		</switch>
	</showmap>

	<showmap name="hci_role_map">
		<switch expr="buf2int(this)">
			<case value="0" show="Change own Role to Master for this BD_ADDR"/>
			<case value="1" show="Change own Role to Slave for this BD_ADDR"/>
			<default show="Invalid Code"/>
		</switch>
	</showmap>

	<showmap name="hci_linkpolicy_settings_map">
		<switch expr="buf2int(this)">
			<case value="0" show="Disable All LM Modes"/>
			<case value="1" show="Enable Master Slave Switch"/>
			<case value="2" show="Enable Hold Mode"/>
			<case value="4" show="Enable Sniff Mode"/>
			<case value="8" show="Enable Park Mode"/>
			<default show="Reserved"/>
		</switch>
	</showmap>

	<showmap name="hci_event_mask_map">
		<switch expr="buf2int(this)">
			<case value="0" show="No Events specified"/>
			<case value="1" show="Inquiry Complete Event"/>
			<default show=" "/>
8888888888888888888888888888888888888888888888888888888
Complete it later
8888888888888888888888888888888888888888888888888888888
		</switch>
	</showmap>

	<showmap name="hci_filter_type_map">
		<switch expr="buf2int(this)">
			<case value="0" show="Clear All Filters"/>
			<case value="1" show="Inquiry Result"/>
			<case value="2" show="Connection Setup"/>
			<default show="Reserved"/>
		</switch>
	</showmap>

	<showmap name="hci_connection_setup_filtercondition_type_map">
		<switch expr="buf2int(this)">
			<case value="0" show="Allow Connections From All Devices"/>
			<case value="1" show="Allow Connections From a device with a Specific Class of Device"/>
			<case value="2" show="Allow Connections From a device with a Specific BD_ADDR"/>
	 		<default show="Reserved"/>
		</switch>
	</showmap>

	<showmap name="hci_pin_type_map">
		<switch expr="buf2int(this)">
			<case value="0" show="Variable PIN"/>
			<case value="1" show="Fixed PIN"/>
			<default show="Reserved"/>
		</switch>
	</showmap>

	<showmap name="hci_read_all_flag_map">
		<switch expr="buf2int(this)">
			<case value="0" show="Return Link Key for specified BD_ADDR"/>
			<case value="1" show="Return all stored Link Keys"/>
			<default show="Reserved"/>
		</switch>
	</showmap>

	<showmap name="hci_delete_all_flag_map">
		<switch expr="buf2int(this)">
			<case value="0" show="Delete only the Link Key for specified BD_ADDR"/>
			<case value="1" show="Delete all stored Link Keys"/>
			<default show="Reserved"/>
		</switch>
	</showmap>

	<showmap name="hci_sacn_enable_map">
		<switch expr="buf2int(this)">
			<case value="0" show="No Scans Enabled"/>
			<case value="1" show="Inquiry Scan Enabled.Page Scan Disabled"/>
			<case value="2" show="Inquiry Scan Disabled.Page Scan Enabled"/>
			<case value="3" show="Inquiry Scan Enabled.Page Scan Enabled"/>
			<default show="Reserved"/>
		</switch>
	</showmap>

	<showmap name="hci_encryption_mode_map">
		<switch expr="buf2int(this)">
			<case value="0" show="Encryption Disabled"/>
			<case value="1" show="Encryption only for Ponit to Point Packets"/>
			<case value="2" show="Encryption for both Point to Point and Broadcast Packets"/>
			<default show="Reserved"/>
		</switch>
	</showmap>

	<showmap name="hci_holdmode_activity_map">
		<switch expr="buf2int(this)">
			<case value="0" show="Maintain current Power State"/>
			<case value="1" show="Suspend Page Scan"/>
			<case value="2" show="Suspend Inquiry Scan"/>
			<case value="4" show="Suspend Periodic Inquiries"/>
			<default show="Reserved"/>
		</switch>
	</showmap>

	<showmap name="hci_read_transmit_powerlevel_type_map">
		<switch expr="buf2int(this)">
			<case value="0" show="Read Current Transmit Power Level"/>
			<case value="1" show="Read maximum Transmit Power Level"/>
			<default show="Reserved"/>
		</switch>
	</showmap>

	<showmap name="hci_read_sco_flowcontrol_enable_map">
		<switch expr="buf2int(this)">
			<case value="0" show="SCO Flow Control is Disabled"/>
			<case value="1" show="SCO Flow Control is Enabled"/>
			<default show="Invalid Code"/>
		</switch>
	</showmap>

-->
<protocol name="cdp" longname="CDP (Cisco Discovery Protocol)" showsumtemplate="cdp">
	<format>
		<fields>
			<field type="fixed" name="ver" longname="Version" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="ttl" longname="Time To Live" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>

			<block name="CDPOpt" longname="CDP Options">
				<loop type="while" expr="1">
					<!-- Loop until we find a 'break' -->
					
					<switch expr="buf2int($packet[$currentoffset:2])">
						<case value="1"> <includeblk name="deviceid"/> </case>
						<case value="2"> <includeblk name="addr"/> </case>
						<case value="3"> <includeblk name="portid"/> </case>
						<case value="4"> <includeblk name="capab"/>	</case>
						<case value="5"> <includeblk name="vers"/> </case>
						<case value="6"> <includeblk name="platf"/> </case>
						<case value="7"> <includeblk name="prefix"/> </case>
						<case value="9"> <includeblk name="vtpdomain"/> </case>
						<case value="10"> <includeblk name="nativevlan"/> </case>
						<case value="11"> <includeblk name="duplex"/> </case>
						<case value="14"> <includeblk name="applianceid"/> </case>
						<case value="16"> <includeblk name="power"/> </case>
						<default> <loopctrl type="break"/> </default>
					</switch>
				</loop>
			</block>
		</fields>

		<block name="deviceid" longname="Device ID">
			<field type="fixed" name="type" longname="Type" size="2" showtemplate="cdp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="deviceID" longname="Device ID" expr="buf2int(length) - 4" showtemplate="FieldAscii"/>
		</block>
					
		<block name="addr" longname="Address">
			<field type="fixed" name="type" longname="Type" size="2" showtemplate="cdp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="number_of_address" longname="Number Of Addresses" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="protocol_type" longname="Protocol Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="protocol_length" longname="Protocol Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="protocol_id" longname="Protocol ID" expr="buf2int(protocol_length)" showtemplate="Field4BytesHex"/>
			<field type="fixed" name="address_length" longname="Address Length" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="address" longname="Address" expr="buf2int(address_length)" showtemplate="Field4BytesHex"/>
		</block>

		<block name="portid" longname="Port ID">
			<field type="fixed" name="type" longname="Type" size="2" showtemplate="cdp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="portID" longname="Port ID" expr="buf2int(length) - 4" showtemplate="FieldAscii"/>
		</block>

		<block name="capab" longname="Capabilities">
			<field type="fixed" name="type" longname="Type" size="2" showtemplate="cdp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="capabilities" longname="Capabilities" expr="buf2int(length) - 4" showtemplate="Field4BytesHex"/>
		</block>

		<block name="vers" longname="Version">
			<field type="fixed" name="type" longname="Type" size="2" showtemplate="cdp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="version" longname="Version" expr="buf2int(length) - 4" showtemplate="FieldAscii"/>
		</block>

		<block name="platf" longname="Platform">
			<field type="fixed" name="type" longname="Type" size="2" showtemplate="cdp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="platform" longname="Platform" expr="buf2int(length) - 4" showtemplate="FieldAscii"/>
		</block>

		<block name="prefix" longname="Network Prefix">
			<field type="fixed" name="type" longname="Type" size="2" showtemplate="cdp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>

			<if expr="(buf2int(length) - 4 - 1) == 4">
				<if-true>
						<field type="fixed" name="prefix" longname="IP Prefix" size="4" showtemplate="ip4addr-noplg"/>
				</if-true>
				<if-false>
					<field type="variable" name="prefix" longname="IP Prefix" expr="buf2int(length) - 4 - 1" showtemplate="Field4BytesHex"/>
				</if-false>
			</if>
			<field type="fixed" name="prefixlen" longname="Prefix Length" size="1" showtemplate="FieldDec"/>
		</block>

		<block name="vtpdomain" longname="VTP Domain">
			<field type="fixed" name="type" longname="Type" size="2" showtemplate="cdp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="vtpdomain" longname="VTP Domain" expr="buf2int(length) - 4" showtemplate="Field4BytesHex"/>
		</block>

		<block name="nativevlan" longname="Native VLAN">
			<field type="fixed" name="type" longname="Type" size="2" showtemplate="cdp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="vlan" longname="VLAN" expr="buf2int(length) - 4" showtemplate="Field4BytesHex"/>
		</block>

		<block name="duplex" longname="Duplex mode">
			<field type="fixed" name="type" longname="Type" size="2" showtemplate="cdp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
<!-- Duplex Mode: 0 = Half (but I don't know which is Full Duplex) -->
			<field type="variable" name="duplexmode" longname="Duplex Mode" expr="buf2int(length) - 4" showtemplate="FieldHex"/>
		</block>

		<block name="applianceid" longname="Appliance ID" description="Allows the VoIP traffic to be differentiated from other traffic, as by separate VLAN-id (auxiliary VLAN)">
			<field type="fixed" name="type" longname="Type" size="2" showtemplate="cdp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="id" longname="Appliance ID" expr="buf2int(length) - 4" showtemplate="Field4BytesHex"/>
		</block>

		<block name="power" longname="Power Consumption" description="Allows the VoIP traffic to be differentiated from other traffic, as by separate VLAN-id (auxiliary VLAN)">
			<field type="fixed" name="type" longname="Type" size="2" showtemplate="cdp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="power" longname="Power Consumption (mW)" expr="buf2int(length) - 4" showtemplate="FieldDec"/>
		</block>

	</format>

	<visualization>
		<showtemplate name="cdp.type" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Device ID"/> 
					<case value="2" show="Address"/> 
					<case value="3" show="Port ID"/>
					<case value="4" show="Capabilities"/>
					<case value="5" show="Software version"/>
					<case value="6" show="Platform"/>
					<case value="7" show="Network Prefix"/>
					<case value="9" show="VTP Domain"/>
					<case value="10" show="Native VLAN"/>
					<case value="11" show="Duplex Mode"/>
					<case value="14" show="Appliance ID"/>
					<case value="16" show="Power Consumption"/>
					<default show="Error in CDP commands code lookup"/> 
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="cdp">
			<section name="next"/>
			<text value="CDP v. "/>
			<protofield name="ver" showdata="showvalue"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="hsrp" longname="Cisco Hot Standby Router Protocol (HSRP)" showsumtemplate="hsrp">
	<execute-code>
		<verify>
			<if expr="$ipdst == '\xE0\x00\x00\x02'and buf2int(dport) == 1985">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>				
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#hsrp"/>
			</update-lookuptable>	

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#hsrp"/>
			</update-lookuptable>

		</before>			
	</execute-code>

	<format>
		<fields>
			<field type="fixed" name="ver" longname="Version" comment="The only version supported is 0" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="opcode" longname="Operation Code" size="1" showtemplate="hsrp.opcode"/>
			<field type="fixed" name="state" longname="State" size="1" showtemplate="hsrp.state"/>
			<field type="fixed" name="helloTime" longname="Hello Time (sec)" description="Seconds between two Hello messages (Used only in Hello messages)" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="holdTime" longname="Hold Time (sec)" description="Time that the current Hello message should be considered valid (used only in Hello messages)" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="priority" longname="Priority" description="Higher value equal higher priority" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="group" longname="Group" description="For Token Ring, values between 0 and 2 inclusive are valid. For other media values between 0 and 255 inclusive are valid." size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="reserv" longname="Reserved" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="authData" longname="Authentification Data" size="8" showtemplate="FieldAscii"/>
			<field type="fixed" name="vipAddr" longname="Virtual IP Address" size="4" showtemplate="ip4addr-noplg"/>
		</fields>
	</format>

	<visualization>
		<showtemplate name="hsrp.opcode" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Hello Message: router is running and is capable of becoming the active or standby router"/> 
					<case value="1" show="Coup Message: router wishes to become the active router"/> 
					<case value="2" show="Resign Message: router no longer wishes to be the active router"/>
					<case value="3" show="Advertise Message: initial message sent by the router, but not documented in RFC"/>
					<default show="Error in HSRP code lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="hsrp.state" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Init: HSRP is not running, bootstrap or configuration change"/> 
					<case value="1" show="Learn: HSRP is running but the router does not know the virtual IP Address"/> 
					<case value="2" show="Listen: the router knows the virtual IP address, but is neither the active router nor the standby router"/>
					<case value="4" show="Speak: the router is participating in the election of the active and/or standby router"/>
					<case value="8" show="Standby: the router is the Standby router"/>
					<case value="16" show="Active: the router is the Active router"/>
					<default show="Error in HSRP State code lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="hsrp">
			<section name="next"/>
			<text value="HSRP "/>

			<if expr="buf2int(opcode) == 0"> <if-true> <text value="Hello"/> </if-true> </if>
			<if expr="buf2int(opcode) == 1"> <if-true> <text value="Coup"/> </if-true> </if>
			<if expr="buf2int(opcode) == 2"> <if-true> <text value="Resign"/> </if-true> </if>
			<if expr="buf2int(opcode) == 3"> <if-true> <text value="Advertise"/> </if-true> </if>

			<text value=": State "/>

			<if expr="buf2int(state) == 0"> <if-true> <text value="Init"/> </if-true> </if>
			<if expr="buf2int(state) == 1"> <if-true> <text value="Learn"/> </if-true> </if>
			<if expr="buf2int(state) == 2"> <if-true> <text value="Listen"/> </if-true> </if>
			<if expr="buf2int(state) == 4"> <if-true> <text value="Speak"/> </if-true> </if>
			<if expr="buf2int(state) == 8"> <if-true> <text value="Standby"/> </if-true> </if>
			<if expr="buf2int(state) == 16"> <if-true> <text value="Active"/> </if-true> </if>

			<text value=", Priority "/>
			<protofield name="priority" showdata="showvalue"/>
			<text value=", Group "/>
			<protofield name="group" showdata="showvalue"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="vrrp" longname="Virtual Router Redundancy Protocol (VRRP)" showsumtemplate="vrrp">
	<!-- We should check that 'version' is equal to '2' Type is 'ADVERTISEMENT' (1), IP destination is 224.0.0.18 -->
	<!-- (multicast address by IANA) and TTL is 255 -->

	<format>
		<fields>
			<block name="versionType" longname="Version and Type">
				<field type="bit" name="version" longname="Version" comment="The only version supported is 2" mask="0xF0" size="1" showtemplate="FieldDec"/>
				<field type="bit" name="type" longname="Type of message" comment="For this version the only type defined is ADVERTISEMENT (value = 1)" mask="0x0F" size="1" showtemplate="FieldHex"/>
			</block>

			<field type="fixed" name="VRID" longname="Virtual Router ID" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="priority" longname="Priority" comment="Higher value equal higher priority" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="ipAddrCnt" longname="Count IP Addresses" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="authType" longname="Authentification Type" size="1" showtemplate="vrrp.authtype"/>
			<field type="fixed" name="adverInt" longname="Advertisement Interval" comment="This field is used for troubleshooting misconfigured routers" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="checksum" longname="Checksum" description="16-bit one's complement of the one's complement sum of the entire VRRP message starting with the version field" size="2" showtemplate="FieldHex"/>

			<!-- These fields are used for troubleshooting misconfigured routers -->
			<block name="ipAddresses" longname="IP Addresses">
				<loop type="times2repeat" expr="buf2int(ipAddrCnt)">
					<field type="fixed" name="ipAddress" longname="IP Address" size="4" showtemplate="ip4addr-noplg"/> 
				</loop>
			</block>

			<field type="fixed" name="authData" longname="Authentification Data" size="8" showtemplate="FieldAscii"/>
		</fields>
	</format>


	<visualization>
		<showtemplate name="vrrp.authtype" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="No Authentication: AuthData SHOULD be zero filled"/> 
					<case value="1" show="Simple Text Password: AuthData contain clear text password (this one in the end MUST be zero filled)"/> 
					<case value="2" show="IP Authentication Header: The packet is authenticated with HMAC-MD5-96, AuthData SHOULD be zero filled"/>
					<default show="Error in VRRP Authentication Type lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="vrrp">
			<section name="next"/>
			<text value="VRRP: Virtual Router ID "/>
			<protofield name="VRID" showdata="showvalue"/>
		</showsumtemplate>
	</visualization>

</protocol>
<protocol name="ccp" longname="CCP (Compression Control Protocol)" showsumtemplate="ccp">
	<format>
		<fields>
			<field type="fixed" name="code" longname="Code" size="1" showtemplate="ccp.code"/>
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="len" longname="Length" size="2" showtemplate="FieldDec"/>
			<loop type="size" expr="buf2int(len)-4">
				<field type="fixed" name="opt_type" longname="Option type" size="1" showtemplate="lcp.opt.type"/>
				<field type="fixed" name="opt_len" longname="Option length" size="1" showtemplate="FieldDec"/>
				<field type="variable" name="opt_data" longname="Option data" expr="buf2int(opt_len)-2" showtemplate="FieldHexBin"/>								
			</loop>
		</fields>
	</format>
	<visualization>
		<showsumtemplate name="ccp">
			<text value=" - CCP"/>
		</showsumtemplate>
		<showtemplate name="ccp.code" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Vendor Specific"/> 
					<case value="1" show="Configure-Request"/> 
					<case value="2" show="Configure-Ack"/> 
					<case value="3" show="Configure-Nak"/> 
					<case value="4" show="Configure-Reject"/> 
					<case value="5" show="Terminate-Request"/> 
					<case value="6" show="Terminate-Ack"/>
					<case value="7" show="Code-Reject"/>
					<case value="14" show="Reset-Request"/>
					<case value="15" show="Reset-Reply"/>
					<default show="Error in code lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
				<showtemplate name="ccp.opt.type" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<!--for more info see http://www.networksorcery.com/enp/protocol/LCP.htm-->
					<case value="0" show="OUI"/> 
					<case value="1" show="Predictor Type 1"/> 
					<case value="2" show="Predictor Type 1"/> 
					<case value="3" show="Puddle Jumper"/> 					
					<case value="16" show="Hewlett-Packard PPC"/> 					
					<case value="17" show="PPP Stac LZS Compression Protocol"/>
					<case value="18" show="MS Compression Protocol/Encryption Protocol"/>
					<case value="19" show="Gandalf FZA Compression Protocol"/>
					<case value="20" show="V.42bis compression"/>
					<case value="21" show="BSD Compression Protocol"/>
					<case value="23" show="LZS-DCP Compression Protocol"/>					
					<case value="24" show="Magnalink Variable Resource Compression Algorithm"/>
					<case value="25" show="PPP for Data Compression in Data Circuit-Terminating Equipment"/>
					<case value="26" show="Deflate Protocol"/>
					<case value="27" show="V.44/LZJH Compression Protocol"/>
					<default show="Error option code lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
	</visualization>
</protocol>
<protocol name="chap" longname="CHAP (Challenge Handshake Authentication Protocol)" showsumtemplate="chap">
	<format>
		<fields>
			<field type="fixed" name="code" longname="Code" size="1" showtemplate="chap.code"/>
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="len" longname="Length" size="2" showtemplate="FieldDec"/>
			<if expr="buf2int(code)==1 or buf2int(code)==2">
			<if-true>
				<field type="fixed" name="val_size" longname="Value size" size="1" showtemplate="FieldDec"/>
				<field type="variable" name="value" longname="Value" expr="buf2int(val_size)" showtemplate="FieldHex"/>
				<field type="variable" name="name" longname="Name" expr="buf2int(len) -buf2int(val_size) -5" showtemplate="FieldAscii"/>
			</if-true>
			<if-false>
				<field type="variable" name="msg" longname="Message" expr="buf2int(len) -4" showtemplate="FieldAscii"/>
			</if-false>			
			</if>			
		</fields>
	</format>
	<visualization>
		<showsumtemplate name="chap">
			<text value=" - CHAP"/>
		</showsumtemplate>
		<showtemplate name="chap.code" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Challenge"/> 
					<case value="2" show="Response"/> 
					<case value="3" show="Success"/> 
					<case value="4" show="Failure"/> 
					<default show="Error in code lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
	</visualization>
</protocol>
<protocol name="gre" longname="GRE (Generic Router Encapsulation)" showsumtemplate="gre">
	<format>
		<fields>
			<switch expr="buf2int($packet[$currentoffset:2]) bitwand 0x0007">
				<case value="0">
					<field type="fixed" name="flag" longname="Flags" size="2" showtemplate="FieldHex">
						<field type="bit" name="cflag" longname="Checksum present" mask="0x8000" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="rflag" longname="Routing present" mask="0x4000" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="kflag" longname="Key present" mask="0x2000" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="snflag" longname="Sequence Number present" mask="0x1000" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="srflag" longname="Strict Source Route" mask="0x0800" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="recurflag" longname="Recursion Control" mask="0x0700" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="reserved" longname="Reserved" mask="0x00F8" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="vflag" longname="Version" mask="0x0007" size="2" showtemplate="FieldBin"/>
					</field>

					<field type="fixed" name="protocol" longname="Protocol type" size="2" showtemplate="FieldHex"/>

					<if expr="buf2int(cflag) or buf2int(rflag)">
						<if-true>
							<field type="fixed" name="checksum" longname="Checksum" size="2" showtemplate="FieldHex"/>
							<field type="fixed" name="roffset" longname="Routing Offset" size="2" showtemplate="FieldDec"/>
						</if-true>
					</if>

					<!-- These fields have been deprecated in the new GRE RFC (post RFC 1701) -->
					<if expr="buf2int(kflag)">
						<if-true>
							<field type="fixed" name="key" longname="Key" size="4" showtemplate="FieldHex"/>
						</if-true>
					</if>
					<if expr="buf2int(snflag)">
						<if-true>
							<field type="fixed" name="seq" longname="Sequence Number" size="4" showtemplate="FieldHex"/>
						</if-true>
					</if>

					<if expr="buf2int(rflag)">
						<if-true>
							<loop type="do-while" expr="buf2int(sre_afamily) or buf2int(sre_length)">								
								<block name="sre" longname="Source Routing Entry">
									<field type="fixed" name="sre_afamily" longname="SRE Address Family" size="2" showtemplate="FieldHex"/>
									<field type="fixed" name="sre_offset" longname="SRE Offset" size="1" showtemplate="FieldDec"/>
									<field type="fixed" name="sre_length" longname="SRE Length" size="1" showtemplate="FieldDec"/>
									<field type="variable" name="sre_route" longname="SRE Routing Information" expr="buf2int(sre_length)" showtemplate="FieldHex"/>
								</block>
							</loop>
						</if-true>
					</if>
				</case>

				<case value="1">
					<field type="fixed" name="flag" longname="Flags" size="2" showtemplate="FieldHex">
						<field type="bit" name="cflag" longname="Checksum present" mask="0x8000" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="rflag" longname="Routing present" mask="0x4000" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="kflag" longname="Key present" mask="0x2000" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="snflag" longname="Sequence Number present" mask="0x1000" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="srflag" longname="Strict Source Route" mask="0x0800" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="recurflag" longname="Recursion Control" mask="0x0700" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="aflag" longname="Acknowledgement present" mask="0x0080" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="reserved" longname="Reserved" mask="0x00780" size="2" showtemplate="FieldBin"/>
						<field type="bit" name="vflag" longname="Version" mask="0x0007" size="2" showtemplate="FieldBin"/>
					</field>
					<field type="fixed" name="protocol" longname="Protocol type" size="2" showtemplate="FieldHex"/>
					<field type="fixed" name="plen" longname="Payload length" size="2" showtemplate="FieldDec"/>
					<field type="fixed" name="callid" longname="Call ID" size="2" showtemplate="FieldDec"/>
					<if expr="buf2int(snflag)">
						<if-true>
							<field type="fixed" name="seq" longname="Sequence Number" size="4" showtemplate="FieldHex"/>
						</if-true>
					</if>
					<if expr="buf2int(aflag)">
						<if-true>
							<field type="fixed" name="ack" longname="Acnowledgement Number" size="4" showtemplate="FieldHex"/>
						</if-true>
					</if>
				</case>
			</switch>
		</fields>
	</format>

	<encapsulation>
		<if expr="buf2int(vflag) == 1">
			<if-true>
				<switch expr="buf2int(protocol)">
					<case value="0x880B"> <nextproto proto="#ppp"/> </case>
				</switch>
			</if-true>			
		</if>	
		<if expr="buf2int(vflag) == 0">
			<if-true>
				<switch expr="buf2int(protocol)">
					<!--more protocols are defined in RFC1701, but they seems to be fairly uncommon-->
					<case value="0x0800"> <nextproto proto="#ip"/> </case>
					<case value="0x0806"> <nextproto proto="#arp"/> </case>					
					<case value="0x880B"> <nextproto proto="#ppp"/> </case>
				</switch>
			</if-true>			
		</if>		

	</encapsulation>

	<visualization>
		<showsumtemplate name="gre">
			<text value=" - GRE"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="ipcp" longname="IPCP (PPP Internet Protocol Control Protocol)" showsumtemplate="ipcp">
	<format>
		<fields>
			<field type="fixed" name="code" longname="Code" size="1" showtemplate="ipcp.code"/>
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="len" longname="Length" size="2" showtemplate="FieldDec"/>
			<loop type="size" expr="buf2int(len)-4">
				<!-- Here a switch could be better in order to provide
				a better decription of each option-->
				<field type="fixed" name="opt_type" longname="Option type" size="1" showtemplate="ipcp.opt.type"/>
				<field type="fixed" name="opt_len" longname="Option length" size="1" showtemplate="FieldDec"/>
				<if expr="buf2int(opt_type) != 2">
					<if-true>
						<field type="variable" name="opt_data" longname="Option data" expr="buf2int(opt_len)-2" showtemplate="ip4addr-noplg"/>
					</if-true>
					<if-false>
						<field type="variable" name="opt_data" longname="Option data" expr="buf2int(opt_len)-2" showtemplate="FieldHex"/>
					</if-false>
				</if>
				
			</loop>
		</fields>
	</format>
	<visualization>
		<showsumtemplate name="ipcp">
			<text value=" - IPCP"/>
		</showsumtemplate>
		<showtemplate name="ipcp.code" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Vendor-Specific"/> 
					<case value="1" show="Configure-Request"/> 
					<case value="2" show="Configure-Ack"/> 
					<case value="3" show="Configure-Nak"/> 
					<case value="4" show="Configure-Reject"/> 
					<case value="5" show="Terminate-Request"/> 
					<case value="6" show="Terminate-Ack"/>
					<case value="7" show="Code-Reject"/>
					<default show="Error in code lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
		<showtemplate name="ipcp.opt.type" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<!--for more info see http://www.networksorcery.com/enp/protocol/LCP.htm-->
					<case value="1" show="IP Address (Deprecated)"/> 
					<case value="2" show="IP Compression Protocol"/> 
					<case value="3" show="IP Address"/> 
					<case value="4" show="Mobile IPv4"/> 					
					<case value="129" show="Primary DNS Server Address"/> 
					<case value="130" show="Primary NBNS Server Address"/>
					<case value="131" show="Secondary DNS Server Address"/>
					<case value="132" show="Secondary NBNS Server Address"/>
					<default show="Error option code lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
	</visualization>
</protocol>
<protocol name="lcp" longname="LCP (Link Control Protocol)" showsumtemplate="lcp">
	<format>
		<fields>
			<field type="fixed" name="code" longname="Code" size="1" showtemplate="lcp.code"/>
			<field type="fixed" name="identifier" longname="Identifier" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="len" longname="Length" size="2" showtemplate="FieldDec"/>
			<if expr="buf2int(code) == 8">
				<if-true>
					<field type="fixed" name="rejpro" longname="Rejected Protocol" size="2" showtemplate="FieldHex"/>
				</if-true>
			</if>
			<if expr="buf2int(code) == 9 or buf2int(code) == 10 or buf2int(code) == 11 or buf2int(code) == 12">
				<if-true>
					<field type="fixed" name="magic" longname="Magic Number" size="4" showtemplate="FieldDec"/>
				</if-true>
			</if>
			<loop type="size" expr="buf2int(len)-4">
				<!-- Here a switch could be better in order to provide
				a better decription of each option-->
				<field type="fixed" name="opt_type" longname="Option type" size="1" showtemplate="lcp.opt.type"/>
				<field type="fixed" name="opt_len" longname="Option length" size="1" showtemplate="FieldDec"/>
				<field type="variable" name="opt_data" longname="Option data" expr="buf2int(opt_len)-2" showtemplate="FieldHexBin"/>								
			</loop>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="lcp">
			<text value=" - LCP"/>
		</showsumtemplate>

