aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/pcap-common.c
AgeCommit message (Collapse)AuthorFilesLines
2016-04-01support for IP-over-Infiniband - pcap encapsulationPetr Sumbera1-1/+1
Bug: 12279 Change-Id: Ib6c54f8b86d95c5546bc800749f124cd0dbb8ff0 Reviewed-on: https://code.wireshark.org/review/14585 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2016-02-20Initial support for FreeBSD USB captures.Guy Harris1-0/+2
(There's also work needed in libpcap; that's also in progress.) Change-Id: Iff5a34c139a000865e2d78cc17a4af5ff24fb44b Reviewed-on: https://code.wireshark.org/review/14025 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-19Get rid of PCAP_ENCAP_USB.Guy Harris1-2/+0
It doesn't correspond to anything we support - and the old Linux USB LINKTYPE_ value of 186 doesn't give enough information to dissect the packets (it discards the event type, for example), so we drop the rest of our support for it as well. Change-Id: I6f537d9263174aba4320edf5140e1d1540e979c8 Reviewed-on: https://code.wireshark.org/review/14020 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-19Don't bother setting phdr->pkt_encap to wth->file_encap.Guy Harris1-2/+0
wtap_read() and wtap_seek_read() now do so before calling the read or seek-read routine, so there's no need to do so in those routines. Rename hcidump_process_packet() to hcidump_read_packet() while we're at it, as it doesn't just process an already-read packet, it does the reading as well as the processing. Change-Id: Ic13da6a2096e68550d80f2eff31f03d0edb58147 Reviewed-on: https://code.wireshark.org/review/13998 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-16Add WTAP_ENCAP_NFC_LLCP to the list of types require a pseudo-header.Guy Harris1-13/+15
Discovered by changing wtap_encap_requires_phdr() to use a switch statement and comparing the case arms. Change-Id: I2a23b86ddfbc88c1b3251a0e97f7f00ee93f630e Reviewed-on: https://code.wireshark.org/review/13341 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-13Clean up handling of the data before the Ethernet packet in ERF files.Guy Harris1-4/+13
The data before the Ethernet packet isn't a 16-bit little-endian integer, it's two bytes, one byte of offset and one byte of padding. Change-Id: I327b88f058dda184b79d3c2c6cf0dea52c0d28b1 Reviewed-on: https://code.wireshark.org/review/13254 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-05GFP: Add support for Generic Framing Procedure (ITU-T G.7041/Y.1303)John A. Thacker1-4/+3
Add support for Generic Framing Procedure. Generic Framing Procedure (GFP) is used to map octet-aligned variable length payloads (e.g. Ethernet, MPLS, octet-aligned PPP, IP) into octet-synchronous signals such as SONET/SDH (ITU-T G.707) and OTN (ITU-T G.709). GFP is a telecommunications industry standard defined in ITU-T G.7041/Y.1303. (https://www.itu.int/rec/T-REC-G.7041/) Bug: 11961 Change-Id: Idf5b311e82b051b1ee65bde5149b3de405537b02 Reviewed-on: https://code.wireshark.org/review/13043 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-12-24Refactor 802.11 radio flags.Simon Barber1-1/+1
The use of a flag field here is aesthetically unpleasing when the flags are referred to frequently. Convert these into bitfield entries. Change-Id: I6f47e31558439dfd343ec7f856d04480366a1237 Reviewed-on: https://code.wireshark.org/review/12511 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-19use the official DLT for ISO14443Martin Kaiser1-0/+3
add DLT_ISO14443 to pcap_to_wtap_map[] define WTAP_ENCAP_ISO14443, link it to the iso14443 dissector Change-Id: Id837197c4d66071094f9336d60db36a371424807 Reviewed-on: https://code.wireshark.org/review/11959 Petri-Dish: Martin Kaiser <wireshark@kaiser.cx> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-06-20Call the "802.11 radio information" dissector for radio headers.Guy Harris1-1/+2
Have dissectors of various forms of radio information headers in the packets fill in a struct ieee_802_11_phdr with radio information as appropriate, and call the "802.11 radio information" dissector rather than the raw 802.11 dissector. This means that the radio information can be found in a protocol-independent and encapsulation-independent form when you're looking at the packet; that information can be presented in a form somewhat easier to read than the raw metadata header format. It also enables having a single "radio information" tap that allows statistics to handle all different sorts of radio information encapsulation. In addition, it lets us clean up some of the arguments passed to the common 802.11 dissector routine, by having it pull that information from the struct ieee_802_11_phdr. Ensure that the right structure gets passed to that routine, and that all the appropriate parts of that structure are filled in. Rename the 802.11 radio protocol to "wlan_radio", rather than just "radio", as it's 802.11-specific. Give all its fields "wlan_radio." names rather than "wlan." names. Change-Id: I78d79afece0ce0cf5fc17293c1e29596413b31c8 Reviewed-on: https://code.wireshark.org/review/8992 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-15Move some structures used only in pcap-common.c there.Guy Harris1-0/+30
