Add support for dissecting RFC 2332 NHRP.

This is from the OpenBSD tcpdump.

18 files changed, 583 insertions, 0 deletions

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 180e2ecf..1dea8d27 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1161,6 +1161,7 @@ set(NETDISSECT_SOURCE_LIST_C
     print-msnlb.c
     print-nflog.c
     print-nfs.c
+    print-nhrp.c
     print-nsh.c
     print-ntp.c
     print-null.c
diff --git a/Makefile.in b/Makefile.in
index 1b3c3a57..1ddeae85 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -183,6 +183,7 @@ LIBNETDISSECT_SRC=\
 	print-msnlb.c \
 	print-nflog.c \
 	print-nfs.c \
+	print-nhrp.c \
 	print-nsh.c \
 	print-ntp.c \
 	print-null.c \
diff --git a/ipproto.h b/ipproto.h
index 30be911e..f6939db7 100644
--- a/ipproto.h
+++ b/ipproto.h
@@ -89,6 +89,9 @@ extern const char *netdb_protoname (const uint8_t);
 #ifndef IPPROTO_AH
 #define	IPPROTO_AH		51		/* SIPP Auth Header */
 #endif
+#ifndef IPPROTO_NHRP
+#define IPPROTO_NHRP		54		/* Next Hop Resolution */
+#endif
 #ifndef IPPROTO_MOBILE
 #define IPPROTO_MOBILE		55
 #endif
diff --git a/netdissect.h b/netdissect.h
index b744fe87..a359824c 100644
--- a/netdissect.h
+++ b/netdissect.h
@@ -697,6 +697,7 @@ extern void netbeui_print(netdissect_options *, u_short, const u_char *, u_int);
 extern void nfsreply_noaddr_print(netdissect_options *, const u_char *, u_int, const u_char *);
 extern void nfsreply_print(netdissect_options *, const u_char *, u_int, const u_char *);
 extern void nfsreq_noaddr_print(netdissect_options *, const u_char *, u_int, const u_char *);
+extern void nhrp_print(netdissect_options *, const u_char *, u_int);
 extern void nsh_print(netdissect_options *, const u_char *, u_int);
 extern void ntp_print(netdissect_options *, const u_char *, u_int);
 extern void oam_print(netdissect_options *, const u_char *, u_int, u_int);
diff --git a/print-gre.c b/print-gre.c
index 40496ca7..25c6ac2f 100644
--- a/print-gre.c
+++ b/print-gre.c
@@ -85,6 +85,7 @@ static const struct tok gre_flag_values[] = {
  * Ethertype values used for GRE (but not elsewhere?).
  */
 #define GRE_CDP			0x2000	/* Cisco Discovery Protocol */
+#define GRE_NHRP		0x2001	/* Next Hop Resolution Protocol */
 #define GRE_WCCP		0x883e	/* Web Cache C* Protocol */
 
 struct wccp_redirect {
@@ -310,6 +311,9 @@ gre_print_0(netdissect_options *ndo, const u_char *bp, u_int length)
 	case GRE_CDP:
 		cdp_print(ndo, bp, len);
 		break;
+	case GRE_NHRP:
+		nhrp_print(ndo, bp, len);
+		break;
 	default:
 		ND_PRINT("gre-proto-0x%x", prot);
 	}
diff --git a/print-ip-demux.c b/print-ip-demux.c
index a0a6fbd1..a71d8c12 100644
--- a/print-ip-demux.c
+++ b/print-ip-demux.c
@@ -216,6 +216,10 @@ again:
 		}
 		break;
 
+	case IPPROTO_NHRP:
+		nhrp_print(ndo, bp, length);
+		break;
+
 	case IPPROTO_NONE:
 		ND_PRINT("no next header");
 		break;
diff --git a/print-nhrp.c b/print-nhrp.c
new file mode 100644
index 00000000..2ef08ba7
--- /dev/null
+++ b/print-nhrp.c
@@ -0,0 +1,454 @@
+/*	$OpenBSD: print-nhrp.c,v 1.2 2022/12/28 21:30:19 jmc Exp $ */
+
+/*
+ * Copyright (c) 2020 Remi Locherer <remi@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* \summary: NHRP printer */
+
+/*
+ * RFC 2332 NBMA Next Hop Resolution Protocol (NHRP)
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include "netdissect-stdinc.h"
+
+#define ND_LONGJMP_FROM_TCHECK
+#include "netdissect.h"
+#include "addrtoname.h"
+#include "af.h"
+#include "ethertype.h"
+#include "interface.h"
+#include "extract.h"
+
+#define NHRP_VER_RFC2332		1
+
+#define NHRP_PKT_RESOLUTION_REQUEST	1
+#define NHRP_PKT_RESOLUTION_REPLY	2
+#define NHRP_PKT_REGISTRATION_REQUEST	3
+#define NHRP_PKT_REGISTRATION_REPLY	4
+#define NHRP_PKT_PURGE_REQUEST		5
+#define NHRP_PKT_PURGE_REPLY		6
+#define NHRP_PKT_ERROR_INDICATION	7
+
+static const struct tok pkt_types[] = {
+	{ NHRP_PKT_RESOLUTION_REQUEST,   "res request" },
+	{ NHRP_PKT_RESOLUTION_REPLY,     "res reply" },
+	{ NHRP_PKT_REGISTRATION_REQUEST, "reg request" },
+	{ NHRP_PKT_REGISTRATION_REPLY,   "reg reply" },
+	{ NHRP_PKT_PURGE_REQUEST,        "purge request" },
+	{ NHRP_PKT_PURGE_REPLY,          "purge reply" },
+	{ NHRP_PKT_ERROR_INDICATION,     "error indication" },
+	{ 0, NULL }
+};
+
+/*
+ * Fixed header part.
