aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap
AgeCommit message (Collapse)AuthorFilesLines
2001-12-04In the NetMon capture file reading code, if we get a short read whenGuy Harris1-4/+4
trying to read the frame table, return -1 with "*err" set to WTAP_ERR_SHORT_READ, don't return 0 - we've already decided that the file is a NetMon file, so we shouldn't return a "this isn't a NetMon file" indication, we should return a "this file is too short" error, as that's what the problem is. Fix up the error messages for WTAP_ERR_SHORT_READ to indicate that the read might have gotten cut short in the middle of data other than a packet. svn path=/trunk/; revision=4331
2001-12-04Support for reading Visual Networks traffic capture files, from TomGuy Harris7-10/+718
Nisbet. Make a comment in "wiretap/file.c" clearer, so people know where to put the entries for their capture file type. svn path=/trunk/; revision=4328
2001-12-04From Motonori Shindo: fix Ascend/Lucent trace reading code to handleGuy Harris2-9/+109
later trace formats that have an ASCII dump at the end of the line. svn path=/trunk/; revision=4327
2001-12-04Make the bytes-written information from Wiretap a long, as we allowGuy Harris4-6/+14
files to get that big. From Thomas Wittwer and Matthias Nyffenegger: Support for "ring buffer mode", wherein there's a ring buffer of N capture files; as each capture file reaches its maximum size (the ring buffer works only with a maximum capture file size specified), Ethereal rolls over to the next capture file in the ring buffer, replacing whatever packets might be in it with new packets. svn path=/trunk/; revision=4323
2001-12-04Support for stopping capture at specified capture file size or captureGuy Harris5-4/+17
duration, from Thomas Wittwer and Matthias Nyffenegger. svn path=/trunk/; revision=4322
2001-11-30Add support for LocalTalk Link Access Protocol.Guy Harris3-7/+13
Rename WTAP_ENCAP_PRISM to WTAP_ENCAP_PRISM_HEADER, to match DLT_PRISM_HEADER. Add in missing capture support for WTAP_ENCAP_PRISM_HEADER when capturing with "pcap_open_live()" rather than reading the capture from a pipe. svn path=/trunk/; revision=4299
2001-11-28Support for 802.11+Prism II monitor-mode link-layer headers, fromGuy Harris3-5/+13
Tim Newsham. Add in missing item for WTAP_ENCAP_CISCO_IOS in the Wiretap encapsulation type table. svn path=/trunk/; revision=4290
2001-11-14Back the previous hack out - the padding is often zero, but it's notGuy Harris1-68/+3
*always* zero, so it won't always work, and it's somewhat gross. The right answer is "don't use Digital/Tru64 UNIX's tcpdump, use tcpdump.org's". svn path=/trunk/; revision=4202
2001-11-14Throw in a hack to try to detect FDDI captures from Digital UNIX'sGuy Harris1-3/+68
tcpdump and, if we think we've found one, strip off the 3 padding bytes they put in front of the frame. svn path=/trunk/; revision=4201
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez40-79/+79
svn path=/trunk/; revision=4199
2001-11-09Wrap calls to "pcap_datalink()" in a routine that attempts to compensateGuy Harris1-7/+8
for AIX 5.x's non-standard libpcap, where "pcap_datalink()" doesn't return DLT_ values, it returns RFC 1573 ifType values. Put that wrapper, and the routine to get the interface list, in a separate file, for packet-capture utility routines, so not everybody who includes "util.h" needs to include <pcap.h>. Fix up the Wiretap hack for dealing with said incompatibility to use the correct ifType value for Token Ring. svn path=/trunk/; revision=4184
2001-11-07Expand on the comments about AIX libpcap.Guy Harris1-6/+10
No, Nokia *weren't* kind enough to change the major or minor version number in the capture file when they changed the format, just as they weren't kind enough to change the magic number. svn path=/trunk/; revision=4173
2001-11-06Add in some heuristics to try to detect AIX libpcap format. (This worksGuy Harris3-27/+93
with one capture I've seen, but perhaps that was done with an old version of AIX, and newer versions use a minor version number, in the file, of 4. However, libpcap hasn't used a minor version of 2 for ages, so perhaps AIX hasn't updated their libpcap in ages, and aren't about to do so soon. If they do, let's hope they change the magic number. The capture file in question *does* have the capture length and real length in the old, pre-2.3, order, so it really looks as if it's an old version, rather than IBM trying to be "helpful" by using a different minor version number so that you can distinguish between normal libpcap and AIX libpcap formats.) svn path=/trunk/; revision=4164
