aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/libpcap.c
AgeCommit message (Collapse)AuthorFilesLines
2002-03-09Sigh. Tcpdump cannot handle capture files with a snapshot length of 0,Guy Harris1-2/+14
as BPF filters return either 0 if they fail or the snapshot length if they succeed, and a snapshot length of 0 means success is indistinguishable from failure and the filter expression would reject all packets. Now that a snapshot length of 0, inside Ethereal, means "snapshot length unknown", we have to, when opening a libpcap file for output, make the snapshot length some non-zero value. We make it WTAP_MAX_PACKET_SIZE, in case some program uses the snapshot length as a buffer size. (That doesn't help if there are packets with more than 65535 bytes of data; if there are, we'd need to raise WTAP_MAX_PACKET_SIZE just to make those files readable in Ethereal in any case.) svn path=/trunk/; revision=4905
2002-03-07Fix a comment.Guy Harris1-3/+3
svn path=/trunk/; revision=4899
2002-03-07Fix a typo - IFT_ISO88025 is 9, not 8.Guy Harris1-2/+2
svn path=/trunk/; revision=4898
2002-03-04Check for errors in seeks, "tell"s, and "stat()"s/"fstat()"s.Guy Harris1-9/+38
For file types where we allocate private data, add "close" routines where they were missing, to free the private data. Also fix up the code to clean up after some errors by freeing private data where that wasn't being done. Get rid of unused arguments to "wtap_dump_open_finish()". Fix indentation. svn path=/trunk/; revision=4857
2002-03-02From Joerg Mayer: get rid of "-Wno-unused" flag in some configureGuy Harris1-3/+5
scripts, and check in changes to add _U_ to some unused arguments (some other should perhaps be used, so we leave the _U_ out so that the warnings serve as a reminder to check those). svn path=/trunk/; revision=4847
2002-02-27From Joerg Mayer: remove unused variables and declarations ofGuy Harris1-3/+3
non-existent functions. Remove the "filetype" argument from the "can_write_encap" functions for particular capture file types - the argument value is implicit, in that the routine being called is the routine for that particular file type. svn path=/trunk/; revision=4823
2002-02-07Support in Wiretap for DLT_HHDLC, from Tomas Kukosa.Guy Harris1-1/+2
svn path=/trunk/; revision=4707
2002-01-29Support a libpcap link-layer type of 17 as DLT_PFLOG unless DLT_LANE8023Guy Harris1-3/+4
is defined as 17. svn path=/trunk/; revision=4617
2002-01-29Support for capturing on, and reading captures from, OpenBSD firewallGuy Harris1-1/+13
logging virtual interface, from Mike Frantzen. svn path=/trunk/; revision=4616
2001-12-04Support for stopping capture at specified capture file size or captureGuy Harris1-1/+5
duration, from Thomas Wittwer and Matthias Nyffenegger. svn path=/trunk/; revision=4322
2001-11-30Add support for LocalTalk Link Access Protocol.Guy Harris1-2/+4
Rename WTAP_ENCAP_PRISM to WTAP_ENCAP_PRISM_HEADER, to match DLT_PRISM_HEADER. Add in missing capture support for WTAP_ENCAP_PRISM_HEADER when capturing with "pcap_open_live()" rather than reading the capture from a pipe. svn path=/trunk/; revision=4299
2001-11-28Support for 802.11+Prism II monitor-mode link-layer headers, fromGuy Harris1-2/+3
Tim Newsham. Add in missing item for WTAP_ENCAP_CISCO_IOS in the Wiretap encapsulation type table. svn path=/trunk/; revision=4290
2001-11-14Back the previous hack out - the padding is often zero, but it's notGuy Harris1-68/+3
*always* zero, so it won't always work, and it's somewhat gross. The right answer is "don't use Digital/Tru64 UNIX's tcpdump, use tcpdump.org's". svn path=/trunk/; revision=4202
2001-11-14Throw in a hack to try to detect FDDI captures from Digital UNIX'sGuy Harris1-3/+68
tcpdump and, if we think we've found one, strip off the 3 padding bytes they put in front of the frame. svn path=/trunk/; revision=4201
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4199
2001-11-09Wrap calls to "pcap_datalink()" in a routine that attempts to compensateGuy Harris1-7/+8
