tcpdump version 4.0.0 decode Agent-Information Option 82

robel · 03-27-2009, 03:10 AM

Using tcpdump version 4.0.0 (libpcap version 1.0.0) to decode Agent-Information Option 82, I would like to get the output a little more human readable.

Code:

            Agent-Information Option 82, length 14:
              Circuit-ID SubOption 1, length 4: M-^@^A^@^C
              Remote-ID SubOption 2, length 6: ^@^[M-]M-,^T4

I've searched through the man-pages but could not find any appropriate switch.

tcpdump version 3.9.2 (libpcap version 0.9.2) works like this on the very same packet:

Code:

            ACKT:1.4.128.1.0.3.2.6.0.27.221.172.20.52

"Pretty" readable. 1.4 is SubOption 1, length 4 (data follows, 4 bytes). 2.6 is SubOption 2, length 6 (data follows, 6 bytes). The last six bytes it the data I need. It is a hardware address: 00:1b:dd:ac:14:34 (translated to hex).

I guess it's not that easy to "see" that ^@^[M-]M-,^T4 is the same hardware address...

Any clue how to solve this with tcpdump 4.0.0?

-Bob-

robel · 03-28-2009, 11:40 AM

Quote:

Originally Posted by robel

Any clue how to solve this with tcpdump 4.0.0?

Ok, didn't get any answer to I had to alter the code. Maybe it can be done without tampering with the code, but I have no clue how...

print-bootp.c line 693:

Old code:

Code:

                                        case AGENT_SUBOPTION_CIRCUIT_ID: /* fall through */
                                        case AGENT_SUBOPTION_REMOTE_ID:
                                        case AGENT_SUBOPTION_SUBSCRIBER_ID:
                                                fn_printn(bp, suboptlen, NULL);
                                                break;

New code:

Code:

                                        case AGENT_SUBOPTION_REMOTE_ID:
                                            printf("%s", etheraddr_string(bp));
                                            break;
                                        case AGENT_SUBOPTION_CIRCUIT_ID: /* fall through */
                                        case AGENT_SUBOPTION_SUBSCRIBER_ID:
                                                fn_printn(bp, suboptlen, NULL);
                                                break;

This will give:

Code:

            Agent-Information Option 82, length 14:
              Circuit-ID SubOption 1, length 4: M-^@^A^@^C
              Remote-ID SubOption 2, length 6: 00:1b:dd:ac:14:34

Still Circuit-ID SubOption 1 is unreadable, but I don't need it so I left it untouched. Something can probably be done in the case AGENT_SUBOPTION_CIRCUIT_ID instead of "falling through" to pn_printn()

-Bob-