diff options
author | Jaap Keuter <jaap.keuter@xs4all.nl> | 2006-01-12 15:02:25 +0000 |
---|---|---|
committer | Jaap Keuter <jaap.keuter@xs4all.nl> | 2006-01-12 15:02:25 +0000 |
commit | ca4000cbafe8191153d8e34707b0a745aeb6eb34 (patch) | |
tree | 583903bfd4d446c15d692ccc85933c8d4ce97caa /wiretap | |
parent | 963539f1bd3fc0351090cb4224c45511c0ed4dfe (diff) |
The attached patch to fix bug 663 allows Ethereal to read Windows
Sniffer V2 format capture files with captyp=5, timeunit=0.
The ticks_per_sec for this case apparently is 1e6.
Bill Meier
svn path=/trunk/; revision=17019
Diffstat (limited to 'wiretap')
-rw-r--r-- | wiretap/netxray.c | 41 |
1 files changed, 38 insertions, 3 deletions
diff --git a/wiretap/netxray.c b/wiretap/netxray.c index 7e88414d1e..5de8692f1e 100644 --- a/wiretap/netxray.c +++ b/wiretap/netxray.c @@ -105,13 +105,17 @@ struct netxray_hdr { * depends on the network type. We prefix all the capture types * for WAN captures with WAN_. */ -#define CAPTYPE_NDIS 0 /* Capture on network interface using NDIS */ +#define CAPTYPE_NDIS 0 /* Capture on network interface using NDIS */ /* * Ethernet capture types. */ -#define ETH_CAPTYPE_GIGPOD 2 /* gigabit Ethernet captured with pod */ -#define ETH_CAPTYPE_OTHERPOD 3 /* non-gigabit Ethernet captured with pod */ +#define ETH_CAPTYPE_GIGPOD 2 /* gigabit Ethernet captured with pod */ +#define ETH_CAPTYPE_OTHERPOD 3 /* non-gigabit Ethernet captured with pod */ +#define ETH_CAPTYPE_OTHERPOD2 5 /* gigabit Ethernet via pod ?? */ + /* Captype 5 seen in capture from Distributed Sniffer with: */ + /* Version 4.50.211 software */ + /* SysKonnect SK-9843 Gigabit Ethernet Server Adapter */ #define ETH_CAPTYPE_GIGPOD2 6 /* gigabit Ethernet captured with pod */ /* @@ -145,6 +149,9 @@ struct netxray_hdr { * has a non-zero value; if so, perhaps we need a new TpS table for the * corresponding network type and captype. * + * TpS...[] entries of 0.0 mean that no capture file for the + * corresponding captype/timeunit values has yet been seen + * * Note that the "realtick" value is wrong in many captures, so * we no longer use it. We don't know what significance it has. * In at least one capture where "realtick" doesn't correspond @@ -195,6 +202,12 @@ static double TpS_otherpod[] = { 1e6, 0.0, 1250000.0 }; #define NUM_NETXRAY_TIMEUNITS_OTHERPOD (sizeof TpS_otherpod / sizeof TpS_otherpod[0]) /* + * Table of time units for Ethernet captures with captype ETH_CAPTYPE_OTHERPOD2. + */ +static double TpS_otherpod2[] = { 1e6, 0.0, 0.0 }; +#define NUM_NETXRAY_TIMEUNITS_OTHERPOD2 (sizeof TpS_otherpod2 / sizeof TpS_otherpod2[0]) + +/* * Table of time units for Ethernet captures with captype ETH_CAPTYPE_GIGPOD2. */ static double TpS_gigpod2[] = { 1e9, 0.0, 0.0 }; @@ -522,6 +535,28 @@ int netxray_open(wtap *wth, int *err, gchar **err_info) start_timestamp = 0.0; break; + case ETH_CAPTYPE_OTHERPOD2: + if (hdr.timeunit > NUM_NETXRAY_TIMEUNITS_OTHERPOD2 + || TpS_otherpod2[hdr.timeunit] == 0.0) { + *err = WTAP_ERR_UNSUPPORTED; + *err_info = g_strdup_printf( + "netxray: Unknown timeunit %u for Ethernet/ETH_CAPTYPE_OTHERPOD2 version %.8s capture", + hdr.timeunit, hdr.version); + return -1; + } + timeunit = TpS_otherpod2[hdr.timeunit]; + /* + * XXX: start time stamp in the one capture file examined of this type was 0; + * We'll assume the start time handling is the same as for other pods. + * + * At least for 002.002 and 002.003 + * captures, the start time stamp is 0, + * not the value in the file. + */ + if (version_minor == 2 || version_minor == 3) + start_timestamp = 0.0; + break; + case ETH_CAPTYPE_GIGPOD2: if (hdr.timeunit > NUM_NETXRAY_TIMEUNITS_GIGPOD2 || TpS_gigpod2[hdr.timeunit] == 0.0) { |