xref: /netbsd-src/external/bsd/tcpdump/dist/addrtoname.c (revision ccd9df534e375a4366c5b55f23782053c7a98d82)
1 /*
2  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that: (1) source code distributions
7  * retain the above copyright notice and this paragraph in its entirety, (2)
8  * distributions including binary code include the above copyright notice and
9  * this paragraph in its entirety in the documentation or other materials
10  * provided with the distribution, and (3) all advertising materials mentioning
11  * features or use of this software display the following acknowledgement:
12  * ``This product includes software developed by the University of California,
13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14  * the University nor the names of its contributors may be used to endorse
15  * or promote products derived from this software without specific prior
16  * written permission.
17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20  *
21  *  Internet, ethernet, port, and protocol string to address
22  *  and address to string conversion routines
23  */
24 #include <sys/cdefs.h>
25 #ifndef lint
26 __RCSID("$NetBSD: addrtoname.c,v 1.12 2023/08/17 20:19:39 christos Exp $");
27 #endif
28 
29 #ifdef HAVE_CONFIG_H
30 #include <config.h>
31 #endif
32 
33 #ifdef HAVE_CASPER
34 #include <libcasper.h>
35 #include <casper/cap_dns.h>
36 #endif /* HAVE_CASPER */
37 
38 #include "netdissect-stdinc.h"
39 
40 #ifdef USE_ETHER_NTOHOST
41   #if defined(NET_ETHERNET_H_DECLARES_ETHER_NTOHOST)
42     /*
43      * OK, just include <net/ethernet.h>.
44      */
45     #include <net/ethernet.h>
46   #elif defined(NETINET_ETHER_H_DECLARES_ETHER_NTOHOST)
47     /*
48      * OK, just include <netinet/ether.h>
49      */
50     #include <netinet/ether.h>
51   #elif defined(SYS_ETHERNET_H_DECLARES_ETHER_NTOHOST)
52     /*
53      * OK, just include <sys/ethernet.h>
54      */
55     #include <sys/ethernet.h>
56   #elif defined(ARPA_INET_H_DECLARES_ETHER_NTOHOST)
57     /*
58      * OK, just include <arpa/inet.h>
59      */
60     #include <arpa/inet.h>
61   #elif defined(NETINET_IF_ETHER_H_DECLARES_ETHER_NTOHOST)
62     /*
63      * OK, include <netinet/if_ether.h>, after all the other stuff we
64      * need to include or define for its benefit.
65      */
66     #define NEED_NETINET_IF_ETHER_H
67   #else
68     /*
69      * We'll have to declare it ourselves.
70      * If <netinet/if_ether.h> defines struct ether_addr, include
71      * it.  Otherwise, define it ourselves.
72      */
73     #ifdef HAVE_STRUCT_ETHER_ADDR
74       #define NEED_NETINET_IF_ETHER_H
75     #else /* HAVE_STRUCT_ETHER_ADDR */
76 	struct ether_addr {
77 		/* Beware FreeBSD calls this "octet". */
78 		unsigned char ether_addr_octet[MAC_ADDR_LEN];
79 	};
80     #endif /* HAVE_STRUCT_ETHER_ADDR */
81   #endif /* what declares ether_ntohost() */
82 
83   #ifdef NEED_NETINET_IF_ETHER_H
84     /*
85      * Include diag-control.h before <net/if.h>, which too defines a macro
86      * named ND_UNREACHABLE.
87      */
88     #include "diag-control.h"
89     #include <net/if.h>		/* Needed on some platforms */
90     #include <netinet/in.h>	/* Needed on some platforms */
91     #include <netinet/if_ether.h>
92   #endif /* NEED_NETINET_IF_ETHER_H */
93 
94   #ifndef HAVE_DECL_ETHER_NTOHOST
95     /*
96      * No header declares it, so declare it ourselves.
97      */
98     extern int ether_ntohost(char *, const struct ether_addr *);
99   #endif /* !defined(HAVE_DECL_ETHER_NTOHOST) */
100 #endif /* USE_ETHER_NTOHOST */
101 
102 #include <pcap.h>
103 #include <pcap-namedb.h>
104 #ifndef HAVE_GETSERVENT
105 #include <getservent.h>
106 #endif
107 #include <signal.h>
108 #include <stdio.h>
109 #include <string.h>
110 #include <stdlib.h>
111 
112 #include "netdissect.h"
113 #include "addrtoname.h"
114 #include "addrtostr.h"
115 #include "ethertype.h"
116 #include "llc.h"
117 #include "extract.h"
118 #include "oui.h"
119 
120 /*
121  * hash tables for whatever-to-name translations
122  *
123  * ndo_error() called on strdup(3) failure with S_ERR_ND_MEM_ALLOC status
124  */
125 
126 #define HASHNAMESIZE 4096
127 
128 struct hnamemem {
129 	uint32_t addr;
130 	const char *name;
131 	struct hnamemem *nxt;
132 };
133 
134 static struct hnamemem hnametable[HASHNAMESIZE];
135 static struct hnamemem tporttable[HASHNAMESIZE];
136 static struct hnamemem uporttable[HASHNAMESIZE];
137 static struct hnamemem eprototable[HASHNAMESIZE];
138 static struct hnamemem dnaddrtable[HASHNAMESIZE];
139 static struct hnamemem ipxsaptable[HASHNAMESIZE];
140 
141 #ifdef _WIN32
142 /*
143  * fake gethostbyaddr for Win2k/XP
144  * gethostbyaddr() returns incorrect value when AF_INET6 is passed
145  * to 3rd argument.
146  *
147  * h_name in struct hostent is only valid.