+ */
+struct nhrp_fixed_header {
+	nd_uint16_t	afn;		/* link layer address */
+	nd_uint16_t	pro_type;	/* protocol type (short form) */
+	nd_uint8_t	pro_snap[5];	/* protocol type (long form) */
+	nd_uint8_t	hopcnt;		/* hop count */
+	nd_uint16_t	pktsz;		/* length of the NHRP packet (octets) */
+	nd_uint16_t	chksum;		/* IP checksum over the entier packet */
+	nd_uint16_t	extoff;		/* extension offset */
+	nd_uint8_t	op_version;	/* version of address mapping and
+					   management protocol */
+	nd_uint8_t	op_type;	/* NHRP packet type */
+	nd_uint8_t	shtl;		/* type and length of src NBMA addr */
+	nd_uint8_t	sstl;		/* type and length of src NBMA
+					   subaddress */
+};
+
+/*
+ * Mandatory header part.  This is the beginning of the mandatory
+ * header; it's followed by addresses and client information entries.
+ *
+ * The mandatory header part formats are similar for
+ * all NHRP packets; the only difference is that NHRP_PKT_ERROR_INDICATION
+ * has a 16-bit error code and a 16-bit error packet offset rather
+ * than a 32-bit request ID.
+ */
+struct nhrp_mand_header {
+	nd_uint8_t	spl;		/* src proto len */
+	nd_uint8_t	dpl;		/* dst proto len */
+	nd_uint16_t	flags;		/* flags */
+        union {
+		nd_uint32_t	id;	/* request id */
+		struct {		/* error code */
+			nd_uint16_t	code;
+			nd_uint16_t	offset;
+		} err;
+	} u;
+};
+
+#define NHRP_FIXED_HEADER_LEN			20
+
+struct nhrp_cie {
+	/* client information entry */
+	nd_uint8_t	code;
+	nd_uint8_t	plen;
+	nd_uint16_t	unused;
+	nd_uint16_t	mtu;
+	nd_uint16_t	htime;
+	nd_uint8_t	cli_addr_tl;
+	nd_uint8_t	cli_saddr_tl;
+	nd_uint8_t	cli_proto_tl;
+	nd_uint8_t	pref;
+};
+
+static u_int	nhrp_print_cie(netdissect_options *ndo, const u_char *, uint16_t, uint16_t, uint16_t);
+
+/*
+ * Get string for IPv4 address pointed to by addr if addrlen is 4;
+ * otherwise, get it as a string for the sequence of hex bytes.
+ */
+static const char *
+nhrp_ipv4_addr_string(netdissect_options *ndo, const u_char *addr, u_int addrlen)
+{
+	if (addrlen == 4)
+		return (GET_IPADDR_STRING(addr));
+	else
+		return (GET_LINKADDR_STRING(addr, LINKADDR_OTHER, addrlen));
+}
+#define NHRP_IPv4_ADDR_STRING(addr, addrlen) \
+	nhrp_ipv4_addr_string(ndo, (addr), (addrlen))
+
+/*
+ * Get string for IPv6 address pointed to by addr if addrlen is 16;
+ * otherwise, get it as a string for the sequence of hex bytes.
