aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/libpcap.c
AgeCommit message (Collapse)AuthorFilesLines
2003-12-21libpcap.c:1777: warning: implicit declaration of function htonsJörg Mayer1-2/+2
svn path=/trunk/; revision=9388
2003-12-18Add support for a link-layer type value of 143 as DOCSIS in libpcapGuy Harris1-1/+3
captures. svn path=/trunk/; revision=9350
2003-12-18From Jan Kiszka: IrDA support.Guy Harris1-6/+130
svn path=/trunk/; revision=9345
2003-12-03From Jeff Morriss: add support for libpcap MTP2 and MTP3 captures.Guy Harris1-1/+4
Add a missing entry in "encap_table[]" for Bluetooth H4, and fix some comments. svn path=/trunk/; revision=9157
2003-10-24Move the version number checking for libpcap files, to see whether toGuy Harris1-21/+54
swap the "captured length" and "length" fields, to the open-file code; store a tri-state (definitely swapped, definitely not swapped, maybe swapped) value in the per-capture-file-format information for libpcap format, and use that when processing packets. svn path=/trunk/; revision=8774
2003-10-24The capture tools for DGUX has swapped the included/original packet lengths ↵Ronnie Sahlberg1-1/+10
of the frame header. they specify the pcap version as 543.0 svn path=/trunk/; revision=8772
2003-10-01Have a pseudo-header for Ethernet packets, giving the size of the FCS -Guy Harris1-3/+23
0 means "there is no FCS in the packet data", 4 means "there is an FCS in the packet data", -1 means "I don't know whether there's an FCS in the packet data, guess based on the packet size". Assume that Ethernet encapsulated inside other protocols has no FCS, by having the "eth" dissector assume that (and not check for an Ethernet pseudo-header). Have "ethertype()" take an argument giving the FCS size; pass 0 when appropriate. Fix up Wiretap routines to set the pseudo-header. This means we no longer use the "generic" seek-and-read routine, so get rid of it. svn path=/trunk/; revision=8574
2003-09-04Put in a note telling people how to add a new libpcap encapsulationGuy Harris1-1/+47
type, and telling them how it should *NOT* be done, i.e. you should ask tcpdump-workers for a new DLT_ value, you should not just pick a value on your own, and you should especially not reuse a value that's already in use! Put in comments about reserved values in the current CVS libpcap. svn path=/trunk/; revision=8367
2003-05-15From Can Erkin Acar: OpenBSD is now using tcpdump.org-assigned DLT_Guy Harris1-2/+2
value for DLT_PFLOG, and that goes along with a change to the link-layer header for DLT_PFLOG - support both the old and new values and format. svn path=/trunk/; revision=7676
2003-03-25AIX's BPF, and thus its tcpdump, appears to use 24 as the link-layerGuy Harris1-4/+17
type for loopback devices; map it to DLT_NULL when reading libpcap files with a major version of 2 and a minor version of 2, and when capturing from an "loN" device on AIX. svn path=/trunk/; revision=7361
2003-03-08WTAP_ENCAP_ENC was, in fact, intended for use for DLT_ENC, so justGuy Harris1-3/+3
rename WTAP_ENCAP_ENC0 to WTAP_ENCAP_ENC. un-#if 0 out the code to handle the value 109 for DLT_ENC, as I've just checked in support for DLT_ENC in tcpdump.org libpcap and tcpdump, which maps DLT_ENC to 109 in the file header. Give packet-enc.c an RCS ID. svn path=/trunk/; revision=7323
2003-03-07From Markus Friedl:Gerald Combs1-2/+2
Add support for the OpenBSD enc(4) encapsulating interface. Add support for Ethernet over IP (RFC 3378). Fold Markus' .h files into their respective .c files, add a define to ipproto.h and use it. svn path=/trunk/; revision=7310
2003-01-31Add WTAP_ENCAP_FRELAY_WITH_PHDR for use with Frame Relay capture filesGuy Harris1-9/+26
