aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/erf.c
AgeCommit message (Collapse)AuthorFilesLines
2011-10-04From Andrew Kampjes:Anders Broman1-18/+29
Allows the saving of packets with snapped length to ERF. Prevents the adding of automatic CRC and rounds down to the nearest 8 bytes instead of up, adding zeros. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6409 svn path=/trunk/; revision=39247
2011-09-06Don't synthesize a CRC if the packet already has one.Guy Harris1-5/+17
svn path=/trunk/; revision=38905
2011-09-03Check return value from wtap_dump_file_write.Stig Bjørlykke1-1/+2
This fixes CID 1272. svn path=/trunk/; revision=38876
2011-09-01Use guint8 rather than guchar for raw octets and pointers to arrays ofGuy Harris1-3/+3
same. Add to wiretap/pcap-common.c a routine to fill in the pseudo-header for ATM (by looking at the VPI, VCI, and packet data, and guessing) and Ethernet (setting the FCS length appropriately). Use it for both pcap and pcap-ng files. svn path=/trunk/; revision=38840
2011-08-31Not ideal, but OK for now - alignbytes, at that point, is < 8, so weGuy Harris1-3/+2
know it'll fit in a gint16. (alignbytes really shouldn't need to be 64 bits, as if we have 2^63-1 bytes of alignment, We Have A Problem; fixing that may involve calculating it differently earlier in that routine.) svn path=/trunk/; revision=38828
2011-08-31Try using gint64 for alignbytes.Stig Bjørlykke1-1/+1
svn path=/trunk/; revision=38827
2011-08-31From Andrew Kampjes via bug 6260:Stig Bjørlykke1-1/+211
Added support for saving ERF files. From me: Use crc routines from libwsutil. svn path=/trunk/; revision=38826
2011-04-21Add a new WTAP_ERR_DECOMPRESS error, and use that for errors discoveredGuy Harris1-11/+16
by the gunzipping code. Have it also supply a err_info string, and report it. Have file_error() supply an err_info string. Put "the file" - or, for WTAP_ERR_DECOMPRESS, "the compressed file", to suggest a decompression error - into the rawshark and tshark errors, along the lines of what other programs print. Fix a case in the Netscaler code where we weren't fetching the error code on a read failure. svn path=/trunk/; revision=36748
2011-04-20pntohll() takes a guint8 * as an argument; there's no need to cast to aGuy Harris1-1/+1
guint64 *, and it causes clang to complain. svn path=/trunk/; revision=36738
2011-04-06From Jakub Zawadzki:Guy Harris1-5/+5
file_read(buf, bsize, count, file) macro is compilant with fread function and takes elements count+ size of each element, however to make it compilant with gzread() it always returns number of bytes. In wiretap file_read() this is not really used, file_read is called either with bsize set to 1 or count to 1. Attached patch remove bsize argument from macro. svn path=/trunk/; revision=36491
2010-11-04From Alexis La Goutte:Jaap Keuter1-4/+1
Replace all *_min()/*_max() by MIN() and MAX(). svn path=/trunk/; revision=34770
2010-10-28From Stephen Donnelly:Anders Broman1-7/+11
Wireshark tools do not detect and read some ERF files correctly https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5344 svn path=/trunk/; revision=34665
2010-04-08From Stephen Donnelly:Anders Broman1-2/+3
InfiniBand Link Packet (flow control) dissector. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4656 svn path=/trunk/; revision=32425
2010-02-02From Stephen Donnelly:Anders Broman1-1/+3
Endace ATM and AAL2 enhancements. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4447 svn path=/trunk/; revision=31766
2009-11-09Removed an unused variable.Stig Bjørlykke1-2/+1
svn path=/trunk/; revision=30891
2009-08-10Update a comment - a bad packet size could also be the result of a fileGuy Harris1-2/+3
not actually being an ERF file. Don't compute the packet size until you know that rlen is valid. svn path=/trunk/; revision=29366
2009-08-10Don't try to allocate more than WTAP_MAX_PACKET_SIZE. Fixes a crashGerald Combs1-0/+7
reported in bug 3849. svn path=/trunk/; revision=29364
2009-04-22Clean up some 64-bit issues.Guy Harris1-18/+18
svn path=/trunk/; revision=28117
2008-09-29From Francesco Fusco:Anders Broman1-9/+45
Endace ERFII (extension header) support. svn path=/trunk/; revision=26287
2008-07-14From Stephen Donnelly:Jaap Keuter1-3/+6
ERF files can contain records of type TYPE_PAD. These records are not related to captured packets, have a zero timestamp value and no associated packet data. Normally TYPE_PAD records are stripped out during capture, but in rare cases unstripped files may exist. Previously wiretap/erf.c generated an 'unknown record encapsulation' error when encountering TYPE_PAD records. With this patch Wireshark skips over any TYPE_PAD records within ERF traces files without reporting an error. TYPE_PAD records are not counted, displayed or decoded. svn path=/trunk/; revision=25733
2008-04-12From Stephen Donnelly (bug 2359):Sake Blok1-43/+39
- add support for ERF files created with a snaplength - tighten heuristics (rlen>=16, time_delta < 1 week) svn path=/trunk/; revision=24929
2008-03-14From Stephen Donnelly via bug 2235:Gerald Combs1-2/+9
