aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--packet-syslog.c97
-rw-r--r--randpkt.c26
2 files changed, 76 insertions, 47 deletions
diff --git a/packet-syslog.c b/packet-syslog.c
index 4aea09ac09..c66eef70d9 100644
--- a/packet-syslog.c
+++ b/packet-syslog.c
@@ -3,7 +3,7 @@
*
* Copyright 2000, Gerald Combs <gerald@zing.org>
*
- * $Id: packet-syslog.c,v 1.1 2000/06/11 05:19:20 gerald Exp $
+ * $Id: packet-syslog.c,v 1.2 2000/06/11 15:54:02 gerald Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@zing.org>
@@ -42,13 +42,15 @@
#define PRIORITY_MASK 0x0007 /* 0000 0111 */
#define FACILITY_MASK 0x03f8 /* 1111 1000 */
+/* The maximum number if priority digits to read in. */
+#define MAX_DIGITS 3
+
/* On my RH 6.2 box, memcpy overwrites nearby chunks of memory if this is
- a multiple of four. */
+ a multiple of four... */
#define COL_INFO_LEN 35
#define ELLIPSIS "..." /* ISO 8859-1 doesn't appear to have a real ellipsis. */
-#define ELL_LEN ((COL_INFO_LEN - strlen(ELLIPSIS)) - 1)
-static const value_string short_pri[] = {
+static const value_string short_lev[] = {
{ 0, "EMERG" },
{ 1, "ALERT" },
{ 2, "CRIT" },
@@ -70,9 +72,10 @@ static const value_string short_fac[] = {
{ 6, "LPR" },
{ 7, "NEWS" },
{ 8, "UUCP" },
- { 9, "CRON" },
+ { 9, "CRON" }, /* The BSDs, Linux, and others */
{ 10, "AUTHPRIV" },
{ 11, "FTP" },
+ { 15, "CRON" }, /* Solaris */
{ 16, "LOCAL0" },
{ 17, "LOCAL1" },
{ 18, "LOCAL2" },
@@ -84,7 +87,7 @@ static const value_string short_fac[] = {
{ 0, NULL },
};
-static const value_string long_pri[] = {
+static const value_string long_lev[] = {
{ 0, "EMERG - system is unusable" },
{ 1, "ALERT - action must be taken immediately" },
{ 2, "CRIT - critical conditions" },
@@ -106,9 +109,10 @@ static const value_string long_fac[] = {
{ 6, "LPR - line printer subsystem" },
{ 7, "NEWS - network news subsystem" },
{ 8, "UUCP - UUCP subsystem" },
- { 9, "CRON - clock daemon" },
+ { 9, "CRON - clock daemon (BSD, Linux)" },
{ 10, "AUTHPRIV - security/authorization messages (private)" },
{ 11, "FTP - ftp daemon" },
+ { 15, "CRON - clock daemon (Solaris)" },
{ 16, "LOCAL0 - reserved for local use" },
{ 17, "LOCAL1 - reserved for local use" },
{ 18, "LOCAL2 - reserved for local use" },
@@ -121,32 +125,34 @@ static const value_string long_fac[] = {
};
static gint proto_syslog = -1;
-static gint hf_syslog_priority = -1;
+static gint hf_syslog_level = -1;
static gint hf_syslog_facility = -1;
static gint hf_syslog_msg_len = -1;
static gint ett_syslog = -1;
/* I couldn't find any documentation for the syslog message format.
- According to the BSD sources, the message format is '<', N, '>', and
- T. N is a decimal value, which should be treated as an 8 bit
- unsigned integer. The lower three bits comprise the priority, and the
+ According to the BSD sources, the message format is '<', P, '>', and
+ T. P is a decimal value, which should be treated as an 8 bit
+ unsigned integer. The lower three bits comprise the level, and the
upper five bits are the facility. T is the message text.
