xref: /netbsd-src/external/bsd/tcpdump/dist/addrtoname.c (revision 26ba0b503b498a5194a71ac319838b7f5497f3fe)
1 /*
2  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that: (1) source code distributions
7  * retain the above copyright notice and this paragraph in its entirety, (2)
8  * distributions including binary code include the above copyright notice and
9  * this paragraph in its entirety in the documentation or other materials
10  * provided with the distribution, and (3) all advertising materials mentioning
11  * features or use of this software display the following acknowledgement:
12  * ``This product includes software developed by the University of California,
13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14  * the University nor the names of its contributors may be used to endorse
15  * or promote products derived from this software without specific prior
16  * written permission.
17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20  *
21  *  Internet, ethernet, port, and protocol string to address
22  *  and address to string conversion routines
23  */
24 #include <sys/cdefs.h>
25 #ifndef lint
26 __RCSID("$NetBSD: addrtoname.c,v 1.13 2024/09/02 16:15:29 christos Exp $");
27 #endif
28 
29 #include <config.h>
30 
31 #ifdef HAVE_CASPER
32 #include <libcasper.h>
33 #include <casper/cap_dns.h>
34 #endif /* HAVE_CASPER */
35 
36 #include "netdissect-stdinc.h"
37 
38 #ifdef USE_ETHER_NTOHOST
39   #if defined(NET_ETHERNET_H_DECLARES_ETHER_NTOHOST)
40     /*
41      * OK, just include <net/ethernet.h>.
42      */
43     #include <net/ethernet.h>
44   #elif defined(NETINET_ETHER_H_DECLARES_ETHER_NTOHOST)
45     /*
46      * OK, just include <netinet/ether.h>
47      */
48     #include <netinet/ether.h>
49   #elif defined(SYS_ETHERNET_H_DECLARES_ETHER_NTOHOST)
50     /*
51      * OK, just include <sys/ethernet.h>
52      */
53     #include <sys/ethernet.h>
54   #elif defined(ARPA_INET_H_DECLARES_ETHER_NTOHOST)
55     /*
56      * OK, just include <arpa/inet.h>
57      */
58     #include <arpa/inet.h>
59   #elif defined(NETINET_IF_ETHER_H_DECLARES_ETHER_NTOHOST)
60     /*
61      * OK, include <netinet/if_ether.h>, after all the other stuff we
62      * need to include or define for its benefit.
63      */
64     #define NEED_NETINET_IF_ETHER_H
65   #else
66     /*
67      * We'll have to declare it ourselves.
68      * If <netinet/if_ether.h> defines struct ether_addr, include
69      * it.  Otherwise, define it ourselves.
70      */
71     #ifdef HAVE_STRUCT_ETHER_ADDR
72       #define NEED_NETINET_IF_ETHER_H
73     #else /* HAVE_STRUCT_ETHER_ADDR */
74 	struct ether_addr {
75 		/* Beware FreeBSD calls this "octet". */
76 		unsigned char ether_addr_octet[MAC_ADDR_LEN];
77 	};
78     #endif /* HAVE_STRUCT_ETHER_ADDR */
79   #endif /* what declares ether_ntohost() */
80 
81   #ifdef NEED_NETINET_IF_ETHER_H
82     /*
83      * Include diag-control.h before <net/if.h>, which too defines a macro
84      * named ND_UNREACHABLE.
85      */
86     #include "diag-control.h"
87     #include <net/if.h>		/* Needed on some platforms */
88     #include <netinet/in.h>	/* Needed on some platforms */
89     #include <netinet/if_ether.h>
90   #endif /* NEED_NETINET_IF_ETHER_H */
91 
92   #ifndef HAVE_DECL_ETHER_NTOHOST
93     /*
94      * No header declares it, so declare it ourselves.
95      */
96     extern int ether_ntohost(char *, const struct ether_addr *);
97   #endif /* !defined(HAVE_DECL_ETHER_NTOHOST) */
98 #endif /* USE_ETHER_NTOHOST */
99 
100 #include <pcap.h>
101 #include <pcap-namedb.h>
102 #ifndef HAVE_GETSERVENT
103 #include <getservent.h>
104 #endif
105 #include <signal.h>
106 #include <stdio.h>
107 #include <string.h>
108 #include <stdlib.h>
109 
110 #include "netdissect.h"
111 #include "addrtoname.h"
112 #include "addrtostr.h"
113 #include "ethertype.h"
114 #include "llc.h"
115 #include "extract.h"
116 #include "oui.h"
117 
118 /*
119  * hash tables for whatever-to-name translations
120  *
121  * ndo_error() called on strdup(3) failure with S_ERR_ND_MEM_ALLOC status
122  */
123 
124 #define HASHNAMESIZE 4096
125 
126 struct hnamemem {
127 	uint32_t addr;
128 	const char *name;
129 	struct hnamemem *nxt;
130 };
131 
132 static struct hnamemem hnametable[HASHNAMESIZE];
133 static struct hnamemem tporttable[HASHNAMESIZE];
134 static struct hnamemem uporttable[HASHNAMESIZE];
135 static struct hnamemem eprototable[HASHNAMESIZE];
136 static struct hnamemem dnaddrtable[HASHNAMESIZE];
137 static struct hnamemem ipxsaptable[HASHNAMESIZE];
138 
139 #ifdef _WIN32
140 /*
141  * fake gethostbyaddr for Win2k/XP
142  * gethostbyaddr() returns incorrect value when AF_INET6 is passed
143  * to 3rd argument.
144  *
145  * h_name in struct hostent is only valid.
146  */
147 static struct hostent *
148 win32_gethostbyaddr(const char *addr, int len, int type)
149 {
150 	static struct hostent host;
151 	static char hostbuf[NI_MAXHOST];
152 	char hname[NI_MAXHOST];
153 	struct sockaddr_in6 addr6;
154 
155 	host.h_name = hostbuf;
156 	switch (type) {
157 	case AF_INET:
158 		return gethostbyaddr(addr, len, type);
159 		break;
160 	case AF_INET6:
161 		memset(&addr6, 0, sizeof(addr6));
162 		addr6.sin6_family = AF_INET6;
163 		memcpy(&addr6.sin6_addr, addr, len);
164 		if (getnameinfo((struct sockaddr *)&addr6, sizeof(addr6),
165 		    hname, sizeof(hname), NULL, 0, 0)) {
166 			return NULL;
167 		} else {
168 			strlcpy(host.h_name, hname, NI_MAXHOST);
169 			return &host;
170 		}
171 		break;
172 	default:
173 		return NULL;
174 	}
175 }
176 #define gethostbyaddr win32_gethostbyaddr
177 #endif /* _WIN32 */
178 
179 struct h6namemem {
180 	nd_ipv6 addr;
181 	char *name;
182 	struct h6namemem *nxt;
183 };
184 
185 static struct h6namemem h6nametable[HASHNAMESIZE];
186 
187 struct enamemem {
188 	u_short e_addr0;
189 	u_short e_addr1;
190 	u_short e_addr2;
191 	const char *e_name;
192 	u_char *e_nsap;			/* used only for nsaptable[] */
193 	struct enamemem *e_nxt;
194 };
195 
196 static struct enamemem enametable[HASHNAMESIZE];
197 static struct enamemem nsaptable[HASHNAMESIZE];
198 
199 struct bsnamemem {
200 	u_short bs_addr0;
201 	u_short bs_addr1;
202 	u_short bs_addr2;
203 	const char *bs_name;
204 	u_char *bs_bytes;
205 	unsigned int bs_nbytes;
206 	struct bsnamemem *bs_nxt;
207 };
208 
209 static struct bsnamemem bytestringtable[HASHNAMESIZE];
210 
211 struct protoidmem {
212 	uint32_t p_oui;
213 	u_short p_proto;
214 	const char *p_name;
215 	struct protoidmem *p_nxt;
216 };
217 
218 static struct protoidmem protoidtable[HASHNAMESIZE];
219 
220 /*
221  * A faster replacement for inet_ntoa().
