From: Josh <jrosenba@cisco.com>
Date: Tue, 2 Sep 2014 23:28:39 +0000 (-0400)
Subject: fixed bugs in codec_logging
X-Git-Tag: 3.0.0-233~1414^2~2^2~14
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=525ef2d8a144ac003ed3d7649fa2af97847f7b02;p=thirdparty%2Fsnort3.git

fixed bugs in codec_logging
---

diff --git a/src/codecs/ip/cd_frag.cc b/src/codecs/ip/cd_frag.cc
index 01071cc35..d94f4ea27 100644
--- a/src/codecs/ip/cd_frag.cc
+++ b/src/codecs/ip/cd_frag.cc
@@ -52,7 +52,7 @@ public:
     virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
         Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
 
-    virtual void log(TextLog*, const uint8_t* /*raw_pkt*/,
+    virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
                     const Packet* const);
     virtual void get_protocol_ids(std::vector<uint16_t>&);
     
@@ -152,21 +152,18 @@ void Ipv6FragCodec::get_protocol_ids(std::vector<uint16_t>& v)
 { v.push_back(IPPROTO_ID_FRAGMENT); }
 
 
-void Ipv6FragCodec::log(TextLog* log, const uint8_t* raw_pkt,
+void Ipv6FragCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
                     const Packet* const)
 {
     const ip::IP6Frag* fragh = reinterpret_cast<const ip::IP6Frag*>(raw_pkt);
     const uint16_t offlg = ntohs(fragh->get_off());
 
 
-    TextLog_Print(log, "Frag6: Next:%s(%02X) Off:%u ID:%u",
-            PacketManager::get_proto_name(fragh->ip6f_nxt), fragh->ip6f_nxt,
-            (offlg >> 3), ntohl(fragh->get_id()));
+    TextLog_Print(text_log, "\tNext:0x%02X Off:%u ID:%u",
+            fragh->ip6f_nxt, (offlg >> 3), ntohl(fragh->get_id()));
 
     if (offlg & ip::IP6F_MF_MASK)
-        TextLog_Puts(log, " MF");
-
-    TextLog_NewLine(log);
+        TextLog_Puts(text_log, " MF");
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/codecs/ip/cd_gre.cc b/src/codecs/ip/cd_gre.cc
index 08cea1aa4..f97d2a0cb 100644
--- a/src/codecs/ip/cd_gre.cc
+++ b/src/codecs/ip/cd_gre.cc
@@ -72,7 +72,7 @@ public:
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
     virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
         Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
-     void log(TextLog* /*log*/, const uint8_t* /*raw_pkt*/,
+     void log(TextLog* const, const uint8_t* /*raw_pkt*/,
                     const Packet* const);
 
 
@@ -243,12 +243,13 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
 }
 
 
-void GreCodec::log(TextLog* log, const uint8_t* raw_pkt,
+void GreCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
                     const Packet* const)
 {
     const gre::GREHdr *greh = reinterpret_cast<const gre::GREHdr *>(raw_pkt);
 
-    TextLog_Print(log, "GRE  version:%u flags:0x%02X ether-type:%s(0x%04X)\n",
+    TextLog_Putc(text_log, '\t');
+    TextLog_Print(text_log, "version:%u flags:0x%02X ether-type:%s(0x%04X)",
             greh->get_version(), greh->flags,
             PacketManager::get_proto_name(greh->get_proto()),
             greh->get_proto());
diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc
index 89de5a60b..f899bd880 100644
--- a/src/codecs/ip/cd_icmp4.cc
+++ b/src/codecs/ip/cd_icmp4.cc
@@ -36,6 +36,7 @@
 #include "codecs/sf_protocols.h"
 #include "codecs/ip/ip_util.h"
 #include "packet_io/active.h"
+#include "log/text_log.h"
 
 namespace{
 
@@ -95,6 +96,8 @@ public:
     virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
     virtual bool update(Packet*, Layer*, uint32_t* len);
     virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
+    virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+                    const Packet* const);
 
 private:
     void ICMP4AddrTests (Packet* );
@@ -131,9 +134,6 @@ bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len,
 
     if(raw_len < icmp::ICMP_HEADER_LEN)
     {
-        DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
-            "WARNING: Truncated ICMP4 header (%d bytes).\n", raw_len););
-
         codec_events::decoder_event(p, DECODE_ICMP4_HDR_TRUNC);
         p->icmph = NULL;
         return false;
@@ -141,7 +141,7 @@ bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len,
 
     /* set the header ptr first */
 
-    p->icmph = reinterpret_cast<ICMPHdr *>(const_cast<uint8_t *> (raw_pkt));
+    p->icmph = reinterpret_cast<const ICMPHdr *>(raw_pkt);
 
     switch (p->icmph->type)
     {
@@ -213,9 +213,6 @@ bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len,
 
     lyr_len =  icmp::ICMP_HEADER_LEN;
 
-    DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "ICMP type: %d   code: %d\n",
-                p->icmph->type, p->icmph->code););
-
     switch(p->icmph->type)
     {
         case icmp::IcmpType::ECHO_4:
@@ -338,6 +335,246 @@ void Icmp4Codec::ICMP4MiscTests (Packet *p)
         codec_events::decoder_event(p, DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED);
 }
 
