aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/netxray.c
AgeCommit message (Collapse)AuthorFilesLines
2007-05-30Update a comment.Guy Harris1-2/+2
svn path=/trunk/; revision=21998
2007-05-29Give more detail on a captype of 6 for an Ethernet capture.Guy Harris1-1/+1
svn path=/trunk/; revision=21997
2007-05-29It's pretty clear that hdr.captype's interpretation depends on theGuy Harris1-7/+10
network type; there's no "presumably" about it. Suggest that "realtick" might have the right time stamp in other cases (if not, a comment should explicitly indicate that, so that in all cases where we either know that realtick is wrong or have a lot of evidence to show that it's right, we note that fact). svn path=/trunk/; revision=21996
2007-05-29Update the big time unit comment to reflect Bill Meier's recent changes.Guy Harris1-20/+32
Fix some other comments. Add a suggestion for why the realtick values might correlate with packets having an FCS. svn path=/trunk/; revision=21993
2007-05-29(fix comment)Bill Meier1-2/+2
svn path=/trunk/; revision=21983
2007-05-29Another sniffer timestamp display fix; addresses bug 866 and other reports.Bill Meier1-17/+47
(Also: change variable name to correctly reflect usage). svn path=/trunk/; revision=21982
2007-04-26From Jeff Foster: add support for Cisco HDLC captures.Guy Harris1-0/+9
svn path=/trunk/; revision=21598
2006-11-05change all file offsets from long to gint64 so we can - theoretically - ↵Ulf Lamping1-4/+4
handle files > 2GB correct. Please distclean Win32 builds! svn path=/trunk/; revision=19814
2006-10-23Use G_GINT64_CONSTANT to handle 64-bit constants in the code.Michael Tüxen1-4/+4
svn path=/trunk/; revision=19663
2006-10-20fix 'save' to store hi-order 32 bits of time offset for each pkt; fixes bug 1168Bill Meier1-10/+16
svn path=/trunk/; revision=19622
2006-04-15Sake Blok wrote....Jaap Keuter1-1/+11
I have taken a look at the trace myself and calculated the TpS to be 20000000.0 for this particular trace. If I also discard the start_timestamp like it has been done for other versions of the netxray format, then I get the proper results. svn path=/trunk/; revision=17869
2006-03-11Remove an entire horde of off-by-one errors pointed out by Coverity's CID: 83Luis Ontanon1-5/+5
(Coverity finds just one at a time...) svn path=/trunk/; revision=17580
2006-03-08Another off by one error found by coverity (CID 83), using > instead of >= ↵Luis Ontanon1-1/+1
when comparing index against array size. svn path=/trunk/; revision=17521
2006-01-12The attached patch to fix bug 663 allows Ethereal to read WindowsJaap Keuter1-3/+38
Sniffer V2 format capture files with captyp=5, timeunit=0. The ticks_per_sec for this case apparently is 1e6. Bill Meier svn path=/trunk/; revision=17019
2005-09-09From Bill Meier:Guy Harris1-23/+51
define "timezone" as "gint16", as it can be positive (west of UTC) or negative (east of UTC); update comments to refer to the new names for structure members; say the precision of the time stamps is 1 nanosecond only if the ticks per second is > 10 million; fix the handling of files truncated exactly on a frame boundary. svn path=/trunk/; revision=15739
2005-08-29Get rid of the old file header definition.Guy Harris1-31/+17
Set the time stamp resolution based on whether the number of ticks per second is > 1 million or not. svn path=/trunk/; revision=15606
2005-08-28From Bill Meier:Guy Harris1-34/+91
1. Use the new (good work!) 'nanosec' precision only for gig pods; 2. Rework 'struct netxray_hdr' to make it (somewhat) easier to maintain and revise: a. Declare known hdr fields such as 'captype' instead of using offsets in 'xxx placeholder' fields. d. Define 'unknown' hdr fields using placeholder names based upon hex-offset in the netxray header record. (This isn't perfect, but I hope it will make things more manageable). 3. Update hdr field info (based upon examination of various capture files): a. Define a hdr field which appears to be 'time-zone' [offset in hours from UTC] for the machine doing the capture. (Maybe this field can eventually be used for Ethereal to display the (local) time as it was at the time of the capture). b. Describe certain hdr fields as being "file offsets" (altho the exact use is still unclear). Update some comments. svn path=/trunk/; revision=15603
2005-08-25timestamp display precision:Ulf Lamping1-0/+8
- automatic adjustment depending on file format - manual adjustment through menu items save the setting in the recent file svn path=/trunk/; revision=15534
2005-08-24EVERYTHING IN THE BUILDBOT IS GOING TO BE RED!!! Sorry! Ulf Lamping1-16/+16