148  */
149 static struct hostent *
150 win32_gethostbyaddr(const char *addr, int len, int type)
151 {
152 	static struct hostent host;
153 	static char hostbuf[NI_MAXHOST];
154 	char hname[NI_MAXHOST];
155 	struct sockaddr_in6 addr6;
156 
157 	host.h_name = hostbuf;
158 	switch (type) {
159 	case AF_INET:
160 		return gethostbyaddr(addr, len, type);
161 		break;
162 	case AF_INET6:
163 		memset(&addr6, 0, sizeof(addr6));
164 		addr6.sin6_family = AF_INET6;
165 		memcpy(&addr6.sin6_addr, addr, len);
166 		if (getnameinfo((struct sockaddr *)&addr6, sizeof(addr6),
167 		    hname, sizeof(hname), NULL, 0, 0)) {
168 			return NULL;
169 		} else {
170 			strlcpy(host.h_name, hname, NI_MAXHOST);
171 			return &host;
172 		}
173 		break;
174 	default:
175 		return NULL;
176 	}
177 }
178 #define gethostbyaddr win32_gethostbyaddr
179 #endif /* _WIN32 */
180 
181 struct h6namemem {
182 	nd_ipv6 addr;
183 	char *name;
184 	struct h6namemem *nxt;
185 };
186 
187 static struct h6namemem h6nametable[HASHNAMESIZE];
188 
189 struct enamemem {
190 	u_short e_addr0;
191 	u_short e_addr1;
192 	u_short e_addr2;
193 	const char *e_name;
194 	u_char *e_nsap;			/* used only for nsaptable[] */
195 	struct enamemem *e_nxt;
196 };
197 
198 static struct enamemem enametable[HASHNAMESIZE];
199 static struct enamemem nsaptable[HASHNAMESIZE];
200 
201 struct bsnamemem {
202 	u_short bs_addr0;
203 	u_short bs_addr1;
204 	u_short bs_addr2;
205 	const char *bs_name;
206 	u_char *bs_bytes;
207 	unsigned int bs_nbytes;
208 	struct bsnamemem *bs_nxt;
209 };
210 
211 static struct bsnamemem bytestringtable[HASHNAMESIZE];
212 
213 struct protoidmem {
214 	uint32_t p_oui;
215 	u_short p_proto;
216 	const char *p_name;
217 	struct protoidmem *p_nxt;
218 };
219 
220 static struct protoidmem protoidtable[HASHNAMESIZE];
221 
222 /*
223  * A faster replacement for inet_ntoa().
224  */
225 const char *
226 intoa(uint32_t addr)
227 {
228 	char *cp;
229 	u_int byte;
230 	int n;
231 	static char buf[sizeof(".xxx.xxx.xxx.xxx")];
232 
233 	addr = ntohl(addr);
234 	cp = buf + sizeof(buf);
235 	*--cp = '\0';
236 
237 	n = 4;
238 	do {
239 		byte = addr & 0xff;
240 		*--cp = (char)(byte % 10) + '0';
241 		byte /= 10;
242 		if (byte > 0) {
243 			*--cp = (char)(byte % 10) + '0';
244 			byte /= 10;
245 			if (byte > 0)
246 				*--cp = (char)byte + '0';
247 		}
248 		*--cp = '.';
249 		addr >>= 8;
250 	} while (--n > 0);
251 
252 	return cp + 1;
253 }
254 
255 static uint32_t f_netmask;
256 static uint32_t f_localnet;
257 #ifdef HAVE_CASPER
258 cap_channel_t *capdns;
259 #endif
260 
261 /*
262  * Return a name for the IP address pointed to by ap.  This address
263  * is assumed to be in network byte order.
264  *
265  * NOTE: ap is *NOT* necessarily part of the packet data, so you
266  * *CANNOT* use the ND_TCHECK_* or ND_TTEST_* macros on it.  Furthermore,
267  * even in cases where it *is* part of the packet data, the caller
268  * would still have to check for a null return value, even if it's
269  * just printing the return value with "%s" - not all versions of
270  * printf print "(null)" with "%s" and a null pointer, some of them
271  * don't check for a null pointer and crash in that case.
272  *
273  * The callers of this routine should, before handing this routine
274  * a pointer to packet data, be sure that the data is present in
275  * the packet buffer.  They should probably do those checks anyway,
276  * as other data at that layer might not be IP addresses, and it
277  * also needs to check whether they're present in the packet buffer.
278  */
279 const char *
280 ipaddr_string(netdissect_options *ndo, const u_char *ap)
281 {
282 	struct hostent *hp;
283 	uint32_t addr;
284 	struct hnamemem *p;
285 
286 	memcpy(&addr, ap, sizeof(addr));
287 	p = &hnametable[addr & (HASHNAMESIZE-1)];
288 	for (; p->nxt; p = p->nxt) {
289 		if (p->addr == addr)
290 			return (p->name);
291 	}
292 	p->addr = addr;
293 	p->nxt = newhnamemem(ndo);
294 
295 	/*
296 	 * Print names unless:
297 	 *	(1) -n was given.
298 	 *      (2) Address is foreign and -f was given. (If -f was not
299 	 *	    given, f_netmask and f_localnet are 0 and the test
300 	 *	    evaluates to true)
301 	 */
302 	if (!ndo->ndo_nflag &&
303 	    (addr & f_netmask) == f_localnet) {
304 #ifdef HAVE_CASPER
305 		if (capdns != NULL) {
306 			hp = cap_gethostbyaddr(capdns, (char *)&addr, 4,
307 			    AF_INET);
308 		} else
309 #endif
310 			hp = gethostbyaddr((char *)&addr, 4, AF_INET);
311 		if (hp) {
312 			char *dotp;
313 
314 			p->name = strdup(hp->h_name);
315 			if (p->name == NULL)
316 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
317 					"%s: strdup(hp->h_name)", __func__);
318 			if (ndo->ndo_Nflag) {
319 				/* Remove domain qualifications */
320 				dotp = strchr(p->name, '.');
321 				if (dotp)
322 					*dotp = '\0';
323 			}
324 			return (p->name);
325 		}
326 	}
327 	p->name = strdup(intoa(addr));
328 	if (p->name == NULL)
329 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
330 				  "%s: strdup(intoa(addr))", __func__);
331 	return (p->name);
332 }
333 
334 /*
335  * Return a name for the IP6 address pointed to by ap.  This address
336  * is assumed to be in network byte order.
337  */
338 const char *
339 ip6addr_string(netdissect_options *ndo, const u_char *ap)
340 {
341 	struct hostent *hp;
342 	union {
343 		nd_ipv6 addr;
344 		struct for_hash_addr {
345 			char fill[14];
346 			uint16_t d;
347 		} addra;
348 	} addr;
349 	struct h6namemem *p;
350 	const char *cp;
351 	char ntop_buf[INET6_ADDRSTRLEN];
352 
353 	memcpy(&addr, ap, sizeof(addr));
354 	p = &h6nametable[addr.addra.d & (HASHNAMESIZE-1)];
355 	for (; p->nxt; p = p->nxt) {
356 		if (memcmp(&p->addr, &addr, sizeof(addr)) == 0)
357 			return (p->name);
358 	}
359 	memcpy(p->addr, addr.addr, sizeof(nd_ipv6));
360 	p->nxt = newh6namemem(ndo);
361 
362 	/*
363 	 * Do not print names if -n was given.
