aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/ngsniffer.c
AgeCommit message (Collapse)AuthorFilesLines
2004-01-25Have the Wiretap open, read, and seek-and-read routines return, inGuy Harris1-30/+33
addition to an error code, an error info string, for WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with "g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed strings returned as the error info string, and change the callers of those routines to, for those errors, put the info string into the printed message or alert box for the error. Add messages for cases where those errors were returned without printing an additional message. Nobody uses the error code from "cf_read()" - "cf_read()" puts up the alert box itself for failures; get rid of the error code, so it just returns a success/failure indication. Rename "file_read_error_message()" to "cf_read_error_message()", as it handles read errors from Wiretap, and have it take an error info string as an argument. (That handles a lot of the work of putting the info string into the error message.) Make some variables in "ascend-grammar.y" static. Check the return value of "erf_read_header()" in "erf_seek_read()". Get rid of an unused #define in "i4btrace.c". svn path=/trunk/; revision=9852
2003-10-25Add a new WTAP_ENCAP_CHDLC_WITH_PHDR type, to distinguish Cisco HDLCGuy Harris1-3/+3
captures with packet direction information from captures without it. Use them appropriately. svn path=/trunk/; revision=8780
2003-10-01Have a pseudo-header for Ethernet packets, giving the size of the FCS -Guy Harris1-7/+27
0 means "there is no FCS in the packet data", 4 means "there is an FCS in the packet data", -1 means "I don't know whether there's an FCS in the packet data, guess based on the packet size". Assume that Ethernet encapsulated inside other protocols has no FCS, by having the "eth" dissector assume that (and not check for an Ethernet pseudo-header). Have "ethertype()" take an argument giving the FCS size; pass 0 when appropriate. Fix up Wiretap routines to set the pseudo-header. This means we no longer use the "generic" seek-and-read routine, so get rid of it. svn path=/trunk/; revision=8574
2003-03-03Handle packet direction information for SDLC Sniffer captures.Guy Harris1-1/+2
Add a bunch of capture types discovered by stuffing them into Windows Sniffer captures and seeing what a Sniffer thought they were. Add support for writing at least some of them. svn path=/trunk/; revision=7265
2003-01-31Add WTAP_ENCAP_FRELAY_WITH_PHDR for use with Frame Relay capture filesGuy Harris1-5/+5
that have direction information. Support writing WTAP_ENCAP_FRELAY_WITH_PHDR and WTAP_ENCAP_PPP_WITH_PHDR captures out in libpcap format - we throw away the direction information, but so it goes. When reading/writing Windows Sniffer format, read and write the direction flag. svn path=/trunk/; revision=7052
2003-01-14We don't know what, in captures with a major version number of 3,Guy Harris1-10/+30
indicates the subtype of an "Internetwork analyzer" capture; we've seen only one such capture, and it was a frame relay capture, so we just wire it to frame relay for now. svn path=/trunk/; revision=6923
2003-01-11If it doesn't begin with FF 00 it can't be LANE LE Control; if it'sGuy Harris1-5/+29
LANE, claimed to be LE Control, but doesn't begin with FF 00, call it 802.3. svn path=/trunk/; revision=6901
2003-01-10Rename the "version" argument to "process_header_records()" "maj_vers",Guy Harris1-48/+66
as it's the major version number. Try using the first word of "rsvd" to determine whether a capture is an ISDN capture or not in version 1 captures. Version 1 captures look as if they might also have a REC_HEADER2 record - it's longer than the ones in version 4 and 5 captures, but it still appears to have a network subtype in the 5th byte. Get rid of the heuristic that checks for WTAP_ENCAP_ISDN by looking at the packet data; if we fail to recognize an ISDN capture, we should look for stuff in the headers to determine whether the capture is one or not. svn path=/trunk/; revision=6894
2003-01-10It looks as if a value of 0xfa in the second byte of a REC_HEADER2Guy Harris1-50/+48
record might indicate an ISDN capture; treat that as an indication that a capture is an ISDN capture. svn path=/trunk/; revision=6893
2003-01-10The Sniffer file formats include a file to identify raw cells; exportGuy Harris1-1/+10
that flag in the ATM pseudo-header, and use it to determine whether a frame is a raw cell or a reassembled frame, rather than using the AAL, as you can have raw AAL5 cells in a capture. svn path=/trunk/; revision=6889
2003-01-09The checksum in DOS ATM Sniffer files appears to be stored in big-endianGuy Harris1-2/+2
format. svn path=/trunk/; revision=6885
2003-01-09It appears that ATM sniffer files with 4.x versions 4.95 and greaterGuy Harris1-11/+19
