search

the-tcpdump-group / tcpdump

the TCPdump network dissector
https://www.tcpdump.org/
Other
2.75k stars 852 forks source link

Choose decoding between DNS and OpenFlow #1064

Closed fxlb closed 1 year ago

fxlb commented 1 year ago

With a TCP packet such as: 192.168.205.135.53 > 192.168.1.106.6653 The protocol selected and decoded by tcpdump is OpenFlow (OPENFLOW_PORT_IANA == 6653) and not DNS.

In the if...else if... test in print-tcp.c, the test for OPENFLOW_PORT_IANA is on line 773. The one for NAMESERVER_PORT is after on line 784.

Should we change the order? (Wireshark decodes a packet like this as DNS.)

infrastation commented 1 year ago

The way I make sense of this an a couple similar earlier cases is as follows. In this case most likely it would be right to test for DNS before testing for OpenFlow. Generally speaking, it should be useful to test for most if not all privileged (< 1024) ports before everything else as the design was (and I believe still is) not to originate a TCP/UDP session from a privileged port. This would not eliminate the problem (consider TCP 1723 to TCP 6653), but would make it smaller.

fxlb commented 1 year ago

it should be useful to test for most if not all privileged (< 1024) ports before everything else

Yes, done with 1e63a2f6903de9303931f3135db88932d4e5785a.