364 	 */
365 	if (!ndo->ndo_nflag) {
366 #ifdef HAVE_CASPER
367 		if (capdns != NULL) {
368 			hp = cap_gethostbyaddr(capdns, (char *)&addr,
369 			    sizeof(addr), AF_INET6);
370 		} else
371 #endif
372 			hp = gethostbyaddr((char *)&addr, sizeof(addr),
373 			    AF_INET6);
374 		if (hp) {
375 			char *dotp;
376 
377 			p->name = strdup(hp->h_name);
378 			if (p->name == NULL)
379 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
380 					"%s: strdup(hp->h_name)", __func__);
381 			if (ndo->ndo_Nflag) {
382 				/* Remove domain qualifications */
383 				dotp = strchr(p->name, '.');
384 				if (dotp)
385 					*dotp = '\0';
386 			}
387 			return (p->name);
388 		}
389 	}
390 	cp = addrtostr6(ap, ntop_buf, sizeof(ntop_buf));
391 	p->name = strdup(cp);
392 	if (p->name == NULL)
393 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
394 				  "%s: strdup(cp)", __func__);
395 	return (p->name);
396 }
397 
398 static const char hex[16] = {
399 	'0', '1', '2', '3', '4', '5', '6', '7',
400 	'8', '9', 'a', 'b', 'c', 'd', 'e', 'f'
401 };
402 
403 /*
404  * Convert an octet to two hex digits.
405  *
406  * Coverity appears either:
407  *
408  *    not to believe the C standard when it asserts that a uint8_t is
409  *    exactly 8 bits in size;
410  *
411  *    not to believe that an unsigned type of exactly 8 bits has a value
412  *    in the range of 0 to 255;
413  *
414  *    not to believe that, for a range of unsigned values, if you shift
415  *    one of those values right by 4 bits, the maximum result value is
416  *    the maximum value shifted right by 4 bits, with no stray 1's shifted
417  *    in;
418  *
419  *    not to believe that 255 >> 4 is 15;
420  *
421  * so it gets upset that we're taking a "tainted" unsigned value, shifting
422  * it right 4 bits, and using it as an index into a 16-element array.
423  *
424  * So we do a stupid pointless masking of the result of the shift with
425  * 0xf, to hammer the point home to Coverity.
426  */
427 static inline char *
428 octet_to_hex(char *cp, uint8_t octet)
429 {
430 	*cp++ = hex[(octet >> 4) & 0xf];
431 	*cp++ = hex[(octet >> 0) & 0xf];
432 	return (cp);
433 }
434 
435 /* Find the hash node that corresponds the ether address 'ep' */
436 
437 static struct enamemem *
438 lookup_emem(netdissect_options *ndo, const u_char *ep)
439 {
440 	u_int i, j, k;
441 	struct enamemem *tp;
442 
443 	k = (ep[0] << 8) | ep[1];
444 	j = (ep[2] << 8) | ep[3];
445 	i = (ep[4] << 8) | ep[5];
446 
447 	tp = &enametable[(i ^ j) & (HASHNAMESIZE-1)];
448 	while (tp->e_nxt)
449 		if (tp->e_addr0 == i &&
450 		    tp->e_addr1 == j &&
451 		    tp->e_addr2 == k)
452 			return tp;
453 		else
454 			tp = tp->e_nxt;
455 	tp->e_addr0 = (u_short)i;
456 	tp->e_addr1 = (u_short)j;
457 	tp->e_addr2 = (u_short)k;
458 	tp->e_nxt = (struct enamemem *)calloc(1, sizeof(*tp));
459 	if (tp->e_nxt == NULL)
460 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "%s: calloc", __func__);
461 
462 	return tp;
463 }
464 
465 /*
466  * Find the hash node that corresponds to the bytestring 'bs'
467  * with length 'nlen'
468  */
469 
470 static struct bsnamemem *
471 lookup_bytestring(netdissect_options *ndo, const u_char *bs,
472 		  const unsigned int nlen)
473 {
474 	struct bsnamemem *tp;
475 	u_int i, j, k;
476 
477 	if (nlen >= 6) {
478 		k = (bs[0] << 8) | bs[1];
479 		j = (bs[2] << 8) | bs[3];
480 		i = (bs[4] << 8) | bs[5];
481 	} else if (nlen >= 4) {
482 		k = (bs[0] << 8) | bs[1];
483 		j = (bs[2] << 8) | bs[3];
484 		i = 0;
485 	} else
486 		i = j = k = 0;
487 
488 	tp = &bytestringtable[(i ^ j) & (HASHNAMESIZE-1)];
489 	while (tp->bs_nxt)
490 		if (nlen == tp->bs_nbytes &&
491 		    tp->bs_addr0 == i &&
492 		    tp->bs_addr1 == j &&
493 		    tp->bs_addr2 == k &&
494 		    memcmp((const char *)bs, (const char *)(tp->bs_bytes), nlen) == 0)
495 			return tp;
496 		else
497 			tp = tp->bs_nxt;
498 
499 	tp->bs_addr0 = (u_short)i;
500 	tp->bs_addr1 = (u_short)j;
501 	tp->bs_addr2 = (u_short)k;
502 
503 	tp->bs_bytes = (u_char *) calloc(1, nlen);
504 	if (tp->bs_bytes == NULL)
505 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
506 				  "%s: calloc", __func__);
507 
508 	memcpy(tp->bs_bytes, bs, nlen);
509 	tp->bs_nbytes = nlen;
510 	tp->bs_nxt = (struct bsnamemem *)calloc(1, sizeof(*tp));
511 	if (tp->bs_nxt == NULL)
512 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
513 				  "%s: calloc", __func__);
514 
515 	return tp;
516 }
517 
518 /* Find the hash node that corresponds the NSAP 'nsap' */
519 
520 static struct enamemem *
521 lookup_nsap(netdissect_options *ndo, const u_char *nsap,
522 	    u_int nsap_length)
523 {
524 	u_int i, j, k;
525 	struct enamemem *tp;
526 	const u_char *ensap;
527 
528 	if (nsap_length > 6) {
529 		ensap = nsap + nsap_length - 6;
530 		k = (ensap[0] << 8) | ensap[1];
531 		j = (ensap[2] << 8) | ensap[3];
532 		i = (ensap[4] << 8) | ensap[5];
533 	}
534 	else
535 		i = j = k = 0;
536 
537 	tp = &nsaptable[(i ^ j) & (HASHNAMESIZE-1)];
538 	while (tp->e_nxt)
539 		if (nsap_length == tp->e_nsap[0] &&
540 		    tp->e_addr0 == i &&
541 		    tp->e_addr1 == j &&
542 		    tp->e_addr2 == k &&
543 		    memcmp((const char *)nsap,
544 			(char *)&(tp->e_nsap[1]), nsap_length) == 0)
545 			return tp;
546 		else
547 			tp = tp->e_nxt;
548 	tp->e_addr0 = (u_short)i;
549 	tp->e_addr1 = (u_short)j;
550 	tp->e_addr2 = (u_short)k;
551 	tp->e_nsap = (u_char *)malloc(nsap_length + 1);
552 	if (tp->e_nsap == NULL)
553 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "%s: malloc", __func__);
554 	tp->e_nsap[0] = (u_char)nsap_length;	/* guaranteed < ISONSAP_MAX_LENGTH */
555 	memcpy((char *)&tp->e_nsap[1], (const char *)nsap, nsap_length);
556 	tp->e_nxt = (struct enamemem *)calloc(1, sizeof(*tp));
557 	if (tp->e_nxt == NULL)
558 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "%s: calloc", __func__);
559 
560 	return tp;
561 }
562 
563 /* Find the hash node that corresponds the protoid 'pi'. */
564 
565 static struct protoidmem *
566 lookup_protoid(netdissect_options *ndo, const u_char *pi)
567 {
568 	u_int i, j;
569 	struct protoidmem *tp;
570 
571 	/* 5 octets won't be aligned */
572 	i = (((pi[0] << 8) + pi[1]) << 8) + pi[2];
573 	j =   (pi[3] << 8) + pi[4];
574 	/* XXX should be endian-insensitive, but do big-endian testing  XXX */
575 
576 	tp = &protoidtable[(i ^ j) & (HASHNAMESIZE-1)];
577 	while (tp->p_nxt)
578 		if (tp->p_oui == i && tp->p_proto == j)
579 			return tp;
580 		else
581 			tp = tp->p_nxt;
582 	tp->p_oui = i;
583 	tp->p_proto = (u_short)j;
584 	tp->p_nxt = (struct protoidmem *)calloc(1, sizeof(*tp));
585 	if (tp->p_nxt == NULL)
586 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "%s: calloc", __func__);
587 
588 	return tp;
589 }
590 
591 const char *
592 etheraddr_string(netdissect_options *ndo, const uint8_t *ep)
593 {
594 	int i;
595 	char *cp;
596 	struct enamemem *tp;
597 	int oui;
598 	char buf[BUFSIZE];
599 
600 	tp = lookup_emem(ndo, ep);
601 	if (tp->e_name)
602 		return (tp->e_name);
603 #ifdef USE_ETHER_NTOHOST
604 	if (!ndo->ndo_nflag) {
605 		char buf2[BUFSIZE];
606 		/*
607 		 * This is a non-const copy of ep for ether_ntohost(), which
608 		 * has its second argument non-const in OpenBSD. Also saves a
609 		 * type cast.
