Skip the LLC and SNAP headers with -x.

Have llc_print() return the length of the LLC header, plus the length of
the SNAP header, if available - or, if it couldn't dissect the payload,
return the *negative* of that sum.  Use that return value in link-layer
printers.

1 files changed, 7 insertions, 2 deletions

diff --git a/print-cip.c b/print-cip.c
index 23f61788..fde5ab44 100644
--- a/print-cip.c
+++ b/print-cip.c
@@ -61,6 +61,7 @@ cip_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char
 {
 	u_int caplen = h->caplen;
 	u_int length = h->len;
+	int llc_hdrlen;
 
 	if (memcmp(rfcllc, p, sizeof(rfcllc))==0 && caplen < RFC1483LLC_LEN) {
 		ND_PRINT((ndo, "[|cip]"));
@@ -74,18 +75,22 @@ cip_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char
 		/*
 		 * LLC header is present.  Try to print it & higher layers.
 		 */
-		if (llc_print(ndo, p, length, caplen, NULL, NULL) == 0) {
+		llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
+		if (llc_hdrlen < 0) {
+			/* packet type not known, print raw packet */
 			if (!ndo->ndo_suppress_default_print)
 				ND_DEFAULTPRINT(p, caplen);
+			llc_hdrlen = -llc_hdrlen;
 		}
 	} else {
 		/*
 		 * LLC header is absent; treat it as just IP.
 		 */
+		llc_hdrlen = 0;
 		ip_print(ndo, p, length);
 	}
 
-	return (0);
+	return (llc_hdrlen);
 }