From: sproule@ernie.Princeton.EDU (William J. Sproule)
Subject: Re: SUMMARY:  Need AppleTalk Frame/Header Formats
Followup-To: comp.protocols.appletalk
Originator: news@nimaster
Keywords: phase2 decode
Organization: Princeton University
Date: Fri, 20 Nov 1992 14:58:41 GMT


In article <1992Nov18.153244.18383@Princeton.EDU>, sproule@ernie.Princeton.EDU (William J. Sproule) writes:
|> I have a quick perl script that will break apart Phase2 ET so this 
|> output from tcpdump:


Sorry, the script did not post, here it is:

#!/usr/princeton/bin/perl

require "getopts.pl";

$opt_a = 0;
$opt_p = 0;
$opt_v = 0;
$opt_f = "0";
$VERBOSE = 0;
$ASPFLAG = 0;
$PAPFLAG = 0;

&Getopts('apvf:');
OPTCASE: {
   if ( (($opt_a == 1) && ($opt_p == 1)) ||
        (($opt_a == 0) && ($opt_p == 0)) ) {
      die "Usage: etdc -a|-p -v -f filename\n";
   }
   if ($opt_a == 1 ) {
      $ASPFLAG = 1;
      print "Decodeing ATP as ASP\n";
      last OPTCASE;
   }
   if ($opt_p == 1 ) {
      $PAPFLAG = 1;
      print "Decodeing ATP as PAP\n";
      last OPTCASE;
   }
}
if ($opt_f eq "0") {
   print "Reading from STDIN\n";
   open(INPUT,"-")|| die "Can not open STDIN\n";
}
else {
   open(INPUT, "$opt_f") || die "No such file: $opt_f\n";  
}
if ($opt_v == 1) {
   $VERBOSE = 1;
   print "Maximum Verbosity!\n";
}  

$data="";



