aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/iptrace.c
AgeCommit message (Collapse)AuthorFilesLines
2005-08-28Get rid of a no-longer-true comment.Guy Harris1-4/+0
svn path=/trunk/; revision=15598
2005-08-25timestamp display precision:Ulf Lamping1-0/+2
- automatic adjustment depending on file format - manual adjustment through menu items save the setting in the recent file svn path=/trunk/; revision=15534
2005-08-24EVERYTHING IN THE BUILDBOT IS GOING TO BE RED!!! Sorry! Ulf Lamping1-4/+4
I've done more than a day to change the timestamp resolution from microseconds to nanoseconds. As I really don't want to loose those changes, I'm going to check in the changes I've done so far. Hopefully someone else will give me a helping hand with the things left ... What's done: I've changed the timestamp resolution from usec to nsec in almost any place in the sources. I've changed parts of the implementation in nstime.s/.h and a lot of places elsewhere. As I don't understand the editcap source (well, I'm maybe just too tired right now), hopefully someone else might be able to fix this soon. Doing all those changes, we get native nanosecond timestamp resolution in Ethereal. After fixing all the remaining issues, I'll take a look how to display this in a convenient way... As I've also changed the wiretap timestamp resolution from usec to nsec we might want to change the wiretap version number... svn path=/trunk/; revision=15520
2004-07-18Set the svn:eol-style property on all text files to "native", so thatGuy Harris1-1/+1
they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-01-25Have the Wiretap open, read, and seek-and-read routines return, inGuy Harris1-14/+18
addition to an error code, an error info string, for WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with "g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed strings returned as the error info string, and change the callers of those routines to, for those errors, put the info string into the printed message or alert box for the error. Add messages for cases where those errors were returned without printing an additional message. Nobody uses the error code from "cf_read()" - "cf_read()" puts up the alert box itself for failures; get rid of the error code, so it just returns a success/failure indication. Rename "file_read_error_message()" to "cf_read_error_message()", as it handles read errors from Wiretap, and have it take an error info string as an argument. (That handles a lot of the work of putting the info string into the error message.) Make some variables in "ascend-grammar.y" static. Check the return value of "erf_read_header()" in "erf_seek_read()". Get rid of an unused #define in "i4btrace.c". svn path=/trunk/; revision=9852
2004-01-24Fix all fixable warningsJörg Mayer1-5/+5
Move addional warnings from extra-gcc-checks to normal compilation flags svn path=/trunk/; revision=9826
2003-10-01Have a pseudo-header for Ethernet packets, giving the size of the FCS -Guy Harris1-55/+64
0 means "there is no FCS in the packet data", 4 means "there is an FCS in the packet data", -1 means "I don't know whether there's an FCS in the packet data, guess based on the packet size". Assume that Ethernet encapsulated inside other protocols has no FCS, by having the "eth" dissector assume that (and not check for an Ethernet pseudo-header). Have "ethertype()" take an argument giving the FCS size; pass 0 when appropriate. Fix up Wiretap routines to set the pseudo-header. This means we no longer use the "generic" seek-and-read routine, so get rid of it. svn path=/trunk/; revision=8574
2003-01-10The Sniffer file formats include a file to identify raw cells; exportGuy Harris1-1/+2
that flag in the ATM pseudo-header, and use it to determine whether a frame is a raw cell or a reassembled frame, rather than using the AAL, as you can have raw AAL5 cells in a capture. svn path=/trunk/; revision=6889
2003-01-03Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not justGuy Harris1-6/+6
used for the DOS-based ATM Sniffer. (That's not a great name, but I couldn't think of a better one.) Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture files where reassembled frames don't have trailers, such as the AAL5 trailer, chopped off. That's what at least some versions of the Windows-based ATM Sniffer appear to have. Map the ATM capture file type for NetXRay captures to WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've reverse-engineered, so far, for the pseudo-header; there's more that needs to be done on it, e.g. getting the channel, AAL type, and traffic type (or inferring them if they're not in the packet header). svn path=/trunk/; revision=6840
2002-11-01Handle the 3 bytes of padding before the FDDI frame data in iptraceGuy Harris1-33/+157
captures. Use #defines rather than magic numbers for various header sizes, and put in a comment explaining the header formats. svn path=/trunk/; revision=6545
