Home | History | Annotate | Line # | Download | only in dist
      1 /*
      2  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
      3  *	The Regents of the University of California.  All rights reserved.
      4  *
      5  * Redistribution and use in source and binary forms, with or without
      6  * modification, are permitted provided that: (1) source code distributions
      7  * retain the above copyright notice and this paragraph in its entirety, (2)
      8  * distributions including binary code include the above copyright notice and
      9  * this paragraph in its entirety in the documentation or other materials
     10  * provided with the distribution, and (3) all advertising materials mentioning
     11  * features or use of this software display the following acknowledgement:
     12  * ``This product includes software developed by the University of California,
     13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
     14  * the University nor the names of its contributors may be used to endorse
     15  * or promote products derived from this software without specific prior
     16  * written permission.
     17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
     18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
     19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
     20  *
     21  *  Internet, ethernet, port, and protocol string to address
     22  *  and address to string conversion routines
     23  */
     24 #include <sys/cdefs.h>
     25 #ifndef lint
     26 __RCSID("$NetBSD: addrtoname.c,v 1.13 2024/09/02 16:15:29 christos Exp $");
     27 #endif
     28 
     29 #include <config.h>
     30 
     31 #ifdef HAVE_CASPER
     32 #include <libcasper.h>
     33 #include <casper/cap_dns.h>
     34 #endif /* HAVE_CASPER */
     35 
     36 #include "netdissect-stdinc.h"
     37 
     38 #ifdef USE_ETHER_NTOHOST
     39   #if defined(NET_ETHERNET_H_DECLARES_ETHER_NTOHOST)
     40     /*
     41      * OK, just include <net/ethernet.h>.
     42      */
     43     #include <net/ethernet.h>
     44   #elif defined(NETINET_ETHER_H_DECLARES_ETHER_NTOHOST)
     45     /*
     46      * OK, just include <netinet/ether.h>
     47      */
     48     #include <netinet/ether.h>
     49   #elif defined(SYS_ETHERNET_H_DECLARES_ETHER_NTOHOST)
     50     /*
     51      * OK, just include <sys/ethernet.h>
     52      */
     53     #include <sys/ethernet.h>
     54   #elif defined(ARPA_INET_H_DECLARES_ETHER_NTOHOST)
     55     /*
     56      * OK, just include <arpa/inet.h>
     57      */
     58     #include <arpa/inet.h>
     59   #elif defined(NETINET_IF_ETHER_H_DECLARES_ETHER_NTOHOST)
     60     /*
     61      * OK, include <netinet/if_ether.h>, after all the other stuff we
     62      * need to include or define for its benefit.
     63      */
     64     #define NEED_NETINET_IF_ETHER_H
     65   #else
     66     /*
     67      * We'll have to declare it ourselves.
     68      * If <netinet/if_ether.h> defines struct ether_addr, include
     69      * it.  Otherwise, define it ourselves.
     70      */
     71     #ifdef HAVE_STRUCT_ETHER_ADDR
     72       #define NEED_NETINET_IF_ETHER_H
     73     #else /* HAVE_STRUCT_ETHER_ADDR */
     74 	struct ether_addr {
     75 		/* Beware FreeBSD calls this "octet". */
     76 		unsigned char ether_addr_octet[MAC_ADDR_LEN];
     77 	};
     78     #endif /* HAVE_STRUCT_ETHER_ADDR */
     79   #endif /* what declares ether_ntohost() */
     80 
     81   #ifdef NEED_NETINET_IF_ETHER_H
     82     /*
     83      * Include diag-control.h before <net/if.h>, which too defines a macro
     84      * named ND_UNREACHABLE.
     85      */
     86     #include "diag-control.h"
     87     #include <net/if.h>		/* Needed on some platforms */
     88     #include <netinet/in.h>	/* Needed on some platforms */
     89     #include <netinet/if_ether.h>
     90   #endif /* NEED_NETINET_IF_ETHER_H */
     91 
     92   #ifndef HAVE_DECL_ETHER_NTOHOST
     93     /*
     94      * No header declares it, so declare it ourselves.
     95      */
     96     extern int ether_ntohost(char *, const struct ether_addr *);
     97   #endif /* !defined(HAVE_DECL_ETHER_NTOHOST) */
     98 #endif /* USE_ETHER_NTOHOST */
     99 
    100 #include <pcap.h>
    101 #include <pcap-namedb.h>
    102 #ifndef HAVE_GETSERVENT
    103 #include <getservent.h>
    104 #endif
    105 #include <signal.h>
    106 #include <stdio.h>
    107 #include <string.h>
    108 #include <stdlib.h>
    109 
    110 #include "netdissect.h"
    111 #include "addrtoname.h"
    112 #include "addrtostr.h"
    113 #include "ethertype.h"
    114 #include "llc.h"
    115 #include "extract.h"
    116 #include "oui.h"
    117 
    118 /*
    119  * hash tables for whatever-to-name translations
    120  *
    121  * ndo_error() called on strdup(3) failure with S_ERR_ND_MEM_ALLOC status
    122  */
    123 
    124 #define HASHNAMESIZE 4096
    125 
    126 struct hnamemem {
    127 	uint32_t addr;
    128 	const char *name;
    129 	struct hnamemem *nxt;
    130 };
    131 
    132 static struct hnamemem hnametable[HASHNAMESIZE];
    133 static struct hnamemem tporttable[HASHNAMESIZE];
    134 static struct hnamemem uporttable[HASHNAMESIZE];
    135 static struct hnamemem eprototable[HASHNAMESIZE];
    136 static struct hnamemem dnaddrtable[HASHNAMESIZE];
    137 static struct hnamemem ipxsaptable[HASHNAMESIZE];
    138 
    139 #ifdef _WIN32
    140 /*
    141  * fake gethostbyaddr for Win2k/XP
    142  * gethostbyaddr() returns incorrect value when AF_INET6 is passed
    143  * to 3rd argument.
    144  *
    145  * h_name in struct hostent is only valid.