This plugin implements a dissector for Infiniband. It is released under the GPL v2. Rather than using say libpcap to capture raw (unframed) IP packets from near the top of an IPoIB stack, this plugin dissects link level Infiniband frames. Infiniband trace files can be read from Endace ERF format trace files, or from libpcap DLT_ERF files containing ERF TYPE_INFINIBAND records. There is currently no native DLT_INFINIBAND in libpcap. Each record contains a hardware timestamp, capture metadata such as port Id, and a complete link level Infiniband frame starting from the Local Route Header. svn path=/trunk/; revision=24628
2008-02-07Removed some "statement not reached" warnings.Stig Bjørlykke1-1/+0
svn path=/trunk/; revision=24282
2008-01-10Get rid of extra blank lines at the end of the file.Guy Harris1-2/+0
svn path=/trunk/; revision=24054
2008-01-10Use WTAP_ENCAP_ERF as the file encapsulation, as that's what we'dGuy Harris1-38/+9
otherwise use as the per-packet encapsulation. The close routine does nothing; get rid of it - you don't *need* a close routine (by default, the subtype_close pointer is null, which means that nothing per-file-type is done when the file is closed). Make the code to handle the length fields in the ERF header common, rather than copying it to each group of record types. svn path=/trunk/; revision=24053
2008-01-09From Florent Drouin:Jeff Morriss1-14/+41
fix http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1727 (pppd format file incorrectly detected as being an ERF file) by: The file_seek() call has been replaced by a call to file_read(), so, when the end of the file is reached and the current record is truncated, we have got an error. This solves the problem of bad file format detection. Additionaly, the ERF heuristic has been improved. svn path=/trunk/; revision=24051
2007-11-19Get the number of captured bytes from "rlen" instead of "wlen". This shouldGerald Combs1-41/+41
fix bug #1983. svn path=/trunk/; revision=23500
2007-11-06From Florent Drouin:Anders Broman1-6/+11
Fix bug Some Toshiba format files with LAPD cannot be open http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1711 svn path=/trunk/; revision=23379
2007-11-05Strengthen BER and ERF heuristics to solve:Anders Broman1-0/+8
Fail to load I4B traces http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1972 svn path=/trunk/; revision=23367
2007-10-08From Florent DROUIN:Anders Broman1-513/+334
This is a replacement of the existing decoding of ERF files (Extensible Record Format from Endace). For the decoding of the ERF files, according to the "type of record" given in the ERF header, several decoders can be used. Up to now, the decoder is determined according to an environment variable, or with a kind of heuristic. And, all the treatment is done during the file extraction. The new architecture, will separate the ERF file decoding, and the ERF record decoding. The ERF records will be decoded with a specific dissector. This dissector can be configured with options, to replace the environment variable. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1839 svn path=/trunk/; revision=23092
2007-06-08From Stephen Donnelly of Endace:Guy Harris1-25/+127
The code for reading ERF files has not been significantly updated since 2004. This patch brings it up to date with a number of changes. 1) Increase number of decodable ERF types from 7 to 12. This covers newer DAG card models and firmware updates. 2) Fix timestamp conversion. Was calculating only microsecond precision, now displaying with nanosecond resolution. Hardware precision is 7.5 to 30 ns depending on model. 3) Allow the user to specify HDLC encapsulation as 'chdlc', 'ppp_serial', 'frelay' or 'mtp2'. This is needed because the ERF HDLC capture formats do not include information on what protocol is used at the next level. This is currently done via an environment variable 'ERF_HDLC_ENCAP' and is analagous to the existing 'ERF_ATM_ENCAP' variable. If the user does not specify an HDLC encapsulation it tries to guess, and falls back to MTP2 for backwards compatibility with Florent's existing behaviour. I know environment variables are ugly, suggestions are welcome. 4) When reading HDLC captures as MTP2, use WTAP_ENCAP_MTP2_WITH_PHDR rather than WTAP_ENCAP_MTP2. This allows us to put the 'Multi-Channel ERF' record 'channel number' field into the MTP2 pseudo header > 'link_number' field. This is then displayed in Frame information, and can be filtered on. (Would be nice if it could be made a display column?) Because the ERF record does not specify whether Annex A is used or not, we pass MTP2_ANNEX_A_USED_UNKNOWN and allow the existing user preference to decide. Move the MTP2_ANNEX_A_ definitions into Wiretap, make the annex_a_used field a guint8, and change MTP2_ANNEX_A_USED_UNKNOWN to 2 so it fits in a guint8. (This means that if you can save an ERF MTP2 file as a libpcap file, the pseudo-header will have MTP2_ANNEX_A_USED_UNKNOWN in it.) svn path=/trunk/; revision=22067
2007-02-18From Florent Drouin: support for MTP2 in ERF type 5 (Multi-Channel HDLC) filesJeff Morriss1-2/+14
svn path=/trunk/; revision=20838
2006-11-29Froim Rene Pilz:Anders Broman1-1/+4