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-4/+4
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6115
2002-08-13Get rid of the "vpi" and "vci" arguments to "atm_guess_traffic_type()",Guy Harris1-7/+7
have it get that information from the pseudo-header instead, and set the VPI and VCI fields in the pseudo-header before calling it. Don't call it for non-ATM NetMon captures. svn path=/trunk/; revision=5982
2002-07-29From Joerg Mayer:Guy Harris1-5/+5
All files: - Replace types from sys/types.h by those from glib.h - Replace ntoh family of macros from netinet/in.h and winsock2.h by g_ntoh family from glib.h - Remove now unneeded includes of sys/types.h, netinet/in.h and winsock2.h wtap.h Move includes to the top svn path=/trunk/; revision=5909
2002-06-07Graeme Hewson noted that zlib has a bug wherein "gzseek()" doesn't setGuy Harris1-7/+3
the internal z_err value for the stream if an "fseek()" call it makes fails, so that if "gzerror()" is subsequently called, it returns Z_OK rather than an error. To work around this, we pass "file_seek()" an "int *err", and have the with-zlib version of "file_seek()" check, if "gzseek()" fails, whether the return value of "file_error()" is 0 and, if so, have it return "errno" instead. svn path=/trunk/; revision=5642
2002-04-30Move the code to guess the traffic type based on the packet contentsGuy Harris1-29/+36
into Wiretap, so that if you read a frame from Wiretap you have what traffic type information could be gleaned from the information in the capture file, and can write the frame out to a capture file where the file contains some or all of that information without having to determine it outside of Wiretap. svn path=/trunk/; revision=5314
2002-04-30Replace the "ngsniffer_atm" with an "atm" pseudo-header, which isn'tGuy Harris1-13/+18
just an image of the ATM Sniffer data. This means that Ethereal doesn't have to know any ATM Sniffer-specific details (that's all hidden in Wiretap), and allows us to add to that pseudo-header fields, traffic types, etc. unknown to ATM Sniffers. Have Wiretap map VPI 0/VCI 5 to the signalling AAL - for some capture files, this might not be necessary, as they may mark all signalling traffic as such, but, on other platforms, we don't know the AAL, so we assume AAL5 except for 0/5 traffic. Doing it in Wiretap lets us hide those details from Ethereal (and lets Ethereal interpret 0/5 traffic as non-signalling traffic, in case that happens to be what it is). We may know that traffic is LANE, but not whether it's LE Control or emulated 802.3/802.5; handle that case. svn path=/trunk/; revision=5302
2002-03-05Make "wtap_seek_read()" return TRUE on success and FALSE on error, likeGuy Harris1-16/+16
"wtap_read()". Add some additional error checks to the Sniffer file reader. svn path=/trunk/; revision=4875
2002-03-05Have "wtap_seek_read()" return 0 on success and -1 on failure, and takeGuy Harris1-15/+31
an "err" argument that points to an "int" into which to put an error code if it fails. Check for errors in one call to it, and note that we should do so in other places. In the "wtap_seek_read()" call in the TCP graphing code, don't overwrite "cfile.pseudo_header", and make the buffer into which we read the data WTAP_MAX_PACKET_SIZE bytes, as it should be. In some of the file readers for text files, check for errors from the "parse the record header" and "parse the hex dump" routines when reading sequentially. In "csids_seek_read()", fix some calls to "file_error()" to check the error on the random stream (that being what we're reading). svn path=/trunk/; revision=4874
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4199
2001-10-25Interface type 0x07 is Ethernet.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4078
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris1-9/+9
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
2001-03-10Obliging every capture file reader's "open()" routine to seek to theGuy Harris1-3/+1
beginning of the file before reading anything from the file is bogus - do that in the loop that tries each of the open routines, instead. (They may have to reset the seek pointer later if, for example, the capture file begins with the first packet, and the "open()" routine looks at that packet to try to guess whether the packet is in the file format in question.) Set "wth->data_offset" to 0 while you're at it, so capture file readers don't have to do that, either. svn path=/trunk/; revision=3123
2000-09-21Make sure to pass the sent/received direction from pppdump.c inGilbert Ramirez1-2/+2
pseudo_header. Use generic "p2p_phdr" instead of "lapd_phdr". Modify toshiba.c and packet-lapd.c to take that into account. Add frame.p2p_dir, a filterable field, 0=sent, 1=recvd Make p2p_dir available in packe_info, as I think it will be needed in VJ COMP and UNCOMP dissection. Rename WTAP_ENCAP_TR to WTAP_ENCAP_TOKEN_RING. Mention pppd-log support in man page. Mention atmsnoop in README. svn path=/trunk/; revision=2455
