• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that: (1) source code distributions
7  * retain the above copyright notice and this paragraph in its entirety, (2)
8  * distributions including binary code include the above copyright notice and
9  * this paragraph in its entirety in the documentation or other materials
10  * provided with the distribution, and (3) all advertising materials mentioning
11  * features or use of this software display the following acknowledgement:
12  * ``This product includes software developed by the University of California,
13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14  * the University nor the names of its contributors may be used to endorse
15  * or promote products derived from this software without specific prior
16  * written permission.
17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20  */
21 
22 /* \summary: Ethernet printer */
23 
24 #ifdef HAVE_CONFIG_H
25 #include <config.h>
26 #endif
27 
28 #include "netdissect-stdinc.h"
29 
30 #define ND_LONGJMP_FROM_TCHECK
31 #include "netdissect.h"
32 #include "extract.h"
33 #include "addrtoname.h"
34 #include "ethertype.h"
35 
36 /*
37  * Structure of an Ethernet header.
38  */
39 struct	ether_header {
40 	nd_mac_addr	ether_dhost;
41 	nd_mac_addr	ether_shost;
42 	nd_uint16_t	ether_length_type;
43 };
44 
45 /*
46  * Length of an Ethernet header; note that some compilers may pad
47  * "struct ether_header" to a multiple of 4 bytes, for example, so
48  * "sizeof (struct ether_header)" may not give the right answer.
49  */
50 #define ETHER_HDRLEN		14
51 
52 const struct tok ethertype_values[] = {
53     { ETHERTYPE_IP,		"IPv4" },
54     { ETHERTYPE_MPLS,		"MPLS unicast" },
55     { ETHERTYPE_MPLS_MULTI,	"MPLS multicast" },
56     { ETHERTYPE_IPV6,		"IPv6" },
57     { ETHERTYPE_8021Q,		"802.1Q" },
58     { ETHERTYPE_8021Q9100,	"802.1Q-9100" },
59     { ETHERTYPE_8021QinQ,	"802.1Q-QinQ" },
60     { ETHERTYPE_8021Q9200,	"802.1Q-9200" },
61     { ETHERTYPE_MACSEC,		"802.1AE MACsec" },
62     { ETHERTYPE_VMAN,		"VMAN" },
63     { ETHERTYPE_PUP,            "PUP" },
64     { ETHERTYPE_ARP,            "ARP"},
65     { ETHERTYPE_REVARP,         "Reverse ARP"},
66     { ETHERTYPE_NS,             "NS" },
67     { ETHERTYPE_SPRITE,         "Sprite" },
68     { ETHERTYPE_TRAIL,          "Trail" },
69     { ETHERTYPE_MOPDL,          "MOP DL" },
70     { ETHERTYPE_MOPRC,          "MOP RC" },
71     { ETHERTYPE_DN,             "DN" },
72     { ETHERTYPE_LAT,            "LAT" },
73     { ETHERTYPE_SCA,            "SCA" },
74     { ETHERTYPE_TEB,            "TEB" },
75     { ETHERTYPE_LANBRIDGE,      "Lanbridge" },
76     { ETHERTYPE_DECDNS,         "DEC DNS" },
77     { ETHERTYPE_DECDTS,         "DEC DTS" },
78     { ETHERTYPE_VEXP,           "VEXP" },
79     { ETHERTYPE_VPROD,          "VPROD" },
80     { ETHERTYPE_ATALK,          "Appletalk" },
81     { ETHERTYPE_AARP,           "Appletalk ARP" },
82     { ETHERTYPE_IPX,            "IPX" },
83     { ETHERTYPE_PPP,            "PPP" },
84     { ETHERTYPE_MPCP,           "MPCP" },
85     { ETHERTYPE_SLOW,           "Slow Protocols" },
86     { ETHERTYPE_PPPOED,         "PPPoE D" },
87     { ETHERTYPE_PPPOES,         "PPPoE S" },
88     { ETHERTYPE_EAPOL,          "EAPOL" },
89     { ETHERTYPE_REALTEK,        "Realtek protocols" },
90     { ETHERTYPE_MS_NLB_HB,      "MS NLB heartbeat" },
91     { ETHERTYPE_JUMBO,          "Jumbo" },
92     { ETHERTYPE_NSH,            "NSH" },
93     { ETHERTYPE_LOOPBACK,       "Loopback" },
