xref: /netbsd-src/external/bsd/tcpdump/dist/print-atalk.c (revision 3117ece4fc4a4ca4489ba793710b60b0d26bab6c)
1 /*
2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that: (1) source code distributions
7  * retain the above copyright notice and this paragraph in its entirety, (2)
8  * distributions including binary code include the above copyright notice and
9  * this paragraph in its entirety in the documentation or other materials
10  * provided with the distribution, and (3) all advertising materials mentioning
11  * features or use of this software display the following acknowledgement:
12  * ``This product includes software developed by the University of California,
13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14  * the University nor the names of its contributors may be used to endorse
15  * or promote products derived from this software without specific prior
16  * written permission.
17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20  */
21 
22 /* \summary: AppleTalk printer */
23 
24 #include <sys/cdefs.h>
25 #ifndef lint
26 __RCSID("$NetBSD: print-atalk.c,v 1.9 2024/09/02 16:15:30 christos Exp $");
27 #endif
28 
29 #include <config.h>
30 
31 #include "netdissect-stdinc.h"
32 
33 #include <stdio.h>
34 #include <string.h>
35 
36 #include "netdissect.h"
37 #include "addrtoname.h"
38 #include "ethertype.h"
39 #include "extract.h"
40 #include "appletalk.h"
41 
42 
43 static const struct tok type2str[] = {
44 	{ ddpRTMP,		"rtmp" },
45 	{ ddpRTMPrequest,	"rtmpReq" },
46 	{ ddpECHO,		"echo" },
47 	{ ddpIP,		"IP" },
48 	{ ddpARP,		"ARP" },
49 	{ ddpKLAP,		"KLAP" },
50 	{ 0,			NULL }
51 };
52 
53 struct aarp {
54 	nd_uint16_t	htype, ptype;
55 	nd_uint8_t	halen, palen;
56 	nd_uint16_t	op;
57 	nd_mac_addr	hsaddr;
58 	uint8_t		psaddr[4];
59 	nd_mac_addr	hdaddr;
60 	uint8_t		pdaddr[4];
61 };
62 
63 static void atp_print(netdissect_options *, const struct atATP *, u_int);
64 static void atp_bitmap_print(netdissect_options *, u_char);
65 static void nbp_print(netdissect_options *, const struct atNBP *, u_int, u_short, u_char, u_char);
66 static const struct atNBPtuple *nbp_tuple_print(netdissect_options *ndo, const struct atNBPtuple *,
67 						const u_char *,
68 						u_short, u_char, u_char);
69 static const struct atNBPtuple *nbp_name_print(netdissect_options *, const struct atNBPtuple *,
70 					       const u_char *);
71 static const char *ataddr_string(netdissect_options *, u_short, u_char);
72 static void ddp_print(netdissect_options *, const u_char *, u_int, u_int, u_short, u_char, u_char);
73 static const char *ddpskt_string(netdissect_options *, u_int);
74 
75 /*
76  * Print LLAP packets received on a physical LocalTalk interface.
77  */
78 void
79 ltalk_if_print(netdissect_options *ndo,
80                const struct pcap_pkthdr *h, const u_char *p)
81 {
82 	u_int hdrlen;
83 
84 	ndo->ndo_protocol = "ltalk";
85 	hdrlen = llap_print(ndo, p, h->len);
86 	if (hdrlen == 0) {
87 		/* Cut short by the snapshot length. */
88 		ndo->ndo_ll_hdr_len += h->caplen;
89 		return;
90 	}
91 	ndo->ndo_ll_hdr_len += hdrlen;
92 }
93 
94 /*
95  * Print AppleTalk LLAP packets.