+/******************************************************************
+ *************************  L O G G E R  **************************
+ ******************************************************************/
+
+void Icmp4Codec::log(TextLog* const log, const uint8_t* raw_pkt,
+                    const Packet* const)
+{
+
+    const icmp::ICMPHdr* const icmph = reinterpret_cast<const ICMPHdr *>(raw_pkt);
+
+    /* 32 digits plus 7 colons and a NULL byte */
+    char buf[8*4 + 7 + 1];
+
+    TextLog_Putc(log, '\t');
+    TextLog_Print(log, "Type:%d  Code:%d  ", icmph->type, icmph->code);
+
+    switch(icmph->type)
+    {
+        case icmp::IcmpType::ECHOREPLY:
+            TextLog_Print(log, "ID:%d  Seq:%d  ", ntohs(icmph->s_icmp_id),
+                    ntohs(icmph->s_icmp_seq));
+            TextLog_Puts(log, "ECHO REPLY");
+            break;
+
+        case icmp::IcmpType::DEST_UNREACH:
+            TextLog_Puts(log, "DESTINATION UNREACHABLE: ");
+            switch(icmph->code)
+            {
+                case icmp::IcmpCode::NET_UNREACH:
+                    TextLog_Puts(log, "NET UNREACHABLE");
+                    break;
+
+                case icmp::IcmpCode::HOST_UNREACH:
+                    TextLog_Puts(log, "HOST UNREACHABLE");
+                    break;
+
+                case icmp::IcmpCode::PROT_UNREACH:
+                    TextLog_Puts(log, "PROTOCOL UNREACHABLE");
+                    break;
+
+                case icmp::IcmpCode::PORT_UNREACH:
+                    TextLog_Puts(log, "PORT UNREACHABLE");
+                    break;
+
+                case icmp::IcmpCode::FRAG_NEEDED:
+                    TextLog_Print(log, "FRAGMENTATION NEEDED,\n\tDF SET,"
+                            " NEXT LINK MTU: %u",
+                            ntohs(icmph->s_icmp_nextmtu));
+                    break;
+
+                case icmp::IcmpCode::SR_FAILED:
+                    TextLog_Puts(log, "SOURCE ROUTE FAILED");
+                    break;
+
+                case icmp::IcmpCode::NET_UNKNOWN:
+                    TextLog_Puts(log, "NET UNKNOWN");
+                    break;
+
+                case icmp::IcmpCode::HOST_UNKNOWN:
+                    TextLog_Puts(log, "HOST UNKNOWN");
+                    break;
+
+                case icmp::IcmpCode::HOST_ISOLATED:
+                    TextLog_Puts(log, "HOST ISOLATED");
+                    break;
+
+                case icmp::IcmpCode::PKT_FILTERED_NET:
+                    TextLog_Puts(log, "ADMINISTRATIVELY PROHIBITED NETWORK FILTERED");
+                    break;
+
+                case icmp::IcmpCode::PKT_FILTERED_HOST:
+                    TextLog_Puts(log, "ADMINISTRATIVELY PROHIBITED HOST FILTERED");
+                    break;
+
+                case icmp::IcmpCode::NET_UNR_TOS:
+                    TextLog_Puts(log, "NET UNREACHABLE FOR TOS");
+                    break;
+
+                case icmp::IcmpCode::HOST_UNR_TOS:
+                    TextLog_Puts(log, "HOST UNREACHABLE FOR TOS");
+                    break;
+
+                case icmp::IcmpCode::PKT_FILTERED:
+                    TextLog_Puts(log, "ADMINISTRATIVELY PROHIBITED,\n\tPACKET FILTERED");
+                    break;
+
+                case icmp::IcmpCode::PREC_VIOLATION:
+                    TextLog_Puts(log, "PREC VIOLATION");
+                    break;
+
+                case icmp::IcmpCode::PREC_CUTOFF:
+                    TextLog_Puts(log, "PREC CUTOFF");
+                    break;
+
+                default:
+                    TextLog_Puts(log, "UNKNOWN");
+                    break;
+
+            }
+            break;
+
+        case icmp::IcmpType::SOURCE_QUENCH:
+            TextLog_Puts(log, "SOURCE QUENCH");
+            break;
+
+        case icmp::IcmpType::REDIRECT:
+            TextLog_Puts(log, "REDIRECT");
+            switch(icmph->code)
+            {
+                case icmp::IcmpCode::REDIR_NET:
+                    TextLog_Puts(log, " NET");
+                    break;
+
+                case icmp::IcmpCode::REDIR_HOST:
+                    TextLog_Puts(log, " HOST");
+                    break;
+
+                case icmp::IcmpCode::REDIR_TOS_NET:
+                    TextLog_Puts(log, " TOS NET");
+                    break;
+
+                case icmp::IcmpCode::REDIR_TOS_HOST:
+                    TextLog_Puts(log, " TOS HOST");
+                    break;
+
+                default:
+                    break;
+            }
+
+/* written this way since inet_ntoa was typedef'ed to use sfip_ntoa
+ * which requires sfip_t instead of inaddr's.  This call to inet_ntoa
+ * is a rare case that doesn't use sfip_t's. */
+
+// XXX-IPv6 NOT YET IMPLEMENTED - IPV6 addresses technically not supported - need to change ICMP
+
+            /* no inet_ntop in Windows */
+            sfip_raw_ntop(AF_INET, (const void *)(&icmph->s_icmp_gwaddr.s_addr),
+                          buf, sizeof(buf));
+            TextLog_Print(log, " NEW GW: %s", buf);
+            break;
+
+        case icmp::IcmpType::ECHO_4:
+            TextLog_Print(log, "ID:%d   Seq:%d  ", ntohs(icmph->s_icmp_id),
+                    ntohs(icmph->s_icmp_seq));
+            TextLog_Puts(log, "ECHO");
+            break;
+
+        case icmp::IcmpType::ROUTER_ADVERTISE:
+            TextLog_Print(log, "ROUTER ADVERTISMENT: "
+                    "Num addrs: %d Addr entry size: %d Lifetime: %u",
+                    icmph->s_icmp_num_addrs, icmph->s_icmp_wpa,
+                    ntohs(icmph->s_icmp_lifetime));
+            break;
+
+        case icmp::IcmpType::ROUTER_SOLICIT:
+            TextLog_Puts(log, "ROUTER SOLICITATION");
+            break;
+
+        case icmp::IcmpType::TIME_EXCEEDED:
+            TextLog_Puts(log, "TTL EXCEEDED");
+            switch(icmph->code)
+            {
+                case icmp::IcmpCode::TIMEOUT_TRANSIT:
+                    TextLog_Puts(log, " IN TRANSIT");
+                    break;
+
+                case icmp::IcmpCode::TIMEOUT_REASSY:
+                    TextLog_Puts(log, " TIME EXCEEDED IN FRAG REASSEMBLY");
+                    break;
+
+                default:
+                    break;
+            }
+
+            break;
+
+        case icmp::IcmpType::PARAMETERPROB:
+            TextLog_Puts(log, "PARAMETER PROBLEM");
+            switch(icmph->code)
+            {
+                case icmp::IcmpCode::PARAM_BADIPHDR:
+                    TextLog_Print(log, ": BAD IP HEADER BYTE %u",
+                            icmph->s_icmp_pptr);
+                    break;
+
+                case icmp::IcmpCode::PARAM_OPTMISSING:
+                    TextLog_Puts(log, ": OPTION MISSING");
+                    break;
+
+                case icmp::IcmpCode::PARAM_BAD_LENGTH:
+                    TextLog_Puts(log, ": BAD LENGTH");
+                    break;
+
+                default:
+                    break;
+            }
+
+            break;
+
+        case icmp::IcmpType::TIMESTAMP:
+            TextLog_Print(log, "ID: %u  Seq: %u  TIMESTAMP REQUEST",
+                    ntohs(icmph->s_icmp_id), ntohs(icmph->s_icmp_seq));
+            break;
+
+        case icmp::IcmpType::TIMESTAMPREPLY:
+            TextLog_Print(log, "ID: %u  Seq: %u  TIMESTAMP REPLY:\n\t"
+                    "Orig: %u Rtime: %u  Ttime: %u",
+                    ntohs(icmph->s_icmp_id), ntohs(icmph->s_icmp_seq),
+                    icmph->s_icmp_otime, icmph->s_icmp_rtime,
+                    icmph->s_icmp_ttime);
+            break;
+
+        case icmp::IcmpType::INFO_REQUEST:
+            TextLog_Print(log, "ID: %u  Seq: %u  INFO REQUEST",
+                    ntohs(icmph->s_icmp_id), ntohs(icmph->s_icmp_seq));
+            break;
+
+        case icmp::IcmpType::INFO_REPLY:
+            TextLog_Print(log, "ID: %u  Seq: %u  INFO REPLY",
+                    ntohs(icmph->s_icmp_id), ntohs(icmph->s_icmp_seq));
+            break;
+
+        case icmp::IcmpType::ADDRESS:
+            TextLog_Print(log, "ID: %u  Seq: %u  ADDRESS REQUEST",
+                    ntohs(icmph->s_icmp_id), ntohs(icmph->s_icmp_seq));
+            break;
+
+        case icmp::IcmpType::ADDRESSREPLY:
+            TextLog_Print(log, "ID: %u  Seq: %u  ADDRESS REPLY: 0x%08X",
+                    ntohs(icmph->s_icmp_id), ntohs(icmph->s_icmp_seq),
+                    (u_int) ntohl(icmph->s_icmp_mask));
+            break;
+
+        default:
+            TextLog_Puts(log, "UNKNOWN");
+
+            break;
+    }
+}
+
 /******************************************************************
  ******************** E N C O D E R  ******************************
  ******************************************************************/
diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc
index d7caf8795..8149e2b45 100644
--- a/src/codecs/ip/cd_icmp6.cc
+++ b/src/codecs/ip/cd_icmp6.cc
@@ -37,6 +37,7 @@
 #include "codecs/ip/checksum.h"
 #include "codecs/ip/ip_util.h"
 #include "packet_io/active.h"
+#include "log/text_log.h"
 
 
 namespace
@@ -82,6 +83,8 @@ public:
         Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
     virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
     virtual bool update(Packet*, Layer*, uint32_t* len);
+    virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+        const Packet* const);
 };
 
 
@@ -339,7 +342,18 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len,
 
 
 /******************************************************************
- ******************** E N C O D E R  ******************************
+ *************************  L O G G E R   *************************
+ ******************************************************************/
+
+void Icmp6Codec::log(TextLog* const text_log, const uint8_t* raw_pkt,
+                const Packet* const)
+{
+    const icmp::ICMP6Hdr* const icmph = reinterpret_cast<const icmp::ICMP6Hdr*>(raw_pkt);
+    TextLog_Print(text_log, "\tsType:%d  Code:%d  ", icmph->type, icmph->code);
+}
+
+/******************************************************************
+ ************************* E N C O D E R  *************************
  ******************************************************************/
 