Those aren't pseudo-headers exported from libwiretap, they're just structures corresponding to the pseudo-headers for some pcap/pcap-ng link-layer header types. Change-Id: Iec37cfc162b64adacdeb57e14e546bced7b673fa Reviewed-on: https://code.wireshark.org/review/8941 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-24pcap-common: fix build error with gcc5Daniel Mack1-1/+1
gcc5 complains about the issue below, so add a trivial fixup. CC libwiretap_la-pcap-common.lo pcap-common.c: In function 'pcap_byteswap_nflog_pseudoheader': pcap-common.c:1290:30: error: logical not is only applied to the left hand side of comparison [-Werror=logical-not-parentheses] if (!(nfhdr->nflog_version) == 0) { ^ cc1: all warnings being treated as errors Change-Id: I9f5b090ffd564f203cc3fb4ff302f2e4752865f0 Reviewed-on: https://code.wireshark.org/review/7336 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-21Set phdr encap for pcap fileMichal Labedzki1-0/+2
Change-Id: Id600b395d6fd2711c9b392a60454e5bd9a3eb465 Reviewed-on: https://code.wireshark.org/review/7288 Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
2015-02-15Handle DLT_LOOP differently from DLT_NULL.Guy Harris1-5/+5
That's a little cleaner, and lets us preserve the LINKTYPE_ value for DLT_LOOP captures. ("Preserve" here doesn't mean "write files with a link-layer header type of 12", as that's ambiguous; we write it with a link-layer header type of LINKTYPE_LOOP, i.e. 108. If programs on OpenBSD don't recognize that as DLT_LOOP, that's a bug in OpenBSD's libpcap or in the program.) Change-Id: I48a2e04aed41c013823ffb5c588d2a8e8b376e15 Reviewed-on: https://code.wireshark.org/review/7143 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-15Don't base interpretation of LINKTYPE_ values on DLT_ value definitions.Guy Harris1-27/+16
Instead, explicitly check for particular build platforms. This means that the interpretation of the link-layer type values with different meanings on different platforms won't be dependent on the particular version of libpcap with which Wireshark happens to be built, and also means that we don't have to fix pcap-common.c to include pcap.h or net/bpf.h. Fix some comments while we're at it. Bug: 10956 Change-Id: If331d9b92081fb0bdf416620fb2ad8dce57dea6b Reviewed-on: https://code.wireshark.org/review/7140 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-01-02Add "Editor modelines"; Adjust whitespace as needed.Bill Meier1-131/+144
Change-Id: Ic5a5acb0f36d3aa144edbfb1ae71097b18426db4 Reviewed-on: https://code.wireshark.org/review/6216 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-10-29Expand the 802.11 pseudo-header and support new radio metadata.Guy Harris1-6/+7
Add a set of presence bits, so we can indicate which bits of radio metadata we do and don't have. Fill in more radio metadata from capture files, and display it. (More to come.) Change-Id: Idea2c05442c74af17c14c4d5a8d8025ab27fbd15 Reviewed-on: https://code.wireshark.org/review/4987 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07No need for WTAP_ERR_CANT_READ.Guy Harris1-16/+0
Unlike the standard I/O routines, the code we introduced that supports fast random seeking on gzipped files will always supply some specific error code for read errors, so we don't need WTAP_ERR_CANT_READ. Add WTAP_ERR_CANT_WRITE for writing, as we're still using the standard I/O routines for that. Set errno to WTAP_ERR_CANT_WRITE before calling fwrite() in wtap_dump_file_write(), so that it's used if fwrite() fails without setting errno. Change-Id: I6bf066a6838284a532737aa65fd0c9bb3639ad63 Reviewed-on: https://code.wireshark.org/review/4540 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07Whitespace cleanups.Guy Harris1-17/+17
Change-Id: I92f983b2e04defab30eb31c14c484b9f0f582413 Reviewed-on: https://code.wireshark.org/review/4513 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07Add some higher-level file-read APIs and use them.Guy Harris1-114/+19
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an error number pointer, and an error string pointer as arguments, and that treats a short read of any sort, including a read that returns 0 bytes, as a WTAP_ERR_SHORT_READ error, and that returns the error number and string through its last two arguments. Add wtap_read_bytes_or_eof(), which is similar, but that treats a read that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF indication. Use those in file readers; that simplifies the code and makes it less likely that somebody will fail to supply the error number and error string on a file read error. Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210 Reviewed-on: https://code.wireshark.org/review/4512 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-06-09HPM.2 IPMI Trace Data encapsulation formatU-beauty\bdn1-1/+4