have a bogus record length for type 4 records, but earlier 4.x versions, and 5.x versions, don't. svn path=/trunk/; revision=6880
2003-01-07If the Windows Sniffer writes out one of its ATM capture files in DOSGuy Harris1-52/+57
Sniffer format, it doesn't distinguish between LE Control and LANE encapsulated LAN frames, so we can't rely on the ATM subtype being correct even when reading DOS Sniffer captures - we force it to TRAF_ST_LANE_LE_CTRL for LANE frames that begin with 0xff 0x00. Move the calls to "infer_pkt_encap()" into "fix_pseudo_header()". svn path=/trunk/; revision=6869
2003-01-06Don't interpret NET_HDLC as LAPB/X.25 - sometimes it's some otherGuy Harris1-22/+34
HDLC-flavored encapsulation (or, at least, it was in at least one capture). Instead, treat it as WTAP_ENCAP_PER_PACKET, and infer the packet type, as we do for NET_ROUTER. For NET_ROUTER captures, if the ISDN channel number is zero, infer the packet type from the contents, rather than wiring it to PPP - it might be, for example, Cisco or Wellfleet HDLC. Fix the check for Cisco HDLC to look for 0x0F 0x00 and 0x8F 0x00, as 0x0F, not 0x08, is the unicast address in Cisco HDLC. When fixing the pseudo-header, fix it for WTAP_ENCAP_WFLEET_HDLC, WTAP_ENCAP_CHDLC, and WTAP_ENCAP_PPP_WITH_PHDR, as well as for WTAP_ENCAP_ISDN, as the three ones listed don't use x25.flags, they use p2p.sent. svn path=/trunk/; revision=6850
2003-01-03Add support for SDLC encapsulation in DOS Sniffer captures; thatGuy Harris1-1/+5
includes adding an SDLC dissector. svn path=/trunk/; revision=6848
2003-01-03Well, at least some version 5 captures have type 7 records, and theyGuy Harris1-16/+23
appear to look like the type 7 records in version 4 captures. Note that sometimes the subtype is misleading. svn path=/trunk/; revision=6847
2003-01-03Well, it's not as simple as "version 5 internetwork analyzer capturesGuy Harris1-5/+6
hide the subtype in the reserved field in the version number", alas.... svn path=/trunk/; revision=6845
2003-01-03Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not justGuy Harris1-4/+4
used for the DOS-based ATM Sniffer. (That's not a great name, but I couldn't think of a better one.) Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture files where reassembled frames don't have trailers, such as the AAL5 trailer, chopped off. That's what at least some versions of the Windows-based ATM Sniffer appear to have. Map the ATM capture file type for NetXRay captures to WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've reverse-engineered, so far, for the pseudo-header; there's more that needs to be done on it, e.g. getting the channel, AAL type, and traffic type (or inferring them if they're not in the packet header). svn path=/trunk/; revision=6840
2002-12-20Update some comments.Guy Harris1-5/+34
Make the "fs" and "flags" fields in type 6 records unsigned, as they are in other per-frame records - they're probably the same set of flag bits. svn path=/trunk/; revision=6814
2002-12-20Make "infer_pkt_encap()" take a pointer and length as arguments.Guy Harris1-26/+58
Update some comments. svn path=/trunk/; revision=6812
2002-12-20Supply more information about "WAN/Synchronous" captures.Guy Harris1-10/+24
svn path=/trunk/; revision=6811
2002-12-20This adds the beginning of support for Wellfleet HDLC to ngsniffer.c asRichard Sharpe1-6/+20
well as Cisco HDLC support. It compiles OK, but I do not claim that it is not borken. I will have to add a small dissector that eats the first two bytes and then calls the Ethernet dissector as well, to complete the work. svn path=/trunk/; revision=6809
2002-11-10Update comments to reflect some information inferred from the SnifferGuy Harris1-7/+20
documentation. svn path=/trunk/; revision=6605
2002-11-09It appears that 0x80 in the fs field of an ISDN packet means "network toGuy Harris1-4/+4
user", not "user to network" (SETUP messages are generally sent *to* the network). svn path=/trunk/; revision=6592
2002-11-09Attempt to handle REC_HEADER2 records in major version 2 DOS SnifferGuy Harris1-56/+128
captures. svn path=/trunk/; revision=6591
2002-11-01Fix up the handling of WAN captures somewhat, based on looking at aGuy Harris1-67/+167
bunch of those captures. svn path=/trunk/; revision=6536
2002-11-01Convert the "maj_vers" field of a REC_VERS record to host byte orderGuy Harris1-2/+2
before passing it to "skip_header_records()". svn path=/trunk/; revision=6530
2002-10-31Discard the WTAP_ENCAP_LAPD encapsulation type in favor of aGuy Harris1-79/+114
WTAP_ENCAP_ISDN encapsulation type, which includes a pseudo-header giving the direction (user-to-network or network-to-user) and the channel number. Add a new circuit type, using the ISDN channel number as the circuit ID. Add an ISDN dissector to put the direction and channel number into the protocol tree and to call the appropriate dissector for the payload based on the channel (LAPD for the D channel; V.120, PPP, or data for B channels, based on some heuristics). svn path=/trunk/; revision=6521