 
@@ -436,24 +450,16 @@ bool Icmp6Codec::update (Packet* p, Layer* lyr, uint32_t* len)
 //-------------------------------------------------------------------------
 
 static Module* mod_ctor()
-{
-    return new Icmp6Module;
-}
+{ return new Icmp6Module; }
 
 static void mod_dtor(Module* m)
-{
-    delete m;
-}
+{ delete m; }
 
 static Codec* ctor(Module*)
-{
-    return new Icmp6Codec();
-}
+{ return new Icmp6Codec(); }
 
 static void dtor(Codec *cd)
-{
-    delete cd;
-}
+{ delete cd; }
 
 static const CodecApi ipv6_api =
 {
diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index 797c98334..8bf04f060 100644
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -108,7 +108,7 @@ public:
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
     virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
         Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
-    virtual void log(TextLog*, const uint8_t* /*raw_pkt*/,
+    virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
         const Packet* const);
     virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
     virtual bool update(Packet*, Layer*, uint32_t* len);
@@ -608,7 +608,7 @@ static void DecodeIPOptions(const uint8_t *start, uint32_t o_len, Packet *p)
             byte_skip = 1;
             break;
         default:
-            /* handle all the dynamic features */
+            /* FIXIT-L - J ip option validation should be updated.  3 of these fields are useless */
             code = OptLenValidate(option_ptr, end_ptr, len_ptr, -1,
                     reinterpret_cast<Options *>(&p->ip_options[opt_count]), &byte_skip);
         }
@@ -702,14 +702,16 @@ struct ip4_addr
     };
 };
 
-void Ipv4Codec::log(TextLog* log, const uint8_t* raw_pkt, const Packet* const p)
+void Ipv4Codec::log(TextLog* const text_log, const uint8_t* raw_pkt,
+    const Packet* const p)
 {
     const IP4Hdr* const ip4h = reinterpret_cast<const IP4Hdr*>(raw_pkt);
+    TextLog_Putc(text_log, '\t');
 
     // FIXIT-H  -->  This does NOT obfuscate correctly
     if (ScObfuscate())
     {
-        TextLog_Print(log, "IPv4  xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx");
+        TextLog_Print(text_log, "xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx");
     }
     else
     {
@@ -717,48 +719,51 @@ void Ipv4Codec::log(TextLog* log, const uint8_t* raw_pkt, const Packet* const p)
         src.addr32 = ip4h->get_src();
         dst.addr32 = ip4h->get_dst();
 
-        TextLog_Print(log, "%d.%d.%d.%d -> %d.%d.%d.%d",
+        TextLog_Print(text_log, "%d.%d.%d.%d -> %d.%d.%d.%d",
             (int)src.addr8[0], (int)src.addr8[1],
             (int)src.addr8[2], (int)src.addr8[3],
             (int)dst.addr8[0], (int)dst.addr8[1],
             (int)dst.addr8[2], (int)dst.addr8[3]);
     }
 
-    TextLog_NewLine(log);
+    TextLog_NewLine(text_log);
+    TextLog_Putc(text_log, '\t');
+
 
     const uint16_t hlen = ip4h->get_hlen() << 2;
     const uint16_t len = ntohs(ip4h->get_len());
     const uint16_t frag_off = ntohs(ip4h->get_off());
 
-    TextLog_Print(log, "\tNext:%s(%02X) TTL:%u TOS:0x%X ID:%u IpLen:%u DgmLen:%u",
-            PacketManager::get_proto_name(ip4h->get_proto()),
+    TextLog_Print(text_log, "Next:0x%02X TTL:%u TOS:0x%X ID:%u IpLen:%u DgmLen:%u",
             ip4h->get_proto(), ip4h->get_ttl(), ip4h->get_tos(),
             ip4h->get_id(), hlen, len);
 
 
     /* print the reserved bit if it's set */
     if(frag_off & 0x8000)
-        TextLog_Puts(log, " RB");
+        TextLog_Puts(text_log, " RB");
 
     /* printf more frags/don't frag bits */
     if(frag_off & 0x4000)
-        TextLog_Puts(log, " DF");
+        TextLog_Puts(text_log, " DF");
 
     if(frag_off & 0x2000)
-        TextLog_Puts(log, " MF");
-
-    TextLog_NewLine(log);
+        TextLog_Puts(text_log, " MF");
 
     /* print IP options */
     if(p->ip_option_count > 0)
     {
-        LogIpOptions(log, p);
+        TextLog_Putc(text_log, '\t');
+        TextLog_NewLine(text_log);
+        LogIpOptions(text_log, p);
     }
 
 
     if( p->decode_flags & DECODE__FRAG)
     {
-        TextLog_Print(log, "Frag Offset: 0x%04X   Frag Size: 0x%04X\n",
+        TextLog_NewLine(text_log);
+        TextLog_Putc(text_log, '\t');
+        TextLog_Print(text_log, "Frag Offset: 0x%04X   Frag Size: 0x%04X\n",
                 (frag_off & 0x1FFF), (len - hlen));
     }
 }
diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc
index 31d3ba8fc..147537435 100644
--- a/src/codecs/ip/cd_ipv6.cc
+++ b/src/codecs/ip/cd_ipv6.cc
@@ -97,7 +97,7 @@ public:
     virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
     virtual bool update(Packet*, Layer*, uint32_t* len);
     virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
-    virtual void log(TextLog*, const uint8_t* /*raw_pkt*/,
+    virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
                     const Packet* const) ;
 
 private:
@@ -601,27 +601,25 @@ static inline int CheckTeredoPrefix(const ip::IP6Hdr* const hdr)
  *********************  L O G G E R  ******************************
 *******************************************************************/
 
-void Ipv6Codec::log(TextLog* log, const uint8_t* raw_pkt,
+void Ipv6Codec::log(TextLog* const text_log, const uint8_t* raw_pkt,
                     const Packet* const)
 {
     const ip::IP6Hdr* const ip6h = reinterpret_cast<const ip::IP6Hdr*>(raw_pkt);
-
-
-    TextLog_NewLine(log);
+    TextLog_Putc(text_log, '\t');
 
     //FIXIT-H  -->  This does NOT obfuscate correctly
 
     // FIXIT-H  -->  This does NOT obfuscate correctly
     if (ScObfuscate())
     {
-        TextLog_Print(log, "IPv6  x:x:x:x::x:x:x:x -> x:x:x:x::x:x:x:x");
+        TextLog_Print(text_log, "x:x:x:x::x:x:x:x -> x:x:x:x::x:x:x:x");
     }
     else
     {
         const ip::snort_in6_addr* const src = ip6h->get_src();
         const ip::snort_in6_addr* const dst = ip6h->get_dst();
 
-        TextLog_Print(log, "%02X%02X:%02X%02X:%02X%02X:%02X%02X:%02X%02X:"
+        TextLog_Print(text_log, "%02X%02X:%02X%02X:%02X%02X:%02X%02X:%02X%02X:"
                             "%02X%02X:%02X%02X:%02X%02X -> %02X%02X:%02X%02X:"
                             "%02X%02X:%02X%02X:%02X%02X:%02X%02X",
             (int)src->u6_addr8[0], (int)src->u6_addr8[1], (int)src->u6_addr8[2],
@@ -638,15 +636,13 @@ void Ipv6Codec::log(TextLog* log, const uint8_t* raw_pkt,
     }
 
 
-    TextLog_NewLine(log);
+    TextLog_NewLine(text_log);
+    TextLog_Putc(text_log, '\t');
 
 
-    TextLog_Print(log, "\tNext:%s(%02X) TTL:%u TOS:0x%X DgmLen:%u",
-            PacketManager::get_proto_name(ip6h->get_next()),
+    TextLog_Print(text_log, "Next:0x%02X TTL:%u TOS:0x%X DgmLen:%u",
             ip6h->get_next(), ip6h->get_hop_lim(), ip6h->get_tos(),
             ntohs(ip6h->get_len()));
-
-    TextLog_NewLine(log);
 }
 
 
diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc
index 32777fb7d..1b2b42749 100644
--- a/src/codecs/ip/cd_tcp.cc
+++ b/src/codecs/ip/cd_tcp.cc
@@ -107,8 +107,8 @@ public:
 
     virtual PROTO_ID get_proto_id() { return PROTO_TCP; };
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual void log(TextLog*, const uint8_t* /*raw_pkt*/,
-                    const Packet* const) ;
+    virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+                    const Packet* const);
     virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
         Packet *, uint16_t &lyr_len, uint16_t &);
     virtual bool encode(EncState*, Buffer* out, const uint8_t *raw_in);
@@ -618,34 +618,35 @@ static inline void TCPMiscTests(Packet *p)
  ******************************************************************/
 
 
-void TcpCodec::log(TextLog* log, const uint8_t* raw_pkt,
+void TcpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
                     const Packet* const p)
 {
     char tcpFlags[9];
 
     const tcp::TCPHdr* tcph = reinterpret_cast<const tcp::TCPHdr*>(raw_pkt);
-    TextLog_Puts(log, "TCP  ");
+    TextLog_Putc(text_log, '\t');
 
     /* print TCP flags */
     CreateTCPFlagString(tcph, tcpFlags);
-    TextLog_Puts(log, tcpFlags); /* We don't care about the NULL */
+    TextLog_Puts(text_log, tcpFlags); /* We don't care about the NULL */
 