2001-11-02Support DLT_CISCO_IOS.Gilbert Ramirez2-3/+6
svn path=/trunk/; revision=4126
2001-10-28Include <unistd.h>, if we have it, to declare "unlink()".Guy Harris1-1/+5
svn path=/trunk/; revision=4094
2001-10-25Interface type 0x07 is Ethernet.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4078
2001-10-25Get rid of signed/unsigned comparison warnings in wiretap.Gilbert Ramirez6-23/+24
svn path=/trunk/; revision=4077
2001-10-19DBS Etherwatch wiretap module, from Marc Milgram.Guy Harris8-7/+417
svn path=/trunk/; revision=4042
2001-10-18VMS TCPIPtrace wiretap module, from Marc Milgram.Guy Harris8-16/+480
Update the lists of known capture file formats in the Tethereal, editcap, and mergecap man pages to match the current list (as found in the Ethereal man page). svn path=/trunk/; revision=4039
2001-10-16Don't create a Wiretap dump file unless we're at least sure we supportGuy Harris1-32/+69
the specified encapsulation with the specified capture file type, and that we can allocate a "wtap_dumper *". If we could do all that, and could create the dump file, but the file-type-specific create routine fails (e.g., because there's not enough disk space to write out the header), remove the dump file. svn path=/trunk/; revision=4032
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris19-93/+95
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
2001-09-28We have our own internal versions of "gzgets()" and "gzgetc()", so weGuy Harris2-8/+8
don't need to check whether zlib has them. We *do*, however, have to check for "gzseek()", as we don't have our own version of that. svn path=/trunk/; revision=3963
2001-09-23Update the URL for ATM-on-Linux.Guy Harris1-2/+2
svn path=/trunk/; revision=3949
2001-09-20Removed the dependency on gzgetc and gzgets by implementing internalAshok Narayanan2-4/+30
versions of these commands in file_wrappers.c. This allows us to compile successfully even on platforms where X has an older zlib built in. Removed this restriction from acinclude.m4 svn path=/trunk/; revision=3948
2001-08-25The return value from "fwrite()" is a "size_t"; make the variable intoGuy Harris6-47/+47
which we store it a "size_t", and then fix up the bugs that were revealed by the compiler warnings that produced - "fwrite()" returns 0, not a negative number, on an I/O error. Fix up some other items to have type "size_t", or to have various unsigned types, while we're at it, to squelch compiler warnings. svn path=/trunk/; revision=3867
2001-08-25Sigh. Shomiti apparently didn't know that the RFC 1761 data link typesGuy Harris1-16/+99
were just DLPI data link types, and didn't know that the list had expanded at some point and that Sun *used* some of the new types (e.g., in atmsnoop), or decided on their own to go beyond those types to encode an Oh-So-Useful link speed indication, or just didn't *care* that they were just DLPI data link types. Therefore, we have to map Shomiti link types to wiretap types using a different mapping table. For now, we assume files with a version number of 2 are snoop files, and version numbers of 3, 4, and 5 are Shomiti files; Shomiti claims to use a version number of 2 as well, but to determine whether a file with a version number of 2 is a snoop file or a Shomiti file requires that we look at the header of the first packet and assume that if there's more than 3 bytes of padding it's a Shomiti file. The return value from "fwrite()" is a "size_t"; make the variable into which we store it a "size_t", and then fix up the bugs that were revealed by the compiler warnings that produced - "fwrite()" returns 0, not a negative number, on an I/O error. svn path=/trunk/; revision=3866
2001-08-20Use system's version of AM_PATH_GLIB macro.Gilbert Ramirez3-207/+11
Optimize use of AC_CHECK_FUNC in wiretap/acinclude.m4 Move #include "config.h" to be first include in some files. From albert chin (china@thewrittenword.com) svn path=/trunk/; revision=3857
2001-08-18If there's no "zlib.h" header, we won't be using zlib, so don't botherGuy Harris1-10/+15
checking for "gzgets()" in zlib. If there is a "zlib.h" header, and there is a "gzgets()" in zlib, check whether we find "gzgets()" in zlib when we link with the GTK+ link flags, and, if not, fail. People often grab XFree86 source and build and install it on their systems, and they appear sometimes to misconfigure XFree86 so that, even on systems with zlib, it assumes there is no zlib, so the XFree86 build process builds and installs its own "mini-zlib" in the X11 library directory. The "mini-zlib" lacks "gzgets()", and that's the zlib with which Ethereal gets linked, so the build of Ethereal fails. svn path=/trunk/; revision=3849