    146  */
    147 static struct hostent *
    148 win32_gethostbyaddr(const char *addr, int len, int type)
    149 {
    150 	static struct hostent host;
    151 	static char hostbuf[NI_MAXHOST];
    152 	char hname[NI_MAXHOST];
    153 	struct sockaddr_in6 addr6;
    154 
    155 	host.h_name = hostbuf;
    156 	switch (type) {
    157 	case AF_INET:
    158 		return gethostbyaddr(addr, len, type);
    159 		break;
    160 	case AF_INET6:
    161 		memset(&addr6, 0, sizeof(addr6));
    162 		addr6.sin6_family = AF_INET6;
    163 		memcpy(&addr6.sin6_addr, addr, len);
    164 		if (getnameinfo((struct sockaddr *)&addr6, sizeof(addr6),
    165 		    hname, sizeof(hname), NULL, 0, 0)) {
    166 			return NULL;
    167 		} else {
    168 			strlcpy(host.h_name, hname, NI_MAXHOST);
    169 			return &host;
    170 		}
    171 		break;
    172 	default:
    173 		return NULL;
    174 	}
    175 }
    176 #define gethostbyaddr win32_gethostbyaddr
    177 #endif /* _WIN32 */
    178 
    179 struct h6namemem {
    180 	nd_ipv6 addr;
    181 	char *name;
    182 	struct h6namemem *nxt;
    183 };
    184 
    185 static struct h6namemem h6nametable[HASHNAMESIZE];
    186 
    187 struct enamemem {
    188 	u_short e_addr0;
    189 	u_short e_addr1;
    190 	u_short e_addr2;
    191 	const char *e_name;
    192 	u_char *e_nsap;			/* used only for nsaptable[] */
    193 	struct enamemem *e_nxt;
    194 };
    195 
    196 static struct enamemem enametable[HASHNAMESIZE];
    197 static struct enamemem nsaptable[HASHNAMESIZE];
    198 
    199 struct bsnamemem {
    200 	u_short bs_addr0;
    201 	u_short bs_addr1;
    202 	u_short bs_addr2;
    203 	const char *bs_name;
    204 	u_char *bs_bytes;
    205 	unsigned int bs_nbytes;
    206 	struct bsnamemem *bs_nxt;
    207 };
    208 
    209 static struct bsnamemem bytestringtable[HASHNAMESIZE];
    210 
    211 struct protoidmem {
    212 	uint32_t p_oui;
    213 	u_short p_proto;
    214 	const char *p_name;
    215 	struct protoidmem *p_nxt;
    216 };
    217 
    218 static struct protoidmem protoidtable[HASHNAMESIZE];
    219 
    220 /*
    221  * A faster replacement for inet_ntoa().
    222  */
    223 const char *
    224 intoa(uint32_t addr)
    225 {
    226 	char *cp;
    227 	u_int byte;
    228 	int n;
    229 	static char buf[sizeof(".xxx.xxx.xxx.xxx")];
    230 
    231 	addr = ntohl(addr);
    232 	cp = buf + sizeof(buf);
    233 	*--cp = '\0';
    234 
    235 	n = 4;
    236 	do {
    237 		byte = addr & 0xff;
    238 		*--cp = (char)(byte % 10) + '0';
    239 		byte /= 10;
    240 		if (byte > 0) {
    241 			*--cp = (char)(byte % 10) + '0';
    242 			byte /= 10;
    243 			if (byte > 0)
    244 				*--cp = (char)byte + '0';
    245 		}
    246 		*--cp = '.';
    247 		addr >>= 8;
    248 	} while (--n > 0);
    249 
    250 	return cp + 1;
    251 }
    252 
    253 static uint32_t f_netmask;
    254 static uint32_t f_localnet;
    255 #ifdef HAVE_CASPER
    256 cap_channel_t *capdns;
    257 #endif
    258 
    259 /*
    260  * Return a name for the IP address pointed to by ap.  This address
    261  * is assumed to be in network byte order.
    262  *
    263  * NOTE: ap is *NOT* necessarily part of the packet data, so you
    264  * *CANNOT* use the ND_TCHECK_* or ND_TTEST_* macros on it.  Furthermore,
    265  * even in cases where it *is* part of the packet data, the caller
    266  * would still have to check for a null return value, even if it's
    267  * just printing the return value with "%s" - not all versions of
    268  * printf print "(null)" with "%s" and a null pointer, some of them
    269  * don't check for a null pointer and crash in that case.
    270  *
    271  * The callers of this routine should, before handing this routine
    272  * a pointer to packet data, be sure that the data is present in
    273  * the packet buffer.  They should probably do those checks anyway,
    274  * as other data at that layer might not be IP addresses, and it
    275  * also needs to check whether they're present in the packet buffer.
    276  */
    277 const char *
    278 ipaddr_string(netdissect_options *ndo, const u_char *ap)
    279 {
    280 	struct hostent *hp;
    281 	uint32_t addr;
    282 	struct hnamemem *p;
    283 
    284 	memcpy(&addr, ap, sizeof(addr));
    285 	p = &hnametable[addr & (HASHNAMESIZE-1)];
    286 	for (; p->nxt; p = p->nxt) {
    287 		if (p->addr == addr)
    288 			return (p->name);
    289 	}
    290 	p->addr = addr;
    291 	p->nxt = newhnamemem(ndo);
    292 
    293 	/*
    294 	 * Print names unless:
    295 	 *	(1) -n was given.
    296 	 *      (2) Address is foreign and -f was given. (If -f was not
    297 	 *	    given, f_netmask and f_localnet are 0 and the test
    298 	 *	    evaluates to true)
    299 	 */
    300 	if (!ndo->ndo_nflag &&
    301 	    (addr & f_netmask) == f_localnet) {
    302 #ifdef HAVE_CASPER
    303 		if (capdns != NULL) {
    304 			hp = cap_gethostbyaddr(capdns, (char *)&addr, 4,
    305 			    AF_INET);
    306 		} else
    307 #endif
    308 			hp = gethostbyaddr((char *)&addr, 4, AF_INET);
    309 		if (hp) {
    310 			char *dotp;
    311 
    312 			p->name = strdup(hp->h_name);
    313 			if (p->name == NULL)
    314 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    315 					"%s: strdup(hp->h_name)", __func__);
    316 			if (ndo->ndo_Nflag) {
    317 				/* Remove domain qualifications */
    318 				dotp = strchr(p->name, '.');
    319 				if (dotp)
    320 					*dotp = '\0';
    321 			}
    322 			return (p->name);
    323 		}
    324 	}
    325 	p->name = strdup(intoa(addr));
    326 	if (p->name == NULL)
    327 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    328 				  "%s: strdup(intoa(addr))", __func__);
    329 	return (p->name);
    330 }
    331 
    332 /*
    333  * Return a name for the IP6 address pointed to by ap.  This address
    334  * is assumed to be in network byte order.
    335  */
    336 const char *
    337 ip6addr_string(netdissect_options *ndo, const u_char *ap)
    338 {
    339 	struct hostent *hp;
    340 	union {
    341 		nd_ipv6 addr;
    342 		struct for_hash_addr {
    343 			char fill[14];
    344 			uint16_t d;
    345 		} addra;
    346 	} addr;
    347 	struct h6namemem *p;
    348 	const char *cp;
    349 	char ntop_buf[INET6_ADDRSTRLEN];
    350 
    351 	memcpy(&addr, ap, sizeof(addr));
    352 	p = &h6nametable[addr.addra.d & (HASHNAMESIZE-1)];
    353 	for (; p->nxt; p = p->nxt) {
    354 		if (memcmp(&p->addr, &addr, sizeof(addr)) == 0)
    355 			return (p->name);
    356 	}
    357 	memcpy(p->addr, addr.addr, sizeof(nd_ipv6));
    358 	p->nxt = newh6namemem(ndo);
    359 
    360 	/*
    361 	 * Do not print names if -n was given.