     /* print other TCP info */
-    TextLog_Print(log, " SrcPort:%u  DstPort:%u  Seq: 0x%lX  Ack: 0x%lX  "
+    TextLog_Print(text_log, "  SrcPort:%u  DstPort:%u  Seq: 0x%lX  Ack: 0x%lX  "
             "Win: 0x%X  TcpLen: %d",ntohs(tcph->th_sport),
             ntohs(tcph->th_dport), (u_long) ntohl(tcph->th_seq),
             (u_long) ntohl(tcph->th_ack),
             ntohs(tcph->th_win), TCP_OFFSET(tcph) << 2);
 
     if((tcph->th_flags & TH_URG) != 0)
-        TextLog_Print(log, "  UrgPtr: 0x%X\n", (uint16_t) ntohs(tcph->th_urp));
+        TextLog_Print(text_log, "UrgPtr: 0x%X", (uint16_t) ntohs(tcph->th_urp));
 
-    TextLog_NewLine(log);
 
     /* dump the TCP options */
     if(p->tcp_option_count > 0)
     {
-        LogTcpOptions(log, p);
+        TextLog_NewLine(text_log);
+        TextLog_Putc(text_log, '\t');
+        LogTcpOptions(text_log, p);
     }
 }
 
diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc
index 333e646bd..2870bdba2 100644
--- a/src/codecs/ip/cd_udp.cc
+++ b/src/codecs/ip/cd_udp.cc
@@ -132,7 +132,8 @@ public:
     virtual bool encode(EncState*, Buffer* out, const uint8_t *raw_in);
     virtual bool update(Packet*, Layer*, uint32_t* len);
     virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
-    virtual void log(TextLog*, const uint8_t* /*raw_pkt*/, const Packet* const);
+    virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+        const Packet* const);
     
 };
 
@@ -359,11 +360,11 @@ static inline void PopUdp (Packet* p)
         p->dsize = p->ip_api.pay_len();
 }
 
-void UdpCodec::log(TextLog* log, const uint8_t* raw_pkt, const Packet* const)
+void UdpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt, const Packet* const)
 {
     const udp::UDPHdr* udph = reinterpret_cast<const udp::UDPHdr*>(raw_pkt);
 
-    TextLog_Print(log, "UDP  SourcePort:%d DestPort:%d Len:%d\n",
+    TextLog_Print(text_log, "\tSourcePort:%d DestPort:%d Len:%d",
             ntohs(udph->uh_sport), ntohs(udph->uh_dport),
             ntohs(udph->uh_len) - udp::UDP_HEADER_LEN);
 }
diff --git a/src/codecs/link/cd_arp.cc b/src/codecs/link/cd_arp.cc
index 1c794adb4..e4f2c7df6 100644
--- a/src/codecs/link/cd_arp.cc
+++ b/src/codecs/link/cd_arp.cc
@@ -31,6 +31,7 @@
 #include "codecs/sf_protocols.h"
 #include "protocols/arp.h"
 #include "protocols/packet.h"
+#include "log/text_log.h"
 
 namespace
 {
@@ -65,7 +66,6 @@ public:
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
     virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
         Packet *, uint16_t &lyr_len, uint16_t &);
-    
 };
 
 
@@ -110,8 +110,6 @@ bool ArpCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& raw_len,
     return true;
 }
 
-
-
 //-------------------------------------------------------------------------
 // api
 //-------------------------------------------------------------------------
diff --git a/src/codecs/link/cd_mpls.cc b/src/codecs/link/cd_mpls.cc
index e12fe6258..17ff282e1 100644
--- a/src/codecs/link/cd_mpls.cc
+++ b/src/codecs/link/cd_mpls.cc
@@ -119,8 +119,8 @@ public:
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
     virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
         Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
-    virtual void log(TextLog*, const uint8_t* /*raw_pkt*/, const Packet* const);
-
+    virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+        const Packet* const);
 };
 
 
@@ -314,10 +314,10 @@ static int checkMplsHdr(
     return iRet;
 }
 
-void MplsCodec::log(TextLog* log, const uint8_t* /*raw_pkt*/,
+void MplsCodec::log(TextLog* const text_log, const uint8_t* /*raw_pkt*/,
         const Packet* const p)
 {
-    TextLog_Print(log,"MPLS  label:0x%05X exp:0x%X bos:0x%X ttl:0x%X\n",
+    TextLog_Print(text_log,"\tlabel:0x%05X exp:0x%X bos:0x%X ttl:0x%X\n",
         p->mplsHdr.label, p->mplsHdr.exp, p->mplsHdr.bos, p->mplsHdr.ttl);
 }
 
diff --git a/src/codecs/link/cd_vlan.cc b/src/codecs/link/cd_vlan.cc
index 14d560f1d..317bb3e06 100644
--- a/src/codecs/link/cd_vlan.cc
+++ b/src/codecs/link/cd_vlan.cc
@@ -68,7 +68,8 @@ public:
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
     virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
         Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
-    virtual void log(TextLog*, const uint8_t* /*raw_pkt*/, const Packet* const);
+    virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+        const Packet* const);
 };
 
 
@@ -116,24 +117,25 @@ bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
     return true;
 }
 
-void VlanCodec::log(TextLog* text_log, const uint8_t* raw_pkt, const Packet* const)
+void VlanCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
+                    const Packet* const)
 {
     const vlan::VlanTagHdr *vh = reinterpret_cast<const vlan::VlanTagHdr *>(raw_pkt);
     const uint16_t proto = ntohs(vh->vth_proto);
     const uint16_t vid = vlan::vth_vlan(vh);
-    uint16_t proto_name;
 
-    if (proto <= ETHERNET_MAX_LEN_ENCAP)
-        proto_name = ETHERNET_LLC;
-    else
-        proto_name = proto;
+
+    TextLog_Putc(text_log, '\t');
+    TextLog_Print(text_log, "Priority:%d(0x%X) CFI:%d "
+        "Vlan_ID:%d(0x%04X)",
+        vlan::vth_priority(vh), vlan::vth_priority(vh),
+        vlan::vth_cfi(vh), vid, vid);
 
 
-    TextLog_Print(text_log, "VLAN  Priority:%d(0x%X) CFI:%d "
-        "Vlan_ID:%d(0x%04X) Next:%s(%04X)",
-        vlan::vth_priority(vh), vlan::vth_cfi(vh),
-        vid, vid, PacketManager::get_proto_name(proto_name),
-        proto);
+    if (proto <= ETHERNET_MAX_LEN_ENCAP)
+        TextLog_Print(text_log, "  Len:0x%04X", proto);
+    else
+        TextLog_Print(text_log, "  Next:0x%04X", proto);
 }
 
 
diff --git a/src/codecs/misc/cd_icmp4_ip.cc b/src/codecs/misc/cd_icmp4_ip.cc
index 99dae1944..f4cc01b29 100644
--- a/src/codecs/misc/cd_icmp4_ip.cc
+++ b/src/codecs/misc/cd_icmp4_ip.cc
@@ -29,18 +29,15 @@
 #include "protocols/ipv4.h"
 #include "protocols/packet.h"
 #include "codecs/codec_events.h"
-
+#include "log/text_log.h"
+#include "main/snort.h"
+#include "log/messages.h"
+#include "protocols/packet_manager.h"
 
 namespace
 {
 
-// yes, macros are necessary. The API and class constructor require different strings.
-//
-// this macros is defined in the module to ensure identical names. However,
-// if you don't want a module, define the name here.
-#ifndef ICMP4_IP_NAME
 #define ICMP4_IP_NAME "icmp4_ip"
-#endif
 
 class Icmp4IpCodec : public Codec
 {
@@ -53,8 +50,8 @@ public:
     virtual bool encode(EncState* enc, Buffer* out, const uint8_t* raw_in);
     virtual bool decode(const uint8_t *raw_pkt, const uint32_t &raw_len,
         Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
-
-
+    virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+                    const Packet* const);
 };
 
 } // namespace
@@ -160,6 +157,181 @@ bool Icmp4IpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
 }
 