2001-07-27Fix AC_ETHEREAL_PCAP_CHECK so that, if a directory was specified withGuy Harris1-4/+5
"--with-pcap", it adds the "include" subdirectory of that directory to the list of directories to search for include files, rather than adding the directory itself. Check whether libpcap defines "pcap_version", and define HAVE_PCAP_VERSION if it does. Use "pcap_version" iff HAVE_PCAP_VERSION is defined, rather than special-casing MacOS X. Don't #define a string for the WinPcap version; just leave HAVE_PCAP_VERSION undefined on Windows, as WinPcap 2.2beta is out, so we can no longer assume that the Windows version of Ethereal is using WinPcap 2.1. svn path=/trunk/; revision=3792
2001-07-26MacOS support changes, from Michael Tuexen (with some modifications):Guy Harris1-3/+11
replace "--with-plugindir" with "--with-plugins", and have the plugin directory optional - this allows plugins to be disabled; add "--traditional-cpp" on MacOS X/Darwin (Apple's "cc" compiler requires it, for some annoying reason, even though it is, as far as I know, GCC-based, and other GCC's don't require it); on MacOS X, don't use "pcap_version[]", as, for some annoying reason, libpcap on MacOS X doesn't define it. Clean up some whitespace in the help messages for the configure script. Move the AM_CONDITIONAL for SETUID_INSTALL after the point at which "enable_setuid_install" is set, as it tests "enable_setuid_install". svn path=/trunk/; revision=3788
2001-07-15Fixes, from Scott Renfro, for some calls to "localtime()" that didn'tGuy Harris2-15/+30
check whether the call succeeded (it doesn't always do so on Windows, for example). svn path=/trunk/; revision=3722
2001-07-13From Joerg Mayer:Guy Harris10-29/+35
* gcc 3.0 warning fixes: - text2pcap.c: The number of characters to scan should probably not be 0 - wiretap/csids.c: using preincrement on a variable used on both sides of an assignment might be undefined by the C99(?) standard * turn on additional warnings for epan and wiretap too - epan/configure.in - wiretap/configure.in * Fix some warnings (missing includes, signed/unsigned, missing initializers) found by turning on the warnings - all other files :-) svn path=/trunk/; revision=3709
2001-07-06Remove a comment that no longer applies - we no longer seek forward inGuy Harris1-18/+1
compressed Sniffer files by sequentially moving forward, and we no longer seek backward by seeking to the beginning and then seeking forward to the new position, we now seek to the beginning of the compressed block that contains the target position, if we're not already in that block, and then move to the appropriate position in that block. svn path=/trunk/; revision=3658
2001-07-05"wtap_file()" is no longer in Wiretap, so don't try to export it fromGuy Harris1-1/+0
the Wiretap DLL. svn path=/trunk/; revision=3655
2001-07-05"open_cap_file()" in Ethereal and Tethereal don't use the FILE_T theyGuy Harris2-9/+2
get from calling "wtap_file()", so get rid of the call and the (otherwise unused) variable to which its result gets assigned. That lets us get rid of "wtap_file()" in Wiretap. It also lets us get rid of the include of "zlib.h" in "file.h"; the #defines of "file_open()", "filed_open()", and "file_close()" are also unnecessary, so we get rid of those as well. However, that means we need to include <zlib.h> in "gtk/main.c" and "tethereal.c", so that the version number of libz is defined and can show up in the version string. svn path=/trunk/; revision=3652
2001-06-27Replace "--enable-pcap" with "--with-pcap", and if an argument isGuy Harris2-16/+59
specified to "--with-pcap", add that directory to the include file and library search paths, so that you can use "--with-pcap=DIR" to search for libpcap in a directory other than the standard ones (either because it was installed somewhere other than under "/usr" or "/usr/local", or because you want to use a special version you've installed rather than the standard one). svn path=/trunk/; revision=3611
2001-05-09Patch from Chris Jepeway to use, in NetXRay 2.x captures, a field fromGuy Harris1-3/+17
the file header to specify the time units; different files appear to have different time stamp units. svn path=/trunk/; revision=3407
2001-04-18Distribute wtap.defGilbert Ramirez1-2/+3