    362 	 */
    363 	if (!ndo->ndo_nflag) {
    364 #ifdef HAVE_CASPER
    365 		if (capdns != NULL) {
    366 			hp = cap_gethostbyaddr(capdns, (char *)&addr,
    367 			    sizeof(addr), AF_INET6);
    368 		} else
    369 #endif
    370 			hp = gethostbyaddr((char *)&addr, sizeof(addr),
    371 			    AF_INET6);
    372 		if (hp) {
    373 			char *dotp;
    374 
    375 			p->name = strdup(hp->h_name);
    376 			if (p->name == NULL)
    377 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    378 					"%s: strdup(hp->h_name)", __func__);
    379 			if (ndo->ndo_Nflag) {
    380 				/* Remove domain qualifications */
    381 				dotp = strchr(p->name, '.');
    382 				if (dotp)
    383 					*dotp = '\0';
    384 			}
    385 			return (p->name);
    386 		}
    387 	}
    388 	cp = addrtostr6(ap, ntop_buf, sizeof(ntop_buf));
    389 	p->name = strdup(cp);
    390 	if (p->name == NULL)
    391 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    392 				  "%s: strdup(cp)", __func__);
    393 	return (p->name);
    394 }
    395 
    396 static const char hex[16] = {
    397 	'0', '1', '2', '3', '4', '5', '6', '7',
    398 	'8', '9', 'a', 'b', 'c', 'd', 'e', 'f'
    399 };
    400 
    401 /*
    402  * Convert an octet to two hex digits.
    403  *
    404  * Coverity appears either:
    405  *
    406  *    not to believe the C standard when it asserts that a uint8_t is
    407  *    exactly 8 bits in size;
    408  *
    409  *    not to believe that an unsigned type of exactly 8 bits has a value
    410  *    in the range of 0 to 255;
    411  *
    412  *    not to believe that, for a range of unsigned values, if you shift
    413  *    one of those values right by 4 bits, the maximum result value is
    414  *    the maximum value shifted right by 4 bits, with no stray 1's shifted
    415  *    in;
    416  *
    417  *    not to believe that 255 >> 4 is 15;
    418  *
    419  * so it gets upset that we're taking a "tainted" unsigned value, shifting
    420  * it right 4 bits, and using it as an index into a 16-element array.
    421  *
    422  * So we do a stupid pointless masking of the result of the shift with
    423  * 0xf, to hammer the point home to Coverity.
    424  */
    425 static inline char *
    426 octet_to_hex(char *cp, uint8_t octet)
    427 {
    428 	*cp++ = hex[(octet >> 4) & 0xf];
    429 	*cp++ = hex[(octet >> 0) & 0xf];
    430 	return (cp);
    431 }
    432 
    433 /* Find the hash node that corresponds the ether address 'ep' */
    434 
    435 static struct enamemem *
    436 lookup_emem(netdissect_options *ndo, const u_char *ep)
    437 {
    438 	u_int i, j, k;
    439 	struct enamemem *tp;
    440 
    441 	k = (ep[0] << 8) | ep[1];
    442 	j = (ep[2] << 8) | ep[3];
    443 	i = (ep[4] << 8) | ep[5];
    444 
    445 	tp = &enametable[(i ^ j) & (HASHNAMESIZE-1)];
    446 	while (tp->e_nxt)
    447 		if (tp->e_addr0 == i &&
    448 		    tp->e_addr1 == j &&
    449 		    tp->e_addr2 == k)
    450 			return tp;
    451 		else
    452 			tp = tp->e_nxt;
    453 	tp->e_addr0 = (u_short)i;
    454 	tp->e_addr1 = (u_short)j;
    455 	tp->e_addr2 = (u_short)k;
    456 	tp->e_nxt = (struct enamemem *)calloc(1, sizeof(*tp));
    457 	if (tp->e_nxt == NULL)
    458 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "%s: calloc", __func__);
    459 
    460 	return tp;
    461 }
    462 
    463 /*
    464  * Find the hash node that corresponds to the bytestring 'bs'
    465  * with length 'nlen'
    466  */
    467 
    468 static struct bsnamemem *
    469 lookup_bytestring(netdissect_options *ndo, const u_char *bs,
    470 		  const unsigned int nlen)
    471 {
    472 	struct bsnamemem *tp;
    473 	u_int i, j, k;
    474 
    475 	if (nlen >= 6) {
    476 		k = (bs[0] << 8) | bs[1];
    477 		j = (bs[2] << 8) | bs[3];
    478 		i = (bs[4] << 8) | bs[5];
    479 	} else if (nlen >= 4) {
    480 		k = (bs[0] << 8) | bs[1];
    481 		j = (bs[2] << 8) | bs[3];
    482 		i = 0;
    483 	} else
    484 		i = j = k = 0;
    485 
    486 	tp = &bytestringtable[(i ^ j) & (HASHNAMESIZE-1)];
    487 	while (tp->bs_nxt)
    488 		if (nlen == tp->bs_nbytes &&
    489 		    tp->bs_addr0 == i &&
    490 		    tp->bs_addr1 == j &&
    491 		    tp->bs_addr2 == k &&
    492 		    memcmp((const char *)bs, (const char *)(tp->bs_bytes), nlen) == 0)
    493 			return tp;
    494 		else
    495 			tp = tp->bs_nxt;
    496 
    497 	tp->bs_addr0 = (u_short)i;
    498 	tp->bs_addr1 = (u_short)j;
    499 	tp->bs_addr2 = (u_short)k;
    500 
    501 	tp->bs_bytes = (u_char *) calloc(1, nlen);
    502 	if (tp->bs_bytes == NULL)
    503 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    504 				  "%s: calloc", __func__);
    505 
    506 	memcpy(tp->bs_bytes, bs, nlen);
    507 	tp->bs_nbytes = nlen;
    508 	tp->bs_nxt = (struct bsnamemem *)calloc(1, sizeof(*tp));
    509 	if (tp->bs_nxt == NULL)
    510 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    511 				  "%s: calloc", __func__);
    512 
    513 	return tp;
    514 }
    515 
    516 /* Find the hash node that corresponds the NSAP 'nsap' */
    517 
    518 static struct enamemem *
    519 lookup_nsap(netdissect_options *ndo, const u_char *nsap,
    520 	    u_int nsap_length)
    521 {
    522 	u_int i, j, k;
    523 	struct enamemem *tp;
    524 	const u_char *ensap;
    525 
    526 	if (nsap_length > 6) {
    527 		ensap = nsap + nsap_length - 6;
    528 		k = (ensap[0] << 8) | ensap[1];
    529 		j = (ensap[2] << 8) | ensap[3];
    530 		i = (ensap[4] << 8) | ensap[5];
    531 	} else
    532 		i = j = k = 0;
    533 
    534 	tp = &nsaptable[(i ^ j) & (HASHNAMESIZE-1)];
    535 	while (tp->e_nxt)
    536 		if (nsap_length == tp->e_nsap[0] &&
    537 		    tp->e_addr0 == i &&
    538 		    tp->e_addr1 == j &&
    539 		    tp->e_addr2 == k &&
    540 		    memcmp((const char *)nsap,
    541 			(char *)&(tp->e_nsap[1]), nsap_length) == 0)
    542 			return tp;
    543 		else
    544 			tp = tp->e_nxt;
    545 	tp->e_addr0 = (u_short)i;
    546 	tp->e_addr1 = (u_short)j;
    547 	tp->e_addr2 = (u_short)k;
    548 	tp->e_nsap = (u_char *)malloc(nsap_length + 1);
    549 	if (tp->e_nsap == NULL)
    550 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "%s: malloc", __func__);