		<showtemplate name="lcp.code" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Configure-Request"/> 
					<case value="2" show="Configure-Ack"/> 
					<case value="3" show="Configure-Nak"/> 
					<case value="4" show="Configure-Reject"/> 
					<case value="5" show="Terminate-Request"/> 
					<case value="6" show="Terminate-Ack"/>
					<case value="7" show="Code-Reject"/>
					<case value="8" show="Protocol-Reject"/>
					<case value="9" show="Echo-Request"/>
					<case value="10" show="Echo-Reply"/>
					<case value="11" show="Discard-Request"/>
					<case value="12" show="Link-Quality Report"/>
					<default show="Error in code lookup"/> 
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="lcp.opt.type" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<!--for more info see http://www.networksorcery.com/enp/protocol/LCP.htm-->
					<case value="0" show="Vendor Specific"/> 
					<case value="1" show="Maximum-Receive-Unit"/> 
					<case value="3" show="Authentication-Protocol"/> 
					<case value="4" show="Quality-Protocol"/> 					
					<case value="5" show="Magic-Number"/> 
					<case value="7" show="Protocol-Field-Compression (Deprecated)"/>
					<case value="8" show="Address-and-Control-Field-Compression"/>
					<case value="9" show="FCS-Alternatives"/>
					<case value="10" show="Self-Describing-Pad"/>
					<case value="11" show="Numbered-Mode"/>
					<case value="12" show="Identification"/>
					<case value="13" show="Callback"/>
					<case value="14" show="Connect-Time (Deprecated)"/>
					<case value="15" show="Compound-Frames (Deprecated)"/>
					<case value="16" show="Nominal-Data-Encapsulation (Deprecated)"/>
					<case value="17" show="Multilink Max-Receive-Reconstructed-Unit (MRRU)"/>
					<case value="18" show="Multilink Short Sequence Number Header Format"/>
					<case value="19" show="Multilink Endpoint Discriminator"/>
					<case value="20" show="Proprietary"/>
					<case value="21" show="DCE-Identifier"/>
					<case value="22" show="MP+ Procedure Option"/>
					<case value="23" show="Link Discriminator for BACP."/>
					<case value="24" show="LCP-Authentication-Option"/>
					<case value="25" show="COBS (Consistent Overhead Byte Stuffing)"/>					
					<case value="26" show="Prefix Elision"/>
					<case value="27" show="Multilink header format"/>
					<case value="28" show="Internationalization"/>
					<case value="29" show="Simple Data Link on SONET/SDH"/>					
					<default show="Error option code lookup"/> 
				</switch>
			</showmap>
		</showtemplate>
	</visualization>
</protocol>
<protocol name="ppp" longname="PPP (Point-To-Point Protocol)" showsumtemplate="ppp">
	<format>
		<fields>
			<field type="fixed" name="flag" longname="Flag" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="control" longname="Control" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="protocol" longname="Protocol" size="2" showtemplate="FieldHex"/>
			<if expr="buf2int(protocol) == 0x00FD">
				<if-true>
					<field type="variable" name="cpayload" longname="PPP Compressed payload" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
				</if-true>
			</if>
		</fields>
	</format>

	<encapsulation>
		<switch expr="buf2int(protocol)">
			<case value="0x0021"> <nextproto proto="#ip"/> </case>
			<case value="0xc021"> <nextproto proto="#lcp"/> </case>
			<case value="0xc223"> <nextproto proto="#chap"/> </case>
			<case value="0x8021"> <nextproto proto="#ipcp"/> </case>
			<case value="0x80FD"> <nextproto proto="#ccp"/> </case>
		</switch>
	</encapsulation>

	<visualization>
		<showsumtemplate name="ppp">
			<text value=" - PPP"/>
		</showsumtemplate>
	</visualization>

</protocol>
<protocol name="pptp" longname="PPTP (Point-to-Point Tunnelling Protocol)" showsumtemplate="pptp">
	<execute-code>
		<verify>
			<if expr="buf2int($packet[$currentoffset+4:4]) == 0x1A2B3C4D">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>
	</execute-code>

	<format>
		<fields>
			<field type="fixed" name="len" longname="Lenght" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="msgtype" longname="Message Type" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="magiccookie" longname="Magic Cookie" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="ctrlmsgtype" longname="Control Message Type" size="2"  showtemplate="pptp.ctrlmsgtype"/>
			<field type="fixed" name="res0" longname="Reserved 0" size ="2" showtemplate="FieldHex"/>

			<switch expr="buf2int(ctrlmsgtype)">
				<case value="1"> <includeblk name="Start_CC_Req"/></case>
				<case value="2"> <includeblk name="Start_CC_Rep"/></case>
				<case value="3"> <includeblk name="Stop_CC_Req"/></case>
				<case value="4"> <includeblk name="Stop_CC_Rep"/></case>
				<case value="5"> <includeblk name="Echo_Req"/></case>
				<case value="6"> <includeblk name="Echo_Rep"/></case>
				<case value="7"> <includeblk name="Out_C_Req"/></case>	
				<case value="8"> <includeblk name="Out_C_Rep"/></case>
				<case value="9"> <includeblk name="In_C_Req"/></case>	
				<case value="10"> <includeblk name="In_C_Rep"/></case> 
				<case value="11"> <includeblk name="In_C_Conn"/></case>
				<case value="15"> <includeblk name="Set-Link-Info"/></case>
			</switch>
		</fields>

		<block name="Start_CC_Req" longname="Start Connection Request">
			<field type="fixed" name="ProtocolVersion" longname="Protocol Version" size ="2" showtemplate="FieldDec"/>
			<field type="fixed" name="res1" longname="Reserved 1" size ="2" showtemplate="FieldHex"/>
			<field type="fixed" name="Framing_Cap" longname="Framing Capabilities" size ="4" showtemplate="pptp.fc"/>
			<field type="fixed" name="Bearer_Cap" longname="Bearer Capabilities" size ="4" showtemplate="pptp.bc"/>
			<field type="fixed" name="Maximum_ch" longname="Maximum Channels" size ="2" showtemplate="FieldDec"/>
			<field type="fixed" name="firmware" longname="Firmware revision" size ="2" showtemplate="FieldDec"/>         
			<field type="fixed" name="hname" longname="Host Name" size ="64" showtemplate="FieldAscii"/>         
			<field type="fixed" name="hname" longname="Vendor Name" size ="64" showtemplate="FieldAscii"/>   
		</block>
			
		<block name="Start_CC_Rep" longname="Start Connection Reply">
			<field type="fixed" name="ProtocolVersion" longname="Protocol Version" size ="2" showtemplate="FieldDec"/>
			<field type="fixed" name="result_start_conn" longname="Result code" size ="1" showtemplate="pptp.rc_start_conn"/>
			<field type="fixed" name="error" longname="Error code" size ="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Framing_Cap" longname="Framing Capability" size ="4" showtemplate="pptp.fc"/>
			<field type="fixed" name="Bearer_Cap" longname="Bearer Capability" size ="4" showtemplate="pptp.bc"/>
			<field type="fixed" name="Maximum_ch" longname="Maximum Channels" size ="2" showtemplate="FieldDec"/>
			<field type="fixed" name="firmware" longname="Firmware revision" size ="2" showtemplate="FieldDec"/>         
			<field type="fixed" name="hname" longname="Host Name" size ="64" showtemplate="FieldAscii"/>         
			<field type="fixed" name="hname" longname="Vendor Name" size ="64" showtemplate="FieldAscii"/>   
		</block>
			
		<block name="Stop_CC_Req" longname="Stop Control Connection Request">
			<field type="fixed" name="reason" longname="Reason" size ="1" showtemplate="FieldDec"/>
			<field type="fixed" name="res1" longname="Reserved 1" size ="1" showtemplate="FieldHex"/>
			<field type="fixed" name="res2" longname="Reserved 2" size ="2" showtemplate="FieldHex"/>                
		</block>
			
		<block name="Stop_CC_Rep" longname="Stop Control Connection Reply">
			<field type="fixed" name="result_stop_conn" longname="Result code" size ="1" showtemplate="pptp.rc_stop_conn"/>
			<field type="fixed" name="error" longname="Error code" size ="1" showtemplate="pptp.ec"/>
			<field type="fixed" name="res1" longname="Reserved 1" size ="2" showtemplate="FieldHex"/>                             
		</block> 
			
		<block name="Echo_Req" longname="Echo Request">
			<field type="fixed" name="identifier" longname="Identifier" size ="4" showtemplate="FieldHex"/>                       
		</block> 

		<block name="Echo_Rep" longname="Echo Reply">
			<field type="fixed" name="identifier" longname="Identifier" size ="4" showtemplate="FieldHex"/> 
			<field type="fixed" name="result" longname="Result code" size ="1" showtemplate="pptp.rc_echo"/>
			<field type="fixed" name="error" longname="Error code" size ="1" showtemplate="pptp.ec"/>
			<field type="fixed" name="res1" longname="Reserved 1" size ="2" showtemplate="FieldHex"/>                                                   
		</block>  
			
		<block name="Out_C_Req" longname="Outgoing Call Request">
			<field type="fixed" name="call_id" longname="Call ID" size ="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="call_sn" longname="Call Serial Number" size ="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="min_bps" longname="Minimum BPS" size ="4" showtemplate="FieldDec"/> 
			<field type="fixed" name="max_bps" longname="Maximum BPS" size ="4" showtemplate="FieldDec"/> 
			<field type="fixed" name="Bearer_Type" longname="Bearer Type" size ="4" showtemplate="pptp.ocbt"/> 
			<field type="fixed" name="Framing_Type" longname="Framing Type" size ="4" showtemplate="pptp.ocft"/>
			<field type="fixed" name="Packet_rec_win" longname="Packet Recv. Window Size" size ="2" showtemplate="FieldDec"/>
			<field type="fixed" name="Packet_proc_del" longname="Packet Processing Delay" size ="2" showtemplate="FieldDec"/>
                        <field type="fixed" name="Phone_Number_Length" longname="Phone Number Length" size="2" showtemplate="FieldDec"/>
                        <field type="fixed" name="res1" longname="reserved1" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="Phone_number" longname="Phone Number" size ="64" showtemplate="FieldDec"/> 
			<field type="fixed" name="subaddress" longname="Subaddress" size ="64" showtemplate="FieldAscii"/>                           
		</block>             
			
		<block name="Out_C_Rep" longname="Outgoing Call Reply">
			<field type="fixed" name="call_id" longname="Call ID" size ="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="peer_call_id" longname="Peer's Call ID" size ="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="result" longname="Result code" size ="1" showtemplate="pptp.ocrc"/>
			<field type="fixed" name="error" longname="Error code" size ="1" showtemplate="pptp.ec"/>
			<field type="fixed" name="cause_code" longname="Cause code" size ="2" showtemplate="FieldDec"/>
			<field type="fixed" name="conn_speed" longname="Connection Speed" size ="4" showtemplate="FieldDec"/>
			<field type="fixed" name="packet_rec_win_size" longname="Packet Receive Window Size" size ="2" showtemplate="FieldDec"/>
			<field type="fixed" name="packet_transmit_delay" longname="Packet Processing Delay" size ="2" showtemplate="FieldDec"/>
			<field type="fixed" name="ph _ch_ID" longname="Physical Channel ID" size ="4" showtemplate="FieldDec"/>
		</block>
			
		<block name="In_C_Req" longname="Incoming Call Request">
			<field type="fixed" name="call_id" longname="Call ID" size ="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="call_sn" longname="Call Serial Number" size ="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="Physical_id" longname="Physical Channel ID" size ="4" showtemplate="FieldDec"/> 
			<field type="fixed" name="Bearer_Type" longname="Call Bearer Type" size ="4" showtemplate="pptp.icbt"/> 
			<field type="fixed" name="Dialed_len" longname="Dialer Number Length" size ="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="Dialing_len" longname="Dialing Number Length" size ="2" showtemplate="FieldDec"/>
			<field type="fixed" name="Dialed_number" longname="Dialer Number" size ="8" showtemplate="FieldDec"/> 
			<field type="fixed" name="Dialing_number" longname="Dialing Number" size ="8" showtemplate="FieldDec"/> 
			<field type="fixed" name="subaddress" longname="Subaddress" size ="8" showtemplate="FieldAscii"/>               
		</block>           
			
		<block name="In_C_Rep" longname="Incoming Call Reply">
			<field type="fixed" name="call_id" longname="Call ID" size ="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="peer_call_id" longname="Peer's Call ID" size ="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="result" longname="Result code" size ="1" showtemplate="pptp.icrc"/>
			<field type="fixed" name="error" longname="Error code" size ="1" showtemplate="pptp.ec"/>
			<field type="fixed" name="packet_rec_win_size" longname="Packet Receive Window Size" size ="2" showtemplate="FieldDec"/>
			<field type="fixed" name="packet_transmit_delay" longname="Packet Transmit Delay" size ="2" showtemplate="FieldDec"/>
			<field type="fixed" name="res1" longname="Reserved 1" size ="2" showtemplate="FieldHex"/>
		</block>
			
		<block name="In_C_Conn" longname="Incoming Call Connected">
			<field type="fixed" name="peer_call_id" longname="Peer's Call ID" size ="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="res1" longname="Reserved 1" size ="2" showtemplate="FieldHex"/>
			<field type="fixed" name="conn_speed" longname="Connection Speed" size ="4" showtemplate="FieldDec"/>
			<field type="fixed" name="packet_rec_win_size" longname="Packet Receive Window Size" size ="2" showtemplate="FieldDec"/>
			<field type="fixed" name="packet_transmit_delay" longname="Packet Transmit Delay" size ="2" showtemplate="FieldDec"/>
			<field type="fixed" name="framing_type" longname="Framing Type" size ="4" showtemplate="pptp.icft"/>              
		</block>

		<block name="Set-Link-Info" longname="Set Link Info">
			<field type="fixed" name="peer_call_id" longname="Peer's Call ID" size ="2" showtemplate="FieldDec"/> 
			<field type="fixed" name="res1" longname="Reserved 1" size ="2" showtemplate="FieldHex"/>
			<field type="fixed" name="sendACCM" longname="Send ACCM" size ="4" showtemplate="FieldHex"/>
			<field type="fixed" name="recACCM" longname="Receive ACCM" size ="4" showtemplate="FieldHex"/>  
		</block>
	</format>

	<visualization>
		<showsumtemplate name="pptp">
			<section name="next"/>
			<text value="PPTP "/>
			<protofield name="ctrlmsgtype" showdata="showmap"/>
		</showsumtemplate>

		<showtemplate name="pptp.ctrlmsgtype" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Start-Control-Connection-Request"/>
					<case value="2" show="Start-Control-Connection-Reply"/>
					<case value="3" show="Stop-Control-Connection-Request"/>
					<case value="4" show="Stop-Control-Connection-Reply"/>
					<case value="5" show="Echo-Request"/>
					<case value="6" show="Echo-Reply"/>
					<case value="7" show="Outgoing-Call-Request"/>
					<case value="8" show="Outgoing-Call-Reply"/>
					<case value="9" show="Incoming-Call-Request"/>
					<case value="10" show="Incoming-Call-Reply"/>
					<case value="11" show="Incoming-Call-Connected"/>
					<case value="15" show="Set-Link-Info"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="pptp.rc_start_conn" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Successful channel establishment"/>
					<case value="2" show="General error: Error Code indicates the problem"/>
					<case value="3" show="Requester is not authorized to establish a command channel"/>
					<case value="4" show="The protocol version of the requester is not supported"/>
					<case value="5" show="The protocol version of the requester is not supported"/>			
				</switch>
			</showmap>
		</showtemplate>
				
		<showtemplate name="pptp.fc" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Asynchronous Framing supported"/>
					<case value="2" show="Synchronous Framing supported"/>
                                        <case value="3" show="Either Framing Supported"/>
					<default show="Error in pptp.fc code lookup"/>
				</switch>
			</showmap>
		</showtemplate>		
				
		<showtemplate name="pptp.bc" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Analog access supported"/>
					<case value="2" show="Digital access supported"/>
					<case value="3" show="Either Framing Supported"/>
				</switch>
			</showmap>
		</showtemplate>
				
		<showtemplate name="pptp.rc_stop_conn" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="(OK) - Control connection closed"/>
					<case value="2" show="(General Error) - Control connection not closed for reason indicated in Error Code"/>
				</switch>
			</showmap>
		</showtemplate>
				
		<showtemplate name="pptp.rc_echo" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="(OK) - The Echo-Reply is valid"/>
					<case value="2" show="(General Error) - Echo-Request not accepted for the reason indicated in Error Code"/>
				</switch>
			</showmap>
		</showtemplate>
				
		<showtemplate name="pptp.ocbt" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Call to be placed on an analog channel"/>
					<case value="2" show="Call to be placed on a digital channel"/>
					<case value="3" show="Call to be placed on any type of channel"/>
				</switch>
			</showmap>
		</showtemplate>
				
		<showtemplate name="pptp.ocft" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Call to use Asynchronous framing"/>
					<case value="2" show="all to use Synchronous framing"/>
					<case value="3" show="Call can use either type of framing"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="pptp.ocrc" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="(Connected) - Call established with no errors"/>
					<case value="2" show="General Error) - Outgoing Call not established for the reason indicated in Error Code"/>
					<case value="3" show="(No Carrier) - Outgoing Call failed due to no carrier detected"/>
					<case value="4" show="(Busy) - Outgoing Call failed due to detection of a busy signal"/>
					<case value="5" show="(Busy) -   (No Dial Tone) - Outgoing Call  failed due to lack of a dial tone"/>
					<case value="6" show="(Time-out) - Outgoing Call was not established within time allotted by PAC"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="pptp.icbt" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Call is on an analog channel"/>
					<case value="2" show="Call is on a digital channel"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="pptp.icrc" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="(Connect) - The PAC should answer the incoming call"/>
					<case value="2" show="(General Error) - The Incoming Call should not be established due to the reason indicated in Error Code"/>
					<case value="3" show="(Do Not Accept) - The PAC should not accept the incoming call.  It should hang up or issue a busy indication"/>
				</switch>
			</showmap>
		</showtemplate>

 		<showtemplate name="pptp.icft" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Call uses asynchronous framing"/>
					<case value="2" show="Call uses synchronous framing"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="pptp.ec" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="No error"/>
					<case value="1" show="Not-Connected"/>
					<case value="2" show="Bad-Format"/>
					<case value="3" show="Bad-Value"/>
					<case value="4" show="No-Resource"/>
					<case value="5" show="Bad-Call ID"/>   
				</switch>
			</showmap>
		</showtemplate>
	</visualization>
</protocol>

<protocol name="esp" longname="ESP Encrypted Data" comment="Encrypted data after ESP Extension Header" showsumtemplate="esp">
	<format>
		<fields>
			<field type="variable" name="payload" longname="Data payload" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
		</fields>	
	</format>
	
	<visualization>
		<showsumtemplate name="esp">
			<section name="next"/>
			<text value="esp"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="kerberos" longname="Kerberos" showsumtemplate="kerberos">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset : 0],'krbtgt',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<!-- is the check against #tcp really needed? -->
		<before when="($protoverify_result == %FOUND) and ($L4proto == #tcp)">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#kerberos"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#kerberos"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#kerberos"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>
	<format>
		<fields>
			<field type="variable" name="kerberosdata" longname="Kerberos Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="kerberos">
			<section name="next"/>
			<text value="Kerberos"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="ntp" longname="Network Time Protocol" showsumtemplate="ntp">
	<execute-code>
		<verify>
			<if expr="($packetlength - $currentoffset) ge 48 and (hasstring($packet[$currentoffset:0],'^([\x13\x1b\x23\xd3\xdb\xe3]|[\x14\x1c$].......?.?.?.?.?.?.?.?.?[\xc6-\xff])',0))">
																												<!-- Simple NTP -->
			<!--<if expr="(($packetlength - $currentoffset) == 48) or (($packetlength - $currentoffset) == 60) or (($packetlength - $currentoffset) == 68)">-->
				<if-true>
					<assign-variable name="$protoverify_result" value="%CANDIDATE"/>
				</if-true>	
			</if>
		</verify>

		<before when="$protoverify_result == %CANDIDATE or $protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#ntp"/>
			</update-lookuptable>	

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#ntp"/>
			</update-lookuptable>
		</before>		
	</execute-code>

	<format>
		<fields>
			<field type="variable" name="ntpdata" longname="NTP Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="ntp">
			<section name="next"/>
			<text value="(Simple) Network Time Protocol"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="pppoe" longname="PPPoE Session Stage" showsumtemplate="pppoesession">
	<format>
		<fields>
			<field type="bit" name="ver" longname="Version" mask="0xF0" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="type" longname="Type" mask="0x0F" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="code" longname="Code" size="1" showtemplate="pppoe.tagtype"/>
			<field type="fixed" name="session_ID" longname="Session ID" description="ID of the PPPoE session" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="hlen" longname="Length" description="Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="nextp" longname="Next protocol" description="Protocol encapsulated into PPPoE" size="2" showtemplate="FieldHex"/>
		</fields>
	</format>

	<encapsulation>
		<switch expr="buf2int(nextp)">
			<case value="33"> <nextproto proto="#ip"/> </case>
			<case value="87"> <nextproto proto="#ipv6"/> </case>
			<case value="32801"> <nextproto proto="#icmp"/> </case>
<!--
			<case value="49185"> <nextproto proto="#LCP"/> </case>
			<case value="43"> <nextproto proto="#IPX"/> </case>
			<case value="63"> <nextproto proto="#Netbeui"/> </case>
-->
		</switch>
	</encapsulation>
	
	<visualization>
		<showsumtemplate name="pppoesession">
			<text value=" - "/>
			<protohdr showdata="longname"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="pppoed" longname="PPPoE Discovery Stage" description="PPP over Ethernet Discovery stage" showsumtemplate="pppoe">
	<format>
		<fields>
			<field type="bit" name="ver" longname="Version" mask="0xF0" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="type" longname="Type" mask="0x0F" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="code" longname="Code" size="1" showtemplate="pppoe.code"/>
			<field type="fixed" name="session_ID" longname="Session ID" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="hlen" longname="Length" size="2" showtemplate="FieldDec"/>

			<loop type="while" expr="1">
				<!-- Loop until the packet ends -->
				<field type="fixed" name="TAGtype" longname="Tag type" size="2" showtemplate="pppoe.tagtype"/>
				<field type="fixed" name="TAGlen" longname="Tag length" size="2" showtemplate="FieldDec"/>
				<field type="variable" name="TAGvalue" longname="Tag value" expr="buf2int(TAGlen)" showtemplate="Field4BytesHex"/>
			</loop>
		</fields>
	</format>

	<visualization>
		<showtemplate name="pppoe.tagtype" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="End of List"/> 
					<case value="257" show="Service Name"/> 
					<case value="258" show="AC Name"/> 
					<case value="259" show="Host Uniq"/> 
					<case value="260" show="AC Cookie"/> 
					<case value="261" show="Vendor Specific"/> 
					<case value="272" show="Relay Session Id"/> 
					<case value="513" show="Service Name Error"/> 
					<case value="514" show="AC System Error"/> 
					<case value="515" show="Generic Error"/> 
					<default show="Error in PPPoe Tag Type lookup"/> 
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="pppoe">
			<section name="next"/>
			<text value="PPPOE: "/>
			<protofield name="code" showdata="showmap"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="radius" longname="RADIUS (Remote Access Dial In User Service)" showsumtemplate="radius">
<execute-code>
  <verify>
			<if expr="hasstring($packet[$currentoffset:0], '[\x01\x02\x03\x04\x05\x0B\x0C\x0D\xFF]',0) and (($packetlength - $currentoffset ) == buf2int($packet[$currentoffset+2:2])) "> 
				<if-true>
						<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
   </verify>
		
   <before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#radius"/>
			</update-lookuptable>	

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#radius"/>
			</update-lookuptable>
   </before>		
 </execute-code>

	<format>
		<fields>
			<field type="fixed" name="Code" longname="Radius PDU Code" size="1" showtemplate="radius.code"/>
			<field type="fixed" name="Identifier" longname="Radius PDU Identifier" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Radius PDU Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="Authenticator" longname="Radius PDU Autheticator" size="16" showtemplate="Field4BytesHex"/>

			<!-- Option list -->
			<loop type="size" expr="buf2int(Length) - 20">
				<switch expr="buf2int($packet[$currentoffset:1])">

					<case value="1"> <includeblk name="User-Name"/> </case>
					<case value="2"> <includeblk name="User-Password"/> </case>
					<case value="3"> <includeblk name="CHAP-Password"/> </case>
					<case value="4"> <includeblk name="NAS-IP-Address"/> </case>
					<case value="5"> <includeblk name="NAS-Port"/> </case>
					<case value="6"> <includeblk name="Service-Type"/> </case>
					<case value="7"> <includeblk name="Framed-Protocol"/> </case>
					<case value="8"> <includeblk name="Framed-IP-Address"/> </case>
					<case value="9"> <includeblk name="Framed-IP-Netmask"/> </case>
					<case value="10"> <includeblk name="Framed-Routing"/> </case>
					<case value="11"> <includeblk name="Filter-ID"/> </case>
					<case value="12"> <includeblk name="Framed-MTU"/> </case>
					<case value="13"> <includeblk name="Framed-Compression"/> </case>
					<case value="14"> <includeblk name="Login-IP-Host"/> </case>
					<case value="15"> <includeblk name="Login-Service"/> </case>				
					<case value="16"> <includeblk name="Login-TCP-Port"/> </case>
					<case value="17"> <includeblk name="unassigned"/> </case>
					<case value="18"> <includeblk name="Reply-Message"/> </case>
					<case value="19"> <includeblk name="Callback-Number"/> </case>
					<case value="20"> <includeblk name="Callback-ID"/> </case>
					<case value="21"> <includeblk name="unassigned"/> </case>
					<case value="22"> <includeblk name="Framed-Route"/> </case>
					<case value="23"> <includeblk name="Framed-IPX-Network"/> </case>
					<case value="24"> <includeblk name="State"/> </case>
					<case value="25"> <includeblk name="Class"/> </case>
					<case value="26"> <includeblk name="Vendor-Specific"/> </case>
					<case value="27"> <includeblk name="Session-Timeout"/> </case>
					<case value="28"> <includeblk name="Idle-Timeout"/> </case>
					<case value="29"> <includeblk name="Termination-Action"/> </case>
					<case value="30"> <includeblk name="Called-Station-ID"/> </case>
					<case value="31"> <includeblk name="Calling-Station-ID"/> </case>
					<case value="32"> <includeblk name="NAS-Identifier"/> </case>
					<case value="33"> <includeblk name="Proxy-State"/> </case>
					<case value="34"> <includeblk name="Login-LAT-Service"/> </case>
					<case value="35"> <includeblk name="Login-LAT-Node"/> </case>
					<case value="36"> <includeblk name="Login-LAT-Group"/> </case>
					<case value="37"> <includeblk name="Framed-Appletalk-Link"/> </case>
					<case value="38"> <includeblk name="Framed-Appletalk-Network"/> </case>
					<case value="39"> <includeblk name="Framed-Appletalk-Zone"/> </case>
					<case value="40" maxvalue="59"> <includeblk name="Reserved-For-Accounting"/> </case>
					<case value="60"> <includeblk name="CHAP-Challenge"/> </case>
					<case value="61"> <includeblk name="NAS-Port-Type"/> </case>
					<case value="62"> <includeblk name="Port-Limit"/> </case>
					<case value="63"> <includeblk name="Login-LAT-Port"/> </case>
					<case value="225"> <includeblk name="X-Ascend-Metric"/> </case>
					<case value="228"> <includeblk name="X-Ascend-Route-IP"/> </case>
					<case value="230"> <includeblk name="X-Ascend-Bridge"/> </case>