222  */
223 const char *
224 intoa(uint32_t addr)
225 {
226 	char *cp;
227 	u_int byte;
228 	int n;
229 	static char buf[sizeof(".xxx.xxx.xxx.xxx")];
230 
231 	addr = ntohl(addr);
232 	cp = buf + sizeof(buf);
233 	*--cp = '\0';
234 
235 	n = 4;
236 	do {
237 		byte = addr & 0xff;
238 		*--cp = (char)(byte % 10) + '0';
239 		byte /= 10;
240 		if (byte > 0) {
241 			*--cp = (char)(byte % 10) + '0';
242 			byte /= 10;
243 			if (byte > 0)
244 				*--cp = (char)byte + '0';
245 		}
246 		*--cp = '.';
247 		addr >>= 8;
248 	} while (--n > 0);
249 
250 	return cp + 1;
251 }
252 
253 static uint32_t f_netmask;
254 static uint32_t f_localnet;
255 #ifdef HAVE_CASPER
256 cap_channel_t *capdns;
257 #endif
258 
259 /*
260  * Return a name for the IP address pointed to by ap.  This address
261  * is assumed to be in network byte order.
262  *
263  * NOTE: ap is *NOT* necessarily part of the packet data, so you
264  * *CANNOT* use the ND_TCHECK_* or ND_TTEST_* macros on it.  Furthermore,
265  * even in cases where it *is* part of the packet data, the caller
266  * would still have to check for a null return value, even if it's
267  * just printing the return value with "%s" - not all versions of
268  * printf print "(null)" with "%s" and a null pointer, some of them
269  * don't check for a null pointer and crash in that case.
270  *
271  * The callers of this routine should, before handing this routine
272  * a pointer to packet data, be sure that the data is present in
273  * the packet buffer.  They should probably do those checks anyway,
274  * as other data at that layer might not be IP addresses, and it
275  * also needs to check whether they're present in the packet buffer.
276  */
277 const char *
278 ipaddr_string(netdissect_options *ndo, const u_char *ap)
279 {
280 	struct hostent *hp;
281 	uint32_t addr;
282 	struct hnamemem *p;
283 
284 	memcpy(&addr, ap, sizeof(addr));
285 	p = &hnametable[addr & (HASHNAMESIZE-1)];
286 	for (; p->nxt; p = p->nxt) {
287 		if (p->addr == addr)
288 			return (p->name);
289 	}
290 	p->addr = addr;
291 	p->nxt = newhnamemem(ndo);
292 
293 	/*
294 	 * Print names unless:
295 	 *	(1) -n was given.
296 	 *      (2) Address is foreign and -f was given. (If -f was not
297 	 *	    given, f_netmask and f_localnet are 0 and the test
298 	 *	    evaluates to true)
299 	 */
300 	if (!ndo->ndo_nflag &&
301 	    (addr & f_netmask) == f_localnet) {
302 #ifdef HAVE_CASPER
303 		if (capdns != NULL) {
304 			hp = cap_gethostbyaddr(capdns, (char *)&addr, 4,
305 			    AF_INET);
306 		} else
307 #endif
308 			hp = gethostbyaddr((char *)&addr, 4, AF_INET);
309 		if (hp) {
310 			char *dotp;
311 
312 			p->name = strdup(hp->h_name);
313 			if (p->name == NULL)
314 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
315 					"%s: strdup(hp->h_name)", __func__);
316 			if (ndo->ndo_Nflag) {
317 				/* Remove domain qualifications */
318 				dotp = strchr(p->name, '.');
319 				if (dotp)
320 					*dotp = '\0';
321 			}
322 			return (p->name);
323 		}
324 	}
325 	p->name = strdup(intoa(addr));
326 	if (p->name == NULL)
327 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
328 				  "%s: strdup(intoa(addr))", __func__);
329 	return (p->name);
330 }
331 
332 /*
333  * Return a name for the IP6 address pointed to by ap.  This address
334  * is assumed to be in network byte order.
335  */
336 const char *
337 ip6addr_string(netdissect_options *ndo, const u_char *ap)
338 {
339 	struct hostent *hp;
340 	union {
341 		nd_ipv6 addr;
342 		struct for_hash_addr {
343 			char fill[14];
344 			uint16_t d;
345 		} addra;
346 	} addr;
347 	struct h6namemem *p;
348 	const char *cp;
349 	char ntop_buf[INET6_ADDRSTRLEN];
350 
351 	memcpy(&addr, ap, sizeof(addr));
352 	p = &h6nametable[addr.addra.d & (HASHNAMESIZE-1)];
353 	for (; p->nxt; p = p->nxt) {
354 		if (memcmp(&p->addr, &addr, sizeof(addr)) == 0)
355 			return (p->name);
356 	}
357 	memcpy(p->addr, addr.addr, sizeof(nd_ipv6));
358 	p->nxt = newh6namemem(ndo);
359 
360 	/*
361 	 * Do not print names if -n was given.
