Only in tcpdump-3.0.3: %1 diff -ur --new-file tcpdump-3.0.3/libpcap-0.0/gencode.c tcpdump-3.0.3+ave/libpcap-0.0/gencode.c --- tcpdump-3.0.3/libpcap-0.0/gencode.c Mon Jun 20 22:07:54 1994 +++ tcpdump-3.0.3+ave/libpcap-0.0/gencode.c Mon Apr 8 14:40:09 1996 @@ -30,6 +30,7 @@ #include #include +#include #include #include @@ -459,6 +460,11 @@ case DLT_EN10MB: off_linktype = 12; off_nl = 14; + return; + + case DLT_ARCNET: + off_linktype = 2; + off_nl = 6; return; case DLT_SLIP: diff -ur --new-file tcpdump-3.0.3/libpcap-0.0/nametoaddr.c tcpdump-3.0.3+ave/libpcap-0.0/nametoaddr.c --- tcpdump-3.0.3/libpcap-0.0/nametoaddr.c Mon Jun 20 22:07:54 1994 +++ tcpdump-3.0.3+ave/libpcap-0.0/nametoaddr.c Mon Apr 8 13:27:22 1996 @@ -30,6 +30,7 @@ #include #include #include +#include #include #include #include diff -ur --new-file tcpdump-3.0.3/libpcap-0.0/pcap-linux.c tcpdump-3.0.3+ave/libpcap-0.0/pcap-linux.c --- tcpdump-3.0.3/libpcap-0.0/pcap-linux.c Sun Oct 16 16:58:22 1994 +++ tcpdump-3.0.3+ave/libpcap-0.0/pcap-linux.c Mon Apr 8 13:46:34 1996 @@ -19,8 +19,8 @@ #include +#include #include -#include #include #include #include @@ -28,6 +28,7 @@ #include #include #include +#include #include "pcap-int.h" @@ -133,9 +134,14 @@ return (0); } bzero(p, sizeof(*p)); - if (strncmp("et", device, 2) == 0) { + + /* it would be better to compare these using the Linux "link encap" field */ + if (strncmp("eth", device, 3) == 0) { p->linktype = DLT_EN10MB; has_promisc = 1; + } else if (strncmp("arc", device, 3) == 0) { + p->linktype = DLT_ARCNET; + has_promisc = 0; /* some cards do, but they're unsupported anyway */ } else if (strncmp("sl", device, 2) == 0) p->linktype = DLT_SLIP; else if (strncmp("ppp", device, 3) == 0) Only in tcpdump-3.0.3/tcpdump-3.0: Makefile diff -ur --new-file tcpdump-3.0.3/tcpdump-3.0/Makefile.in tcpdump-3.0.3+ave/tcpdump-3.0/Makefile.in --- tcpdump-3.0.3/tcpdump-3.0/Makefile.in Thu Jun 30 01:46:30 1994 +++ tcpdump-3.0.3+ave/tcpdump-3.0/Makefile.in Mon Apr 8 13:51:18 1996 @@ -100,7 +100,7 @@ print-icmp.c print-sl.c print-ppp.c print-rip.c \ print-snmp.c print-ntp.c print-null.c print-egp.c print-ospf.c \ print-fddi.c print-llc.c print-sunrpc.c \ - print-wb.c print-decnet.c print-isoclns.c print-ipx.c \ + print-wb.c print-decnet.c print-isoclns.c print-ipx.c print-arcnet.c \ util.c bpf_dump.c parsenfsfh.c GEN = version.c diff -ur --new-file tcpdump-3.0.3/tcpdump-3.0/configure tcpdump-3.0.3+ave/tcpdump-3.0/configure --- tcpdump-3.0.3/tcpdump-3.0/configure Thu Jul 7 12:57:16 1994 +++ tcpdump-3.0.3+ave/tcpdump-3.0/configure Mon Apr 8 13:30:26 1996 @@ -43,6 +43,7 @@ endif switch ( $md ) case alpha: + case i586: case i486: case i386: if ( $name == "linux" ) then diff -ur --new-file tcpdump-3.0.3/tcpdump-3.0/interface.h tcpdump-3.0.3+ave/tcpdump-3.0/interface.h --- tcpdump-3.0.3/tcpdump-3.0/interface.h Fri Jul 22 20:51:22 1994 +++ tcpdump-3.0.3+ave/tcpdump-3.0/interface.h Mon Apr 8 13:50:08 1996 @@ -100,6 +100,8 @@ extern void ether_if_print(u_char *, const struct pcap_pkthdr *, const u_char *); +extern void arcnet_if_print(u_char *, const struct pcap_pkthdr *, + const u_char *); extern void fddi_if_print(u_char *, const struct pcap_pkthdr *, const u_char*); extern void null_if_print(u_char *, const struct pcap_pkthdr *, const u_char*); extern void ppp_if_print(u_char *, const struct pcap_pkthdr *, const u_char *); diff -ur --new-file