 
+struct ip4_addr
+{
+    union
+    {
+        uint32_t addr32;
+        uint8_t addr8[4];
+    };
+};
+
+void Icmp4IpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
+                    const Packet* const)
+{
+    const IP4Hdr* const ip4h = reinterpret_cast<const IP4Hdr*>(raw_pkt);
+    TextLog_Puts(text_log, "\t**** ORIGINAL DATAGRAM DUMP: ****");
+    TextLog_NewLine(text_log);
+    TextLog_Puts(text_log, "\tIPv4\n\t\t");
+
+    // COPIED DIRECTLY FROM ipv4 CODEC.  This is specificially replicated since
+    //      the two are not necessarily the same.
+
+    // FIXIT-H  -->  This does NOT obfuscate correctly
+    if (ScObfuscate())
+    {
+        TextLog_Print(text_log, "xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx");
+    }
+    else
+    {
+        ip4_addr src, dst;
+        src.addr32 = ip4h->get_src();
+        dst.addr32 = ip4h->get_dst();
+
+        TextLog_Print(text_log, "%d.%d.%d.%d -> %d.%d.%d.%d",
+            (int)src.addr8[0], (int)src.addr8[1],
+            (int)src.addr8[2], (int)src.addr8[3],
+            (int)dst.addr8[0], (int)dst.addr8[1],
+            (int)dst.addr8[2], (int)dst.addr8[3]);
+    }
+
+    TextLog_NewLine(text_log);
+    TextLog_Puts(text_log, "\t\t");
+
+    const uint16_t hlen = ip4h->get_hlen() << 2;
+    const uint16_t len = ntohs(ip4h->get_len());
+    const uint16_t frag_off = ntohs(ip4h->get_off());
+
+    TextLog_Print(text_log, "Next:%s(%02X) TTL:%u TOS:0x%X ID:%u IpLen:%u DgmLen:%u",
+            PacketManager::get_proto_name(ip4h->get_proto()),
+            ip4h->get_proto(), ip4h->get_ttl(), ip4h->get_tos(),
+            ip4h->get_id(), hlen, len);
+
+
+    /* print the reserved bit if it's set */
+    if(frag_off & 0x8000)
+        TextLog_Puts(text_log, " RB");
+
+    /* printf more frags/don't frag bits */
+    if(frag_off & 0x4000)
+        TextLog_Puts(text_log, " DF");
+
+    bool mf = false;
+    if(frag_off & 0x2000)
+    {
+        mf = true;
+        TextLog_Puts(text_log, " MF");
+    }
+
+
+#if 0
+    // FIXIT-L - J  more ip options fixits
+    /* print IP options */
+    if(p->ip_option_count > 0)
+    {
+        LogIpOptions(text_log, p);
+    }
+#endif
+
+    if( mf && (frag_off & 0x1FFF) && ((len - hlen > 0)))
+    {
+        TextLog_NewLine(text_log);
+        TextLog_Puts(text_log, "\t\t");
+        TextLog_Print(text_log, "Frag Offset: 0x%04X   Frag Size: 0x%04X",
+                (frag_off & 0x1FFF), (len - hlen));
+    }
+
+    TextLog_NewLine(text_log);
+    TextLog_Putc(text_log, '\t');
+
+
+    /*  EMBEDDED PROTOCOL */
+    switch(ip4h->get_proto())
+    {
+        case IPPROTO_TCP: /* decode the interesting part of the header */
+        {
+            const tcp::TCPHdr* tcph = reinterpret_cast<const tcp::TCPHdr*>
+                (raw_pkt + hlen);
+            TextLog_Puts(text_log, "TCP\n\t\t");
+            TextLog_Print(text_log, "SrcPort:%u  DstPort:%u  Seq: 0x%lX  "
+                    "Ack: 0x%lX  Win: 0x%X  TcpLen: %d",ntohs(tcph->th_sport),
+                    ntohs(tcph->th_dport), (u_long) ntohl(tcph->th_seq),
+                    (u_long) ntohl(tcph->th_ack),
+                    ntohs(tcph->th_win), TCP_OFFSET(tcph) << 2);
+
+            break;
+        }
+
+        case IPPROTO_UDP:
+        {
+            const udp::UDPHdr* udph = reinterpret_cast<const udp::UDPHdr*>
+                (raw_pkt + hlen);
+            TextLog_Puts(text_log, "UDP\n\t\t");
+            TextLog_Print(text_log, "SourcePort:%d DestPort:%d Len:%d",
+                    ntohs(udph->uh_sport), ntohs(udph->uh_dport),
+                ntohs(udph->uh_len) - udp::UDP_HEADER_LEN);
+            break;
+        }
+
+        case IPPROTO_ICMP:
+        {
+            const icmp::ICMPHdr* icmph = reinterpret_cast<const icmp::ICMPHdr*>
+                (raw_pkt + hlen);
+
+            TextLog_Puts(text_log, "ICMPv4\n\t\t");
+            TextLog_Print(text_log, "Type:%d  Code:%d  Csum:%u",
+                    icmph->type, icmph->code, ntohs(icmph->csum));
+
+            switch (icmph->type)
+            {
+                case icmp::IcmpType::DEST_UNREACH:
+                case icmp::IcmpType::TIME_EXCEEDED:
+                case icmp::IcmpType::SOURCE_QUENCH:
+                    break;
+
+                case icmp::IcmpType::PARAMETERPROB:
+                    if (icmph->code == 0)
+                        TextLog_Print(text_log, "  Ptr: %u", icmph->s_icmp_pptr);
+                    break;
+
+                case ICMP_REDIRECT:
+        // XXX-IPv6 "NOT YET IMPLEMENTED - ICMP printing"
+                    break;
+
+                case icmp::IcmpType::ECHO_4:
+                case icmp::IcmpType::ECHOREPLY:
+                case icmp::IcmpType::TIMESTAMP:
+                case icmp::IcmpType::TIMESTAMPREPLY:
+                case icmp::IcmpType::INFO_REQUEST:
+                case icmp::IcmpType::INFO_REPLY:
+                case icmp::IcmpType::ADDRESS:
+                case icmp::IcmpType::ADDRESSREPLY:
+                    TextLog_Print(text_log, "  Id: %u  SeqNo: %u",
+                            ntohs(icmph->s_icmp_id), ntohs(icmph->s_icmp_seq));
+                    break;
+
+                case icmp::IcmpType::ROUTER_ADVERTISE:
+                    TextLog_Print(text_log, "  Addrs: %u  Size: %u  Lifetime: %u",
+                            icmph->s_icmp_num_addrs, icmph->s_icmp_wpa,
+                            ntohs(icmph->s_icmp_lifetime));
+                    break;
+
+                default:
+                    break;
+            }
+            break;
+        }
+        default:
+        {
+            TextLog_Print(text_log, "Protocol:%s(%02X)",
+                PacketManager::get_proto_name(ip4h->get_proto()),
+                ip4h->get_proto());
+            break;
+        }
+    }
+}
+
+
 bool Icmp4IpCodec::encode(EncState* /*enc*/, Buffer* out, const uint8_t* raw_in)
 {
     // allocate space for this protocols encoded data
diff --git a/src/codecs/misc/cd_llc.cc b/src/codecs/misc/cd_llc.cc
index 52496505c..a4193e01c 100644
--- a/src/codecs/misc/cd_llc.cc
+++ b/src/codecs/misc/cd_llc.cc
@@ -54,7 +54,8 @@ public:
     virtual bool decode(const uint8_t *raw_pkt, const uint32_t &raw_len,
         Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
 
-    virtual void log(TextLog*, const uint8_t* /*raw_pkt*/, const Packet* const);
+    virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+        const Packet* const);
     virtual void get_protocol_ids(std::vector<uint16_t>&);
 };
 
@@ -130,12 +131,13 @@ bool LlcCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
     return true;
 }
 
-void LlcCodec::log(TextLog* text_log, const uint8_t* raw_pkt,
-    const Packet* const)
+void LlcCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
+                    const Packet* const)
 {
     const EthLlc *ehllc = reinterpret_cast<const EthLlc *>(raw_pkt);
 
-    TextLog_Print(text_log, "LLC  DSAP:0x%X SSAP:0x%X CTRL:0x%X",
+    TextLog_Putc(text_log, '\t');
+    TextLog_Print(text_log, "DSAP:0x%X SSAP:0x%X CTRL:0x%X",
         ehllc->dsap, ehllc->ssap, ehllc->ctrl);
 
     // Assuming that if these three conditions are met, this is SNAP.
@@ -147,9 +149,9 @@ void LlcCodec::log(TextLog* text_log, const uint8_t* raw_pkt,
         const EthLlcOther *other = reinterpret_cast<const EthLlcOther *>(raw_pkt + sizeof(EthLlc));
         const uint16_t proto = ntohs(other->proto_id);
 