94     { ETHERTYPE_ISO,            "OSI" },
95     { ETHERTYPE_GRE_ISO,        "GRE-OSI" },
96     { ETHERTYPE_CFM_OLD,        "CFM (old)" },
97     { ETHERTYPE_CFM,            "CFM" },
98     { ETHERTYPE_IEEE1905_1,     "IEEE1905.1" },
99     { ETHERTYPE_LLDP,           "LLDP" },
100     { ETHERTYPE_TIPC,           "TIPC"},
101     { ETHERTYPE_GEONET_OLD,     "GeoNet (old)"},
102     { ETHERTYPE_GEONET,         "GeoNet"},
103     { ETHERTYPE_CALM_FAST,      "CALM FAST"},
104     { ETHERTYPE_AOE,            "AoE" },
105     { ETHERTYPE_PTP,            "PTP" },
106     { ETHERTYPE_ARISTA,         "Arista Vendor Specific Protocol" },
107     { 0, NULL}
108 };
109 
110 static void
ether_addresses_print(netdissect_options * ndo,const u_char * src,const u_char * dst)111 ether_addresses_print(netdissect_options *ndo, const u_char *src,
112 		      const u_char *dst)
113 {
114 	ND_PRINT("%s > %s, ",
115 		 GET_ETHERADDR_STRING(src), GET_ETHERADDR_STRING(dst));
116 }
117 
118 static void
ether_type_print(netdissect_options * ndo,uint16_t type)119 ether_type_print(netdissect_options *ndo, uint16_t type)
120 {
121 	if (!ndo->ndo_qflag)
122 		ND_PRINT("ethertype %s (0x%04x)",
123 			 tok2str(ethertype_values, "Unknown", type), type);
124 	else
125 		ND_PRINT("%s",
126 			 tok2str(ethertype_values, "Unknown Ethertype (0x%04x)", type));
127 }
128 
129 /*
130  * Common code for printing Ethernet frames.
131  *
132  * It can handle Ethernet headers with extra tag information inserted
133  * after the destination and source addresses, as is inserted by some
134  * switch chips, and extra encapsulation header information before
135  * printing Ethernet header information (such as a LANE ID for ATM LANE).
136  */
137 static u_int
ether_common_print(netdissect_options * ndo,const u_char * p,u_int length,u_int caplen,void (* print_switch_tag)(netdissect_options * ndo,const u_char *),u_int switch_tag_len,void (* print_encap_header)(netdissect_options * ndo,const u_char *),const u_char * encap_header_arg)138 ether_common_print(netdissect_options *ndo, const u_char *p, u_int length,
139     u_int caplen,
140     void (*print_switch_tag)(netdissect_options *ndo, const u_char *),
141     u_int switch_tag_len,
142     void (*print_encap_header)(netdissect_options *ndo, const u_char *),
143     const u_char *encap_header_arg)
144 {
145 	const struct ether_header *ehp;
146 	u_int orig_length;
147 	u_int hdrlen;
148 	u_short length_type;
149 	int printed_length;
150 	int llc_hdrlen;
151 	struct lladdr_info src, dst;
152 
153 	if (length < caplen) {
154 		ND_PRINT("[length %u < caplen %u]", length, caplen);
155 		nd_print_invalid(ndo);
156 		return length;
157 	}
158 	if (caplen < ETHER_HDRLEN + switch_tag_len) {
159 		nd_print_trunc(ndo);
160 		return caplen;
161 	}
162 
163 	if (print_encap_header != NULL)
164 		(*print_encap_header)(ndo, encap_header_arg);
165 
166 	orig_length = length;
167 
168 	/*
169 	 * Get the source and destination addresses, skip past them,
170 	 * and print them if we're printing the link-layer header.
171 	 */
172 	ehp = (const struct ether_header *)p;
173 	src.addr = ehp->ether_shost;
174 	src.addr_string = etheraddr_string;
175 	dst.addr = ehp->ether_dhost;
176 	dst.addr_string = etheraddr_string;
177 
178 	length -= 2*MAC_ADDR_LEN;
179 	caplen -= 2*MAC_ADDR_LEN;
180 	p += 2*MAC_ADDR_LEN;
181 	hdrlen = 2*MAC_ADDR_LEN;
182 
183 	if (ndo->ndo_eflag)
184 		ether_addresses_print(ndo, src.addr, dst.addr);
185 
186 	/*
187 	 * Print the switch tag, if we have one, and skip past it.