This patch consists also the last issues. Additionally it solves: - For the SSCOP frames the AAL5 decoding was not performed due to an earlier patch. This caused that no SSCOP message was properly decoded. - As the detection between a LANE frame and a SSCOP frame is rather hard a switch within the atm dissector is included which enforce SSCOP dissecting over a LANE frame. At the moment I do not see a better solution for that. svn path=/trunk/; revision=20013
2006-11-05change all file offsets from long to gint64 so we can - theoretically - ↵Ulf Lamping1-4/+4
handle files > 2GB correct. Please distclean Win32 builds! svn path=/trunk/; revision=19814
2006-01-07don't claim to be an erf file if it isn't (e.g. if the file_read call fails)Ulf Lamping1-1/+1
I don't know if this is the right way to fix it, but it seems at least better than before svn path=/trunk/; revision=16971
2005-08-26Ethereal now requires 64-bit integer support, so get rid of the tests ofGuy Harris1-19/+1
G_HAVE_GINT64. Get rid of the floating-point stuff in the Etherpeek Classic file reading code, just use 64-bit integers. Fix up the calculation of the nanoseconds portion of the time stamp. svn path=/trunk/; revision=15544
2005-08-25timestamp display precision:Ulf Lamping1-0/+1
- automatic adjustment depending on file format - manual adjustment through menu items save the setting in the recent file svn path=/trunk/; revision=15534
2005-08-24EVERYTHING IN THE BUILDBOT IS GOING TO BE RED!!! Sorry! Ulf Lamping1-5/+5
I've done more than a day to change the timestamp resolution from microseconds to nanoseconds. As I really don't want to loose those changes, I'm going to check in the changes I've done so far. Hopefully someone else will give me a helping hand with the things left ... What's done: I've changed the timestamp resolution from usec to nsec in almost any place in the sources. I've changed parts of the implementation in nstime.s/.h and a lot of places elsewhere. As I don't understand the editcap source (well, I'm maybe just too tired right now), hopefully someone else might be able to fix this soon. Doing all those changes, we get native nanosecond timestamp resolution in Ethereal. After fixing all the remaining issues, I'll take a look how to display this in a convenient way... As I've also changed the wiretap timestamp resolution from usec to nsec we might want to change the wiretap version number... svn path=/trunk/; revision=15520
2005-02-03Give a URL for the ERF specification.Guy Harris1-0/+4
svn path=/trunk/; revision=13252
2004-07-18Set the svn:eol-style property on all text files to "native", so thatGuy Harris1-1/+1
they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-01-25Have the Wiretap open, read, and seek-and-read routines return, inGuy Harris1-11/+18
addition to an error code, an error info string, for WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with "g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed strings returned as the error info string, and change the callers of those routines to, for those errors, put the info string into the printed message or alert box for the error. Add messages for cases where those errors were returned without printing an additional message. Nobody uses the error code from "cf_read()" - "cf_read()" puts up the alert box itself for failures; get rid of the error code, so it just returns a success/failure indication. Rename "file_read_error_message()" to "cf_read_error_message()", as it handles read errors from Wiretap, and have it take an error info string as an argument. (That handles a lot of the work of putting the info string into the error message.) Make some variables in "ascend-grammar.y" static. Check the return value of "erf_read_header()" in "erf_seek_read()". Get rid of an unused #define in "i4btrace.c". svn path=/trunk/; revision=9852
2004-01-05 removed some MSVC warnings (level 3)Ulf Lamping1-3/+3
svn path=/trunk/; revision=9558
2003-12-11prevent MSVC warning:Ulf Lamping1-2/+2
"warning C4761: Gr��enkonflikt im Argument. Konvertierung vorgenommen" -> size conflict in argument, conversion done svn path=/trunk/; revision=9244
2003-10-01Have a pseudo-header for Ethernet packets, giving the size of the FCS -Guy Harris1-7/+11
0 means "there is no FCS in the packet data", 4 means "there is an FCS in the packet data", -1 means "I don't know whether there's an FCS in the packet data, guess based on the packet size". Assume that Ethernet encapsulated inside other protocols has no FCS, by having the "eth" dissector assume that (and not check for an Ethernet pseudo-header). Have "ethertype()" take an argument giving the FCS size; pass 0 when appropriate. Fix up Wiretap routines to set the pseudo-header. This means we no longer use the "generic" seek-and-read routine, so get rid of it. svn path=/trunk/; revision=8574
2003-09-19From Jesper Peterson: add support for AAL5 records in ERF files,Guy Harris1-18/+57
treating them as PDUs with an AAL5 trailer. svn path=/trunk/; revision=8493
2003-08-26From Jesper Peterson:Guy Harris1-4/+7
use WTAP_ENCAP_ATM_PDUS as the default encapsulation for ATM; don't use ULL constants, as not all C compilers that support gint64 support them, and as there's no need to make them ULL constants. svn path=/trunk/; revision=8278
2003-08-26From Jesper Peterson: support for Endace ERF file format.Guy Harris1-0/+412
svn path=/trunk/; revision=8272
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-27 00:20:41 +0000