				</switch>
			</loop>
		</fields>

		
		<!-- RADIUS Options -->
		<block name="User-Name" longname="Option 1: User Name">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="User Name" expr="buf2int(Length) - 2" showtemplate="FieldAscii"/>
		</block>
		
		<block name="User-Password" longname="Option 2: User Password">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="User Password" expr="buf2int(Length) - 2" showtemplate="FieldAscii"/>
		</block>
		
		<block name="CHAP-Password" longname="Option 3: CHAP Password">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="CHAP-Ident" longname="CHAP Identifier" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="CHAP Response" size="16" showtemplate="Field4BytesHex"/>
		</block>
		
		<block name="NAS-IP-Address" longname="Option 4: NAS IP Address">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Address" longname="Address Field" size="4" showtemplate="ip4addr-noplg"/>
		</block>
		
		<block name="NAS-Port" longname="Option 5: NAS Port">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="port" longname="Port Value" size="4" showtemplate="FieldDec"/>
		</block>
		
		<block name="Service-Type" longname="Option 6: Service Type">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="Service Type" size="4" showtemplate="radius.type06"/>
		</block>
		
		<block name="Framed-Protocol" longname="Option 7: Framed Protocol">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="Framed Protocol" size="4" showtemplate="radius.type07"/>
		</block>
		
		<block name="Framed-IP-Address" longname="Option 8: Framed IP Address">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="IP Address" size="4" showtemplate="ip4addr-noplg"/>
		</block>
		
		<block name="Framed-IP-Netmask" longname="Option 9: Framed IP Netmask">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="IP Netmask" size="4" showtemplate="ip4addr-noplg"/>
		</block>
		
		<block name="Framed-Routing" longname="Option 10: Framed Routing">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="Routing" size="4" showtemplate="radius.type10"/>
		</block>
		
		<block name="Filter-ID" longname="Option 11: Filter ID">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Filter ID" expr="buf2int(Length) - 2" showtemplate="FieldAscii"/>
		</block>
		
		<block name="Framed-MTU" longname="Option 12: Framed MTU">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="MTU" size="4" showtemplate="FieldDec"/>
		</block>
		
		<block name="Framed-Compression" longname="Option 13: Framed Compression">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="Compression Protocol" size="4" showtemplate="radius.type13"/>
		</block>
		
		<block name="Login-IP-Host" longname="Option 14: Login IP Host">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="IP Address" size="4" showtemplate="ip4addr-noplg"/>
		</block>
		
		<block name="Login-Service" longname="Option 15: Login Service">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="Login Service" size="4" showtemplate="radius.type15"/>
		</block>
		
		<block name="Login-TCP-Port" longname="Option 16: Login TCP Port">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="Login TCP Port" size="4" showtemplate="FieldDec"/>
		</block>
		
		<!-- Unassigned Options -->
		<block name="unassigned" longname="Option 17: Unassigned">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Value" expr="buf2int(Length) - 2" showtemplate="Field4BytesHex"/>
		</block>
		<!-- End Unassigned Options -->
		
		<block name="Reply-Message" longname="Option 18: Reply Message">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Reply Message" expr="buf2int(Length) - 2" showtemplate="FieldAscii"/>
		</block>
		
		<block name="Callback-Number" longname="Option 19: Callback Number">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Value" expr="buf2int(Length) - 2" showtemplate="Field4BytesHex"/>
		</block>
		
		<block name="Callback-ID" longname="Option 20: Callback ID">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Value" expr="buf2int(Length) - 2" showtemplate="Field4BytesHex"/>
		</block>
		
		<block name="Framed-Route" longname="Option 22: Framed Route">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Framed Route" expr="buf2int(Length) - 2" showtemplate="FieldAscii"/>
		</block>
		
		<block name="Framed-IPX-Network" longname="Option 23: Framed IPX Network">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="IP Address" size="4" showtemplate="ip4addr-noplg"/>
		</block>
		
		<block name="State" longname="Option 24: State">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Value" expr="buf2int(Length) - 2" showtemplate="Field4BytesHex"/>
		</block>
		
		<block name="Class" longname="Option 25: Class">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Value" expr="buf2int(Length) - 2" showtemplate="Field4BytesHex"/>
		</block>
		
		<block name="Vendor-Specific" longname="Option 26: Vendor Specific">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="ID" longname="Vendor ID" size="4" showtemplate="FieldHex"/>
			<field type="variable" name="Value" longname="Value" expr="buf2int(Length) - 6" showtemplate="Field4BytesHex"/>
		</block>
		
		<block name="Session-Timeout" longname="Option 27: Session Timeout">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="Seconds till Timeout" size="4" showtemplate="FieldDec"/>
		</block>
		
		<block name="Idle-Timeout" longname="Option 28: Idle Timeout">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="Idle Seconds till Timeout" size="4" showtemplate="FieldDec"/>
		</block>
		
		<block name="Termination-Action" longname="Option 29: Termination Action">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="Termination Action" size="4" showtemplate="radius.type29"/>
		</block>
		
		<block name="Called-Station-ID" longname="Option 30: Called Station ID">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Phone Number" expr="buf2int(Length) - 2" showtemplate="Field4BytesHex"/>
		</block>
		
		<block name="Calling-Station-ID" longname="Option 31: Calling Station ID">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Phone Number" expr="buf2int(Length) - 2" showtemplate="Field4BytesHex"/>
		</block>
		
		<block name="NAS-Identifier" longname="Option 32: NAS Identifier">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="NAS ID" expr="buf2int(Length) - 2" showtemplate="Field4BytesHex"/>
		</block>
		
		<block name="Proxy-State" longname="Option 33: Proxy State">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Proxy State" expr="buf2int(Length) - 2" showtemplate="Field4BytesHex"/>
		</block>
		
		<block name="Login-LAT-Service" longname="Option 34: Login LAT Service">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="System beeing connected" expr="buf2int(Length) - 2" showtemplate="FieldAscii"/>
		</block>
		
		<block name="Login-LAT-Node" longname="Option 35: Login LAT Node">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Node beeing connected" expr="buf2int(Length) - 2" showtemplate="FieldAscii"/>
		</block>
		
		<block name="Login-LAT-Group" longname="Option 36: Login LAT Group">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Group codes authorized" expr="buf2int(Length) - 2" showtemplate="FieldAscii"/>
		</block>
		
		<block name="Framed-Appletalk-Link" longname="Option 37: Framed Appletalk Link">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="Framed Appletalk Network Number" size="4" showtemplate="FieldDec"/>
		</block>
		
		<block name="Framed-Appletalk-Network" longname="Option 38: Framed Appletalk Network">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="Framed Appletalk Network Number" size="4" showtemplate="FieldDec"/>
		</block>
		
		<block name="Framed-Appletalk-Zone" longname="Option 39: Framed Appletalk Zone">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Appletalk default zone" expr="buf2int(Length) - 2" showtemplate="Field4BytesHex"/>
		</block>
		
		<!-- Reserved Options -->
		<block name="Reserved-For-Accounting" longname="Option reserved for Accounting">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="Option Data" expr="buf2int(Length) - 2" showtemplate="Field4BytesHex"/>
		</block>
		<!-- End Reserved Options -->
		
		<block name="CHAP-Challenge" longname="Option 60: CHAP Challenge">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="CHAP Challenge" expr="buf2int(Length) - 2" showtemplate="Field4BytesHex"/>
		</block>
		
		<block name="NAS-Port-Type" longname="Option 61: NAS Port Type">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="NAS Port Type" size="4" showtemplate="radius.type61"/>
		</block>
		
		<block name="Port-Limit" longname="Option 62: Port Limit">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Value" longname="Maximum number of ports connected" size="4" showtemplate="FieldDec"/>
		</block>
		
		<block name="Login-LAT-Port" longname="Option 63: Login LAT Port">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="LAT port connected" expr="buf2int(Length) - 2" showtemplate="FieldAscii"/>
		</block>
                <block name="X-Ascend-Metric" longname="X-Ascend-Metric">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="X-Ascend-Metric" expr="buf2int(Length) - 2" showtemplate="FieldAscii"/>
		</block>
                <block name="X-Ascend-Bridge" longname="X-Ascend-Bridge">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="X-Ascend-Bridge" expr="buf2int(Length) - 2" showtemplate="FieldAscii"/>
		</block>
                <block name="X-Ascend-Route-IP" longname="X-Ascend-Route-IP">
			<field type="fixed" name="Type" longname="Option Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="Length" longname="Option Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="Value" longname="X-Ascend-Route-IP" expr="buf2int(Length) - 2" showtemplate="FieldAscii"/>
		</block>

		<!-- End RADIUS Options -->
	</format>


	<visualization>
		<showtemplate name="radius.code" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="01" show="Access - Request packet"/> 
					<case value="02" show="Access - Accept packet"/> 
					<case value="03" show="Access - Reject packet"/>
					<case value="04" show="Accounting - Request packet"/>
					<case value="05" show="Accounting - Response packet"/>
					<case value="0B" show="Access - Challenge packet"/>
					<case value="0C" show="Status - Server packet"/>
					<case value="FF" show="Reserved packet"/>
					<default show="Error in RADIUS code lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="radius.type06" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="01" show="Login"/> 
					<case value="02" show="Framed"/> 
					<case value="03" show="Callback Login"/>
					<case value="04" show="Callback Framed"/>
					<case value="05" show="Outbound"/>
					<case value="06" show="Administrative"/>
					<case value="07" show="NAS prompt"/>
					<case value="08" show="Authenticate only"/>
					<case value="09" show="Callback NAS Prompt"/> 
					<case value="10" show="Call Check"/> 
					<case value="11" show="Callback Administrative"/>
					<default show="Error in RADIUS (Type 06) code lookup"/>
				</switch>
			</showmap>
		</showtemplate>
			
		<showtemplate name="radius.type07" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="PPP"/> 
					<case value="2" show="SLIP"/> 
					<case value="3" show="Appletalk Remote Access Protocol (ARAP)"/>
					<case value="4" show="Gandalf proprietary Single/Multi-link protocol"/>
					<case value="5" show="XYlogics proprietary IPX/SLIP"/>
					<case value="6" show="X.75 Synchronous"/>
					<default show="Error in RADIUS (Type 07) code lookup"/>
				</switch>
			</showmap>
		</showtemplate>
			
		<showtemplate name="radius.type10" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="None"/> 
					<case value="1" show="Send Routing packets"/> 
					<case value="2" show="Listen for routing packets"/> 
					<case value="3" show="Send and Listen"/>
					<default show="Error in RADIUS (Type 10) code lookup"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="radius.type13" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="None"/> 
					<case value="1" show="VJ TCP/IP header compression"/> 
					<case value="2" show="IPX header compression"/> 
					<case value="3" show="Stac-LSZ compression"/>
					<default show="Error in RADIUS (Type 13) code lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="radius.type15" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Telnet"/> 
					<case value="1" show="RLogin"/> 
					<case value="2" show="TCP clear"/> 
					<case value="3" show="Portmaster (proprietary)"/>
					<case value="4" show="LAT"/> 
					<case value="5" show="X25-PAD"/> 
					<case value="6" show="X25-T3POS"/> 
					<case value="7" show="TCP clear quiet (suppresses any NAS-generated connect string)"/>
					<default show="Error in RADIUS (Type 15) code lookup"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="radius.type29" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="Default"/> 
					<case value="1" show="RADIUS-Request"/> 
					<default show="Error in RADIUS (Type 29) code lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="radius.type61" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="00" show="Async"/> 
					<case value="01" show="Sync"/> 
					<case value="02" show="ISDN Sync"/> 
					<case value="03" show="ISDN Async v. 120"/>
					<case value="04" show="ISDN Async v. 110"/> 
					<case value="05" show="Virtual"/> 
					<case value="06" show="PIAFS"/> 
					<case value="07" show="HDLC Clear Channel"/>
					<case value="08" show="X.25"/> 
					<case value="09" show="X.75"/> 
					<case value="10" show="G.3 FAX"/>
					<case value="11" show="SDSL - Symmetric DSL"/>
					<case value="12" show="ADSL CAP - Asymmetric DSL, Carrierless Amplitude Phase Modulation"/> 
					<case value="13" show="ADSL DMT - Asymmetric DSL, Discrete Multi-Tone"/> 
					<case value="14" show="IDSL - ISDN Digital Subscriber Line"/> 
					<case value="15" show="ethernet"/>
					<case value="16" show="xDSL - Digital Subscriber Line of unknown type"/> 
					<case value="17" show="Cable"/> 
					<case value="18" show="Wireless - Other"/> 
					<case value="19" show="Wireless - IEEE 802.11"/>
					<default show="Error in RADIUS (Type 61) code lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="radius">
			<section name="next"/>
			<text value="RADIUS: "/>
			<protofield name="Code" showdata="showmap"/>
			<text value=", ID "/>
			<protofield name="Identifier" showdata="showvalue"/>
			<text value=", Len "/>
			<protofield name="Length" showdata="showvalue"/>
		</showsumtemplate>
	</visualization>
	
</protocol>
<protocol name="rpcap" longname="RPCAP (Remote Capture Protocol)" showsumtemplate="rpcap">
<execute-code>
<verify>
		<if expr="hasstring($packet[$currentoffset+1:0], '[\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x82\x83\x84\x85\x88\x89\x8A\x8B]',0) and (($packetlength - $currentoffset ) == buf2int($packet[$currentoffset+4:4])) "> 
			<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
			</if-true>
		</if>
</verify>
		
   <before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#rpcap"/>
			</update-lookuptable>	

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#rpcap"/>
			</update-lookuptable>
   </before>		
 </execute-code>

	<format>
		<fields>
			<field type="fixed" name="ver" longname="Version" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="type" longname="Command type" size="1" showtemplate="rpcap.type"/>
			<field type="fixed" name="value" longname="Value (command dependent)" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="plen" longname="Payload Length" size="4" showtemplate="FieldDec"/>

			<switch expr="buf2int(type)">
				<case value="4">
					<includeblk name="StartCap"/>
				</case>

				<case value="137">
					<includeblk name="GetStatsReply"/>
				</case>

				<default>
					<field type="variable" name="payload" longname="Data payload" expr="buf2int(plen)" showtemplate="Field4BytesHex"/>
				</default>
			</switch>
		</fields>


		<block name="StartCap" longname="Start Capture Request">
			<field type="fixed" name="snaplen" longname="Packet snapshot length" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="read_timeout" longname="Read Timeout" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="flags" longname="Flags" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="portdata" longname="Port data" size="2" showtemplate="FieldDec"/>
			<includeblk name="SetFilter"/>
		</block>
		
		<block name="SetFilter" longname="Set Filter Request">
			<field type="fixed" name="filtertype" longname="Filter Type" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="dummy" longname="Dummy" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="nitems" longname="Number of Items" size="4" showtemplate="FieldDec"/>
			<field type="variable" name="filter" longname="Filter string" expr="buf2int(nitems) * 8" showtemplate="Field4BytesHex"/>
		</block>

		<block name="GetStatsReply">
			<field type="fixed" name="ifrecv" longname="Packets received by the kernel filter" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="ifdrop" longname="Packets dropped by the network interface" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="krnldrop" longname="Packets dropped by the kernel filter" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="srvcapt" longname="Packets sent to the RPCAP collector" size="4" showtemplate="FieldDec"/>
		</block>
	</format>


	<visualization>
		<showtemplate name="rpcap.type" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="1" show="Error"/> 
					<case value="2" show="List all devices request"/> 
					<case value="3" show="Open adapter request"/>
					<case value="4" show="Start capture request"/>
					<case value="5" show="Update capture filter request"/>
					<case value="6" show="Close adapter"/>
					<case value="7" show="Packet transfer"/>
					<case value="8" show="Authentication request"/>
					<case value="9" show="Get stats request"/>
					<case value="10" show="End capture request"/>
					<case value="11" show="Set sampling request"/>

					<case value="130" show="List all devices reply"/> 
					<case value="131" show="Open adapter reply"/>
					<case value="132" show="Start capture reply"/>
					<case value="133" show="Update capture filter reply"/>
					<case value="136" show="Authentication reply"/>
					<case value="137" show="Get stats reply"/>
					<case value="138" show="End capture reply"/>
					<case value="139" show="Set sampling reply"/>

					<default show="Error in RPCAP code lookup"/>
				</switch>
			</showmap>
		</showtemplate>

		<showsumtemplate name="rpcap">
			<section name="next"/>
			<text value="RPCAP "/>
			<protofield name="type" showdata="showmap"/>
		</showsumtemplate>
	</visualization>

</protocol>
<protocol name="rtcp" longname="RTCP (Real Time Control Protocol)" showsumtemplate="rtcp">
	<!-- We should check that 'version' is equal to '2' -->
	<format>
		<fields>
			<loop type="size" expr="$packetlength - $currentoffset">
				<switch expr="buf2int($packet[$currentoffset+1:1])">
					
					<case value="200">	<includeblk name="sr"/>		</case>
					<case value="201">	<includeblk name="rr"/>		</case>
					<case value="202">	<includeblk name="sdes"/>	</case>
					<case value="203">	<includeblk name="bye"/>	</case>
					<case value="204">	<includeblk name="app"/>	</case>

					<!-- Unknown option -->
					<default>
						<block name="unknown" longname="Unknown Option">
							<field type="bit" name="ver" longname="Version" mask="0xC0" size="1" showtemplate="FieldDec"/>
							<field type="bit" name="pad" longname="Padding" description="Set to enable padding" mask="0x20" size="1" showtemplate="FieldBin"/>
							<field type="bit" name="st" longname="Subtype" mask="0x1F" size="1" showtemplate="FieldDec"/>
							<field type="fixed" name="type" longname="Type" size="1" showtemplate="rtcp.type"/>
							<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
							<field type="variable" name="srinfo" longname="Sender Information" expr="buf2int(length) * 4" showtemplate="Field4BytesHex"/>
						</block>
					</default>
				</switch>
			</loop>
		</fields>

		<block name="sr" longname="Sender Report (SR)">
			<field type="bit" name="ver" longname="Version" description="Always set to 2" mask="0xC0" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="pad" longname="Padding" description="Set to enable padding" mask="0x20" size="1" showtemplate="FieldBin"/>
			<field type="bit" name="rc" longname="Reception Report Count" mask="0x1F" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="rtcp.type"/>
			<!-- Warning: 'length" keeps the nuber of words (32bit) - 1 -->
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="ssrc" longname="SSRC" description="Sync Source ID" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="srinfo" longname="Sender Information" expr="(buf2int(length) + 1) * 4" showtemplate="Field4BytesHex"/>
		</block>

		<block name="rr" longname="Receiver Report (RR)">
			<field type="bit" name="ver" longname="Version" description="Always set to 2" mask="0xC0" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="pad" longname="Padding" description="Set to enable padding" mask="0x20" size="1" showtemplate="FieldBin"/>
			<field type="bit" name="rc" longname="Reception Report Count" mask="0x1F" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="rtcp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="ssrc" longname="Packet Sender SSRC" size="4" showtemplate="FieldHex"/>

			<loop type="size" expr="(buf2int(length) - 1) * 4">
				<loop type="times2repeat" expr="buf2int(rrc)">
					<block name="ritem" longname="Receiver Item">
						<field type="fixed" name="ssrc" longname="Source SSRC" size="4" showtemplate="FieldHex"/>
						<field type="fixed" name="flost" longname="Fraction of Lost Packets " size="1" showtemplate="FieldHex"/>
						<field type="fixed" name="clost" longname="Cumulative Number of Lost Packets" size="3" showtemplate="FieldHex"/>
						<field type="fixed" name="highseq" longname="Highest Received Sequence Number" size="4" showtemplate="FieldHex"/>
						<field type="fixed" name="ijitter" longname="Interarrival Jitter" size="4" showtemplate="FieldDec"/>
						<field type="fixed" name="lastsr" longname="Last Sender Report (LSR)" size="4" showtemplate="FieldHex"/>
						<field type="fixed" name="delaylastsr" longname="Delat Since Last Sender Report (DLSR)" size="4" showtemplate="FieldDec"/>			
					</block>		
				</loop>
				<field type="variable" name="profile_ext" longname="Profile-specific Extensions" expr="(buf2int(length) - 1) * 4 - (buf2int(rrc) * 24)" showtemplate="Field4BytesHex"/>
			</loop>
		</block>

		<block name="sdes" longname="Source Description (SDES)">
			<field type="bit" name="ver" longname="Version" description="Always set to 2" mask="0xC0" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="pad" longname="Padding" description="Set to enable padding" mask="0x20" size="1" showtemplate="FieldBin"/>
			<field type="bit" name="rc" longname="Reception Report Count" mask="0x1F" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="rtcp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>

			<loop type="times2repeat" expr="buf2int(sc)">

				<block name="sdesitem" longname="Source Description Item">
					<field type="fixed" name="ssrc" longname="SSRC" size="4" showtemplate="FieldHex"/>
					<loop type="while" expr="1">

						<switch expr="buf2int($packet[$currentoffset:1])">
							<case value="0">
								<block name="eoitems" longname="End of items">
									<field type="fixed" name="sdestype" longname="Type" size="1" showtemplate="rtcp.sdestype"/>
									<field type="padding" name="sdespad" longname="padding" align="4" showtemplate="FieldHex"/>
									<loopctrl type="break"/>
								</block>
							</case>
							<case value="1">
								<block name="cname" longname="CNAME">
									<field type="fixed" name="sdestype" longname="Type" size="1" showtemplate="rtcp.sdestype"/>
									<field type="fixed" name="sdeslength" longname="Length" size="1" showtemplate="FieldDec"/>
									<field type="variable" name="sdesuser" longname="User and Domain name" expr="buf2int(sdeslength)" showtemplate="FieldAscii"/>
								</block>
							</case>
							<case value="2">
								<block name="name" longname="User name">
									<field type="fixed" name="sdestype" longname="Type" size="1" showtemplate="rtcp.sdestype"/>
									<field type="fixed" name="sdeslength" longname="Length" size="1" showtemplate="FieldDec"/>
									<field type="variable" name="sdesname" longname="Common name of source" expr="buf2int(sdeslength)" showtemplate="FieldAscii"/>
								</block>
							</case>
							<case value="3">
								<block name="email" longname="Email">
									<field type="fixed" name="sdestype" longname="Type" size="1" showtemplate="rtcp.sdestype"/>
									<field type="fixed" name="sdeslength" longname="Length" size="1" showtemplate="FieldDec"/>
									<field type="variable" name="sdesemail" longname="Email address of source" expr="buf2int(sdeslength)" showtemplate="FieldAscii"/>
								</block>
							</case>
							<case value="4">
								<block name="phone" longname="Phone number">
									<field type="fixed" name="sdestype" longname="Type" size="1" showtemplate="rtcp.sdestype"/>
									<field type="fixed" name="sdeslength" longname="Length" size="1" showtemplate="FieldDec"/>
									<field type="variable" name="sdesphone" longname="Phone Number of source" expr="buf2int(sdeslength)" showtemplate="FieldAscii"/>
								</block>
							</case>
							<case value="5">
								<block name="location" longname="Geographic user location">
									<field type="fixed" name="sdestype" longname="Type" size="1" showtemplate="rtcp.sdestype"/>
									<field type="fixed" name="sdeslength" longname="Length" size="1" showtemplate="FieldDec"/>
									<field type="variable" name="sdesloc" longname="Geographic location of site" expr="buf2int(sdeslength)" showtemplate="FieldAscii"/>
								</block>
							</case>
							<case value="6">
								<block name="tool" longname="Application or tool name">
									<field type="fixed" name="sdestype" longname="Type" size="1" showtemplate="rtcp.sdestype"/>
									<field type="fixed" name="sdeslength" longname="Length" size="1" showtemplate="FieldDec"/>
									<field type="variable" name="sdestool" longname="Name/version of source application" expr="buf2int(sdeslength)" showtemplate="FieldAscii"/>
								</block>
							</case>
							<case value="7">
								<block name="note" longname="Notice or Status">
									<field type="fixed" name="sdestype" longname="Type" size="1" showtemplate="rtcp.sdestype"/>
									<field type="fixed" name="sdeslength" longname="Length" size="1" showtemplate="FieldDec"/>
									<field type="variable" name="sdesnote" longname="Note about the source" expr="buf2int(sdeslength)" showtemplate="FieldAscii"/>
								</block>
							</case>
							<case value="8">
								<block name="priv" longname="Private extension">
									<field type="fixed" name="sdestype" longname="Type" size="1" showtemplate="rtcp.sdestype"/>
									<field type="fixed" name="sdeslength" longname="Length" size="1" showtemplate="FieldDec"/>
									<field type="fixed" name="sdespreflength" longname="Prefix Length" size="1" showtemplate="FieldDec"/>
									<field type="variable" name="sdesprefstring" longname="Prefix string" expr="buf2int(sdespreflength)" showtemplate="FieldAscii"/>
									<field type="variable" name="sdesvaluestring" longname="Value string" expr="buf2int(sdeslength)" showtemplate="FieldAscii"/>
								</block>
							</case>
							<default>
									<loopctrl type="break"/>
							</default>
						</switch>
					</loop>
				</block>		
			</loop>
		</block>

		<block name="bye" longname="Goodbye (BYE)">
			<field type="bit" name="ver" longname="Version" description="Always set to 2" mask="0xC0" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="pad" longname="Padding" description="Set to enable padding" mask="0x20" size="1" showtemplate="FieldBin"/>
			<field type="bit" name="rc" longname="Reception Report Count" mask="0x1F" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="rtcp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="byeinfo" longname="Bye Information" expr="(buf2int(length) + 1) * 4" showtemplate="Field4BytesHex"/>
		</block>

		<block name="app" longname="Application Defined (APP)">
			<field type="bit" name="ver" longname="Version" description="Always set to 2" mask="0xC0" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="pad" longname="Padding" description="Set to enable padding" mask="0x20" size="1" showtemplate="FieldBin"/>
			<field type="bit" name="rc" longname="Reception Report Count" mask="0x1F" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="type" longname="Type" size="1" showtemplate="rtcp.type"/>
			<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="ssrc" longname="SSRC" description="Sync Source ID" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="appinfo" longname="APP Information" expr="(buf2int(length) + 1) * 4" showtemplate="Field4BytesHex"/>
		</block>

	</format>

	<visualization>
		<showsumtemplate name="rtcp">
			<section name="next"/>
			<text value="RTCP"/>
		</showsumtemplate>

		<showtemplate name="rtcp.type" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="200" show="Sender Report">			</case>
					<case value="201" show="Receiver Report">		</case>
					<case value="202" show="Sender Description">	</case>
					<case value="203" show="Bye">					</case>
					<case value="204" show="Application Defined">	</case>
					<default show="Error in RTCP.Type: value not recognized">		</default>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="rtcp.sdestype" showtype="dec">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="END">		</case>
					<case value="1" show="CNAME">	</case>
					<case value="2" show="NAME">	</case>
					<case value="3" show="EMAIL">	</case>
					<case value="4" show="PHONE">	</case>
					<case value="5" show="LOC">		</case>
					<case value="6" show="TOOL">	</case>
					<case value="7" show="NOTE">	</case>
					<case value="7" show="PRIV">	</case>
					<default show="Error in RTCP.SdesType: value not recognized">		</default>
				</switch>
			</showmap>
		</showtemplate>
	</visualization>
</protocol>
<protocol name="rtp" longname="RTP (Real Time Protocol)" showsumtemplate="rtp">
	<execute-code>
		<verify>