188 	 */
189 	if (print_switch_tag != NULL)
190 		(*print_switch_tag)(ndo, p);
191 
192 	length -= switch_tag_len;
193 	caplen -= switch_tag_len;
194 	p += switch_tag_len;
195 	hdrlen += switch_tag_len;
196 
197 	/*
198 	 * Get the length/type field, skip past it, and print it
199 	 * if we're printing the link-layer header.
200 	 */
201 recurse:
202 	length_type = GET_BE_U_2(p);
203 
204 	length -= 2;
205 	caplen -= 2;
206 	p += 2;
207 	hdrlen += 2;
208 
209 	/*
210 	 * Process 802.1AE MACsec headers.
211 	 */
212 	printed_length = 0;
213 	if (length_type == ETHERTYPE_MACSEC) {
214 		/*
215 		 * MACsec, aka IEEE 802.1AE-2006
216 		 * Print the header, and try to print the payload if it's not encrypted
217 		 */
218 		if (ndo->ndo_eflag) {
219 			ether_type_print(ndo, length_type);
220 			ND_PRINT(", length %u: ", orig_length);
221 			printed_length = 1;
222 		}
223 
224 		int ret = macsec_print(ndo, &p, &length, &caplen, &hdrlen,
225 				       &src, &dst);
226 
227 		if (ret == 0) {
228 			/* Payload is encrypted; print it as raw data. */
229 			if (!ndo->ndo_suppress_default_print)
230 				ND_DEFAULTPRINT(p, caplen);
231 			return hdrlen;
232 		} else if (ret > 0) {
233 			/* Problem printing the header; just quit. */
234 			return ret;
235 		} else {
236 			/*
237 			 * Keep processing type/length fields.
238 			 */
239 			length_type = GET_BE_U_2(p);
240 
241 			ND_LCHECK_U(caplen, 2);
242 			length -= 2;
243 			caplen -= 2;
244 			p += 2;
245 			hdrlen += 2;
246 		}
247 	}
248 
249 	/*
250 	 * Process VLAN tag types.
251 	 */
252 	while (length_type == ETHERTYPE_8021Q  ||
253 		length_type == ETHERTYPE_8021Q9100 ||
254 		length_type == ETHERTYPE_8021Q9200 ||
255 		length_type == ETHERTYPE_8021QinQ) {
256 		/*
257 		 * It has a VLAN tag.
258 		 * Print VLAN information, and then go back and process
259 		 * the enclosed type field.
260 		 */
261 		if (caplen < 4) {
262 			ndo->ndo_protocol = "vlan";
263 			nd_print_trunc(ndo);
264 			return hdrlen + caplen;
265 		}
266 		if (length < 4) {
267 			ndo->ndo_protocol = "vlan";
268 			nd_print_trunc(ndo);
269 			return hdrlen + length;
270 		}
271 		if (ndo->ndo_eflag) {
272 			uint16_t tag = GET_BE_U_2(p);
273 
274 			ether_type_print(ndo, length_type);
275 			if (!printed_length) {
276 				ND_PRINT(", length %u: ", orig_length);
277 				printed_length = 1;
278 			} else
279 				ND_PRINT(", ");
280 			ND_PRINT("%s, ", ieee8021q_tci_string(tag));
281 		}
282 
283 		length_type = GET_BE_U_2(p + 2);
284 		p += 4;
285 		length -= 4;
286 		caplen -= 4;
287 		hdrlen += 4;
288 	}
289 
290 	/*
291 	 * We now have the final length/type field.
292 	 */
293 	if (length_type <= MAX_ETHERNET_LENGTH_VAL) {
294 		/*
295 		 * It's a length field, containing the length of the
296 		 * remaining payload; use it as such, as long as
297 		 * it's not too large (bigger than the actual payload).
298 		 */
299 		if (length_type < length) {
300 			length = length_type;
301 			if (caplen > length)
302 				caplen = length;
303 		}
304 
305 		/*
306 		 * Cut off the snapshot length to the end of the
307 		 * payload.
308 		 */
309 		if (!nd_push_snaplen(ndo, p, length)) {
310 			(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
311 				"%s: can't push snaplen on buffer stack", __func__);
312 		}
313 
314 		if (ndo->ndo_eflag) {
315 			ND_PRINT("802.3");
316 			if (!printed_length)
317 				ND_PRINT(", length %u: ", length);
318 		}
319 
320 		/*
321 		 * An LLC header follows the length.  Print that and
322 		 * higher layers.