for AIX 5.x's non-standard libpcap, where "pcap_datalink()" doesn't return DLT_ values, it returns RFC 1573 ifType values. Put that wrapper, and the routine to get the interface list, in a separate file, for packet-capture utility routines, so not everybody who includes "util.h" needs to include <pcap.h>. Fix up the Wiretap hack for dealing with said incompatibility to use the correct ifType value for Token Ring. svn path=/trunk/; revision=4184
2001-11-07Expand on the comments about AIX libpcap.Guy Harris1-6/+10
No, Nokia *weren't* kind enough to change the major or minor version number in the capture file when they changed the format, just as they weren't kind enough to change the magic number. svn path=/trunk/; revision=4173
2001-11-06Add in some heuristics to try to detect AIX libpcap format. (This worksGuy Harris1-2/+63
with one capture I've seen, but perhaps that was done with an old version of AIX, and newer versions use a minor version number, in the file, of 4. However, libpcap hasn't used a minor version of 2 for ages, so perhaps AIX hasn't updated their libpcap in ages, and aren't about to do so soon. If they do, let's hope they change the magic number. The capture file in question *does* have the capture length and real length in the old, pre-2.3, order, so it really looks as if it's an old version, rather than IBM trying to be "helpful" by using a different minor version number so that you can distinguish between normal libpcap and AIX libpcap formats.) svn path=/trunk/; revision=4164
2001-11-02Support DLT_CISCO_IOS.Gilbert Ramirez1-1/+3
svn path=/trunk/; revision=4126
2001-10-25Get rid of signed/unsigned comparison warnings in wiretap.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4077
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris1-3/+3
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
2001-08-25The return value from "fwrite()" is a "size_t"; make the variable intoGuy Harris1-8/+8
which we store it a "size_t", and then fix up the bugs that were revealed by the compiler warnings that produced - "fwrite()" returns 0, not a negative number, on an I/O error. Fix up some other items to have type "size_t", or to have various unsigned types, while we're at it, to squelch compiler warnings. svn path=/trunk/; revision=3867
2001-07-13From Joerg Mayer:Guy Harris1-3/+3
* gcc 3.0 warning fixes: - text2pcap.c: The number of characters to scan should probably not be 0 - wiretap/csids.c: using preincrement on a variable used on both sides of an assignment might be undefined by the C99(?) standard * turn on additional warnings for epan and wiretap too - epan/configure.in - wiretap/configure.in * Fix some warnings (missing includes, signed/unsigned, missing initializers) found by turning on the warnings - all other files :-) svn path=/trunk/; revision=3709
2001-03-15Add a new Wiretap encapsulation type for Cisco HDLC. Map the NetBSDGuy Harris1-8/+14
DLT_HDLC to it. Make a separate dissector for Cisco HDLC, and add a dissector for Cisco SLARP. Have the PPP dissector call the Cisco HDLC dissector if the address field is the Cisco HDLC unicast or multicast address. Use the Cisco HDLC dissector for the Cisco HDLC Wiretap encapsulation type. Add a new dissector table "chdlctype", for Cisco HDLC packet types (they're *almost* the same as Ethernet types, but 0x8035 is SLARP, not Reverse ARP, and 0x2000 is the Cisco Discovery protocol, for example), replacing "fr.chdlc". Have a "chdlctype()" routine, similar to "ethertype()", used both by the Cisco HDLC and Frame Relay dissectors. Have a "chdlc_vals[]" "value_string" table for Cisco HDLC types and protocol names. Split the packet type field in the Frame Relay dissector into separate SNAP and Cisco HDLC fields, and give them the Ethernet type and Cisco HDLC type "value_string" tables, respectively. svn path=/trunk/; revision=3133
2001-03-11Handle NetBSD Cisco HDLC as PPP, for now.Guy Harris1-5/+18
svn path=/trunk/; revision=3125
2001-03-10Obliging every capture file reader's "open()" routine to seek to theGuy Harris1-3/+1
