aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/netmon.c
AgeCommit message (Collapse)AuthorFilesLines
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-5/+5
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6115
2002-08-13Get rid of the "vpi" and "vci" arguments to "atm_guess_traffic_type()",Guy Harris1-5/+8
have it get that information from the pseudo-header instead, and set the VPI and VCI fields in the pseudo-header before calling it. Don't call it for non-ATM NetMon captures. svn path=/trunk/; revision=5982
2002-08-13Use "atm_guess_traffic_type()" to guess the ATM traffic type for ATMGuy Harris1-15/+23
NetMon captures. svn path=/trunk/; revision=5981
2002-07-29From Joerg Mayer:Guy Harris1-15/+11
All files: - Replace types from sys/types.h by those from glib.h - Replace ntoh family of macros from netinet/in.h and winsock2.h by g_ntoh family from glib.h - Remove now unneeded includes of sys/types.h, netinet/in.h and winsock2.h wtap.h Move includes to the top svn path=/trunk/; revision=5909
2002-07-16From Graeme Hewson:Guy Harris1-3/+10
Allow "-" as the output file name in Wiretap, referring to the standard error. Optimize the capture loop. Fix some of the error-message printing code in Ethereal and Tethereal. Have Wiretap check whether it can seek on a file descriptor, and pass the results of that test to the file-type-specific "open for output" routine. Have the "open for output" routines for files where we need to seek when writing the file return an error if seeks don't work. svn path=/trunk/; revision=5884
2002-06-07Graeme Hewson noted that zlib has a bug wherein "gzseek()" doesn't setGuy Harris1-9/+4
the internal z_err value for the stream if an "fseek()" call it makes fails, so that if "gzerror()" is subsequently called, it returns Z_OK rather than an error. To work around this, we pass "file_seek()" an "int *err", and have the with-zlib version of "file_seek()" check, if "gzseek()" fails, whether the return value of "file_error()" is 0 and, if so, have it return "errno" instead. svn path=/trunk/; revision=5642
2002-06-04The frame table isn't needed once we've made a sequential pass throughGuy Harris1-3/+17
the packets, as the offsets of the frames have been saved by our caller (because they need them to pass to the random-read routine); add a sequential_close routine for Netmon files and free up the frame table in that routine. svn path=/trunk/; revision=5618
2002-05-04Fix capture-file-specific "close output" routines to check whether theGuy Harris1-32/+39
"err" argument is null and return an error code through that argument only if it isn't, to match what "wtap_dump_close()", which calls those routines, does. Put the NetXRay dump routines in order by version number. svn path=/trunk/; revision=5385
2002-04-30Uniformly use "sizeof (struct netmon_atm_hdr)" for the size of NetworkGuy Harris1-3/+3
Monitor's ATM pseudo-header. Fix a message. svn path=/trunk/; revision=5303
2002-04-30Replace the "ngsniffer_atm" with an "atm" pseudo-header, which isn'tGuy Harris1-15/+24
just an image of the ATM Sniffer data. This means that Ethereal doesn't have to know any ATM Sniffer-specific details (that's all hidden in Wiretap), and allows us to add to that pseudo-header fields, traffic types, etc. unknown to ATM Sniffers. Have Wiretap map VPI 0/VCI 5 to the signalling AAL - for some capture files, this might not be necessary, as they may mark all signalling traffic as such, but, on other platforms, we don't know the AAL, so we assume AAL5 except for 0/5 traffic. Doing it in Wiretap lets us hide those details from Ethereal (and lets Ethereal interpret 0/5 traffic as non-signalling traffic, in case that happens to be what it is). We may know that traffic is LANE, but not whether it's LE Control or emulated 802.3/802.5; handle that case. svn path=/trunk/; revision=5302
2002-03-05Make "wtap_seek_read()" return TRUE on success and FALSE on error, likeGuy Harris1-22/+20
"wtap_read()". Add some additional error checks to the Sniffer file reader. svn path=/trunk/; revision=4875
2002-03-05Have "wtap_seek_read()" return 0 on success and -1 on failure, and takeGuy Harris1-7/+9