96  */
97 u_int
98 llap_print(netdissect_options *ndo,
99            const u_char *bp, u_int length)
100 {
101 	const struct LAP *lp;
102 	const struct atDDP *dp;
103 	const struct atShortDDP *sdp;
104 	u_short snet;
105 	u_int hdrlen;
106 
107 	ndo->ndo_protocol = "llap";
108 	if (length < sizeof(*lp)) {
109 		ND_PRINT(" [|llap %u]", length);
110 		return (length);
111 	}
112 	if (!ND_TTEST_LEN(bp, sizeof(*lp))) {
113 		nd_print_trunc(ndo);
114 		return (0);	/* cut short by the snapshot length */
115 	}
116 	lp = (const struct LAP *)bp;
117 	bp += sizeof(*lp);
118 	length -= sizeof(*lp);
119 	hdrlen = sizeof(*lp);
120 	switch (GET_U_1(lp->type)) {
121 
122 	case lapShortDDP:
123 		if (length < ddpSSize) {
124 			ND_PRINT(" [|sddp %u]", length);
125 			return (length);
126 		}
127 		if (!ND_TTEST_LEN(bp, ddpSSize)) {
128 			ND_PRINT(" [|sddp]");
129 			return (0);	/* cut short by the snapshot length */
130 		}
131 		sdp = (const struct atShortDDP *)bp;
132 		ND_PRINT("%s.%s",
133 		    ataddr_string(ndo, 0, GET_U_1(lp->src)),
134 		    ddpskt_string(ndo, GET_U_1(sdp->srcSkt)));
135 		ND_PRINT(" > %s.%s:",
136 		    ataddr_string(ndo, 0, GET_U_1(lp->dst)),
137 		    ddpskt_string(ndo, GET_U_1(sdp->dstSkt)));
138 		bp += ddpSSize;
139 		length -= ddpSSize;
140 		hdrlen += ddpSSize;
141 		ddp_print(ndo, bp, length, GET_U_1(sdp->type), 0,
142 			  GET_U_1(lp->src), GET_U_1(sdp->srcSkt));
143 		break;
144 
145 	case lapDDP:
146 		if (length < ddpSize) {
147 			ND_PRINT(" [|ddp %u]", length);
148 			return (length);
149 		}
150 		if (!ND_TTEST_LEN(bp, ddpSize)) {
151 			ND_PRINT(" [|ddp]");
152 			return (0);	/* cut short by the snapshot length */
153 		}
154 		dp = (const struct atDDP *)bp;
155 		snet = GET_BE_U_2(dp->srcNet);
156 		ND_PRINT("%s.%s",
157 			 ataddr_string(ndo, snet, GET_U_1(dp->srcNode)),
158 			 ddpskt_string(ndo, GET_U_1(dp->srcSkt)));
159 		ND_PRINT(" > %s.%s:",
160 		    ataddr_string(ndo, GET_BE_U_2(dp->dstNet), GET_U_1(dp->dstNode)),
161 		    ddpskt_string(ndo, GET_U_1(dp->dstSkt)));
162 		bp += ddpSize;
163 		length -= ddpSize;
164 		hdrlen += ddpSize;
165 		ddp_print(ndo, bp, length, GET_U_1(dp->type), snet,
166 			  GET_U_1(dp->srcNode), GET_U_1(dp->srcSkt));
167 		break;
168 
169 #ifdef notdef
170 	case lapKLAP:
171 		klap_print(bp, length);
172 		break;
173 #endif
174 
175 	default:
176 		ND_PRINT("%u > %u at-lap#%u %u",
177 		    GET_U_1(lp->src), GET_U_1(lp->dst), GET_U_1(lp->type),
178 		    length);
179 		break;
180 	}
181 	return (hdrlen);
182 }
183 
184 /*
185  * Print EtherTalk/TokenTalk packets (or FDDITalk, or whatever it's called
186  * when it runs over FDDI; yes, I've seen FDDI captures with AppleTalk
187  * packets in them).