beginning of the file before reading anything from the file is bogus - do that in the loop that tries each of the open routines, instead. (They may have to reset the seek pointer later if, for example, the capture file begins with the first packet, and the "open()" routine looks at that packet to try to guess whether the packet is in the file format in question.) Set "wth->data_offset" to 0 while you're at it, so capture file readers don't have to do that, either. svn path=/trunk/; revision=3123
2000-12-23Add support for the DLT_LINUX_SLL capture type in the current CVSGuy Harris1-1/+7
version of libpcap; that's used on Linux for captures on the "any" device (which captures from all interfaces simultaneously) and for captures on devices whose link-layer type libpcap doesn't (yet) support natively. The spanning tree code, when checking for GV{M,R,...}P packets, must first check whether the link-layer destination address is, in fact, an Ethernet-style address; on Linux cooked captures, there *is* no destination address, so it's of type AT_NONE, not AT_ETHER. svn path=/trunk/; revision=2772
2000-11-15IEEE 802.11 support, from Johan Jorgensen of Axis Communications AB.Guy Harris1-2/+37
Add in stuff for a bunch of libpcap formats either in libpcap 0.5.2 or in the current CVS version; we don't implement all of them in Ethereal/Wiretap (those are "#if 0"ed out), but we do implement the IEEE 802.11 stuff (which isn't yet in libpcap or tcpdump, but the CVS version of libpcap *does* reserve 105 as the encapsulation type number for 802.11). svn path=/trunk/; revision=2646
2000-09-21Make sure to pass the sent/received direction from pppdump.c inGilbert Ramirez1-2/+2
pseudo_header. Use generic "p2p_phdr" instead of "lapd_phdr". Modify toshiba.c and packet-lapd.c to take that into account. Add frame.p2p_dir, a filterable field, 0=sent, 1=recvd Make p2p_dir available in packe_info, as I think it will be needed in VJ COMP and UNCOMP dissection. Rename WTAP_ENCAP_TR to WTAP_ENCAP_TOKEN_RING. Mention pppd-log support in man page. Mention atmsnoop in README. svn path=/trunk/; revision=2455
2000-09-17Close the handle for the SNMP library after we're done with it - sharedGuy Harris1-7/+11
objects are reference-counted so that won't make it disappear if Ethereal is also linked with it as a shared SNMP library. svn path=/trunk/; revision=2444
2000-09-15Code to read capture files from some version of tcpdump from some sortGuy Harris1-87/+282
of Nokia box (firewall) - yep, it's yet *another* mutant libpcap format that didn't change the magic number, sigh.... svn path=/trunk/; revision=2440
2000-09-12Add support for NetBSD DLT_PPP_SERIAL, which has the value 50, and whichGuy Harris1-1/+55
is, for now, handled as WTAP_ENCAP_PPP (although we may have to split WTAP_ENCAP_PPP into more than one type at some point). svn path=/trunk/; revision=2423
2000-09-07Change wtap_read() API so that the data offset is set via a pointer, andGilbert Ramirez1-13/+9
a "keep reading" boolean value is returned from the function. This avoids having to hack around the fact that some file formats truly do have records that start at offset 0. (i4btrace and csids have no file header. Neither does the pppdump-style file that I'm looking at right now). svn path=/trunk/; revision=2392
2000-08-25Redo the way we map between libpcap encapsulation type codes and WiretapGuy Harris1-87/+221
encapsulation type codes - for those libpcap type codes whose numerical value is interpreted differently by different versions of libpcap, include <pcap.h> if you can and, if you can, use what it defines to control which Wiretap code we map those type codes to. Also, map the new libpcap type codes introduced by libpcap 0.5. svn path=/trunk/; revision=2369
2000-07-30Support for capturing packet data from a pipe (a FIFO, or standard input).Olivier Abad1-63/+1