			<if expr="(buf2int($packet[$currentoffset:1]) bitwand 0xC0) == 0x80">
				<if-true>

					<if expr="checklookuptable($rtptable, $ipsrc, $ipdst, $portsrc, $portdst)">
						<if-true>

							<if expr="$rtptable.ssrc == $packet[$currentoffset + 8 : 4]">
								<if-true>
									<assign-variable name="$protoverify_result" value="%FOUND"/>
								</if-true>

								<if-false>
									<assign-variable name="$protoverify_result" value="%NOTFOUND"/>

									<!-- We should avoid code that updates variables here unless we're 100% sure that this code must be executed. -->
									<!-- Please check the NetPDL documentation for more details. -->
									<!-- However, this is a case in which we're 100% sure :-) -->

									<update-lookuptable name="$rtptable" action="purge">
										<lookupkey value="$ipsrc"/>
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portsrc"/>
										<lookupkey value="$portdst"/>
									</update-lookuptable>
								</if-false>
							</if>
						</if-true>

						<if-false>
							<assign-variable name="$protoverify_result" value="%DEFERRED"/>
						</if-false>
					</if>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<!-- Add RTP stream -->
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="10" hittime="10">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#rtp"/>
			</update-lookuptable>

			<!-- Add companion RTCP stream -->
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="int2buf(buf2int($portsrc) + 1, 2)"/>
				<lookupkey value="int2buf(buf2int($portdst) + 1, 2)"/>
				<lookupdata value="#rtcp"/>
			</update-lookuptable>

			<update-lookuptable name="$rtptable" action="purge">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
			</update-lookuptable>
		</before>

		<before when="$protoverify_result == %DEFERRED">
			<update-lookuptable name="$rtptable" action="add" validity="updateonhit" keeptime="10" hittime="10">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="$packet[$currentoffset + 8 : 4]"/>
			</update-lookuptable>

			<!-- We do not add RTCP in case of 'deferred'; we'll add the RTCP session only when we're sure we have an RTP stream -->
			<!-- With this choice, we may have some RTCP packets that are not recognized (the ones that arrive -->
			<!-- when the RTP session is still in the "deferred" state; however, this is rather uncommon -->
		</before>
	</execute-code>
	<format>
		<fields>
			<field type="bit" name="ver" longname="Version" description="Always set to 2" mask="0xC0" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="pad" longname="Padding" description="Set to enable padding" mask="0x20" size="1" showtemplate="FieldBin"/>
			<field type="bit" name="ext" longname="Extension" mask="0x10" size="1" showtemplate="FieldBin"/>
			<field type="bit" name="cc" longname="CSRC Count" description="Number of CSRC Identifiers" mask="0x0F" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="mar" longname="Marker" mask="0x80" size="1" showtemplate="FieldDec"/>
			<field type="bit" name="pt" longname="Payload Type" description="Format of RTP payload" mask="0x7F" size="1" showtemplate="rtp.pt"/>
			<field type="fixed" name="sn" longname="Sequence Number" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="ts" longname="TimeStamp" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="ssrc" longname="SSRC synchronization Source" size="4" showtemplate="FieldHex"/>

			<block name="csrc" longname="CSRC List">
				<loop type="times2repeat" expr="buf2int(cc)">
					<field type="fixed" name="csrc" longname="Source CSRC" size="4" showtemplate="FieldDec"/>
				</loop>
			</block>

			<field type="variable" name="media" longname="Media Data" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>

		</fields>
	</format>

	<visualization>
		<showsumtemplate name="rtp">

			<section name="next"/>
			<text value="RTP: Seq "/>
			<protofield name="sn" showdata="showvalue"/>
			<text value=", Media type "/>
			<protofield name="pt" showdata="showvalue"/>
			<text value=" ("/>
			<protofield name="pt" showdata="showmap"/>
			<text value=")"/>
			<if expr="$protoverify_result == %DEFERRED">
				<if-true>
					<text value=" (Candidate)"/>
				</if-true>
			</if>
		</showsumtemplate>

		<showtemplate name="rtp.pt" showtype="dec">
			<!-- http://www.iana.org/assignments/rtp-parameters -->
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0" show="PCMU (Audio, 8KHz, 1 Channel)"/> 
					<case value="3" show="GSM (Audio, 8KHz, 1 Channel)"/> 
					<case value="4" show="G723 (Audio, 8KHz, 1 Channel)"/> 
					<case value="5" show="DVI4 (Audio, 8KHz, 1 Channel)"/> 
					<case value="6" show="DVI4 (Audio, 16KHz, 1 Channel)"/> 
					<case value="7" show="LPC (Audio, 8KHz, 1 Channel)"/> 
					<case value="8" show="PCMA (Audio, 8KHz, 1 Channel)"/> 
					<case value="8" show="PCMA (Audio, 8KHz, 1 Channel)"/> 
					<case value="9" show="G722 (Audio, 8KHz, 1 Channel)"/> 
					<case value="10" show="L16 (Audio, 44.1KHz, 2 Channels)"/> 
					<case value="11" show="L16 (Audio, 44.1KHz, 1 Channel)"/> 
					<case value="12" show="QCELP (Audio, 8KHz, 1 Channel)"/> 
					<case value="13" show="CN (Audio, 8KHz, 1 Channel)"/> 
					<case value="14" show="MPA (Audio, 90KHz, 1 Channel)"/> 
					<case value="15" show="G728 (Audio, 8KHz, 1 Channel)"/> 
					<case value="16" show="DVI4 (Audio, 11.025KHz, 1 Channel)"/> 
					<case value="17" show="DVI4 (Audio, 22,05KHz, 1 Channel)"/> 
					<case value="18" show="G729 (Audio, 8KHz, 1 Channel)"/> 
					<case value="25" show="CelB (Video, 90KHz)"/> 
					<case value="26" show="JPEG (Video, 90KHz)"/> 
					<case value="28" show="nv (Video, 90KHz)"/> 
					<case value="31" show="H261 (Video, 90KHz)"/> 
					<case value="32" show="MPV (Video, 90KHz)"/> 
					<case value="33" show="MP2T (Audio Video, 90KHz)"/> 
					<case value="34" show="H263 (Video, 90KHz)"/> 
					<case value="96" maxvalue="127" show="Dynamically negotiated"/> 
					<default show="Payload type not recognized"/> 
				</switch>
			</showmap>
		</showtemplate>
	</visualization>
</protocol>

<protocol name="auth" longname="Authentication Service" showsumtemplate="auth">
	<format>
		<fields>
			<if expr="hasstring($packet[$currentoffset : 0], '[0-9]*,[0-9]*\x0D\x0A',0)">
				<if-true>
					<field type="line" name="request" longname="Request" showtemplate="FieldAscii">
						<field type="tokenended" name="local_port" longname="Local Port" endtoken="," endoffset="$token_fieldlen" enddiscard ="1" showtemplate="FieldAscii"/>
						<!--<field type="tokenended" name="foreign_port" longname="Foreign Port" endtoken="\x0d\x0a|:" endoffset="$token_fieldlen" enddiscard="$token_endtlen"   showtemplate="FieldAscii"/>-->
						<field type="tokenended" name="foreign_port" longname="Foreign Port" endtoken="\x0D" endoffset="$token_fieldlen"  showtemplate="FieldAscii"/>
					</field>
				</if-true>
				
				<if-false>
					<field type="line" name="response" longname="Response" showtemplate="FieldAscii">
						<field type="tokenwrapped" name="response_type" longname="Response Type" begintoken=" : " endtoken=" : "  beginoffset="$token_begintlen" endoffset="$token_begintlen + $token_fieldlen" enddiscard ="$token_endtlen" showtemplate="FieldAscii"/>
						<field type="variable" name="add_info" longname="Additional Info" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
						<field type="variable" name="Data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>					
					</field>
				</if-false>
			</if>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="auth">
			<section name="next"/>
			<text value="Authentication Service"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="cldap" longname="Connection-Less Lightweight Directory Access Protocol (CLDAP)" showsumtemplate="cldap">
	<execute-code>
		<verify>
													<!-- sequence   messegeID      type op  -->			
			<if expr="hasstring($packet[$currentoffset:0],'\x30(.|\x0a){1,5}\x02[\x01\x02\x03](.|\x0a){1,3}[\x63\x64\x6f]',0) and ((($packetlength - $currentoffset - 2) == buf2int($packet[$currentoffset +1:1])) or (((buf2int($packet[$currentoffset+1 : 1]) bitwand 0x80  !=0) and (($packetlength - $currentoffset - 2 - (buf2int ($packet[$currentoffset +1 : 1]) bitwand 0x7F)) == buf2int ($packet[$currentoffset + 2 : buf2int($packet[$currentoffset + 1 : 1]) bitwand 0x7F ])))))">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#cldap"/>
			</update-lookuptable>

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#cldap"/>
			</update-lookuptable>
		</before>		
	</execute-code>
	
	<format>
		<fields>
			<field type="variable" name="data" longname="CLDAP Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
			<!--<field type="fixed" name="ldapdata" longname="LDAP Data" size="100" showtemplate="FieldAscii"/>-->
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="cldap">
			<section name="next"/>
			<text value="CLDAP"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="icp" longname="Internet Cache Protocol" showsumtemplate="icp">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '^([\0-\x04]|[\x0a\x0b]|[\x15-\x17])\x02', 0) and (($packetlength - $currentoffset) == buf2int($packet[$currentoffset + 2: 2 ]))">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>
		
		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#icp"/>
			</update-lookuptable>

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#icp"/>
			</update-lookuptable>
		</before>
	</execute-code>	
	
	<format>
		<fields>
			<field type="fixed" name="opcode" longname="Op Code" size="1" showtemplate="icp.opcode"/>
			<field type="fixed" name="version" longname="Version" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="message_length" longname="Message Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="request_number" longname="Request Number" size="4" showtemplate="FieldDec"/>
			<field type="fixed" name="options" longname="Options" size="4" showtemplate="FieldHex">
				<field type="bit" name="ipc_flag_hit_obj" longname="IPC_FLAG_HIT_OBJ" mask="0x80000000" size="4" showtemplate="FieldBin"/>
				<field type="bit" name="ipc_flag_src_rtt" longname="IPC_FLAG_SRC_RTT" mask="0x40000000" size="4" showtemplate="FieldBin"/>
			</field>	
			<field type="fixed" name="option_data" longname="Option Data" size="4" showtemplate="FieldHex"/>
			<field type="fixed" name="sender_host_address" longname="Sender Host Address" size="4" showtemplate="ip4addr"/>
			<switch expr="buf2int(opcode)">
				
				<case value="0x01">
					<field type="fixed" name="requester_host" longname="Requester Host Address" size="4" showtemplate="ip4addr"/>
					<field type="tokenended" name="url" longname="URL" endtoken="\0" showtemplate="FieldAscii"/>
				</case>
				
				<default>
					<field type="variable" name="payload" longname="Payload" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
				</default>
			</switch>
			
		</fields>
	</format>
				
	<visualization>

		<showtemplate name="icp.opcode" showtype="hex">
			<showmap>
				<switch expr="buf2int(this[0:1])">
					<case value="0x00" show="ICP_OP_INVALID"></case>
					<case value="0x01" show="ICP_OP_QUERY"></case>
					<case value="0x02" show="ICP_OP_HIT"></case>
					<case value="0x03" show="ICP_OP_MISS"></case>
					<case value="0x04" show="ICP_OP_ERR"></case>
					<case value="0x0a" show="ICP_OP_SECHO"></case>
					<case value="0x0b" show="ICP_OP_DECHO"></case>
					<case value="0x15" show="ICP_OP_MISS_NOFETCH"></case>
					<case value="0x16" show="ICP_OP_DENIED"></case>
					<case value="0x17" show="ICP_OP_HIT_OBJ"></case>
					<default show="Unkown messagge"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showsumtemplate name="icp">
			<section name="next"/>
			<text value="Inernet Cache Protocol (ICP) "/>
			
			<text value="Request Number: "/> <protofield name="request_number" showdata="showvalue"/>
			<text value=" Op Code: "/> <protofield name="opcode" showdata="showmap"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="ipp" longname="Internet Printing Protocol" showsumtemplate="ipp">
	<format>
		<fields>
			<field type="variable" name="ippdata" longname="IPP Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>	
		<showsumtemplate name="ipp">
			<section name="next"/>
			<text value="IPP"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="isakmp" longname="ISAKMP" showsumtemplate="isakmp">
	<format>
		<fields>
			<block name="header" longname="Header ISAKMP">
				<field type="fixed" name="initiator_cookie" longname="Initiator Cookie" size="8" showtemplate="FieldHex"/>
				<field type="fixed" name="responder_cookie" longname="Responder Cookie" size="8" showtemplate="FieldHex"/>
				<field type="fixed" name="next_payload" longname="Next Payload" size="1" showtemplate="isakmp.payload.type"/>
				<field type="fixed" name="version" longname="Version" size="1" showtemplate="FieldHex">
					<field type="bit" name="major" longname="Major" mask="0xf0" size="1" showtemplate="FieldDec"/>
					<field type="bit" name="minor" longname="Minor" mask="0x0f" size="1" showtemplate="FieldDec"/>
				</field>
					
				<field type="fixed" name="exchange_type" longname="Exchanghe type" size="1" showtemplate="isakmp.exchange.type"/>
				<field type="fixed" name="flags" longname="Flags"  size="1" showtemplate="FieldHex">
					<field type="bit" name="authentication" longname="Authentication" mask="0x04" size="1" showtemplate="FieldBin"/>
					<field type="bit" name="commit" longname="Commit" mask="0x02" size="1" showtemplate="FieldBin"/>
					<field type="bit" name="encryption" longname="Encryption" mask="0x01" size="1" showtemplate="FieldBin"/>					
				</field>
					
				<field type="fixed" name="messageid" longname="Message ID" size="4" showtemplate="FieldDec"/>
				<field type="fixed" name="length" longname="Length" size="4" showtemplate="FieldDec"/>			
			</block>
			
			<if expr="(buf2int(flags) bitwand 0x01) == 0x01">
				<if-true>
					<!-- payload is encrypted -->
					<field type="variable" name="encrypted_payload" longname="Encrypted Payload" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
				</if-true>
				<if-false>
					<loop type="size" expr="$packetlength - $currentoffset">
						<switch expr="buf2int(next_payload)">
							<case value="0x01">	<includeblk name="sa"/>	</case>
							<case value="0x02">	<includeblk name="proposal"/> </case>
							<case value="0x03">	<includeblk name="transform"/> </case>
							<case value="0x04">	<includeblk name="key_exchange"/> </case>
							<case value="0x05">	<includeblk name="identification"/>	</case>
							<case value="0x06">	<includeblk name="certificate"/> </case>
							<case value="0x07">	<includeblk name="certificate_request"/> </case>
							<case value="0x08">	<includeblk name="hash"/> </case>
							<case value="0x09">	<includeblk name="signature"/> </case>
							<case value="0x0a">	<includeblk name="nonce"/> </case>
							<case value="0x0b">	<includeblk name="notification"/> </case>
							<case value="0x0c">	<includeblk name="delete"/>	</case>
							<case value="0x0d">	<includeblk name="vendor"/>	</case>				
						</switch>
					</loop>
				</if-false>
				
			</if>
			
			<!--<field type="variable" name="payload" longname="Payload" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>-->
		
		</fields>
		
		<block name="header_payload" longname="Header Payload">
			<field type="fixed" name="next_payload" longname="Next Payload" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="reserved" longname="Reserved" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="payload_length" longname="Payload Length" size="2" showtemplate="FieldDec"/>
		</block>
		
		<block name="sa" longname="Security Association Payload">
			<includeblk name="header_payload"/>
			<field type="fixed" name="doi" longname="DOI" size="4" showtemplate="FieldAscii"/>
			<field type="variable" name="situation" longname="Situation" expr="buf2int(payload_length) - 8" showtemplate="FieldAscii"/>
		</block>
		
		<block name="proposal" longname="Proposal Payload">
			<includeblk name="header_payload"/>
			<field type="fixed" name="proposal_number" longname="Proposal #" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="protocol_id" longname="Protocol ID" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="spi_size" longname="SPI size" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="number_transfom" longname="# of Transform" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="spi" longname="SPI" expr="buf2int(payload_length) - 8" showtemplate="FieldAscii"/>
		</block>
		
		<block name="transform" longname="Transform Payload">
			<includeblk name="header_payload"/>
			<field type="fixed" name="transform_number" longname="Transform #" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="transform_id" longname="Transform ID" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="reserved" longname="Reserved" size="2" showtemplate="FieldDec"/>
			<field type="variable" name="sa_attributes" longname="SA Attributes" expr="buf2int(payload_length) - 8" showtemplate="FieldAscii"/>
		</block>

		<block name="key_exchange" longname="Key Exchange Payload">
			<includeblk name="header_payload"/>
			<field type="variable" name="kex_data" longname="Key Exchange Data" expr="buf2int(payload_length) -4" showtemplate="FieldAscii"/>
		</block>
		
		<block name="identification" longname="Identification Payload">
			<includeblk name="header_payload"/>
			<field type="fixed" name="id_type" longname="ID Type" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="doi_specification_id_data" longname="DOI Specification ID Data" size="3" showtemplate="FieldAscii"/>
			<field type="variable" name="identification_data" longname="Identification Data" expr="buf2int(payload_length)-8" showtemplate="FieldAscii"/>
		</block>
		
		<block name="certificate" longname="Certificate Payload">
			<includeblk name="header_payload"/>
			<field type="fixed" name="cert_encoding" longname="Certificate Encoding" size="1" showtemplate="isakmp.cert.type"/>
			<field type="variable" name="certifcate_data" longname="Certificate Data" expr="buf2int(payload_length) -5" showtemplate="FieldAscii"/>
		</block>
		
		<block name="certificate_request" longname="Certificate Request Payload">
			<includeblk name="header_payload"/>
			<field type="fixed" name="cert_type" longname="Certificate type" size="1" showtemplate="isakmp.cert.type"/>
			<field type="variable" name="certifcate_autority" longname="Certificate Autority" expr="buf2int(payload_length) -5" showtemplate="FieldAscii"/>
		</block>
		
		<block name="hash" longname="Hash Payload">
			<includeblk name="header_payload"/>
			<field type="variable" name="hash_data" longname="Hash Data" expr="buf2int(payload_length) -4" showtemplate="FieldAscii"/>
		</block>
		
		<block name="signature" longname="Signature Payload">
			<includeblk name="header_payload"/>
			<field type="variable" name="signature_data" longname="Signature Data" expr="buf2int(payload_length) -4" showtemplate="FieldAscii"/>
		</block>
		
		<block name="nonce" longname="Nonce Payload">
			<includeblk name="header_payload"/>
			<field type="variable" name="nonce_data" longname="Nonce Data" expr="buf2int(payload_length) -4" showtemplate="FieldAscii"/>
		</block>
		
		<block name="notification" longname="Notification Payload">
			<includeblk name="header_payload"/>
			<field type="fixed" name="doi" longname="DOI" size="4" showtemplate="FieldAscii"/>
			<field type="fixed" name="protocol_id" longname="Protocol ID" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="spi_size" longname="SPI Size" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="notify_message_type" longname="Notify Message Type" size="2" showtemplate="isakmp.notify.type"/>
			<field type="variable" name="spi" longname="SPI" expr="buf2int(spi_size)" showtemplate="FieldAscii"/>
			<field type="variable" name="notification_data" longname="Notification Data" expr="buf2int(payload_length) - buf2int(spi_size) - 12" showtemplate="FieldAscii"/>
		</block>
		
		<block name="delete" longname="Delete Payload">
			<includeblk name="header_payload"/>
			<field type="fixed" name="doi" longname="DOI" size="4" showtemplate="FieldAscii"/>
			<field type="fixed" name="protocol_id" longname="Protocol ID" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="spi_size" longname="SPI Size" size="1" showtemplate="FieldDec"/>
			<field type="fixed" name="number_spis" longname="# of SPIs" size="1" showtemplate="FieldDec"/>
			<!--<field type="variable" name="security_parameter_index" longname="Security Parameter Index" expr="buf2int(spi_size) * buf2int(number_spis)" showtemplate="FieldAscii"/>-->
			<field type="variable" name="security_parameter_index" longname="Security Parameter Index" expr="buf2int(payload_length) - 11" showtemplate="FieldAscii"/>
		</block>
		
		<block name="vendor" longname="Vendor Payload">
			<includeblk name="header_payload"/>
			<field type="variable" name="vendor_id" longname="Vendor ID" expr="buf2int(payload_length) -4" showtemplate="FieldAscii"/>
		</block>
		
		<block name="dataattribute" longname="Data Attribute">
			<loop type="while" expr="$packetlength - $currentoffset - buf2int(payload_length) - 8">
				<field type="bit" name="attribute_format" longname="AF" mask="0x8000" size="2" showtemplate="FieldBin"/>
				<field type="bit" name="attribute_type" longname="Attribute Type" mask="0x7FFFF" size="2" showtemplate="FieldBin"/>
				
				<!--<if expr="buf2int(attribute_format) bitwand 0x8000 == 0x8000">-->
				<if expr="buf2int(attribute_format)">
					<if-true>
						<field type="fixed" name="attribute_value" longname="Attribute Value" size="2" showtemplate="FieldAscii"/>
					</if-true>
					<if-false>
						<field type="fixed" name="attribute_length" longname="Attribute Length" size="2" showtemplate="FieldAscii"/>
						<field type="variable" name="attribute_value" longname="Attribute Value" expr="buf2int(attribute_value)" showtemplate="FieldAscii"/>
					</if-false>
				</if>

			</loop>
		</block>
	</format>
	
	
	<visualization>
		<showtemplate name="isakmp.payload.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this[0:1])">
					<case value="0x01" show="Security Association"></case>
					<case value="0x02" show="Proposal"></case>
					<case value="0x03" show="Transform"></case>
					<case value="0x04" show="Key Exchange"></case>
					<case value="0x05" show="Identification"></case>
					<case value="0x06" show="Certificate"></case>
					<case value="0x07" show="Certificate Request"></case>
					<case value="0x08" show="Hash"></case>
					<case value="0x09" show="Signature"></case>
					<case value="0x0a" show="Nonce"></case>
					<case value="0x0b" show="Notification"></case>
					<case value="0x0c" show="Delete"></case>
					<case value="0x0d" show="Vendor ID"></case>
					<default show="Unkown messagge"/>
				</switch>
			</showmap>
		</showtemplate>

		<showtemplate name="isakmp.exchange.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this[0:1])">
					<case value="0x00" show="NONE"></case>
					<case value="0x01" show="Base"></case>
					<case value="0x02" show="Identify Protection"></case>
					<case value="0x03" show="Authentication Only"></case>
					<case value="0x04" show="Aggressive"></case>
					<case value="0x05" show="Informal"></case>
					<default show="Unkown messagge"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="isakmp.cert.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this[0:1])">
					<case value="0x00" show="NONE"></case>
					<case value="0x01" show="PKCS #7"></case>
					<case value="0x02" show="PGP"></case>
					<case value="0x03" show="DSN Signed Key"></case>
					<case value="0x04" show="X.509 Certificate - Signature"></case>
					<case value="0x05" show="X.509 Certificate - Key Exchange"></case>
					<case value="0x06" show="Kerberos Tokens"></case>
					<case value="0x07" show="Certificate Revocation List (CRL)"></case>
					<case value="0x08" show="Authority Revocation List (ARL)"></case>
					<case value="0x09" show="SPKI Certificate"></case>
					<case value="0x0a" show="X.509 Certificate - Attribute"></case>
					<default show="RESERVED"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showtemplate name="isakmp.notify.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x0001" show="INVALID-PAYLOAD-TYPE"></case>
					<case value="0x0002" show="DOI-NOT-SUPPORTED"></case>
					<case value="0x0003" show="SITUATION-NOT-SUPPORTED"></case>
					<case value="0x0004" show="INVALID-COOKIE"></case>
					<case value="0x0005" show="INVALID-MAJOR-VERSION"></case>
					<case value="0x0006" show="INVALID-MINOR-VERSION"></case>
					<case value="0x0007" show="INVALID-EXCHANGE-TYPE"></case>
					<case value="0x0008" show="INVALID-FLAGS"></case>
					<case value="0x0009" show="INVALID-MESSAGE-ID"></case>
					<case value="0x000a" show="INVALID-PROTOCOL-ID"></case>
					<case value="0x000b" show="INVALID-SPI"></case>
					<case value="0x000c" show="INVALID-TRANSFORM-ID"></case>
					<case value="0x000d" show="ATTRIBUTES-NOT-SUPPORTED"></case>
					<case value="0x000e" show="NO-PROPOSAL-CHOSEN"></case>
					<case value="0x000f" show="BAD-PROPOSAL-SYNTAX"></case>
					
					<case value="0x0010" show="PAYLOAD-MALFORMED"></case>
					<case value="0x0011" show="INVALID-KEY-INFORMATION"></case>
					<case value="0x0012" show="INVALID-ID-INFORMATION"></case>
					<case value="0x0013" show="INVALID-CERT-ENCODING"></case>
					<case value="0x0014" show="INVALID-CERTIFICATE"></case>
					<case value="0x0015" show="CERT-TYPE-UNSUPPORTED"></case>
					<case value="0x0016" show="INVALID-CERT-AUTHORITY"></case>
					<case value="0x0017" show="INVALID-HASH-INFORMATION"></case>
					<case value="0x0018" show="AUTHENTICATION-FAILED"></case>
					<case value="0x0019" show="INVALID-SIGNATURE"></case>
					<case value="0x001a" show="ADDRESS-NOTIFICATION"></case>
					<case value="0x001b" show="NOTIFY-SA-LIFETIME"></case>
					<case value="0x001c" show="CERTIFICATE-UNAVAILABLE"></case>
					<case value="0x001d" show="UNSUPPORTED-EXCHANGE-TYPE"></case>
					<case value="0x001e" show="UNEQUAL-PAYLOAD-LENGTHS"></case>
					
					<case value="0x4000" show="CONNECTED"></case>

					<default show="RESERVED"/>
				</switch>
			</showmap>
		</showtemplate>
		<showsumtemplate name="isakmp">
			<section name="next"/>
			<text value="ISAKMP "/>
			<protofield name="exchange_type" showdata="showmap"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="jrmi" longname="Java Remote Method Invocation" showsumtemplate="jrmi">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0],'JRMI\0[\x01\x02][\x4b\x4c\x4d]',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#jrmi"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#jrmi"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#jrmi"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>		
	</execute-code>
	
	<format>
		<fields>
			<field type="variable" name="jrmidata" longname="JRMI Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="jrmi">
			<section name="next"/>
			<text value="JRMI"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="ldap" longname="Lightweight Directory Access Protocol (LDAP)" showsumtemplate="ldap">
	<execute-code>
		<verify>
													     <!-- sequence              messegeID               bind/search  -->			
<!--			<if expr="hasstring($packet[$currentoffset:0],'^\x30(.|\x0a){1,5}\x02[\x01\x02\x03](.|\x0a){1,3}[\x60\x63]',0) and ((($packetlength - $currentoffset - 2) == buf2int($packet[$currentoffset +1:1])) or (((buf2int($packet[$currentoffset+1 : 1]) bitwand 0x80  !=0) and (($packetlength - $currentoffset - 2 - (buf2int ($packet[$currentoffset +1 : 1]) bitwand 0x7F)) == buf2int ($packet[$currentoffset + 2 : buf2int($packet[$currentoffset + 1 : 1]) bitwand 0x7F ])))))">-->
			<!-- in some case bind message is splitted in two or more pkts then length check don't work! -->
			<if expr="hasstring($packet[$currentoffset:0],'^\x30(.|\x0a){1,5}\x02[\x01\x02\x03](.|\x0a){1,3}[\x60\x63]',0)">