188  */
189 void
190 atalk_print(netdissect_options *ndo,
191             const u_char *bp, u_int length)
192 {
193 	const struct atDDP *dp;
194 	u_short snet;
195 
196 	ndo->ndo_protocol = "atalk";
197         if(!ndo->ndo_eflag)
198             ND_PRINT("AT ");
199 
200 	if (length < ddpSize) {
201 		ND_PRINT(" [|ddp %u]", length);
202 		return;
203 	}
204 	if (!ND_TTEST_LEN(bp, ddpSize)) {
205 		ND_PRINT(" [|ddp]");
206 		return;
207 	}
208 	dp = (const struct atDDP *)bp;
209 	snet = GET_BE_U_2(dp->srcNet);
210 	ND_PRINT("%s.%s", ataddr_string(ndo, snet, GET_U_1(dp->srcNode)),
211 		 ddpskt_string(ndo, GET_U_1(dp->srcSkt)));
212 	ND_PRINT(" > %s.%s: ",
213 	       ataddr_string(ndo, GET_BE_U_2(dp->dstNet), GET_U_1(dp->dstNode)),
214 	       ddpskt_string(ndo, GET_U_1(dp->dstSkt)));
215 	bp += ddpSize;
216 	length -= ddpSize;
217 	ddp_print(ndo, bp, length, GET_U_1(dp->type), snet,
218 		  GET_U_1(dp->srcNode), GET_U_1(dp->srcSkt));
219 }
220 
221 /* XXX should probably pass in the snap header and do checks like arp_print() */
222 void
223 aarp_print(netdissect_options *ndo,
224            const u_char *bp, u_int length)
225 {
226 	const struct aarp *ap;
227 
228 #define AT(member) ataddr_string(ndo, (ap->member[1]<<8)|ap->member[2],ap->member[3])
229 
230 	ndo->ndo_protocol = "aarp";
231 	ND_PRINT("aarp ");
232 	ap = (const struct aarp *)bp;
233 	if (!ND_TTEST_SIZE(ap)) {
234 		/* Just bail if we don't have the whole chunk. */
235 		nd_print_trunc(ndo);
236 		return;
237 	}
238 	if (length < sizeof(*ap)) {
239 		ND_PRINT(" [|aarp %u]", length);
240 		return;
241 	}
242 	if (GET_BE_U_2(ap->htype) == 1 &&
243 	    GET_BE_U_2(ap->ptype) == ETHERTYPE_ATALK &&
244 	    GET_U_1(ap->halen) == MAC_ADDR_LEN && GET_U_1(ap->palen) == 4)
245 		switch (GET_BE_U_2(ap->op)) {
246 
247 		case 1:				/* request */
248 			ND_PRINT("who-has %s tell %s", AT(pdaddr), AT(psaddr));
249 			return;
250 
251 		case 2:				/* response */
252 			ND_PRINT("reply %s is-at %s", AT(psaddr), GET_ETHERADDR_STRING(ap->hsaddr));
253 			return;
254 
255 		case 3:				/* probe (oy!) */
256 			ND_PRINT("probe %s tell %s", AT(pdaddr), AT(psaddr));
257 			return;
258 		}
259 	ND_PRINT("len %u op %u htype %u ptype %#x halen %u palen %u",
260 	    length, GET_BE_U_2(ap->op), GET_BE_U_2(ap->htype),
261 	    GET_BE_U_2(ap->ptype), GET_U_1(ap->halen), GET_U_1(ap->palen));
262 }
263 
264 /*
265  * Print AppleTalk Datagram Delivery Protocol packets.
266  */
267 static void
268 ddp_print(netdissect_options *ndo,
269           const u_char *bp, u_int length, u_int t,
270           u_short snet, u_char snode, u_char skt)
271 {
272 
273 	switch (t) {
274 
275 	case ddpNBP:
276 		nbp_print(ndo, (const struct atNBP *)bp, length, snet, snode, skt);
277 		break;
278 
279 	case ddpATP:
280 		atp_print(ndo, (const struct atATP *)bp, length);
281 		break;
282 
283 	case ddpEIGRP:
284 		eigrp_print(ndo, bp, length);
285 		break;
286 
287 	default:
288 		ND_PRINT(" at-%s %u", tok2str(type2str, NULL, t), length);
289 		break;
290 	}
291 }
292 
293 static void
294 atp_print(netdissect_options *ndo,
295           const struct atATP *ap, u_int length)
296 {
297 	uint8_t control;
298 	uint32_t data;
299 
300 	if ((const u_char *)(ap + 1) > ndo->ndo_snapend) {
301 		/* Just bail if we don't have the whole chunk. */
302 		nd_print_trunc(ndo);
303 		return;
304 	}
305 	if (length < sizeof(*ap)) {
306 		ND_PRINT(" [|atp %u]", length);
307 		return;
308 	}
309 	length -= sizeof(*ap);
310 	control = GET_U_1(ap->control);
311 	switch (control & 0xc0) {
312 
313 	case atpReqCode:
314 		ND_PRINT(" atp-req%s %u",
315 			     control & atpXO? " " : "*",
316 			     GET_BE_U_2(ap->transID));
317 