    551 	tp->e_nsap[0] = (u_char)nsap_length;	/* guaranteed < ISONSAP_MAX_LENGTH */
    552 	memcpy((char *)&tp->e_nsap[1], (const char *)nsap, nsap_length);
    553 	tp->e_nxt = (struct enamemem *)calloc(1, sizeof(*tp));
    554 	if (tp->e_nxt == NULL)
    555 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "%s: calloc", __func__);
    556 
    557 	return tp;
    558 }
    559 
    560 /* Find the hash node that corresponds the protoid 'pi'. */
    561 
    562 static struct protoidmem *
    563 lookup_protoid(netdissect_options *ndo, const u_char *pi)
    564 {
    565 	u_int i, j;
    566 	struct protoidmem *tp;
    567 
    568 	/* 5 octets won't be aligned */
    569 	i = (((pi[0] << 8) + pi[1]) << 8) + pi[2];
    570 	j =   (pi[3] << 8) + pi[4];
    571 	/* XXX should be endian-insensitive, but do big-endian testing  XXX */
    572 
    573 	tp = &protoidtable[(i ^ j) & (HASHNAMESIZE-1)];
    574 	while (tp->p_nxt)
    575 		if (tp->p_oui == i && tp->p_proto == j)
    576 			return tp;
    577 		else
    578 			tp = tp->p_nxt;
    579 	tp->p_oui = i;
    580 	tp->p_proto = (u_short)j;
    581 	tp->p_nxt = (struct protoidmem *)calloc(1, sizeof(*tp));
    582 	if (tp->p_nxt == NULL)
    583 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "%s: calloc", __func__);
    584 
    585 	return tp;
    586 }
    587 
    588 const char *
    589 etheraddr_string(netdissect_options *ndo, const uint8_t *ep)
    590 {
    591 	int i;
    592 	char *cp;
    593 	struct enamemem *tp;
    594 	int oui;
    595 	char buf[BUFSIZE];
    596 
    597 	tp = lookup_emem(ndo, ep);
    598 	if (tp->e_name)
    599 		return (tp->e_name);
    600 #ifdef USE_ETHER_NTOHOST
    601 	if (!ndo->ndo_nflag) {
    602 		char buf2[BUFSIZE];
    603 		/*
    604 		 * This is a non-const copy of ep for ether_ntohost(), which
    605 		 * has its second argument non-const in OpenBSD. Also saves a
    606 		 * type cast.
    607 		 */
    608 		struct ether_addr ea;
    609 
    610 		memcpy (&ea, ep, MAC_ADDR_LEN);
    611 		if (ether_ntohost(buf2, &ea) == 0) {
    612 			tp->e_name = strdup(buf2);
    613 			if (tp->e_name == NULL)
    614 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    615 					"%s: strdup(buf2)", __func__);
    616 			return (tp->e_name);
    617 		}
    618 	}
    619 #endif
    620 	cp = buf;
    621 	oui = EXTRACT_BE_U_3(ep);
    622 	cp = octet_to_hex(cp, *ep++);
    623 	for (i = 5; --i >= 0;) {
    624 		*cp++ = ':';
    625 		cp = octet_to_hex(cp, *ep++);
    626 	}
    627 
    628 	if (!ndo->ndo_nflag) {
    629 		snprintf(cp, BUFSIZE - (2 + 5*3), " (oui %s)",
    630 		    tok2str(oui_values, "Unknown", oui));
    631 	} else
    632 		*cp = '\0';
    633 	tp->e_name = strdup(buf);
    634 	if (tp->e_name == NULL)
    635 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    636 				  "%s: strdup(buf)", __func__);
    637 	return (tp->e_name);
    638 }
    639 
    640 const char *
    641 le64addr_string(netdissect_options *ndo, const uint8_t *ep)
    642 {
    643 	const unsigned int len = 8;
    644 	u_int i;
    645 	char *cp;
    646 	struct bsnamemem *tp;
    647 	char buf[BUFSIZE];
    648 
    649 	tp = lookup_bytestring(ndo, ep, len);
    650 	if (tp->bs_name)
    651 		return (tp->bs_name);
    652 
    653 	cp = buf;
    654 	for (i = len; i > 0 ; --i) {
    655 		cp = octet_to_hex(cp, *(ep + i - 1));
    656 		*cp++ = ':';
    657 	}
    658 	cp --;
    659 
    660 	*cp = '\0';
    661 
    662 	tp->bs_name = strdup(buf);
    663 	if (tp->bs_name == NULL)
    664 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    665 				  "%s: strdup(buf)", __func__);
    666 
    667 	return (tp->bs_name);
    668 }
    669 
    670 const char *
    671 linkaddr_string(netdissect_options *ndo, const uint8_t *ep,
    672 		const unsigned int type, const unsigned int len)
    673 {
    674 	u_int i;
    675 	char *cp;
    676 	struct bsnamemem *tp;
    677 
    678 	if (len == 0)
    679 		return ("<empty>");
    680 
    681 	if (type == LINKADDR_ETHER && len == MAC_ADDR_LEN)
    682 		return (etheraddr_string(ndo, ep));
    683 
    684 	if (type == LINKADDR_FRELAY)
    685 		return (q922_string(ndo, ep, len));
    686 
    687 	tp = lookup_bytestring(ndo, ep, len);
    688 	if (tp->bs_name)
    689 		return (tp->bs_name);
    690 
    691 	tp->bs_name = cp = (char *)malloc(len*3);
    692 	if (tp->bs_name == NULL)
    693 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    694 				  "%s: malloc", __func__);
    695 	cp = octet_to_hex(cp, *ep++);
    696 	for (i = len-1; i > 0 ; --i) {
    697 		*cp++ = ':';
    698 		cp = octet_to_hex(cp, *ep++);
    699 	}
    700 	*cp = '\0';
    701 	return (tp->bs_name);
    702 }
    703 
    704 #define ISONSAP_MAX_LENGTH 20
    705 const char *
    706 isonsap_string(netdissect_options *ndo, const uint8_t *nsap,
    707 	       u_int nsap_length)
    708 {
    709 	u_int nsap_idx;
    710 	char *cp;
    711 	struct enamemem *tp;
    712 
    713 	if (nsap_length < 1 || nsap_length > ISONSAP_MAX_LENGTH)
    714 		return ("isonsap_string: illegal length");
    715 
    716 	tp = lookup_nsap(ndo, nsap, nsap_length);
    717 	if (tp->e_name)
    718 		return tp->e_name;
    719 
    720 	tp->e_name = cp = (char *)malloc(sizeof("xx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xx"));
    721 	if (cp == NULL)
    722 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    723 				  "%s: malloc", __func__);
    724 
    725 	for (nsap_idx = 0; nsap_idx < nsap_length; nsap_idx++) {
    726 		cp = octet_to_hex(cp, *nsap++);
    727 		if (((nsap_idx & 1) == 0) &&
    728 		     (nsap_idx + 1 < nsap_length)) {
    729 			*cp++ = '.';
    730 		}
    731 	}
    732 	*cp = '\0';
    733 	return (tp->e_name);
    734 }
    735 
    736 const char *
    737 tcpport_string(netdissect_options *ndo, u_short port)
    738 {
    739 	struct hnamemem *tp;
    740 	uint32_t i = port;
    741 	char buf[sizeof("00000")];
    742 
    743 	for (tp = &tporttable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
    744 		if (tp->addr == i)
    745 			return (tp->name);
    746 
    747 	tp->addr = i;
    748 	tp->nxt = newhnamemem(ndo);
    749 
    750 	(void)snprintf(buf, sizeof(buf), "%u", i);
    751 	tp->name = strdup(buf);
    752 	if (tp->name == NULL)