				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#ldap"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#ldap"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#ldap"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>		
	</execute-code>
	
	<format>
		<fields>
			<field type="variable" name="data" longname="LDAP Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
			<!--<field type="fixed" name="ldapdata" longname="LDAP Data" size="100" showtemplate="FieldAscii"/>-->
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="ldap">
			<section name="next"/>
			<text value="LDAP"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="rdp" longname="Remote Desktop Protocol" showsumtemplate="rdp">
	<execute-code>
		<verify>
			<!--<if expr="hasstring($packet[$currentoffset:0], 'rdpdr.*cliprdr.*rdpsnd|.*cliprdr.*',0)">-->
			<!--<if expr="hasstring($packet[$currentoffset:0], '^\x03\0...(\xe0|\xd0).*(\x0d\x0a)$',0) and (($packetlength - $currentoffset)== buf2int($packet[$currentoffset+2:2]))">-->
			<!--<if expr="hasstring($packet[$currentoffset:0], '^\x03\0...(\xe0|\xd0).*(\x0d\x0a)$',0) and (($packetlength - $currentoffset)== buf2int($packet[$currentoffset+2:2]))">-->
			<if expr="hasstring($packet[$currentoffset:0], '^\x03\0(.|\x0a){1,3}(\xe0|\xd0)',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#rdp"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#rdp"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#rdp"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>
	
	<format>
		<fields>
			<field type="variable" name="rdpdata" longname="RDP Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="rdp">
			<section name="next"/>
			<text value="RDP"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="ssdp" longname="SSDP" showsumtemplate="ssdp">
	<execute-code>
		<verify>
			<!-- header has fixed length (20 bytes)-->
			<if expr="hasstring($packet[$currentoffset:0],'^notify[\x09-\x0d ]\*[\x09-\x0d ]http/1\.1[\x09-\x0d -~]*ssdp:(alive|byebye)|^m-search[\x09-\x0d ]\*[\x09-\x0d ]http/1\.1[\x09-\x0d -~]*ssdp:discover',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#ssdp"/>
			</update-lookuptable>

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#ssdp"/>
			</update-lookuptable>
		</before>
	</execute-code>
	
	<format>
		<fields>
			<field type="variable" name="ssdpdata" longname="SSDP Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>	
		<showsumtemplate name="ssdp">
			<section name="next"/>
			<text value="SSDP"/>
		</showsumtemplate>
	</visualization>
	
</protocol>

<protocol name="ssh" longname="Secure Shell (SSH)" showsumtemplate="ssh">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '^ssh-[12]\.[0-9]',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>
		
		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#ssh"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#ssh"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#ssh"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>

		<!-- if first four bytes matchs again length of packet, packet isn't encrypted -->
		<before when="buf2int($packet[$currentoffset : 4]) == ($packetlength - $currentoffset -4)">
			<if expr="checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
				<if-true>
					<assign-lookuptable name="$tcpsessiontable.flag" value="0"/>
				</if-true>
			</if>
		</before>

		<!-- next messages are encrypted -->
		<!-- set a flag of two entrys -->
		<after when="ispresent(type_payload) and buf2int(type_payload) == 0x15">
			<if expr="checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport)">
				<if-true>
					<assign-lookuptable name="$tcpsessiontable.flag" value="1"/>
				</if-true>
			</if>
		</after>
	</execute-code>
	
	<format>
		<fields>
			<if expr="checklookuptable($tcpsessiontable, $firstip, $secondip, $firstport, $secondport) and $tcpsessiontable.flag == 1">
				<if-true>
					<field type="variable" name="encrypted" longname="Encrypted Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
				</if-true>
				
				<if-false>
					<if expr ="not hasstring($packet[$currentoffset:0], '^ssh-[12]\.[0-9]',0)">
						<if-true>
							<field type="fixed" name="length" longname="Packet Legnth" size="4" showtemplate="FieldDec"/>
							<field type="fixed" name="lengthpad" longname="Padding Legnth" size="1" showtemplate="FieldDec"/>
						
							
							<switch expr="buf2int($packet[$currentoffset  : 1])">
								<case value="0x14">	<includeblk name="kexinit"/> </case>
								<case value="0x15">	<includeblk name="newkeys"/> </case>
								<case value="0x1F">	<includeblk name="keyexchange"/> </case>
								<case value="0x1E">	<includeblk name="keyexchange"/> </case>
								<case value="0x20">	<includeblk name="keyexchange"/> </case>
								<case value="0x21">	<includeblk name="keyexchange"/> </case>
								<case value="0x22">	<includeblk name="keyexchange"/> </case>
								<default>
									<field type="variable" name="pay" longname="Payload" expr="buf2int(length) - buf2int(lengthpad)-1" showtemplate="FieldAscii">
										<field type="fixed" name="type_payload" longname="Type Payload" size="1" showtemplate="ssh.payload_type"/>
										<field type="variable" name="pay" longname="Payload" expr="buf2int(length) - buf2int(lengthpad)-1 - 1" showtemplate="FieldAscii"/>
									</field>
								</default>
							</switch>	
							
							<field type="variable" name="pad" longname="Padding" expr="buf2int(lengthpad)" showtemplate="FieldAscii"/>
							<field type="variable" name="mac" longname="MAC" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
						</if-true>
						<if-false>
							<field type="variable" name="version_exchange" longname="Version Exchange" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
						</if-false>
					</if>
					<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
				</if-false>
			</if>


		</fields>
		
		
		<block name="keyexchange" longname="Key Exchange">
			<field type="fixed" name="type_payload" longname="Type Payload" size="1" showtemplate="ssh.payload_type"/>
			<field type="variable" name="pay" longname="Payload" expr="buf2int(length) - buf2int(lengthpad)- 1 -1" showtemplate="FieldAscii"/>
		</block>
		
		<block name="newkeys" longname="New Keys">
			<field type="fixed" name="type_payload" longname="Type Payload" size="1" showtemplate="ssh.payload_type"/>
		</block>
		
		<block name="kexinit" longname="Key Exchange">
			<field type="fixed" name="type_payload" longname="Type Payload" size="1" showtemplate="ssh.payload_type"/>
			<field type="fixed" name="cookie" longname="Cookie" size="16" showtemplate="FieldHex"/>
			<!-- list of algoritm -->
			<field type="fixed"		name="kex_algorithms_length"							longname="Kex Algorithms Length" size="4" showtemplate="FieldDec"/>
			<field type="variable"	name="kex_algorithms"									longname="Kex Algorithms" expr="buf2int(kex_algorithms_length)" showtemplate="FieldAscii"/>
			
			<field type="fixed"		name="server_host_key_algorithms_length"				longname="Server Host Key Algorithms Length" size="4" showtemplate="FieldDec"/>
			<field type="variable"	name="server_host_key_algorithms"						longname="Server Host Key Algorithms " expr="buf2int(server_host_key_algorithms_length)" showtemplate="FieldAscii"/>

			<field type="fixed"		name="encryption_algorithms_client_to_server_length"	longname="Encryption Algorithms Client to Server Length" size="4" showtemplate="FieldDec"/>
			<field type="variable"	name="encryption_algorithms_client_to_server"			longname="Encryption Algorithms Client to Server" expr="buf2int(encryption_algorithms_client_to_server_length)" showtemplate="FieldAscii"/>

			<field type="fixed"		name="encryption_algorithms_server_to_client_length"	longname="Encryption Algorithms Server to Client Length" size="4" showtemplate="FieldDec"/>
			<field type="variable"	name="encryption_algorithms_server_to_client"			longname="Encryption Algorithms Server to Client" expr="buf2int(encryption_algorithms_server_to_client_length)" showtemplate="FieldAscii"/>

			<field type="fixed"		name="mac_algorithms_client_to_server_length"			longname="MAC Algorithms Client to Server Length" size="4" showtemplate="FieldDec"/>
			<field type="variable"	name="mac_algorithms_client_to_server"					longname="MAC Algorithms Client to Server" expr="buf2int(mac_algorithms_client_to_server_length)" showtemplate="FieldAscii"/>

			<field type="fixed"		name="mac_algorithms_server_to_client_length"			longname="MAC Algorithms Server to Client Length" size="4" showtemplate="FieldDec"/>
			<field type="variable"	name="mac_algorithms_server_to_client"					longname="MAC Algorithms Server to Client" expr="buf2int(mac_algorithms_server_to_client_length)" showtemplate="FieldAscii"/>

			<field type="fixed"		name="compression_algorithms_client_to_server_length"	longname="Compression Algorithms Client to Server Length" size="4" showtemplate="FieldDec"/>
			<field type="variable"	name="compression_algorithms_client_to_server"			longname="Compression Algorithms Client to Server" expr="buf2int(compression_algorithms_client_to_server_length)" showtemplate="FieldAscii"/>

			<field type="fixed"		name="compression_algorithms_server_to_client_length"	longname="Compression Algorithms Server to Client Length" size="4" showtemplate="FieldDec"/>
			<field type="variable"	name="compression_algorithms_server_to_client"			longname="Compression Algorithms Server to Client" expr="buf2int(compression_algorithms_server_to_client_length)" showtemplate="FieldAscii"/>

			<field type="fixed"		name="languages_client_to_server_length"				longname="Languages Client_to Server Length" size="4" showtemplate="FieldDec"/>
			<field type="variable"	name="languages_client_to_server"						longname="Languages Client_to Server" expr="buf2int(languages_client_to_server_length)" showtemplate="FieldAscii"/>

			<field type="fixed"		name="languages_server_to_client_length"				longname="Languages Server to Client Length" size="4" showtemplate="FieldDec"/>
			<field type="variable"	name="languages_server_to_client"						longname="Languages Server to Client" expr="buf2int(languages_server_to_client_length)" showtemplate="FieldAscii"/>

			<field type="fixed" name="first_kex_packet_follows" longname="First Kex Packet Follows" size="1" showtemplate="FieldHex"/>
			<field type="fixed" name="reserved" longname="Reserved" size="4" showtemplate="FieldAscii"/>
		</block>
		
	</format>

	<visualization>
		<showtemplate name="ssh.payload_type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this[0:1])">
					<case value="0x01" show="SSH_MSG_DISCONNECT"></case>
					<case value="0x02" show="SSH_MSG_IGNORE"></case>
					<case value="0x03" show="SSH_MSG_UNIMPLEMENTED"></case>
					<case value="0x04" show="SSH_MSG_DEBUG"></case>
					<case value="0x05" show="SSH_MSG_SERVICE_REQUEST"></case>
					<case value="0x06" show="SSH_MSG_SERVICE_ACCEPT"></case>
					<case value="0x14" show="SSH_MSG_KEXINIT"></case>
					<case value="0x15" show="SSH_MSG_NEWKEYS"></case>
					
					<case value="0x1E" show="SSH_MSG_KEX_DH_GEX_REQUEST_OLD"></case>
					<case value="0x1F" show="SSH_MSG_KEX_DH_GEX_GROUP"></case>
					<case value="0x20" show="SSH_MSG_KEX_DH_GEX_INIT"></case>
					<case value="0x21" show="SSH_MSG_KEX_DH_GEX_REPLY"></case>
					<case value="0x22" show="SSH_MSG_KEX_DH_GEX_REQUEST"></case>
					<case value="0x23" show="SSH_MSG_KEX"></case>
					<case value="0x24" show="SSH_MSG_KEX"></case>
					<case value="0x25" show="SSH_MSG_KEX"></case>
					<case value="0x26" show="SSH_MSG_KEX"></case>
					<case value="0x27" show="SSH_MSG_KEX"></case>
					<case value="0x28" show="SSH_MSG_KEX"></case>
					<case value="0x29" show="SSH_MSG_KEX"></case>
					<case value="0x2A" show="SSH_MSG_KEX"></case>
					<case value="0x2B" show="SSH_MSG_KEX"></case>
					<case value="0x2C" show="SSH_MSG_KEX"></case>
					<case value="0x2D" show="SSH_MSG_KEX"></case>
					<case value="0x2E" show="SSH_MSG_KEX"></case>
					<case value="0x2F" show="SSH_MSG_KEX"></case>
					<case value="0x30" show="SSH_MSG_KEX"></case>
					<case value="0x31" show="SSH_MSG_KEX"></case>
					<default show="Unkown Messagge Type"/>
				</switch>
			</showmap>
		</showtemplate>
		<showsumtemplate name="ssh">
			<section name="next"/>
			<text value="Secure Shell "/>
			<if expr ="ispresent(type_payload)">
				<if-true>
					<protofield name="type_payload" showdata="showmap"/>
				</if-true>
			</if>

			<if expr ="ispresent(version_exchange)">
				<if-true>
					<protofield name="version_exchange" showdata="longname"/>
				</if-true>
			</if>
			
			<if expr="ispresent(encrypted)">
				<if-true>
					<protofield name="encrypted" showdata="longname"/>
				</if-true>
			</if>			
			
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="ssl" longname="SSL" showsumtemplate="ssl">
	<execute-code>
		<verify>
		 	<!-- SSL v2 Hello client | SSLv3 hello client, hello server, hello request -->
			<if expr="hasstring($packet[$currentoffset:0],'^(...?\x01\x03(\0|\x01))|^(\x16\x03(\0|\x01)..(\0|\x01|\x02))',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#ssl"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#ssl"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#ssl"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>
	
	<format>
		<fields>
			<if expr="hasstring($packet[$currentoffset:0],'^...?\x01\x03\0',0)">	<!-- ssl v2-->
				<if-true>
					<block name="record_layer" longname="RecordLayer">
						<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldHex"/>
						<if expr="(buf2int(length) bitwand 0x8000 ) == 0x0000">
							<if-true>
								<field type="fixed" name="padding" longname="Padding" size="1" showtemplate="FieldHex"/>	
							</if-true>
						</if>
						<includeblk name="client_hello_v2"/>
					</block>
				</if-true>
				
				<if-false>
					<!--<if expr="not(buf2int($packet[$currentoffset : 1]) == 0x14 or buf2int($packet[$currentoffset : 1]) == 0x15 or buf2int($packet[$currentoffset : 1]) == 0x16 or buf2int($packet[$currentoffset : 1])== 0x17)">-->
					<loop type="while" expr="$packetlength - $currentoffset">
						<if expr="not(buf2int($packet[$currentoffset : 1]) == 0x14 or buf2int($packet[$currentoffset : 1]) == 0x15 or buf2int($packet[$currentoffset : 1]) == 0x16 or buf2int($packet[$currentoffset : 1])== 0x17)">
							<if-true>
								<field type="variable" name="Data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
							</if-true>
							<if-false>
								<block name="record_layer" longname="RecordLayer">	
									<field type="fixed" name="content_type" longname="Content Type" size="1" showtemplate="record.content.type"/>
									<field type="fixed" name="version" longname="Version" size="2" showtemplate="FieldAscii"/>
									<field type="fixed" name="length" longname="Length" size="2" showtemplate="FieldDec"/>
										
									<switch expr="buf2int(content_type)">
										<case value="0x14"> <includeblk name="change"/></case>
										<case value="0x15"> <includeblk name="alter"/></case>
										<case value="0x17"> 
											<if expr="buf2int(length) gt ($packetlength - $currentoffset)">
												<if-true>
													<field type="variable" name="encrypted_data" longname="Encrypted Data" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
												</if-true>
												<if-false>
													<field type="variable" name="encrypted_data" longname="Encrypted Data" expr="buf2int(length)" showtemplate="Field4BytesHex"/>
												</if-false>
											</if>
										</case>
										<case value="0x16">	<includeblk name="handshake"/> </case>
										<default>
											<field type="variable" name="Data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
										</default>
									</switch>
								</block>
							</if-false>
						</if>

					</loop>						
					
				</if-false>
			</if>	
		</fields>
		
		<block name="handshake" longname="Handshake Protocol">
			<if expr="ispresent(change_field)">
				<if-true>
					<field type="variable" name="handshake_field" longname="Handshake Data (encrypted)" expr="buf2int(length)" showtemplate="FieldAscii"/>
				</if-true>
				<if-false>
					<loop type="while" expr="1">
						<field type="fixed" name="handshake_type" longname="Handshake Type" size="1" showtemplate="handshake.type"/>
						<field type="fixed" name="handshake_length" longname="Length" size="3" showtemplate="FieldDec"/>
						<switch expr="buf2int(handshake_type)">
							<case value="0x01"> <includeblk name="client_hello"/> </case>
							<case value="0x02"> <includeblk name="server_hello"/> </case>
							<case value="0x0b"> <includeblk name="certificate"/> </case>
							<case value="0x0e"> <includeblk name="server_hello_done"/> </case>
							<case value="0x10"> <includeblk name="client_key_exchange"/> </case>
							<default>
								<field type="variable" name="handshake_field" longname="Handshake Field" expr="buf2int(handshake_length)" showtemplate="FieldAscii"/>
							</default>
						</switch>
						
						<!-- multiple handshake message -->
						<!-- one record layer may contents many handshake messages -->
						<if expr="not(buf2int($packet[$currentoffset+0:1]) == 0x01 or buf2int($packet[$currentoffset+0:1]) == 0x02 or buf2int($packet[$currentoffset+0:1]) == 0x0b or buf2int($packet[$currentoffset+0:1]) == 0x0e) ">
							<if-true>
								<loopctrl type="break"/>
							</if-true>
						</if>
					</loop>				
				</if-false>
			</if>
		</block>
		
		<block name="client_key_exchange">
			<field type="variable" name="key_exchange" longname="Key Exchange" expr="buf2int(handshake_length)" showtemplate="FieldAscii"/>
		</block>
		
		<block name="change" longname="Change Cipher Spec">
			<field type="variable" name="change_field" longname="Change Field" expr="buf2int(length)" showtemplate="FieldAscii"/>
		</block>
		
		<block name="alter" longname="Alert">
			<field type="variable" name="alert_field" longname="Alert Field" expr="buf2int(length)" showtemplate="FieldAscii"/>
		</block>
		
		<block name="client_hello_v2" longname="Client Hello v2.0">
			<field type="fixed" name="type_message" longname="Type Message" size="1" showtemplate="handshake.type"/>
			<field type="fixed" name="version" longname="Version" size="2" showtemplate="FieldHex"/>
			<field type="fixed" name="cipher_spec_length" longname="Cipher Spec Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="session_id_length" longname="Session ID Length" size="2" showtemplate="FieldDec"/>
			<field type="fixed" name="challenge_length" longname="Challenge Length" size="2" showtemplate="FieldDec"/>

			<block name="cipher_specs" longname="Cipher Specs">
				<loop type="size" expr="buf2int(cipher_spec_length)">
					<field type="fixed" name="cipher_suite" longname="Cipher suite" size="3" showtemplate="ssl.cipher_suite"/>
				</loop>
			</block>
			<field type="variable" name="session_id" longname="Session ID" expr="buf2int(session_id_length)" showtemplate="FieldHex"/>
			<field type="variable" name="challenge" longname="Challenge" expr="buf2int(challenge_length)" showtemplate="FieldHex"/>
		</block>
		
		<block name="client_hello" longname="Client Hello">
			<field type="fixed" name="version_client" longname="Version Client" size="2" showtemplate="FieldAscii"/>
			<field type="fixed" name="random" longname="Random" size="32" showtemplate="FieldAscii">
				<field type="fixed" name="gmt_unix_time" longname="GTM Unix Time" size="4" showtemplate="FieldAscii"/>
				<field type="fixed" name="random_bytes" longname="Random Byte" size="28" showtemplate="FieldAscii"/>
			</field>
			
			<field type="fixed" name="session_id_length" longname="Session ID Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="session_id" longname="Session ID" expr="buf2int(session_id_length)" showtemplate="FieldAscii"/>
		
			<field type="fixed" name="cipher_suite_length" longname="Cipher Suite Length" size="2" showtemplate="FieldDec"/>
			<block name="cipher_suites" longname="Cipher Suites">
				<loop type="size" expr="buf2int(cipher_suite_length)">
					<field type="fixed" name="cipher_suite" longname="Cipher suite" size="2" showtemplate="ssl.cipher_suite"/>
				</loop>
			</block>
			
			<field type="fixed" name="compression_methods_length" longname="Compression Methods Length" size="1" showtemplate="FieldDec"/>
			<block name="compression_methods" longname="Compression Methods">
				<loop type="size" expr="buf2int(compression_methods_length)">
					<field type="fixed" name="compression_method" longname="Compression Method" size="1" showtemplate="FieldAscii"/>
				</loop>
			</block>
		</block>
		
		<block name="server_hello" longname="Server Hello">
			<field type="fixed" name="version_client" longname="Version Client" size="2" showtemplate="FieldAscii"/>
			<field type="fixed" name="random" longname="Random" size="32" showtemplate="FieldAscii">
				<field type="fixed" name="gmt_unix_time" longname="GTM Unix Time" size="4" showtemplate="FieldAscii"/>
				<field type="fixed" name="random_bytes" longname="Random Byte" size="28" showtemplate="FieldAscii"/>
			</field>
			
			<field type="fixed" name="session_id_length" longname="Session ID Length" size="1" showtemplate="FieldDec"/>
			<field type="variable" name="session_id" longname="Session ID" expr="buf2int(session_id_length)" showtemplate="FieldAscii"/>
		
			<field type="variable" name="cipher_suite" longname="Cipher Suite" expr="2" showtemplate="ssl.cipher_suite"/>
			
			<field type="variable" name="compressio_methods" longname="Compression Methods" expr="1" showtemplate="FieldAscii"/>			
		</block>
		
		<block name="certificate" longname="Certificate">
			<if expr="buf2int(handshake_length) gt ($packetlength - $currentoffset)">
				<if-true>
					<field type="variable" name="cert" longname="Certificate" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
				</if-true>
				<if-false>
					<field type="variable" name="cert" longname="Certificate" expr="buf2int(handshake_length)" showtemplate="FieldAscii"/>
				</if-false>
			</if>
		</block>
		
		<block name="server_hello_done" longname="Server Hello Done">
			<field type="variable" name="server_hello_done_field" longname="Server Hello Done Field" expr="buf2int(handshake_length)" showtemplate="FieldAscii"/>
		</block>
	</format>
	
	<visualization>
		<showtemplate name="ssl.cipher_suite" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x0000" show="TLS_NULL_WITH_NULL_NULL"/>
					<case value="0x0001" show="TLS_RSA_WITH_NULL_MD5"/>
					<case value="0x0002" show="TLS_RSA_WITH_NULL_SHA"/>
					<case value="0x0003" show="TLS_RSA_EXPORT_WITH_RC4_40_MD5"/>
					<case value="0x0004" show="TLS_RSA_WITH_RC4_128_MD5"/>
					<case value="0x0005" show="TLS_RSA_WITH_RC4_128_SHA"/>
					<case value="0x0006" show="TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5"/>
					<case value="0x0007" show="TLS_RSA_WITH_IDEA_CBC_SHA"/>
					<case value="0x0008" show="TLS_RSA_EXPORT_WITH_DES40_CBC_SHA"/>
					<case value="0x0009" show="TLS_RSA_WITH_DES_CBC_SHA"/>
					<case value="0x000A" show="TLS_RSA_WITH_3DES_EDE_CBC_SHA"/>
					
					<case value="0x010080" show="TLS_RC4_128_WITH_MD5"/>
					<case value="0x020080" show="TLS_RC4_128_EXPORT40_WITH_MD5"/>
					<case value="0x030080" show="TLS_RC2_CBC_128_CBC_WITH_MD5"/>
					<case value="0x040080" show="TLS_RC2_CBC_128_CBC_EXPORT40_WITH_MD5"/>
					<case value="0x050080" show="TLS_IDEA_128_CBC_WITH_MD5"/>
					<case value="0x060040" show="TLS_DES_64_CBC_WITH_MD5"/>
					<case value="0x0700c0" show="TLS_DES_192_EDE3_CBC_WITH_MD5"/>
					<default show="Unknown chiper suite"/>
				</switch>
			</showmap>
		</showtemplate>
		
		<showsumtemplate name="ssl">
			<section name="next"/>

			<text value="Secure Socket Layer "/>
			<!--<protofield name="handshake_type" showdata="showmap"/>-->
			<protofield name="content_type" showdata="showmap"/>
			<!--<if expr="ispresent(version)">
				<if-true>
					<switch expr="buf2int(version)">
						<case value="0x0300"> <text value=" SSL 3.0"/></case>
						<case value="0x0301"> <text value=" TLS 1.0"/></case>
						<case value="0x0302"> <text value=" TLS 1.1"/></case>
						<default> <text value=" Unknown"/> </default>
					</switch>
				</if-true>
			</if>-->				


		</showsumtemplate>
		<showtemplate name="record.content.type" showtype="hex">
			<showmap>
				<switch expr="buf2int(this)">
					<case value="0x14" show="Change chiper spec protocol"/>
					<case value="0x15" show="Alert protocol"/>
					<case value="0x16" show="Handshake protocol"/>
					<case value="0x17" show="Application Data"/>
					<default show="unknown"/>
				</switch>
			</showmap>		
		</showtemplate>
	
		<showtemplate name="handshake.type" showtype="hex">
				<showmap>
					<switch expr="buf2int(this)">
						<case value="0x00" show="Hello Request"/>
						<case value="0x01" show="Client Hello"/>
						<case value="0x02" show="Server Hello"/>
						<case value="0x0b" show="Certificate"/>
						<case value="0x0c" show="Server Key Exchange"/>
						<case value="0x0d" show="Certificate Request"/>
						<case value="0x0e" show="Server Hello Done"/>
						<case value="0x0f" show="Certificate Verify"/>
						<case value="0x10" show="Client Key Exchange"/>
						<case value="0x14" show="Finished"/>
						<default show="unknown"/>
					</switch>
				</showmap>
		</showtemplate>

	</visualization>
</protocol>

<protocol name="syslog" longname="SysLog BSD" showsumtemplate="syslog">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '\x3c[0-9][0-9]?[0-9]?\x3e',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#syslog"/>
			</update-lookuptable>

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#syslog"/>
			</update-lookuptable>
		</before>
	</execute-code>
	
	<format>
		<fields>
			<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="syslog">
			<section name="next"/>
			<text value="SysLog"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="xmpp" longname="Extensible Messaging and Presence Protocol" showsumtemplate="xmpp">
	<execute-code>
		<verify>
			<!--<if expr="hasstring($packet[$currentoffset:0],'\x3cstream.*\x3e',0)">-->
			<if expr="hasstring($packet[$currentoffset:0],'\x3cstream:stream[\x09-\x0d ][ -~]*[\x09-\x0d ]xmlns=[\x27\x22]jabber',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#xmpp"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#xmpp"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#xmpp"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>
	
	<format>
		<fields>
			<field type="variable" name="xmppdata" longname="XMPP Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="xmpp">
			<section name="next"/>
			<text value="XMPP"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="fsecure" longname="F-Secure" showsumtemplate="fsecure">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], 'fsbw.*f\-secure\.com', 0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>
		
		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#fsecure"/>
			</update-lookuptable>

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#fsecure"/>
			</update-lookuptable>
		</before>
	</execute-code>	
	
	<format>
		<fields>
			<field type="variable" name="fsecuredata" longname="F-Secure Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
				
	<visualization>
		<showsumtemplate name="fsecure">
			<section name="next"/>
			<text value="F-Secure"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="sql" longname="SQL Services" showsumtemplate="sql">
	<format>
		<fields>
			<field type="variable" name="sqldata" longname="SQL Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="sql">
			<section name="next"/>
			<text value="SQL Services"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="oracle_sql" longname="Oracle SQL" showsumtemplate="oracle_sql">
	<execute-code>
		<verify>
			<!-- check this signature -->
			<if expr="hasstring($packet[$currentoffset : 0],'.*\(description=',0) and (($packetlength - $currentoffset)==(buf2int($packet[$currentoffset : 2])))">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>	
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#oracle_sql"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#oracle_sql"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#oracle_sql"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>		
	</execute-code>