610 		 */
611 		struct ether_addr ea;
612 
613 		memcpy (&ea, ep, MAC_ADDR_LEN);
614 		if (ether_ntohost(buf2, &ea) == 0) {
615 			tp->e_name = strdup(buf2);
616 			if (tp->e_name == NULL)
617 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
618 					"%s: strdup(buf2)", __func__);
619 			return (tp->e_name);
620 		}
621 	}
622 #endif
623 	cp = buf;
624 	oui = EXTRACT_BE_U_3(ep);
625 	cp = octet_to_hex(cp, *ep++);
626 	for (i = 5; --i >= 0;) {
627 		*cp++ = ':';
628 		cp = octet_to_hex(cp, *ep++);
629 	}
630 
631 	if (!ndo->ndo_nflag) {
632 		snprintf(cp, BUFSIZE - (2 + 5*3), " (oui %s)",
633 		    tok2str(oui_values, "Unknown", oui));
634 	} else
635 		*cp = '\0';
636 	tp->e_name = strdup(buf);
637 	if (tp->e_name == NULL)
638 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
639 				  "%s: strdup(buf)", __func__);
640 	return (tp->e_name);
641 }
642 
643 const char *
644 le64addr_string(netdissect_options *ndo, const uint8_t *ep)
645 {
646 	const unsigned int len = 8;
647 	u_int i;
648 	char *cp;
649 	struct bsnamemem *tp;
650 	char buf[BUFSIZE];
651 
652 	tp = lookup_bytestring(ndo, ep, len);
653 	if (tp->bs_name)
654 		return (tp->bs_name);
655 
656 	cp = buf;
657 	for (i = len; i > 0 ; --i) {
658 		cp = octet_to_hex(cp, *(ep + i - 1));
659 		*cp++ = ':';
660 	}
661 	cp --;
662 
663 	*cp = '\0';
664 
665 	tp->bs_name = strdup(buf);
666 	if (tp->bs_name == NULL)
667 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
668 				  "%s: strdup(buf)", __func__);
669 
670 	return (tp->bs_name);
671 }
672 
673 const char *
674 linkaddr_string(netdissect_options *ndo, const uint8_t *ep,
675 		const unsigned int type, const unsigned int len)
676 {
677 	u_int i;
678 	char *cp;
679 	struct bsnamemem *tp;
680 
681 	if (len == 0)
682 		return ("<empty>");
683 
684 	if (type == LINKADDR_ETHER && len == MAC_ADDR_LEN)
685 		return (etheraddr_string(ndo, ep));
686 
687 	if (type == LINKADDR_FRELAY)
688 		return (q922_string(ndo, ep, len));
689 
690 	tp = lookup_bytestring(ndo, ep, len);
691 	if (tp->bs_name)
692 		return (tp->bs_name);
693 
694 	tp->bs_name = cp = (char *)malloc(len*3);
695 	if (tp->bs_name == NULL)
696 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
697 				  "%s: malloc", __func__);
698 	cp = octet_to_hex(cp, *ep++);
699 	for (i = len-1; i > 0 ; --i) {
700 		*cp++ = ':';
701 		cp = octet_to_hex(cp, *ep++);
702 	}
703 	*cp = '\0';
704 	return (tp->bs_name);
705 }
706 
707 #define ISONSAP_MAX_LENGTH 20
708 const char *
709 isonsap_string(netdissect_options *ndo, const uint8_t *nsap,
710 	       u_int nsap_length)
711 {
712 	u_int nsap_idx;
713 	char *cp;
714 	struct enamemem *tp;
715 
716 	if (nsap_length < 1 || nsap_length > ISONSAP_MAX_LENGTH)
717 		return ("isonsap_string: illegal length");
718 
719 	tp = lookup_nsap(ndo, nsap, nsap_length);
720 	if (tp->e_name)
721 		return tp->e_name;
722 
723 	tp->e_name = cp = (char *)malloc(sizeof("xx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xx"));
724 	if (cp == NULL)
725 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
726 				  "%s: malloc", __func__);
727 
728 	for (nsap_idx = 0; nsap_idx < nsap_length; nsap_idx++) {
729 		cp = octet_to_hex(cp, *nsap++);
730 		if (((nsap_idx & 1) == 0) &&
731 		     (nsap_idx + 1 < nsap_length)) {
732 			*cp++ = '.';
733 		}
734 	}
735 	*cp = '\0';
736 	return (tp->e_name);
737 }
738 
739 const char *
740 tcpport_string(netdissect_options *ndo, u_short port)
741 {
742 	struct hnamemem *tp;
743 	uint32_t i = port;
744 	char buf[sizeof("00000")];
745 
746 	for (tp = &tporttable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
747 		if (tp->addr == i)
748 			return (tp->name);
749 
750 	tp->addr = i;
751 	tp->nxt = newhnamemem(ndo);
752 
753 	(void)snprintf(buf, sizeof(buf), "%u", i);
754 	tp->name = strdup(buf);
755 	if (tp->name == NULL)
756 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
757 				  "%s: strdup(buf)", __func__);
758 	return (tp->name);
759 }
760 
761 const char *
762 udpport_string(netdissect_options *ndo, u_short port)
763 {
764 	struct hnamemem *tp;
765 	uint32_t i = port;
766 	char buf[sizeof("00000")];
767 
768 	for (tp = &uporttable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
769 		if (tp->addr == i)
770 			return (tp->name);
771 
772 	tp->addr = i;
773 	tp->nxt = newhnamemem(ndo);
774 
775 	(void)snprintf(buf, sizeof(buf), "%u", i);
776 	tp->name = strdup(buf);
777 	if (tp->name == NULL)
778 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
779 				  "%s: strdup(buf)", __func__);
780 	return (tp->name);
781 }
782 
783 const char *
784 ipxsap_string(netdissect_options *ndo, u_short port)
785 {
786 	char *cp;
787 	struct hnamemem *tp;
788 	uint32_t i = port;
789 	char buf[sizeof("0000")];