that have direction information. Support writing WTAP_ENCAP_FRELAY_WITH_PHDR and WTAP_ENCAP_PPP_WITH_PHDR captures out in libpcap format - we throw away the direction information, but so it goes. When reading/writing Windows Sniffer format, read and write the direction flag. svn path=/trunk/; revision=7052
2003-01-23In the BSDs, ARCNET packets don't have an offset field between theGuy Harris1-1/+2
addresses and the protocol type, as supplied by BPF; on Linux, they *do* have an offset field, as supplied by PF_PACKET sockets. Add a new WTAP_ENCAP_ARCNET_LINUX, with packets that include the offset field, and don't dissect an offset in WTAP_ENCAP_ARCNET packets. Map a libpcap link-layer type of 129 to WTAP_ENCAP_ARCNET_LINUX; that value was recently assigned to Linux-style ARCNET. Add some more ARCNET protocol IDs. For most protocol IDs, dissect an ATA 878.2 fragmentation header; don't do it for RFC 1051 IP and ARP, and Diagnose packets. Set the length of the ARCNET protocol tree item appropriately. Dissect both the RFC 1051 and RFC 1201 styles of IP and ARP over ARCNET, and dissect the RFC 1201 style of RARP as well. svn path=/trunk/; revision=6981
2003-01-10The Sniffer file formats include a file to identify raw cells; exportGuy Harris1-1/+2
that flag in the ATM pseudo-header, and use it to determine whether a frame is a raw cell or a reassembled frame, rather than using the AAL, as you can have raw AAL5 cells in a capture. svn path=/trunk/; revision=6889
2003-01-09It appears that a channel number of 0 means DTE->DCE, and a channelGuy Harris1-3/+3
number of 1 means DCE->DTE, in DOS Sniffer ATM captures. svn path=/trunk/; revision=6881
2003-01-08From Chris Waters: support Tazmen Sniffer Protocol and DLT_TZSP capturesGuy Harris1-1/+2
from network-based libpcaps that use that protocol. svn path=/trunk/; revision=6875
2003-01-03Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not justGuy Harris1-9/+9
used for the DOS-based ATM Sniffer. (That's not a great name, but I couldn't think of a better one.) Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture files where reassembled frames don't have trailers, such as the AAL5 trailer, chopped off. That's what at least some versions of the Windows-based ATM Sniffer appear to have. Map the ATM capture file type for NetXRay captures to WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've reverse-engineered, so far, for the pseudo-header; there's more that needs to be done on it, e.g. getting the channel, AAL type, and traffic type (or inferring them if they're not in the packet header). svn path=/trunk/; revision=6840
2002-12-11Add support for the new DLT_ value of 127, for the AVS WLAN header.Guy Harris1-2/+3
svn path=/trunk/; revision=6780
2002-11-27The "pd" argument to "wtap_process_pcap_packet()" is a const pointer;Guy Harris1-2/+2
when extracting the ATM pseudo-header from the data it points to, cast it to a "const struct sunatm_hdr *". svn path=/trunk/; revision=6679
2002-11-16AIX's tcpdump has the same annoying habit as AIX's iptrace of putting 3Guy Harris1-1/+24
bytes of padding in front of FDDI frames; strip it off. svn path=/trunk/; revision=6647
2002-10-22Add a Wiretap encapsulation type for RFC 2625 IP-over-Fibre Channel, andGuy Harris1-1/+2
map libpcap's DLT_IP_OVER_FC to it. svn path=/trunk/; revision=6473
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-4/+4
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6115
2002-08-07Properly set the LANE traffic type.Guy Harris1-2/+30
svn path=/trunk/; revision=5967
2002-07-29From Joerg Mayer:Guy Harris1-9/+13
All files: - Replace types from sys/types.h by those from glib.h - Replace ntoh family of macros from netinet/in.h and winsock2.h by g_ntoh family from glib.h - Remove now unneeded includes of sys/types.h, netinet/in.h and winsock2.h wtap.h Move includes to the top svn path=/trunk/; revision=5909
