aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/wtap.h
AgeCommit message (Collapse)AuthorFilesLines
2004-02-11From Rolf Fiedler: support for reading EyeSDN USB S0 trace files.Guy Harris1-2/+3
svn path=/trunk/; revision=10038
2004-01-29The DLT_ value 127 is being used for the BSD radio header, and theGuy Harris1-41/+42
current CVS libpcap uses 163 for the AVS radio header (127 was never used for the AVS radio header). Redo the Wiretap encapsulation values for that (and shuffle them to put the 802.11 Wiretap values together). svn path=/trunk/; revision=9904
2004-01-28From Tomas Kukosa: reserve private WTAP_ENCAP values and map them toGuy Harris1-2/+18
reserved private DLT_ values. svn path=/trunk/; revision=9892
2004-01-27Supply a pseudo-header for all 802.11 packets; add an "fcs_len" field toGuy Harris1-2/+4
it, similar to the Ethernet pseudo-header's "fcs_len" field, and use it in the 802.11 dissector. svn path=/trunk/; revision=9884
2004-01-25Have the Wiretap open, read, and seek-and-read routines return, inGuy Harris1-5/+9
addition to an error code, an error info string, for WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with "g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed strings returned as the error info string, and change the callers of those routines to, for those errors, put the info string into the printed message or alert box for the error. Add messages for cases where those errors were returned without printing an additional message. Nobody uses the error code from "cf_read()" - "cf_read()" puts up the alert box itself for failures; get rid of the error code, so it just returns a success/failure indication. Rename "file_read_error_message()" to "cf_read_error_message()", as it handles read errors from Wiretap, and have it take an error info string as an argument. (That handles a lot of the work of putting the info string into the error message.) Make some variables in "ascend-grammar.y" static. Check the return value of "erf_read_header()" in "erf_seek_read()". Get rid of an unused #define in "i4btrace.c". svn path=/trunk/; revision=9852
2003-12-18From Jan Kiszka: IrDA support.Guy Harris1-2/+29
svn path=/trunk/; revision=9345
2003-12-03From Jeff Morriss: add support for libpcap MTP2 and MTP3 captures.Guy Harris1-2/+4
Add a missing entry in "encap_table[]" for Bluetooth H4, and fix some comments. svn path=/trunk/; revision=9157
2003-12-02From Martijn Schipper: support for reading AiroPeek files in V9 captureGuy Harris1-2/+3
file format (AiroPeek 2.x). svn path=/trunk/; revision=9144
2003-10-31From Scott Emberley: support for reading Network Instruments version 9Guy Harris1-2/+3
capture files. svn path=/trunk/; revision=8840
2003-10-30From Marcel Holtmann: support for reading Linux Bluez Bluetooth stackGuy Harris1-4/+6
"hcidump -w" traces. Note that Jesper Peterson contributed support for reading Endace ERF files. svn path=/trunk/; revision=8824
2003-10-25Add a new WTAP_ENCAP_CHDLC_WITH_PHDR type, to distinguish Cisco HDLCGuy Harris1-2/+3
captures with packet direction information from captures without it. Use them appropriately. svn path=/trunk/; revision=8780
2003-10-01Have a pseudo-header for Ethernet packets, giving the size of the FCS -Guy Harris1-3/+7
0 means "there is no FCS in the packet data", 4 means "there is an FCS in the packet data", -1 means "I don't know whether there's an FCS in the packet data, guess based on the packet size". Assume that Ethernet encapsulated inside other protocols has no FCS, by having the "eth" dissector assume that (and not check for an Ethernet pseudo-header). Have "ethertype()" take an argument giving the FCS size; pass 0 when appropriate. Fix up Wiretap routines to set the pseudo-header. This means we no longer use the "generic" seek-and-read routine, so get rid of it. svn path=/trunk/; revision=8574
2003-08-26From Jesper Peterson: support for Endace ERF file format.Guy Harris1-2/+3
svn path=/trunk/; revision=8272
2003-07-29From Thierry Martin: support for reading files from Accellent 5Views LANGuy Harris1-2/+3
agents. svn path=/trunk/; revision=8093