an "err" argument that points to an "int" into which to put an error code if it fails. Check for errors in one call to it, and note that we should do so in other places. In the "wtap_seek_read()" call in the TCP graphing code, don't overwrite "cfile.pseudo_header", and make the buffer into which we read the data WTAP_MAX_PACKET_SIZE bytes, as it should be. In some of the file readers for text files, check for errors from the "parse the record header" and "parse the hex dump" routines when reading sequentially. In "csids_seek_read()", fix some calls to "file_error()" to check the error on the random stream (that being what we're reading). svn path=/trunk/; revision=4874
2002-03-04Check for errors in seeks, "tell"s, and "stat()"s/"fstat()"s.Guy Harris1-4/+14
For file types where we allocate private data, add "close" routines where they were missing, to free the private data. Also fix up the code to clean up after some errors by freeing private data where that wasn't being done. Get rid of unused arguments to "wtap_dump_open_finish()". Fix indentation. svn path=/trunk/; revision=4857
2002-02-27From Joerg Mayer: remove unused variables and declarations ofGuy Harris1-3/+3
non-existent functions. Remove the "filetype" argument from the "can_write_encap" functions for particular capture file types - the argument value is implicit, in that the routine being called is the routine for that particular file type. svn path=/trunk/; revision=4823
2002-02-08Have Wiretap set the snapshot length to 0 if it can't be derived fromGuy Harris1-2/+2
reading the capture file. Have callers of "wtap_snapshot_length()" treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so that, when writing a capture file in a format that *does* store the snapshot length, we can at least put *something* in the file). If we don't know the snapshot length of the current capture file, don't display a value in the summary window. Don't use "cfile.snap" as the snapshot length option when capturing - doing so causes Ethereal to default, when capturing, to the snapshot length of the last capture file that you read in, rather than to the snapshot length of the last capture you did (or the initial default of "no snapshot length"). Redo the "Capture Options" dialog box to group options into sections with frames around them, and add units to the snapshot length, maximum file size, and capture duration options, as per a suggestion by Ulf Lamping. Also add units to the capture count option. Make the snapshot length, capture count, maximum file size, and capture duration options into a combination of a check box and a spin button. If the check box is not checked, the limit in question is inactive (snapshot length of 65535, no max packet count, no max file size, no max capture duration); if it's checked, the spinbox specifies the limit. Default all of the check boxes to "not checked" and all of the spin boxes to small values. Use "gtk_toggle_button_get_active()" rather than directly fetching the state of a check box. svn path=/trunk/; revision=4709
2002-01-25From Motonori Shindo: protect include of <netinet/in.h> with #ifdefGuy Harris1-1/+3
HAVE_NETINET_IN_H. svn path=/trunk/; revision=4610
2002-01-24Add support for ATM captures (based on writing one out and handing it toGuy Harris1-34/+171
NetMon 2.0; I don't have any ATM captures *from* NetMon to try it on, so I don't know what significance the "destination address" and "source address" fields have, but we can at least read the captures we ourselves write out, as can NetMon). svn path=/trunk/; revision=4606
2001-12-04In the NetMon capture file reading code, if we get a short read whenGuy Harris1-4/+4
trying to read the frame table, return -1 with "*err" set to WTAP_ERR_SHORT_READ, don't return 0 - we've already decided that the file is a NetMon file, so we shouldn't return a "this isn't a NetMon file" indication, we should return a "this file is too short" error, as that's what the problem is. Fix up the error messages for WTAP_ERR_SHORT_READ to indicate that the read might have gotten cut short in the middle of data other than a packet. svn path=/trunk/; revision=4331
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4199
2001-10-25Get rid of signed/unsigned comparison warnings in wiretap.Gilbert Ramirez1-4/+4
svn path=/trunk/; revision=4077
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris1-3/+3
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
2001-08-25The return value from "fwrite()" is a "size_t"; make the variable intoGuy Harris1-12/+12