svn path=/trunk/; revision=3330
2001-04-18#define YY_NEVER_INTERACTIVE to avoid reference to isatty() on Win32,Gilbert Ramirez1-1/+3
and thus avoid a compiler warning when compiling ascend-scanner.c. svn path=/trunk/; revision=3322
2001-04-17As of GLib 1.2.9, you won't automatically get "-I/usr/local/include" andGuy Harris1-2/+29
"-L/usr/local/lib" added to CFLAGS and LDFLAGS merely as a result of running AM_PATH_GLIB, as 1.2.9 and later don't install headers directly under "/usr/local/include". Therefore, we have to put "-I/usr/local/include" into CFLAGS ourselves, just as we do in the top-level configure script, or we run the risk of not being able to find other packages (libpcap, zlib, etc.) if it's installed under "/usr/local". svn path=/trunk/; revision=3318
2001-04-17Fix the e-mail address for Joerg Mayer (and remove it from files heGuy Harris1-1/+1
wasn't involved with). svn path=/trunk/; revision=3311
2001-04-16GCC 2.95.1 on SPARC/Solaris, at least, is clever enough to figure outGuy Harris1-5/+1
that the loop in "lanalyzer_open()" is an infinite loop, so the "return 0;" at the end isn't necessary to suppress a compiler warning with that compiler - and Sun C not only figures it out, it warns that the "g_assert_not_reached()" and the "return 0;" are unreachable, so I'll take them out for now (and put them back if my older GCC at home still requires it to suppress warnings). svn path=/trunk/; revision=3310
2001-04-16The "data" member of a Buffer structure is a "u_char *"; when assigningGuy Harris1-3/+3
the result of a "g_malloc()" to it, cast it to "u_char *", not "char *". svn path=/trunk/; revision=3309
2001-04-12Improvement of 'make clean' targets.Gilbert Ramirez1-2/+3
svn path=/trunk/; revision=3297
2001-04-09Add support for "version 7" wandess output. Actually, I think it'sGerald Combs2-12/+74
simply PPP data that doesn't have a username associated with it, e.g. for a dedicated WAN link as opposed to a dialup link. svn path=/trunk/; revision=3274
2001-04-06Build with zlib.Gilbert Ramirez2-9/+7
Pre-compiled zlib provided at http://www.ethereal.com/distribution/win32/zlib-1.1.3-fixed.zip "fixed" because the pre-compiled version in the "extralibs" package from the Gimp/Win32 page has a fault zlib.lib in it. Add note about zlib in README.win32; more work needs to be done to this file to mention new packaging method. svn path=/trunk/; revision=3263
2001-04-05Use sed in the Win32 build to place the version in various files.Gilbert Ramirez2-4/+4
We us $(VERSION), defined in the top-level config.nmake, to replace @VERSION@ in various files. $(RC_VERSION) and $(WTAP_VERSION) are similarly used. svn path=/trunk/; revision=3258
2001-03-23Back out the guint64 stuff - it's not clear it's the right way to handleGuy Harris1-41/+20
this, as 1) we still need to handle platforms that don't support 64-bit integral data types, so we still needed the old stuff in some fashion anyway and 2) MSVC appears to treat structures as requiring 8-byte alignment in some cases, and "guint64"s require 8-byte alignment on at least some platforms, forcing structures containing those 64-bit time stamps to have a size that's a multiple of 8 bytes, which *isn't* the correct size for the data record header. svn path=/trunk/; revision=3177
2001-03-23The Win32 build builds wiretap as a DLL and requires WinPcap 2.1.Gilbert Ramirez3-6/+61
svn path=/trunk/; revision=3163
2001-03-15Add a new Wiretap encapsulation type for Cisco HDLC. Map the NetBSDGuy Harris3-11/+21
DLT_HDLC to it. Make a separate dissector for Cisco HDLC, and add a dissector for Cisco SLARP. Have the PPP dissector call the Cisco HDLC dissector if the address field is the Cisco HDLC unicast or multicast address. Use the Cisco HDLC dissector for the Cisco HDLC Wiretap encapsulation type. Add a new dissector table "chdlctype", for Cisco HDLC packet types (they're *almost* the same as Ethernet types, but 0x8035 is SLARP, not Reverse ARP, and 0x2000 is the Cisco Discovery protocol, for example), replacing "fr.chdlc". Have a "chdlctype()" routine, similar to "ethertype()", used both by the Cisco HDLC and Frame Relay dissectors. Have a "chdlc_vals[]" "value_string" table for Cisco HDLC types and protocol names. Split the packet type field in the Frame Relay dissector into separate SNAP and Cisco HDLC fields, and give them the Ethernet type and Cisco HDLC type "value_string" tables, respectively. svn path=/trunk/; revision=3133
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-18 01:24:23 +0000