790 
791 	for (tp = &ipxsaptable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
792 		if (tp->addr == i)
793 			return (tp->name);
794 
795 	tp->addr = i;
796 	tp->nxt = newhnamemem(ndo);
797 
798 	cp = buf;
799 	port = ntohs(port);
800 	*cp++ = hex[port >> 12 & 0xf];
801 	*cp++ = hex[port >> 8 & 0xf];
802 	*cp++ = hex[port >> 4 & 0xf];
803 	*cp++ = hex[port & 0xf];
804 	*cp++ = '\0';
805 	tp->name = strdup(buf);
806 	if (tp->name == NULL)
807 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
808 				  "%s: strdup(buf)", __func__);
809 	return (tp->name);
810 }
811 
812 static void
813 init_servarray(netdissect_options *ndo)
814 {
815 	struct servent *sv;
816 	struct hnamemem *table;
817 	int i;
818 	char buf[sizeof("0000000000")];
819 
820 	while ((sv = getservent()) != NULL) {
821 		int port = ntohs(sv->s_port);
822 		i = port & (HASHNAMESIZE-1);
823 		if (strcmp(sv->s_proto, "tcp") == 0)
824 			table = &tporttable[i];
825 		else if (strcmp(sv->s_proto, "udp") == 0)
826 			table = &uporttable[i];
827 		else
828 			continue;
829 
830 		while (table->name)
831 			table = table->nxt;
832 		if (ndo->ndo_nflag) {
833 			(void)snprintf(buf, sizeof(buf), "%d", port);
834 			table->name = strdup(buf);
835 		} else
836 			table->name = strdup(sv->s_name);
837 		if (table->name == NULL)
838 			(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
839 					  "%s: strdup", __func__);
840 
841 		table->addr = port;
842 		table->nxt = newhnamemem(ndo);
843 	}
844 	endservent();
845 }
846 
847 static const struct eproto {
848 	const char *s;
849 	u_short p;
850 } eproto_db[] = {
851 	{ "aarp", ETHERTYPE_AARP },
852 	{ "arp", ETHERTYPE_ARP },
853 	{ "atalk", ETHERTYPE_ATALK },
854 	{ "decnet", ETHERTYPE_DN },
855 	{ "ip", ETHERTYPE_IP },
856 	{ "ip6", ETHERTYPE_IPV6 },
857 	{ "lat", ETHERTYPE_LAT },
858 	{ "loopback", ETHERTYPE_LOOPBACK },
859 	{ "mopdl", ETHERTYPE_MOPDL },
860 	{ "moprc", ETHERTYPE_MOPRC },
861 	{ "rarp", ETHERTYPE_REVARP },
862 	{ "sca", ETHERTYPE_SCA },
863 	{ (char *)0, 0 }
864 };
865 
866 static void
867 init_eprotoarray(netdissect_options *ndo)
868 {
869 	int i;
870 	struct hnamemem *table;
871 
872 	for (i = 0; eproto_db[i].s; i++) {
873 		int j = htons(eproto_db[i].p) & (HASHNAMESIZE-1);
874 		table = &eprototable[j];
875 		while (table->name)
876 			table = table->nxt;
877 		table->name = eproto_db[i].s;
878 		table->addr = htons(eproto_db[i].p);
879 		table->nxt = newhnamemem(ndo);
880 	}
881 }
882 
883 static const struct protoidlist {
884 	const u_char protoid[5];
885 	const char *name;
886 } protoidlist[] = {
887 	{{ 0x00, 0x00, 0x0c, 0x01, 0x07 }, "CiscoMLS" },
888 	{{ 0x00, 0x00, 0x0c, 0x20, 0x00 }, "CiscoCDP" },
889 	{{ 0x00, 0x00, 0x0c, 0x20, 0x01 }, "CiscoCGMP" },
890 	{{ 0x00, 0x00, 0x0c, 0x20, 0x03 }, "CiscoVTP" },
891 	{{ 0x00, 0xe0, 0x2b, 0x00, 0xbb }, "ExtremeEDP" },
892 	{{ 0x00, 0x00, 0x00, 0x00, 0x00 }, NULL }
893 };
894 
895 /*
896  * SNAP proto IDs with org code 0:0:0 are actually encapsulated Ethernet
897  * types.
898  */
899 static void
900 init_protoidarray(netdissect_options *ndo)
901 {
902 	int i;
903 	struct protoidmem *tp;
904 	const struct protoidlist *pl;
905 	u_char protoid[5];
906 
907 	protoid[0] = 0;
908 	protoid[1] = 0;
909 	protoid[2] = 0;
910 	for (i = 0; eproto_db[i].s; i++) {
911 		u_short etype = htons(eproto_db[i].p);
912 
913 		memcpy((char *)&protoid[3], (char *)&etype, 2);
914 		tp = lookup_protoid(ndo, protoid);
915 		tp->p_name = strdup(eproto_db[i].s);
916 		if (tp->p_name == NULL)
917 			(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
918 				"%s: strdup(eproto_db[i].s)", __func__);
919 	}
920 	/* Hardwire some SNAP proto ID names */
921 	for (pl = protoidlist; pl->name != NULL; ++pl) {
922 		tp = lookup_protoid(ndo, pl->protoid);
923 		/* Don't override existing name */
924 		if (tp->p_name != NULL)
925 			continue;
926 
927 		tp->p_name = pl->name;
928 	}
929 }
930 
931 static const struct etherlist {
932 	const nd_mac_addr addr;
933 	const char *name;
934 } etherlist[] = {
935 	{{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, "Broadcast" },
936 	{{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, NULL }
937 };
938 
939 /*
940  * Initialize the ethers hash table.  We take two different approaches
941  * depending on whether or not the system provides the ethers name
942  * service.  If it does, we just wire in a few names at startup,
943  * and etheraddr_string() fills in the table on demand.  If it doesn't,
944  * then we suck in the entire /etc/ethers file at startup.  The idea
945  * is that parsing the local file will be fast, but spinning through
946  * all the ethers entries via NIS & next_etherent might be very slow.