+ */
+static const char *
+nhrp_ipv6_addr_string(netdissect_options *ndo, const u_char *addr, u_int addrlen)
+{
+	if (addrlen == 16)
+		return (GET_IP6ADDR_STRING(addr));
+	else
+		return (GET_LINKADDR_STRING(addr, LINKADDR_OTHER, addrlen));
+}
+#define NHRP_IPv6_ADDR_STRING(addr, addrlen) \
+	nhrp_ipv6_addr_string(ndo, (addr), (addrlen))
+
+/*
+ * Get string for MAC address pointed to by addr if addrlen is 6;
+ * otherwise, get it as a string for the sequence of hex bytes.
+ */
+static const char *
+nhrp_mac_addr_string(netdissect_options *ndo, const u_char *addr, u_int addrlen)
+{
+	if (addrlen == 6)
+		return (GET_ETHERADDR_STRING(addr));
+	else
+		return (GET_LINKADDR_STRING(addr, LINKADDR_OTHER, addrlen));
+}
+#define NHRP_MAC_ADDR_STRING(addr, addrlen) \
+	nhrp_mac_addr_string(ndo, (addr), (addrlen))
+
+void
+nhrp_print(netdissect_options *ndo, const u_char *bp, u_int length)
+{
+	const struct nhrp_fixed_header	*fixed_hdr;
+	uint16_t			afn;
+	uint16_t			pro_type;
+	uint16_t			pktsz;
+	uint16_t			extoff;
+	uint8_t				op_version;
+	uint8_t				op_type;
+	uint8_t				shtl, sstl;
+	const struct nhrp_mand_header	*mand_hdr;
+	uint16_t			mand_part_len;
+	uint8_t				spl, dpl;
+
+	ndo->ndo_protocol = "nhrp";
+	nd_print_protocol_caps(ndo);
+	ND_PRINT(": ");
+
+	fixed_hdr = (const struct nhrp_fixed_header *)bp;
+
+	ND_ICHECK_ZU(length, <, sizeof(*fixed_hdr));
+	op_version = GET_U_1(fixed_hdr->op_version);
+	if (op_version != NHRP_VER_RFC2332) {
+		ND_PRINT("unknown-version-%02x", op_version);
+		return;
+	}
+
+	afn = GET_BE_U_2(fixed_hdr->afn);
+	pro_type = GET_BE_U_2(fixed_hdr->pro_type);
+
+	pktsz = GET_BE_U_2(fixed_hdr->pktsz);
+	ND_ICHECKMSG_ZU("pktsz", pktsz, <, sizeof(*fixed_hdr));
+	extoff = GET_BE_U_2(fixed_hdr->extoff);
+
+	op_type = GET_U_1(fixed_hdr->op_type);
+	ND_PRINT("%s", tok2str(pkt_types, "unknown-op-type-%04x", op_type));
+
+	/*
+	 * Mandatory part length.
+	 * We already know that pktsz is large enough for the fixed
+	 * header and the fixed part of the mandatory heaer.
+	 */
+	if (extoff == 0) {
+		mand_part_len = pktsz - sizeof(*fixed_hdr);
+	} else {
+		ND_ICHECKMSG_U("extoff", extoff, >, pktsz);
+		ND_ICHECKMSG_ZU("extoff", extoff, <, sizeof(*fixed_hdr));
+		mand_part_len = extoff - sizeof(*fixed_hdr);
+	}
+	length -= sizeof(*fixed_hdr);
+	if (mand_part_len > length)
+		mand_part_len = length;
+
+	/* We start looking at the mandatory header here. */
+	ND_TCHECK_LEN(bp, sizeof(*fixed_hdr));
+	bp += sizeof(*fixed_hdr);
+	length -= sizeof(*fixed_hdr);
+	ND_ICHECK_ZU(mand_part_len, <, sizeof(*mand_hdr));
+	ND_TCHECK_LEN(bp, sizeof(*mand_hdr));
+	mand_hdr = (const struct nhrp_mand_header *)bp;
+
+//	nhrpext = p + extoff;
+//	nhrpend = p + pktsz;
+
+	switch (op_type) {
+	case NHRP_PKT_RESOLUTION_REQUEST:
+	case NHRP_PKT_RESOLUTION_REPLY:
+	case NHRP_PKT_REGISTRATION_REQUEST:
+	case NHRP_PKT_REGISTRATION_REPLY:
+	case NHRP_PKT_PURGE_REQUEST:
+	case NHRP_PKT_PURGE_REPLY:
+		ND_PRINT(", id %u", GET_BE_U_4(mand_hdr->u.id));
+		break;
+	case NHRP_PKT_ERROR_INDICATION:
+		ND_PRINT(", error %u", GET_BE_U_2(mand_hdr->u.err.code));
+		return;
+	}
+
+	shtl = GET_U_1(fixed_hdr->shtl);
+	sstl = GET_U_1(fixed_hdr->sstl);
+
+	if (ndo->ndo_vflag) {
+		ND_PRINT(", hopcnt %u", GET_U_1(fixed_hdr->hopcnt));
+
+		/* most significant bit must be 0 */
+		if (shtl & 0x80)
+			ND_PRINT(" (shtl bit 7 set)");
+
+		/* check 2nd most significant bit */