318 		atp_bitmap_print(ndo, GET_U_1(ap->bitmap));
319 
320 		if (length != 0)
321 			ND_PRINT(" [len=%u]", length);
322 
323 		switch (control & (atpEOM|atpSTS)) {
324 		case atpEOM:
325 			ND_PRINT(" [EOM]");
326 			break;
327 		case atpSTS:
328 			ND_PRINT(" [STS]");
329 			break;
330 		case atpEOM|atpSTS:
331 			ND_PRINT(" [EOM,STS]");
332 			break;
333 		}
334 		break;
335 
336 	case atpRspCode:
337 		ND_PRINT(" atp-resp%s%u:%u (%u)",
338 			     control & atpEOM? "*" : " ",
339 			     GET_BE_U_2(ap->transID), GET_U_1(ap->bitmap),
340 			     length);
341 		switch (control & (atpXO|atpSTS)) {
342 		case atpXO:
343 			ND_PRINT(" [XO]");
344 			break;
345 		case atpSTS:
346 			ND_PRINT(" [STS]");
347 			break;
348 		case atpXO|atpSTS:
349 			ND_PRINT(" [XO,STS]");
350 			break;
351 		}
352 		break;
353 
354 	case atpRelCode:
355 		ND_PRINT(" atp-rel  %u", GET_BE_U_2(ap->transID));
356 
357 		atp_bitmap_print(ndo, GET_U_1(ap->bitmap));
358 
359 		/* length should be zero */
360 		if (length)
361 			ND_PRINT(" [len=%u]", length);
362 
363 		/* there shouldn't be any control flags */
364 		if (control & (atpXO|atpEOM|atpSTS)) {
365 			char c = '[';
366 			if (control & atpXO) {
367 				ND_PRINT("%cXO", c);
368 				c = ',';
369 			}
370 			if (control & atpEOM) {
371 				ND_PRINT("%cEOM", c);
372 				c = ',';
373 			}
374 			if (control & atpSTS) {
375 				ND_PRINT("%cSTS", c);
376 			}
377 			ND_PRINT("]");
378 		}
379 		break;
380 
381 	default:
382 		ND_PRINT(" atp-0x%x  %u (%u)", control,
383 			     GET_BE_U_2(ap->transID), length);
384 		break;
385 	}
386 	data = GET_BE_U_4(ap->userData);
387 	if (data != 0)
388 		ND_PRINT(" 0x%x", data);
389 }
390 
391 static void
392 atp_bitmap_print(netdissect_options *ndo,
393                  u_char bm)
394 {
395 	u_int i;
396 
397 	/*
398 	 * The '& 0xff' below is needed for compilers that want to sign
399 	 * extend a u_char, which is the case with the Ultrix compiler.
400 	 * (gcc is smart enough to eliminate it, at least on the Sparc).
401 	 */
402 	if ((bm + 1) & (bm & 0xff)) {
403 		char c = '<';
404 		for (i = 0; bm; ++i) {
405 			if (bm & 1) {
406 				ND_PRINT("%c%u", c, i);
407 				c = ',';
408 			}
409 			bm >>= 1;
410 		}
411 		ND_PRINT(">");
412 	} else {
413 		for (i = 0; bm; ++i)
414 			bm >>= 1;
415 		if (i > 1)
416 			ND_PRINT("<0-%u>", i - 1);
417 		else
418 			ND_PRINT("<0>");
419 	}
420 }
421 
422 static void
423 nbp_print(netdissect_options *ndo,
424           const struct atNBP *np, u_int length, u_short snet,
425           u_char snode, u_char skt)
426 {
427 	const struct atNBPtuple *tp =
428 		(const struct atNBPtuple *)((const u_char *)np + nbpHeaderSize);
429 	uint8_t control;
430 	u_int i;
431 	const u_char *ep;
432 
433 	if (length < nbpHeaderSize) {
434 		ND_PRINT(" truncated-nbp %u", length);
435 		return;
436 	}
437 
438 	length -= nbpHeaderSize;
439 	if (length < 8) {
440 		/* must be room for at least one tuple */
441 		ND_PRINT(" truncated-nbp %u", length + nbpHeaderSize);
442 		return;
443 	}
444 	/* ep points to end of available data */
445 	ep = ndo->ndo_snapend;
446 	if ((const u_char *)tp > ep) {
447 		nd_print_trunc(ndo);
448 		return;
449 	}
450 	control = GET_U_1(np->control);
451 	switch (i = (control & 0xf0)) {
452 
453 	case nbpBrRq:
454 	case nbpLkUp:
455 		ND_PRINT(i == nbpLkUp? " nbp-lkup %u:":" nbp-brRq %u:",
456 			 GET_U_1(np->id));
457 		if ((const u_char *)(tp + 1) > ep) {
458 			nd_print_trunc(ndo);
459 			return;
460 		}
461 		(void)nbp_name_print(ndo, tp, ep);
462 		/*
463 		 * look for anomalies: the spec says there can only
464 		 * be one tuple, the address must match the source
465 		 * address and the enumerator should be zero.