    753 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    754 				  "%s: strdup(buf)", __func__);
    755 	return (tp->name);
    756 }
    757 
    758 const char *
    759 udpport_string(netdissect_options *ndo, u_short port)
    760 {
    761 	struct hnamemem *tp;
    762 	uint32_t i = port;
    763 	char buf[sizeof("00000")];
    764 
    765 	for (tp = &uporttable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
    766 		if (tp->addr == i)
    767 			return (tp->name);
    768 
    769 	tp->addr = i;
    770 	tp->nxt = newhnamemem(ndo);
    771 
    772 	(void)snprintf(buf, sizeof(buf), "%u", i);
    773 	tp->name = strdup(buf);
    774 	if (tp->name == NULL)
    775 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    776 				  "%s: strdup(buf)", __func__);
    777 	return (tp->name);
    778 }
    779 
    780 const char *
    781 ipxsap_string(netdissect_options *ndo, u_short port)
    782 {
    783 	char *cp;
    784 	struct hnamemem *tp;
    785 	uint32_t i = port;
    786 	char buf[sizeof("0000")];
    787 
    788 	for (tp = &ipxsaptable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
    789 		if (tp->addr == i)
    790 			return (tp->name);
    791 
    792 	tp->addr = i;
    793 	tp->nxt = newhnamemem(ndo);
    794 
    795 	cp = buf;
    796 	port = ntohs(port);
    797 	*cp++ = hex[port >> 12 & 0xf];
    798 	*cp++ = hex[port >> 8 & 0xf];
    799 	*cp++ = hex[port >> 4 & 0xf];
    800 	*cp++ = hex[port & 0xf];
    801 	*cp++ = '\0';
    802 	tp->name = strdup(buf);
    803 	if (tp->name == NULL)
    804 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    805 				  "%s: strdup(buf)", __func__);
    806 	return (tp->name);
    807 }
    808 
    809 static void
    810 init_servarray(netdissect_options *ndo)
    811 {
    812 	struct servent *sv;
    813 	struct hnamemem *table;
    814 	int i;
    815 	char buf[sizeof("0000000000")];
    816 
    817 	while ((sv = getservent()) != NULL) {
    818 		int port = ntohs(sv->s_port);
    819 		i = port & (HASHNAMESIZE-1);
    820 		if (strcmp(sv->s_proto, "tcp") == 0)
    821 			table = &tporttable[i];
    822 		else if (strcmp(sv->s_proto, "udp") == 0)
    823 			table = &uporttable[i];
    824 		else
    825 			continue;
    826 
    827 		while (table->name)
    828 			table = table->nxt;
    829 		if (ndo->ndo_nflag) {
    830 			(void)snprintf(buf, sizeof(buf), "%d", port);
    831 			table->name = strdup(buf);
    832 		} else
    833 			table->name = strdup(sv->s_name);
    834 		if (table->name == NULL)
    835 			(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    836 					  "%s: strdup", __func__);
    837 
    838 		table->addr = port;
    839 		table->nxt = newhnamemem(ndo);
    840 	}
    841 	endservent();
    842 }
    843 
    844 static const struct eproto {
    845 	const char *s;
    846 	u_short p;
    847 } eproto_db[] = {
    848 	{ "aarp", ETHERTYPE_AARP },
    849 	{ "arp", ETHERTYPE_ARP },
    850 	{ "atalk", ETHERTYPE_ATALK },
    851 	{ "decnet", ETHERTYPE_DN },
    852 	{ "ip", ETHERTYPE_IP },
    853 	{ "ip6", ETHERTYPE_IPV6 },
    854 	{ "lat", ETHERTYPE_LAT },
    855 	{ "loopback", ETHERTYPE_LOOPBACK },
    856 	{ "mopdl", ETHERTYPE_MOPDL },
    857 	{ "moprc", ETHERTYPE_MOPRC },
    858 	{ "rarp", ETHERTYPE_REVARP },
    859 	{ "sca", ETHERTYPE_SCA },
    860 	{ (char *)0, 0 }
    861 };
    862 
    863 static void
    864 init_eprotoarray(netdissect_options *ndo)
    865 {
    866 	int i;
    867 	struct hnamemem *table;
    868 
    869 	for (i = 0; eproto_db[i].s; i++) {
    870 		int j = htons(eproto_db[i].p) & (HASHNAMESIZE-1);
    871 		table = &eprototable[j];
    872 		while (table->name)
    873 			table = table->nxt;
    874 		table->name = eproto_db[i].s;
    875 		table->addr = htons(eproto_db[i].p);
    876 		table->nxt = newhnamemem(ndo);
    877 	}
    878 }
    879 
    880 static const struct protoidlist {
    881 	const u_char protoid[5];
    882 	const char *name;
    883 } protoidlist[] = {
    884 	{{ 0x00, 0x00, 0x0c, 0x01, 0x07 }, "CiscoMLS" },
    885 	{{ 0x00, 0x00, 0x0c, 0x20, 0x00 }, "CiscoCDP" },
    886 	{{ 0x00, 0x00, 0x0c, 0x20, 0x01 }, "CiscoCGMP" },
    887 	{{ 0x00, 0x00, 0x0c, 0x20, 0x03 }, "CiscoVTP" },
    888 	{{ 0x00, 0xe0, 0x2b, 0x00, 0xbb }, "ExtremeEDP" },
    889 	{{ 0x00, 0x00, 0x00, 0x00, 0x00 }, NULL }
    890 };
    891 
    892 /*
    893  * SNAP proto IDs with org code 0:0:0 are actually encapsulated Ethernet
    894  * types.
    895  */
    896 static void
    897 init_protoidarray(netdissect_options *ndo)
    898 {
    899 	int i;
    900 	struct protoidmem *tp;
    901 	const struct protoidlist *pl;
    902 	u_char protoid[5];
    903 
    904 	protoid[0] = 0;
    905 	protoid[1] = 0;
    906 	protoid[2] = 0;
    907 	for (i = 0; eproto_db[i].s; i++) {
    908 		u_short etype = htons(eproto_db[i].p);
    909 
    910 		memcpy((char *)&protoid[3], (char *)&etype, 2);
    911 		tp = lookup_protoid(ndo, protoid);
    912 		tp->p_name = strdup(eproto_db[i].s);
    913 		if (tp->p_name == NULL)
    914 			(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    915 				"%s: strdup(eproto_db[i].s)", __func__);
    916 	}
    917 	/* Hardwire some SNAP proto ID names */
    918 	for (pl = protoidlist; pl->name != NULL; ++pl) {
    919 		tp = lookup_protoid(ndo, pl->protoid);
    920 		/* Don't override existing name */
    921 		if (tp->p_name != NULL)
    922 			continue;
    923 
    924 		tp->p_name = pl->name;
    925 	}
    926 }
    927 
    928 static const struct etherlist {
    929 	const nd_mac_addr addr;
    930 	const char *name;
    931 } etherlist[] = {
    932 	{{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, "Broadcast" },
    933 	{{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, NULL }
    934 };
    935 
    936 /*
    937  * Initialize the ethers hash table.  We take two different approaches
    938  * depending on whether or not the system provides the ethers name
    939  * service.  If it does, we just wire in a few names at startup,
    940  * and etheraddr_string() fills in the table on demand.  If it doesn't,
    941  * then we suck in the entire /etc/ethers file at startup.  The idea
    942  * is that parsing the local file will be fast, but spinning through
    943  * all the ethers entries via NIS & next_etherent might be very slow.