+		if (shtl & 0x40)
+			ND_PRINT(" (nbma E.154)");
+	}
+
+	/* Mandatory header part */
+	spl = GET_U_1(mand_hdr->spl);
+	dpl = GET_U_1(mand_hdr->dpl);
+	bp += sizeof(*mand_hdr);	/* Skip to the addresses */
+	mand_part_len -= sizeof(*mand_hdr);
+
+	/* Source NBMA Address, if any. */
+	if (shtl != 0) {
+		ND_ICHECK_U(mand_part_len, <, shtl);
+		switch (afn) {
+		case AFNUM_IP:
+			ND_PRINT(", src nbma %s", NHRP_IPv4_ADDR_STRING(bp, shtl));
+			break;
+		case AFNUM_IP6:
+			ND_PRINT(", src nbma %s", NHRP_IPv6_ADDR_STRING(bp, shtl));
+			break;
+		case AFNUM_802:
+			ND_PRINT(", src nbma %s", NHRP_MAC_ADDR_STRING(bp, shtl));
+			break;
+		default:
+			ND_PRINT(", unknown-nbma-addr-family-%04x (%s)",
+			         afn, GET_LINKADDR_STRING(bp, LINKADDR_OTHER, shtl));
+			break;
+		}
+		bp += shtl;
+		mand_part_len -= shtl;
+	}
+
+	/* Skip the Source NBMA SubAddress, if any */
+	if (sstl != 0) {
+		ND_ICHECK_U(mand_part_len, <, sstl);
+		ND_TCHECK_LEN(bp, sstl);
+		bp += sstl;
+		mand_part_len -= sstl;
+	}
+
+	ND_PRINT(", ");
+	/* Source Protocol Address */
+	if (spl != 0) {
+		ND_ICHECK_U(mand_part_len, <, spl);
+		switch (pro_type) {
+		case ETHERTYPE_IP:
+			ND_PRINT("%s ", NHRP_IPv4_ADDR_STRING(bp, spl));
+			break;
+		case ETHERTYPE_IPV6:
+			ND_PRINT("%s ", NHRP_IPv6_ADDR_STRING(bp, spl));
+			break;
+		default:
+			ND_PRINT("proto type %04x ", pro_type);
+			ND_PRINT("%s ", GET_LINKADDR_STRING(bp, LINKADDR_OTHER, spl));
+			break;
+		}
+		bp += spl;
+		mand_part_len -= spl;
+	}
+	ND_PRINT("->");
+	/* Destination Protocol Address */
+	if (dpl != 0) {
+		ND_ICHECK_U(mand_part_len, <, dpl);
+		switch (pro_type) {
+		case ETHERTYPE_IP:
+			ND_PRINT(" %s", NHRP_IPv4_ADDR_STRING(bp, dpl));
+			break;
+		case ETHERTYPE_IPV6:
+			ND_PRINT(" %s", NHRP_IPv6_ADDR_STRING(bp, dpl));
+			break;
+		default:
+			ND_PRINT(" %s", GET_LINKADDR_STRING(bp, LINKADDR_OTHER, dpl));
+			break;
+		}
+		bp += dpl;
+		mand_part_len -= dpl;
+	}
+
+	switch (op_type) {
+	case NHRP_PKT_RESOLUTION_REQUEST:
+	case NHRP_PKT_RESOLUTION_REPLY:
+	case NHRP_PKT_REGISTRATION_REQUEST:
+	case NHRP_PKT_REGISTRATION_REPLY:
+	case NHRP_PKT_PURGE_REQUEST:
+	case NHRP_PKT_PURGE_REPLY:
+		/* Client Information Entries */
+		while (mand_part_len != 0) {
+			u_int cie_len;
+
+			cie_len = nhrp_print_cie(ndo, bp, mand_part_len,
+			    afn, pro_type);
+			bp += cie_len;
+			mand_part_len -= cie_len;
+		}
+		break;
+	case NHRP_PKT_ERROR_INDICATION:
+		/* Contents of NHRP Packet in error */
+		break;
+	default:
+		break;
+	}
+	return;
+
+invalid:
+	nd_print_invalid(ndo);
+}
+
+static u_int
+nhrp_print_cie(netdissect_options *ndo, const u_char *data, uint16_t mand_part_len,
+               uint16_t afn, uint16_t pro_type)
+{
+	const struct nhrp_cie	*cie;
+	u_int			cie_len;
+	uint8_t			cli_addr_tl;
+	uint8_t			cli_saddr_tl;
+	uint8_t			cli_proto_tl;
+
+	cie = (const struct nhrp_cie *)data;
+	cie_len = 0;
+	ND_ICHECKMSG_ZU("remaining mandatory part length",
+	                 mand_part_len, <, sizeof(*cie));
+
+	ND_PRINT(" (code %d", GET_U_1(cie->code));
+	if (ndo->ndo_vflag)
+		ND_PRINT(", pl %d, mtu %d, htime %d, pref %d",
+		    GET_U_1(cie->plen),
+		    GET_BE_U_2(cie->mtu),
+		    GET_BE_U_2(cie->htime),
+		    GET_U_1(cie->pref));
+
+	cli_addr_tl = GET_U_1(cie->cli_addr_tl);
+	cli_saddr_tl = GET_U_1(cie->cli_saddr_tl);
+	cli_proto_tl = GET_U_1(cie->cli_proto_tl);
+
+	/* check 2nd most significant bit */