2002-07-16From Graeme Hewson:Guy Harris1-2/+2
Allow "-" as the output file name in Wiretap, referring to the standard error. Optimize the capture loop. Fix some of the error-message printing code in Ethereal and Tethereal. Have Wiretap check whether it can seek on a file descriptor, and pass the results of that test to the file-type-specific "open for output" routine. Have the "open for output" routines for files where we need to seek when writing the file return an error if seeks don't work. svn path=/trunk/; revision=5884
2002-06-13Move the entries to map between platform-dependent libpcap link-layerGuy Harris1-117/+125
types and Wiretap encapsulations after the entries to map between platform-independent libpcap link-layer types and those Wiretap encapsulations, so that, when writing a libpcap-format file, we choose the platform-independent link-layer types. svn path=/trunk/; revision=5668
2002-06-10Add #define HAVE_PCAP_H 1 to config.h.win32.Gilbert Ramirez1-12/+13
In libpcap.c, move wtap_pcap_encap_to_wtap_encap before libpcap_open so that if HAVE_PCAP_H is not true, the file will still compile. svn path=/trunk/; revision=5660
2002-06-07Add a Wiretap routine to process packets captured via libpcap, possiblyGuy Harris1-23/+87
extracting a pseudo-header, for the use of SunATM captures. Add support for SunATM capture. svn path=/trunk/; revision=5652
2002-06-07Graeme Hewson noted that zlib has a bug wherein "gzseek()" doesn't setGuy Harris1-19/+9
the internal z_err value for the stream if an "fseek()" call it makes fails, so that if "gzerror()" is subsequently called, it returns Z_OK rather than an error. To work around this, we pass "file_seek()" an "int *err", and have the with-zlib version of "file_seek()" check, if "gzseek()" fails, whether the return value of "file_error()" is 0 and, if so, have it return "errno" instead. svn path=/trunk/; revision=5642
2002-06-07BSD/OS Frame Relay packets just begin with the Frame Relay header, soGuy Harris1-17/+4
they are, in fact, WTAP_ENCAP_FRELAY. Support 11 as WTAP_ENCAP_FRELAY if DLT_FR is defined and is equal to 11, and support 107 as WTAP_ENCAP_FRELAY unconditionally. Get rid of a comment indicating that 105 isn't used - it's been supported as DLT_IEEE802_11 for a while. svn path=/trunk/; revision=5640
2002-06-06Use "phtons()", not "htons()", just as we use "pntohs()" rather thanGuy Harris1-2/+2
"ntohs()". svn path=/trunk/; revision=5636
2002-06-06Support the Solaris+SunATM libpcap capture file type (not yet checkedGuy Harris1-14/+241
into libpcap or tcpdump, but the LINKTYPE_ number is reserved for that purpose). svn path=/trunk/; revision=5633
2002-03-09Sigh. Tcpdump cannot handle capture files with a snapshot length of 0,Guy Harris1-2/+14
as BPF filters return either 0 if they fail or the snapshot length if they succeed, and a snapshot length of 0 means success is indistinguishable from failure and the filter expression would reject all packets. Now that a snapshot length of 0, inside Ethereal, means "snapshot length unknown", we have to, when opening a libpcap file for output, make the snapshot length some non-zero value. We make it WTAP_MAX_PACKET_SIZE, in case some program uses the snapshot length as a buffer size. (That doesn't help if there are packets with more than 65535 bytes of data; if there are, we'd need to raise WTAP_MAX_PACKET_SIZE just to make those files readable in Ethereal in any case.) svn path=/trunk/; revision=4905
2002-03-07Fix a comment.Guy Harris1-3/+3
svn path=/trunk/; revision=4899
2002-03-07Fix a typo - IFT_ISO88025 is 9, not 8.Guy Harris1-2/+2
svn path=/trunk/; revision=4898