-        TextLog_Print(text_log, " ORG:0x%02X%02X%02X PROTO:0x%s(%04X)",
+        TextLog_Print(text_log, " ORG:0x%02X%02X%02X PROTO:0x%04X",
             other->org_code[0], other->org_code[1], other->org_code[2],
-            PacketManager::get_proto_name(proto), proto);
+            proto);
     }
 }
 
diff --git a/src/codecs/root/cd_eth.cc b/src/codecs/root/cd_eth.cc
index bb2a9252d..3fe9a4319 100644
--- a/src/codecs/root/cd_eth.cc
+++ b/src/codecs/root/cd_eth.cc
@@ -63,7 +63,8 @@ public:
     virtual PROTO_ID get_proto_id() { return PROTO_ETH; };
     virtual void get_protocol_ids(std::vector<uint16_t>&);
     virtual void get_data_link_type(std::vector<int>&);
-    virtual void log(TextLog* /*log*/, const uint8_t* /*raw_pkt*/, const Packet*const );
+    virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+        const Packet*const );
     virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
         Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id);
     virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
@@ -113,29 +114,13 @@ bool EthCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
     /* do a little validation */
     if(raw_len < eth::ETH_HEADER_LEN)
     {
-        DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
-            "WARNING: Truncated eth header (%d bytes).\n", raw_len););
-
         codec_events::decoder_event(p, DECODE_ETH_HDR_TRUNC);
-
         return false;
     }
 
     /* lay the ethernet structure over the packet data */
     const eth::EtherHdr *eh = reinterpret_cast<const eth::EtherHdr *>(raw_pkt);
 
-    DEBUG_WRAP(
-            DebugMessage(DEBUG_DECODE, "%X:%X:%X:%X:%X:%X -> %X:%X:%X:%X:%X:%X\n",
-                eh->ether_src[0],
-                eh->ether_src[1], eh->ether_src[2], eh->ether_src[3],
-                eh->ether_src[4], eh->ether_src[5], eh->ether_dst[0],
-                eh->ether_dst[1], eh->ether_dst[2], eh->ether_dst[3],
-                eh->ether_dst[4], eh->ether_dst[5]);
-            );
-    DEBUG_WRAP(
-            DebugMessage(DEBUG_DECODE, "type:0x%X len:0x%X\n",
-                ntohs(eh->ether_type), p->pkth->pktlen)
-            );
 
     next_prot_id = ntohs(eh->ether_type);
     if (next_prot_id > eth::MIN_ETHERTYPE )
@@ -149,26 +134,27 @@ bool EthCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
 }
 
 
-void EthCodec::log(TextLog* log, const uint8_t* raw_pkt, const Packet* const)
+void EthCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
+                    const Packet* const)
 {
     const eth::EtherHdr *eh = reinterpret_cast<const eth::EtherHdr *>(raw_pkt);
 
     /* src addr */
-    TextLog_Print(log, "%02X:%02X:%02X:%02X:%02X:%02X -> ", eh->ether_src[0],
+    TextLog_Print(text_log, "\t%02X:%02X:%02X:%02X:%02X:%02X -> ", eh->ether_src[0],
         eh->ether_src[1], eh->ether_src[2], eh->ether_src[3],
         eh->ether_src[4], eh->ether_src[5]);
 
     /* dest addr */
-    TextLog_Print(log, "%02X:%02X:%02X:%02X:%02X:%02X", eh->ether_dst[0],
+    TextLog_Print(text_log, "%02X:%02X:%02X:%02X:%02X:%02X", eh->ether_dst[0],
         eh->ether_dst[1], eh->ether_dst[2], eh->ether_dst[3],
         eh->ether_dst[4], eh->ether_dst[5]);
 
     const uint16_t prot = ntohs(eh->ether_type);
 
     if (prot <= eth::MIN_ETHERTYPE)
-        TextLog_Print(log, " len:0x%04X", prot);
+        TextLog_Print(text_log, "  len:0x%04X", prot);
     else
-        TextLog_Print(log, "type:0x%04X", prot);
+        TextLog_Print(text_log, "  type:0x%04X", prot);
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/codecs/root/cd_wlan.cc b/src/codecs/root/cd_wlan.cc
index 500e9039f..eed16656d 100644
--- a/src/codecs/root/cd_wlan.cc
+++ b/src/codecs/root/cd_wlan.cc
@@ -99,7 +99,7 @@ void WlanCodec::get_data_link_type(std::vector<int>&v)
 }
 
 bool WlanCodec::decode(const uint8_t *raw_pkt, const uint32_t &raw_len,
-        Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
+        Packet*, uint16_t &lyr_len, uint16_t &next_prot_id)
 {
     uint32_t cap_len = raw_len;
     // reinterpret the raw data into this codec's data format
diff --git a/src/framework/codec.h b/src/framework/codec.h
index 9de1d8f72..21a96e94e 100644
--- a/src/framework/codec.h
+++ b/src/framework/codec.h
@@ -122,7 +122,7 @@ public:
     /*  Codec Initialization */
 
     // Get the codec's name
-    inline const char* get_name(){return name; };
+    inline const char* get_name() const {return name; };
     // used for backwards compatability.
     virtual PROTO_ID get_proto_id() { return PROTO_AH; };
     // Registers this Codec's data link type (as defined by libpcap)
@@ -141,7 +141,7 @@ public:
      *          const uint8_t *raw_pkt = the same data seen during decode
      *          Packet *p = pointer to the packet struct.
      */
-    virtual void log(TextLog* /*log*/, const uint8_t* /*raw_pkt*/,
+    virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
                     const Packet* const) {}
 
 
diff --git a/src/log/log.cc b/src/log/log.cc
index 196c5a320..0c5430b14 100644
--- a/src/log/log.cc
+++ b/src/log/log.cc
@@ -160,13 +160,17 @@ void snort_print(Packet* p)
     {
         LogIPPkt(text_log, p->ip_api.proto(), p);
     }
+#if 0
+    // ARP not impelemted
     else if (p->proto_bits & PROTO_BIT__ARP)
     {
+
         log_mutex.lock();
         LogArpHeader(text_log, p);
         TextLog_Flush(text_log);
         log_mutex.unlock();
     }
+#endif
 #if 0
     else if (p->eplh != NULL)
     {
diff --git a/src/log/log_text.cc b/src/log/log_text.cc
index 981a3d835..63d7bfcd8 100644
--- a/src/log/log_text.cc
+++ b/src/log/log_text.cc
@@ -1889,11 +1889,6 @@ void LogIPPkt(TextLog* log, int type, Packet * p)
  * ARP stuff cloned from log.c
  *--------------------------------------------------------------------
  */
-void LogArpHeader(TextLog*, Packet*)
-{
-// XXX-IPv6 "NOT YET IMPLEMENTED - printing ARP header"
-}
-
 
 #if 0
 // these must be converted to use TextLog 
diff --git a/src/log/log_text.h b/src/log/log_text.h
index 844cf96db..71ae30557 100644
--- a/src/log/log_text.h
+++ b/src/log/log_text.h
@@ -60,7 +60,5 @@ void LogTCPHeader(TextLog*, Packet*);
 SO_PUBLIC void LogTcpOptions(TextLog*,  const Packet* const);
 void LogUDPHeader(TextLog*, Packet*);
 void LogICMPHeader(TextLog*, Packet*);
-void LogArpHeader(TextLog*, Packet*);
 
 #endif
-
diff --git a/src/log/text_log.cc b/src/log/text_log.cc
index 63e85dac2..21048f225 100644
--- a/src/log/text_log.cc
+++ b/src/log/text_log.cc
@@ -107,7 +107,7 @@ TextLog* TextLog_Init (
  * TextLog_Term: destructor
  *-------------------------------------------------------------------
  */
-void TextLog_Term (TextLog* txt)
+void TextLog_Term (TextLog* const txt)
 {
     if ( !txt ) return;
 
@@ -124,7 +124,7 @@ void TextLog_Term (TextLog* txt)
  * than resolution of filename discriminator
  *-------------------------------------------------------------------
  */
-static void TextLog_Roll (TextLog* txt)
+static void TextLog_Roll (TextLog* const txt)
 {
     if ( txt->file == stdout ) return;
     if ( txt->last >= time(NULL) ) return;
@@ -141,7 +141,7 @@ static void TextLog_Roll (TextLog* txt)
  * TextLog_Flush: write buffered stream to file
  *-------------------------------------------------------------------
  */
-bool TextLog_Flush(TextLog* txt)
+bool TextLog_Flush(TextLog* const txt)
 {
     int ok;
 