362 	 */
363 	if (!ndo->ndo_nflag) {
364 #ifdef HAVE_CASPER
365 		if (capdns != NULL) {
366 			hp = cap_gethostbyaddr(capdns, (char *)&addr,
367 			    sizeof(addr), AF_INET6);
368 		} else
369 #endif
370 			hp = gethostbyaddr((char *)&addr, sizeof(addr),
371 			    AF_INET6);
372 		if (hp) {
373 			char *dotp;
374 
375 			p->name = strdup(hp->h_name);
376 			if (p->name == NULL)
377 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
378 					"%s: strdup(hp->h_name)", __func__);
379 			if (ndo->ndo_Nflag) {
380 				/* Remove domain qualifications */
381 				dotp = strchr(p->name, '.');
382 				if (dotp)
383 					*dotp = '\0';
384 			}
385 			return (p->name);
386 		}
387 	}
388 	cp = addrtostr6(ap, ntop_buf, sizeof(ntop_buf));
389 	p->name = strdup(cp);
390 	if (p->name == NULL)
391 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
392 				  "%s: strdup(cp)", __func__);
393 	return (p->name);
394 }
395 
396 static const char hex[16] = {
397 	'0', '1', '2', '3', '4', '5', '6', '7',
398 	'8', '9', 'a', 'b', 'c', 'd', 'e', 'f'
399 };
400 
401 /*
402  * Convert an octet to two hex digits.
403  *
404  * Coverity appears either:
405  *
406  *    not to believe the C standard when it asserts that a uint8_t is
407  *    exactly 8 bits in size;
408  *
409  *    not to believe that an unsigned type of exactly 8 bits has a value
410  *    in the range of 0 to 255;
411  *
412  *    not to believe that, for a range of unsigned values, if you shift
413  *    one of those values right by 4 bits, the maximum result value is
414  *    the maximum value shifted right by 4 bits, with no stray 1's shifted
415  *    in;
416  *
417  *    not to believe that 255 >> 4 is 15;
418  *
419  * so it gets upset that we're taking a "tainted" unsigned value, shifting
420  * it right 4 bits, and using it as an index into a 16-element array.
421  *
422  * So we do a stupid pointless masking of the result of the shift with
423  * 0xf, to hammer the point home to Coverity.
424  */
425 static inline char *
426 octet_to_hex(char *cp, uint8_t octet)
427 {
428 	*cp++ = hex[(octet >> 4) & 0xf];
429 	*cp++ = hex[(octet >> 0) & 0xf];
430 	return (cp);
431 }
432 
433 /* Find the hash node that corresponds the ether address 'ep' */
434 
435 static struct enamemem *
436 lookup_emem(netdissect_options *ndo, const u_char *ep)
437 {
438 	u_int i, j, k;
439 	struct enamemem *tp;
440 
441 	k = (ep[0] << 8) | ep[1];
442 	j = (ep[2] << 8) | ep[3];
443 	i = (ep[4] << 8) | ep[5];
444 
445 	tp = &enametable[(i ^ j) & (HASHNAMESIZE-1)];
446 	while (tp->e_nxt)
447 		if (tp->e_addr0 == i &&
448 		    tp->e_addr1 == j &&
449 		    tp->e_addr2 == k)
450 			return tp;
451 		else
452 			tp = tp->e_nxt;
453 	tp->e_addr0 = (u_short)i;
454 	tp->e_addr1 = (u_short)j;
455 	tp->e_addr2 = (u_short)k;
456 	tp->e_nxt = (struct enamemem *)calloc(1, sizeof(*tp));
457 	if (tp->e_nxt == NULL)
458 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "%s: calloc", __func__);
459 
460 	return tp;
461 }
462 
463 /*
464  * Find the hash node that corresponds to the bytestring 'bs'
465  * with length 'nlen'
466  */
467 
468 static struct bsnamemem *
469 lookup_bytestring(netdissect_options *ndo, const u_char *bs,
470 		  const unsigned int nlen)
471 {
472 	struct bsnamemem *tp;
473 	u_int i, j, k;
474 
475 	if (nlen >= 6) {
476 		k = (bs[0] << 8) | bs[1];
477 		j = (bs[2] << 8) | bs[3];
478 		i = (bs[4] << 8) | bs[5];
479 	} else if (nlen >= 4) {
480 		k = (bs[0] << 8) | bs[1];
481 		j = (bs[2] << 8) | bs[3];
482 		i = 0;
483 	} else
484 		i = j = k = 0;
485 
486 	tp = &bytestringtable[(i ^ j) & (HASHNAMESIZE-1)];
487 	while (tp->bs_nxt)
488 		if (nlen == tp->bs_nbytes &&
489 		    tp->bs_addr0 == i &&
490 		    tp->bs_addr1 == j &&
491 		    tp->bs_addr2 == k &&
492 		    memcmp((const char *)bs, (const char *)(tp->bs_bytes), nlen) == 0)
493 			return tp;
494 		else
495 			tp = tp->bs_nxt;
496 
497 	tp->bs_addr0 = (u_short)i;
498 	tp->bs_addr1 = (u_short)j;
499 	tp->bs_addr2 = (u_short)k;
500 
501 	tp->bs_bytes = (u_char *) calloc(1, nlen);
502 	if (tp->bs_bytes == NULL)
503 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
504 				  "%s: calloc", __func__);
505 
506 	memcpy(tp->bs_bytes, bs, nlen);
507 	tp->bs_nbytes = nlen;
508 	tp->bs_nxt = (struct bsnamemem *)calloc(1, sizeof(*tp));
509 	if (tp->bs_nxt == NULL)
510 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
511 				  "%s: calloc", __func__);
512 
513 	return tp;
514 }
515 
516 /* Find the hash node that corresponds the NSAP 'nsap' */
517 
518 static struct enamemem *
519 lookup_nsap(netdissect_options *ndo, const u_char *nsap,
520 	    u_int nsap_length)
521 {
522 	u_int i, j, k;
523 	struct enamemem *tp;
524 	const u_char *ensap;
525 
526 	if (nsap_length > 6) {
527 		ensap = nsap + nsap_length - 6;
528 		k = (ensap[0] << 8) | ensap[1];
529 		j = (ensap[2] << 8) | ensap[3];
530 		i = (ensap[4] << 8) | ensap[5];
531 	} else
532 		i = j = k = 0;
533 
534 	tp = &nsaptable[(i ^ j) & (HASHNAMESIZE-1)];
535 	while (tp->e_nxt)
536 		if (nsap_length == tp->e_nsap[0] &&
537 		    tp->e_addr0 == i &&
538 		    tp->e_addr1 == j &&
539 		    tp->e_addr2 == k &&
540 		    memcmp((const char *)nsap,
541 			(char *)&(tp->e_nsap[1]), nsap_length) == 0)
542 			return tp;
543 		else
544 			tp = tp->e_nxt;
545 	tp->e_addr0 = (u_short)i;
546 	tp->e_addr1 = (u_short)j;
547 	tp->e_addr2 = (u_short)k;
548 	tp->e_nsap = (u_char *)malloc(nsap_length + 1);
549 	if (tp->e_nsap == NULL)
550 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "%s: malloc", __func__);
551 	tp->e_nsap[0] = (u_char)nsap_length;	/* guaranteed < ISONSAP_MAX_LENGTH */
552 	memcpy((char *)&tp->e_nsap[1], (const char *)nsap, nsap_length);
553 	tp->e_nxt = (struct enamemem *)calloc(1, sizeof(*tp));
554 	if (tp->e_nxt == NULL)
555 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "%s: calloc", __func__);
556 
557 	return tp;
558 }
559 
560 /* Find the hash node that corresponds the protoid 'pi'. */
561 
562 static struct protoidmem *
563 lookup_protoid(netdissect_options *ndo, const u_char *pi)
564 {
565 	u_int i, j;
566 	struct protoidmem *tp;
567 
568 	/* 5 octets won't be aligned */
569 	i = (((pi[0] << 8) + pi[1]) << 8) + pi[2];
570 	j =   (pi[3] << 8) + pi[4];
571 	/* XXX should be endian-insensitive, but do big-endian testing  XXX */
572 
573 	tp = &protoidtable[(i ^ j) & (HASHNAMESIZE-1)];
574 	while (tp->p_nxt)
575 		if (tp->p_oui == i && tp->p_proto == j)
576 			return tp;
577 		else
578 			tp = tp->p_nxt;
579 	tp->p_oui = i;
580 	tp->p_proto = (u_short)j;
581 	tp->p_nxt = (struct protoidmem *)calloc(1, sizeof(*tp));
582 	if (tp->p_nxt == NULL)
583 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "%s: calloc", __func__);
584 
585 	return tp;
586 }
587 
588 const char *
589 etheraddr_string(netdissect_options *ndo, const uint8_t *ep)
590 {
591 	int i;
592 	char *cp;
593 	struct enamemem *tp;
594 	int oui;
595 	char buf[BUFSIZE];
596 
597 	tp = lookup_emem(ndo, ep);
598 	if (tp->e_name)
599 		return (tp->e_name);
600 #ifdef USE_ETHER_NTOHOST
601 	if (!ndo->ndo_nflag) {
602 		char buf2[BUFSIZE];
603 		/*
604 		 * This is a non-const copy of ep for ether_ntohost(), which
605 		 * has its second argument non-const in OpenBSD. Also saves a
606 		 * type cast.
