Patch to enable our tcpdump to handle CARP

[Dan Nelson]

In the last episode (Oct 19), George Neville-Neil said:
> I've been trying to debug CARP problems of late. I noticed that our
> tcpdump didn't have CARP support.  I took and fixed some code from OpenBSD
> so that our tcpdump can work with CARP.  Unlike OpenBSD you have to
> specify -T carp to read carp packets.  In their version you specify -T
> VRRP, because they don't like VRRP.  I decided that we should go with what
> most of the industry cares about rather than what OpenBSD cares about.
> 
> Patch is here: http://people.freebsd.org/~gnn/tcpdump-carp.diff
> 
> Technical comments welcome.

Here's the patch I've been using.  I include a rendering of the packet
format in the comments (since the CARP packet is otherwise completely
undocumented), and also examine the packet to decide whether to print it as
CARP or VRRP.  CARP hardcodes a 7 in the AuthLen field, so it'll get the
packet type right unless you happen to use VRRP with 7 IP addresses.

-- 
	Dan Nelson
	dnelson at allantgroup.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: carp.diff
Type: text/x-diff
Size: 3483 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-net/attachments/20111020/c188522d/carp.bin