@@ -163,7 +163,7 @@ bool TextLog_Flush(TextLog* txt)
  * TextLog_Putc: append char to buffer
  *-------------------------------------------------------------------
  */
-bool TextLog_Putc (TextLog* txt, char c)
+bool TextLog_Putc (TextLog* const txt, char c)
 {
     if ( TextLog_Avail(txt) < 1 )
     {
@@ -179,7 +179,7 @@ bool TextLog_Putc (TextLog* txt, char c)
  * TextLog_Write: append string to buffer
  *-------------------------------------------------------------------
  */
-bool TextLog_Write (TextLog* txt, const char* str, int len)
+bool TextLog_Write (TextLog* const txt, const char* str, int len)
 {
     int avail = TextLog_Avail(txt);
 
@@ -208,7 +208,7 @@ bool TextLog_Write (TextLog* txt, const char* str, int len)
  * TextLog_Printf: append formatted string to buffer
  *-------------------------------------------------------------------
  */
-bool TextLog_Print (TextLog* txt, const char* fmt, ...)
+bool TextLog_Print (TextLog* const txt, const char* fmt, ...)
 {
     int avail = TextLog_Avail(txt);
     int len;
@@ -247,7 +247,7 @@ bool TextLog_Print (TextLog* txt, const char* fmt, ...)
  * checking for 3
  *-------------------------------------------------------------------
  */
-bool TextLog_Quote (TextLog* txt, const char* qs)
+bool TextLog_Quote (TextLog* const txt, const char* qs)
 {
     int pos = txt->pos;
 
@@ -272,4 +272,3 @@ bool TextLog_Quote (TextLog* txt, const char* qs)
 
     return true;
 }
-
diff --git a/src/log/text_log.h b/src/log/text_log.h
index 6575efdef..a8fd4931a 100644
--- a/src/log/text_log.h
+++ b/src/log/text_log.h
@@ -75,33 +75,33 @@ TextLog* TextLog_Init (
 );
 void TextLog_Term (TextLog*);
 
-bool TextLog_Putc(TextLog*, char);
-bool TextLog_Quote(TextLog*, const char*);
-bool TextLog_Write(TextLog*, const char*, int len);
-bool TextLog_Print(TextLog*, const char* format, ...);
-bool TextLog_Flush(TextLog*);
+bool TextLog_Putc(TextLog* const, char);
+bool TextLog_Quote(TextLog* const, const char*);
+bool TextLog_Write(TextLog* const, const char*, int len);
+bool TextLog_Print(TextLog* const, const char* format, ...);
+bool TextLog_Flush(TextLog* const);
 
 /*-------------------------------------------------------------------
   * helper functions
   *-------------------------------------------------------------------
   */
- static inline int TextLog_Tell (TextLog* txt)
+ static inline int TextLog_Tell (TextLog* const txt)
  {
      return txt->pos;
  }
 
- static inline int TextLog_Avail (TextLog* txt)
+ static inline int TextLog_Avail (TextLog* const txt)
  {
      return txt->maxBuf - txt->pos - 1;
  }
 
- static inline void TextLog_Reset (TextLog* txt)
+ static inline void TextLog_Reset (TextLog* const txt)
  {
      txt->pos = 0;
      txt->buf[txt->pos] = '\0';
  }
 
-static inline bool TextLog_NewLine (TextLog* txt)
+static inline bool TextLog_NewLine (TextLog* const txt)
 {
     return TextLog_Putc(txt, '\n');
 }
diff --git a/src/loggers/CMakeLists.txt b/src/loggers/CMakeLists.txt
index ac56fa61c..9a4cf77d0 100644
--- a/src/loggers/CMakeLists.txt
+++ b/src/loggers/CMakeLists.txt
@@ -3,6 +3,7 @@ include_directories(${LUAJIT_INCLUDE_DIR})
 
 set (LOGGER_SOURCES
     alert_luajit.cc
+    log_codecs.cc
     loggers.cc
     loggers.h
 )
diff --git a/src/loggers/alert_fast.cc b/src/loggers/alert_fast.cc
index 4dc1b3c31..2bfcf1bb0 100644
--- a/src/loggers/alert_fast.cc
+++ b/src/loggers/alert_fast.cc
@@ -245,9 +245,11 @@ void FastLogger::alert(Packet *p, const char *msg, Event *event)
         if(p->ip_api.is_valid())
             LogIPPkt(fast_log, p->ip_api.proto(), p);
 
+#if 0
+        // FIXIT-L -J LogArpHeader unimplemented
         else if(p->proto_bits & PROTO_BIT__ARP)
             LogArpHeader(fast_log, p);
-
+#endif
     }
     TextLog_NewLine(fast_log);
     TextLog_Flush(fast_log);
diff --git a/src/loggers/log_codecs.cc b/src/loggers/log_codecs.cc
new file mode 100644
index 000000000..6e147dd43
--- /dev/null
+++ b/src/loggers/log_codecs.cc
@@ -0,0 +1,232 @@
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+** Copyright (C) 2013-2013 Sourcefire, Inc.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation.  You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+*/
+// alert_codecs.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <ctype.h>
+#include <string.h>
+
+#include <algorithm>
+#include <iostream>
+
+#include "main/snort_types.h"
+#include "framework/logger.h"
+#include "framework/module.h"
+#include "protocols/packet.h"
+#include "protocols/packet_manager.h"
+#include "detection/signature.h"
+#include "log/text_log.h"
+
+
+static THREAD_LOCAL TextLog* test_file = nullptr;
+
+//-------------------------------------------------------------------------
+// module stuff
+//-------------------------------------------------------------------------
+
+#define LOG_CODECS_NAME "log_codecs"
+static const unsigned ALERT_FLAG_MSG = 0x01;
+
+static const Parameter ex_params[] =
+{
+    { "file", Parameter::PT_STRING, nullptr, "stdout",
+      "name of tsv alert file or 'stdout'" },
+
+    { "msg", Parameter::PT_BOOL, nullptr, "false",
+      "include alert msg" },
+
+    { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+namespace
+{
+
+class LogCodecModule : public Module
+{
+public:
+    LogCodecModule() : Module(LOG_CODECS_NAME, ex_params) { };
+    bool set(const char*, Value&, SnortConfig*);
+    bool begin(const char*, int, SnortConfig*);
+
+public:
+    std::string file;
+    uint8_t flags;
+};
+
+} // namespace
+
+bool LogCodecModule::set(const char*, Value& v, SnortConfig*)
+{
+    if ( v.is("file") )
+        file = v.get_string();
+
+    else if ( v.is("msg") )
+    {
+        if ( v.get_bool() )
+            flags |= ALERT_FLAG_MSG;
+    }
+
+    else
+        return false;
+
+    return true;
+}
+
+bool LogCodecModule::begin(const char*, int, SnortConfig*)
+{
+    file = "stdout";
+    flags = 0;
+    return true;
+}
+
+//-------------------------------------------------------------------------
+// logger stuff
+//-------------------------------------------------------------------------
+
+namespace
+{
+
+class CodecLogger : public Logger {
+public:
+    CodecLogger(LogCodecModule* m);
+
+    void open();
+    void close();
+    virtual void alert(Packet*, const char* msg, Event*);
+    virtual void log(Packet*, const char*, Event*);
+
+public:
+    std::string file;
+    uint8_t flags;
+};
+
+} // namespace
+
+
+CodecLogger::CodecLogger(LogCodecModule* m)
+{
+    file = m->file;
+    flags = m->flags;
+}
+
+void CodecLogger::open()
+{ test_file = TextLog_Init(file.c_str()); }
+
+void CodecLogger::close()
+{ TextLog_Term(test_file); }
+
+void CodecLogger::alert(Packet* p, const char* msg, Event* e)
+{
+    log(p, msg, e);
+#if 0
+    std::string s = std::string(msg);
+
+    if (e != NULL)
+    {
+        TextLog_Print(test_file, "%lu\t%lu\t%lu\t",
+                (unsigned long) e->sig_info->generator,
+                (unsigned long) e->sig_info->id,
+                (unsigned long) e->sig_info->rev);
+    }
+
+    if (flags & ALERT_FLAG_MSG)
+    {
+        if (msg != NULL)
+            TextLog_Print(test_file, "%s\t", msg);
+    }
+
+
+    TextLog_NewLine(test_file);
+    TextLog_Print(test_file, " **** DUMPING PACKET ****");
+    TextLog_NewLine(test_file);
+    PacketManager::log_protocols(test_file, p);
+    TextLog_Print(test_file, " **** FINISHED DUMPING ****");
+    TextLog_NewLine(test_file);
+#endif
+}
+
+void CodecLogger::log(Packet* p, const char* msg, Event* e)
+{
+    std::string s = std::string(msg);
+
+
+    if (e != NULL)
+    {
+        TextLog_Print(test_file, "%lu\t%lu\t%lu\t",
+                (unsigned long) e->sig_info->generator,
+                (unsigned long) e->sig_info->id,
+                (unsigned long) e->sig_info->rev);
+    }
+
+    if (flags & ALERT_FLAG_MSG)
+    {
+        if (msg != NULL)
+            TextLog_Print(test_file, "%s\t", msg);
+    }
+
+    TextLog_NewLine(test_file);
+    TextLog_Print(test_file, " **** DUMPING PACKET ****");
+    TextLog_NewLine(test_file);
+    PacketManager::log_protocols(test_file, p);
+    TextLog_NewLine(test_file);
+    TextLog_Print(test_file, " **** FINISHED DUMPING ****");
+    TextLog_NewLine(test_file);
+    TextLog_NewLine(test_file);
+    TextLog_NewLine(test_file);
+    TextLog_NewLine(test_file);
+
+}
+
+//-------------------------------------------------------------------------
+// api stuff
+//-------------------------------------------------------------------------
+
+static Module* mod_ctor()
+{ return new LogCodecModule; }
+
+static void mod_dtor(Module* m)
+{ delete m; }
+
+static Logger* codec_log_ctor(SnortConfig*, Module* mod)
+{ return new CodecLogger((LogCodecModule*)mod); }
+
+static void codec_log_dtor(Logger* p)
+{ delete p; }
+
+static const LogApi log_codecs_api =
+{
+    {
+        PT_LOGGER,
+        LOG_CODECS_NAME,
+        LOGAPI_PLUGIN_V0,
+        0,
+        mod_ctor,
+        mod_dtor
+    },
+    (OUTPUT_TYPE_FLAG__LOG | OUTPUT_TYPE_FLAG__ALERT),
+    codec_log_ctor,
+    codec_log_dtor
+};
+
+
+const BaseApi* eh_codecs = &log_codecs_api.base;
diff --git a/src/loggers/loggers.cc b/src/loggers/loggers.cc
index 3370c93c9..ad0c37283 100644
--- a/src/loggers/loggers.cc
+++ b/src/loggers/loggers.cc
@@ -26,6 +26,10 @@
 