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-17/+17
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6115
2002-07-29From Joerg Mayer:Guy Harris1-8/+8
All files: - Replace types from sys/types.h by those from glib.h - Replace ntoh family of macros from netinet/in.h and winsock2.h by g_ntoh family from glib.h - Remove now unneeded includes of sys/types.h, netinet/in.h and winsock2.h wtap.h Move includes to the top svn path=/trunk/; revision=5909
2002-07-16From Graeme Hewson:Guy Harris1-2/+2
Allow "-" as the output file name in Wiretap, referring to the standard error. Optimize the capture loop. Fix some of the error-message printing code in Ethereal and Tethereal. Have Wiretap check whether it can seek on a file descriptor, and pass the results of that test to the file-type-specific "open for output" routine. Have the "open for output" routines for files where we need to seek when writing the file return an error if seeks don't work. svn path=/trunk/; revision=5884
2002-06-07Graeme Hewson noted that zlib has a bug wherein "gzseek()" doesn't setGuy Harris1-30/+10
the internal z_err value for the stream if an "fseek()" call it makes fails, so that if "gzerror()" is subsequently called, it returns Z_OK rather than an error. To work around this, we pass "file_seek()" an "int *err", and have the with-zlib version of "file_seek()" check, if "gzseek()" fails, whether the return value of "file_error()" is 0 and, if so, have it return "errno" instead. svn path=/trunk/; revision=5642
2002-06-04The "sequential_close" routine for a capture file type, if it has one,Guy Harris1-3/+5
is always called before the "close" routine is called, so the "close" routine doesn't need to free anything that's freed by the "sequential_close" routine. svn path=/trunk/; revision=5619
2002-05-04Fix capture-file-specific "close output" routines to check whether theGuy Harris1-5/+7
"err" argument is null and return an error code through that argument only if it isn't, to match what "wtap_dump_close()", which calls those routines, does. Put the NetXRay dump routines in order by version number. svn path=/trunk/; revision=5385
2002-04-30Replace the "ngsniffer_atm" with an "atm" pseudo-header, which isn'tGuy Harris1-10/+240
just an image of the ATM Sniffer data. This means that Ethereal doesn't have to know any ATM Sniffer-specific details (that's all hidden in Wiretap), and allows us to add to that pseudo-header fields, traffic types, etc. unknown to ATM Sniffers. Have Wiretap map VPI 0/VCI 5 to the signalling AAL - for some capture files, this might not be necessary, as they may mark all signalling traffic as such, but, on other platforms, we don't know the AAL, so we assume AAL5 except for 0/5 traffic. Doing it in Wiretap lets us hide those details from Ethereal (and lets Ethereal interpret 0/5 traffic as non-signalling traffic, in case that happens to be what it is). We may know that traffic is LANE, but not whether it's LE Control or emulated 802.3/802.5; handle that case. svn path=/trunk/; revision=5302
2002-04-25Cast the sum of "ngsniffer->rand.nextout" and "delta" to "size_t" beforeGuy Harris1-2/+2
comparing with the "size_t" value "ngsniffer->rand.nbytes", rather than just casting "ngsniffer->rand.nextout" to "unsigned" - if "unsigned" is shorter than "long", the latter doesn't do what you want. svn path=/trunk/; revision=5252
2002-04-09Move the definition of the FROM_DCE bit in the "flags" field of aGuy Harris1-3/+3
"struct x25_phdr" to "wiretap/wtap.h". Have two X.25 dissectors, one of which assumes that there's a "struct x25_phdr" pseudo-header and one of which doesn't; the former uses the information in that pseudo-header to determine whether the packet is DTE->DCE or DCE->DTE, and the latter assumes it has no clue whether the packet is DTE->DCE or DCE->TDE. Use the former one in the LAPB dissector, and the latter one in the XOT dissector and in the LLC dissector table. In the X.25-over-TCP dissector, handle multiple X.25 packets per TCP segment, and handle X.25 packets split across TCP segments. svn path=/trunk/; revision=5134
2002-03-05Make "wtap_seek_read()" return TRUE on success and FALSE on error, likeGuy Harris1-34/+44
"wtap_read()". Add some additional error checks to the Sniffer file reader. svn path=/trunk/; revision=4875
2002-03-05Have "wtap_seek_read()" return 0 on success and -1 on failure, and takeGuy Harris1-11/+17
an "err" argument that points to an "int" into which to put an error code if it fails. Check for errors in one call to it, and note that we should do so in other places. In the "wtap_seek_read()" call in the TCP graphing code, don't overwrite "cfile.pseudo_header", and make the buffer into which we read the data WTAP_MAX_PACKET_SIZE bytes, as it should be. In some of the file readers for text files, check for errors from the "parse the record header" and "parse the hex dump" routines when reading sequentially. In "csids_seek_read()", fix some calls to "file_error()" to check the error on the random stream (that being what we're reading). svn path=/trunk/; revision=4874