while (<INPUT>) {
  chop;
  s/\t//g;
  if (length > 40 ) {
     $pkthdr = $pktnew;
     $pktnew = $_;
     if ( length($data) > 0) {
        $packed=pack("H*",$data);
        ($header,$bhops,$msblngth,$lsblngth,$chksum,$dstnet,$srcnet,
         $dstnode,$srcnode,$dstskt,$srcskt,$ddptype) = unpack("H16 B6 X B8 B8 H4 H4 H4 H2 H2 H2 H2 H2",$packed);
        $bhops = "00".$bhops;
        $thops = pack("B8",$bhops);
        $hops = unpack("H2",$thops);
        $msblngth = substr($msblngth,6,2);
        $tmpl = "000000".$msblngth.$lsblngth;
        $lngth = unpack("H4",pack("B16",$tmpl));  
        print "\n\n",$pkthdr,"\n";
        if ($VERBOSE) {
           print $data,"\n";
        }
        CASELOOP: {
           if ($header ne "aaaa03080007809b") {
              print "Non-EtherTalk Packet.\n";
              last CASELOOP;
           }
           else {
              print "DDP HEADER:\n";
              printf("Header: %s\tHops: %s\tLength: %s\tChkSum: %s\n",$header,$hops,$lngth,$chksum);
              printf("Dest: %s.%s.%s Src: %s.%s.%s\t",$dstnet,$dstnode,$dstskt,$srcnet,$srcnode,$srcskt);
              printf("DDPType: %s\n",$ddptype); 
           }
#
# RTMP Packets
#
           if ($ddptype == 1) {
              $rtmpoffset = 25;
              $rtmplngth = hex($lngth) + 8;
              ($rtmpnet,$idl,$rtmpsndr) = unpack("@21 H4 H2 H2",$packed);
              printf("RTMP Header:\tNET: %s\tID Length: %s\tNode ID: %s\n",$rtmpnet,hex($idl),$rtmpsndr);
              while ($rtmpoffset < $rtmplngth) {
                 ($rs,$ds) = unpack("@$rtmpoffset H4 H2", $packed);
                 $hopcnt = 0x1f & hex($ds);
                 $rtmpoffset += 3;
                 print "Range Start: ",$rs," Distance: ",$hopcnt;
                 if ( (0x80 & hex($ds)) == 0x80) {   #extended network tuple
                    ($re,$et) = unpack("@$rtmpoffset H4 H2 ", $packed);
                    print " Range End: ",$re;
                    $rtmpoffset += 3;
                 }
                 print "\n";
              }
              last CASELOOP;
           }
#
# NBP Packets
#
           if ($ddptype == 2) {
              $datalngth = (hex($lngth) *2) - 26 ;
              print "NBP HEADER:\n";
              ($nbpfunc,$tuplecnt,$nbpid) = unpack("@21 H1 @21 h1 H2",$packed);
              NBPCASE:{
                 if ($nbpfunc == 1 ) {
                    print "FUNCTION: BrRq\t TUPLECNT: ",$tuplecnt,"\n";
                    last NBPCASE;
                 }
                 if ($nbpfunc == 2 ) {
                    print "FUNCTION: LkUp\t TUPLECNT: ",$tuplecnt,"\n";
                    last NBPCASE;
                 }
                 if ($nbpfunc == 3 ) {
                    print "FUNCTION: LkUp-Reply\t TUPLECNT: ",$tuplecnt,"\n";
                    last NBPCASE;
                 }
                 print "Unknown NBP type: ",$nbpfunc,"\n";
              }
              $i=0;
              $tupleoffset=28;
              print "NBP DATA:\n";
              ($nbpnetnum,$nbpnodeid,$nbpsktnum,$nbpenum) = unpack("@23 H4 H2 H2 H2",$packed);
              printf("NetNum:%s\tNodeID:%s\tSktNum:%s\tEnumerator:%s\n",$nbpnetnum,$nbpnodeid,$nbpsktnum,$nbpenum);
              while ( $i < $tuplecnt ) {
                 $i++;
                 $objlnth = hex(unpack("@$tupleoffset H2",$packed));
                 $tupleoffset += 1;
                 $nbpstr = "OBJECT: ".unpack("@$tupleoffset a$objlnth",$packed)."\t";
                 $tupleoffset += $objlnth;
                 $typelnth = hex(unpack("@$tupleoffset H2",$packed));
                 $tupleoffset += 1;
                 $nbpstr = $nbpstr."TYPE: ".unpack("@$tupleoffset a$typelnth",$packed)."\t";
                 $tupleoffset += $typelnth;
                 $zonelnth = hex(unpack("@$tupleoffset H2",$packed)); 
                 $tupleoffset += 1;
                 $nbpstr = $nbpstr."ZONE: ".unpack("@$tupleoffset a$zonelnth",$packed); 
                 $tupleoffset += $zonelnth + 5;
                 print $nbpstr,"\n";
              }
              last CASELOOP;
           }
#
# ATP Packets - could be PAP or ASP
#
           if ($ddptype == 3) {           
              $datalngth = (hex($lngth) *2) - 42 ;  
              ($cntrlinfo,$seqnum,$tid) = unpack("@21 H2 H2 H4",$packed);
              $cntrlstr = "";
              $ctlpkd = hex($cntrlinfo);
              ATPCNTRCASE: {
                 if (($ctlpkd & 0xc0) == 0xc0) {
                    $cntrlstr = "TREL";
                    last ATPCNTRCASE;
                 }
                 if (($ctlpkd & 0x80) == 0x80) {
                    $cntrlstr = "TRESP";
                    last ATPCNTRCASE;
                 }        
                 if (($ctlpkd & 0x40) == 0x40) { 
                    $cntrlstr = "TREQ";
                    last ATPCNTRCASE;
                 }
              }
              if (($ctlpkd & 0x20) == 0x20) {
                 $cntrlstr = $cntrlstr." XO" ;
              }
              if (($ctlpkd & 0x10) == 0x10) {
                 $cntrlstr = $cntrlstr." EOM" ;
              }        
              if (($ctlpkd & 0x08) == 0x08) { 
                 $cntrlstr = $cntrlstr." STS" ;
              }
              printf("ATP HEADER:\tCONTRLINFO: %s\tSEQNUM: %s\tTID: %s\n",$cntrlstr,$seqnum,$tid);
              if ($ASPFLAG){
                 print "ASP HEADER: \t",unpack("@25 H8",$packed),"\n";
                 print "ASP DATA:\n";
                 print "ASCII: ",unpack("@29 a$datalngth",$packed),"\n";
                 print "HEX: ",unpack("@29 H$datalngth",$packed),"\n";
              }
              if ($PAPFLAG) {
                 print "PAP HEADER:\t";
                 ($connid,$cmd,$usrbytes,$data) = unpack("@25 H2 H2 H4 a$datalngth ",$packed);