which we store it a "size_t", and then fix up the bugs that were revealed by the compiler warnings that produced - "fwrite()" returns 0, not a negative number, on an I/O error. Fix up some other items to have type "size_t", or to have various unsigned types, while we're at it, to squelch compiler warnings. svn path=/trunk/; revision=3867
2001-07-15Fixes, from Scott Renfro, for some calls to "localtime()" that didn'tGuy Harris1-9/+19
check whether the call succeeded (it doesn't always do so on Windows, for example). svn path=/trunk/; revision=3722
2001-07-13From Joerg Mayer:Guy Harris1-2/+2
* gcc 3.0 warning fixes: - text2pcap.c: The number of characters to scan should probably not be 0 - wiretap/csids.c: using preincrement on a variable used on both sides of an assignment might be undefined by the C99(?) standard * turn on additional warnings for epan and wiretap too - epan/configure.in - wiretap/configure.in * Fix some warnings (missing includes, signed/unsigned, missing initializers) found by turning on the warnings - all other files :-) svn path=/trunk/; revision=3709
2001-03-10Obliging every capture file reader's "open()" routine to seek to theGuy Harris1-2/+1
beginning of the file before reading anything from the file is bogus - do that in the loop that tries each of the open routines, instead. (They may have to reset the seek pointer later if, for example, the capture file begins with the first packet, and the "open()" routine looks at that packet to try to guess whether the packet is in the file format in question.) Set "wth->data_offset" to 0 while you're at it, so capture file readers don't have to do that, either. svn path=/trunk/; revision=3123
2001-01-25Finish up support for writing NetMon 2.x capture files.Guy Harris1-4/+19
(We really need to put in some rudimentary 64-bit integer support, for the benefit of platforms+compilers that don't support it; the floating-point calculations we're doing now appear not to get exactly the right answer, from an experiment at reading a NetMon 2.x file and writing it back out as NetMon 2.x with editcap.) svn path=/trunk/; revision=2939
2000-11-19"wtap_read()" must *always* set "*err" when it returns FALSE - if it'sGuy Harris1-2/+3
just an EOF, it should set "*err" to 0. Fix up a bunch of read routines for various capture file types to set "*err" appropriately. svn path=/trunk/; revision=2667
2000-09-21Make sure to pass the sent/received direction from pppdump.c inGilbert Ramirez1-3/+3
pseudo_header. Use generic "p2p_phdr" instead of "lapd_phdr". Modify toshiba.c and packet-lapd.c to take that into account. Add frame.p2p_dir, a filterable field, 0=sent, 1=recvd Make p2p_dir available in packe_info, as I think it will be needed in VJ COMP and UNCOMP dissection. Rename WTAP_ENCAP_TR to WTAP_ENCAP_TOKEN_RING. Mention pppd-log support in man page. Mention atmsnoop in README. svn path=/trunk/; revision=2455
2000-09-07Change wtap_read() API so that the data offset is set via a pointer, andGilbert Ramirez1-16/+13
a "keep reading" boolean value is returned from the function. This avoids having to hack around the fact that some file formats truly do have records that start at offset 0. (i4btrace and csids have no file header. Neither does the pppdump-style file that I'm looking at right now). svn path=/trunk/; revision=2392
2000-08-25Move #include <time.h> into wtap-int.h instead of requiring it inGilbert Ramirez1-2/+1
every C file. I noticed this because of a build break of csids.obj on Win32. svn path=/trunk/; revision=2378
2000-05-19Add wtap-int.h. Move definitions relevant to the internal workins of wiretapGilbert Ramirez1-4/+4
to that file, leave public definitions in wtap.h. Rename "union pseudo_header" to "union wtap_pseudo_header". Make the wtap_pseudo_header pointer available in packet_info struct. svn path=/trunk/; revision=1989
2000-05-18Remove the "union pseudo_header" from the "frame_data" structure;Guy Harris1-3/+4
there's no need to keep it around in memory - when the frame data is read in when handing a frame, read in the information, if any, necessary to reconstruct the frame header, and reconstruct it. This saves some memory. This requires that the seek-and-read function be implemented inside Wiretap, and that the Wiretap handle remain open even after we've finished reading the file sequentially. This also points out that we can't really do X.25-over-Ethernet correctly, as we don't know where the direction (DTE->DCE or DCE->DTE) flag is stored; it's not clear how the Ethernet type 0x0805 for X.25 Layer 3 is supposed to be handled in any case. We eliminate X.25-over-Ethernet support (until we find out what we're supposed to do). svn path=/trunk/; revision=1975