607 		 */
608 		struct ether_addr ea;
609 
610 		memcpy (&ea, ep, MAC_ADDR_LEN);
611 		if (ether_ntohost(buf2, &ea) == 0) {
612 			tp->e_name = strdup(buf2);
613 			if (tp->e_name == NULL)
614 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
615 					"%s: strdup(buf2)", __func__);
616 			return (tp->e_name);
617 		}
618 	}
619 #endif
620 	cp = buf;
621 	oui = EXTRACT_BE_U_3(ep);
622 	cp = octet_to_hex(cp, *ep++);
623 	for (i = 5; --i >= 0;) {
624 		*cp++ = ':';
625 		cp = octet_to_hex(cp, *ep++);
626 	}
627 
628 	if (!ndo->ndo_nflag) {
629 		snprintf(cp, BUFSIZE - (2 + 5*3), " (oui %s)",
630 		    tok2str(oui_values, "Unknown", oui));
631 	} else
632 		*cp = '\0';
633 	tp->e_name = strdup(buf);
634 	if (tp->e_name == NULL)
635 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
636 				  "%s: strdup(buf)", __func__);
637 	return (tp->e_name);
638 }
639 
640 const char *
641 le64addr_string(netdissect_options *ndo, const uint8_t *ep)
642 {
643 	const unsigned int len = 8;
644 	u_int i;
645 	char *cp;
646 	struct bsnamemem *tp;
647 	char buf[BUFSIZE];
648 
649 	tp = lookup_bytestring(ndo, ep, len);
650 	if (tp->bs_name)
651 		return (tp->bs_name);
652 
653 	cp = buf;
654 	for (i = len; i > 0 ; --i) {
655 		cp = octet_to_hex(cp, *(ep + i - 1));
656 		*cp++ = ':';
657 	}
658 	cp --;
659 
660 	*cp = '\0';
661 
662 	tp->bs_name = strdup(buf);
663 	if (tp->bs_name == NULL)
664 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
665 				  "%s: strdup(buf)", __func__);
666 
667 	return (tp->bs_name);
668 }
669 
670 const char *
671 linkaddr_string(netdissect_options *ndo, const uint8_t *ep,
672 		const unsigned int type, const unsigned int len)
673 {
674 	u_int i;
675 	char *cp;
676 	struct bsnamemem *tp;
677 
678 	if (len == 0)
679 		return ("<empty>");
680 
681 	if (type == LINKADDR_ETHER && len == MAC_ADDR_LEN)
682 		return (etheraddr_string(ndo, ep));
683 
684 	if (type == LINKADDR_FRELAY)
685 		return (q922_string(ndo, ep, len));
686 
687 	tp = lookup_bytestring(ndo, ep, len);
688 	if (tp->bs_name)
689 		return (tp->bs_name);
690 
691 	tp->bs_name = cp = (char *)malloc(len*3);
692 	if (tp->bs_name == NULL)
693 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
694 				  "%s: malloc", __func__);
695 	cp = octet_to_hex(cp, *ep++);
696 	for (i = len-1; i > 0 ; --i) {
697 		*cp++ = ':';
698 		cp = octet_to_hex(cp, *ep++);
699 	}
700 	*cp = '\0';
701 	return (tp->bs_name);
702 }
703 
704 #define ISONSAP_MAX_LENGTH 20
705 const char *
706 isonsap_string(netdissect_options *ndo, const uint8_t *nsap,
707 	       u_int nsap_length)
708 {
709 	u_int nsap_idx;
710 	char *cp;
711 	struct enamemem *tp;
712 
713 	if (nsap_length < 1 || nsap_length > ISONSAP_MAX_LENGTH)
714 		return ("isonsap_string: illegal length");
715 
716 	tp = lookup_nsap(ndo, nsap, nsap_length);
717 	if (tp->e_name)
718 		return tp->e_name;
719 
720 	tp->e_name = cp = (char *)malloc(sizeof("xx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xx"));
721 	if (cp == NULL)
722 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
723 				  "%s: malloc", __func__);
724 
725 	for (nsap_idx = 0; nsap_idx < nsap_length; nsap_idx++) {
726 		cp = octet_to_hex(cp, *nsap++);
727 		if (((nsap_idx & 1) == 0) &&
728 		     (nsap_idx + 1 < nsap_length)) {
729 			*cp++ = '.';
730 		}
731 	}
732 	*cp = '\0';
733 	return (tp->e_name);
734 }
735 
736 const char *
737 tcpport_string(netdissect_options *ndo, u_short port)
738 {
739 	struct hnamemem *tp;
740 	uint32_t i = port;
741 	char buf[sizeof("00000")];
742 
743 	for (tp = &tporttable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
744 		if (tp->addr == i)
745 			return (tp->name);
746 
747 	tp->addr = i;
748 	tp->nxt = newhnamemem(ndo);
749 
750 	(void)snprintf(buf, sizeof(buf), "%u", i);
751 	tp->name = strdup(buf);
752 	if (tp->name == NULL)
753 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
754 				  "%s: strdup(buf)", __func__);
755 	return (tp->name);
756 }
757 
758 const char *
759 udpport_string(netdissect_options *ndo, u_short port)
760 {
761 	struct hnamemem *tp;
762 	uint32_t i = port;
763 	char buf[sizeof("00000")];
764 
765 	for (tp = &uporttable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
766 		if (tp->addr == i)
767 			return (tp->name);
768 
769 	tp->addr = i;
770 	tp->nxt = newhnamemem(ndo);
771 
772 	(void)snprintf(buf, sizeof(buf), "%u", i);
773 	tp->name = strdup(buf);
774 	if (tp->name == NULL)
775 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
776 				  "%s: strdup(buf)", __func__);
777 	return (tp->name);
778 }
779 
780 const char *
781 ipxsap_string(netdissect_options *ndo, u_short port)
782 {
783 	char *cp;
784 	struct hnamemem *tp;
785 	uint32_t i = port;
786 	char buf[sizeof("0000")];