    944  *
    945  * XXX pcap_next_etherent doesn't belong in the pcap interface, but
    946  * since the pcap module already does name-to-address translation,
    947  * it's already does most of the work for the ethernet address-to-name
    948  * translation, so we just pcap_next_etherent as a convenience.
    949  */
    950 static void
    951 init_etherarray(netdissect_options *ndo)
    952 {
    953 	const struct etherlist *el;
    954 	struct enamemem *tp;
    955 #ifdef USE_ETHER_NTOHOST
    956 	char name[256];
    957 #else
    958 	struct pcap_etherent *ep;
    959 	FILE *fp;
    960 
    961 	/* Suck in entire ethers file */
    962 	fp = fopen(PCAP_ETHERS_FILE, "r");
    963 	if (fp != NULL) {
    964 		while ((ep = pcap_next_etherent(fp)) != NULL) {
    965 			tp = lookup_emem(ndo, ep->addr);
    966 			tp->e_name = strdup(ep->name);
    967 			if (tp->e_name == NULL)
    968 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    969 					"%s: strdup(ep->addr)", __func__);
    970 		}
    971 		(void)fclose(fp);
    972 	}
    973 #endif
    974 
    975 	/* Hardwire some ethernet names */
    976 	for (el = etherlist; el->name != NULL; ++el) {
    977 		tp = lookup_emem(ndo, el->addr);
    978 		/* Don't override existing name */
    979 		if (tp->e_name != NULL)
    980 			continue;
    981 
    982 #ifdef USE_ETHER_NTOHOST
    983 		/*
    984 		 * Use YP/NIS version of name if available.
    985 		 */
    986 		/* Same workaround as in etheraddr_string(). */
    987 		struct ether_addr ea;
    988 		memcpy (&ea, el->addr, MAC_ADDR_LEN);
    989 		if (ether_ntohost(name, &ea) == 0) {
    990 			tp->e_name = strdup(name);
    991 			if (tp->e_name == NULL)
    992 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
    993 					"%s: strdup(name)", __func__);
    994 			continue;
    995 		}
    996 #endif
    997 		tp->e_name = el->name;
    998 	}
    999 }
   1000 
   1001 static const struct ipxsap_ent {
   1002 	uint16_t	v;
   1003 	const char	*s;
   1004 } ipxsap_db[] = {
   1005 	{ 0x0000, "Unknown" },
   1006 	{ 0x0001, "User" },
   1007 	{ 0x0002, "User Group" },
   1008 	{ 0x0003, "PrintQueue" },
   1009 	{ 0x0004, "FileServer" },
   1010 	{ 0x0005, "JobServer" },
   1011 	{ 0x0006, "Gateway" },
   1012 	{ 0x0007, "PrintServer" },
   1013 	{ 0x0008, "ArchiveQueue" },
   1014 	{ 0x0009, "ArchiveServer" },
   1015 	{ 0x000a, "JobQueue" },
   1016 	{ 0x000b, "Administration" },
   1017 	{ 0x000F, "Novell TI-RPC" },
   1018 	{ 0x0017, "Diagnostics" },
   1019 	{ 0x0020, "NetBIOS" },
   1020 	{ 0x0021, "NAS SNA Gateway" },
   1021 	{ 0x0023, "NACS AsyncGateway" },
   1022 	{ 0x0024, "RemoteBridge/RoutingService" },
   1023 	{ 0x0026, "BridgeServer" },
   1024 	{ 0x0027, "TCP/IP Gateway" },
   1025 	{ 0x0028, "Point-to-point X.25 BridgeServer" },
   1026 	{ 0x0029, "3270 Gateway" },
   1027 	{ 0x002a, "CHI Corp" },
   1028 	{ 0x002c, "PC Chalkboard" },
   1029 	{ 0x002d, "TimeSynchServer" },
   1030 	{ 0x002e, "ARCserve5.0/PalindromeBackup" },
   1031 	{ 0x0045, "DI3270 Gateway" },
   1032 	{ 0x0047, "AdvertisingPrintServer" },
   1033 	{ 0x004a, "NetBlazerModems" },
   1034 	{ 0x004b, "BtrieveVAP" },
   1035 	{ 0x004c, "NetwareSQL" },
   1036 	{ 0x004d, "XtreeNetwork" },
   1037 	{ 0x0050, "BtrieveVAP4.11" },
   1038 	{ 0x0052, "QuickLink" },
   1039 	{ 0x0053, "PrintQueueUser" },
   1040 	{ 0x0058, "Multipoint X.25 Router" },
   1041 	{ 0x0060, "STLB/NLM" },
   1042 	{ 0x0064, "ARCserve" },
   1043 	{ 0x0066, "ARCserve3.0" },
   1044 	{ 0x0072, "WAN CopyUtility" },
   1045 	{ 0x007a, "TES-NetwareVMS" },
   1046 	{ 0x0092, "WATCOM Debugger/EmeraldTapeBackupServer" },
   1047 	{ 0x0095, "DDA OBGYN" },
   1048 	{ 0x0098, "NetwareAccessServer" },
   1049 	{ 0x009a, "Netware for VMS II/NamedPipeServer" },
   1050 	{ 0x009b, "NetwareAccessServer" },
   1051 	{ 0x009e, "PortableNetwareServer/SunLinkNVT" },
   1052 	{ 0x00a1, "PowerchuteAPC UPS" },
   1053 	{ 0x00aa, "LAWserve" },
   1054 	{ 0x00ac, "CompaqIDA StatusMonitor" },
   1055 	{ 0x0100, "PIPE STAIL" },
   1056 	{ 0x0102, "LAN ProtectBindery" },
   1057 	{ 0x0103, "OracleDataBaseServer" },
   1058 	{ 0x0107, "Netware386/RSPX RemoteConsole" },
   1059 	{ 0x010f, "NovellSNA Gateway" },
   1060 	{ 0x0111, "TestServer" },
   1061 	{ 0x0112, "HP PrintServer" },
   1062 	{ 0x0114, "CSA MUX" },
   1063 	{ 0x0115, "CSA LCA" },
   1064 	{ 0x0116, "CSA CM" },
   1065 	{ 0x0117, "CSA SMA" },
   1066 	{ 0x0118, "CSA DBA" },
   1067 	{ 0x0119, "CSA NMA" },
   1068 	{ 0x011a, "CSA SSA" },
   1069 	{ 0x011b, "CSA STATUS" },
   1070 	{ 0x011e, "CSA APPC" },
   1071 	{ 0x0126, "SNA TEST SSA Profile" },
   1072 	{ 0x012a, "CSA TRACE" },
   1073 	{ 0x012b, "NetwareSAA" },
   1074 	{ 0x012e, "IKARUS VirusScan" },
   1075 	{ 0x0130, "CommunicationsExecutive" },
   1076 	{ 0x0133, "NNS DomainServer/NetwareNamingServicesDomain" },