2003-06-25GCC 3.3 noticed that checking whether the length of the slice is > 65535Guy Harris1-1/+2
is pointless, as it's a 16-bit unsigned quantity. Remove those checks - but note in a comment that WTAP_MAX_PACKET_SIZE must be at least 65535 (as there might well be link-layer types with packets at least that large). svn path=/trunk/; revision=7934
2003-05-15From Can Erkin Acar: OpenBSD is now using tcpdump.org-assigned DLT_Guy Harris1-3/+4
value for DLT_PFLOG, and that goes along with a change to the link-layer header for DLT_PFLOG - support both the old and new values and format. svn path=/trunk/; revision=7676
2003-03-08WTAP_ENCAP_ENC was, in fact, intended for use for DLT_ENC, so justGuy Harris1-2/+2
rename WTAP_ENCAP_ENC0 to WTAP_ENCAP_ENC. un-#if 0 out the code to handle the value 109 for DLT_ENC, as I've just checked in support for DLT_ENC in tcpdump.org libpcap and tcpdump, which maps DLT_ENC to 109 in the file header. Give packet-enc.c an RCS ID. svn path=/trunk/; revision=7323
2003-03-07From Markus Friedl:Gerald Combs1-2/+3
Add support for the OpenBSD enc(4) encapsulating interface. Add support for Ethernet over IP (RFC 3378). Fold Markus' .h files into their respective .c files, add a define to ipproto.h and use it. svn path=/trunk/; revision=7310
2003-01-31Add WTAP_ENCAP_FRELAY_WITH_PHDR for use with Frame Relay capture filesGuy Harris1-14/+15
that have direction information. Support writing WTAP_ENCAP_FRELAY_WITH_PHDR and WTAP_ENCAP_PPP_WITH_PHDR captures out in libpcap format - we throw away the direction information, but so it goes. When reading/writing Windows Sniffer format, read and write the direction flag. svn path=/trunk/; revision=7052
2003-01-23In the BSDs, ARCNET packets don't have an offset field between theGuy Harris1-28/+29
addresses and the protocol type, as supplied by BPF; on Linux, they *do* have an offset field, as supplied by PF_PACKET sockets. Add a new WTAP_ENCAP_ARCNET_LINUX, with packets that include the offset field, and don't dissect an offset in WTAP_ENCAP_ARCNET packets. Map a libpcap link-layer type of 129 to WTAP_ENCAP_ARCNET_LINUX; that value was recently assigned to Linux-style ARCNET. Add some more ARCNET protocol IDs. For most protocol IDs, dissect an ATA 878.2 fragmentation header; don't do it for RFC 1051 IP and ARP, and Diagnose packets. Set the length of the ARCNET protocol tree item appropriately. Dissect both the RFC 1051 and RFC 1201 styles of IP and ARP over ARCNET, and dissect the RFC 1201 style of RARP as well. svn path=/trunk/; revision=6981
2003-01-10The Sniffer file formats include a file to identify raw cells; exportGuy Harris1-1/+7
that flag in the ATM pseudo-header, and use it to determine whether a frame is a raw cell or a reassembled frame, rather than using the AAL, as you can have raw AAL5 cells in a capture. svn path=/trunk/; revision=6889
2003-01-09It appears that a channel number of 0 means DTE->DCE, and a channelGuy Harris1-2/+2
number of 1 means DCE->DTE, in DOS Sniffer ATM captures. svn path=/trunk/; revision=6881
2003-01-08From Chris Waters: support Tazmen Sniffer Protocol and DLT_TZSP capturesGuy Harris1-2/+3
from network-based libpcaps that use that protocol. svn path=/trunk/; revision=6875
2003-01-03Add support for SDLC encapsulation in DOS Sniffer captures; thatGuy Harris1-3/+4
includes adding an SDLC dissector. svn path=/trunk/; revision=6848
2003-01-03Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not justGuy Harris1-22/+23
used for the DOS-based ATM Sniffer. (That's not a great name, but I couldn't think of a better one.) Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture files where reassembled frames don't have trailers, such as the AAL5 trailer, chopped off. That's what at least some versions of the Windows-based ATM Sniffer appear to have. Map the ATM capture file type for NetXRay captures to WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've reverse-engineered, so far, for the pseudo-header; there's more that needs to be done on it, e.g. getting the channel, AAL type, and traffic type (or inferring them if they're not in the packet header). svn path=/trunk/; revision=6840