787 
788 	for (tp = &ipxsaptable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
789 		if (tp->addr == i)
790 			return (tp->name);
791 
792 	tp->addr = i;
793 	tp->nxt = newhnamemem(ndo);
794 
795 	cp = buf;
796 	port = ntohs(port);
797 	*cp++ = hex[port >> 12 & 0xf];
798 	*cp++ = hex[port >> 8 & 0xf];
799 	*cp++ = hex[port >> 4 & 0xf];
800 	*cp++ = hex[port & 0xf];
801 	*cp++ = '\0';
802 	tp->name = strdup(buf);
803 	if (tp->name == NULL)
804 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
805 				  "%s: strdup(buf)", __func__);
806 	return (tp->name);
807 }
808 
809 static void
810 init_servarray(netdissect_options *ndo)
811 {
812 	struct servent *sv;
813 	struct hnamemem *table;
814 	int i;
815 	char buf[sizeof("0000000000")];
816 
817 	while ((sv = getservent()) != NULL) {
818 		int port = ntohs(sv->s_port);
819 		i = port & (HASHNAMESIZE-1);
820 		if (strcmp(sv->s_proto, "tcp") == 0)
821 			table = &tporttable[i];
822 		else if (strcmp(sv->s_proto, "udp") == 0)
823 			table = &uporttable[i];
824 		else
825 			continue;
826 
827 		while (table->name)
828 			table = table->nxt;
829 		if (ndo->ndo_nflag) {
830 			(void)snprintf(buf, sizeof(buf), "%d", port);
831 			table->name = strdup(buf);
832 		} else
833 			table->name = strdup(sv->s_name);
834 		if (table->name == NULL)
835 			(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
836 					  "%s: strdup", __func__);
837 
838 		table->addr = port;
839 		table->nxt = newhnamemem(ndo);
840 	}
841 	endservent();
842 }
843 
844 static const struct eproto {
845 	const char *s;
846 	u_short p;
847 } eproto_db[] = {
848 	{ "aarp", ETHERTYPE_AARP },
849 	{ "arp", ETHERTYPE_ARP },
850 	{ "atalk", ETHERTYPE_ATALK },
851 	{ "decnet", ETHERTYPE_DN },
852 	{ "ip", ETHERTYPE_IP },
853 	{ "ip6", ETHERTYPE_IPV6 },
854 	{ "lat", ETHERTYPE_LAT },
855 	{ "loopback", ETHERTYPE_LOOPBACK },
856 	{ "mopdl", ETHERTYPE_MOPDL },
857 	{ "moprc", ETHERTYPE_MOPRC },
858 	{ "rarp", ETHERTYPE_REVARP },
859 	{ "sca", ETHERTYPE_SCA },
860 	{ (char *)0, 0 }
861 };
862 
863 static void
864 init_eprotoarray(netdissect_options *ndo)
865 {
866 	int i;
867 	struct hnamemem *table;
868 
869 	for (i = 0; eproto_db[i].s; i++) {
870 		int j = htons(eproto_db[i].p) & (HASHNAMESIZE-1);
871 		table = &eprototable[j];
872 		while (table->name)
873 			table = table->nxt;
874 		table->name = eproto_db[i].s;
875 		table->addr = htons(eproto_db[i].p);
876 		table->nxt = newhnamemem(ndo);
877 	}
878 }
879 
880 static const struct protoidlist {
881 	const u_char protoid[5];
882 	const char *name;
883 } protoidlist[] = {
884 	{{ 0x00, 0x00, 0x0c, 0x01, 0x07 }, "CiscoMLS" },
885 	{{ 0x00, 0x00, 0x0c, 0x20, 0x00 }, "CiscoCDP" },
886 	{{ 0x00, 0x00, 0x0c, 0x20, 0x01 }, "CiscoCGMP" },
887 	{{ 0x00, 0x00, 0x0c, 0x20, 0x03 }, "CiscoVTP" },
888 	{{ 0x00, 0xe0, 0x2b, 0x00, 0xbb }, "ExtremeEDP" },
889 	{{ 0x00, 0x00, 0x00, 0x00, 0x00 }, NULL }
890 };
891 
892 /*
893  * SNAP proto IDs with org code 0:0:0 are actually encapsulated Ethernet
894  * types.
895  */
896 static void
897 init_protoidarray(netdissect_options *ndo)
898 {
899 	int i;
900 	struct protoidmem *tp;
901 	const struct protoidlist *pl;
902 	u_char protoid[5];
903 
904 	protoid[0] = 0;
905 	protoid[1] = 0;
906 	protoid[2] = 0;
907 	for (i = 0; eproto_db[i].s; i++) {
908 		u_short etype = htons(eproto_db[i].p);
909 
910 		memcpy((char *)&protoid[3], (char *)&etype, 2);
911 		tp = lookup_protoid(ndo, protoid);
912 		tp->p_name = strdup(eproto_db[i].s);
913 		if (tp->p_name == NULL)
914 			(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
915 				"%s: strdup(eproto_db[i].s)", __func__);
916 	}
917 	/* Hardwire some SNAP proto ID names */
918 	for (pl = protoidlist; pl->name != NULL; ++pl) {
919 		tp = lookup_protoid(ndo, pl->protoid);
920 		/* Don't override existing name */
921 		if (tp->p_name != NULL)
922 			continue;
923 
924 		tp->p_name = pl->name;
925 	}
926 }
927 
928 static const struct etherlist {
929 	const nd_mac_addr addr;
930 	const char *name;
931 } etherlist[] = {
932 	{{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, "Broadcast" },
933 	{{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, NULL }
934 };
935 
936 /*
937  * Initialize the ethers hash table.  We take two different approaches
938  * depending on whether or not the system provides the ethers name
939  * service.  If it does, we just wire in a few names at startup,
940  * and etheraddr_string() fills in the table on demand.  If it doesn't,
941  * then we suck in the entire /etc/ethers file at startup.  The idea
942  * is that parsing the local file will be fast, but spinning through
943  * all the ethers entries via NIS & next_etherent might be very slow.