Added a mapping between DLT_IPMI_HPM_2 link-layer header type to the IPMI Trace Wiretap encapsulation. Change-Id: I458d44ad0f51beecfe5589e0e9cb75f4771d866b Reviewed-on: https://code.wireshark.org/review/2054 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-05-09Revert "Refactor Wiretap"Guy Harris1-13/+12
This reverts commit 1abeb277f5e6bd27fbaebfecc8184e37ba9d008a. This isn't building, and looks as if it requires significant work to fix. Change-Id: I622b1bb243e353e874883a302ab419532b7601f2 Reviewed-on: https://code.wireshark.org/review/1568 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-09Refactor WiretapMichael Mann1-12/+13
Start of refactoring Wiretap and breaking structures down into "generally useful fields for dissection" and "capture specific". Since this in intended as a "base" for Wiretap and Filetap, the "wft" prefix is used for "common" functionality. The "architectural" changes can be found in cfile.h, wtap.h, wtap-int.h and (new file) wftap-int.h. Most of the other (painstaking) changes were really just the result of compiling those new architecture changes. bug:9607 Change-Id: Ife858a61760d7a8a03be073546c0e7e582cab2ae Reviewed-on: https://code.wireshark.org/review/1485 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-04-28Add dissector for LINKTYPE_EPONPhilip Rosenberg-Watt1-1/+4
See IEEE Standard 802.3-2012 Section 5, Clause 65 and CableLabs DPoE Security and Certificate Specification 1.0, Section 6. Currently dissects 1G mode. 10G mode will be added when hardware is available. Change-Id: I6232af9bf6807644ef66a120d97e5fa5927988fe Reviewed-on: https://code.wireshark.org/review/1284 Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Evan Huus <eapache@gmail.com>
2014-04-01Add a dissector for Apple's PKTAP headers.Guy Harris1-0/+4
It automatically works for LINKTYPE_PKTAP and, by default, for LINKTYPE_USER2; if any other dissector is specified for LINKTYPE_USER2, that dissector overrides PKTAP. Change-Id: Ic00ac8a81c6101e45d638d337aef42df3920da12 Reviewed-on: https://code.wireshark.org/review/903 Reviewed-by: Evan Huus <eapache@gmail.com>
2014-03-24Use tabs instead of spacesMichal Labedzki1-6/+5
Change-Id: I16086216ffcac0a457c8fcdabfc0458d4e701ea0 Reviewed-on: https://code.wireshark.org/review/809 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-07Introduces two new Bluetooth DLTs for RF-based captures.Christopher Kilgour1-0/+5
Adds support for BLUETOOTH_LE_LL_WITH_PHDR, dissector integrates with existing BTLE dissector. Fixes BTLE dissector to correctly extract packet CRC. Adds CRC checking to BTLE dissector. Provides optional context to BTLE dissector that allows RF captures to provide link-layer hints for dissection details. Significantly, parameters for determining CRC correctness are provided, as well as Access Address validity information. Change-Id: I7d4936b053353a7f9c524021c01f67f5828253fb Reviewed-on: https://code.wireshark.org/review/310 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-06Have NFLOG TLV type and length be in host byte order.Guy Harris1-0/+80
When capturing, they'll be in host byte order. The top of the libpcap trunk and 1.5 branch, when reading a file, will, if necessary, byte-swap the type and length values so that they're in the byte order of the host reading the file (rather than the host that wrote the file). Do the same when we read a file, and have the NFLOG dissector assume host byte order for those fields. Change-Id: I493aed1e07b626af1157d75f3bc293b0a694ad07 Reviewed-on: https://code.wireshark.org/review/148 Reviewed-by: Evan Huus <eapache@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-02-20Add support for Bluetooth Linux MonitorMichal Labedzki1-1/+58
BlueZ 5/Linux Kernel introduced new way to sniffing Bluetooth interfaces. We are ready to use it. Libpcap provide new interface called "bluetooth-monior". Also fix trivial typos. Change-Id: Ic608a3d8553bbebbb21f2733ec92c758cbf8f707 Reviewed-on: https://code.wireshark.org/review/253 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-02-08Have macros to handle the range check and byte swapping.Guy Harris1-56/+44
Combine the check for whether the field is within the packet data and the swapping of the field into macros that do both, and use them. Change-Id: I1db4c5fd76172edd44abc9fb111d79a2537c6c9d Reviewed-on: https://code.wireshark.org/review/130 Reviewed-by: Evan Huus <eapache@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-02-06Make some routines take a struct wtap_pkthdr * as an argument.Guy Harris1-98/+105