	<format>
		<fields>
			<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="oracle_sql">
			<section name="next"/>
			<text value="Oracle SQL"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="rfb" longname="Remote FrameBuffer" showsumtemplate="rfb">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '^rfb [0-9][0-9][0-9]\.[0-9][0-9][0-9]', 0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">	
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#rfb"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#rfb"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#rfb"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>

	<format>
		<fields>
			<field type="variable" name="data" longname="Data"  expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="rfb">
			<section name="next"/>
			<text value="RFB"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="wins" longname="Windows Internet Naming Service" showsumtemplate="wins">
	<execute-code>
		<verify>
			<if expr="buf2int($packet[$currentoffset:4]) == ($packetlength - $currentoffset -4) ">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#wins"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#wins"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#wins"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>		
	</execute-code>
	
	<format>
		<fields>
			<field type="variable" name="winsdata" longname="WINSData" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="wins">
			<section name="next"/>
			<text value="WINS"/>
		</showsumtemplate>
	</visualization>
</protocol>	

<protocol name="ms_sql_monitor" longname="MS SQL Monitor" showsumtemplate="ms_sql_monitor">
	<!-- this protocol uses TDS / UDP as transport protocol -->
	<!-- TDS header is made of 8 byte : first byte is type packet, second byte is last indicator packet, third and fourth bytes indicates packet length -->
	<!-- the meaning of last four byte is unknown -->
	<execute-code>
		<verify>
			<!-- check this signature -->
			<if expr="(hasstring($packet[$currentoffset:0],'^\x03',0)  and ($packetlength - $currentoffset) ==1 ) or (hasstring($packet[$currentoffset:0],'^\x05',0)  and (($packetlength - $currentoffset - 3)== buf2int(changebyteorder($packet[$currentoffset +1 : 2]))))">
			 
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>	
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#ms_sql_monitor"/>
			</update-lookuptable>	

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#ms_sql_monitor"/>
			</update-lookuptable>
		</before>		
	</execute-code>
	<format>
		<fields>
			<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="ms_sql_monitor">
			<section name="next"/>
			<text value="MS SQL Monitor"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="ms_sql_server" longname="MS SQL Server" showsumtemplate="ms_sql_server">
	<!-- this protocol uses TDS / TCP as transport protocol -->
	<!-- TDS header is made of 8 byte : first byte is type packet, second byte is last indicator packet, third and fourth bytes indicates packet length -->
	<!-- the meaning of last four byte is unknown -->
	<execute-code>
		<verify>
			<!-- check this signature -->
			<if expr="hasstring($packet[$currentoffset:0],'[\x01\x04\x10\x12][\0\x01]',0)  and (buf2int($packet[$currentoffset + 2 : 2 ]) == ($packetlength - $currentoffset))">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>	
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#ms_sql_server"/>
				<lookupdata value="0"/>
			</update-lookuptable>	

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#ms_sql_server"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#ms_sql_server"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>		
	</execute-code>

	<format>
		<fields>
			<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="ms_sql_server">
			<section name="next"/>
			<text value="MS SQL Server"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="nt_security_log" longname="NT Security Log" showsumtemplate="nt_security_log">
	<execute-code>
		<verify>
			<!--<if expr="hasstring($packet[$currentoffset:0], '\x3c[0-9][0-9]?[0-9]?\x3e',0)">-->
			<if expr="hasstring($packet[$currentoffset:0], '\x3c[0-9][0-9]?[0-9]?\x3e.*([0-9a-z]*:[0-9a-z]*;)*([0-9a-z]*:[0-9a-z]*)',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$ipdst"/>
				<lookupkey value="$portsrc"/>
				<lookupkey value="$portdst"/>
				<lookupdata value="#nt_security_log"/>
			</update-lookuptable>

			<update-lookuptable name="$udpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$ipdst"/>
				<lookupkey value="$ipsrc"/>
				<lookupkey value="$portdst"/>
				<lookupkey value="$portsrc"/>
				<lookupdata value="#nt_security_log"/>
			</update-lookuptable>
		</before>
	</execute-code>
	
	<format>
		<fields>
			<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>

	<visualization>
		<showsumtemplate name="nt_security_log">
			<section name="next"/>
			<text value="NT Security Log"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="cvs" longname="Concurrent Versions System" showsumtemplate="cvs">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0],'^BEGIN (AUTH|VERIFICATION|GSSAPI) REQUEST\x0a',0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>

		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#cvs"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#cvs"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#cvs"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>		
	</execute-code>
	
	<format>
		<fields>
			<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="cvs">
			<section name="next"/>
			<text value="CVS"/>
		</showsumtemplate>
	</visualization>
</protocol>
<protocol name="pcanywhere" longname="PCAnyWhere" showsumtemplate="pcanywhere">
	<execute-code>
		<verify>
			<if expr="hasstring($packet[$currentoffset:0], '^(nq|st)$', 0)">
				<if-true>
					<assign-variable name="$protoverify_result" value="%FOUND"/>
				</if-true>
			</if>
		</verify>
		
		<before when="$protoverify_result == %FOUND">
			<assign-variable name="$session_hit" value="1"/>
			<update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
				<lookupkey value="$firstip"/>
				<lookupkey value="$secondip"/>
				<lookupkey value="$firstport"/>
				<lookupkey value="$secondport"/>
				<lookupdata value="#pcanywhere"/>
				<lookupdata value="0"/>
			</update-lookuptable>

			<if expr="$enable_servertable">
				<if-true>
					<if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)">
						<if-true>
							<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>
								<lookupdata value="#pcanywhere"/>
							</update-lookuptable>
							<!-- delete entry from CandidateServersTable -->
							<update-lookuptable name="$CandidateServersTable" action="purge">
								<lookupkey value="$ipsrc"/>
								<lookupkey value="$portsrc"/>											
							</update-lookuptable>
						</if-true>
						<if-false>
							<if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)">
								<if-true>
									<update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>
										<lookupdata value="#pcanywhere"/>
									</update-lookuptable>
									<update-lookuptable name="$CandidateServersTable" action="purge">
										<lookupkey value="$ipdst"/>
										<lookupkey value="$portdst"/>											
									</update-lookuptable>
								</if-true>
							</if>
						</if-false>
					</if>
				</if-true>
			</if>
		</before>
	</execute-code>	
	
	<format>
		<fields>
			<field type="variable" name="data" longname="Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/>
		</fields>
	</format>
				
	<visualization>
		<showsumtemplate name="pcanywhere">
			<section name="next"/>
			<text value="PCAnyWhere"/>
		</showsumtemplate>
	</visualization>
</protocol>

<protocol name="defaultproto" longname="Other data" comment="Generic protocol that is called when no other protocols are available" showsumtemplate="defaultproto">
	<execute-code>
		<before when="($L4proto == #tcp)">
			<!-- Since both sides of the connection are stored in the table, we can just check for one of them -->
			<if expr="not updatelookuptable($unknownprotosessiontable, $firstip, $secondip, $firstport, $secondport)">
				<if-true>
					<assign-variable name="$session_hit" value="1"/>
					<update-lookuptable name="$unknownprotosessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
						<lookupkey value="$firstip"/>
						<lookupkey value="$secondip"/>
						<lookupkey value="$firstport"/>
						<lookupkey value="$secondport"/>
					</update-lookuptable>
				</if-true>
			</if>
		</before>
		
		<before when="($L4proto == #udp)">
			<!-- Since both sides of the connection are stored in the table, we can just check for one of them -->
			<if expr="not updatelookuptable($unknownprotosessiontable, $ipsrc, $ipdst, $portsrc, $portdst)">
				<if-true>
					<assign-variable name="$session_hit" value="1"/>
					<update-lookuptable name="$unknownprotosessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
						<lookupkey value="$ipsrc"/>
						<lookupkey value="$ipdst"/>
						<lookupkey value="$portsrc"/>
						<lookupkey value="$portdst"/>
					</update-lookuptable>
					<update-lookuptable name="$unknownprotosessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300">
						<lookupkey value="$ipdst"/>
						<lookupkey value="$ipsrc"/>
						<lookupkey value="$portdst"/>
						<lookupkey value="$portsrc"/>
					</update-lookuptable>
				</if-true>
			</if>
		</before>
	</execute-code>
	<format>
		<fields>
			<field type="variable" name="payload" longname="Data payload" expr="$packetlength - $currentoffset" showtemplate="Field4BytesHex"/>
		</fields>
	</format>
	
	<visualization>
		<showsumtemplate name="defaultproto">
			<section name="L7"/>
			<text value="Generic Data"/>
		</showsumtemplate>
	</visualization>
</protocol>

<visualization>

	<!-- Defines the structure of the summary view of each packet -->
	<showsumstruct>
		<sumsection name="NUMBER" longname="N."/>
		<sumsection name="TIME" longname="Time"/>
		<sumsection name="L2" longname="Data Link"/>
		<sumsection name="L3" longname="Network"/>
		<sumsection name="L4" longname="Transport"/>
		<sumsection name="L7" longname="Application"/>
	</showsumstruct>


	<!-- Very simple and common templates -->
	<showtemplate name="FieldBin" showtype="bin"/>
	<showtemplate name="FieldDec" showtype="dec"/>
	<showtemplate name="FieldHex" showtype="hex"/>
	<showtemplate name="FieldAscii" showtype="ascii" showgrp="1"/>

	<showtemplate name="FieldHexBin" showtype="hex">
		<showdtl>
		    <text value="0x"/>
			<protofield showdata="value"/>
			<text value=" ("/>
			<text expr="buf2int(this)"/>
			<text value=")"/>					
		</showdtl>
	</showtemplate>	



	<!-- Templates that prints a field as a continuous string of hex numbers (e.g. '0xAABBCCDDEE...') -->
	<!-- with a delimiter every N bytes (in order to improve readability) -->
	<showtemplate name="Field4BytesHex" showtype="hex" showgrp="4" showsep=" "/>			<!-- E.g. "AABBCCDD AABBCCDD" -->
	<showtemplate name="Field1BytesHex" showtype="hex" showgrp="1" showsep=" "/>			<!-- E.g. "AA BB CC DD" -->
	<showtemplate name="Field2BytesHexDash" showtype="hex" showgrp="2" showsep="-"/>		<!-- E.g. "AABB CCDD" -->
	<showtemplate name="Field2BytesHexColon" showtype="hex" showgrp="2" showsep=":"/>		<!-- E.g. "AABB:CCDD" -->

	<!-- Templates for fields that cannot be printed with standard NetPDL primitives -->
	<showtemplate name="ip4addr" showtype="dec" showgrp="1" showsep="." showplg="IP46Name"/>

	<showtemplate name="ip6addr" showtype="hexnox" showgrp="2" showsep=":" showplg="IP46Name">
		<showdtl>
			<protofield showdata="showvalue"/>
			<if expr="this == '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'">
				<if-true>
					<text value=" (Unspecified Address)"/>
				</if-true>
			</if>
			<if expr="this == '\xFF\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'">
				<if-true>
					<text value=" (All nodes multicast address)"/>
				</if-true>
			</if>
			<if expr="this[0:12] == '\xFF\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'">
				<if-true>
					<text value=" (Multicast solicited node)"/>
				</if-true>
			</if>

<!-- FULVIO: questo non funz perche' non ci sono funzioni di traduzione in stampa, per cui quando -->
<!-- voglio far stampare una stringa dal "text", questo me la stampa come se fosse codificata in ascii -->
<!--
			<if expr="(this[11:2] == '\xFF\xFE')">
				<if-true>
					<text value=" (Originating MAC address: "/>
					<text expr="this[8:3]"/>
					<text value="-"/>
					<text expr="this[13:3]"/>
					<text value=")"/>
				</if-true>
			</if>
-->
		</showdtl>
	</showtemplate>

	<showtemplate name="netbios-name" showplg="NetBIOSName"/>


	<!-- Template for printing IPv4 address using only numbers (e.g. netmasks) -->
	<showtemplate name="ip4addr-noplg" showtype="dec" showgrp="1" showsep="."/>

	<!-- Template for printing IPv6 address using only numbers (e.g. prefixes) -->
	<showtemplate name="ip6addr-noplg" showtype="hexnox" showgrp="2" showsep=":"/>

	<!-- Templates specific for MAC addresses -->
	<showtemplate name="MAC-colon" showtype="hexnox" showgrp="1" showsep=":"/>
	<showtemplate name="MAC-dash" showtype="hexnox" showgrp="3" showsep="-"/>




	<!-- *********************************************************** -->
	<!-- Generic templates with some common visualization primitives -->
	<!-- *********************************************************** -->

	<!-- Generic template that prints a field timed by '4' -->
	<showtemplate name="FieldMul4Dec" showtype="dec">
		<showdtl>
			<text expr="buf2int(this) * 4"/>
			<text value=" (field value = "/>
			<protofield showdata="showvalue"/>
			<text value=")"/>
		</showdtl>
	</showtemplate>

	<!-- Generic template that prints a short-field timed by '8' -->
	<showtemplate name="ShortMul8Dec" showtype="dec">
		<showdtl>
			<text expr="buf2int(this) * 8"/>
			<text value=" (field value = "/>
			<protofield showdata="showvalue"/>
			<text value=")"/>
		</showdtl>
	</showtemplate>

	<showtemplate name="ShortDiv256Dec" showtype="dec">
		<showdtl>
			<text expr="buf2int(this) div 256"/>
			<text value=" sec (field value = "/>
			<protofield showdata="showvalue"/>
			<text value=")"/>
		</showdtl>
	</showtemplate>

	<showtemplate name="TrueFalse" showtype="dec">
		<showmap>
			<switch expr="buf2int(this)">
				<case value="0" show="False"/>
				<case value="1" show="True"/>
			</switch>
		</showmap>
	</showtemplate>



	<!-- ************************************************ -->
	<!-- Generic templates used by more than one protocol -->
	<!-- ************************************************ -->

	<showtemplate name="eth.typelength" showtype="dec">
		<showdtl>
			<if expr="buf2int(this) le 1500">				
				<if-true>
					<protofield showdata="showvalue"/>
					<text value=" (Length)"/>
				</if-true>

				<if-false>
					<text value="0x"/>
					<protofield showdata="value"/>
					<text value=" (Ethertype)"/>
				</if-false>
			</if>
		</showdtl>
	</showtemplate>

	<showtemplate name="dhcp.code" showtype="dec">
		<showmap>
			<switch expr="buf2int(this)">
				<case value="1" show="Request"/> 
				<case value="2" show="Reply"/> 
				<default show="Error in DHCP / BOOTP code lookup"/> 
			</switch>
		</showmap>
	</showtemplate>

	<showtemplate name="pppoe.code" showtype="hex">
		<showmap>
			<switch expr="buf2int(this)">
				<case value="0" show="Session"/> 
				<case value="7" show="PADO"/> 
				<case value="9" show="PADI"/> 
				<case value="25" show="PADR"/> 
				<case value="101" show="PADS"/> 
				<case value="167" show="PADT"/> 
				<default show="Error in PPPoe code lookup"/> 
			</switch>
		</showmap>
	</showtemplate>

	<showtemplate name="rip.cmd" showtype="dec">
		<showmap>
			<switch expr="buf2int(this)">
				<case value="1" show="Request"/> 
				<case value="2" show="Update"/> 
				<default show="Error in RIP command lookup"/> 
			</switch>
		</showmap>
	</showtemplate>

	<showtemplate name="bluetooth.page_scan_mode" showtype="dec">
		<showmap>
			<switch expr="buf2int(this)">
				<case value="0" show="Mandatory Page Scan Mode"/>
				<case value="1" show="Optional Page Scan Mode 1"/>
				<case value="2" show="Optional Page Scan Mode 2"/>
				<case value="3" show="Optional Page Scan Mode 3"/>
				<default show="Reserved"/>
			</switch>
		</showmap>
	</showtemplate>

	<showtemplate name="bluetooth.encryption_enable" showtype="dec">
		<showmap>
			<switch expr="buf2int(this)">
				<case value="0" show="Link Level Encryption OFF"/>
				<case value="1" show="Link Level Encryption ON"/>
				<default show="Invalid Code"/>
			</switch>
		</showmap>
	</showtemplate>
	

	<!-- Generic template for visualizing Ethernet MAC addresses -->
	<showtemplate name="MACaddressEth" showtype="hexnox" showgrp="3" showsep="-">
		<showdtl>
			<protofield showdata="showvalue"/>
			<if expr="(buf2int(this[0:1]) bitwand 0b00000001) == 0b00000001">
				<!-- It extracts the first byte of the MAC address, then it matches the result against -->
				<!-- the 'xxxxxxx1' pattern -->
				<!-- Extract the first byte of the MAC address -->
				<!-- If it is a broadcast address, the last char will be '1' (due to network/host byte order)-->
				
				<if-true>
					<if expr="this == '\xFF\xFF\xFF\xFF\xFF\xFF'">
						<if-true>
							<text value=" (Broadcast address)"/>
						</if-true>

						<if-false>
							<text value=" (Multicast address)"/>
						</if-false>		
					</if>
				</if-true>

				<if-false>
					<text value=" (Unicast address, vendor "/>
					<protofield showdata="showmap"/>
					<text value=")"/>
				</if-false>
			</if>
		</showdtl>