2002-03-04Check for errors in seeks, "tell"s, and "stat()"s/"fstat()"s.Guy Harris1-9/+38
For file types where we allocate private data, add "close" routines where they were missing, to free the private data. Also fix up the code to clean up after some errors by freeing private data where that wasn't being done. Get rid of unused arguments to "wtap_dump_open_finish()". Fix indentation. svn path=/trunk/; revision=4857
2002-03-02From Joerg Mayer: get rid of "-Wno-unused" flag in some configureGuy Harris1-3/+5
scripts, and check in changes to add _U_ to some unused arguments (some other should perhaps be used, so we leave the _U_ out so that the warnings serve as a reminder to check those). svn path=/trunk/; revision=4847
2002-02-27From Joerg Mayer: remove unused variables and declarations ofGuy Harris1-3/+3
non-existent functions. Remove the "filetype" argument from the "can_write_encap" functions for particular capture file types - the argument value is implicit, in that the routine being called is the routine for that particular file type. svn path=/trunk/; revision=4823
2002-02-07Support in Wiretap for DLT_HHDLC, from Tomas Kukosa.Guy Harris1-1/+2
svn path=/trunk/; revision=4707
2002-01-29Support a libpcap link-layer type of 17 as DLT_PFLOG unless DLT_LANE8023Guy Harris1-3/+4
is defined as 17. svn path=/trunk/; revision=4617
2002-01-29Support for capturing on, and reading captures from, OpenBSD firewallGuy Harris1-1/+13
logging virtual interface, from Mike Frantzen. svn path=/trunk/; revision=4616
2001-12-04Support for stopping capture at specified capture file size or captureGuy Harris1-1/+5
duration, from Thomas Wittwer and Matthias Nyffenegger. svn path=/trunk/; revision=4322
2001-11-30Add support for LocalTalk Link Access Protocol.Guy Harris1-2/+4
Rename WTAP_ENCAP_PRISM to WTAP_ENCAP_PRISM_HEADER, to match DLT_PRISM_HEADER. Add in missing capture support for WTAP_ENCAP_PRISM_HEADER when capturing with "pcap_open_live()" rather than reading the capture from a pipe. svn path=/trunk/; revision=4299
2001-11-28Support for 802.11+Prism II monitor-mode link-layer headers, fromGuy Harris1-2/+3
Tim Newsham. Add in missing item for WTAP_ENCAP_CISCO_IOS in the Wiretap encapsulation type table. svn path=/trunk/; revision=4290
2001-11-14Back the previous hack out - the padding is often zero, but it's notGuy Harris1-68/+3
*always* zero, so it won't always work, and it's somewhat gross. The right answer is "don't use Digital/Tru64 UNIX's tcpdump, use tcpdump.org's". svn path=/trunk/; revision=4202
2001-11-14Throw in a hack to try to detect FDDI captures from Digital UNIX'sGuy Harris1-3/+68
tcpdump and, if we think we've found one, strip off the 3 padding bytes they put in front of the frame. svn path=/trunk/; revision=4201
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4199
2001-11-09Wrap calls to "pcap_datalink()" in a routine that attempts to compensateGuy Harris1-7/+8
for AIX 5.x's non-standard libpcap, where "pcap_datalink()" doesn't return DLT_ values, it returns RFC 1573 ifType values. Put that wrapper, and the routine to get the interface list, in a separate file, for packet-capture utility routines, so not everybody who includes "util.h" needs to include <pcap.h>. Fix up the Wiretap hack for dealing with said incompatibility to use the correct ifType value for Token Ring. svn path=/trunk/; revision=4184
2001-11-07Expand on the comments about AIX libpcap.Guy Harris1-6/+10
No, Nokia *weren't* kind enough to change the major or minor version number in the capture file when they changed the format, just as they weren't kind enough to change the magic number. svn path=/trunk/; revision=4173
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-02 00:16:47 +0000