🚀 go-pugleaf

Doug Greenwald (fsgreen@dredd.lerc.nasa.gov) wrote:
: I'm writing a small network analyzer to gather statistics.  

My condolences.  Y'know, there are lots of network analyzers out there
for real cheap...I think FTP corp. has one that is a software only
solution that runs on a PC.  You can get ahold of them at support@ftp.com

: Any pointers to references or information you could shed would be 
: appreciated.

(Ahem.)  The *offical* place to get that info is from  Novell Developer 
Relations.  They will attempt to sell you some very gross manual called "The
NetWare System Interface Technical Overview" (yuk!).  There's a chapter in it
on communication.  It describes the headers for IPX and SPX.  Basicly, look in
RFC 1060 (nic.ddn.mil) and you'll find the number for the XNS protocol.
That's what IPX/SPX is.  RFC 1060 might actually give you the number for
Novell's version of XNS, I dunno.

The Cheaper way to find the information which you seek is to ask your local
library to find a copy of Charles Rose's book _Programming NetWare_.  I think
you can get it for about $25 at any mall-type bookstore.

If you need something in a hurry, how 'bout this:

IPX:
Offset	Content			Type
0	Checksum		BYTE[2]
2	Length			BYTE[2]
4	Transport Control	BYTE
5	Packet Type		BYTE

6	Dest. Network		BYTE[4]
10	Dest. Node		BYTE[6]
16	Dest. Socket		BYTE[2]

18	Source Network		BYTE[4]
22	Source Node		BYTE[6]
28	Source Socket		BYTE[2]

30	Data Portion		BYTE[0 to 546]

Chekcsum: Included to conform to original Xerox packet defn. Not used (always
set to 0xFFFF).

Length: Length of complete packet (header + data).  Min = 30, Max = 576. 

Transport Control: Used by NetWare internetwork bridges.  Set to 0 at start.
Is analagous to the IP Time-To-Live (TTL) field.

Packet Type: Indicates the type of service offered or required by the packet.
Xerox has defined the following values (IPX users should, however, only use 0
or 4)
	Type	Meaning
	0	Unknown Pkt Type
	1	Routing Info Pkt
	2	Echo Packet
	3	Error Packet
	4	Packet Exchange Packet
	5 	Sequenced Packet Protocol Packet (SPX)
	16-31	Experimental Protocols
	17	NetWare Core Protocol

Dest. Network & Node: Self explanitory.

Dest. Socket: socet address of destination process (or, for you PC users out
there, destination program).  Xerox has reserved the following numbers:

	Socket		Meaning
	1		Routing Information Packet
	2		Echo Protocol Packet
	3		Error Handling Packet
	0x20-0x3F	Experimental
	0x1-0xBB8	Registered with Xerox
	0xBB9-		Dynamically assignable
Xerox has assigned Novell a set of sockets for use by NetWare:
	0x451		File Service Packet
	0x452		Service Advertising Packet
	0x453		Routing Info Packet
	0x455		NetBIOS Packet
	0x456		Diagnostic Packet

SPX:
SPX is identical to IPX except for an additional 12 bytes in the header.

The additional fields are:
Offset	Content			Type
	{normal IPX header}
30	Connect. Control	BYTE
31	Data Stream Type	BYTE
32	Source Connect. ID	BYTE[2]
34	Dest. Connect. ID	BYTE[2]
36	Sequence #		BYTE[2]
38	Ack. #			BYTE[2]
40	Allocation #		BYTE[2]

42	Data Portion		BYTE[0 to 534]

Connection Control: This field contains four single-bit flags used by SPX and
it's clients to control the bi-directional flow of data accross a connection.

Value	Meaning
0x1-0x8	Undefined-Ignored by SPX (Undefined by Xerox)
0x10	End-of-Message
0x20	Attention (not really implemented, according to the NW-SITO)
0x40	Ack Required
0x80	System Packet

Data Stream Type: 1-byte flag that indicates the type of data found in the
packet.  Possible values include:
Value		Meaning
0x0-0xFD	Client Defined -- SPX ignores this field
0xFE		End-of-Connection
0xFF		End-of-Connection-Ack

The rest of the packets are self-explanatory.  And I'm tired of typing
tonight... ;)

Hope this helps you out...
-- 
# NightProwler -- I live in the night	| "When the going gets wierd,
# Internet: NtPrlr@eskimo.celestial.com |  The Wierd turn Pro."
# CompuServe: 75730,243			|  --Dr. Hunter S. Thompson
# 			 [Standard Disclaimer Applies]