+	if (cli_addr_tl & 0x40)
+		ND_PRINT(", nbma E.154");
+
+	data += sizeof(*cie);
+	cie_len += sizeof(*cie);
+	mand_part_len -= sizeof(*cie);
+
+	if (cli_addr_tl) {
+		ND_ICHECKMSG_U("remaining mandatory part length",
+		                mand_part_len, <, cli_addr_tl);
+		switch (afn) {
+		case AFNUM_IP:
+			ND_PRINT(", nbma %s", NHRP_IPv4_ADDR_STRING(data, cli_addr_tl));
+			break;
+		case AFNUM_IP6:
+			ND_PRINT(", nbma %s", NHRP_IPv6_ADDR_STRING(data, cli_addr_tl));
+			break;
+		case AFNUM_802:
+			ND_PRINT(", nbma %s", NHRP_MAC_ADDR_STRING(data, cli_addr_tl));
+			break;
+		default:
+			ND_PRINT(", unknown-nbma-addr-family-%04x (%s)",
+			    afn, GET_LINKADDR_STRING(data, LINKADDR_OTHER, cli_addr_tl));
+			break;
+		}
+		data += cli_addr_tl;
+		cie_len += cli_addr_tl;
+		mand_part_len -= cli_addr_tl;
+	}
+
+	if (cli_saddr_tl) {
+		ND_ICHECKMSG_U("remaining mandatory part length",
+		                mand_part_len, <, cli_addr_tl);
+		ND_PRINT(", unknown-nbma-saddr-family");
+		ND_TCHECK_LEN(data, cli_saddr_tl);
+		data += cli_saddr_tl;
+		cie_len += cli_saddr_tl;
+		mand_part_len -= cli_saddr_tl;
+	}
+
+	if (cli_proto_tl) {
+		ND_ICHECKMSG_U("remaining mandatory part length",
+		                mand_part_len, <, cli_proto_tl);
+		switch (pro_type) {
+		case ETHERTYPE_IP:
+			ND_PRINT(", proto %s", NHRP_IPv4_ADDR_STRING(data, cli_proto_tl));
+			break;
+		case ETHERTYPE_IPV6:
+			ND_PRINT(", proto %s", NHRP_IPv6_ADDR_STRING(data, cli_proto_tl));
+			break;
+		default:
+			ND_PRINT(", unknown-proto-family-%04x (%s)",
+			    pro_type, GET_LINKADDR_STRING(data, LINKADDR_OTHER, cli_proto_tl));
+			break;
+		}
+		cie_len += cli_proto_tl;
+		mand_part_len -= cli_proto_tl;
+	}
+
+	ND_PRINT(")");
+
+	return (cie_len);
+
+invalid:
+	nd_print_invalid(ndo);
+	return (cie_len);
+}
diff --git a/tests/NHRP-responder-address.out b/tests/NHRP-responder-address.out
new file mode 100644
index 00000000..a7cc943e
--- /dev/null
+++ b/tests/NHRP-responder-address.out
@@ -0,0 +1,6 @@
+    1  07:30:12.301691 IP (tos 0xc0, ttl 255, id 10041, offset 0, flags [none], proto GRE (47), length 136)
+    155.1.79.2 > 6.6.6.6: GREv0, Flags [key present], key=0x2, length 116
+	NHRP: reg request, id 300, hopcnt 255, src nbma 155.1.79.2, 155.1.0.9 -> 155.1.0.6 (code 0, pl 32, mtu 17912, htime 7200, pref 0)
+    2  07:30:12.304575 IP (tos 0xc0, ttl 254, id 19697, offset 0, flags [none], proto GRE (47), length 156)
+    6.6.6.6 > 155.1.79.2: GREv0, Flags [key present], key=0x2, length 136
+	NHRP: reg reply, id 300, hopcnt 255, src nbma 155.1.79.2, 155.1.0.9 -> 155.1.0.6 (code 0, pl 32, mtu 17912, htime 7200, pref 0)
diff --git a/tests/NHRP-responder-address.pcap b/tests/NHRP-responder-address.pcap
new file mode 100644
index 00000000..12878d08
--- /dev/null
+++ b/tests/NHRP-responder-address.pcap
diff --git a/tests/NHRP_registration.out b/tests/NHRP_registration.out
new file mode 100644
index 00000000..7af82091
--- /dev/null
+++ b/tests/NHRP_registration.out
@@ -0,0 +1,12 @@
+    1  08:21:45.190210 IP (tos 0xc0, ttl 255, id 16, offset 0, flags [none], proto GRE (47), length 136)
+    169.254.100.1 > 169.254.100.5: GREv0, Flags [key present], key=0x2, length 116
+	NHRP: reg request, id 1, hopcnt 255, src nbma 169.254.100.1, 155.1.0.1 -> 155.1.0.5 (code 0, pl 32, mtu 17912, htime 7200, pref 0)
+    2  08:21:45.192105 IP (tos 0xc0, ttl 255, id 16, offset 0, flags [none], proto GRE (47), length 156)