I've done more than a day to change the timestamp resolution from microseconds to nanoseconds. As I really don't want to loose those changes, I'm going to check in the changes I've done so far. Hopefully someone else will give me a helping hand with the things left ... What's done: I've changed the timestamp resolution from usec to nsec in almost any place in the sources. I've changed parts of the implementation in nstime.s/.h and a lot of places elsewhere. As I don't understand the editcap source (well, I'm maybe just too tired right now), hopefully someone else might be able to fix this soon. Doing all those changes, we get native nanosecond timestamp resolution in Ethereal. After fixing all the remaining issues, I'll take a look how to display this in a convenient way... As I've also changed the wiretap timestamp resolution from usec to nsec we might want to change the wiretap version number... svn path=/trunk/; revision=15520
2005-08-18Try yet another scheme for handling time stamps; realtick isn't alwaysGuy Harris1-44/+146
correct. svn path=/trunk/; revision=15404
2005-07-02Chris Lydick: Support for Sniffer 2.003 files.Jörg Mayer1-1/+9
Modified to match the current codebase. svn path=/trunk/; revision=14832
2005-06-16Note that the WAN_CAPTYPE value of 4 can correspond to Cisco HDLCGuy Harris1-0/+14
traffic as well as Frame Relay traffic, and give some information about the cruft found in the xxc field of the header for one CHDLC and one FR capture. svn path=/trunk/; revision=14659
2005-01-29Add some notes about stuff discovered by Ken Mann.Guy Harris1-1/+11
svn path=/trunk/; revision=13194
2005-01-14Note that the low-order bit of hdr->hdr_2_x.xxx[8] appears to be a "badGuy Harris1-2/+10
FCS" bit for 802.11, just as it appears to be for Ethernet, and give more details on the 4 bytes of junk at the end of the packet (i.e., that we haven't yet seen an 802.11 capture where it's an FCS rather than just junk). svn path=/trunk/; revision=13028
2005-01-03Add some more comments about the FCS issue.Guy Harris1-10/+14
svn path=/trunk/; revision=12939
2005-01-03Give a bit more information on the "are there FCSes in the frame?"Guy Harris1-5/+32
issue. svn path=/trunk/; revision=12938
2005-01-03Rename the CAPTYPE_ definitions as appropriate - many of them areGuy Harris1-25/+39
specific to particular types of captures, and the same value might correspond to more than one CAPTYPE_ definition. Add an additional CAPTYPE_ for some non-gigabit Ethereal capture seen by Bill Meier, and fix the range check the time stamp units value as per his mail. svn path=/trunk/; revision=12937
2005-01-03From James Fields and Kevin Johnson: fix the handling of time stamps inGuy Harris1-69/+86
a number of Windows Sniffer captures - apparently the time stamp units are in a field in the file header. Add a capture type value seen in at least one ATM capture. Update some comments, and add some comments. Get rid of some redundant setting of "timeunit". svn path=/trunk/; revision=12936
2004-10-17file_hdr.network is one byte long, so don't use htoles() on values it'sGuy Harris1-2/+2
set to - that causes it to be set to zero. svn path=/trunk/; revision=12328
2004-07-18Set the svn:eol-style property on all text files to "native", so thatGuy Harris1-1/+1
they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-03-03Have "wtap_read()" set "wth->phdr.pkt_encap" to "wth->file_encap",Guy Harris1-2/+1
rather than requiring individual capture file type handlers to do it (unless they're doing per-packet encapsulation, in which case we check to make sure they didn't *leave* it as WTAP_ENCAP_PER_PACKET). svn path=/trunk/; revision=10290
2004-01-27Supply a pseudo-header for all 802.11 packets; add an "fcs_len" field toGuy Harris1-18/+10
it, similar to the Ethernet pseudo-header's "fcs_len" field, and use it in the 802.11 dissector. svn path=/trunk/; revision=9884
2004-01-25Don't muck with the Ethernet pseudo-header if we have an 802.11 capture.Guy Harris1-1/+9
svn path=/trunk/; revision=9857
2004-01-25Have the Wiretap open, read, and seek-and-read routines return, inGuy Harris1-17/+21
addition to an error code, an error info string, for WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with "g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed strings returned as the error info string, and change the callers of those routines to, for those errors, put the info string into the printed message or alert box for the error. Add messages for cases where those errors were returned without printing an additional message. Nobody uses the error code from "cf_read()" - "cf_read()" puts up the alert box itself for failures; get rid of the error code, so it just returns a success/failure indication. Rename "file_read_error_message()" to "cf_read_error_message()", as it handles read errors from Wiretap, and have it take an error info string as an argument. (That handles a lot of the work of putting the info string into the error message.) Make some variables in "ascend-grammar.y" static. Check the return value of "erf_read_header()" in "erf_seek_read()". Get rid of an unused #define in "i4btrace.c". svn path=/trunk/; revision=9852