947  *
948  * XXX pcap_next_etherent doesn't belong in the pcap interface, but
949  * since the pcap module already does name-to-address translation,
950  * it's already does most of the work for the ethernet address-to-name
951  * translation, so we just pcap_next_etherent as a convenience.
952  */
953 static void
954 init_etherarray(netdissect_options *ndo)
955 {
956 	const struct etherlist *el;
957 	struct enamemem *tp;
958 #ifdef USE_ETHER_NTOHOST
959 	char name[256];
960 #else
961 	struct pcap_etherent *ep;
962 	FILE *fp;
963 
964 	/* Suck in entire ethers file */
965 	fp = fopen(PCAP_ETHERS_FILE, "r");
966 	if (fp != NULL) {
967 		while ((ep = pcap_next_etherent(fp)) != NULL) {
968 			tp = lookup_emem(ndo, ep->addr);
969 			tp->e_name = strdup(ep->name);
970 			if (tp->e_name == NULL)
971 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
972 					"%s: strdup(ep->addr)", __func__);
973 		}
974 		(void)fclose(fp);
975 	}
976 #endif
977 
978 	/* Hardwire some ethernet names */
979 	for (el = etherlist; el->name != NULL; ++el) {
980 		tp = lookup_emem(ndo, el->addr);
981 		/* Don't override existing name */
982 		if (tp->e_name != NULL)
983 			continue;
984 
985 #ifdef USE_ETHER_NTOHOST
986 		/*
987 		 * Use YP/NIS version of name if available.
988 		 */
989 		/* Same workaround as in etheraddr_string(). */
990 		struct ether_addr ea;
991 		memcpy (&ea, el->addr, MAC_ADDR_LEN);
992 		if (ether_ntohost(name, &ea) == 0) {
993 			tp->e_name = strdup(name);
994 			if (tp->e_name == NULL)
995 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
996 					"%s: strdup(name)", __func__);
997 			continue;
998 		}
999 #endif
1000 		tp->e_name = el->name;
1001 	}
1002 }
1003 
1004 static const struct ipxsap_ent {
1005 	uint16_t	v;
1006 	const char	*s;
1007 } ipxsap_db[] = {
1008 	{ 0x0000, "Unknown" },
1009 	{ 0x0001, "User" },
1010 	{ 0x0002, "User Group" },
1011 	{ 0x0003, "PrintQueue" },
1012 	{ 0x0004, "FileServer" },
1013 	{ 0x0005, "JobServer" },
1014 	{ 0x0006, "Gateway" },
1015 	{ 0x0007, "PrintServer" },
1016 	{ 0x0008, "ArchiveQueue" },
1017 	{ 0x0009, "ArchiveServer" },
1018 	{ 0x000a, "JobQueue" },
1019 	{ 0x000b, "Administration" },
1020 	{ 0x000F, "Novell TI-RPC" },
1021 	{ 0x0017, "Diagnostics" },
1022 	{ 0x0020, "NetBIOS" },
1023 	{ 0x0021, "NAS SNA Gateway" },
1024 	{ 0x0023, "NACS AsyncGateway" },
1025 	{ 0x0024, "RemoteBridge/RoutingService" },
1026 	{ 0x0026, "BridgeServer" },
1027 	{ 0x0027, "TCP/IP Gateway" },
1028 	{ 0x0028, "Point-to-point X.25 BridgeServer" },
1029 	{ 0x0029, "3270 Gateway" },
1030 	{ 0x002a, "CHI Corp" },
1031 	{ 0x002c, "PC Chalkboard" },
1032 	{ 0x002d, "TimeSynchServer" },
1033 	{ 0x002e, "ARCserve5.0/PalindromeBackup" },
1034 	{ 0x0045, "DI3270 Gateway" },
1035 	{ 0x0047, "AdvertisingPrintServer" },
1036 	{ 0x004a, "NetBlazerModems" },
1037 	{ 0x004b, "BtrieveVAP" },
1038 	{ 0x004c, "NetwareSQL" },
1039 	{ 0x004d, "XtreeNetwork" },
1040 	{ 0x0050, "BtrieveVAP4.11" },
1041 	{ 0x0052, "QuickLink" },
1042 	{ 0x0053, "PrintQueueUser" },
1043 	{ 0x0058, "Multipoint X.25 Router" },
1044 	{ 0x0060, "STLB/NLM" },
1045 	{ 0x0064, "ARCserve" },
1046 	{ 0x0066, "ARCserve3.0" },
1047 	{ 0x0072, "WAN CopyUtility" },
1048 	{ 0x007a, "TES-NetwareVMS" },
1049 	{ 0x0092, "WATCOM Debugger/EmeraldTapeBackupServer" },
1050 	{ 0x0095, "DDA OBGYN" },
1051 	{ 0x0098, "NetwareAccessServer" },
1052 	{ 0x009a, "Netware for VMS II/NamedPipeServer" },
1053 	{ 0x009b, "NetwareAccessServer" },
1054 	{ 0x009e, "PortableNetwareServer/SunLinkNVT" },
1055 	{ 0x00a1, "PowerchuteAPC UPS" },
1056 	{ 0x00aa, "LAWserve" },
1057 	{ 0x00ac, "CompaqIDA StatusMonitor" },
1058 	{ 0x0100, "PIPE STAIL" },
1059 	{ 0x0102, "LAN ProtectBindery" },
1060 	{ 0x0103, "OracleDataBaseServer" },
1061 	{ 0x0107, "Netware386/RSPX RemoteConsole" },
1062 	{ 0x010f, "NovellSNA Gateway" },
1063 	{ 0x0111, "TestServer" },
1064 	{ 0x0112, "HP PrintServer" },
1065 	{ 0x0114, "CSA MUX" },
1066 	{ 0x0115, "CSA LCA" },
1067 	{ 0x0116, "CSA CM" },
1068 	{ 0x0117, "CSA SMA" },
1069 	{ 0x0118, "CSA DBA" },
1070 	{ 0x0119, "CSA NMA" },
1071 	{ 0x011a, "CSA SSA" },
1072 	{ 0x011b, "CSA STATUS" },
1073 	{ 0x011e, "CSA APPC" },
1074 	{ 0x0126, "SNA TEST SSA Profile" },
1075 	{ 0x012a, "CSA TRACE" },
1076 	{ 0x012b, "NetwareSAA" },
1077 	{ 0x012e, "IKARUS VirusScan" },
1078 	{ 0x0130, "CommunicationsExecutive" },
1079 	{ 0x0133, "NNS DomainServer/NetwareNamingServicesDomain" },