2000-09-07Change wtap_read() API so that the data offset is set via a pointer, andGilbert Ramirez1-17/+17
a "keep reading" boolean value is returned from the function. This avoids having to hack around the fact that some file formats truly do have records that start at offset 0. (i4btrace and csids have no file header. Neither does the pppdump-style file that I'm looking at right now). svn path=/trunk/; revision=2392
2000-08-25Move #include <time.h> into wtap-int.h instead of requiring it inGilbert Ramirez1-2/+1
every C file. I noticed this because of a build break of csids.obj on Win32. svn path=/trunk/; revision=2378
2000-05-19Add wtap-int.h. Move definitions relevant to the internal workins of wiretapGilbert Ramirez1-8/+8
to that file, leave public definitions in wtap.h. Rename "union pseudo_header" to "union wtap_pseudo_header". Make the wtap_pseudo_header pointer available in packet_info struct. svn path=/trunk/; revision=1989
2000-05-19In Wiretap, a file stream handle is a "FILE_T", not a "FILE_T *" (aGuy Harris1-5/+5
"FILE_T" is either a "gzFile" or a "FILE *", depending on whether zlib support is enabled or not). Fix various function declarations and definitions. svn path=/trunk/; revision=1984
2000-05-18Remove the "union pseudo_header" from the "frame_data" structure;Guy Harris1-69/+130
there's no need to keep it around in memory - when the frame data is read in when handing a frame, read in the information, if any, necessary to reconstruct the frame header, and reconstruct it. This saves some memory. This requires that the seek-and-read function be implemented inside Wiretap, and that the Wiretap handle remain open even after we've finished reading the file sequentially. This also points out that we can't really do X.25-over-Ethernet correctly, as we don't know where the direction (DTE->DCE or DCE->DTE) flag is stored; it's not clear how the Ethernet type 0x0805 for X.25 Layer 3 is supposed to be handled in any case. We eliminate X.25-over-Ethernet support (until we find out what we're supposed to do). svn path=/trunk/; revision=1975
2000-03-30Jochen Friedrich <jochen@nwe.de>Gilbert Ramirez1-2/+2
protocol type 0x0c in AIX iptrace is used for the IBM SP switch devices. Encoding is RAW IP... svn path=/trunk/; revision=1767
2000-02-19Use WTAP_ERR_UNSUPPORTED_ENCAP for all attempts to open or read aGuy Harris1-3/+3
capture file for an unsupported link-layer encapsulation type (as the nettl reader does), and report it correctly if it occurs on an open or read attempt rather than a save attempt. svn path=/trunk/; revision=1647
2000-01-22Fix files that had Gilbert's old e-mail address or that didn't have myGuy Harris1-2/+2
forwarding e-mail address. svn path=/trunk/; revision=1522
2000-01-13We are obliged to define HAVE_UNISTD_H in "config.h"; to avoid theGuy Harris1-2/+2
hideous problem on FreeBSD 3.[23] (and perhaps other BSDs) if HAVE_UNISTD_H is defined before "zlib.h" is included, turn "file_seek()" into a subroutine defined in a file that *undefines* HAVE_UNISTD_H before including "zlib.h", so that the *only* call to "gzseek()" is made from a file that does not have HAVE_UNISTD_H defined when it includes "zlib.h". Move "file_error()" to that file while you're at it, so it holds all the wrappers that hide the presence or absence of zlib from routines to read capture files. Turn "file.h", which declared those wrapper functions as well as wrapper macros, into "file_wrapper.h" - it belongs with the "file_wrapper.c" file that defines the wrapper functions, not with "file.c" which handles higher-layer file access functions. Remove the comment in "configure.in" that explained why defining HAVE_UNISTD_H was a bad idea, as we're not obliged to define it and work around the problem. (The comment in "file_wrapper.c" explains the workaround.) svn path=/trunk/; revision=1463
1999-11-27Move the "guess what type of ATM traffic this is" stuff into the ATMGuy Harris1-47/+37
dissector; I don't think it's guaranteed that even a Sniffer will tell you that (there may be situations where it can't figure it out, and where the user didn't tell it), we may need it for "atmsnoop" traffic and other types of ATM traffic as well, we will probably want to add to it the ability to let the user specify "virtual circuit X.Y is this kind of traffic", and we may also have Ethereal try to intuit it based on previous traffic in the capture (Q.2931 call setup, LANE traffic, etc.). Don't show the cell count if it's zero - assume that means we don't know how many cells made up the packet. Also don't show the AAL5 trailer if the cell count is zero - the ATM Sniffer *might* sometimes supply a cell count of 0 even if it has the AAL5 trailer, I guess, and we *might* see some other capture file format that has the AAL5 trailer but no cell count, but we'll cross that bridge when we come to it. Add support for "atmsnoop" captures to the code to handle "snoop" captures. Use the field in "iptrace" headers that appears to be, in ATM captures, a direction indicator - we may have the direction backwards, but, as an STP packet was tagged as a DCE->DTE packet, and as the capturing machine, which also was presumably the recipient of the packet, was an AIX box, not a switch or bridge or some piece of networking equipment such as that, it *probably* wasn't sending the STP packet, it was probably receiving it. svn path=/trunk/; revision=1120