323 		 */
324 		llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst);
325 		if (llc_hdrlen < 0) {
326 			/* packet type not known, print raw packet */
327 			if (!ndo->ndo_suppress_default_print)
328 				ND_DEFAULTPRINT(p, caplen);
329 			llc_hdrlen = -llc_hdrlen;
330 		}
331 		hdrlen += llc_hdrlen;
332 		nd_pop_packet_info(ndo);
333 	} else if (length_type == ETHERTYPE_JUMBO) {
334 		/*
335 		 * It's a type field, with the type for Alteon jumbo frames.
336 		 * See
337 		 *
338 		 *	https://tools.ietf.org/html/draft-ietf-isis-ext-eth-01
339 		 *
340 		 * which indicates that, following the type field,
341 		 * there's an LLC header and payload.
342 		 */
343 		/* Try to print the LLC-layer header & higher layers */
344 		llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst);
345 		if (llc_hdrlen < 0) {
346 			/* packet type not known, print raw packet */
347 			if (!ndo->ndo_suppress_default_print)
348 				ND_DEFAULTPRINT(p, caplen);
349 			llc_hdrlen = -llc_hdrlen;
350 		}
351 		hdrlen += llc_hdrlen;
352 	} else if (length_type == ETHERTYPE_ARISTA) {
353 		if (caplen < 2) {
354 			ND_PRINT("[|arista]");
355 			return hdrlen + caplen;
356 		}
357 		if (length < 2) {
358 			ND_PRINT("[|arista]");
359 			return hdrlen + length;
360 		}
361 		ether_type_print(ndo, length_type);
362 		ND_PRINT(", length %u: ", orig_length);
363 		int bytesConsumed = arista_ethertype_print(ndo, p, length);
364 		if (bytesConsumed > 0) {
365 			p += bytesConsumed;
366 			length -= bytesConsumed;
367 			caplen -= bytesConsumed;
368 			hdrlen += bytesConsumed;
369 			goto recurse;
370 		} else {
371 			/* subtype/version not known, print raw packet */
372 			if (!ndo->ndo_eflag && length_type > MAX_ETHERNET_LENGTH_VAL) {
373 				ether_addresses_print(ndo, src.addr, dst.addr);
374 				ether_type_print(ndo, length_type);
375 				ND_PRINT(", length %u: ", orig_length);
376 			}
377 			 if (!ndo->ndo_suppress_default_print)
378 				 ND_DEFAULTPRINT(p, caplen);
379 		}
380 	} else {
381 		/*
382 		 * It's a type field with some other value.
383 		 */
384 		if (ndo->ndo_eflag) {
385 			ether_type_print(ndo, length_type);
386 			if (!printed_length)
387 				ND_PRINT(", length %u: ", orig_length);
388 			else
389 				ND_PRINT(", ");
390 		}
391 		if (ethertype_print(ndo, length_type, p, length, caplen, &src, &dst) == 0) {
392 			/* type not known, print raw packet */
393 			if (!ndo->ndo_eflag) {
394 				/*
395 				 * We didn't print the full link-layer
396 				 * header, as -e wasn't specified, so
397 				 * print only the source and destination
398 				 * MAC addresses and the final Ethernet
399 				 * type.
400 				 */
401 				ether_addresses_print(ndo, src.addr, dst.addr);
402 				ether_type_print(ndo, length_type);
403 				ND_PRINT(", length %u: ", orig_length);
404 			}
405 
406 			if (!ndo->ndo_suppress_default_print)
407 				ND_DEFAULTPRINT(p, caplen);
408 		}
409 	}
410 invalid:
411 	return hdrlen;
412 }
413 
414 /*
415  * Print an Ethernet frame while specyfing a non-standard Ethernet header
416  * length.
417  * This might be encapsulated within another frame; we might be passed
418  * a pointer to a function that can print header information for that
419  * frame's protocol, and an argument to pass to that function.
420  *
421  * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
422  */
423 u_int
ether_switch_tag_print(netdissect_options * ndo,const u_char * p,u_int length,u_int caplen,void (* print_switch_tag)(netdissect_options *,const u_char *),u_int switch_tag_len)424 ether_switch_tag_print(netdissect_options *ndo, const u_char *p, u_int length,
425     u_int caplen,
426     void (*print_switch_tag)(netdissect_options *, const u_char *),
427     u_int switch_tag_len)
428 {
429 	return ether_common_print(ndo, p, length, caplen, print_switch_tag,
430 				  switch_tag_len, NULL, NULL);
431 }
432 
433 /*
434  * Print an Ethernet frame.