		<showmap>
			<switch expr="buf2int(this[0:3])">		<!-- Extracts the first 3 bytes of the MAC address -->
				<case value="0xFFFFFF" show="Broadcast address"/>
				<case value="0x000001" show="SuperLAN-2U"/> 
				<case value="0x000002" show="BBN (was internal usage only, no longer used)"/>
				<case value="0x000009" show="powerpipes?"/> 
				<case value="0x00000C" show="Cisco"/> 
				<case value="0x00000E" show="Fujitsu"/> 
				<case value="0x00000F" show="NeXT"/> 
				<case value="0x000010" show="Sytek (Hughes LAN Systems)"/> 
				<case value="0x000011" show="Tektronix"/> 
				<case value="0x000015" show="Datapoint Corporation"/> 
				<case value="0x000018" show="Webster Computer Corporation Appletalk/Ethernet Gateway"/> 
				<case value="0x00001A" show="AMD (?)"/> 
				<case value="0x00001B" show="Novell (now Eagle Technology)"/> 
				<case value="0x00001C" show="JDR Microdevices generic, NE2000 drivers"/> 
				<case value="0x00001D" show="Cabletron"/> 
				<case value="0x00001F" show="Cryptall Communications Corp."/> 
				<case value="0x000020" show="DIAB (Data Intdustrier AB)"/> 
				<case value="0x000021" show="SC&amp;C (PAM Soft&amp;Hardware also reported)"/> 
				<case value="0x000022" show="Visual Tecnology"/> 
				<case value="0x000023" show="ABB Automation AB, Dept. Q"/> 
				<case value="0x000024" show="Olicom"/> 
				<case value="0x000029" show="IMC"/> 
				<case value="0x00002A" show="TRW"/> 
				<case value="0x00002C" show="NRC - Network Resources Corporation - MultiGate Hub1+, Hub2, etc"/> 
				<case value="0x000032" show="GPT Limited (reassigned from GEC Computers Ltd)"/> 
				<case value="0x000037" show="Oxford Metrics Ltd"/> 
				<case value="0x00003B" show="Hyundai/Axil Sun clones"/> 
				<case value="0x00003C" show="Auspex"/> 
				<case value="0x00003D" show="AT&amp;T"/> 
				<case value="0x00003F" show="Syntrex Inc"/> 
				<case value="0x000044" show="Castelle"/> 
				<case value="0x000046" show="ISC-Bunker Ramo, An Olivetti Company"/> 
				<case value="0x000048" show="Epson"/> 
				<case value="0x000049" show="Apricot Ltd."/> 
				<case value="0x00004B" show="APT -ICL also reported"/> 
				<case value="0x00004C" show="NEC Corporation"/> 
				<case value="0x00004F" show="Logicraft 386-Ware P.C. Emulator"/> 
				<case value="0x000051" show="Hob Electronic Gmbh &amp; Co. KG"/> 
				<case value="0x000052" show="Optical Data Systems (ODS)"/> 
				<case value="0x000055" show="AT&amp;T"/> 
				<case value="0x000058" show="Racore Computer Products Inc"/> 
				<case value="0x00005A" show="S&amp;Koch (Schneider &amp; Koch in Europe and Syskonnect outside of Europe) OR Xerox 806 (unregistered)"/> 
				<case value="0x00005B" show="Eltec"/> 
				<case value="0x00005D" show="RCE"/> 
				<case value="0x00005E" show="IANA (U.S. Department of Defense)"/> 
				<case value="0x00005F" show="Sumitomo"/> 
				<case value="0x000061" show="Gateway Communications"/> 
				<case value="0x000062" show="Honeywell"/> 
				<case value="0x000063" show="Hewlett-Packard LanProbe"/> 
				<case value="0x000064" show="Yokogawa Digital Computer Corp"/> 
				<case value="0x000065" show="Network General"/> 
				<case value="0x000066" show="Talaris"/> 
				<case value="0x000068" show="Rosemount Controls"/> 
				<case value="0x000069" show="Concord Communications, Inc (although someone said Silicon Graphics)"/> 
				<case value="0x00006B" show="MIPS"/> 
				<case value="0x00006D" show="Case"/> 
				<case value="0x00006E" show="Artisoft, Inc."/> 
				<case value="0x00006F" show="Madge Networks Ltd. Token-ring adapters"/> 
				<case value="0x000073" show="DuPont"/> 
				<case value="0x000075" show="Bell Northern Research (BNR)"/> 
				<case value="0x000077" show="Interphase Corporation [Used in other systems, e.g. MIPS, Motorola]"/> 
				<case value="0x000078" show="Labtam Australia"/> 
				<case value="0x000079" show="Networth Incorporated [bought by Compaq, used in Netelligent series]"/> 
				<case value="0x00007A" show="Ardent"/> 
				<case value="0x00007B" show="Research Machines"/> 
				<case value="0x00007D" show="Cray Research Superservers,Inc [Also Harris (3M) (old)]"/> 
				<case value="0x00007E" show="NetFRAME multiprocessor network servers"/> 
				<case value="0x00007F" show="Linotype-Hell AG Linotronic typesetters"/> 
				<case value="0x000080" show="Cray Communications A/S (formerly Dowty Network Services) [Also shows as Harris (3M) (new) and/or Imagen(?) elsewhere]"/> 
				<case value="0x000081" show="Synoptics"/> 
				<case value="0x000083" show="Tadpole Technology [had Optical Data Systems which is wrong according to both]"/> 
				<case value="0x000084" show="Aquila (?), ADI Systems Inc.(?)"/> 
				<case value="0x000086" show="Gateway Communications Inc. (then Megahertz &amp; now 3com)"/> 
				<case value="0x000087" show="Hitachi"/> 
				<case value="0x000089" show="Cayman Systems Gatorbox"/> 
				<case value="0x00008A" show="Datahouse Information Systems"/> 
				<case value="0x00008E" show="Solbourne(?), Jupiter(?) (I've had confirming mail on Solbourne)"/> 
				<case value="0x000092" show="Unisys, Cogent (both reported)"/> 
				<case value="0x000093" show="Proteon"/> 
				<case value="0x000094" show="Asante MAC"/> 
				<case value="0x000095" show="Sony/Tektronix"/> 
				<case value="0x000097" show="Epoch"/> 
				<case value="0x000098" show="Cross Com"/> 
				<case value="0x000099" show="Memorex Telex Corporations"/> 
				<case value="0x00009F" show="Ameristar Technology"/> 
				<case value="0x0000A0" show="Sanyo Electronics"/> 
				<case value="0x0000A2" show="Wellfleet"/> 
				<case value="0x0000A3" show="Network Application Tech. (NAT)"/> 
				<case value="0x0000A4" show="Acorn"/> 
				<case value="0x0000A5" show="Compatible Systems Corporation"/> 
				<case value="0x0000A6" show="Network General (internal assignment, not for products)"/> 
				<case value="0x0000A7" show="NCD (Network Computing Devices) X-terminals"/> 
				<case value="0x0000A8" show="Stratus Computer, Inc."/> 
				<case value="0x0000A9" show="Network Systems"/> 
				<case value="0x0000AA" show="Xerox (Xerox machines)"/> 
				<case value="0x0000AC" show="Conware Netzpartner [had Apollo, claimed incorrect]"/> 
				<case value="0x0000AE" show="Dassault Automatismes et Telecommunications"/> 
				<case value="0x0000AF" show="Nuclear Data Acquisition Interface Modules (AIM)"/> 
				<case value="0x0000B0" show="RND (RAD Network Devices)"/> 
				<case value="0x0000B1" show="Alpha Microsystems Inc."/> 
				<case value="0x0000B3" show="CIMLinc"/> 
				<case value="0x0000B4" show="Edimax"/> 
				<case value="0x0000B5" show="Datability Terminal Servers"/> 
				<case value="0x0000B6" show="Micro-matic Research"/> 
				<case value="0x0000B7" show="Dove Fastnet"/> 
				<case value="0x0000BB" show="TRI-DATA Systems Inc. Netway products, 3274 emulators"/> 
				<case value="0x0000BC" show="Allen-Bradley, now SMC (Standard Microsystems Corp.)"/> 
				<case value="0x0000C0" show="Western Digital"/> 
				<case value="0x0000C1" show="Olicom A/S"/> 
				<case value="0x0000C5" show="Farallon Computing Inc (Phone Net Card)"/> 
				<case value="0x0000C6" show="HP Intelligent Networks Operation (formerly Eon Systems)"/> 
				<case value="0x0000C8" show="Altos"/> 
				<case value="0x0000C9" show="Emulex Terminal Servers, Print Servers"/> 
				<case value="0x0000CA" show="LANcity Cable Modems (now owned by BayNetworks)"/> 
				<case value="0x0000CC" show="Densan Co., Ltd."/> 
				<case value="0x0000CD" show="Industrial Research Limited"/> 
				<case value="0x0000D0" show="Develcon Electronics, Ltd."/> 
				<case value="0x0000D1" show="Adaptec, Inc. Nodem product"/> 
				<case value="0x0000D2" show="SBE Inc"/> 
				<case value="0x0000D3" show="Wang Labs"/> 
				<case value="0x0000D4" show="PureData"/> 
				<case value="0x0000D7" show="Dartmouth College (NED Router)"/> 
				<case value="0x0000D8" show="3Com? old Novell NE1000's (before about 1987?)? PS/2"/> 
				<case value="0x0000DD" show="Gould"/> 
				<case value="0x0000DE" show="Unigraph"/> 
				<case value="0x0000E1" show="Hitachi (laptop built-in)"/> 
				<case value="0x0000E2" show="Acer Counterpoint"/> 
				<case value="0x0000E3" show="Integrated Micro Products Ltd"/> 
				<case value="0x0000E4" show="mips?"/> 
				<case value="0x0000E6" show="Aptor Produits De Comm Indust"/> 
				<case value="0x0000E8" show="Accton Technology Corporation"/> 
				<case value="0x0000E9" show="ISICAD, Inc."/> 
				<case value="0x0000ED" show="April"/> 
				<case value="0x0000EE" show="Network Designers Limited [also KNX Ltd, a former division]"/> 
				<case value="0x0000EF" show="Alantec (now owned by ForeSystems)"/> 
				<case value="0x0000F0" show="Samsung"/> 
				<case value="0x0000F2" show="Spider Communications (Montreal, not Spider Systems)"/> 
				<case value="0x0000F3" show="Gandalf Data Ltd. - Canada"/> 
				<case value="0x0000F4" show="Allied Telesis, Inc."/> 
				<case value="0x0000F6" show="A.M.C. (Applied Microsystems Corp.)"/> 
				<case value="0x0000F8" show="DEC"/> 
				<case value="0x0000FB" show="Rechner zur Kommunikation"/> 
				<case value="0x0000FD" show="High Level Hardarware (Orion, UK)"/> 
				<case value="0x0000FF" show="Camtec Electronics (UK) Ltd."/> 
				<case value="0x000102" show="BBN (Bolt Beranek and Newman, Inc.) internal usage (not registered)"/> 
				<case value="0x000143" show="IEEE 802"/> 
				<case value="0x000150" show="Megahertz (now 3com) modem"/> 
				<case value="0x000163" show="NDC (National Datacomm Corporation)"/> 
				<case value="0x000168" show="W&amp;G (Wandel &amp; Goltermann) [incorrect according to W&amp;G]"/> 
				<case value="0x0001C8" show="Thomas Conrad Corp."/> 
				<case value="0x0001FA" show="Compaq (PageMarq printers)"/> 
				<case value="0x000204" show="Novell NE3200"/> 
				<case value="0x000205" show="Hamilton (Sparc Clones)"/> 
				<case value="0x000216" show="ESI (Extended Systems, Inc) print servers"/> 
				<case value="0x000288" show="Global Village (PCcard in Mac portable)"/> 
				<case value="0x0003C6" show="Morning Star Technologies Inc"/> 
				<case value="0x000400" show="Lexmark (Print Server)"/> 
				<case value="0x0004AC" show="IBM (Intel 82557-based Ethernet 10/100) PCMCIA Ethernet adapter"/> 
				<case value="0x000502" show="Apple (PCI bus Macs)"/> 
				<case value="0x00059A" show="PowerComputing (Mac clone)"/> 
				<case value="0x0005A8" show="PowerComputing Mac clones"/> 
				<case value="0x00060D" show="Hewlett-Packard JetDirect token-ring interfaces"/> 
				<case value="0x000629" show="IBM RISC6000 system"/> 
				<case value="0x00067C" show="Cisco"/> 
				<case value="0x0006C1" show="Cisco"/> 
				<case value="0x000701" show="Racal-Datacom"/> 
				<case value="0x00070D" show="Cisco 2511 Token Ring"/> 
				<case value="0x000852" show="Technically Elite Concepts"/> 
				<case value="0x000855" show="Fermilab"/> 
				<case value="0x0008C7" show="Compaq"/> 
				<case value="0x000A8A" show="Cisco Systems Aironet (802.11)"/> 
				<case value="0x001007" show="Cisco Systems Catalyst 1900"/> 
				<case value="0x00100B" show="Cisco Systems"/> 
				<case value="0x00100D" show="Cisco Systems Catalyst 2924-XL"/> 
				<case value="0x001011" show="Cisco Systems Cisco 75xx"/> 
				<case value="0x00101F" show="Cisco Systems Catalyst 2901"/> 
				<case value="0x001029" show="Cisco Systems Catalyst 5000"/> 
				<case value="0x00102F" show="Cisco Systems Cisco 5000"/> 
				<case value="0x00104B" show="3Com 3C905-TX PCI"/> 
				<case value="0x00105A" show="3Com Fast Etherlink XL in a Gateway 2000"/> 
				<case value="0x001060" show="Billington Novell NE200 Compatible"/> 
				<case value="0x001079" show="Cisco 5500 Router"/> 
				<case value="0x00107A" show="Ambicom (was Tandy?)"/> 
				<case value="0x00107B" show="Cisco Systems"/> 
				<case value="0x001083" show="HP-UX E 9000/889"/> 
				<case value="0x0010A4" show="Xircom RealPort 10/100 PC Card"/> 
				<case value="0x0010A6" show="Cisco"/> 
				<case value="0x0010D1" show="BlazeNet"/> 
				<case value="0x0010D7" show="Argosy EN 220 Fast Ethernet PCMCIA"/> 
				<case value="0x0010F6" show="Cisco"/> 
				<case value="0x001700" show="Kabel"/> 
				<case value="0x002000" show="Lexmark (Print Server)"/> 
				<case value="0x002005" show="simpletech"/> 
				<case value="0x002008" show="Cable &amp; Computer Technology"/> 
				<case value="0x00200C" show="Adastra Systems Corp"/> 
				<case value="0x002011" show="Canopus Co Ltd"/> 
				<case value="0x002017" show="Orbotech"/> 
				<case value="0x002018" show="Realtek"/> 
				<case value="0x00201A" show="Nbase"/> 
				<case value="0x002025" show="Control Technology Inc (Industrial Controls and Network Interfaces)"/> 
				<case value="0x002028" show="Bloomberg"/> 
				<case value="0x002029" show="TeleProcessing CSU/DSU (now owned by ADC/Kentrox)"/> 
				<case value="0x00202B" show="ATML (Advanced Telecommunications Modules, Ltd.)"/> 
				<case value="0x002035" show="IBM (International Business Machines) mainframes, Etherjet printers"/> 
				<case value="0x002036" show="BMC Software"/> 
				<case value="0x002042" show="Datametrics Corp"/> 
				<case value="0x002045" show="SolCom Systems Limited"/> 
				<case value="0x002048" show="Fore Systems Inc"/> 
				<case value="0x00204B" show="Autocomputer Co Ltd"/> 
				<case value="0x00204C" show="Mitron Computer Pte Ltd"/> 
				<case value="0x002056" show="Neoproducts"/> 
				<case value="0x002061" show="Dynatech Communications Inc"/> 
				<case value="0x002063" show="Wipro Infotech Ltd"/> 
				<case value="0x002066" show="General Magic Inc"/> 
				<case value="0x002067" show="Node Runner Inc"/> 
				<case value="0x00206B" show="Minolta Co., Ltd Network printers"/> 
				<case value="0x002078" show="Runtop Inc"/> 
				<case value="0x002085" show="3COM SuperStack II UPS management module"/> 
				<case value="0x00208A" show="Sonix Communications Ltd"/> 
				<case value="0x00208B" show="Focus Enhancements"/> 
				<case value="0x00208C" show="Galaxy Networks Inc"/> 
				<case value="0x002094" show="Cubix Corporation"/> 
				<case value="0x00209C" show="PRIMARY ACCESS CORP."/> 
				<case value="0x0020A5" show="Newer Technology"/> 
				<case value="0x0020A6" show="Proxim Inc"/> 
				<case value="0x0020A7" show="Pairgain Technologies, Inc."/> 
				<case value="0x0020AF" show="3COM Corporation ?"/> 
				<case value="0x0020B2" show="CSP (Printline Multiconnectivity converter)"/> 
				<case value="0x0020B6" show="Agile Networks Inc"/> 
				<case value="0x0020B9" show="Metricom, Inc."/> 
				<case value="0x0020C5" show="Eagle NE2000"/> 
				<case value="0x0020C6" show="NECTEC"/> 
				<case value="0x0020C9" show="Victron"/> 
				<case value="0x0020D0" show="Versalynx Corp. The One Port terminal server"/> 
				<case value="0x0020D2" show="RAD Data Communications Ltd"/> 
				<case value="0x0020D3" show="OST (Ouet Standard Telematique)"/> 
				<case value="0x0020D8" show="NetWave"/> 
				<case value="0x0020DA" show="Xylan"/> 
				<case value="0x0020DC" show="Densitron Taiwan Ltd"/> 
				<case value="0x0020E0" show="PreMax PE-200 (PCMCIA NE2000-clone card, sold by InfoExpress)"/> 
				<case value="0x0020E5" show="Apex Data"/> 
				<case value="0x0020EE" show="Gtech Corporation"/> 
				<case value="0x0020F6" show="Net Tek &amp; Karlnet Inc"/> 
				<case value="0x0020F8" show="Carrera Computers Inc"/> 
				<case value="0x0020FC" show="Matrox"/> 
				<case value="0x004001" show="Zero One Technology Co Ltd (ZyXEL?)"/> 
				<case value="0x004005" show="TRENDware International Inc.; Linksys; Simple Net; all three reported"/> 
				<case value="0x004009" show="Tachibana Tectron Co Ltd"/> 
				<case value="0x00400B" show="Crescendo (now owned by Cisco)"/> 
				<case value="0x00400C" show="General Micro Systems, Inc."/> 
				<case value="0x00400D" show="LANNET Data Communications"/> 
				<case value="0x004010" show="Sonic Mac Ethernet interfaces"/> 
				<case value="0x004011" show="Facilities Andover Environmental Controllers"/> 
				<case value="0x004013" show="NTT Data Communication Systems Corp"/> 
				<case value="0x004014" show="Comsoft Gmbh"/> 
				<case value="0x004015" show="Ascom"/> 
				<case value="0x004017" show="XCd XJet - HP printer server card"/> 
				<case value="0x00401C" show="AST Pentium/90 PC (emulating AMD EISA card)"/> 
				<case value="0x00401F" show="Colorgraph Ltd"/> 
				<case value="0x004020" show="Pilkington Communication"/> 
				<case value="0x004023" show="Logic Corporation"/> 
				<case value="0x004025" show="Molecular Dynamics"/> 
				<case value="0x004026" show="Melco Inc"/> 
				<case value="0x004027" show="SMC Massachusetts [Had:Sigma (?), maybe the S?]"/> 
				<case value="0x004028" show="Netcomm"/> 
				<case value="0x00402A" show="Canoga-Perkins"/> 
				<case value="0x00402B" show="TriGem"/> 
				<case value="0x00402F" show="Xlnt Designs Inc (XDI)"/> 
				<case value="0x004030" show="GK Computer"/> 
				<case value="0x004032" show="Digital Communications"/> 
				<case value="0x004033" show="Addtron Technology Co., Ltd."/> 
				<case value="0x004036" show="TribeStar"/> 
				<case value="0x004039" show="Optec Daiichi Denko Co Ltd"/> 
				<case value="0x00403C" show="Forks, Inc."/> 
				<case value="0x004041" show="Fujikura Ltd."/> 
				<case value="0x004043" show="Nokia Data Communications"/> 
				<case value="0x004048" show="SMD Informatica S.A."/> 
				<case value="0x00404C" show="Hypertec Pty Ltd."/> 
				<case value="0x00404D" show="Telecomm Techniques"/> 
				<case value="0x00404F" show="Space &amp; Naval Warfare Systems"/> 
				<case value="0x004050" show="Ironics, Incorporated"/> 
				<case value="0x004052" show="Star Technologies Inc"/> 
				<case value="0x004053" show="Datum [Bancomm Division] TymServe 2000"/> 
				<case value="0x004054" show="Thinking Machines Corporation"/> 
				<case value="0x004057" show="Lockheed-Sanders"/> 
				<case value="0x004059" show="Yoshida Kogyo K.K."/> 
				<case value="0x00405B" show="Funasset Limited"/> 
				<case value="0x00405D" show="Star-Tek Inc"/> 
				<case value="0x004066" show="Hitachi Cable, Ltd."/> 
				<case value="0x004067" show="Omnibyte Corporation"/> 
				<case value="0x004068" show="Extended Systems"/> 
				<case value="0x004069" show="Lemcom Systems Inc"/> 
				<case value="0x00406A" show="Kentek Information Systems Inc"/> 
				<case value="0x00406E" show="Corollary, Inc."/> 
				<case value="0x00406F" show="Sync Research Inc"/> 
				<case value="0x004072" show="Applied Innovation"/> 
				<case value="0x004074" show="Cable and Wireless"/> 
				<case value="0x004076" show="AMP Incorporated"/> 
				<case value="0x004078" show="Wearnes Automation Pte Ltd"/> 
				<case value="0x00407F" show="Agema Infrared Systems AB"/> 
				<case value="0x004082" show="Laboratory Equipment Corp"/> 
				<case value="0x004085" show="SAAB Instruments AB"/> 
				<case value="0x004086" show="Michels &amp; Kleberhoff Computer"/> 
				<case value="0x004087" show="Ubitrex Corporation"/> 
				<case value="0x004088" show="Mobuis NuBus (Mac) combination video/EtherTalk"/> 
				<case value="0x00408A" show="TPS Teleprocessing Sys. Gmbh"/> 
				<case value="0x00408C" show="Axis Communications AB"/> 
				<case value="0x00408E" show="CXR/Digilog"/> 
				<case value="0x00408F" show="WM-Data Minfo AB"/> 
				<case value="0x004090" show="Ansel Communications PC NE2000 compatible twisted-pair ethernet cards"/> 
				<case value="0x004091" show="Procomp Industria Eletronica"/> 
				<case value="0x004092" show="ASP Computer Products, Inc."/> 
				<case value="0x004094" show="Shographics Inc"/> 
				<case value="0x004095" show="Eagle Technologies [UMC also reported]"/> 
				<case value="0x004096" show="Telesystems SLW Inc"/> 
				<case value="0x00409A" show="Network Express Inc"/> 
				<case value="0x00409C" show="Transware"/> 
				<case value="0x00409D" show="DigiBoard Ethernet-ISDN bridges"/> 
				<case value="0x00409E" show="Concurrent Technologies Ltd."/> 
				<case value="0x00409F" show="Lancast/Casat Technology Inc"/> 
				<case value="0x0040A4" show="Rose Electronics"/> 
				<case value="0x0040A6" show="Cray Research Inc."/> 
				<case value="0x0040AA" show="Valmet Automation Inc"/> 
				<case value="0x0040AD" show="SMA Regelsysteme Gmbh"/> 
				<case value="0x0040AE" show="Delta Controls, Inc."/> 
				<case value="0x0040AF" show="Digital Products, Inc. (DPI)."/> 
				<case value="0x0040B4" show="3COM K.K."/> 
				<case value="0x0040B5" show="Video Technology Computers Ltd"/> 
				<case value="0x0040B6" show="Computerm Corporation"/> 
				<case value="0x0040B9" show="MACQ Electronique SA"/> 
				<case value="0x0040BD" show="Starlight Networks Inc"/> 
				<case value="0x0040C1" show="Bizerba-Werke Wilheim Kraut"/> 
				<case value="0x0040C2" show="Applied Computing Devices"/> 
				<case value="0x0040C3" show="Fischer and Porter Co."/> 
				<case value="0x0040C5" show="Micom Communications Corp."/> 
				<case value="0x0040C6" show="Fibernet Research, Inc."/> 
				<case value="0x0040C7" show="Danpex Corporation"/> 
				<case value="0x0040C8" show="Milan Technology Corp."/> 
				<case value="0x0040CC" show="Silcom Manufacturing Technology Inc"/> 
				<case value="0x0040CF" show="Strawberry Tree Inc"/> 
				<case value="0x0040D0" show="DEC/Compaq"/> 
				<case value="0x0040D2" show="Pagine Corporation"/> 
				<case value="0x0040D4" show="Gage Talker Corp."/> 
				<case value="0x0040D7" show="Studio Gen Inc"/> 
				<case value="0x0040D8" show="Ocean Office Automation Ltd"/> 
				<case value="0x0040DC" show="Tritec Electronic Gmbh"/> 
				<case value="0x0040DF" show="Digalog Systems, Inc."/> 
				<case value="0x0040E1" show="Marner International Inc"/> 
				<case value="0x0040E2" show="Mesa Ridge Technologies Inc"/> 
				<case value="0x0040E3" show="Quin Systems Ltd"/> 
				<case value="0x0040E5" show="Sybus Corporation"/> 
				<case value="0x0040E7" show="Arnos Instruments &amp; Computer"/> 
				<case value="0x0040E9" show="Accord Systems, Inc."/> 
				<case value="0x0040EA" show="PlainTree Systems Inc"/> 
				<case value="0x0040ED" show="Network Controls International Inc"/> 
				<case value="0x0040F0" show="Micro Systems Inc"/> 
				<case value="0x0040F1" show="Chuo Electronics Co., Ltd."/> 
				<case value="0x0040F4" show="Cameo Communications, Inc."/> 
				<case value="0x0040F5" show="OEM Engines"/> 
				<case value="0x0040F6" show="Katron Computers Inc"/> 
				<case value="0x0040F9" show="Combinet"/> 
				<case value="0x0040FA" show="Microboards Inc"/> 
				<case value="0x0040FB" show="Cascade Communications Corp."/> 
				<case value="0x0040FD" show="LXE"/> 
				<case value="0x0040FF" show="Telebit Corporation Personal NetBlazer"/> 
				<case value="0x004854" show="Digital SemiConductor 21143/2 based 10/100"/> 
				<case value="0x004F49" show="Realtek"/> 
				<case value="0x004F4B" show="Pine Technology Ltd."/> 
				<case value="0x005004" show="3com 3C90X"/> 
				<case value="0x00500F" show="Cisco"/> 
				<case value="0x00504D" show="Repotec Group"/> 
				<case value="0x00504E" show="UMC UM9008 NE2000-compatible ISA Card for PC"/> 
				<case value="0x005050" show="Cisco"/> 
				<case value="0x005069" show="PixStream Incorporated"/> 
				<case value="0x0050BD" show="Cisco"/> 
				<case value="0x0050E2" show="Cisco"/> 
				<case value="0x005500" show="Xerox"/> 
				<case value="0x006008" show="3Com (Etherlink III PCMCIA 3C589X) 3Com PCI form factor 3C905 TX board"/> 
				<case value="0x006009" show="Cisco Catalyst 5000 Ethernet switch"/> 
				<case value="0x006025" show="Active Imaging Inc."/> 
				<case value="0x00602F" show="Cisco"/> 
				<case value="0x006030" show="VillageTronic used on Amiga"/> 
				<case value="0x00603E" show="Cisco 100Mbps interface"/> 
				<case value="0x006047" show="Cisco"/> 
				<case value="0x00604E" show="Cycle Computer (Sun MotherBoard Replacements)"/> 
				<case value="0x006052" show="Realtek (RTL 8029 == PCI NE2000)"/> 
				<case value="0x00605C" show="Cisco"/> 
				<case value="0x006067" show="Acer Lan"/> 
				<case value="0x006070" show="Cisco routers (2524 and 4500)"/> 
				<case value="0x006083" show="Cisco Systems, Inc. 3620/3640 routers"/> 
				<case value="0x00608C" show="3Com (1990 onwards)"/> 
				<case value="0x006094" show="AMD PCNET PCI"/> 
				<case value="0x006097" show="3Com"/> 
				<case value="0x0060B0" show="Hewlett-Packard"/> 
				<case value="0x0060F5" show="Phobos FastEthernet for Unix WS"/> 
				<case value="0x008000" show="Multitech Systems Inc"/> 
				<case value="0x008001" show="Periphonics Corporation"/> 
				<case value="0x008004" show="Antlow Computers, Ltd."/> 
				<case value="0x008005" show="Cactus Computer Inc."/> 
				<case value="0x008006" show="Compuadd Corporation"/> 
				<case value="0x008007" show="Dlog NC-Systeme"/> 
				<case value="0x008009" show="Jupiter Systems (older MX-600 series machines)"/> 
				<case value="0x00800D" show="Vosswinkel FU"/> 
				<case value="0x00800F" show="SMC (Standard Microsystem Corp.)"/> 
				<case value="0x008010" show="Commodore"/> 
				<case value="0x008012" show="IMS Corp. IMS failure analysis tester"/> 
				<case value="0x008013" show="Thomas Conrad Corp."/> 
				<case value="0x008015" show="Seiko Systems Inc"/> 
				<case value="0x008016" show="Wandel &amp; Goltermann"/> 
				<case value="0x008017" show="PFU"/> 
				<case value="0x008019" show="Dayna Communications Etherprint product"/> 
				<case value="0x00801A" show="Bell Atlantic"/> 
				<case value="0x00801B" show="Kodiak Technology"/> 
				<case value="0x00801C" show="Cisco"/> 
				<case value="0x008021" show="Newbridge Networks Corporation"/> 
				<case value="0x008023" show="Integrated Business Networks"/> 
				<case value="0x008024" show="Kalpana"/> 
				<case value="0x008026" show="Network Products Corporation"/> 
				<case value="0x008029" show="Microdyne Corporation"/> 
				<case value="0x00802A" show="Test Systems &amp; Simulations Inc"/> 
				<case value="0x00802B" show="IMAC ???"/> 
				<case value="0x00802C" show="The Sage Group PLC"/> 
				<case value="0x00802D" show="Xylogics Inc. Annex terminal servers"/> 
				<case value="0x00802E" show="Plexcom, Inc."/> 
				<case value="0x008033" show="Formation (?)"/> 
				<case value="0x008034" show="SMT-Goupil"/> 
				<case value="0x008035" show="Technology Works"/> 
				<case value="0x008037" show="Ericsson Business Comm."/> 
				<case value="0x008038" show="Data Research &amp; Applications"/> 
				<case value="0x00803B" show="APT Communications, Inc."/> 
				<case value="0x00803D" show="Surigiken Co Ltd"/> 
				<case value="0x00803E" show="Synernetics"/> 
				<case value="0x00803F" show="Hyundai Electronics"/> 
				<case value="0x008042" show="Force Computers"/> 
				<case value="0x008043" show="Networld Inc"/> 
				<case value="0x008045" show="Matsushita Electric Ind Co"/> 
				<case value="0x008046" show="University of Toronto"/> 
				<case value="0x008048" show="Compex, used by Commodore and DEC at least"/> 
				<case value="0x008049" show="Nissin Electric Co Ltd"/> 
				<case value="0x00804C" show="Contec Co., Ltd."/> 
				<case value="0x00804D" show="Cyclone Microsystems, Inc."/> 
				<case value="0x008051" show="ADC Fibermux"/> 
				<case value="0x008052" show="Network Professor"/> 
				<case value="0x008057" show="Adsoft Ltd"/> 
				<case value="0x00805A" show="Tulip Computers International BV"/> 
				<case value="0x00805B" show="Condor Systems, Inc."/> 
				<case value="0x00805C" show="Agilis(?)"/> 
				<case value="0x00805F" show="Compaq Computer Corporation"/> 
				<case value="0x008060" show="Network Interface Corporation"/> 
				<case value="0x008062" show="Interface Co."/> 
				<case value="0x008063" show="Richard Hirschmann Gmbh &amp; Co"/> 
				<case value="0x008064" show="Wyse Technology / Link Technologies"/> 
				<case value="0x008067" show="Square D Company"/> 
				<case value="0x008069" show="Computone Systems"/> 
				<case value="0x00806A" show="ERI (Empac Research Inc.)"/> 
				<case value="0x00806B" show="Schmid Telecommunication"/> 