For some routines that take multiple arguments that come from a struct wtap_pkthdr, pass a pointer to the struct wtap_pkthdr in question, rather than the separate arguments. Do this even if we're passing expressions that were earlier assigned to the struct wtap_pkthdr fields in question. This simplifies the calling sequences and ensures that the right values are picked up by the called routine; in at least one case we were *not* passing the right values (the code to handle Simple Packet Blocks in pcap-ng files). Also, call the byte-swapping routines for pseudo-header fields only if we need to do byte-swapping. Change-Id: I3a8badfcfeb0237dfc1d1014185a67f18c0f2ebe Reviewed-on: https://code.wireshark.org/review/119 Reviewed-by: Evan Huus <eapache@gmail.com> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2013-12-07Add WTAP_ENCAP_NETLINK which maps to DLT_NETLINK /253/Jakub Zawadzki1-0/+2
svn path=/trunk/; revision=53834
2013-12-03wiretap: start using <wsutil/pint.h>Jakub Zawadzki1-15/+15
svn path=/trunk/; revision=53764
2013-11-30STANAG 5066 DTS Layer dissector. Bug 9217 ↵Michael Mann1-0/+2
(https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9217) From İbrahim Can Yüce From me: Update to new tcp_dissect_pdus format, minor whitespace issues noticed in wiretap files. svn path=/trunk/; revision=53669
2013-11-08The "file types" we have are actually combinations of types andGuy Harris1-3/+3
subtypes, e.g. Network Monitor version 1 and Network Monitor version 2 are separate "file types", even though they both come from Network Monitor. Rename various functions, #defines, and variables appropriately. svn path=/trunk/; revision=53166
2013-08-08Clarify what the special cases in wtap_wtap_encap_to_pcap_encap() areGuy Harris1-17/+17
doing. svn path=/trunk/; revision=51209
2013-08-08Point to the tcpdump.org link-layer header types page.Guy Harris1-1/+2
svn path=/trunk/; revision=51203
2013-08-08Rename "dlt_value" to "linktype_value", and give more details inGuy Harris1-30/+43
comments about LINKTYPE_ values vs. DLT_ values. svn path=/trunk/; revision=51202
2013-07-31Back out previous checkin, which wasn't intended (and which had theGuy Harris1-147/+137
wrong checking message - wrong source tree...). svn path=/trunk/; revision=51051
2013-07-31Copy over r51049 from trunk:Guy Harris1-137/+147
------------------------------------------------------------------------ r51049 | guy | 2013-07-30 22:00:28 -0700 (Tue, 30 Jul 2013) | 5 lines If no target OS version was specified, default to the major version on which we're running, so we *always* build against an SDK. (The "10" in "10.x.y" is not *really* part of the version number, so the "major version" includes the "10" and the major version number following it.) svn path=/trunk/; revision=51050
2013-06-28Use newly assigned DLT for PDU export functionalityPascal Quantin1-0/+4
svn path=/trunk/; revision=50212
2013-05-30From Chris Bontje via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8644 :Pascal Quantin1-3/+5
SEL RTAC (Real Time Automation Controller) EIA-232 Serial-Line Dissection svn path=/trunk/; revision=49635
2013-05-18In the pcapng seek-read routine, *don't* fill in wth->phdr; seek-readGuy Harris1-23/+23
routines are passed a separate struct wtap_pkthdr to be filled in. Get rid of the pseudo_header member of the wblock structure - the pseudo-header is part of the struct wtap_pkthdr. Get rid of the union wtap_pseudo_header * argument to pcap_process_pseudo_header() - it's passed a pointer to a struct pcap_pkthdr, and that structure contains the union in question. Have libpcap_read_header() take a FILE_T argument, rather than using only the "sequential" handle of the wtap it's handed. Have the libpcap read routine return the offset of the beginning of the pcap record, and have the seek-read routine read the header and fill in the struct wtap_pkthdr handed to it. svn path=/trunk/; revision=49401
2013-04-14From Tomasz Mon via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8503 :Pascal Quantin1-0/+2
Add USBPcap support svn path=/trunk/; revision=48847
2013-03-23From Prafulla Harpanhalli via ↵Evan Huus1-1/+2
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8513 Add support for encapsulation 136, Juniper service PIC cookie. svn path=/trunk/; revision=48494
2013-02-28Revert "Fix MSVC build errors related to symbol visibility"Balint Reczey1-3/+0
This reverts commit r47952. The problem was different from what I originally thought, thus the commit was obsolete. svn path=/trunk/; revision=47954
2013-02-28Fix MSVC build errors related to symbol visibilityBalint Reczey1-0/+3
svn path=/trunk/; revision=47952
2013-02-26its ==> it'sBill Meier1-1/+1
svn path=/trunk/; revision=47895
2012-12-22Whitespace changes.Michael Tüxen1-9/+9
svn path=/trunk/; revision=46694
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-01 18:49:35 +0000