466 		 */
467 		if ((control & 0xf) != 1)
468 			ND_PRINT(" [ntup=%u]", control & 0xf);
469 		if (GET_U_1(tp->enumerator))
470 			ND_PRINT(" [enum=%u]", GET_U_1(tp->enumerator));
471 		if (GET_BE_U_2(tp->net) != snet ||
472 		    GET_U_1(tp->node) != snode ||
473 		    GET_U_1(tp->skt) != skt)
474 			ND_PRINT(" [addr=%s.%u]",
475 			    ataddr_string(ndo, GET_BE_U_2(tp->net),
476 					  GET_U_1(tp->node)),
477 			    GET_U_1(tp->skt));
478 		break;
479 
480 	case nbpLkUpReply:
481 		ND_PRINT(" nbp-reply %u:", GET_U_1(np->id));
482 
483 		/* print each of the tuples in the reply */
484 		for (i = control & 0xf; i != 0 && tp; i--)
485 			tp = nbp_tuple_print(ndo, tp, ep, snet, snode, skt);
486 		break;
487 
488 	default:
489 		ND_PRINT(" nbp-0x%x  %u (%u)", control, GET_U_1(np->id),
490 			 length);
491 		break;
492 	}
493 }
494 
495 /* print a counted string */
496 static const u_char *
497 print_cstring(netdissect_options *ndo,
498               const u_char *cp, const u_char *ep)
499 {
500 	u_int length;
501 
502 	if (cp >= ep) {
503 		nd_print_trunc(ndo);
504 		return (0);
505 	}
506 	length = GET_U_1(cp);
507 	cp++;
508 
509 	/* Spec says string can be at most 32 bytes long */
510 	if (length > 32) {
511 		ND_PRINT("[len=%u]", length);
512 		return (0);
513 	}
514 	while (length != 0) {
515 		if (cp >= ep) {
516 			nd_print_trunc(ndo);
517 			return (0);
518 		}
519 		fn_print_char(ndo, GET_U_1(cp));
520 		cp++;
521 		length--;
522 	}
523 	return (cp);
524 }
525 
526 static const struct atNBPtuple *
527 nbp_tuple_print(netdissect_options *ndo,
528                 const struct atNBPtuple *tp, const u_char *ep,
529                 u_short snet, u_char snode, u_char skt)
530 {
531 	const struct atNBPtuple *tpn;
532 
533 	if ((const u_char *)(tp + 1) > ep) {
534 		nd_print_trunc(ndo);
535 		return 0;
536 	}
537 	tpn = nbp_name_print(ndo, tp, ep);
538 
539 	/* if the enumerator isn't 1, print it */
540 	if (GET_U_1(tp->enumerator) != 1)
541 		ND_PRINT("(%u)", GET_U_1(tp->enumerator));
542 
543 	/* if the socket doesn't match the src socket, print it */
544 	if (GET_U_1(tp->skt) != skt)
545 		ND_PRINT(" %u", GET_U_1(tp->skt));
546 
547 	/* if the address doesn't match the src address, it's an anomaly */
548 	if (GET_BE_U_2(tp->net) != snet ||
549 	    GET_U_1(tp->node) != snode)
550 		ND_PRINT(" [addr=%s]",
551 		    ataddr_string(ndo, GET_BE_U_2(tp->net), GET_U_1(tp->node)));
552 
553 	return (tpn);
554 }
555 
556 static const struct atNBPtuple *
557 nbp_name_print(netdissect_options *ndo,
558                const struct atNBPtuple *tp, const u_char *ep)
559 {
560 	const u_char *cp = (const u_char *)tp + nbpTupleSize;
561 
562 	ND_PRINT(" ");
563 
564 	/* Object */
565 	ND_PRINT("\"");
566 	if ((cp = print_cstring(ndo, cp, ep)) != NULL) {
567 		/* Type */
568 		ND_PRINT(":");
569 		if ((cp = print_cstring(ndo, cp, ep)) != NULL) {
570 			/* Zone */
571 			ND_PRINT("@");
572 			if ((cp = print_cstring(ndo, cp, ep)) != NULL)
573 				ND_PRINT("\"");
574 		}
575 	}
576 	return ((const struct atNBPtuple *)cp);
577 }
578 
579 
580 #define HASHNAMESIZE 4096
581 
582 struct hnamemem {
583 	u_int addr;
584 	char *name;
585 	struct hnamemem *nxt;
586 };
587 
588 static struct hnamemem hnametable[HASHNAMESIZE];
589 
590 static const char *
591 ataddr_string(netdissect_options *ndo,
592               u_short atnet, u_char athost)
593 {
594 	struct hnamemem *tp, *tp2;
595 	u_int i = (atnet << 8) | athost;
596 	char nambuf[256+1];
597 	static int first = 1;
598 	FILE *fp;
599 
600 	/*
601 	 * Are we doing address to name resolution?