+    169.254.100.5 > 169.254.100.1: GREv0, Flags [key present], key=0x2, length 136
+	NHRP: reg reply, id 1, hopcnt 255, src nbma 169.254.100.1, 155.1.0.1 -> 155.1.0.5 (code 0, pl 32, mtu 17912, htime 7200, pref 0)
+    3  08:21:46.188858 IP (tos 0xc0, ttl 255, id 17, offset 0, flags [none], proto GRE (47), length 136)
+    169.254.100.1 > 169.254.100.5: GREv0, Flags [key present], key=0x2, length 116
+	NHRP: reg request, id 2, hopcnt 255, src nbma 169.254.100.1, 155.1.0.1 -> 155.1.0.5 (code 0, pl 32, mtu 17912, htime 7200, pref 0)
+    4  08:21:46.189213 IP (tos 0xc0, ttl 255, id 17, offset 0, flags [none], proto GRE (47), length 156)
+    169.254.100.5 > 169.254.100.1: GREv0, Flags [key present], key=0x2, length 136
+	NHRP: reg reply, id 2, hopcnt 255, src nbma 169.254.100.1, 155.1.0.1 -> 155.1.0.5 (code 0, pl 32, mtu 17912, htime 7200, pref 0)
diff --git a/tests/NHRP_registration.pcap b/tests/NHRP_registration.pcap
new file mode 100644
index 00000000..2dc7deac
--- /dev/null
+++ b/tests/NHRP_registration.pcap
diff --git a/tests/TESTLIST b/tests/TESTLIST
index bdb88273..95592bd6 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -907,3 +907,10 @@ various_gre			various_gre.pcap		various_gre.out	-v
 
 # DHCP ZTP(RFC5970) and SZTP(RFC8572) tests
 dhcpv4v6-rfc5970-rfc8572        dhcpv4v6-rfc5970-rfc8572.pcap           dhcpv4v6-rfc5970-rfc8572.out    -vv
+
+# NHRP tests
+ios_nhrp			ios_nhrp.pcap			ios_nhrp.out	-v
+NHRP_registration		NHRP_registration.pcap		NHRP_registration.out	-v
+NHRP-responder-address		NHRP-responder-address.pcap	NHRP-responder-address.out	-v
+nhrp-trace			nhrp-trace.pcap			nhrp-trace.out	-v
+nhrp				nhrp.pcap			nhrp.out	-v
diff --git a/tests/ios_nhrp.out b/tests/ios_nhrp.out
new file mode 100644
index 00000000..1c93507b
--- /dev/null
+++ b/tests/ios_nhrp.out
@@ -0,0 +1,3 @@
+    1  17:40:27.474286 IP (tos 0xc0, ttl 255, id 8, offset 0, flags [none], proto GRE (47), length 105)
+    10.0.12.2 > 10.0.12.1: GREv0, Flags [none], length 85
+	NHRP: reg request, id 5, hopcnt 255, src nbma 10.0.12.2, 192.168.0.2 -> 192.168.0.1 (code 0, pl 255, mtu 1514, htime 30, pref 0)
diff --git a/tests/ios_nhrp.pcap b/tests/ios_nhrp.pcap
new file mode 100644
index 00000000..36e45ec4
--- /dev/null
+++ b/tests/ios_nhrp.pcap
diff --git a/tests/nhrp-trace.out b/tests/nhrp-trace.out
new file mode 100644
index 00000000..632164a9
--- /dev/null
+++ b/tests/nhrp-trace.out
@@ -0,0 +1,12 @@
+    1  07:11:37.354029 IP (tos 0xc0, ttl 255, id 22, offset 0, flags [none], proto GRE (47), length 126)
+    192.168.200.1 > 192.168.200.3: GREv0, Flags [key present], key=0x3e8, length 106
+	NHRP: unknown-op-type-0008, hopcnt 255, src nbma 192.168.200.1, 10.255.255.1 -> 10.255.255.3
+    2  07:11:37.366110 IP (tos 0xc0, ttl 255, id 14, offset 0, flags [none], proto GRE (47), length 114)
+    192.168.200.3 > 192.168.200.1: GREv0, Flags [key present], key=0x3e8, length 94
+	NHRP: res request, id 5, hopcnt 255, src nbma 192.168.200.3, 10.255.255.3 -> 10.255.255.2 (code 0, pl 0, mtu 1514, htime 7200, pref 0)
+    3  07:11:37.378373 IP (tos 0xc0, ttl 255, id 24, offset 0, flags [none], proto GRE (47), length 134)
+    192.168.200.1 > 192.168.200.2: GREv0, Flags [key present], key=0x3e8, length 114
+	NHRP: res request, id 5, hopcnt 254, src nbma 192.168.200.3, 10.255.255.3 -> 10.255.255.2 (code 0, pl 0, mtu 1514, htime 7200, pref 0)