944  *
945  * XXX pcap_next_etherent doesn't belong in the pcap interface, but
946  * since the pcap module already does name-to-address translation,
947  * it's already does most of the work for the ethernet address-to-name
948  * translation, so we just pcap_next_etherent as a convenience.
949  */
950 static void
951 init_etherarray(netdissect_options *ndo)
952 {
953 	const struct etherlist *el;
954 	struct enamemem *tp;
955 #ifdef USE_ETHER_NTOHOST
956 	char name[256];
957 #else
958 	struct pcap_etherent *ep;
959 	FILE *fp;
960 
961 	/* Suck in entire ethers file */
962 	fp = fopen(PCAP_ETHERS_FILE, "r");
963 	if (fp != NULL) {
964 		while ((ep = pcap_next_etherent(fp)) != NULL) {
965 			tp = lookup_emem(ndo, ep->addr);
966 			tp->e_name = strdup(ep->name);
967 			if (tp->e_name == NULL)
968 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
969 					"%s: strdup(ep->addr)", __func__);
970 		}
971 		(void)fclose(fp);
972 	}
973 #endif
974 
975 	/* Hardwire some ethernet names */
976 	for (el = etherlist; el->name != NULL; ++el) {
977 		tp = lookup_emem(ndo, el->addr);
978 		/* Don't override existing name */
979 		if (tp->e_name != NULL)
980 			continue;
981 
982 #ifdef USE_ETHER_NTOHOST
983 		/*
984 		 * Use YP/NIS version of name if available.
985 		 */
986 		/* Same workaround as in etheraddr_string(). */
987 		struct ether_addr ea;
988 		memcpy (&ea, el->addr, MAC_ADDR_LEN);
989 		if (ether_ntohost(name, &ea) == 0) {
990 			tp->e_name = strdup(name);
991 			if (tp->e_name == NULL)
992 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
993 					"%s: strdup(name)", __func__);
994 			continue;
995 		}
996 #endif
997 		tp->e_name = el->name;
998 	}
999 }
1000 
1001 static const struct ipxsap_ent {
1002 	uint16_t	v;
1003 	const char	*s;
1004 } ipxsap_db[] = {
1005 	{ 0x0000, "Unknown" },
1006 	{ 0x0001, "User" },
1007 	{ 0x0002, "User Group" },
1008 	{ 0x0003, "PrintQueue" },
1009 	{ 0x0004, "FileServer" },
1010 	{ 0x0005, "JobServer" },
1011 	{ 0x0006, "Gateway" },
1012 	{ 0x0007, "PrintServer" },
1013 	{ 0x0008, "ArchiveQueue" },
1014 	{ 0x0009, "ArchiveServer" },
1015 	{ 0x000a, "JobQueue" },
1016 	{ 0x000b, "Administration" },
1017 	{ 0x000F, "Novell TI-RPC" },
1018 	{ 0x0017, "Diagnostics" },
1019 	{ 0x0020, "NetBIOS" },
1020 	{ 0x0021, "NAS SNA Gateway" },
1021 	{ 0x0023, "NACS AsyncGateway" },
1022 	{ 0x0024, "RemoteBridge/RoutingService" },
1023 	{ 0x0026, "BridgeServer" },
1024 	{ 0x0027, "TCP/IP Gateway" },
1025 	{ 0x0028, "Point-to-point X.25 BridgeServer" },
1026 	{ 0x0029, "3270 Gateway" },
1027 	{ 0x002a, "CHI Corp" },
1028 	{ 0x002c, "PC Chalkboard" },
1029 	{ 0x002d, "TimeSynchServer" },
1030 	{ 0x002e, "ARCserve5.0/PalindromeBackup" },
1031 	{ 0x0045, "DI3270 Gateway" },
1032 	{ 0x0047, "AdvertisingPrintServer" },
1033 	{ 0x004a, "NetBlazerModems" },
1034 	{ 0x004b, "BtrieveVAP" },
1035 	{ 0x004c, "NetwareSQL" },
1036 	{ 0x004d, "XtreeNetwork" },
1037 	{ 0x0050, "BtrieveVAP4.11" },
1038 	{ 0x0052, "QuickLink" },
1039 	{ 0x0053, "PrintQueueUser" },
1040 	{ 0x0058, "Multipoint X.25 Router" },
1041 	{ 0x0060, "STLB/NLM" },
1042 	{ 0x0064, "ARCserve" },
1043 	{ 0x0066, "ARCserve3.0" },
1044 	{ 0x0072, "WAN CopyUtility" },
1045 	{ 0x007a, "TES-NetwareVMS" },
1046 	{ 0x0092, "WATCOM Debugger/EmeraldTapeBackupServer" },
1047 	{ 0x0095, "DDA OBGYN" },
1048 	{ 0x0098, "NetwareAccessServer" },
1049 	{ 0x009a, "Netware for VMS II/NamedPipeServer" },
1050 	{ 0x009b, "NetwareAccessServer" },
1051 	{ 0x009e, "PortableNetwareServer/SunLinkNVT" },
1052 	{ 0x00a1, "PowerchuteAPC UPS" },
1053 	{ 0x00aa, "LAWserve" },
1054 	{ 0x00ac, "CompaqIDA StatusMonitor" },
1055 	{ 0x0100, "PIPE STAIL" },
1056 	{ 0x0102, "LAN ProtectBindery" },
1057 	{ 0x0103, "OracleDataBaseServer" },
1058 	{ 0x0107, "Netware386/RSPX RemoteConsole" },
1059 	{ 0x010f, "NovellSNA Gateway" },
1060 	{ 0x0111, "TestServer" },
1061 	{ 0x0112, "HP PrintServer" },
1062 	{ 0x0114, "CSA MUX" },
1063 	{ 0x0115, "CSA LCA" },
1064 	{ 0x0116, "CSA CM" },
1065 	{ 0x0117, "CSA SMA" },
1066 	{ 0x0118, "CSA DBA" },
1067 	{ 0x0119, "CSA NMA" },
1068 	{ 0x011a, "CSA SSA" },
1069 	{ 0x011b, "CSA STATUS" },
1070 	{ 0x011e, "CSA APPC" },
1071 	{ 0x0126, "SNA TEST SSA Profile" },
1072 	{ 0x012a, "CSA TRACE" },
1073 	{ 0x012b, "NetwareSAA" },
1074 	{ 0x012e, "IKARUS VirusScan" },
1075 	{ 0x0130, "CommunicationsExecutive" },
1076 	{ 0x0133, "NNS DomainServer/NetwareNamingServicesDomain" },
