From Stephen Donnelly of Endace:

	The code for reading ERF files has not been significantly
	updated since 2004.  This patch brings it up to date with a
	number of changes.

	1) Increase number of decodable ERF types from 7 to 12. This
	   covers newer DAG card models and firmware updates.

	2) Fix timestamp conversion. Was calculating only microsecond
	   precision, now displaying with nanosecond resolution.  Hardware
	   precision is 7.5 to 30 ns depending on model.

	3) Allow the user to specify HDLC encapsulation as 'chdlc',
	   'ppp_serial', 'frelay' or 'mtp2'.  This is needed because the
	   ERF HDLC capture formats do not include information on what
	   protocol is used at the next level.  This is currently done via
	   an environment variable 'ERF_HDLC_ENCAP' and is analagous to the
	   existing 'ERF_ATM_ENCAP' variable.

	   If the user does not specify an HDLC encapsulation it tries to
	   guess, and falls back to MTP2 for backwards compatibility with
	   Florent's existing behaviour.

	   I know environment variables are ugly, suggestions are welcome.

	4) When reading HDLC captures as MTP2, use
	   WTAP_ENCAP_MTP2_WITH_PHDR rather than WTAP_ENCAP_MTP2.  This
	   allows us to put the 'Multi-Channel ERF' record 'channel
	   number' field into the MTP2 pseudo header > 'link_number'
	   field.  This is then displayed in Frame information, and can
	   be filtered on.  (Would be nice if it could be made a display
	   column?)

	Because the ERF record does not specify whether Annex A is used
	or not, we pass MTP2_ANNEX_A_USED_UNKNOWN and allow the existing
	user preference to decide.

Move the MTP2_ANNEX_A_ definitions into Wiretap, make the annex_a_used
field a guint8, and change MTP2_ANNEX_A_USED_UNKNOWN to 2 so it fits in
a guint8.  (This means that if you can save an ERF MTP2 file as a
libpcap file, the pseudo-header will have MTP2_ANNEX_A_USED_UNKNOWN in
it.)

svn path=/trunk/; revision=22067

1 files changed, 25 insertions, 11 deletions

diff --git a/wiretap/erf.h b/wiretap/erf.h
index ed7ade992a..5a9a4d592e 100644
--- a/wiretap/erf.h
+++ b/wiretap/erf.h
@@ -39,16 +39,30 @@
 #define __W_ERF_H__
 
 /* Record type defines */
-#define TYPE_LEGACY	0
-#define TYPE_HDLC_POS	1
-#define TYPE_ETH	2
-#define TYPE_ATM	3
-#define TYPE_AAL5	4
-#define TYPE_MC_HDLC	5
-#define TYPE_MC_RAW	6
-#define TYPE_MC_ATM	7
-#define TYPE_MC_AAL2	9
-#define TYPE_MC_AAL5	12
+#define TYPE_LEGACY             0
+#define TYPE_HDLC_POS           1
+#define TYPE_ETH                2
+#define TYPE_ATM                3
+#define TYPE_AAL5               4
+#define TYPE_MC_HDLC            5
+#define TYPE_MC_RAW             6
+#define TYPE_MC_ATM             7
+#define TYPE_MC_RAW_CHANNEL     8
+#define TYPE_MC_AAL5            9
+#define TYPE_COLOR_HDLC_POS     10
+#define TYPE_COLOR_ETH          11
+#define TYPE_MC_AAL2            12
+#define TYPE_IP_COUNTER         13
+#define TYPE_TCP_FLOW_COUNTER   14
+#define TYPE_DSM_COLOR_HDLC_POS 15
+#define TYPE_DSM_COLOR_ETH      16
+#define TYPE_COLOR_MC_HDLC_POS  17
+#define TYPE_AAL2               18
+
+#define TYPE_PAD                48
+
+#define TYPE_MIN  1   /* sanity checking */
+#define TYPE_MAX  48  /* sanity checking */
 
  /*
   * The timestamp is 64bit unsigned fixed point little-endian value with
@@ -100,7 +114,7 @@ typedef struct erf_record {
  * Size of MC_HDLC payload
  */
 #define MC_HDLC_WLEN(h, e)		(g_htons((h)->wlen))
-#define MC_HDLC_SLEN(h, e)		min(HDLC_WLEN(h, e), g_htons((h)->rlen) - sizeof(*(h)) )
+#define MC_HDLC_SLEN(h, e)		min(MC_HDLC_WLEN(h, e), g_htons((h)->rlen) - sizeof(*(h)) )
 
 int erf_open(wtap *wth, int *err, gchar **err_info);