435  * This might be encapsulated within another frame; we might be passed
436  * a pointer to a function that can print header information for that
437  * frame's protocol, and an argument to pass to that function.
438  *
439  * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
440  */
441 u_int
ether_print(netdissect_options * ndo,const u_char * p,u_int length,u_int caplen,void (* print_encap_header)(netdissect_options * ndo,const u_char *),const u_char * encap_header_arg)442 ether_print(netdissect_options *ndo,
443 	    const u_char *p, u_int length, u_int caplen,
444 	    void (*print_encap_header)(netdissect_options *ndo, const u_char *),
445 	    const u_char *encap_header_arg)
446 {
447 	ndo->ndo_protocol = "ether";
448 	return ether_common_print(ndo, p, length, caplen, NULL, 0,
449 				  print_encap_header, encap_header_arg);
450 }
451 
452 /*
453  * This is the top level routine of the printer.  'p' points
454  * to the ether header of the packet, 'h->len' is the length
455  * of the packet off the wire, and 'h->caplen' is the number
456  * of bytes actually captured.
457  */
458 void
ether_if_print(netdissect_options * ndo,const struct pcap_pkthdr * h,const u_char * p)459 ether_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
460 	       const u_char *p)
461 {
462 	ndo->ndo_protocol = "ether";
463 	ndo->ndo_ll_hdr_len +=
464 		ether_print(ndo, p, h->len, h->caplen, NULL, NULL);
465 }
466 
467 /*
468  * This is the top level routine of the printer.  'p' points
469  * to the ether header of the packet, 'h->len' is the length
470  * of the packet off the wire, and 'h->caplen' is the number
471  * of bytes actually captured.
472  *
473  * This is for DLT_NETANALYZER, which has a 4-byte pseudo-header
474  * before the Ethernet header.
475  */
476 void
netanalyzer_if_print(netdissect_options * ndo,const struct pcap_pkthdr * h,const u_char * p)477 netanalyzer_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
478 		     const u_char *p)
479 {
480 	/*
481 	 * Fail if we don't have enough data for the Hilscher pseudo-header.
482 	 */
483 	ndo->ndo_protocol = "netanalyzer";
484 	ND_TCHECK_LEN(p, 4);
485 
486 	/* Skip the pseudo-header. */
487 	ndo->ndo_ll_hdr_len += 4;
488 	ndo->ndo_ll_hdr_len +=
489 		ether_print(ndo, p + 4, h->len - 4, h->caplen - 4, NULL, NULL);
490 }
491 
492 /*
493  * This is the top level routine of the printer.  'p' points
494  * to the ether header of the packet, 'h->len' is the length
495  * of the packet off the wire, and 'h->caplen' is the number
496  * of bytes actually captured.
497  *
498  * This is for DLT_NETANALYZER_TRANSPARENT, which has a 4-byte
499  * pseudo-header, a 7-byte Ethernet preamble, and a 1-byte Ethernet SOF
500  * before the Ethernet header.
501  */
502 void
netanalyzer_transparent_if_print(netdissect_options * ndo,const struct pcap_pkthdr * h,const u_char * p)503 netanalyzer_transparent_if_print(netdissect_options *ndo,
504 				 const struct pcap_pkthdr *h,
505 				 const u_char *p)
506 {
507 	/*
508 	 * Fail if we don't have enough data for the Hilscher pseudo-header,
509 	 * preamble, and SOF.
510 	 */
511 	ndo->ndo_protocol = "netanalyzer_transparent";
512 	ND_TCHECK_LEN(p, 12);
513 
514 	/* Skip the pseudo-header, preamble, and SOF. */
515 	ndo->ndo_ll_hdr_len += 12;
516 	ndo->ndo_ll_hdr_len +=
517 		ether_print(ndo, p + 12, h->len - 12, h->caplen - 12, NULL, NULL);
518 }
519 
520 /*
521  * Prints the packet payload, given an Ethernet type code for the payload's
522  * protocol.
523  *
524  * Returns non-zero if it can do so, zero if the ethertype is unknown.