2002-12-20This adds the beginning of support for Wellfleet HDLC to ngsniffer.c asRichard Sharpe1-2/+3
well as Cisco HDLC support. It compiles OK, but I do not claim that it is not borken. I will have to add a small dissector that eats the first two bytes and then calls the Ethernet dissector as well, to complete the work. svn path=/trunk/; revision=6809
2002-12-05Sigh. We really *do* have to check whether a capture is a snoop orGuy Harris1-23/+24
Surveyor capture, as there's one link-layer type that UNICOS/mp snoop treats one way and Shomiti Surveyor treats another way. The only way to check that is to look at the first record to see how much padding it has. svn path=/trunk/; revision=6750
2002-11-06From Solomon Peachy: support for new "wlancap" 802.11 extra-informationGuy Harris1-2/+3
header. Add overflow checks to "BYTES_ARE_IN_FRAME()", and cast all arguments to unsigned values (negative values should never be passed) to squelch compiler warnings. svn path=/trunk/; revision=6567
2002-10-31Discard the WTAP_ENCAP_LAPD encapsulation type in favor of aGuy Harris1-5/+13
WTAP_ENCAP_ISDN encapsulation type, which includes a pseudo-header giving the direction (user-to-network or network-to-user) and the channel number. Add a new circuit type, using the ISDN channel number as the circuit ID. Add an ISDN dissector to put the direction and channel number into the protocol tree and to call the appropriate dissector for the payload based on the channel (LAPD for the D channel; V.120, PPP, or data for B channels, based on some heuristics). svn path=/trunk/; revision=6521
2002-10-22Add a Wiretap encapsulation type for RFC 2625 IP-over-Fibre Channel, andGuy Harris1-2/+3
map libpcap's DLT_IP_OVER_FC to it. svn path=/trunk/; revision=6473
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-4/+4
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6115
2002-08-16Updates from Motonori Shindo.Guy Harris1-11/+7
svn path=/trunk/; revision=6000
2002-07-31Add conditional include of winsock2.h again, so compilation with MSVC++Jörg Mayer1-1/+5
will work again without complaints. svn path=/trunk/; revision=5925
2002-07-31From Motonori Shindo: support for reading CoSine L2 debug output.Guy Harris1-3/+38
svn path=/trunk/; revision=5922
2002-07-29From Joerg Mayer:Guy Harris1-20/+12
All files: - Replace types from sys/types.h by those from glib.h - Replace ntoh family of macros from netinet/in.h and winsock2.h by g_ntoh family from glib.h - Remove now unneeded includes of sys/types.h, netinet/in.h and winsock2.h wtap.h Move includes to the top svn path=/trunk/; revision=5909
2002-07-16From Graeme Hewson:Guy Harris1-13/+15
Allow "-" as the output file name in Wiretap, referring to the standard error. Optimize the capture loop. Fix some of the error-message printing code in Ethereal and Tethereal. Have Wiretap check whether it can seek on a file descriptor, and pass the results of that test to the file-type-specific "open for output" routine. Have the "open for output" routines for files where we need to seek when writing the file return an error if seeks don't work. svn path=/trunk/; revision=5884
2002-07-12From Anand V. Narwani:Guy Harris1-2/+3
DOCSIS support, including support for "Ethernet" captures where the raw frame is a DOCSIS frame rather than an Ethernet frame (some Cisco cable-modem head-end gear can send out a trace of all traffic on an Ethernet, but what it sends are the raw bytes of DOCSIS frames, not Ethernet frames) Get rid of second AUTHORS entry for Devin Heitmueller, merging its item into the older entry. Clean up the order of some lists of plugin items. svn path=/trunk/; revision=5861
2002-06-23WinPcap 2.3's <pcap.h> includes <packet32.h>, and WinPcap 2.3'sGuy Harris1-3/+3
<packet32.h> includes <winsock2.h>; we include that rather than <winsock.h>, to avoid errors due to conflicting declarations in <winsock.h> and <winsock2.h>. svn path=/trunk/; revision=5742
2002-06-07Add a Wiretap routine to process packets captured via libpcap, possiblyGuy Harris1-4/+1
extracting a pseudo-header, for the use of SunATM captures. Add support for SunATM capture. svn path=/trunk/; revision=5652