   1077 	{ 0x0135, "NetwareNamingServicesProfile" },
   1078 	{ 0x0137, "Netware386 PrintQueue/NNS PrintQueue" },
   1079 	{ 0x0141, "LAN SpoolServer" },
   1080 	{ 0x0152, "IRMALAN Gateway" },
   1081 	{ 0x0154, "NamedPipeServer" },
   1082 	{ 0x0166, "NetWareManagement" },
   1083 	{ 0x0168, "Intel PICKIT CommServer/Intel CAS TalkServer" },
   1084 	{ 0x0173, "Compaq" },
   1085 	{ 0x0174, "Compaq SNMP Agent" },
   1086 	{ 0x0175, "Compaq" },
   1087 	{ 0x0180, "XTreeServer/XTreeTools" },
   1088 	{ 0x018A, "NASI ServicesBroadcastServer" },
   1089 	{ 0x01b0, "GARP Gateway" },
   1090 	{ 0x01b1, "Binfview" },
   1091 	{ 0x01bf, "IntelLanDeskManager" },
   1092 	{ 0x01ca, "AXTEC" },
   1093 	{ 0x01cb, "ShivaNetModem/E" },
   1094 	{ 0x01cc, "ShivaLanRover/E" },
   1095 	{ 0x01cd, "ShivaLanRover/T" },
   1096 	{ 0x01ce, "ShivaUniversal" },
   1097 	{ 0x01d8, "CastelleFAXPressServer" },
   1098 	{ 0x01da, "CastelleLANPressPrintServer" },
   1099 	{ 0x01dc, "CastelleFAX/Xerox7033 FaxServer/ExcelLanFax" },
   1100 	{ 0x01f0, "LEGATO" },
   1101 	{ 0x01f5, "LEGATO" },
   1102 	{ 0x0233, "NMS Agent/NetwareManagementAgent" },
   1103 	{ 0x0237, "NMS IPX Discovery/LANternReadWriteChannel" },
   1104 	{ 0x0238, "NMS IP Discovery/LANternTrapAlarmChannel" },
   1105 	{ 0x023a, "LANtern" },
   1106 	{ 0x023c, "MAVERICK" },
   1107 	{ 0x023f, "NovellSMDR" },
   1108 	{ 0x024e, "NetwareConnect" },
   1109 	{ 0x024f, "NASI ServerBroadcast Cisco" },
   1110 	{ 0x026a, "NMS ServiceConsole" },
   1111 	{ 0x026b, "TimeSynchronizationServer Netware 4.x" },
   1112 	{ 0x0278, "DirectoryServer Netware 4.x" },
   1113 	{ 0x027b, "NetwareManagementAgent" },
   1114 	{ 0x0280, "Novell File and Printer Sharing Service for PC" },
   1115 	{ 0x0304, "NovellSAA Gateway" },
   1116 	{ 0x0308, "COM/VERMED" },
   1117 	{ 0x030a, "GalacticommWorldgroupServer" },
   1118 	{ 0x030c, "IntelNetport2/HP JetDirect/HP Quicksilver" },
   1119 	{ 0x0320, "AttachmateGateway" },
   1120 	{ 0x0327, "MicrosoftDiagnostics" },
   1121 	{ 0x0328, "WATCOM SQL Server" },
   1122 	{ 0x0335, "MultiTechSystems MultisynchCommServer" },
   1123 	{ 0x0343, "Xylogics RemoteAccessServer/LANModem" },
   1124 	{ 0x0355, "ArcadaBackupExec" },
   1125 	{ 0x0358, "MSLCD1" },
   1126 	{ 0x0361, "NETINELO" },
   1127 	{ 0x037e, "Powerchute UPS Monitoring" },
   1128 	{ 0x037f, "ViruSafeNotify" },
   1129 	{ 0x0386, "HP Bridge" },
   1130 	{ 0x0387, "HP Hub" },
   1131 	{ 0x0394, "NetWare SAA Gateway" },
   1132 	{ 0x039b, "LotusNotes" },
   1133 	{ 0x03b7, "CertusAntiVirus" },
   1134 	{ 0x03c4, "ARCserve4.0" },
   1135 	{ 0x03c7, "LANspool3.5" },
   1136 	{ 0x03d7, "LexmarkPrinterServer" },
   1137 	{ 0x03d8, "LexmarkXLE PrinterServer" },
   1138 	{ 0x03dd, "BanyanENS NetwareClient" },
   1139 	{ 0x03de, "GuptaSequelBaseServer/NetWareSQL" },
   1140 	{ 0x03e1, "UnivelUnixware" },
   1141 	{ 0x03e4, "UnivelUnixware" },
   1142 	{ 0x03fc, "IntelNetport" },
   1143 	{ 0x03fd, "PrintServerQueue" },
   1144 	{ 0x040A, "ipnServer" },
   1145 	{ 0x040D, "LVERRMAN" },
   1146 	{ 0x040E, "LVLIC" },
   1147 	{ 0x0414, "NET Silicon (DPI)/Kyocera" },
   1148 	{ 0x0429, "SiteLockVirus" },
   1149 	{ 0x0432, "UFHELPR???" },
   1150 	{ 0x0433, "Synoptics281xAdvancedSNMPAgent" },
   1151 	{ 0x0444, "MicrosoftNT SNA Server" },
   1152 	{ 0x0448, "Oracle" },
   1153 	{ 0x044c, "ARCserve5.01" },
   1154 	{ 0x0457, "CanonGP55" },
   1155 	{ 0x045a, "QMS Printers" },
   1156 	{ 0x045b, "DellSCSI Array" },
   1157 	{ 0x0491, "NetBlazerModems" },
   1158 	{ 0x04ac, "OnTimeScheduler" },
   1159 	{ 0x04b0, "CD-Net" },
   1160 	{ 0x0513, "EmulexNQA" },
   1161 	{ 0x0520, "SiteLockChecks" },
   1162 	{ 0x0529, "SiteLockChecks" },
   1163 	{ 0x052d, "CitrixOS2 AppServer" },
   1164 	{ 0x0535, "Tektronix" },
   1165 	{ 0x0536, "Milan" },
   1166 	{ 0x055d, "Attachmate SNA gateway" },
   1167 	{ 0x056b, "IBM8235 ModemServer" },
   1168 	{ 0x056c, "ShivaLanRover/E PLUS" },
   1169 	{ 0x056d, "ShivaLanRover/T PLUS" },
   1170 	{ 0x0580, "McAfeeNetShield" },
   1171 	{ 0x05B8, "NLM to workstation communication (Revelation Software)" },
   1172 	{ 0x05BA, "CompatibleSystemsRouters" },
   1173 	{ 0x05BE, "CheyenneHierarchicalStorageManager" },
   1174 	{ 0x0606, "JCWatermarkImaging" },
   1175 	{ 0x060c, "AXISNetworkPrinter" },
   1176 	{ 0x0610, "AdaptecSCSIManagement" },
   1177 	{ 0x0621, "IBM AntiVirus" },
   1178 	{ 0x0640, "Windows95 RemoteRegistryService" },
   1179 	{ 0x064e, "MicrosoftIIS" },
   1180 	{ 0x067b, "Microsoft Win95/98 File and Print Sharing for NetWare" },
   1181 	{ 0x067c, "Microsoft Win95/98 File and Print Sharing for NetWare" },
   1182 	{ 0x076C, "Xerox" },
   1183 	{ 0x079b, "ShivaLanRover/E 115" },
   1184 	{ 0x079c, "ShivaLanRover/T 115" },
   1185 	{ 0x07B4, "CubixWorldDesk" },