1077 	{ 0x0135, "NetwareNamingServicesProfile" },
1078 	{ 0x0137, "Netware386 PrintQueue/NNS PrintQueue" },
1079 	{ 0x0141, "LAN SpoolServer" },
1080 	{ 0x0152, "IRMALAN Gateway" },
1081 	{ 0x0154, "NamedPipeServer" },
1082 	{ 0x0166, "NetWareManagement" },
1083 	{ 0x0168, "Intel PICKIT CommServer/Intel CAS TalkServer" },
1084 	{ 0x0173, "Compaq" },
1085 	{ 0x0174, "Compaq SNMP Agent" },
1086 	{ 0x0175, "Compaq" },
1087 	{ 0x0180, "XTreeServer/XTreeTools" },
1088 	{ 0x018A, "NASI ServicesBroadcastServer" },
1089 	{ 0x01b0, "GARP Gateway" },
1090 	{ 0x01b1, "Binfview" },
1091 	{ 0x01bf, "IntelLanDeskManager" },
1092 	{ 0x01ca, "AXTEC" },
1093 	{ 0x01cb, "ShivaNetModem/E" },
1094 	{ 0x01cc, "ShivaLanRover/E" },
1095 	{ 0x01cd, "ShivaLanRover/T" },
1096 	{ 0x01ce, "ShivaUniversal" },
1097 	{ 0x01d8, "CastelleFAXPressServer" },
1098 	{ 0x01da, "CastelleLANPressPrintServer" },
1099 	{ 0x01dc, "CastelleFAX/Xerox7033 FaxServer/ExcelLanFax" },
1100 	{ 0x01f0, "LEGATO" },
1101 	{ 0x01f5, "LEGATO" },
1102 	{ 0x0233, "NMS Agent/NetwareManagementAgent" },
1103 	{ 0x0237, "NMS IPX Discovery/LANternReadWriteChannel" },
1104 	{ 0x0238, "NMS IP Discovery/LANternTrapAlarmChannel" },
1105 	{ 0x023a, "LANtern" },
1106 	{ 0x023c, "MAVERICK" },
1107 	{ 0x023f, "NovellSMDR" },
1108 	{ 0x024e, "NetwareConnect" },
1109 	{ 0x024f, "NASI ServerBroadcast Cisco" },
1110 	{ 0x026a, "NMS ServiceConsole" },
1111 	{ 0x026b, "TimeSynchronizationServer Netware 4.x" },
1112 	{ 0x0278, "DirectoryServer Netware 4.x" },
1113 	{ 0x027b, "NetwareManagementAgent" },
1114 	{ 0x0280, "Novell File and Printer Sharing Service for PC" },
1115 	{ 0x0304, "NovellSAA Gateway" },
1116 	{ 0x0308, "COM/VERMED" },
1117 	{ 0x030a, "GalacticommWorldgroupServer" },
1118 	{ 0x030c, "IntelNetport2/HP JetDirect/HP Quicksilver" },
1119 	{ 0x0320, "AttachmateGateway" },
1120 	{ 0x0327, "MicrosoftDiagnostics" },
1121 	{ 0x0328, "WATCOM SQL Server" },
1122 	{ 0x0335, "MultiTechSystems MultisynchCommServer" },
1123 	{ 0x0343, "Xylogics RemoteAccessServer/LANModem" },
1124 	{ 0x0355, "ArcadaBackupExec" },
1125 	{ 0x0358, "MSLCD1" },
1126 	{ 0x0361, "NETINELO" },
1127 	{ 0x037e, "Powerchute UPS Monitoring" },
1128 	{ 0x037f, "ViruSafeNotify" },
1129 	{ 0x0386, "HP Bridge" },
1130 	{ 0x0387, "HP Hub" },
1131 	{ 0x0394, "NetWare SAA Gateway" },
1132 	{ 0x039b, "LotusNotes" },
1133 	{ 0x03b7, "CertusAntiVirus" },
1134 	{ 0x03c4, "ARCserve4.0" },
1135 	{ 0x03c7, "LANspool3.5" },
1136 	{ 0x03d7, "LexmarkPrinterServer" },
1137 	{ 0x03d8, "LexmarkXLE PrinterServer" },
1138 	{ 0x03dd, "BanyanENS NetwareClient" },
1139 	{ 0x03de, "GuptaSequelBaseServer/NetWareSQL" },
1140 	{ 0x03e1, "UnivelUnixware" },
1141 	{ 0x03e4, "UnivelUnixware" },
1142 	{ 0x03fc, "IntelNetport" },
1143 	{ 0x03fd, "PrintServerQueue" },
1144 	{ 0x040A, "ipnServer" },
1145 	{ 0x040D, "LVERRMAN" },
1146 	{ 0x040E, "LVLIC" },
1147 	{ 0x0414, "NET Silicon (DPI)/Kyocera" },
1148 	{ 0x0429, "SiteLockVirus" },
1149 	{ 0x0432, "UFHELPR???" },
1150 	{ 0x0433, "Synoptics281xAdvancedSNMPAgent" },
1151 	{ 0x0444, "MicrosoftNT SNA Server" },
1152 	{ 0x0448, "Oracle" },
1153 	{ 0x044c, "ARCserve5.01" },
1154 	{ 0x0457, "CanonGP55" },
1155 	{ 0x045a, "QMS Printers" },
1156 	{ 0x045b, "DellSCSI Array" },
1157 	{ 0x0491, "NetBlazerModems" },
1158 	{ 0x04ac, "OnTimeScheduler" },
1159 	{ 0x04b0, "CD-Net" },
1160 	{ 0x0513, "EmulexNQA" },
1161 	{ 0x0520, "SiteLockChecks" },
1162 	{ 0x0529, "SiteLockChecks" },
1163 	{ 0x052d, "CitrixOS2 AppServer" },
1164 	{ 0x0535, "Tektronix" },
1165 	{ 0x0536, "Milan" },
1166 	{ 0x055d, "Attachmate SNA gateway" },
1167 	{ 0x056b, "IBM8235 ModemServer" },
1168 	{ 0x056c, "ShivaLanRover/E PLUS" },
1169 	{ 0x056d, "ShivaLanRover/T PLUS" },
1170 	{ 0x0580, "McAfeeNetShield" },
1171 	{ 0x05B8, "NLM to workstation communication (Revelation Software)" },
1172 	{ 0x05BA, "CompatibleSystemsRouters" },
1173 	{ 0x05BE, "CheyenneHierarchicalStorageManager" },
1174 	{ 0x0606, "JCWatermarkImaging" },
1175 	{ 0x060c, "AXISNetworkPrinter" },
1176 	{ 0x0610, "AdaptecSCSIManagement" },
1177 	{ 0x0621, "IBM AntiVirus" },
1178 	{ 0x0640, "Windows95 RemoteRegistryService" },
1179 	{ 0x064e, "MicrosoftIIS" },
1180 	{ 0x067b, "Microsoft Win95/98 File and Print Sharing for NetWare" },
1181 	{ 0x067c, "Microsoft Win95/98 File and Print Sharing for NetWare" },
1182 	{ 0x076C, "Xerox" },
1183 	{ 0x079b, "ShivaLanRover/E 115" },
1184 	{ 0x079c, "ShivaLanRover/T 115" },
1185 	{ 0x07B4, "CubixWorldDesk" },