1999-11-26Support for iptrace 1.0 traces (AIX 3). Thanks to Florian LohoffGilbert Ramirez1-43/+149
<flo@rfc822.org> for the sample traces. It turns out that the iptrace 2.0 header is simply an extension to the iptrace 1.0 header. It also appears that iptrace 1.0 has only tv_sec, but not tv_usec, which explains why the fields are separated in the iptrace 2.0 header, but doesn't explain why the iptrace 2.0 header has tv_sec copied in two places. I changed iptrace.c to detect FDDI captures via if_type, even though I don't have a trace to substantiate this. If *should* work, given that loopback, ethernet, token-ring, and X.25 work. If it doesn't work, someone will let me know. svn path=/trunk/; revision=1117
1999-11-22Detect x.25 and loopback traces via if_type field, not theGilbert Ramirez1-16/+4
interface name. Thanks to Olivier for testing this. The only link type detected by interface name is FDDI. svn path=/trunk/; revision=1094
1999-11-19Add comments showing IFT names for the IFT-to-Wiretap encapsulation array.Gilbert Ramirez1-40/+55
If a interface type is not recognized, set error to WTAP_ERR_UNSUPPORTED instead of WTAP_BAD_RECORD. Continue to check for X.25, FDDI, and loopback traces via the interface name instead of the newly-discovered if_type field in the packet header. Once Olivier confirms that his traces still work by checking only if_type, I'll change the code. But he's on vacation right now. ATM, Ethernet, and Token-Ring are discovered via the if_type field. svn path=/trunk/; revision=1063
1999-11-18(AppTrafType & ATT_HLTYPE) is the type of high-level traffic, andGuy Harris1-4/+16
AppHLType is the subtype of that type; set them appropriately (as best we can, given that we can only *guess* what kind of traffic it is) for "iptrace" captures in Wiretap. (Alas, more work is needed to distinguish Ethernet from Token-Ring LANE traffic....) Handle VPI = 0, VCI = 5 as the Signalling AAL in "iptrace" captures. svn path=/trunk/; revision=1058
1999-11-18Check in my work so far on enabling the ATM iptrace capability. NotGilbert Ramirez1-39/+159
all packets are recognized yet, but ILMI and Classical IP (LLCMX) are. The ATM iptrace facility uses the ngsniffer_atm_phdr pseudo header so that ethereal doesn't have to worry about yet another psuedo header. svn path=/trunk/; revision=1057
1999-11-17Add some comment based on some spelunking done in some capture files,Guy Harris1-1/+10
and on a comment that "libpcap"/BPF on AIX appears to return 6 as the network type for an Ethernet device - the BSD IFT_ETHER is 6. svn path=/trunk/; revision=1048
1999-10-06Whitespace cleanup.Guy Harris1-2/+2
svn path=/trunk/; revision=773
1999-10-06Add "wtap_file_encap()", to return the encapsulation of packets in theGuy Harris1-1/+14
file (which could be WTAP_ENCAP_UNKNOWN, if we couldn't determine it, or WTAP_ENCAP_PER_PACKET, if we could determine the encapsulation of packets in the file, but they didn't all have the same encapsulation). This may be useful in the future, if we allow files to be saved in different capture file formats - we'd have to specify, when creating the capture file, the per-file encapsulation, for those formats that don't support per-packet encapsulations (we wouldn't be able to save a multi-encapsulation capture in those formats). Make the code to read "iptrace" files set the per-file packet encapsulation - set it to the type of the first packet seen, and, if any subsequent packets have a different encapsulation, set it to WTAP_ENCAP_PER_PACKET. svn path=/trunk/; revision=772
1999-10-05Better handle errors from zlib:Guy Harris1-10/+7
Assign a range of Wiretap errors for zlib errors, and have "wtap_strerror()" use "zError()" to get an error message for them. Have the internal "file_error()" routine return 0 for no error and a Wiretap error code for an error. svn path=/trunk/; revision=769
1999-09-24Fix it so that it builds with "--disable-zlib".Guy Harris1-2/+2
The "fh" member of a "wtap" structure points to something constructed from the "fd" member of that structure, so that closing the stream referred to by "fh" also closes the underlying file descriptor; get rid of an unnecessary close of "wth->fd". svn path=/trunk/; revision=720