tcpdump-3.0.3/tcpdump-3.0/libpcap/gencode.c tcpdump-3.0.3+ave/tcpdump-3.0/libpcap/gencode.c --- tcpdump-3.0.3/tcpdump-3.0/libpcap/gencode.c Mon Jun 20 22:07:54 1994 +++ tcpdump-3.0.3+ave/tcpdump-3.0/libpcap/gencode.c Mon Apr 8 14:40:09 1996 @@ -30,6 +30,7 @@ #include #include +#include #include #include @@ -459,6 +460,11 @@ case DLT_EN10MB: off_linktype = 12; off_nl = 14; + return; + + case DLT_ARCNET: + off_linktype = 2; + off_nl = 6; return; case DLT_SLIP: diff -ur --new-file tcpdump-3.0.3/tcpdump-3.0/libpcap/nametoaddr.c tcpdump-3.0.3+ave/tcpdump-3.0/libpcap/nametoaddr.c --- tcpdump-3.0.3/tcpdump-3.0/libpcap/nametoaddr.c Mon Jun 20 22:07:54 1994 +++ tcpdump-3.0.3+ave/tcpdump-3.0/libpcap/nametoaddr.c Mon Apr 8 13:27:22 1996 @@ -30,6 +30,7 @@ #include #include #include +#include #include #include #include diff -ur --new-file tcpdump-3.0.3/tcpdump-3.0/libpcap/pcap-linux.c tcpdump-3.0.3+ave/tcpdump-3.0/libpcap/pcap-linux.c --- tcpdump-3.0.3/tcpdump-3.0/libpcap/pcap-linux.c Sun Oct 16 16:58:22 1994 +++ tcpdump-3.0.3+ave/tcpdump-3.0/libpcap/pcap-linux.c Mon Apr 8 13:46:34 1996 @@ -19,8 +19,8 @@ #include +#include #include -#include #include #include #include @@ -28,6 +28,7 @@ #include #include #include +#include #include "pcap-int.h" @@ -133,9 +134,14 @@ return (0); } bzero(p, sizeof(*p)); - if (strncmp("et", device, 2) == 0) { + + /* it would be better to compare these using the Linux "link encap" field */ + if (strncmp("eth", device, 3) == 0) { p->linktype = DLT_EN10MB; has_promisc = 1; + } else if (strncmp("arc", device, 3) == 0) { + p->linktype = DLT_ARCNET; + has_promisc = 0; /* some cards do, but they're unsupported anyway */ } else if (strncmp("sl", device, 2) == 0) p->linktype = DLT_SLIP; else if (strncmp("ppp", device, 3) == 0) diff -ur --new-file tcpdump-3.0.3/tcpdump-3.0/print-arcnet.c tcpdump-3.0.3+ave/tcpdump-3.0/print-arcnet.c --- tcpdump-3.0.3/tcpdump-3.0/print-arcnet.c Wed Dec 31 19:00:00 1969 +++ tcpdump-3.0.3+ave/tcpdump-3.0/print-arcnet.c Mon Apr 8 14:42:22 1996 @@ -0,0 +1,174 @@ +/* + * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994 + * The Regents of the University of California. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that: (1) source code distributions + * retain the above copyright notice and this paragraph in its entirety, (2) + * distributions including binary code include the above copyright notice and + * this paragraph in its entirety in the documentation or other materials + * provided with the distribution, and (3) all advertising materials mentioning + * features or use of this software display the following acknowledgement: + * ``This product includes software developed by the University of California, + * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of + * the University nor the names of its contributors may be used to endorse + * or promote products derived from this software without specific prior + * written permission. + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED + * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. + */ +#ifndef lint +static char rcsid[] = + "@(#) $Header: print-arcnet.c,v 1.00 96/04/08 12:00:00 apenwarr Exp $ (LBL)"; +#endif + +#include +#include +#include +#include + +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include + +#include "interface.h" +#include "addrtoname.h" + +const u_char *packetp; +const u_char *snapend; + +/* offsets are for the fake "struct ClientData" in + * linux/drivers/net/arcnet.c, which is basically a "collapsed" version + * of the real packet (no padding area in the middle, and no "offset" + * field) + */ +static inline void +arcnet_print(register const u_char *bp, int length) +{ + if (qflag) + (void)printf("%02X %02X %d: ",*bp,*(bp+1),length); + else + (void)printf("%02X %02X [%02X] %d: ", + *bp,*(bp+1),*(bp+2),length); +} + +/* + * This is the top level routine of the printer. 