2004-01-19It appears that, for ISDN captures, the rules for whether there's 4Guy Harris1-10/+30
bytes of extra stuff at the end of the packet or not are the same as for Ethernet and 802.11. svn path=/trunk/; revision=9728
2004-01-05 removed some MSVC warnings (level 3)Ulf Lamping1-3/+3
svn path=/trunk/; revision=9558
2003-10-01Have a pseudo-header for Ethernet packets, giving the size of the FCS -Guy Harris1-29/+137
0 means "there is no FCS in the packet data", 4 means "there is an FCS in the packet data", -1 means "I don't know whether there's an FCS in the packet data, guess based on the packet size". Assume that Ethernet encapsulated inside other protocols has no FCS, by having the "eth" dissector assume that (and not check for an Ethernet pseudo-header). Have "ethertype()" take an argument giving the FCS size; pass 0 when appropriate. Fix up Wiretap routines to set the pseudo-header. This means we no longer use the "generic" seek-and-read routine, so get rid of it. svn path=/trunk/; revision=8574
2003-09-28It appears that, at least for gigabit pod captures, there are time stampGuy Harris1-21/+52
differences between versions 002.001 and 002.002. svn path=/trunk/; revision=8563
2003-07-07A couple of captures have been seen with the first (low-order) byte ofGuy Harris1-41/+94
the network type being 1 and the byte after it being 2; we assume, for now, that the network type is 1 byte, and that if the byte after it is 0, the network type is an NDIS type - 1, and if it's 2, it's an NDIS type. svn path=/trunk/; revision=7973
2003-03-31The units, in non-whizzo-gigabit-pod captures, for hdr.timeunit = 2Guy Harris1-11/+21
aren't 1/1193000.0 second; the code used to use 1/1193180.0 second, but at least one capture appears to have units of somewhere around 1/3579540.0 second. svn path=/trunk/; revision=7388
2003-03-28Ian Schorr discovered that, for gigabit pod captures, if hdr.timeunit isGuy Harris1-23/+31
2 the time stamps are in units of 1/31250000 seconds rather than nanoseconds - and, by generating Windows Sniffer captures with various hdr.timeunit values, that for all the non-zero values he tested, the time stamps for non-gigabit pod captures are in units of 1/1193000 second. Instead of having a TpS array, just test for the exception value (0 for non-gigabit pod captures, 2 for gigabit pod captures). svn path=/trunk/; revision=7380
2003-03-04Handle the direction bit in SDLC and PPP Sniffer files.Guy Harris1-1/+7
svn path=/trunk/; revision=7267
2003-03-03Handle packet direction information for SDLC Sniffer captures.Guy Harris1-8/+60
Add a bunch of capture types discovered by stuffing them into Windows Sniffer captures and seeing what a Sniffer thought they were. Add support for writing at least some of them. svn path=/trunk/; revision=7265
2003-03-01A "hdr.xxb[20]" value of 2 in a version 2 capture appears to mean thatGuy Harris1-1/+13
it's a gigabit Ethernet capture, possibly, with special hardware, and that time stamps have 1000 times the resolution that they have in other captures (perhaps due to the special hardware having a higher-resolution clock?). svn path=/trunk/; revision=7240
2003-01-31Add WTAP_ENCAP_FRELAY_WITH_PHDR for use with Frame Relay capture filesGuy Harris1-14/+21
that have direction information. Support writing WTAP_ENCAP_FRELAY_WITH_PHDR and WTAP_ENCAP_PPP_WITH_PHDR captures out in libpcap format - we throw away the direction information, but so it goes. When reading/writing Windows Sniffer format, read and write the direction flag. svn path=/trunk/; revision=7052
2003-01-30Add support for writing Frame Relay files in NetXRay format 2.x.Guy Harris1-21/+72
svn path=/trunk/; revision=7048
2003-01-10The Sniffer file formats include a file to identify raw cells; exportGuy Harris1-1/+7
that flag in the ATM pseudo-header, and use it to determine whether a frame is a raw cell or a reassembled frame, rather than using the AAL, as you can have raw AAL5 cells in a capture. svn path=/trunk/; revision=6889
2003-01-09It appears that a channel number of 0 means DTE->DCE, and a channelGuy Harris1-2/+2
number of 1 means DCE->DTE, in DOS Sniffer ATM captures. svn path=/trunk/; revision=6881
2003-01-07PRI captures appear to be the ISDN captures with padding.Guy Harris1-12/+20
The Windows Sniffer does *not* appear to know the difference between 802.3 and 802.3 multicast LANE traffic. svn path=/trunk/; revision=6870
2003-01-07Use some fields in the per-packet header for ATM to get the AAL typeGuy Harris1-22/+92
and traffic type. svn path=/trunk/; revision=6868
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-12 02:26:53 +0000