1080 	{ 0x0135, "NetwareNamingServicesProfile" },
1081 	{ 0x0137, "Netware386 PrintQueue/NNS PrintQueue" },
1082 	{ 0x0141, "LAN SpoolServer" },
1083 	{ 0x0152, "IRMALAN Gateway" },
1084 	{ 0x0154, "NamedPipeServer" },
1085 	{ 0x0166, "NetWareManagement" },
1086 	{ 0x0168, "Intel PICKIT CommServer/Intel CAS TalkServer" },
1087 	{ 0x0173, "Compaq" },
1088 	{ 0x0174, "Compaq SNMP Agent" },
1089 	{ 0x0175, "Compaq" },
1090 	{ 0x0180, "XTreeServer/XTreeTools" },
1091 	{ 0x018A, "NASI ServicesBroadcastServer" },
1092 	{ 0x01b0, "GARP Gateway" },
1093 	{ 0x01b1, "Binfview" },
1094 	{ 0x01bf, "IntelLanDeskManager" },
1095 	{ 0x01ca, "AXTEC" },
1096 	{ 0x01cb, "ShivaNetModem/E" },
1097 	{ 0x01cc, "ShivaLanRover/E" },
1098 	{ 0x01cd, "ShivaLanRover/T" },
1099 	{ 0x01ce, "ShivaUniversal" },
1100 	{ 0x01d8, "CastelleFAXPressServer" },
1101 	{ 0x01da, "CastelleLANPressPrintServer" },
1102 	{ 0x01dc, "CastelleFAX/Xerox7033 FaxServer/ExcelLanFax" },
1103 	{ 0x01f0, "LEGATO" },
1104 	{ 0x01f5, "LEGATO" },
1105 	{ 0x0233, "NMS Agent/NetwareManagementAgent" },
1106 	{ 0x0237, "NMS IPX Discovery/LANternReadWriteChannel" },
1107 	{ 0x0238, "NMS IP Discovery/LANternTrapAlarmChannel" },
1108 	{ 0x023a, "LANtern" },
1109 	{ 0x023c, "MAVERICK" },
1110 	{ 0x023f, "NovellSMDR" },
1111 	{ 0x024e, "NetwareConnect" },
1112 	{ 0x024f, "NASI ServerBroadcast Cisco" },
1113 	{ 0x026a, "NMS ServiceConsole" },
1114 	{ 0x026b, "TimeSynchronizationServer Netware 4.x" },
1115 	{ 0x0278, "DirectoryServer Netware 4.x" },
1116 	{ 0x027b, "NetwareManagementAgent" },
1117 	{ 0x0280, "Novell File and Printer Sharing Service for PC" },
1118 	{ 0x0304, "NovellSAA Gateway" },
1119 	{ 0x0308, "COM/VERMED" },
1120 	{ 0x030a, "GalacticommWorldgroupServer" },
1121 	{ 0x030c, "IntelNetport2/HP JetDirect/HP Quicksilver" },
1122 	{ 0x0320, "AttachmateGateway" },
1123 	{ 0x0327, "MicrosoftDiagnostiocs" },
1124 	{ 0x0328, "WATCOM SQL Server" },
1125 	{ 0x0335, "MultiTechSystems MultisynchCommServer" },
1126 	{ 0x0343, "Xylogics RemoteAccessServer/LANModem" },
1127 	{ 0x0355, "ArcadaBackupExec" },
1128 	{ 0x0358, "MSLCD1" },
1129 	{ 0x0361, "NETINELO" },
1130 	{ 0x037e, "Powerchute UPS Monitoring" },
1131 	{ 0x037f, "ViruSafeNotify" },
1132 	{ 0x0386, "HP Bridge" },
1133 	{ 0x0387, "HP Hub" },
1134 	{ 0x0394, "NetWare SAA Gateway" },
1135 	{ 0x039b, "LotusNotes" },
1136 	{ 0x03b7, "CertusAntiVirus" },
1137 	{ 0x03c4, "ARCserve4.0" },
1138 	{ 0x03c7, "LANspool3.5" },
1139 	{ 0x03d7, "LexmarkPrinterServer" },
1140 	{ 0x03d8, "LexmarkXLE PrinterServer" },
1141 	{ 0x03dd, "BanyanENS NetwareClient" },
1142 	{ 0x03de, "GuptaSequelBaseServer/NetWareSQL" },
1143 	{ 0x03e1, "UnivelUnixware" },
1144 	{ 0x03e4, "UnivelUnixware" },
1145 	{ 0x03fc, "IntelNetport" },
1146 	{ 0x03fd, "PrintServerQueue" },
1147 	{ 0x040A, "ipnServer" },
1148 	{ 0x040D, "LVERRMAN" },
1149 	{ 0x040E, "LVLIC" },
1150 	{ 0x0414, "NET Silicon (DPI)/Kyocera" },
1151 	{ 0x0429, "SiteLockVirus" },
1152 	{ 0x0432, "UFHELPR???" },
1153 	{ 0x0433, "Synoptics281xAdvancedSNMPAgent" },
1154 	{ 0x0444, "MicrosoftNT SNA Server" },
1155 	{ 0x0448, "Oracle" },
1156 	{ 0x044c, "ARCserve5.01" },
1157 	{ 0x0457, "CanonGP55" },
1158 	{ 0x045a, "QMS Printers" },
1159 	{ 0x045b, "DellSCSI Array" },
1160 	{ 0x0491, "NetBlazerModems" },
1161 	{ 0x04ac, "OnTimeScheduler" },
1162 	{ 0x04b0, "CD-Net" },
1163 	{ 0x0513, "EmulexNQA" },
1164 	{ 0x0520, "SiteLockChecks" },
1165 	{ 0x0529, "SiteLockChecks" },
1166 	{ 0x052d, "CitrixOS2 AppServer" },
1167 	{ 0x0535, "Tektronix" },
1168 	{ 0x0536, "Milan" },
1169 	{ 0x055d, "Attachmate SNA gateway" },
1170 	{ 0x056b, "IBM8235 ModemServer" },
1171 	{ 0x056c, "ShivaLanRover/E PLUS" },
1172 	{ 0x056d, "ShivaLanRover/T PLUS" },
1173 	{ 0x0580, "McAfeeNetShield" },
1174 	{ 0x05B8, "NLM to workstation communication (Revelation Software)" },
1175 	{ 0x05BA, "CompatibleSystemsRouters" },
1176 	{ 0x05BE, "CheyenneHierarchicalStorageManager" },
1177 	{ 0x0606, "JCWatermarkImaging" },
1178 	{ 0x060c, "AXISNetworkPrinter" },
1179 	{ 0x0610, "AdaptecSCSIManagement" },
1180 	{ 0x0621, "IBM AntiVirus" },
1181 	{ 0x0640, "Windows95 RemoteRegistryService" },
1182 	{ 0x064e, "MicrosoftIIS" },
1183 	{ 0x067b, "Microsoft Win95/98 File and Print Sharing for NetWare" },
1184 	{ 0x067c, "Microsoft Win95/98 File and Print Sharing for NetWare" },
1185 	{ 0x076C, "Xerox" },
1186 	{ 0x079b, "ShivaLanRover/E 115" },
1187 	{ 0x079c, "ShivaLanRover/T 115" },
1188 	{ 0x07B4, "CubixWorldDesk" },
