Packet Interception & Format

[Brendan P Kehoe]

I've been recently dabbling in the NIT package on the Sun SS1. I wrote a
program that puts the ethernet controller into promiscuous mode then
shoots out each packet that's received...nothing to amaze the kids with.
My main interest is in finding out how to get the format of each kind of
packet that's sent across. I can interpret the header of an IP packet with
the struct in /usr/include/netinet/ip.h...how do I find out (for example)
what kind of packet (NFS/RPC/text/authentication/etc) it is, what port
it's going to, etc? How about the structure of Decnet and Applelink
packets?  Is there any "main" place I can look (either here or remote)
that would tell me the format of a nice hefty number of 'em? (Like
SNA/X.25/....) I got a lil frustrated with the output of etherfind and
have ended up in a seemingly bottomless pit.  (I don't dare ask about rarp
and arp yet cuz I haven't checked around Ye Olde Include directories yet &
RTFM's have echoed in my ear ever since I started this project) Appreciate
your help..

Brendan Kehoe | Soon: brendan at cs.widener.edu | temp: brendan at world.std.com
Also: brendan at chinet.chi.il.us | Preferred: bkehoe at widener.bitnet