2000-05-10Rename the "private" member of a "wtap_dumper" structure to "dump", asGuy Harris1-32/+32
per the "capture" member of a "wtap" structure, so that it doesn't collide with the C++ reserved word "private". svn path=/trunk/; revision=1936
2000-03-22Make the previous checkin actually compile on big-endian machines.Guy Harris1-1/+4
svn path=/trunk/; revision=1742
2000-03-22Byte-swap the frame table on big-endian machines.Guy Harris1-9/+24
Free it as soon as we're at the end of the sequential pass through the file; that way, if we keep the capture file open with Wiretap even after that's done (as I may do as part of some stuff I'm working on), we at least aren't hanging on to the frame table memory after that point. svn path=/trunk/; revision=1741
2000-03-22In a Network Monitor capture file, get the starting offsets of framesGuy Harris1-31/+55
from the frame table - Network Monitor 2.x, at least, doesn't always write frame N+1 right after frame N. To do that, we need to mallocate a big array to hold the frame table, and free it when we close the capture file; this requires that we have capture-file-type-specific close routines as well as capture-file-type-specific read routines - we let it the pointer to that routine be null if it's not needed. Given that, we might as well get rid of the switch statement in "wtap_close()", in favor of using capture-file-type-specific close routines, as per the comment before that switch statement. svn path=/trunk/; revision=1740
2000-02-19Use WTAP_ERR_UNSUPPORTED_ENCAP for all attempts to open or read aGuy Harris1-2/+2
capture file for an unsupported link-layer encapsulation type (as the nettl reader does), and report it correctly if it occurs on an open or read attempt rather than a save attempt. svn path=/trunk/; revision=1647
2000-01-22Fix files that had Gilbert's old e-mail address or that didn't have myGuy Harris1-2/+2
forwarding e-mail address. svn path=/trunk/; revision=1522
2000-01-13We are obliged to define HAVE_UNISTD_H in "config.h"; to avoid theGuy Harris1-2/+2
hideous problem on FreeBSD 3.[23] (and perhaps other BSDs) if HAVE_UNISTD_H is defined before "zlib.h" is included, turn "file_seek()" into a subroutine defined in a file that *undefines* HAVE_UNISTD_H before including "zlib.h", so that the *only* call to "gzseek()" is made from a file that does not have HAVE_UNISTD_H defined when it includes "zlib.h". Move "file_error()" to that file while you're at it, so it holds all the wrappers that hide the presence or absence of zlib from routines to read capture files. Turn "file.h", which declared those wrapper functions as well as wrapper macros, into "file_wrapper.h" - it belongs with the "file_wrapper.c" file that defines the wrapper functions, not with "file.c" which handles higher-layer file access functions. Remove the comment in "configure.in" that explained why defining HAVE_UNISTD_H was a bad idea, as we're not obliged to define it and work around the problem. (The comment in "file_wrapper.c" explains the workaround.) svn path=/trunk/; revision=1463
1999-12-15One field in the NetXRay header appears to be the number of frames inGuy Harris1-2/+2
the capture; set it to that when writing the capture. Support Token Ring and FDDI captures (as per the network type in the file header appearing to be either the NDIS network type, or the NDIS network type minus 1 - I forget whether Ethernet has an NDIS type of 0 or 1). Don't write the file header twice, keeping a static copy of it around, as Wiretap code isn't supposed to keep any static data around; instead, write it only when we're done writing out all the records (as we do on Network Monitor captures). Compute the time stamps when writing the file. Give Windows Sniffer 1.1-format a short name, so "editcap" doesn't dump core or print "(null)" in its usage message. WTAP_ENCAP_NULL isn't supported by NetMon; don't write it. svn path=/trunk/; revision=1336
1999-12-04Fix some names.Guy Harris1-2/+2
svn path=/trunk/; revision=1203
1999-12-04Add some infrastructure for the use of Ethereal, so it can make a listGuy Harris1-13/+15