*/
#if 0
static void dissect_syslog(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
- gint num = -1, pri, fac;
+ gint pri = -1, lev, fac;
gint msg_off = 0, msg_len;
+ gint ellipsis_len = (COL_INFO_LEN - strlen(ELLIPSIS)) - 1;
proto_item *ti;
proto_tree *syslog_tree;
gchar msg_str[COL_INFO_LEN];
#else
static void dissect_syslog(const u_char *pd, int o, frame_data *fd, proto_tree *tree)
{
- gint num = -1, pri = -1, fac = -1;
+ gint pri = -1, lev = -1, fac = -1;
gint msg_off = 0, msg_len;
+ gint ellipsis_len = (COL_INFO_LEN - strlen(ELLIPSIS)) - 1;
proto_item *ti;
proto_tree *syslog_tree;
gchar msg_str[COL_INFO_LEN];
@@ -158,59 +164,61 @@ static void dissect_syslog(const u_char *pd, int o, frame_data *fd, proto_tree *
pinfo->current_proto = "Syslog";
msg_len = tvb_length(tvb);
- if (tvb_get_guint8(tvb, 0) == '<') {
+
+ if (tvb_get_guint8(tvb, 0) == '<' && isdigit(tvb_get_guint8(tvb, 1))) {
msg_off++;
- num = 0;
- while (isdigit(tvb_get_guint8(tvb, msg_off)) &&
+ pri = 0;
+ while (isdigit(tvb_get_guint8(tvb, msg_off)) && msg_off <= MAX_DIGITS &&
tvb_length_remaining(tvb, msg_off)) {
- num = num * 10 + (tvb_get_guint8(tvb, msg_off) - '0');
+ pri = pri * 10 + (tvb_get_guint8(tvb, msg_off) - '0');
msg_off++;
}
if (tvb_get_guint8(tvb, msg_off) == '>')
msg_off++;
- msg_len = tvb_length_remaining(tvb, msg_off);
- if (msg_len > ELL_LEN) {
- tvb_memcpy(tvb, msg_str, msg_off, ELL_LEN);
- strcpy (msg_str + ELL_LEN, ELLIPSIS);
- msg_str[COL_INFO_LEN] = '\0';
- } else {
- tvb_memcpy(tvb, msg_str, msg_off, msg_len);
- msg_str[msg_len] = '\0';
- }
-
- fac = (num & FACILITY_MASK) >> 3;
- pri = num & PRIORITY_MASK;
+ fac = (pri & FACILITY_MASK) >> 3;
+ lev = pri & PRIORITY_MASK;
}
+ /* Copy the message into a string buffer, with a trailing ellipsis if needed. */
+ msg_len = tvb_length_remaining(tvb, msg_off);
+ if (msg_len > ellipsis_len) {
+ tvb_memcpy(tvb, msg_str, msg_off, ellipsis_len);
+ strcpy (msg_str + ellipsis_len, ELLIPSIS);
+ msg_str[COL_INFO_LEN] = '\0';
+ } else {
+ tvb_memcpy(tvb, msg_str, msg_off, msg_len);
+ msg_str[msg_len] = '\0';
+ }
+
if (check_col(pinfo->fd, COL_PROTOCOL))
col_add_str(pinfo->fd, COL_PROTOCOL, "Syslog");
if (check_col(pinfo->fd, COL_INFO)) {
- if (num >= 0) {
+ if (pri >= 0) {
col_add_fstr(pinfo->fd, COL_INFO, "%s.%s: %s",
val_to_str(fac, short_fac, "UNKNOWN"),
- val_to_str(pri, short_pri, "UNKNOWN"), msg_str);
+ val_to_str(lev, short_lev, "UNKNOWN"), msg_str);
} else {
col_add_fstr(pinfo->fd, COL_INFO, "%s", msg_str);
}
}
if (tree) {
- if (num >= 0) {
+ if (pri >= 0) {
ti = proto_tree_add_protocol_format(tree, proto_syslog, tvb, 0,
tvb_length(tvb), "Syslog message: %s.%s: %s",
val_to_str(fac, short_fac, "UNKNOWN"),
- val_to_str(pri, short_pri, "UNKNOWN"), msg_str);
+ val_to_str(lev, short_lev, "UNKNOWN"), msg_str);
} else {
- ti = proto_tree_add_string(tree, proto_syslog, tvb, 0, tvb_length(tvb),
- msg_str);
+ ti = proto_tree_add_protocol_format(tree, proto_syslog, tvb, 0,