1189 	{ 0x07c2, "Quarterdeck IWare Connect V2.x NLM" },
1190 	{ 0x07c1, "Quarterdeck IWare Connect V3.x NLM" },
1191 	{ 0x0810, "ELAN License Server Demo" },
1192 	{ 0x0824, "ShivaLanRoverAccessSwitch/E" },
1193 	{ 0x086a, "ISSC Collector" },
1194 	{ 0x087f, "ISSC DAS AgentAIX" },
1195 	{ 0x0880, "Intel Netport PRO" },
1196 	{ 0x0881, "Intel Netport PRO" },
1197 	{ 0x0b29, "SiteLock" },
1198 	{ 0x0c29, "SiteLockApplications" },
1199 	{ 0x0c2c, "LicensingServer" },
1200 	{ 0x2101, "PerformanceTechnologyInstantInternet" },
1201 	{ 0x2380, "LAI SiteLock" },
1202 	{ 0x238c, "MeetingMaker" },
1203 	{ 0x4808, "SiteLockServer/SiteLockMetering" },
1204 	{ 0x5555, "SiteLockUser" },
1205 	{ 0x6312, "Tapeware" },
1206 	{ 0x6f00, "RabbitGateway" },
1207 	{ 0x7703, "MODEM" },
1208 	{ 0x8002, "NetPortPrinters" },
1209 	{ 0x8008, "WordPerfectNetworkVersion" },
1210 	{ 0x85BE, "Cisco EIGRP" },
1211 	{ 0x8888, "WordPerfectNetworkVersion/QuickNetworkManagement" },
1212 	{ 0x9000, "McAfeeNetShield" },
1213 	{ 0x9604, "CSA-NT_MON" },
1214 	{ 0xb6a8, "OceanIsleReachoutRemoteControl" },
1215 	{ 0xf11f, "SiteLockMetering" },
1216 	{ 0xf1ff, "SiteLock" },
1217 	{ 0xf503, "Microsoft SQL Server" },
1218 	{ 0xF905, "IBM TimeAndPlace" },
1219 	{ 0xfbfb, "TopCallIII FaxServer" },
1220 	{ 0xffff, "AnyService/Wildcard" },
1221 	{ 0, (char *)0 }
1222 };
1223 
1224 static void
1225 init_ipxsaparray(netdissect_options *ndo)
1226 {
1227 	int i;
1228 	struct hnamemem *table;
1229 
1230 	for (i = 0; ipxsap_db[i].s != NULL; i++) {
1231 		u_int j = htons(ipxsap_db[i].v) & (HASHNAMESIZE-1);
1232 		table = &ipxsaptable[j];
1233 		while (table->name)
1234 			table = table->nxt;
1235 		table->name = ipxsap_db[i].s;
1236 		table->addr = htons(ipxsap_db[i].v);
1237 		table->nxt = newhnamemem(ndo);
1238 	}
1239 }
1240 
1241 /*
1242  * Initialize the address to name translation machinery.  We map all
1243  * non-local IP addresses to numeric addresses if ndo->ndo_fflag is true
1244  * (i.e., to prevent blocking on the nameserver).  localnet is the IP address
1245  * of the local network.  mask is its subnet mask.
1246  */
1247 void
1248 init_addrtoname(netdissect_options *ndo, uint32_t localnet, uint32_t mask)
1249 {
1250 	if (ndo->ndo_fflag) {
1251 		f_localnet = localnet;
1252 		f_netmask = mask;
1253 	}
1254 	if (ndo->ndo_nflag)
1255 		/*
1256 		 * Simplest way to suppress names.
1257 		 */
1258 		return;
1259 
1260 	init_etherarray(ndo);
1261 	init_servarray(ndo);
1262 	init_eprotoarray(ndo);
1263 	init_protoidarray(ndo);
1264 	init_ipxsaparray(ndo);
1265 }
1266 
1267 const char *
1268 dnaddr_string(netdissect_options *ndo, u_short dnaddr)
1269 {
1270 	struct hnamemem *tp;
1271 
1272 	for (tp = &dnaddrtable[dnaddr & (HASHNAMESIZE-1)]; tp->nxt != NULL;
1273 	     tp = tp->nxt)
1274 		if (tp->addr == dnaddr)
1275 			return (tp->name);
1276 
1277 	tp->addr = dnaddr;
1278 	tp->nxt = newhnamemem(ndo);
1279 	tp->name = dnnum_string(ndo, dnaddr);
1280 
1281 	return(tp->name);
1282 }
1283 
1284 /* Return a zero'ed hnamemem struct and cuts down on calloc() overhead */
1285 struct hnamemem *
1286 newhnamemem(netdissect_options *ndo)
1287 {
1288 	struct hnamemem *p;
1289 	static struct hnamemem *ptr = NULL;
1290 	static u_int num = 0;
1291 
1292 	if (num  == 0) {
1293 		num = 64;
1294 		ptr = (struct hnamemem *)calloc(num, sizeof (*ptr));
1295 		if (ptr == NULL)
1296 			(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
1297 					  "%s: calloc", __func__);
1298 	}
1299 	--num;
1300 	p = ptr++;
1301 	return (p);
1302 }
1303 
1304 /* Return a zero'ed h6namemem struct and cuts down on calloc() overhead */
1305 struct h6namemem *
1306 newh6namemem(netdissect_options *ndo)
1307 {
1308 	struct h6namemem *p;
1309 	static struct h6namemem *ptr = NULL;
1310 	static u_int num = 0;
1311 
1312 	if (num  == 0) {
1313 		num = 64;
1314 		ptr = (struct h6namemem *)calloc(num, sizeof (*ptr));
1315 		if (ptr == NULL)
1316 			(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
1317 					  "%s: calloc", __func__);
1318 	}
1319 	--num;
1320 	p = ptr++;
1321 	return (p);
1322 }
1323 
1324 /* Represent TCI part of the 802.1Q 4-octet tag as text. */
1325 const char *
1326 ieee8021q_tci_string(const uint16_t tci)
1327 {
1328 	static char buf[128];
1329 	snprintf(buf, sizeof(buf), "vlan %u, p %u%s",
1330 	         tci & 0xfff,
1331 	         tci >> 13,
1332 	         (tci & 0x1000) ? ", DEI" : "");
1333 	return buf;
1334 }
1335