Age | Commit message (Collapse) | Author | Files | Lines |
|
"etherpeek.c" file format is used by AiroPeek and the "airopeek9.c" file
format is used by EtherPeek.
Instead, use the names that WildPackets apparently uses for those
formats - "classic" and "tagged".
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@43630 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
(COPYING will be updated in next commit)
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@43536 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
DATA chunk: having them in both places is helpful when looking at the
messages but having them separate is helpful when graphing the RTTs.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@43406 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
by Wiretap, to indicate whether certain fields in that structure
actually have data in them.
Use the "time stamp present" flag to omit showing time stamp information
for packets (and "packets") that don't have time stamps; don't bother
working very hard to "fake" a time stamp for data files.
Use the "interface ID present" flag to omit the interface ID for packets
that don't have an interface ID.
We don't use the "captured length, separate from packet length, present"
flag to omit the captured length; that flag might be present but equal
to the packet length, and if you want to know if a packet was cut short
by a snapshot length, comparing the values would be the way to do that.
More work is needed to have wiretap/pcapng.c properly report the flags,
e.g. reporting no time stamp being present for a Simple Packet Block.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@41185 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
form of corruption/bogosity in a file, including in a file header as
well as in records in the file. Change the error message
wtap_strerror() returns for it to reflect that.
Use it for some file header problems for which it wasn't already being
used - WTAP_ERR_UNSUPPORTED shouldn't be used for that, it should only
be used for files that we have no reason to believe are invalid but that
have a version number we don't know about or some other
non-link-layer-encapsulation-type value we don't know about.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@40175 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
same.
Add to wiretap/pcap-common.c a routine to fill in the pseudo-header for
ATM (by looking at the VPI, VCI, and packet data, and guessing) and
Ethernet (setting the FCS length appropriately). Use it for both pcap
and pcap-ng files.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@38840 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
by the gunzipping code. Have it also supply a err_info string, and
report it. Have file_error() supply an err_info string.
Put "the file" - or, for WTAP_ERR_DECOMPRESS, "the compressed file", to
suggest a decompression error - into the rawshark and tshark errors,
along the lines of what other programs print.
Fix a case in the Netscaler code where we weren't fetching the error
code on a read failure.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@36748 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
keeps GCC 4.6.0 from complaining about them and failing to build with
-Werror, and may also squelch some Coverity (and other static analyzer)
complaints.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@36599 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
Don't have variables that point to string constants, just make the
string constants be static const arrays.
strlen(array of unspecified size initialized with a string) ==
sizeof array - 1; the latter can be computed at compile time.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@32020 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
handle files > 2GB correct.
Please distclean Win32 builds!
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@19814 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
G_HAVE_GINT64.
Get rid of the floating-point stuff in the Etherpeek Classic file
reading code, just use 64-bit integers. Fix up the calculation of the
nanoseconds portion of the time stamp.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@15544 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
- automatic adjustment depending on file format
- manual adjustment through menu items
save the setting in the recent file
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@15534 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
I've done more than a day to change the timestamp resolution from microseconds to nanoseconds. As I really don't want to loose those changes, I'm going to check in the changes I've done so far. Hopefully someone else will give me a helping hand with the things left ...
What's done: I've changed the timestamp resolution from usec to nsec in almost any place in the sources. I've changed parts of the implementation in nstime.s/.h and a lot of places elsewhere.
As I don't understand the editcap source (well, I'm maybe just too tired right now), hopefully someone else might be able to fix this soon.
Doing all those changes, we get native nanosecond timestamp resolution in Ethereal. After fixing all the remaining issues, I'll take a look how to display this in a convenient way...
As I've also changed the wiretap timestamp resolution from usec to nsec we might want to change the wiretap version number...
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@15520 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
they have LF at the end of the line on UN*X and CR/LF on Windows;
hopefully this means that if a CR/LF version is checked in on Windows,
the CRs will be stripped so that they show up only when checked out on
Windows, not on UN*X.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@11400 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
rather than requiring individual capture file type handlers to do it
(unless they're doing per-packet encapsulation, in which case we check
to make sure they didn't *leave* it as WTAP_ENCAP_PER_PACKET).
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10290 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
only for versions 5, 6, and 7 of the file format.
Add another comment explaining why this refers to "etherpeek" even
though it's also used for AiroPeek and probably also TokenPeek.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9989 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
it, similar to the Ethernet pseudo-header's "fcs_len" field, and use it
in the 802.11 dissector.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9884 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
addition to an error code, an error info string, for
WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and
WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with
"g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed
strings returned as the error info string, and change the callers of
those routines to, for those errors, put the info string into the
printed message or alert box for the error.
Add messages for cases where those errors were returned without printing
an additional message.
Nobody uses the error code from "cf_read()" - "cf_read()" puts up the
alert box itself for failures; get rid of the error code, so it just
returns a success/failure indication.
Rename "file_read_error_message()" to "cf_read_error_message()", as it
handles read errors from Wiretap, and have it take an error info string
as an argument. (That handles a lot of the work of putting the info
string into the error message.)
Make some variables in "ascend-grammar.y" static.
Check the return value of "erf_read_header()" in "erf_seek_read()".
Get rid of an unused #define in "i4btrace.c".
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9852 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
except that the 0x80 bit is turned on in the file version number field.