'p' is the points + * to the ether header of the packet, 'tvp' is the timestamp, + * 'length' is the length of the packet off the wire, and 'caplen' + * is the number of bytes actually captured. + */ +void +arcnet_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p) +{ + int caplen = h->caplen; + int length = h->len; + const u_char *ep; + u_short protocol_id; + extern int arcnet_encap_print(u_short protocol_id, const u_char *p, + int length,int caplen); + + ts_print(&h->ts); + + if (caplen < 6) { + printf("[|arcnet]"); + goto out; + } + + if (eflag) + arcnet_print(p, length); + + /* + * Some printers want to get back at the hardware addresses, + * and/or check that they're not walking off the end of the packet. + * Rather than pass them all the way down, we set these globals. + */ + packetp = p; + snapend = p + caplen; + + ep = p; + length -= 6; + caplen -= 6; + p += 6; + + protocol_id = *(ep+2); + + if (arcnet_encap_print(protocol_id, p, length, caplen) == 0) { + /* type not recognized, print raw packet */ + if (!eflag) + arcnet_print(ep, length + 6); + if (!xflag && !qflag) + default_print(p, caplen); + } + + if (xflag) + default_print(p, caplen); + out: + putchar('\n'); +} + +/* + * Prints the packet encapsulated in an Ethernet data segment + * (or an equivalent encapsulation), given the Ethernet type code. + * + * Returns non-zero if it can do so, zero if the ethertype is unknown. + * + * Stuffs the ether type into a global for the benefit of lower layers + * that might want to know what it is. + */ + +int +arcnet_encap_print(u_short protocol_id, const u_char *p, int length, + int caplen) +{ + switch (protocol_id) { + + case 0xD4: /* IP */ + ip_print(p, length); + return (1); + + case 0xD5: /* ARP */ + case 0xD6: /* RARP */ + arp_print(p, length, caplen); + return (1); + + /*case ETHERTYPE_DN: + decnet_print(p, length, caplen); + return (1);*/ + + case 0xDD: /* Appletalk (untested!) */ + if (vflag) + fputs("et1 ", stdout); + atalk_print(p, length); + return (1); + + /*case ETHERTYPE_AARP: + aarp_print(p, length); + return (1);*/ + + case 0xFA: /* IPX */ + ipx_print(p, length); + return (1); + + /*case ETHERTYPE_LAT: + case ETHERTYPE_MOPRC: + case ETHERTYPE_MOPDL:*/ + case 0xF0: /* RFC1051 - give up now */ + /* default_print for now */ + default: + return (0); + } +} + diff -ur --new-file tcpdump-3.0.3/tcpdump-3.0/tcpdump.c tcpdump-3.0.3+ave/tcpdump-3.0/tcpdump.c --- tcpdump-3.0.3/tcpdump-3.0/tcpdump.c Fri Jul 22 20:50:53 1994 +++ tcpdump-3.0.3+ave/tcpdump-3.0/tcpdump.c Mon Apr 8 14:23:34 1996 @@ -83,6 +83,7 @@ static struct printer printers[] = { { ether_if_print, DLT_EN10MB }, + { arcnet_if_print, DLT_ARCNET }, { sl_if_print, DLT_SLIP }, { ppp_if_print, DLT_PPP }, { fddi_if_print, DLT_FDDI }, @@ -94,7 +95,7 @@ lookup_printer(int type) { struct printer *p; - + for (p = printers; p->f; ++p) if (type == p->type) return p->f;