1999-09-22This commit contains support for reading capture files compressed usingAshok Narayanan1-8/+9
gzip. The zLib library is used for this purpose. If zLib is not available (or it's use is disabled by the --disable-zlib option to configure), you can still compile Ethereal but it will be unable to read compressed capture files. IMPORTANT: Now all file accesses to capture files should be done through special macros. Specifically, for any use of the following functions on capture files, replace them. The arguments for the right-side functions are exactly the same as for the original stdio functions. fopen file_open fdopen filed_open fread file_read fwrite file_write fseek file_seek fclose file_close ferror file_error svn path=/trunk/; revision=695
1999-08-28Keep in the "wtap" structure the current offset into the file beingGuy Harris1-2/+6
read, and maintain it ourselves as we read through the file, rather than calling "ftell()" for every packet we read - "ftell()" may involve an "lseek()" call, which could add a noticeable CPU overhead when reading a large file. svn path=/trunk/; revision=596
1999-08-24Add a new Wiretap encapsulation type WTAP_ENCAP_FDDI_BITSWAPPED, meaningGuy Harris1-2/+2
"FDDI with the MAC addresses bit-swapped"; whether the MAC addresses are bit-swapped is a property of the machine on which the capture was taken, not of the machine on which the capture is being read - right now, none of the capture file formats we read indicate whether FDDI MAC addresses are bit-swapped, but this does let us treat non-"libpcap" captures as being bit-swapped or not bit-swapped independent of the machine on which they're being read (and of the machine on which they were captured, but I have the impression they're bit-swapped on most platforms), and allows us to, if, as, and when we implement packet capture in Wiretap, mark packets in a capture file written in Wiretap-native format based on the machine on which they are captured (assuming the rule "Ultrix, Alpha, and BSD/OS are the only platforms that don't bit-swap", or some other compile-time rule, gets the right answer, or that some platform has drivers that can tell us whether the addresses are bit-swapped). (NOTE: if, for any of the capture file formats used only on one platform, FDDI MAC addresses aren't bit-swapped, the code to read that capture file format should be fixed to flag them as not bit-swapped.) Use the encapsulation type to decide whether to bit-swap addresses in "dissect_fddi()". svn path=/trunk/; revision=557
1999-08-22Get rid of some cruft left in by previous checkins as placeholders.Guy Harris1-2/+5
Get rid of WTAP_ENCAP_NONE; replace it with WTAP_ENCAP_UNKNOWN, which means "I can't handle that file, it's using an encapsulation I don't support". Check for encapsulations we don't support, and return an error (as is already done in "libpcap.c"). Check for too-large packet sizes, and return an error (as is already done in "libpcap.c"). Print unsigned quantities in Wiretap messages with "%u", not "%d". svn path=/trunk/; revision=544
1999-08-20Made iptrace wiretap module return error on partial packets, instead ofGilbert Ramirez1-16/+5
expecting it as normal. Added paragraph about iptrace oddities to README. I also added a section to the README about how to report bugs. svn path=/trunk/; revision=519
1999-08-19Have the per-capture-file-type open routines "wtap_open_offline()" callsGuy Harris1-11/+30
return 1 on success, -1 if they got an error, and 0 if the file isn't of the type that file is checking for, and supply an error code if they return -1; have "wtap_open_offline()" use that error code. Also, have the per-capture-file-type open routines treat errors accessing the file as errors, and return -1, rather than just returning 0 so that we try another file type. Have the per-capture-file-type read routines "wtap_loop()" calls return -1 and supply an error code on error (and not, as they did in some cases, call "g_error()" and abort), and have "wtap_loop()", if the read routine returned an error, return FALSE (and pass an error-code-pointer argument onto the read routines, so they fill it in), and return TRUE on success. Add some new error codes for them to return. Now that "wtap_loop()" can return a success/failure indication and an error code, in "read_cap_file()" put up a message box if we get an error reading the file, and return the error code. Handle the additional errors we can get when opening a capture file. If the attempt to open a capture file succeeds, but the attempt to read it fails, don't treat that as a complete failure - we may have managed to read some of the capture file, and we should display what we managed to read. svn path=/trunk/; revision=516
1999-07-28Added a patch from Olivier Abad to handle X.25 iptrace captures.Gerald Combs1-1/+7
svn path=/trunk/; revision=390
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-01 10:20:48 +0000