2002-03-04Check for errors in seeks, "tell"s, and "stat()"s/"fstat()"s.Guy Harris1-29/+53
For file types where we allocate private data, add "close" routines where they were missing, to free the private data. Also fix up the code to clean up after some errors by freeing private data where that wasn't being done. Get rid of unused arguments to "wtap_dump_open_finish()". Fix indentation. svn path=/trunk/; revision=4857
2002-03-02From Joerg Mayer: get rid of "-Wno-unused" flag in some configureGuy Harris1-4/+5
scripts, and check in changes to add _U_ to some unused arguments (some other should perhaps be used, so we leave the _U_ out so that the warnings serve as a reminder to check those). svn path=/trunk/; revision=4847
2002-02-27From Joerg Mayer: remove unused variables and declarations ofGuy Harris1-3/+2
non-existent functions. Remove the "filetype" argument from the "can_write_encap" functions for particular capture file types - the argument value is implicit, in that the routine being called is the routine for that particular file type. svn path=/trunk/; revision=4823
2002-02-08Have Wiretap set the snapshot length to 0 if it can't be derived fromGuy Harris1-2/+2
reading the capture file. Have callers of "wtap_snapshot_length()" treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so that, when writing a capture file in a format that *does* store the snapshot length, we can at least put *something* in the file). If we don't know the snapshot length of the current capture file, don't display a value in the summary window. Don't use "cfile.snap" as the snapshot length option when capturing - doing so causes Ethereal to default, when capturing, to the snapshot length of the last capture file that you read in, rather than to the snapshot length of the last capture you did (or the initial default of "no snapshot length"). Redo the "Capture Options" dialog box to group options into sections with frames around them, and add units to the snapshot length, maximum file size, and capture duration options, as per a suggestion by Ulf Lamping. Also add units to the capture count option. Make the snapshot length, capture count, maximum file size, and capture duration options into a combination of a check box and a spin button. If the check box is not checked, the limit in question is inactive (snapshot length of 65535, no max packet count, no max file size, no max capture duration); if it's checked, the spinbox specifies the limit. Default all of the check boxes to "not checked" and all of the spin boxes to small values. Use "gtk_toggle_button_get_active()" rather than directly fetching the state of a check box. svn path=/trunk/; revision=4709
2002-01-11Oh, what the heck, write out FDDI and bit-swapped FDDI as the same typeGuy Harris1-2/+2
in Sniffer Classic files; there's nothing we can do about those platforms that bit-swap FDDI addresses before handing them to DLPI or whatever, so we'll just let people live with wrong FDDI addresses (or maybe someday put in code to bit-swap them before writing them out to the capture file). svn path=/trunk/; revision=4519
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4199
2001-10-25Get rid of signed/unsigned comparison warnings in wiretap.Gilbert Ramirez1-5/+5
svn path=/trunk/; revision=4077
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris1-5/+5
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
2001-08-25The return value from "fwrite()" is a "size_t"; make the variable intoGuy Harris1-11/+11
which we store it a "size_t", and then fix up the bugs that were revealed by the compiler warnings that produced - "fwrite()" returns 0, not a negative number, on an I/O error. Fix up some other items to have type "size_t", or to have various unsigned types, while we're at it, to squelch compiler warnings. svn path=/trunk/; revision=3867
2001-07-15Fixes, from Scott Renfro, for some calls to "localtime()" that didn'tGuy Harris1-6/+11
check whether the call succeeded (it doesn't always do so on Windows, for example). svn path=/trunk/; revision=3722
2001-07-06Remove a comment that no longer applies - we no longer seek forward inGuy Harris1-18/+1
compressed Sniffer files by sequentially moving forward, and we no longer seek backward by seeking to the beginning and then seeking forward to the new position, we now seek to the beginning of the compressed block that contains the target position, if we're not already in that block, and then move to the appropriate position in that block. svn path=/trunk/; revision=3658
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-14 12:17:15 +0000