602 	 */
603 	if (!ndo->ndo_nflag) {
604 		/*
605 		 * Yes.  Have we tried to open and read an AppleTalk
606 		 * number to name map file?
607 		 */
608 		if (!first) {
609 			/*
610 			 * No; try to do so.
611 			 */
612 			first = 0;
613 			fp = fopen("/etc/atalk.names", "r");
614 			if (fp != NULL) {
615 				char line[256];
616 				u_int i1, i2;
617 
618 				while (fgets(line, sizeof(line), fp)) {
619 					if (line[0] == '\n' || line[0] == 0 ||
620 					    line[0] == '#')
621 						continue;
622 					if (sscanf(line, "%u.%u %256s", &i1,
623 					    &i2, nambuf) == 3)
624 						/* got a hostname. */
625 						i2 |= (i1 << 8);
626 					else if (sscanf(line, "%u %256s", &i1,
627 					    nambuf) == 2)
628 						/* got a net name */
629 						i2 = (i1 << 8) | 255;
630 					else
631 						continue;
632 
633 					for (tp = &hnametable[i2 & (HASHNAMESIZE-1)];
634 					     tp->nxt; tp = tp->nxt)
635 						;
636 					tp->addr = i2;
637 					tp->nxt = newhnamemem(ndo);
638 					tp->name = strdup(nambuf);
639 					if (tp->name == NULL)
640 						(*ndo->ndo_error)(ndo,
641 						    S_ERR_ND_MEM_ALLOC,
642 						    "%s: strdup(nambuf)", __func__);
643 				}
644 				fclose(fp);
645 			}
646 		}
647 	}
648 
649 	/*
650 	 * Now try to look up the address in the table.
651 	 */
652 	for (tp = &hnametable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
653 		if (tp->addr == i)
654 			return (tp->name);
655 
656 	/* didn't have the node name -- see if we've got the net name */
657 	i |= 255;
658 	for (tp2 = &hnametable[i & (HASHNAMESIZE-1)]; tp2->nxt; tp2 = tp2->nxt)
659 		if (tp2->addr == i) {
660 			tp->addr = (atnet << 8) | athost;
661 			tp->nxt = newhnamemem(ndo);
662 			(void)snprintf(nambuf, sizeof(nambuf), "%s.%u",
663 			    tp2->name, athost);
664 			tp->name = strdup(nambuf);
665 			if (tp->name == NULL)
666 				(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
667 					"%s: strdup(nambuf)", __func__);
668 			return (tp->name);
669 		}
670 
671 	tp->addr = (atnet << 8) | athost;
672 	tp->nxt = newhnamemem(ndo);
673 	if (athost != 255)
674 		(void)snprintf(nambuf, sizeof(nambuf), "%u.%u", atnet, athost);
675 	else
676 		(void)snprintf(nambuf, sizeof(nambuf), "%u", atnet);
677 	tp->name = strdup(nambuf);
678 	if (tp->name == NULL)
679 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
680 				  "%s: strdup(nambuf)", __func__);
681 
682 	return (tp->name);
683 }
684 
685 static const struct tok skt2str[] = {
686 	{ rtmpSkt,	"rtmp" },	/* routing table maintenance */
687 	{ nbpSkt,	"nis" },	/* name info socket */
688 	{ echoSkt,	"echo" },	/* AppleTalk echo protocol */
689 	{ zipSkt,	"zip" },	/* zone info protocol */
690 	{ 0,		NULL }
691 };
692 
693 static const char *
694 ddpskt_string(netdissect_options *ndo,
695               u_int skt)
696 {
697 	static char buf[8];
698 
699 	if (ndo->ndo_nflag) {
700 		(void)snprintf(buf, sizeof(buf), "%u", skt);
701 		return (buf);
702 	}
703 	return (tok2str(skt2str, "%u", skt));
704 }
705