diff options
| -rw-r--r-- | doc/editcap.pod | 6 | ||||
| -rw-r--r-- | docbook/release-notes.asciidoc | 19 | ||||
| -rw-r--r-- | editcap.c | 63 |
3 files changed, 55 insertions, 33 deletions
diff --git a/doc/editcap.pod b/doc/editcap.pod index e30424cd89..b865b2c731 100644 --- a/doc/editcap.pod +++ b/doc/editcap.pod @@ -92,13 +92,17 @@ opened. The default is to use a single output file. =item -C E<lt>choplenE<gt> Sets the chop length to use when writing the packet data. Each packet is -chopped by a few <choplen> bytes of data. Positive values chop at the packet +chopped by <choplen> bytes of data. Positive values chop at the packet beginning while negative values chop at the packet end. This is useful for chopping headers for decapsulation of an entire capture or in the rare case that the conversion between two file formats leaves some random bytes at the end of each packet. +NOTE: This option can be used more than once, effectively allowing you to chop +bytes from the beginning of a packet as well as from the end of a packet in a +single step. + =item -d Attempts to remove duplicate packets. The length and MD5 hash of the diff --git a/docbook/release-notes.asciidoc b/docbook/release-notes.asciidoc index cfd17ba500..6bbee7c69b 100644 --- a/docbook/release-notes.asciidoc +++ b/docbook/release-notes.asciidoc @@ -22,12 +22,19 @@ The following bugs have been fixed: The following features are new (or have been significantly updated) since version 1.10: -* Expert info is now filterable (if the dissector has been updated to support the new API). -* The Windows installer now uninstalls the previous version of Wireshark silently. -You can still run the uninstaller manually beforehand if you wish to run it interactively. -* The "Number" column shows related packets and protocol conversation spans (Qt only). -* When manipulating packets with editcap using the -C <choplen> and/or -s <snaplen> options, - it is now possible to also adjust the original frame length using the -L option. +* Expert info is now filterable (if the dissector has been updated to support + the new API). +* The Windows installer now uninstalls the previous version of Wireshark + silently. You can still run the uninstaller manually beforehand if you wish + to run it interactively. +* The "Number" column shows related packets and protocol conversation spans + (Qt only). +* When manipulating packets with editcap using the -C <choplen> and/or + -s <snaplen> options, it is now possible to also adjust the original frame + length using the -L option. +* You can now pass the -C <choplen> option to editcap multiple times, which + allows you to chop bytes from the beginning of a packet as well as at the end + of a packet in a single step. === New Protocol Support @@ -733,7 +733,7 @@ usage(gboolean is_error) fprintf(output, " -s <snaplen> truncate each packet to max. <snaplen> bytes of data.\n"); fprintf(output, " -C <choplen> chop each packet by <choplen> bytes. Positive values\n"); fprintf(output, " chop at the packet beginning, negative values at the\n"); - fprintf(output, " packet end.\n"); + fprintf(output, " packet end. You can use this option more than once.\n"); fprintf(output, " -L adjust the frame length when chopping and/or snapping\n"); fprintf(output, " -t <time adjustment> adjust the timestamp of each packet;\n"); fprintf(output, " <time adjustment> is in relative seconds (e.g. -0.5).\n"); @@ -745,21 +745,21 @@ usage(gboolean is_error) fprintf(output, " that each packet's delta time is the absolute value\n"); fprintf(output, " of the adjustment specified. A value of -0 will set\n"); fprintf(output, " all packets to the timestamp of the first packet.\n"); - fprintf(output, " -E <error probability> set the probability (between 0.0 and 1.0 incl.)