 #include "framework/logger.h"
 
+// to ensure PacketManager::log_protocols() is built into Snort++
+extern const BaseApi* eh_codecs;
+extern const BaseApi* log_luajit;
+
 #ifdef LINUX
 extern const BaseApi* alert_sf_socket;
 #endif
@@ -50,11 +54,11 @@ const BaseApi* loggers[] =
 
 #ifdef STATIC_LOGGERS
     // alerters
+    alert_csv,
     alert_fast,
     alert_full,
     alert_syslog,
     alert_test,
-    alert_csv,
     alert_unix_sock,
     // loggers
     log_null,
@@ -63,6 +67,9 @@ const BaseApi* loggers[] =
     // both
     eh_unified2,
 #endif
+    // loggers
+    log_luajit,
+    // both
+    eh_codecs,
     nullptr
 };
-
diff --git a/src/protocols/icmp4.h b/src/protocols/icmp4.h
index 0bae8e3eb..91150342f 100644
--- a/src/protocols/icmp4.h
+++ b/src/protocols/icmp4.h
@@ -246,8 +246,6 @@ constexpr uint8_t ICMP_HOST_UNR_TOS = 12;
 constexpr uint8_t ICMP_PKT_FILTERED = 13;    /* Packet filtered */
 constexpr uint8_t ICMP_PREC_VIOLATION = 14;    /* Precedence violation */
 constexpr uint8_t ICMP_PREC_CUTOFF = 15;    /* Precedence cut off */
-constexpr uint8_t NR_ICMP_UNREACH = 15;   /* instead of hardcoding immediate
-                                       * value */
 
 constexpr uint8_t ICMP_REDIR_NET = 0;
 constexpr uint8_t ICMP_REDIR_HOST = 1;
diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc
index 5f1c3e5c6..a6b826330 100644
--- a/src/protocols/packet_manager.cc
+++ b/src/protocols/packet_manager.cc
@@ -32,6 +32,7 @@
 
 #include "protocols/packet.h"
 #include "protocols/protocol_ids.h"
+#include "protocols/eth.h"
 #include "time/profiler.h"
 #include "parser/parser.h"
 
@@ -39,6 +40,7 @@
 #include "codecs/codec_events.h"
 #include "codecs/decode_module.h"
 #include "utils/stats.h"
+#include "log/text_log.h"
 
 
 #ifdef PERF_PROFILING
@@ -141,10 +143,6 @@ void PacketManager::decode(
     uint16_t lyr_len = 0;
     uint32_t len;
 
-    DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet!\n");
-            DebugMessage(DEBUG_DECODE, "caplen: %lu    pktlen: %lu\n",
-                (unsigned long)pkthdr->caplen, (unsigned long)pkthdr->pktlen);
-            );
 
     MODULE_PROFILE_START(decodePerfStats);
 
@@ -501,9 +499,10 @@ void PacketManager::accumulate()
 {
     static std::mutex stats_mutex;
 
-    stats_mutex.lock();
+    std::lock_guard<std::mutex> lock(stats_mutex);
     sum_stats(&g_stats[0], &s_stats[0], s_stats.size());
-    stats_mutex.unlock();
+
+    // mutex is automatically unlocked
 }
 
 
@@ -512,3 +511,56 @@ const char* PacketManager::get_proto_name(uint16_t protocol)
 
 const char* PacketManager::get_proto_name(uint8_t protocol)
 { return CodecManager::s_protocols[CodecManager::s_proto_map[protocol]]->get_name(); }
+
+
+void PacketManager::log_protocols(TextLog* const text_log,
+                                        const Packet* const p)
+{
+    uint8_t num_layers = p->num_layers;
+    const Layer* const lyr = p->layers;
+//    int pos = TextLog_Tell(text_log);
+
+    if (num_layers != 0)
+    {
+        // Grinder is not in the layer array
+        Codec* const cd = CodecManager::s_protocols[CodecManager::grinder];
+        TextLog_Print(text_log, "DLT %s", cd->get_name());
+        TextLog_NewLine(text_log);
+
+        const int dlt_pos = TextLog_Tell(text_log);
+        cd->log(text_log, lyr[0].start, p);
+
+        if (dlt_pos != TextLog_Tell(text_log))
+            TextLog_NewLine(text_log);
+
+
+        for (int i = 1; i < num_layers; i++)
+        {
+            const uint16_t protocol = lyr[i].prot_id;
+            const uint8_t codec_offset =  CodecManager::s_proto_map[protocol];
+            Codec* const cd = CodecManager::s_protocols[codec_offset];
+
+
+            TextLog_Print(text_log, "%s", cd->get_name(), protocol);
+
+            // don't print the type if this is a custom type.  Look
+            // in protocol_ids.h for more details.
+            if (protocol <= 0xFF || protocol >= eth::MIN_ETHERTYPE)
+                TextLog_Print(text_log, "(0x%04x)", protocol);
+
+
+            TextLog_NewLine(text_log);
+            const int pos = TextLog_Tell(text_log);
+
+            cd->log(text_log, lyr[i].start, p);
+
+            // Don't print a newline if nothing has been printed or
+            // this is the last line
+            if (pos != TextLog_Tell(text_log) && ((i + 1) < num_layers))
+                TextLog_NewLine(text_log);
+
+            TextLog_Flush(text_log);
+        }
+    }
+
+}
diff --git a/src/protocols/packet_manager.h b/src/protocols/packet_manager.h
index df8ca6d04..1abb34483 100644
--- a/src/protocols/packet_manager.h
+++ b/src/protocols/packet_manager.h
@@ -33,6 +33,7 @@
 
 
 struct _daq_pkthdr;
+struct TextLog;
 
 
 /*
@@ -102,6 +103,8 @@ public:
     static const char* get_proto_name(uint16_t protocol);
     // Get the name of the given protocol
     static const char* get_proto_name(uint8_t protocol);
+    // print this packets information, layer by layer
+    static void log_protocols(TextLog* const, const Packet* const);
 
 private:
     //  STATISTICS!!