   1186 	{ 0x07c2, "Quarterdeck IWare Connect V2.x NLM" },
   1187 	{ 0x07c1, "Quarterdeck IWare Connect V3.x NLM" },
   1188 	{ 0x0810, "ELAN License Server Demo" },
   1189 	{ 0x0824, "ShivaLanRoverAccessSwitch/E" },
   1190 	{ 0x086a, "ISSC Collector" },
   1191 	{ 0x087f, "ISSC DAS AgentAIX" },
   1192 	{ 0x0880, "Intel Netport PRO" },
   1193 	{ 0x0881, "Intel Netport PRO" },
   1194 	{ 0x0b29, "SiteLock" },
   1195 	{ 0x0c29, "SiteLockApplications" },
   1196 	{ 0x0c2c, "LicensingServer" },
   1197 	{ 0x2101, "PerformanceTechnologyInstantInternet" },
   1198 	{ 0x2380, "LAI SiteLock" },
   1199 	{ 0x238c, "MeetingMaker" },
   1200 	{ 0x4808, "SiteLockServer/SiteLockMetering" },
   1201 	{ 0x5555, "SiteLockUser" },
   1202 	{ 0x6312, "Tapeware" },
   1203 	{ 0x6f00, "RabbitGateway" },
   1204 	{ 0x7703, "MODEM" },
   1205 	{ 0x8002, "NetPortPrinters" },
   1206 	{ 0x8008, "WordPerfectNetworkVersion" },
   1207 	{ 0x85BE, "Cisco EIGRP" },
   1208 	{ 0x8888, "WordPerfectNetworkVersion/QuickNetworkManagement" },
   1209 	{ 0x9000, "McAfeeNetShield" },
   1210 	{ 0x9604, "CSA-NT_MON" },
   1211 	{ 0xb6a8, "OceanIsleReachoutRemoteControl" },
   1212 	{ 0xf11f, "SiteLockMetering" },
   1213 	{ 0xf1ff, "SiteLock" },
   1214 	{ 0xf503, "Microsoft SQL Server" },
   1215 	{ 0xF905, "IBM TimeAndPlace" },
   1216 	{ 0xfbfb, "TopCallIII FaxServer" },
   1217 	{ 0xffff, "AnyService/Wildcard" },
   1218 	{ 0, (char *)0 }
   1219 };
   1220 
   1221 static void
   1222 init_ipxsaparray(netdissect_options *ndo)
   1223 {
   1224 	int i;
   1225 	struct hnamemem *table;
   1226 
   1227 	for (i = 0; ipxsap_db[i].s != NULL; i++) {
   1228 		u_int j = htons(ipxsap_db[i].v) & (HASHNAMESIZE-1);
   1229 		table = &ipxsaptable[j];
   1230 		while (table->name)
   1231 			table = table->nxt;
   1232 		table->name = ipxsap_db[i].s;
   1233 		table->addr = htons(ipxsap_db[i].v);
   1234 		table->nxt = newhnamemem(ndo);
   1235 	}
   1236 }
   1237 
   1238 /*
   1239  * Initialize the address to name translation machinery.  We map all
   1240  * non-local IP addresses to numeric addresses if ndo->ndo_fflag is true
   1241  * (i.e., to prevent blocking on the nameserver).  localnet is the IP address
   1242  * of the local network.  mask is its subnet mask.
   1243  */
   1244 void
   1245 init_addrtoname(netdissect_options *ndo, uint32_t localnet, uint32_t mask)
   1246 {
   1247 	if (ndo->ndo_fflag) {
   1248 		f_localnet = localnet;
   1249 		f_netmask = mask;
   1250 	}
   1251 	if (ndo->ndo_nflag)
   1252 		/*
   1253 		 * Simplest way to suppress names.
   1254 		 */
   1255 		return;
   1256 
   1257 	init_etherarray(ndo);
   1258 	init_servarray(ndo);
   1259 	init_eprotoarray(ndo);
   1260 	init_protoidarray(ndo);
   1261 	init_ipxsaparray(ndo);
   1262 }
   1263 
   1264 const char *
   1265 dnaddr_string(netdissect_options *ndo, u_short dnaddr)
   1266 {
   1267 	struct hnamemem *tp;
   1268 
   1269 	for (tp = &dnaddrtable[dnaddr & (HASHNAMESIZE-1)]; tp->nxt != NULL;
   1270 	     tp = tp->nxt)
   1271 		if (tp->addr == dnaddr)
   1272 			return (tp->name);
   1273 
   1274 	tp->addr = dnaddr;
   1275 	tp->nxt = newhnamemem(ndo);
   1276 	tp->name = dnnum_string(ndo, dnaddr);
   1277 
   1278 	return(tp->name);
   1279 }
   1280 
   1281 /* Return a zero'ed hnamemem struct and cuts down on calloc() overhead */
   1282 struct hnamemem *
   1283 newhnamemem(netdissect_options *ndo)
   1284 {
   1285 	struct hnamemem *p;
   1286 	static struct hnamemem *ptr = NULL;
   1287 	static u_int num = 0;
   1288 
   1289 	if (num  == 0) {
   1290 		num = 64;
   1291 		ptr = (struct hnamemem *)calloc(num, sizeof (*ptr));
   1292 		if (ptr == NULL)
   1293 			(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
   1294 					  "%s: calloc", __func__);
   1295 	}
   1296 	--num;
   1297 	p = ptr++;
   1298 	return (p);
   1299 }
   1300 
   1301 /* Return a zero'ed h6namemem struct and cuts down on calloc() overhead */
   1302 struct h6namemem *
   1303 newh6namemem(netdissect_options *ndo)
   1304 {
   1305 	struct h6namemem *p;
   1306 	static struct h6namemem *ptr = NULL;
   1307 	static u_int num = 0;
   1308 
   1309 	if (num  == 0) {
   1310 		num = 64;
   1311 		ptr = (struct h6namemem *)calloc(num, sizeof (*ptr));
   1312 		if (ptr == NULL)
   1313 			(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
   1314 					  "%s: calloc", __func__);
   1315 	}
   1316 	--num;
   1317 	p = ptr++;
   1318 	return (p);
   1319 }
   1320 
   1321 /* Represent TCI part of the 802.1Q 4-octet tag as text. */
   1322 const char *
   1323 ieee8021q_tci_string(const uint16_t tci)
   1324 {
   1325 	static char buf[128];
   1326 	snprintf(buf, sizeof(buf), "vlan %u, p %u%s",
   1327 	         tci & 0xfff,
   1328 	         tci >> 13,
   1329 	         (tci & 0x1000) ? ", DEI" : "");
   1330 	return buf;
   1331 }
   1332