capture.c : - modified capture() to try to open an interface as a pipe if pcap_open_live() failed, and then read data in libpcap format from this pipe ; - add new functions used by capture() : pipe_open_live() and pipe_dispatch() which are equivalents to the pcap_ functions. libpcap.[ch] : - moved the MAGIC and headers definitions from libpcap.c to libpcap.h because capture() now needs it. svn path=/trunk/; revision=2181
2000-07-26In the final scene of the horror movie, just when you think the monsterGuy Harris1-103/+153
is finally dead, and you're walking away, it springs up again and attacks. It appears that the ss990915 version of Alexey Kuznetzov's libpcap patch has some extra stuff in the per-packet header for some sort of SMP debugging, and that SuSE Linux 6.3 picked it up. Thus, even if a libpcap file has the modified magic number, we *still* have to go through the usual heuristic hell to figure out what type of file it is. svn path=/trunk/; revision=2164
2000-05-19Add wtap-int.h. Move definitions relevant to the internal workins of wiretapGilbert Ramirez1-4/+4
to that file, leave public definitions in wtap.h. Rename "union pseudo_header" to "union wtap_pseudo_header". Make the wtap_pseudo_header pointer available in packet_info struct. svn path=/trunk/; revision=1989
2000-05-18Remove the "union pseudo_header" from the "frame_data" structure;Guy Harris1-3/+4
there's no need to keep it around in memory - when the frame data is read in when handing a frame, read in the information, if any, necessary to reconstruct the frame header, and reconstruct it. This saves some memory. This requires that the seek-and-read function be implemented inside Wiretap, and that the Wiretap handle remain open even after we've finished reading the file sequentially. This also points out that we can't really do X.25-over-Ethernet correctly, as we don't know where the direction (DTE->DCE or DCE->DTE) flag is stored; it's not clear how the Ethernet type 0x0805 for X.25 Layer 3 is supposed to be handled in any case. We eliminate X.25-over-Ethernet support (until we find out what we're supposed to do). svn path=/trunk/; revision=1975
2000-03-22In a Network Monitor capture file, get the starting offsets of framesGuy Harris1-1/+9
from the frame table - Network Monitor 2.x, at least, doesn't always write frame N+1 right after frame N. To do that, we need to mallocate a big array to hold the frame table, and free it when we close the capture file; this requires that we have capture-file-type-specific close routines as well as capture-file-type-specific read routines - we let it the pointer to that routine be null if it's not needed. Given that, we might as well get rid of the switch statement in "wtap_close()", in favor of using capture-file-type-specific close routines, as per the comment before that switch statement. svn path=/trunk/; revision=1740
2000-02-19Use WTAP_ERR_UNSUPPORTED_ENCAP for all attempts to open or read aGuy Harris1-2/+2
capture file for an unsupported link-layer encapsulation type (as the nettl reader does), and report it correctly if it occurs on an open or read attempt rather than a save attempt. svn path=/trunk/; revision=1647
2000-01-22Fix files that had Gilbert's old e-mail address or that didn't have myGuy Harris1-2/+2
forwarding e-mail address. svn path=/trunk/; revision=1522
2000-01-13We are obliged to define HAVE_UNISTD_H in "config.h"; to avoid theGuy Harris1-2/+2
hideous problem on FreeBSD 3.[23] (and perhaps other BSDs) if HAVE_UNISTD_H is defined before "zlib.h" is included, turn "file_seek()" into a subroutine defined in a file that *undefines* HAVE_UNISTD_H before including "zlib.h", so that the *only* call to "gzseek()" is made from a file that does not have HAVE_UNISTD_H defined when it includes "zlib.h". Move "file_error()" to that file while you're at it, so it holds all the wrappers that hide the presence or absence of zlib from routines to read capture files. Turn "file.h", which declared those wrapper functions as well as wrapper macros, into "file_wrapper.h" - it belongs with the "file_wrapper.c" file that defines the wrapper functions, not with "file.c" which handles higher-layer file access functions. Remove the comment in "configure.in" that explained why defining HAVE_UNISTD_H was a bad idea, as we're not obliged to define it and work around the problem. (The comment in "file_wrapper.c" explains the workaround.) svn path=/trunk/; revision=1463