                 print "ConnID: ",$connid,"\tCMD: ";
                 PAPCASE: {
                    if ($cmd == 1) {
                       ($aparsn,$fq,$wt) = unpack("@29 H2 H2 H4",$packed);
                       printf("OpenConn\tATPRSSN: %s\tFlowQuantum: %s\tWaitTime: %s\n",$aparsn,$fq,$wt);
                       last PAPCASE;
                    }
                    if ($cmd == 2) {
                       ($aparsn,$fq,$rslt) = unpack("@29 H2 H2 H4",$packed);
                       printf("OpenConnReply\tATPRSSN: %s\tFlowQuantum: %s\tResult: %s\n",$aparsn,$fq,$rslt);
                       $datalngth -= 16;
                       $data = unpack("@33 a$datalngth",$packed);
                       print "STATUS: ",$data,"\n";
                       last PAPCASE;
                    }
                    if ($cmd == 3) {
                       print "SendData\t PAP Seq Num: ",$usrbytes,"\n";
                       last PAPCASE;
                    }
                    if ($cmd == 4) {
                       print "Data\t EOF: ",$usrbytes,"\n";
                       print "DATA: ",unpack("@29 a$datalngth",$packed);
                       last PAPCASE;
                    }
                    if ($cmd == 5) {
                       print "Tickle\n";
                       last PAPCASE;
                    }
                    if ($cmd == 6) {
                       print "CloseConn\n";
                       last PAPCASE;
                    }
                    if ($cmd == 7) {
                       print "CloseConnReply\n";
                       last PAPCASE;
                    }
                    if ($cmd == 8) {
                       print "SendStatus\n";
                       last PAPCASE;
                    }
                    if ($cmd == 9) {
                       print "Status\n";
                       $datalngth -= 8;
                       $data = unpack("@33 a$datalngth",$packed);
                       print "STATUS: ",$data,"\n";
                       last PAPCASE;
                    }
                 }
              }
              last CASELOOP;
           }
#
# AEP
#
           if ($ddptype == 4) {
              $aepcmd = hex(unpack("@21 H2",$packed));
              AEPCASE: {
                 if ($aepcmd == 1 ) {
                    print "AEP Request\n";
                    last AEPCASE;
                 }
                 if ($aepcmd == 2 ) {
                    print "AEP Reply\n";
                    last AEPCASE;
                 }
              }
              print "AEP DATA:\n" , unpack("@22 H*",$packed),"\n";
              last CASELOOP;
           }
#
# RTMP Request
#
           if ($ddptype == 5) {
              print "RDR HEADER:\n";
              $rdrcmd = hex(unpack("@21 H2",$packed));
              RDRCASE: {
                 if ($rdrcmd == 1 ) {
                    print "RDR Request\n";
                    last RDRCASE;
                 }
                 if ($rdrcmd == 2 ) {
                    print "RDR Route Data Request - Normal Split-Horizon\n";
                    last RDRCASE;
                 }
                 if ($rdrcmd == 3 ) {
                    print "RDR Route Data Request - Without Split-Horizon\n";
                    last RDRCASE;
                 }
                 print "Unknown RDR Command\n";
              }
              print "RDR Data:\n" , unpack("@22 H*",$packed),"\n";
              last CASELOOP;
           }
#
# ZIP
#
           if ($ddptype == 6) {
              print "ZIP HEADER:\n";
              $zipcmd = hex(unpack("@21 H2",$packed));
              ZIPCASE: {
                 if ($zipcmd = 1) {
                    print "ZIP Query:\n";
                    last ZIPCASE;
                 }
                 if ($zipcmd = 2) {
                    print "ZIP Reply:\n";
                    last ZIPCASE;
                 }
                 if ($zipcmd = 3) {
                    print "ZIP Takedown:\n";
                    last ZIPCASE;
                 }
                 if ($zipcmd = 4) {
                    print "ZIP Bringup:\n";
                    last ZIPCASE;
                 }
                 if ($zipcmd = 5) {
                    print "ZIP GetNetInfo:\n";
                    last ZIPCASE;
                 }
                 if ($zipcmd = 6) {
                    print "ZIP NetInfoReply:\n";
                    last ZIPCASE;
                 }
                 if ($zipcmd = 7) {
                    print "ZIP GetMyZone:\n";
                    last ZIPCASE;
                 }
                 if ($zipcmd = 8) {
                    print "ZIP GetZoneList:\n";
                    last ZIPCASE;
                 }
              }
              print "ZIP DATA:\n" , unpack("@22 H*",$packed),"\n";
              last CASELOOP;
           }
#
# ADSP
#
           if ($ddptype == 7) {
              print "ADSP DATA:\n" , unpack("@21 H*",$packed),"\n";
              last CASELOOP;
           }
#
# AURP
#
           if ($ddptype == 8) {
              print "AURP DATA:\n" , unpack("@21 H*",$packed),"\n";
              last CASELOOP;
           }
#
# MacIP
#
           if (hex($ddptype) == 0x16) {
              print "MacIP DATA:\n" , unpack("@21 a*",$packed),"\n";
              last CASELOOP;
           }
           print "Unknown AppleTalk protocol\n";
        }
     }
     $data="";
  }
  else {
     s/ //g;
     s/\n//g;
     $data = $data . $_;
  }
}

-- 
William J. Sproule - Networking  	Princeton University
UUCP:     	...princeton!sproule	87 Prospect Ave.
INTERNET:	sproule@Princeton.EDU	Princeton, NJ   08544
BITNET:		SPROULE@PUCC		VOICE: 609-258-6089  FAX: 609-258-3943