Document the "netbeui" filter expression keyword.
Add a #define LLCSAP_NETBEUI for the NetBEUI LLC SAP, and use that
rather than "0xf0" in the LLC dissector.
diff --git a/llc.h b/llc.h
index de185c8..b812bf1 100644
--- a/llc.h
+++ b/llc.h
@@ -18,7 +18,7 @@
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*
- * @(#) $Header: /tcpdump/master/tcpdump/llc.h,v 1.9 2001-01-15 00:33:59 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/tcpdump/llc.h,v 1.10 2001-01-28 09:46:42 guy Exp $ (LBL)
*/
/*
@@ -115,9 +115,12 @@
#ifndef LLCSAP_SNAP
#define LLCSAP_SNAP 0xaa
#endif
-#ifndef LLCSAP_ISONS
-#define LLCSAP_ISONS 0xfe
-#endif
#ifndef LLCSAP_IPX
#define LLCSAP_IPX 0xe0
#endif
+#ifndef LLCSAP_NETBEUI
+#define LLCSAP_NETBEUI 0xf0
+#endif
+#ifndef LLCSAP_ISONS
+#define LLCSAP_ISONS 0xfe
+#endif
diff --git a/print-llc.c b/print-llc.c
index 4557c4f..100ed88 100644
--- a/print-llc.c
+++ b/print-llc.c
@@ -24,7 +24,7 @@
#ifndef lint
static const char rcsid[] =
- "@(#) $Header: /tcpdump/master/tcpdump/print-llc.c,v 1.35 2001-01-15 03:59:13 guy Exp $";
+ "@(#) $Header: /tcpdump/master/tcpdump/print-llc.c,v 1.36 2001-01-28 09:46:43 guy Exp $";
#endif
#ifdef HAVE_CONFIG_H
@@ -123,7 +123,7 @@
return (1);
}
- if (llc.ssap == 0xf0 && llc.dsap == 0xf0
+ if (llc.ssap == LLCSAP_NETBEUI && llc.dsap == LLCSAP_NETBEUI
&& (!(llc.llcu & LLC_S_FMT) || llc.llcu == LLC_U_FMT)) {
/*
* we don't actually have a full netbeui parser yet, but the
diff --git a/tcpdump.1 b/tcpdump.1
index f51c9fb..ba3af30 100644
--- a/tcpdump.1
+++ b/tcpdump.1
@@ -1,4 +1,4 @@
-.\" @(#) $Header: /tcpdump/master/tcpdump/Attic/tcpdump.1,v 1.98 2001-01-18 04:37:23 guy Exp $ (LBL)
+.\" @(#) $Header: /tcpdump/master/tcpdump/Attic/tcpdump.1,v 1.99 2001-01-28 09:46:43 guy Exp $ (LBL)
.\"
.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
.\" The Regents of the University of California. All rights reserved.
@@ -530,7 +530,7 @@
\fIProtocol\fP can be a number or one of the names
\fIip\fP, \fIip6\fP, \fIarp\fP, \fIrarp\fP, \fIatalk\fP, \fIaarp\fP,
\fIdecnet\fP, \fIsca\fP, \fIlat\fP, \fImopdl\fP, \fImoprc\fP,
-\fIiso\fP, \fIstp\fP, or \fIipx\fP.
+\fIiso\fP, \fIstp\fP, \fIipx\fP, or \fInetbeui\fP.
Note these identifiers are also keywords
and must be escaped via backslash (\\).
.IP
@@ -540,7 +540,7 @@
header, which is usually layered on top of the FDDI or Token Ring
header.
.IP
-When filtering for those protocol identifiers on FDDI or Token Ring,
+When filtering for most protocol identifiers on FDDI or Token Ring,
\fBtcpdump\fR checks only the protocol ID field of an LLC header in
so-called SNAP format with an Organizational Unit Identifier (OUI) of
0x000000, for encapsulated Ethernet; it doesn't check whether the packet
@@ -548,21 +548,21 @@
.IP
The exceptions are \fIiso\fP, for which it checks the DSAP (Destination
Service Access Point) and SSAP (Source Service Access Point) fields of
-the LLC header, \fIstp\fP, where it checks the DSAP of the LLC
-header, and \fIatalk\fP, where it checks for a SNAP-format packet with
-an OUI of 0x080007 and the Appletalk etype.
+the LLC header, \fIstp\fP and \fInetbeui\fP, where it checks the DSAP of
+the LLC header, and \fIatalk\fP, where it checks for a SNAP-format
+packet with an OUI of 0x080007 and the Appletalk etype.
.IP
In the case of Ethernet, \fBtcpdump\fR checks the Ethernet type field
-for most of those protocols; the exceptions are \fIiso\fP and \fIsap\fP,
-for which it checks for an 802.3 frame and then checks the LLC header as
-it does for FDDI and Token Ring, \fIatalk\fP, where it checks both for
-the Appletalk etype in an Ethernet frame and for a SNAP-format packet as
-it does for FDDI and Token Ring, \fIaarp\fP, where it checks for the
-Appletalk ARP etype in either an Ethernet frame or an 802.2 SNAP frame
-with an OUI of 0x000000, and \fIipx\fP, where it checks for the IPX
-etype in an Ethernet frame, the IPX DSAP in the LLC header, the
-802.3 with no LLC header encapsulation of IPX, and the IPX etype in
-a SNAP frame.]
+for most of those protocols; the exceptions are \fIiso\fP, \fIsap\fP,
+and \fInetbeui\fP, for which it checks for an 802.3 frame and then
+checks the LLC header as it does for FDDI and Token Ring, \fIatalk\fP,
+where it checks both for the Appletalk etype in an Ethernet frame and
+for a SNAP-format packet as it does for FDDI and Token Ring, \fIaarp\fP,
+where it checks for the Appletalk ARP etype in either an Ethernet frame
+or an 802.2 SNAP frame with an OUI of 0x000000, and \fIipx\fP, where it
+checks for the IPX etype in an Ethernet frame, the IPX DSAP in the LLC
+header, the 802.3 with no LLC header encapsulation of IPX, and the IPX
+etype in a SNAP frame.]
.IP "\fBdecnet src \fIhost\fR"
True if the DECNET source address is
.IR host ,
@@ -575,7 +575,7 @@
.IP "\fBdecnet host \fIhost\fR"
True if either the DECNET source or destination address is
.IR host .
-.IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBatalk\fR, \fBaarp\fR, \fBdecnet\fR, \fBiso\fR, \fBstp\fR, \fBipx\fR"
+.IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBatalk\fR, \fBaarp\fR, \fBdecnet\fR, \fBiso\fR, \fBstp\fR, \fBipx\fR, \fInetbeui\fP"
Abbreviations for:
.in +.5i
.nf