				<case value="0x00806C" show="Cegelec Projects Ltd"/> 
				<case value="0x00806D" show="Century Systems Corp."/> 
				<case value="0x00806E" show="Nippon Steel Corporation"/> 
				<case value="0x00806F" show="Onelan Ltd"/> 
				<case value="0x008071" show="SAI Technology"/> 
				<case value="0x008072" show="Microplex Systems Ltd"/> 
				<case value="0x008074" show="Fisher Controls"/> 
				<case value="0x008079" show="Microbus Designs Ltd"/> 
				<case value="0x00807B" show="Artel Communications Corp."/> 
				<case value="0x00807C" show="FiberCom"/> 
				<case value="0x00807D" show="Equinox Systems Inc"/> 
				<case value="0x008082" show="PEP Modular Computers Gmbh"/> 
				<case value="0x008086" show="Computer Generation Inc."/> 
				<case value="0x008087" show="Okidata"/> 
				<case value="0x00808A" show="Summit (?)"/> 
				<case value="0x00808B" show="Dacoll Limited"/> 
				<case value="0x00808C" show="Frontier Software Dev. (Netscout Systems)"/> 
				<case value="0x00808D" show="Westcove Technology BV"/> 
				<case value="0x00808E" show="Radstone Technology"/> 
				<case value="0x008090" show="Microtek International Inc"/> 
				<case value="0x008092" show="Japan Computer Industry, Inc."/> 
				<case value="0x008093" show="Xyron Corporation"/> 
				<case value="0x008094" show="Sattcontrol AB"/> 
				<case value="0x008096" show="HDS (Human Designed Systems) X terminals"/> 
				<case value="0x008098" show="TDK Corporation"/> 
				<case value="0x00809A" show="Novus Networks Ltd"/> 
				<case value="0x00809B" show="Justsystem Corporation"/> 
				<case value="0x00809D" show="Datacraft Manufactur'g Pty Ltd"/> 
				<case value="0x00809F" show="Alcatel Business Systems"/> 
				<case value="0x0080A1" show="Microtest"/> 
				<case value="0x0080A3" show="Lantronix (see also 0800A3)"/> 
				<case value="0x0080A6" show="Republic Technology Inc"/> 
				<case value="0x0080A7" show="Measurex Corp"/> 
				<case value="0x0080AD" show="CNet Technology Used by Telebit (among others)"/> 
				<case value="0x0080AE" show="Hughes Network Systems"/> 
				<case value="0x0080AF" show="Allumer Co., Ltd."/> 
				<case value="0x0080B1" show="Softcom A/S"/> 
				<case value="0x0080B2" show="NET (Network Equipment Technologies)"/> 
				<case value="0x0080B6" show="Themis corporation"/> 
				<case value="0x0080BA" show="Specialix (Asia) Pte Ltd"/> 
				<case value="0x0080C0" show="Penril Datability Networks"/> 
				<case value="0x0080C2" show="IEEE 802.1 Committee"/> 
				<case value="0x0080C6" show="Soho"/> 
				<case value="0x0080C7" show="Xircom, Inc."/> 
				<case value="0x0080C8" show="D-Link (also Solectek Pocket Adapters, and LinkSys PCMCIA)"/> 
				<case value="0x0080C9" show="Alberta Microelectronic Centre"/> 
				<case value="0x0080CE" show="Broadcast Television Systems"/> 
				<case value="0x0080D0" show="Computer Products International"/> 
				<case value="0x0080D3" show="Shiva Appletalk-Ethernet interface"/> 
				<case value="0x0080D4" show="Chase Limited"/> 
				<case value="0x0080D6" show="Apple Mac Portable(?)"/> 
				<case value="0x0080D7" show="Fantum Electronics"/> 
				<case value="0x0080D8" show="Network Peripherals"/> 
				<case value="0x0080DA" show="Bruel &amp; Kjaer"/> 
				<case value="0x0080E0" show="XTP Systems Inc"/> 
				<case value="0x0080E3" show="Coral (?)"/> 
				<case value="0x0080E7" show="Lynwood Scientific Dev Ltd"/> 
				<case value="0x0080EA" show="The Fiber Company"/> 
				<case value="0x0080F0" show="Kyushu Matsushita Electric Co"/> 
				<case value="0x0080F1" show="Opus"/> 
				<case value="0x0080F3" show="Sun Electronics Corp"/> 
				<case value="0x0080F4" show="Telemechanique Electrique"/> 
				<case value="0x0080F5" show="Quantel Ltd"/> 
				<case value="0x0080F7" show="Zenith Communications Products"/> 
				<case value="0x0080FB" show="BVM Limited"/> 
				<case value="0x0080FE" show="Azure Technologies Inc"/> 
				<case value="0x009004" show="3Com"/> 
				<case value="0x009027" show="Intel"/> 
				<case value="0x0090B1" show="Cisco"/> 
				<case value="0x00902B" show="Cisco Ethernet Switches and Light Streams"/> 
				<case value="0x009086" show="Cisco"/> 
				<case value="0x009092" show="Cisco"/> 
				<case value="0x0090AB" show="Cisco"/> 
				<case value="0x0090B1" show="Cisco"/> 
				<case value="0x0090F2" show="Cisco Ethernet Switches and Light Streams"/> 
				<case value="0x00A000" show="Bay Networks Ethernet switch"/> 
				<case value="0x00A00C" show="Kingmax Technology Inc. PCMCIA card"/> 
				<case value="0x00A024" show="3com"/> 
				<case value="0x00A03E" show="ATM Forum"/> 
				<case value="0x00A040" show="Apple (PCI Mac)"/> 
				<case value="0x00A04B" show="Sonic Systems Inc. EtherFE 10/100 PCI for Mac or PC"/> 
				<case value="0x00A073" show="Com21"/> 
				<case value="0x00A083" show="Intel"/> 
				<case value="0x00A092" show="Intermate International [LAN printer interfaces]"/> 
				<case value="0x00A0AE" show="Network Peripherals, Inc."/> 
				<case value="0x00A0C8" show="Adtran, Inc."/> 
				<case value="0x00A0C9" show="Intel (PRO100B and PRO100+) [used on Cisco PIX firewall among others]"/> 
				<case value="0x00A0CC" show="Lite-On (used by MacSense in Adapter for Mac, also seen in PCs)"/> 
				<case value="0x00A0D1" show="National Semiconductor [COMPAQ Docking Station]"/> 
				<case value="0x00A0D2" show="Allied Telesyn"/> 
				<case value="0x00AA00" show="Intel"/> 
				<case value="0x00B0d0" show="Computer Products International"/> 
				<case value="0x00C000" show="Lanoptics Ltd"/> 
				<case value="0x00C001" show="Diatek Patient Managment"/> 
				<case value="0x00C002" show="Sercomm Corporation"/> 
				<case value="0x00C003" show="Globalnet Communications"/> 
				<case value="0x00C004" show="Japan Business Computer Co.Ltd"/> 
				<case value="0x00C005" show="Livingston Enterprises Inc Portmaster (OEMed by Cayman)"/> 
				<case value="0x00C006" show="Nippon Avionics Co Ltd"/> 
				<case value="0x00C007" show="Pinnacle Data Systems Inc"/> 
				<case value="0x00C008" show="Seco SRL"/> 
				<case value="0x00C009" show="KT Technology (s) Pte Inc"/> 
				<case value="0x00C00A" show="Micro Craft"/> 
				<case value="0x00C00B" show="Norcontrol A.S."/> 
				<case value="0x00C00C" show="ARK PC Technology, Inc."/> 
				<case value="0x00C00D" show="Advanced Logic Research Inc"/> 
				<case value="0x00C00E" show="Psitech Inc"/> 
				<case value="0x00C00F" show="QNX Software Systems Ltd. [also Quantum Software Systems Ltd]"/> 
				<case value="0x00C011" show="Interactive Computing Devices"/> 
				<case value="0x00C012" show="Netspan Corp"/> 
				<case value="0x00C013" show="Netrix"/> 
				<case value="0x00C014" show="Telematics Calabasas"/> 
				<case value="0x00C015" show="New Media Corp"/> 
				<case value="0x00C016" show="Electronic Theatre Controls"/> 
				<case value="0x00C017" show="Fluke"/> 
				<case value="0x00C018" show="Lanart Corp"/> 
				<case value="0x00C01A" show="Corometrics Medical Systems"/> 
				<case value="0x00C01B" show="Socket Communications"/> 
				<case value="0x00C01C" show="Interlink Communications Ltd."/> 
				<case value="0x00C01D" show="Grand Junction Networks, Inc. (Cisco Catalyst also reported)"/> 
				<case value="0x00C01F" show="S.E.R.C.E.L."/> 
				<case value="0x00C020" show="Arco Electronic, Control Ltd."/> 
				<case value="0x00C021" show="Netexpress"/> 
				<case value="0x00C023" show="Tutankhamon Electronics"/> 
				<case value="0x00C024" show="Eden Sistemas De Computacao SA"/> 
				<case value="0x00C025" show="Dataproducts Corporation"/> 
				<case value="0x00C027" show="Cipher Systems, Inc."/> 
				<case value="0x00C028" show="Jasco Corporation"/> 
				<case value="0x00C029" show="Kabel Rheydt AG"/> 
				<case value="0x00C02A" show="Ohkura Electric Co"/> 
				<case value="0x00C02B" show="Gerloff Gesellschaft Fur"/> 
				<case value="0x00C02C" show="Centrum Communications, Inc."/> 
				<case value="0x00C02D" show="Fuji Photo Film Co., Ltd."/> 
				<case value="0x00C02E" show="Netwiz"/> 
				<case value="0x00C02F" show="Okuma Corp"/> 
				<case value="0x00C030" show="Integrated Engineering B. V."/> 
				<case value="0x00C031" show="Design Research Systems, Inc."/> 
				<case value="0x00C032" show="I-Cubed Limited"/> 
				<case value="0x00C033" show="Telebit Corporation"/> 
				<case value="0x00C034" show="Dale Computer Corporation"/> 
				<case value="0x00C035" show="Quintar Company"/> 
				<case value="0x00C036" show="Raytech Electronic Corp"/> 
				<case value="0x00C039" show="Silicon Systems"/> 
				<case value="0x00C03B" show="Multiaccess Computing Corp"/> 
				<case value="0x00C03C" show="Tower Tech S.R.L."/> 
				<case value="0x00C03D" show="Wiesemann &amp; Theis Gmbh"/> 
				<case value="0x00C03E" show="Fa. Gebr. Heller Gmbh"/> 
				<case value="0x00C03F" show="Stores Automated Systems Inc"/> 
				<case value="0x00C040" show="ECCI"/> 
				<case value="0x00C041" show="Digital Transmission Systems"/> 
				<case value="0x00C042" show="Datalux Corp."/> 
				<case value="0x00C043" show="Stratacom"/> 
				<case value="0x00C044" show="Emcom Corporation"/> 
				<case value="0x00C045" show="Isolation Systems Inc"/> 
				<case value="0x00C046" show="Kemitron Ltd"/> 
				<case value="0x00C047" show="Unimicro Systems Inc"/> 
				<case value="0x00C048" show="Bay Technical Associates"/> 
				<case value="0x00C049" show="US Robotics Total Control (tm) NETServer Card"/> 
				<case value="0x00C04D" show="Mitec Ltd"/> 
				<case value="0x00C04E" show="Comtrol Corporation"/> 
				<case value="0x00C04F" show="Dell"/> 
				<case value="0x00C050" show="Toyo Denki Seizo K.K."/> 
				<case value="0x00C051" show="Advanced Integration Research"/> 
				<case value="0x00C055" show="Modular Computing Technologies"/> 
				<case value="0x00C056" show="Somelec"/> 
				<case value="0x00C057" show="Myco Electronics"/> 
				<case value="0x00C058" show="Dataexpert Corp"/> 
				<case value="0x00C059" show="Nippondenso Corp"/> 
				<case value="0x00C05B" show="Networks Northwest Inc"/> 
				<case value="0x00C05C" show="Elonex PLC"/> 
				<case value="0x00C05D" show="L&amp;N Technologies"/> 
				<case value="0x00C05E" show="Vari-Lite Inc"/> 
				<case value="0x00C060" show="ID Scandinavia A/S"/> 
				<case value="0x00C061" show="Solectek Corporation"/> 
				<case value="0x00C063" show="Morning Star Technologies Inc May be miswrite of 0003C6"/> 
				<case value="0x00C064" show="General Datacomm Ind Inc"/> 
				<case value="0x00C065" show="Scope Communications Inc"/> 
				<case value="0x00C066" show="Docupoint, Inc."/> 
				<case value="0x00C067" show="United Barcode Industries"/> 
				<case value="0x00C068" show="Philp Drake Electronics Ltd"/> 
				<case value="0x00C069" show="California Microwave Inc"/> 
				<case value="0x00C06A" show="Zahner-Elektrik Gmbh &amp; Co KG"/> 
				<case value="0x00C06B" show="OSI Plus Corporation"/> 
				<case value="0x00C06C" show="SVEC Computer Corp"/> 
				<case value="0x00C06D" show="Boca Research, Inc."/> 
				<case value="0x00C06F" show="Komatsu Ltd"/> 
				<case value="0x00C070" show="Sectra Secure-Transmission AB"/> 
				<case value="0x00C071" show="Areanex Communications, Inc."/> 
				<case value="0x00C072" show="KNX Ltd"/> 
				<case value="0x00C073" show="Xedia Corporation"/> 
				<case value="0x00C074" show="Toyoda Automatic Loom Works Ltd"/> 
				<case value="0x00C075" show="Xante Corporation "/> 
				<case value="0x00C076" show="I-Data International A-S"/> 
				<case value="0x00C077" show="Daewoo Telecom Ltd"/> 
				<case value="0x00C078" show="Computer Systems Engineering"/> 
				<case value="0x00C079" show="Fonsys Co Ltd"/> 
				<case value="0x00C07A" show="Priva BV"/> 
				<case value="0x00C07B" show="Ascend Communications ISDN bridges/routers"/> 
				<case value="0x00C07D" show="RISC Developments Ltd"/> 
				<case value="0x00C07F" show="Nupon Computing Corp"/> 
				<case value="0x00C080" show="Netstar Inc"/> 
				<case value="0x00C081" show="Metrodata Ltd"/> 
				<case value="0x00C082" show="Moore Products Co"/> 
				<case value="0x00C084" show="Data Link Corp Ltd"/> 
				<case value="0x00C085" show="Canon"/> 
				<case value="0x00C086" show="The Lynk Corporation"/> 
				<case value="0x00C087" show="UUNET Technologies Inc"/> 
				<case value="0x00C089" show="Telindus Distribution"/> 
				<case value="0x00C08A" show="Lauterbach Datentechnik Gmbh"/> 
				<case value="0x00C08B" show="RISQ Modular Systems Inc"/> 
				<case value="0x00C08C" show="Performance Technologies Inc"/> 
				<case value="0x00C08D" show="Tronix Product Development"/> 
				<case value="0x00C08E" show="Network Information Technology"/> 
				<case value="0x00C08F" show="Matsushita Electric Works, Ltd."/> 
				<case value="0x00C090" show="Praim S.R.L."/> 
				<case value="0x00C091" show="Jabil Circuit, Inc."/> 
				<case value="0x00C092" show="Mennen Medical Inc"/> 
				<case value="0x00C093" show="Alta Research Corp."/> 
				<case value="0x00C095" show="Znyx (Network Appliance); Jupiter Systems (MX-700); Apple (G3) all seen"/> 
				<case value="0x00C096" show="Tamura Corporation"/> 
				<case value="0x00C097" show="Archipel SA"/> 
				<case value="0x00C098" show="Chuntex Electronic Co., Ltd."/> 
				<case value="0x00C09B" show="Reliance Comm/Tec, R-Tec Systems Inc"/> 
				<case value="0x00C09C" show="TOA Electronic Ltd"/> 
				<case value="0x00C09D" show="Distributed Systems Int'l, Inc."/> 
				<case value="0x00C09F" show="Quanta Computer Inc"/> 
				<case value="0x00C0A0" show="Advance Micro Research, Inc."/> 
				<case value="0x00C0A1" show="Tokyo Denshi Sekei Co"/> 
				<case value="0x00C0A2" show="Intermedium A/S"/> 
				<case value="0x00C0A3" show="Dual Enterprises Corporation"/> 
				<case value="0x00C0A4" show="Unigraf OY"/> 
				<case value="0x00C0A7" show="SEEL Ltd"/> 
				<case value="0x00C0A8" show="GVC Corporation"/> 
				<case value="0x00C0A9" show="Barron McCann Ltd"/> 
				<case value="0x00C0AA" show="Silicon Valley Computer"/> 
				<case value="0x00C0AB" show="Jupiter Technology Inc"/> 
				<case value="0x00C0AC" show="Gambit Computer Communications"/> 
				<case value="0x00C0AD" show="Computer Communication Systems"/> 
				<case value="0x00C0AE" show="Towercom Co Inc DBA PC House"/> 
				<case value="0x00C0B0" show="GCC Technologies,Inc."/> 
				<case value="0x00C0B2" show="Norand Corporation"/> 
				<case value="0x00C0B3" show="Comstat Datacomm Corporation"/> 
				<case value="0x00C0B4" show="Myson Technology Inc"/> 
				<case value="0x00C0B5" show="Corporate Network Systems Inc"/> 
				<case value="0x00C0B6" show="Meridian Data Inc"/> 
				<case value="0x00C0B7" show="American Power Conversion Corp"/> 
				<case value="0x00C0B8" show="Fraser's Hill Ltd."/> 
				<case value="0x00C0B9" show="Funk Software Inc"/> 
				<case value="0x00C0BA" show="Netvantage"/> 
				<case value="0x00C0BB" show="Forval Creative Inc"/> 
				<case value="0x00C0BD" show="Inex Technologies, Inc."/> 
				<case value="0x00C0BE" show="Alcatel - Sel"/> 
				<case value="0x00C0BF" show="Technology Concepts Ltd"/> 
				<case value="0x00C0C0" show="Shore Microsystems Inc"/> 
				<case value="0x00C0C1" show="Quad/Graphics Inc"/> 
				<case value="0x00C0C2" show="Infinite Networks Ltd."/> 
				<case value="0x00C0C3" show="Acuson Computed Sonography"/> 
				<case value="0x00C0C4" show="Computer Operational"/> 
				<case value="0x00C0C5" show="SID Informatica"/> 
				<case value="0x00C0C6" show="Personal Media Corp"/> 
				<case value="0x00C0C8" show="Micro Byte Pty Ltd"/> 
				<case value="0x00C0C9" show="Bailey Controls Co"/> 
				<case value="0x00C0CA" show="Alfa, Inc."/> 
				<case value="0x00C0CB" show="Control Technology Corporation"/> 
				<case value="0x00C0CD" show="Comelta S.A."/> 
				<case value="0x00C0C0" show="Ratoc System Inc"/> 
				<case value="0x00C0D1" show="Comtree Technology Corporation (EFA also reported)"/> 
				<case value="0x00C0D2" show="Syntellect Inc"/> 
				<case value="0x00C0D4" show="Axon Networks Inc"/> 
				<case value="0x00C0D5" show="Quancom Electronic Gmbh"/> 
				<case value="0x00C0D6" show="J1 Systems, Inc."/> 
				<case value="0x00C0D9" show="Quinte Network Confidentiality Equipment Inc"/> 
				<case value="0x00C0DB" show="IPC Corporation (Pte) Ltd"/> 
				<case value="0x00C0DC" show="EOS Technologies, Inc."/> 
				<case value="0x00C0DE" show="ZComm Inc"/> 
				<case value="0x00C0DF" show="Kye Systems Corp"/> 
				<case value="0x00C0E1" show="Sonic Solutions"/> 
				<case value="0x00C0E2" show="Calcomp, Inc."/> 
				<case value="0x00C0E3" show="Ositech Communications Inc"/> 
				<case value="0x00C0E4" show="Landis &amp; Gyr Powers Inc"/> 
				<case value="0x00C0E5" show="GESPAC S.A."/> 
				<case value="0x00C0E6" show="TXPORT"/> 
				<case value="0x00C0E7" show="Fiberdata AB"/> 
				<case value="0x00C0E8" show="Plexcom Inc"/> 
				<case value="0x00C0E9" show="Oak Solutions Ltd"/> 
				<case value="0x00C0EA" show="Array Technology Ltd."/> 
				<case value="0x00C0EC" show="Dauphin Technology"/> 
				<case value="0x00C0ED" show="US Army Electronic Proving Ground"/> 
				<case value="0x00C0EE" show="Kyocera Corporation"/> 
				<case value="0x00C0EF" show="Abit Corporation"/> 
				<case value="0x00C0F0" show="Kingston Technology Corporation"/> 
				<case value="0x00C0F1" show="Shinko Electric Co Ltd"/> 
				<case value="0x00C0F2" show="Transition Engineering Inc"/> 
				<case value="0x00C0F3" show="Network Communications Corp"/> 
				<case value="0x00C0F4" show="Interlink System Co., Ltd."/> 
				<case value="0x00C0F5" show="Metacomp Inc"/> 
				<case value="0x00C0F6" show="Celan Technology Inc."/> 
				<case value="0x00C0F7" show="Engage Communication, Inc."/> 
				<case value="0x00C0F8" show="About Computing Inc."/> 
				<case value="0x00C0FA" show="Canary Communications Inc"/> 
				<case value="0x00C0FB" show="Advanced Technology Labs"/> 
				<case value="0x00C0FC" show="ASDG Incorporated"/> 
				<case value="0x00C0FD" show="Prosum"/> 
				<case value="0x00C0FF" show="Box Hill Systems Corporation"/> 
				<case value="0x00DD00" show="Ungermann-Bass IBM RT"/> 
				<case value="0x00DD01" show="Ungermann-Bass"/> 
				<case value="0x00DD08" show="Ungermann-Bass"/> 
				<case value="0x00E011" show="Uniden Corporation"/> 
				<case value="0x00E014" show="Cisco"/> 
				<case value="0x00E016" show="rapid-city (now a part of bay networks)"/> 
				<case value="0x00E018" show="Asustek Intel 82558-based Integrated Fast Ethernet for WIM"/> 
				<case value="0x00E01E" show="Cisco"/> 
				<case value="0x00E029" show="SMC EtherPower II 10/100"/> 
				<case value="0x00E02C" show="AST - built into 5166M PC motherboard (win95 id's as Intel)"/> 
				<case value="0x00E034" show="Cisco"/> 
				<case value="0x00E039" show="Paradyne 7112 T1 DSU/CSU"/> 
				<case value="0x00E04F" show="Cisco"/> 
				<case value="0x00E07D" show="Encore (Netronix?) 10/100 PCI Fast ethernet card"/> 
				<case value="0x00E081" show="Tyan Computer Corp. Onboard Intel 82558 10/100"/> 
				<case value="0x00E083" show="Jato Technologies, Inc."/> 
				<case value="0x00E08F" show="Cisco Systems Catalyst 2900 series"/> 
				<case value="0x00E098" show="Linksys PCMCIA card"/> 
				<case value="0x00E0A3" show="Cisco Systems Catalyst 1924"/> 
				<case value="0x00E0B0" show="Cisco Systems Various systems reported"/> 
				<case value="0x00E0B8" show="AMD PCNet in a Gateway 2000"/> 
				<case value="0x00E0C5" show="BCOM Electronics Inc."/> 
				<case value="0x00E0ED" show="New Link"/> 
				<case value="0x00E0F7" show="Cisco"/> 
				<case value="0x00E0F9" show="Cisco"/> 
				<case value="0x00E0FE" show="Cisco"/> 
				<case value="0x020406" show="BBN (Bolt Beranek and Newman) internal usage (not registered)"/> 
				<case value="0x020701" show="Racal-InterLan OR Racal-Datacom (ex-Interlan) DEC (UNIBUS or QBUS), Apollo, Cisco OR MICOM"/> 
				<case value="0x026060" show="3Com"/> 
				<case value="0x026086" show="Satelcom MegaPac (UK)"/> 
				<case value="0x02608C" show="3Com IBM PC; Imagen; Valid; Cisco; Macintosh"/> 
				<case value="0x02A0C9" show="Intel"/> 
				<case value="0x02AA3C" show="Olivetti"/> 
				<case value="0x02CF1F" show="CMC Masscomp; Silicon Graphics; Prime EXL"/> 
				<case value="0x02E03B" show="Prominet Corporation Gigabit Ethernet Switch"/> 
				<case value="0x02E6D3" show="BTI (Bus-Tech, Inc.) IBM Mainframes"/> 
				<case value="0x048845" show="Bay Networks token ring line card"/> 
				<case value="0x080001" show="Computer Vision"/> 
				<case value="0x080002" show="3Com (formerly Bridge)"/> 
				<case value="0x080003" show="ACC (Advanced Computer Comm.)"/> 
				<case value="0x080005" show="Symbolics Symbolics LISP machines"/> 
				<case value="0x080006" show="Siemens Nixdorf PC clone"/> 
				<case value="0x080007" show="Apple"/> 
				<case value="0x080008" show="BBN (Bolt Beranek and Neuman)"/> 
				<case value="0x080009" show="Hewlett-Packard"/> 
				<case value="0x08000A" show="Nestar Systems"/> 
				<case value="0x08000B" show="Unisys also Ascom-Timeplex (former Unisys subsidiary)"/> 
				<case value="0x08000D" show="ICL (International Computers, Ltd.)"/> 
				<case value="0x08000E" show="NCR/AT&amp;T"/> 
				<case value="0x08000F" show="SMC (Standard Microsystems Corp.)"/> 
				<case value="0x080010" show="AT&amp;T [misrepresentation of 800010?]"/> 
				<case value="0x080011" show="Tektronix, Inc."/> 
				<case value="0x080014" show="Excelan BBN Butterfly, Masscomp, Silicon Graphics"/> 
				<case value="0x080017" show="NSC (National Semiconductor Corp.) (used to have Network System Corp., wrong NSC)"/> 
				<case value="0x08001A" show="Data General (Tiara ?)"/> 
				<case value="0x08001B" show="Data General"/> 
				<case value="0x08001E" show="Apollo"/> 
				<case value="0x08001F" show="Sharp"/> 
				<case value="0x080020" show="Sun Sun machines"/> 
				<case value="0x080022" show="NBI (Nothing But Initials)"/> 
				<case value="0x080023" show="Matsushita Denso"/> 
				<case value="0x080025" show="CDC"/> 
				<case value="0x080026" show="Norsk Data (Nord)"/> 
				<case value="0x080027" show="PCS Computer Systems GmbH"/> 
				<case value="0x080028" show="TI Explorer"/> 
				<case value="0x08002B" show="DEC"/> 
				<case value="0x08002E" show="Metaphor"/> 
				<case value="0x08002F" show="Prime Computer Prime 50-Series LHC300"/> 
				<case value="0x080030" show="CERN"/> 
				<case value="0x080032" show="Tigan"/> 
				<case value="0x080036" show="Intergraph CAE stations"/> 
				<case value="0x080037" show="Fujitsu-Xerox"/> 
				<case value="0x080038" show="Bull"/> 
				<case value="0x080039" show="Spider Systems"/> 
				<case value="0x08003B" show="Torus Systems"/> 
				<case value="0x08003D" show="cadnetix"/> 
				<case value="0x08003E" show="Motorola VME bus processor modules"/> 
				<case value="0x080041" show="DCA (Digital Comm. Assoc.)"/> 
				<case value="0x080044" show="DSI (DAVID Systems, Inc.)"/> 
				<case value="0x080045" show="Xylogics? (maybe Xylogics, but they claim not to know this number)"/> 
				<case value="0x080046" show="Sony"/> 
				<case value="0x080047" show="Sequent"/> 
				<case value="0x080048" show="Eurotherm Gauging Systems"/> 
				<case value="0x080049" show="Univation"/> 
				<case value="0x08004C" show="Encore"/> 
				<case value="0x08004E" show="BICC [3com bought BICC, so may appear on 3com equipment as well]"/> 
				<case value="0x080051" show="Experdata"/> 
				<case value="0x080056" show="Stanford University"/> 
				<case value="0x080057" show="Evans &amp; Sutherland (?)"/> 
				<case value="0x080058" show="??? DECsystem-20"/> 
				<case value="0x08005A" show="IBM"/> 
				<case value="0x080066" show="AGFA printers, phototypesetters etc."/> 
				<case value="0x080067" show="Comdesign"/> 
				<case value="0x080068" show="Ridge"/> 
				<case value="0x080069" show="Silicon Graphics"/> 
				<case value="0x08006A" show="ATTst (?)"/> 
				<case value="0x08006E" show="Excelan OR Concurrent Masscomp"/> 
				<case value="0x080070" show="Mitsubishi"/> 
				<case value="0x080074" show="Casio"/> 
				<case value="0x080075" show="DDE (Danish Data Elektronik A/S)"/> 
				<case value="0x080077" show="TSL (now Retix)"/> 
				<case value="0x080079" show="Silicon Graphics"/> 
				<case value="0x08007C" show="Vitalink TransLAN III"/> 
				<case value="0x080080" show="XIOS"/> 
				<case value="0x080081" show="Crosfield Electronics"/> 
				<case value="0x080083" show="Seiko Denshi"/> 
				<case value="0x080086" show="Imagen/QMS"/> 
				<case value="0x080087" show="Xyplex terminal servers"/> 
				<case value="0x080088" show="McDATA Corporation"/> 
				<case value="0x080089" show="Kinetics AppleTalk-Ethernet interface"/> 
				<case value="0x08008B" show="Pyramid"/> 
				<case value="0x08008D" show="XyVision XyVision machines"/> 
				<case value="0x08008E" show="Tandem / Solbourne Computer ?"/> 
				<case value="0x08008F" show="Chipcom Corp."/> 
				<case value="0x080090" show="Retix Inc Bridges"/> 
				<case value="0x09006A" show="AT&amp;T"/> 
				<case value="0x10005A" show="IBM"/> 
				<case value="0x100090" show="Hewlett-Packard Advisor products"/> 
				<case value="0x1000D4" show="DEC"/> 
				<case value="0x1000E0" show="Apple A/UX (modified addresses for licensing)"/> 
				<case value="0x2E2E2E" show="LAA (Locally Administered Address) for Meditech Systems"/> 
				<case value="0x3C0000" show="3Com dual function (V.34 modem + Ethernet) card"/> 
				<case value="0x400003" show="Net Ware (?)"/> 
				<case value="0x444553" show="Microsoft (Windows95 internal adapters)"/> 
				<case value="0x444649" show="DFI (Diamond Flower Industries)"/> 
				<case value="0x475443" show="GTC (Not registered!) (This number is a multicast!)"/> 
				<case value="0x484453" show="HDS ???"/> 
				<case value="0x484C00" show="Network Solutions"/> 
				<case value="0x4854E8" show="winbond?"/> 
				<case value="0x4C424C" show="Information Modes software modified addresses (not registered?)"/> 
				<case value="0x525400" show="Realtek (UpTech? also reported)"/> 
				<case value="0x52544C" show="Novell 2000"/> 
				<case value="0x5254AB" show="REALTEK (a Realtek 8029 based PCI Card)"/> 
				<case value="0x565857" show="Aculab plc audio bridges"/> 
				<case value="0x800010" show="AT&amp;T [misrepresented as 080010? One source claims this is correct]"/> 
				<case value="0x80AD00" show="CNET Technology Inc. (Probably an error, see instead 0080AD)"/> 
				<case value="0xAA0000" show="DEC obsolete"/> 
				<case value="0xAA0001" show="DEC obsolete"/> 
				<case value="0xAA0002" show="DEC obsolete"/> 
				<case value="0xAA0003" show="DEC Global physical address for some DEC machines"/> 
				<case value="0xAA0004" show="DEC Local logical address for systems running DECNET"/> 
				<case value="0xC00000" show="Western Digital (may be reversed 00 00 C0?)"/> 
				<case value="0xCF0001" show="Data Comm for Business"/> 
				<case value="0xEC1000" show="Enance Source Co., Ltd. PC clones(?)"/> 
				<case value="0xE20C0F" show="Kingston Technologies"/>
				<default show="code not available"/>
			</switch>
		</showmap>
	</showtemplate>



	<!-- Generic template for visualizing TR, FDDI MAC addresses -->
	<showtemplate name="MACaddressTR" showtype="hexnox" showgrp="3" showsep="-">
		<showdtl>
			<protofield showdata="showvalue"/>
			<if expr="(buf2int(this[0:1]) bitwand 0b10000000) == 0b10000000">
				<!-- It extracts the first byte of the MAC address, then it matches the result against -->
				<!-- the 'xxxxxxx1' pattern -->
				<!-- Extract the first byte of the MAC address -->
				<!-- If it is a multicast or broadcast address, the first bit will be '1' -->
				
				<if-true>
					<if expr="this == '\xFF\xFF\xFF\xFF\xFF\xFF'">>
						<if-true>
							<text value=" (Broadcast address)"/>
						</if-true>

						<if-false>
							<text value=" (Multicast address)"/>
						</if-false>		
					</if>
				</if-true>

				<if-false>
					<text value=" (Unicast address, vendor "/>
					<protofield showdata="showmap"/>
					<text value=")"/>
				</if-false>
			</if>
		</showdtl>
	</showtemplate>

</visualization>
</netpdl>