2002-06-07Add a new error for attempts to open a pipe or FIFO for random access.Guy Harris1-16/+18
Have "wtap_open_offline()", if asked to open a FIFO, return that error if it was asked to open the file for random access. svn path=/trunk/; revision=5643
2002-05-28Add support for old NetXRay format.Guy Harris1-17/+18
svn path=/trunk/; revision=5576
2002-04-30Replace the "ngsniffer_atm" with an "atm" pseudo-header, which isn'tGuy Harris1-64/+76
just an image of the ATM Sniffer data. This means that Ethereal doesn't have to know any ATM Sniffer-specific details (that's all hidden in Wiretap), and allows us to add to that pseudo-header fields, traffic types, etc. unknown to ATM Sniffers. Have Wiretap map VPI 0/VCI 5 to the signalling AAL - for some capture files, this might not be necessary, as they may mark all signalling traffic as such, but, on other platforms, we don't know the AAL, so we assume AAL5 except for 0/5 traffic. Doing it in Wiretap lets us hide those details from Ethereal (and lets Ethereal interpret 0/5 traffic as non-signalling traffic, in case that happens to be what it is). We may know that traffic is LANE, but not whether it's LE Control or emulated 802.3/802.5; handle that case. svn path=/trunk/; revision=5302
2002-04-09Move the definition of the FROM_DCE bit in the "flags" field of aGuy Harris1-3/+3
"struct x25_phdr" to "wiretap/wtap.h". Have two X.25 dissectors, one of which assumes that there's a "struct x25_phdr" pseudo-header and one of which doesn't; the former uses the information in that pseudo-header to determine whether the packet is DTE->DCE or DCE->DTE, and the latter assumes it has no clue whether the packet is DTE->DCE or DCE->TDE. Use the former one in the LAPB dissector, and the latter one in the XOT dissector and in the LLC dissector table. In the X.25-over-TCP dissector, handle multiple X.25 packets per TCP segment, and handle X.25 packets split across TCP segments. svn path=/trunk/; revision=5134
2002-04-08Use WTAP_ENCAP_IEEE_802_11_WITH_RADIO for AiroPeek files, rather thanGuy Harris1-4/+3
having a special encapsulation type for AiroPeek files. svn path=/trunk/; revision=5123
2002-04-08Add an encapsulation type for "802.11 with radio information"; that typeGuy Harris1-11/+20
returns radio information such as signal strength, channel, and data rate in a pseudo-header. Add that pseudo-header. Use the "802.11 with radio information" encapsulation type for Wireless Sniffer files; extract the radio information from where it appears to be in the header. Add dissector code for that encapsulation type. Fix an error in the code to put radio information into the AiroPeek tree. Make the "wrapped" flag for NetXRay/Windows Sniffer captures a "gboolean". svn path=/trunk/; revision=5122
2002-03-05Make "wtap_seek_read()" return TRUE on success and FALSE on error, likeGuy Harris1-3/+3
"wtap_read()". Add some additional error checks to the Sniffer file reader. svn path=/trunk/; revision=4875
2002-03-05Have "wtap_seek_read()" return 0 on success and -1 on failure, and takeGuy Harris1-3/+3
an "err" argument that points to an "int" into which to put an error code if it fails. Check for errors in one call to it, and note that we should do so in other places. In the "wtap_seek_read()" call in the TCP graphing code, don't overwrite "cfile.pseudo_header", and make the buffer into which we read the data WTAP_MAX_PACKET_SIZE bytes, as it should be. In some of the file readers for text files, check for errors from the "parse the record header" and "parse the hex dump" routines when reading sequentially. In "csids_seek_read()", fix some calls to "file_error()" to check the error on the random stream (that being what we're reading). svn path=/trunk/; revision=4874
2002-02-07Support in Wiretap for DLT_HHDLC, from Tomas Kukosa.Guy Harris1-2/+3
svn path=/trunk/; revision=4707
2002-02-01Update a comment.Guy Harris1-4/+7
svn path=/trunk/; revision=4655
2002-01-29Untested support for AiroPeek captures.Guy Harris1-2/+3
svn path=/trunk/; revision=4619
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-27 12:05:47 +0000