+ tvb_length(tvb), "Syslog message: (unknown): %s", msg_str);
}
syslog_tree = proto_item_add_subtree(ti, ett_syslog);
- if (num >= 0) {
+ if (pri >= 0) {
ti = proto_tree_add_uint(syslog_tree, hf_syslog_facility, tvb, 0,
- msg_off - 1, num);
- ti = proto_tree_add_uint(syslog_tree, hf_syslog_priority, tvb, 0,
- msg_off - 1, num);
+ msg_off, pri);
+ ti = proto_tree_add_uint(syslog_tree, hf_syslog_level, tvb, 0,
+ msg_off, pri);
}
proto_tree_add_uint_format(syslog_tree, hf_syslog_msg_len, tvb, msg_off,
msg_len, msg_len, "Message (%d byte%s)", msg_len, plurality(msg_len, "", "s"));
@@ -229,15 +237,15 @@ void proto_register_syslog(void)
FT_UINT8, BASE_DEC, VALS(long_fac), FACILITY_MASK,
"Message facility" }
},
- { &hf_syslog_priority,
- { "Priority", "syslog.priority",
- FT_UINT8, BASE_DEC, VALS(long_pri), PRIORITY_MASK,
- "Message priority" }
+ { &hf_syslog_level,
+ { "Level", "syslog.level",
+ FT_UINT8, BASE_DEC, VALS(long_lev), PRIORITY_MASK,
+ "Message level" }
},
{ &hf_syslog_msg_len,
{ "Message length", "syslog.msg_len",
FT_UINT32, BASE_DEC, NULL, 0x0,
- "Message length, excluding priority/facility descriptor" }
+ "Message length, excluding priority descriptor" }
},
};
@@ -259,4 +267,3 @@ proto_reg_handoff_syslog(void)
{
dissector_add("udp.port", UDP_PORT_SYSLOG, dissect_syslog);
}
-
diff --git a/randpkt.c b/randpkt.c
index eed8c9c951..c4011baeae 100644
--- a/randpkt.c
+++ b/randpkt.c
@@ -4,7 +4,7 @@
* Creates random packet traces. Useful for debugging sniffers by testing
* assumptions about the veracity of the data found in the packet.
*
- * $Id: randpkt.c,v 1.7 2000/05/19 23:06:11 gram Exp $
+ * $Id: randpkt.c,v 1.8 2000/06/11 15:54:03 gerald Exp $
*
* Copyright (C) 1999 by Gilbert Ramirez <gram@xiexie.org>
*
@@ -56,6 +56,7 @@ enum {
PKT_IP,
PKT_LLC,
PKT_NBNS,
+ PKT_SYSLOG,
PKT_TCP,
PKT_TR,
PKT_UDP
@@ -78,7 +79,7 @@ guint8 pkt_arp[] = {
0x08, 0x06
};
-/* Ethernet+IP+UP, indicating DNS */
+/* Ethernet+IP+UDP, indicating DNS */
guint8 pkt_dns[] = {
0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0x01, 0x01,
@@ -144,6 +145,24 @@ guint8 pkt_nbns[] = {
0x30
};
+/* Ethernet+IP+UDP, indicating syslog */
+guint8 pkt_syslog[] = {
+ 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0x01, 0x01,
+ 0x01, 0x01, 0x01, 0x01,
+ 0x08, 0x00,
+
+ 0x45, 0x00, 0x00, 0x64,
+ 0x20, 0x48, 0x00, 0x00,
+ 0xfc, 0x11, 0xf8, 0x03,
+ 0xd0, 0x15, 0x02, 0xb8,
+ 0x0a, 0x01, 0x01, 0x63,
+
+ 0x05, 0xe8, 0x02, 0x02,
+ 0x00, 0x50, 0x51, 0xe1,
+ 0x3c
+};
+
/* TR+LLC+IP, indicating TCP */
guint8 pkt_tcp[] = {
0x10, 0x40, 0x68, 0x00,
@@ -201,6 +220,9 @@ pkt_example examples[] = {
{ "nbns", "NetBIOS-over-TCP Name Service",
PKT_NBNS, pkt_nbns, WTAP_ENCAP_ETHERNET, array_length(pkt_nbns) },
+ { "syslog", "Syslog message",
+ PKT_SYSLOG, pkt_syslog, WTAP_ENCAP_ETHERNET, array_length(pkt_syslog) },
+
{ "tcp", "Transmission Control Protocol",
PKT_TCP, pkt_tcp, WTAP_ENCAP_TR, array_length(pkt_tcp) },
generated by cgit v1.2.3 (git 2.25.1) at 2025-02-26 21:57:47 +0000