of all the file types in which a file can be saved. Giving each dumpable file type a routine that checks whether a file of a given file type and encapsulation can be written lets us hoist some checks into common code from out of the open routines. If the "dump close" routine for a dump stream is NULL, have that mean that there's no action that needs to be taken on a close by the code to handle that file type; some file types don't need that, as they can be written purely sequentially. svn path=/trunk/; revision=1200
1999-12-04Include <string.h> to declare "memset()".Guy Harris1-1/+2
svn path=/trunk/; revision=1198
1999-12-04Add support to Wiretap for writing Network Monitor 1.x-format captureGuy Harris1-1/+237
files. Make the return type of a number of routines that return 1 (for "true") on success and 0 (for "false") on failure to "gboolean", and make the 1's and 0's TRUEs and FALSEs. svn path=/trunk/; revision=1194
1999-11-26It appears that the first frame in a NetMon 2.0 capture file doesn'tGuy Harris1-4/+41
necessarily start at an offset of 128 into the file; we have to read the first entry in the frame table to find the offset in the file of the first frame. (That also works on NetMon 1.0.) Keep the header size around, though, as we'll need it if we add code to *write* NetMon files. svn path=/trunk/; revision=1119
1999-10-05Better handle errors from zlib:Guy Harris1-13/+9
Assign a range of Wiretap errors for zlib errors, and have "wtap_strerror()" use "zError()" to get an error message for them. Have the internal "file_error()" routine return 0 for no error and a Wiretap error code for an error. svn path=/trunk/; revision=769
1999-09-24Fix it so that it builds with "--disable-zlib".Guy Harris1-2/+2
The "fh" member of a "wtap" structure points to something constructed from the "fd" member of that structure, so that closing the stream referred to by "fh" also closes the underlying file descriptor; get rid of an unnecessary close of "wth->fd". svn path=/trunk/; revision=720
1999-09-22This commit contains support for reading capture files compressed usingAshok Narayanan1-11/+12
gzip. The zLib library is used for this purpose. If zLib is not available (or it's use is disabled by the --disable-zlib option to configure), you can still compile Ethereal but it will be unable to read compressed capture files. IMPORTANT: Now all file accesses to capture files should be done through special macros. Specifically, for any use of the following functions on capture files, replace them. The arguments for the right-side functions are exactly the same as for the original stdio functions. fopen file_open fdopen filed_open fread file_read fwrite file_write fseek file_seek fclose file_close ferror file_error svn path=/trunk/; revision=695
1999-08-28Keep in the "wtap" structure the current offset into the file beingGuy Harris1-5/+6
read, and maintain it ourselves as we read through the file, rather than calling "ftell()" for every packet we read - "ftell()" may involve an "lseek()" call, which could add a noticeable CPU overhead when reading a large file. svn path=/trunk/; revision=596
1999-08-24Add a new Wiretap encapsulation type WTAP_ENCAP_FDDI_BITSWAPPED, meaningGuy Harris1-2/+2
"FDDI with the MAC addresses bit-swapped"; whether the MAC addresses are bit-swapped is a property of the machine on which the capture was taken, not of the machine on which the capture is being read - right now, none of the capture file formats we read indicate whether FDDI MAC addresses are bit-swapped, but this does let us treat non-"libpcap" captures as being bit-swapped or not bit-swapped independent of the machine on which they're being read (and of the machine on which they were captured, but I have the impression they're bit-swapped on most platforms), and allows us to, if, as, and when we implement packet capture in Wiretap, mark packets in a capture file written in Wiretap-native format based on the machine on which they are captured (assuming the rule "Ultrix, Alpha, and BSD/OS are the only platforms that don't bit-swap", or some other compile-time rule, gets the right answer, or that some platform has drivers that can tell us whether the addresses are bit-swapped). (NOTE: if, for any of the capture file formats used only on one platform, FDDI MAC addresses aren't bit-swapped, the code to read that capture file format should be fixed to flag them as not bit-swapped.) Use the encapsulation type to decide whether to bit-swap addresses in "dissect_fddi()". svn path=/trunk/; revision=557
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-03 11:43:54 +0000