2000-01-09Add to some comments notes on the meaning of DLT types 15 and 16 onGuy Harris1-3/+15
Linux systems with the isdn4linux patches; they help make DLT types even less useful than they were after the various flavors of BSD proceeded to add their own types past 14, with no coordination whatosever, so that they overlapped, rendering it impossible to read a libpcap capture file without knowing what particular OS generated it. svn path=/trunk/; revision=1442
1999-12-15Handle i4btrace captures if they're from a machine with the oppositeGuy Harris1-11/+1
byte order from the machine that's reading them. svn path=/trunk/; revision=1338
1999-12-11Provide different file types for "modified" and Red Hat 6.1 "libpcap"Guy Harris1-12/+71
files (the former have a different per-packet header, and a different magic number, from the standard "libpcap"; the latter have the same per-packet header as "modified" "libpcap" files, but the same magic number as standard "libpcap" files, sigh). Support writing "libpcap" captures in all three formats (so that, for example, people running Ethereal on RH 6.1 can write out captures that the "tcpdump" that comes with RH 6.1 can read, although that's not the default format we save in - there's no way to tell whether you're running on RH 6.1, as far as I know; "uname()" just tells you, on Linux systems, that the kernel is Linux 2.x, and what "x" is, it doesn't say what the *rest* of the system is). Fix the table in "file.c" to use Olivier's code for writing Sniffer files. svn path=/trunk/; revision=1288
1999-12-04Fix some names.Guy Harris1-2/+2
svn path=/trunk/; revision=1203
1999-12-04Add some infrastructure for the use of Ethereal, so it can make a listGuy Harris1-40/+34
of all the file types in which a file can be saved. Giving each dumpable file type a routine that checks whether a file of a given file type and encapsulation can be written lets us hoist some checks into common code from out of the open routines. If the "dump close" routine for a dump stream is NULL, have that mean that there's no action that needs to be taken on a close by the code to handle that file type; some file types don't need that, as they can be written purely sequentially. svn path=/trunk/; revision=1200
1999-12-04Add support to Wiretap for writing Network Monitor 1.x-format captureGuy Harris1-18/+18
files. Make the return type of a number of routines that return 1 (for "true") on success and 0 (for "false") on failure to "gboolean", and make the 1's and 0's TRUEs and FALSEs. svn path=/trunk/; revision=1194
1999-11-06Add in a gross heuristic that attempts to detect files with the versionGuy Harris1-44/+151
of the "libpcap" patch that changes the per-packet header but not the magic number - it seems to work on at least one capture file I tried it on. Give the modified "libpcap" format a WTAP_FILE type of its own (so that, in the future, we could support writing captures out in that format, possibly). svn path=/trunk/; revision=987
1999-11-06Add support for capture files written by programs linked with AlexeyGuy Harris1-27/+75
Kuznetsov's modified "libpcap" *as long as you have the ss990915 or later patch*; the 990417 patch, alas, changes the per-packet header but *doesn't* change the magic number, so you can't just look at the magic number to see that it's Not Standard Libpcap. (Even more unfortunately, Red Hat appears to have picked up *that* patch for Red Hat 6.1; I've filed bug 6773 with Bugzilla on their site - hopefully, if I'm not misremembering the RH 6.1 code I've seen, and they really *did* pick up the older patch, they'll fix it ASAP to use the new magic number, and will make updates available.) svn path=/trunk/; revision=986
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-24 10:08:51 +0000