+    4  07:11:37.385926 IP (tos 0xc0, ttl 255, id 20, offset 0, flags [none], proto GRE (47), length 162)
+    192.168.200.2 > 192.168.200.3: GREv0, Flags [key present], key=0x3e8, length 142
+	NHRP: res reply, id 5, hopcnt 255, src nbma 192.168.200.3, 10.255.255.3 -> 10.255.255.2 (code 0, pl 32, mtu 1514, htime 7200, pref 0, nbma 192.168.200.2, proto 10.255.255.2)
diff --git a/tests/nhrp-trace.pcap b/tests/nhrp-trace.pcap
new file mode 100644
index 00000000..40cf4ae5
--- /dev/null
+++ b/tests/nhrp-trace.pcap
diff --git a/tests/nhrp.out b/tests/nhrp.out
new file mode 100644
index 00000000..43551736
--- /dev/null
+++ b/tests/nhrp.out
@@ -0,0 +1,75 @@
+    1  07:19:51.987024 IP (tos 0xc0, ttl 255, id 123, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.14: GREv0, Flags [none], length 108
+	NHRP: reg request, id 21, hopcnt 255, src nbma 100.1.2.27, 10.65.0.3 -> 10.65.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+    2  07:19:51.988481 IP (tos 0xc0, ttl 249, id 901, offset 0, flags [none], proto GRE (47), length 148)
+    100.1.0.14 > 100.1.2.27: GREv0, Flags [none], length 128
+	NHRP: reg reply, id 21, hopcnt 255, src nbma 100.1.2.27, 10.65.0.3 -> 10.65.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+    3  07:19:52.987348 IP (tos 0xc0, ttl 255, id 124, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.14: GREv0, Flags [none], length 108
+	NHRP: reg request, id 22, hopcnt 255, src nbma 100.1.2.27, 10.65.0.3 -> 10.65.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+    4  07:19:52.989260 IP (tos 0xc0, ttl 249, id 902, offset 0, flags [none], proto GRE (47), length 148)
+    100.1.0.14 > 100.1.2.27: GREv0, Flags [none], length 128
+	NHRP: reg reply, id 22, hopcnt 255, src nbma 100.1.2.27, 10.65.0.3 -> 10.65.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+    5  07:22:55.203280 IP (tos 0xc0, ttl 255, id 1, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.15: GREv0, Flags [none], length 108
+	NHRP: reg request, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+    6  07:22:55.204580 IP (tos 0xc0, ttl 251, id 1778, offset 0, flags [none], proto GRE (47), length 148)
+    100.1.0.15 > 100.1.2.27: GREv0, Flags [none], length 128
+	NHRP: reg reply, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+    7  07:22:55.407426 IP (tos 0xc0, ttl 255, id 1, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.14: GREv0, Flags [none], length 108
+	NHRP: reg request, id 2, hopcnt 255, src nbma 100.1.2.27, 10.65.0.3 -> 10.65.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+    8  07:22:55.408874 IP (tos 0xc0, ttl 249, id 924, offset 0, flags [none], proto GRE (47), length 148)
+    100.1.0.14 > 100.1.2.27: GREv0, Flags [none], length 128
+	NHRP: reg reply, id 2, hopcnt 255, src nbma 100.1.2.27, 10.65.0.3 -> 10.65.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+    9  07:22:56.785123 IP (tos 0xc0, ttl 255, id 2, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.15: GREv0, Flags [none], length 108
+	NHRP: reg request, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   10  07:22:56.786403 IP (tos 0xc0, ttl 251, id 1779, offset 0, flags [none], proto GRE (47), length 148)
+    100.1.0.15 > 100.1.2.27: GREv0, Flags [none], length 128
+	NHRP: reg reply, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   11  07:23:00.452506 IP (tos 0xc0, ttl 255, id 3, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.15: GREv0, Flags [none], length 108