525  */
526 
527 int
ethertype_print(netdissect_options * ndo,u_short ether_type,const u_char * p,u_int length,u_int caplen,const struct lladdr_info * src,const struct lladdr_info * dst)528 ethertype_print(netdissect_options *ndo,
529 		u_short ether_type, const u_char *p,
530 		u_int length, u_int caplen,
531 		const struct lladdr_info *src, const struct lladdr_info *dst)
532 {
533 	switch (ether_type) {
534 
535 	case ETHERTYPE_IP:
536 		ip_print(ndo, p, length);
537 		return (1);
538 
539 	case ETHERTYPE_IPV6:
540 		ip6_print(ndo, p, length);
541 		return (1);
542 
543 	case ETHERTYPE_ARP:
544 	case ETHERTYPE_REVARP:
545 		arp_print(ndo, p, length, caplen);
546 		return (1);
547 
548 	case ETHERTYPE_DN:
549 		decnet_print(ndo, p, length, caplen);
550 		return (1);
551 
552 	case ETHERTYPE_ATALK:
553 		if (ndo->ndo_vflag)
554 			ND_PRINT("et1 ");
555 		atalk_print(ndo, p, length);
556 		return (1);
557 
558 	case ETHERTYPE_AARP:
559 		aarp_print(ndo, p, length);
560 		return (1);
561 
562 	case ETHERTYPE_IPX:
563 		ND_PRINT("(NOV-ETHII) ");
564 		ipx_print(ndo, p, length);
565 		return (1);
566 
567 	case ETHERTYPE_ISO:
568 		if (length == 0 || caplen == 0) {
569 			ndo->ndo_protocol = "isoclns";
570 			nd_print_trunc(ndo);
571 			return (1);
572 		}
573 		/* At least one byte is required */
574 		/* FIXME: Reference for this byte? */
575 		ND_TCHECK_LEN(p, 1);
576 		isoclns_print(ndo, p + 1, length - 1);
577 		return(1);
578 
579 	case ETHERTYPE_PPPOED:
580 	case ETHERTYPE_PPPOES:
581 	case ETHERTYPE_PPPOED2:
582 	case ETHERTYPE_PPPOES2:
583 		pppoe_print(ndo, p, length);
584 		return (1);
585 
586 	case ETHERTYPE_EAPOL:
587 		eapol_print(ndo, p);
588 		return (1);
589 
590 	case ETHERTYPE_REALTEK:
591 		rtl_print(ndo, p, length, src, dst);
592 		return (1);
593 
594 	case ETHERTYPE_PPP:
595 		if (length) {
596 			ND_PRINT(": ");
597 			ppp_print(ndo, p, length);
598 		}
599 		return (1);
600 
601 	case ETHERTYPE_MPCP:
602 		mpcp_print(ndo, p, length);
603 		return (1);
604 
605 	case ETHERTYPE_SLOW:
606 		slow_print(ndo, p, length);
607 		return (1);
608 
609 	case ETHERTYPE_CFM:
610 	case ETHERTYPE_CFM_OLD:
611 		cfm_print(ndo, p, length);
612 		return (1);
613 
614 	case ETHERTYPE_LLDP:
615 		lldp_print(ndo, p, length);
616 		return (1);
617 
618 	case ETHERTYPE_NSH:
619 		nsh_print(ndo, p, length);
620 		return (1);
621 
622 	case ETHERTYPE_LOOPBACK:
623 		loopback_print(ndo, p, length);
624 		return (1);
625 
626 	case ETHERTYPE_MPLS:
627 	case ETHERTYPE_MPLS_MULTI:
628 		mpls_print(ndo, p, length);
629 		return (1);
630 
631 	case ETHERTYPE_TIPC:
632 		tipc_print(ndo, p, length, caplen);
633 		return (1);
634 
635 	case ETHERTYPE_MS_NLB_HB:
636 		msnlb_print(ndo, p);
637 		return (1);
638 
639 	case ETHERTYPE_GEONET_OLD:
640 	case ETHERTYPE_GEONET:
641 		geonet_print(ndo, p, length, src);
642 		return (1);
643 
644 	case ETHERTYPE_CALM_FAST:
645 		calm_fast_print(ndo, p, length, src);
646 		return (1);
647 
648 	case ETHERTYPE_AOE:
649 		aoe_print(ndo, p, length);
650 		return (1);
651 
652 	case ETHERTYPE_PTP:
653 		ptp_print(ndo, p, length);
654 		return (1);
655 
656 	case ETHERTYPE_LAT:
657 	case ETHERTYPE_SCA:
658 	case ETHERTYPE_MOPRC:
659 	case ETHERTYPE_MOPDL:
660 	case ETHERTYPE_IEEE1905_1:
661 		/* default_print for now */
662 	default:
663 		return (0);
664 	}
665 }
666