\n"); - fprintf(output, " that a particular packet byte will be randomly changed.\n"); + fprintf(output, " -E <error probability> set the probability (between 0.0 and 1.0 incl.) that\n"); + fprintf(output, " a particular packet byte will be randomly changed.\n"); fprintf(output, "\n"); fprintf(output, "Output File(s):\n"); - fprintf(output, " -c <packets per file> split the packet output to different files\n"); - fprintf(output, " based on uniform packet counts\n"); - fprintf(output, " with a maximum of <packets per file> each.\n"); - fprintf(output, " -i <seconds per file> split the packet output to different files\n"); - fprintf(output, " based on uniform time intervals\n"); - fprintf(output, " with a maximum of <seconds per file> each.\n"); - fprintf(output, " -F <capture type> set the output file type; default is pcapng.\n"); - fprintf(output, " an empty \"-F\" option will list the file types.\n"); - fprintf(output, " -T <encap type> set the output file encapsulation type;\n"); - fprintf(output, " default is the same as the input file.\n"); - fprintf(output, " an empty \"-T\" option will list the encapsulation types.\n"); + fprintf(output, " -c <packets per file> split the packet output to different files based on\n"); + fprintf(output, " uniform packet counts with a maximum of\n"); + fprintf(output, " <packets per file> each.\n"); + fprintf(output, " -i <seconds per file> split the packet output to different files based on\n"); + fprintf(output, " uniform time intervals with a maximum of\n"); + fprintf(output, " <seconds per file> each.\n"); + fprintf(output, " -F <capture type> set the output file type; default is pcapng. An empty\n"); + fprintf(output, " \"-F\" option will list the file types.\n"); + fprintf(output, " -T <encap type> set the output file encapsulation type; default is the\n"); + fprintf(output, " same as the input file. An empty \"-T\" option will\n"); + fprintf(output, " list the encapsulation types.\n"); fprintf(output, "\n"); fprintf(output, "Miscellaneous:\n"); fprintf(output, " -h display this help and exit.\n"); @@ -860,7 +860,8 @@ main(int argc, char *argv[]) char *p; guint32 snaplen = 0; /* No limit */ - int choplen = 0; /* No chop */ + int choplen_begin = 0; /* No chop at beginning */ + int choplen_end = 0; /* No chop at end */ gboolean adjlen = FALSE; wtap_dumper *pdh = NULL; unsigned int count = 1; @@ -961,13 +962,21 @@ main(int argc, char *argv[]) break; case 'C': + { + int choplen; + choplen = (int)strtol(optarg, &p, 10); if (p == optarg || *p != '\0') { fprintf(stderr, "editcap: \"%s\" isn't a valid chop length\n", optarg); exit(1); } + if (choplen > 0) + choplen_begin += choplen; + else if (choplen < 0) + choplen_end += choplen; break; + } case 'd': dup_detect = TRUE; @@ -1294,29 +1303,31 @@ main(int argc, char *argv[]) } } - if (choplen < 0) { + if (choplen_end < 0) { snap_phdr = *phdr; - if (((signed int) phdr->caplen + choplen) > 0) - snap_phdr.caplen += choplen; + if (((signed int) phdr->caplen + choplen_end) > 0) + snap_phdr.caplen += choplen_end; else snap_phdr.caplen = 0; if (adjlen) { - if (((signed int) phdr->len + choplen) > 0) - snap_phdr.len += choplen; + if (((signed int) phdr->len + choplen_end) > 0) + snap_phdr.len += choplen_end; else snap_phdr.len = 0; } phdr = &snap_phdr; - } else if (choplen > 0) { + } + + if (choplen_begin > 0) { snap_phdr = *phdr; - if (phdr->caplen > (unsigned int) choplen) { - snap_phdr.caplen -= choplen; - buf += choplen; + if (phdr->caplen > (unsigned int) choplen_begin) { + snap_phdr.caplen -= choplen_begin; + buf += choplen_begin; } else snap_phdr.caplen = 0; if (adjlen) { - if (phdr->len > (unsigned int) choplen) { - snap_phdr.len -= choplen; + if (phdr->len > (unsigned int) choplen_begin) { + snap_phdr.len -= choplen_begin; } else snap_phdr.len = 0; } |