+	NHRP: reg request, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   12  07:23:00.453960 IP (tos 0xc0, ttl 251, id 1780, offset 0, flags [none], proto GRE (47), length 148)
+    100.1.0.15 > 100.1.2.27: GREv0, Flags [none], length 128
+	NHRP: reg reply, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   13  07:23:08.136007 IP (tos 0xc0, ttl 255, id 4, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.15: GREv0, Flags [none], length 108
+	NHRP: reg request, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   14  07:23:20.172765 IP (tos 0xc0, ttl 255, id 5, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.15: GREv0, Flags [none], length 108
+	NHRP: reg request, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   15  07:23:45.699548 IP (tos 0xc0, ttl 255, id 6, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.15: GREv0, Flags [none], length 108
+	NHRP: reg request, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   16  07:24:33.740180 IP (tos 0xc0, ttl 255, id 7, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.15: GREv0, Flags [none], length 108
+	NHRP: reg request, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   17  07:25:23.946120 IP (tos 0xc0, ttl 255, id 8, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.15: GREv0, Flags [none], length 108
+	NHRP: reg request, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   18  07:26:27.340081 IP (tos 0xc0, ttl 255, id 9, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.15: GREv0, Flags [none], length 108
+	NHRP: reg request, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   19  07:26:27.341463 IP (tos 0xc0, ttl 251, id 1, offset 0, flags [none], proto GRE (47), length 148)
+    100.1.0.15 > 100.1.2.27: GREv0, Flags [none], length 128
+	NHRP: reg reply, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   20  07:27:21.911625 IP (tos 0xc0, ttl 255, id 10, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.15: GREv0, Flags [none], length 108
+	NHRP: reg request, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   21  07:27:21.912680 IP (tos 0xc0, ttl 251, id 11, offset 0, flags [none], proto GRE (47), length 148)
+    100.1.0.15 > 100.1.2.27: GREv0, Flags [none], length 128
+	NHRP: reg reply, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   22  07:28:23.385265 IP (tos 0xc0, ttl 255, id 11, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.15: GREv0, Flags [none], length 108
+	NHRP: reg request, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   23  07:28:23.386428 IP (tos 0xc0, ttl 251, id 16, offset 0, flags [none], proto GRE (47), length 148)
+    100.1.0.15 > 100.1.2.27: GREv0, Flags [none], length 128
+	NHRP: reg reply, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   24  07:29:23.772910 IP (tos 0xc0, ttl 255, id 12, offset 0, flags [none], proto GRE (47), length 128)
+    100.1.2.27 > 100.1.0.15: GREv0, Flags [none], length 108
+	NHRP: reg request, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
+   25  07:29:23.774010 IP (tos 0xc0, ttl 251, id 20, offset 0, flags [none], proto GRE (47), length 148)
+    100.1.0.15 > 100.1.2.27: GREv0, Flags [none], length 128
+	NHRP: reg reply, id 1, hopcnt 255, src nbma 100.1.2.27, 10.64.0.3 -> 10.64.0.1 (code 0, pl 32, mtu 17916, htime 7200, pref 0)
diff --git a/tests/nhrp.pcap b/tests/nhrp.pcap
new file mode 100644
index 00000000..02f764f4
--- /dev/null
+++ b/tests/nhrp.pcap