Turn that bit off before processing that field.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9342 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
0 means "there is no FCS in the packet data", 4 means "there is an FCS
in the packet data", -1 means "I don't know whether there's an FCS in
the packet data, guess based on the packet size".
Assume that Ethernet encapsulated inside other protocols has no FCS, by
having the "eth" dissector assume that (and not check for an Ethernet
pseudo-header).
Have "ethertype()" take an argument giving the FCS size; pass 0 when
appropriate.
Fix up Wiretap routines to set the pseudo-header. This means we no
longer use the "generic" seek-and-read routine, so get rid of it.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8574 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
is pointless, as it's a 16-bit unsigned quantity. Remove those checks -
but note in a comment that WTAP_MAX_PACKET_SIZE must be at least 65535
(as there might well be link-layer types with packets at least that
large).
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7934 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
winapi_cleanup tool written by Patrik Stridvall for the wine
project.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6115 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
All files:
- Replace types from sys/types.h by those from glib.h
- Replace ntoh family of macros from netinet/in.h and winsock2.h
by g_ntoh family from glib.h
- Remove now unneeded includes of sys/types.h, netinet/in.h and
winsock2.h
wtap.h
Move includes to the top
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5909 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
the internal z_err value for the stream if an "fseek()" call it makes
fails, so that if "gzerror()" is subsequently called, it returns Z_OK
rather than an error.
To work around this, we pass "file_seek()" an "int *err", and have the
with-zlib version of "file_seek()" check, if "gzseek()" fails, whether
the return value of "file_error()" is 0 and, if so, have it return
"errno" instead.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5642 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
the "read" routine, which means it's already had any end-of-frame
padding/FCS removed; we don't need to remove it in the "seek_read"
routine.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5124 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
having a special encapsulation type for AiroPeek files.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5123 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
non-existent functions.
Remove the "filetype" argument from the "can_write_encap" functions for
particular capture file types - the argument value is implicit, in that
the routine being called is the routine for that particular file type.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4823 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
support revealed that I'd left it out; putting it back made it work.)
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4740 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
reading the capture file. Have callers of "wtap_snapshot_length()"
treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so
that, when writing a capture file in a format that *does* store the
snapshot length, we can at least put *something* in the file).
If we don't know the snapshot length of the current capture file, don't
display a value in the summary window.
Don't use "cfile.snap" as the snapshot length option when capturing -
doing so causes Ethereal to default, when capturing, to the snapshot
length of the last capture file that you read in, rather than to the
snapshot length of the last capture you did (or the initial default of
"no snapshot length").
Redo the "Capture Options" dialog box to group options into sections
with frames around them, and add units to the snapshot length, maximum
file size, and capture duration options, as per a suggestion by Ulf
Lamping. Also add units to the capture count option.
Make the snapshot length, capture count, maximum file size, and capture
duration options into a combination of a check box and a spin button.
If the check box is not checked, the limit in question is inactive
(snapshot length of 65535, no max packet count, no max file size, no max
capture duration); if it's checked, the spinbox specifies the limit.
Default all of the check boxes to "not checked" and all of the spin
boxes to small values.
Use "gtk_toggle_button_get_active()" rather than directly fetching the
state of a check box.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4709 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4619 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
that EtherPeek for Windows uses the same format as EtherPeek for MacOS,
so the code isn't specific to the MacOS version.
Check the physMedium value in the secondary header, and leave a
placeholder for a value of 1, which is presumably used in AiroPeek
captures.
Treat unknown mediaType and physMedium values as indications that we
don't have a *Peek file, not as unsupported *Peek files - we need all
the heuristics we can get.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4601 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
the V7-format read routine.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4597 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4593 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
of the capture, so change some names and comments.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4563 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4562 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
data structure attached to the "wtap" structure, rather than in a
pseudo-header structure; get rid of the EtherPeek pseudo-header
structure, as it's not actually used as a pseudo-header, it's just used
as private data for the EtherPeek reader.
Get rid of an extra level of indentation in switch statements.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4561 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
files would put a 32-bit quantity on a 16-bit boundary without padding;
this means that many compilers will insert the padding and thus make the
structure not match what's in the file.
Instead of using a C structure, #define values for the offsets of
fields, read the header into an array of bytes, and extract values using
the offsets.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4334 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4199 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
can handle capture files bigger than 2GB.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3993 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
* gcc 3.0 warning fixes:
- text2pcap.c: The number of characters to scan should probably not be 0
- wiretap/csids.c: using preincrement on a variable used on both
sides of an assignment might be undefined by the C99(?) standard
* turn on additional warnings for epan and wiretap too
- epan/configure.in
- wiretap/configure.in
* Fix some warnings (missing includes, signed/unsigned, missing
initializers) found by turning on the warnings
- all other files :-)
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3709 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
beginning of the file before reading anything from the file is bogus -
do that in the loop that tries each of the open routines, instead.
(They may have to reset the seek pointer later if, for example, the
capture file begins with the first packet, and the "open()" routine
looks at that packet to try to guess whether the packet is in the file
format in question.)
Set "wth->data_offset" to 0 while you're at it, so capture file readers
don't have to do that, either.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3123 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
which declares routines we neither define nor use.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3121 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3066 f5534014-38df-0310-8fa8-9805f1628bb7
|