1186 	{ 0x07c2, "Quarterdeck IWare Connect V2.x NLM" },
1187 	{ 0x07c1, "Quarterdeck IWare Connect V3.x NLM" },
1188 	{ 0x0810, "ELAN License Server Demo" },
1189 	{ 0x0824, "ShivaLanRoverAccessSwitch/E" },
1190 	{ 0x086a, "ISSC Collector" },
1191 	{ 0x087f, "ISSC DAS AgentAIX" },
1192 	{ 0x0880, "Intel Netport PRO" },
1193 	{ 0x0881, "Intel Netport PRO" },
1194 	{ 0x0b29, "SiteLock" },
1195 	{ 0x0c29, "SiteLockApplications" },
1196 	{ 0x0c2c, "LicensingServer" },
1197 	{ 0x2101, "PerformanceTechnologyInstantInternet" },
1198 	{ 0x2380, "LAI SiteLock" },
1199 	{ 0x238c, "MeetingMaker" },
1200 	{ 0x4808, "SiteLockServer/SiteLockMetering" },
1201 	{ 0x5555, "SiteLockUser" },
1202 	{ 0x6312, "Tapeware" },
1203 	{ 0x6f00, "RabbitGateway" },
1204 	{ 0x7703, "MODEM" },
1205 	{ 0x8002, "NetPortPrinters" },
1206 	{ 0x8008, "WordPerfectNetworkVersion" },
1207 	{ 0x85BE, "Cisco EIGRP" },
1208 	{ 0x8888, "WordPerfectNetworkVersion/QuickNetworkManagement" },
1209 	{ 0x9000, "McAfeeNetShield" },
1210 	{ 0x9604, "CSA-NT_MON" },
1211 	{ 0xb6a8, "OceanIsleReachoutRemoteControl" },
1212 	{ 0xf11f, "SiteLockMetering" },
1213 	{ 0xf1ff, "SiteLock" },
1214 	{ 0xf503, "Microsoft SQL Server" },
1215 	{ 0xF905, "IBM TimeAndPlace" },
1216 	{ 0xfbfb, "TopCallIII FaxServer" },
1217 	{ 0xffff, "AnyService/Wildcard" },
1218 	{ 0, (char *)0 }
1219 };
1220 
1221 static void
1222 init_ipxsaparray(netdissect_options *ndo)
1223 {
1224 	int i;
1225 	struct hnamemem *table;
1226 
1227 	for (i = 0; ipxsap_db[i].s != NULL; i++) {
1228 		u_int j = htons(ipxsap_db[i].v) & (HASHNAMESIZE-1);
1229 		table = &ipxsaptable[j];
1230 		while (table->name)
1231 			table = table->nxt;
1232 		table->name = ipxsap_db[i].s;
1233 		table->addr = htons(ipxsap_db[i].v);
1234 		table->nxt = newhnamemem(ndo);
1235 	}
1236 }
1237 
1238 /*
1239  * Initialize the address to name translation machinery.  We map all
1240  * non-local IP addresses to numeric addresses if ndo->ndo_fflag is true
1241  * (i.e., to prevent blocking on the nameserver).  localnet is the IP address
1242  * of the local network.  mask is its subnet mask.
1243  */
1244 void
1245 init_addrtoname(netdissect_options *ndo, uint32_t localnet, uint32_t mask)
1246 {
1247 	if (ndo->ndo_fflag) {
1248 		f_localnet = localnet;
1249 		f_netmask = mask;
1250 	}
1251 	if (ndo->ndo_nflag)
1252 		/*
1253 		 * Simplest way to suppress names.
1254 		 */
1255 		return;
1256 
1257 	init_etherarray(ndo);
1258 	init_servarray(ndo);
1259 	init_eprotoarray(ndo);
1260 	init_protoidarray(ndo);
1261 	init_ipxsaparray(ndo);
1262 }
1263 
1264 const char *
1265 dnaddr_string(netdissect_options *ndo, u_short dnaddr)
1266 {
1267 	struct hnamemem *tp;
1268 
1269 	for (tp = &dnaddrtable[dnaddr & (HASHNAMESIZE-1)]; tp->nxt != NULL;
1270 	     tp = tp->nxt)
1271 		if (tp->addr == dnaddr)
1272 			return (tp->name);
1273 
1274 	tp->addr = dnaddr;
1275 	tp->nxt = newhnamemem(ndo);
1276 	tp->name = dnnum_string(ndo, dnaddr);
1277 
1278 	return(tp->name);
1279 }
1280 
1281 /* Return a zero'ed hnamemem struct and cuts down on calloc() overhead */
1282 struct hnamemem *
1283 newhnamemem(netdissect_options *ndo)
1284 {
1285 	struct hnamemem *p;
1286 	static struct hnamemem *ptr = NULL;
1287 	static u_int num = 0;
1288 
1289 	if (num  == 0) {
1290 		num = 64;
1291 		ptr = (struct hnamemem *)calloc(num, sizeof (*ptr));
1292 		if (ptr == NULL)
1293 			(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
1294 					  "%s: calloc", __func__);
1295 	}
1296 	--num;
1297 	p = ptr++;
1298 	return (p);
1299 }
1300 
1301 /* Return a zero'ed h6namemem struct and cuts down on calloc() overhead */
1302 struct h6namemem *
1303 newh6namemem(netdissect_options *ndo)
1304 {
1305 	struct h6namemem *p;
1306 	static struct h6namemem *ptr = NULL;
1307 	static u_int num = 0;
1308 
1309 	if (num  == 0) {
1310 		num = 64;
1311 		ptr = (struct h6namemem *)calloc(num, sizeof (*ptr));
1312 		if (ptr == NULL)
1313 			(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
1314 					  "%s: calloc", __func__);
1315 	}
1316 	--num;
1317 	p = ptr++;
1318 	return (p);
1319 }
1320 
1321 /* Represent TCI part of the 802.1Q 4-octet tag as text. */
1322 const char *
1323 ieee8021q_tci_string(const uint16_t tci)
1324 {
1325 	static char buf[128];
1326 	snprintf(buf, sizeof(buf), "vlan %u, p %u%s",
1327 	         tci & 0xfff,
1328 	         tci >> 13,
1329 	         (tci & 0x1000) ? ", DEI" : "");
1330 	return buf;
1331 }
1332