aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/netmon.c
AgeCommit message (Collapse)AuthorFilesLines
2010-07-23At least in some NetMon 3.4 VPN captures, the per-packet link-layer typeGuy Harris1-1/+7
is 0, but the packets have Ethernet headers. We handle this by mapping 0 to WTAP_ENCAP_ETHERNET. (XXX - should we, instead, use the per-file link-layer type?) svn path=/trunk/; revision=33620
2010-07-21The 32-bit unsigned time offset in version 1.x files should be convertedGuy Harris1-1/+5
to a gint64 (which won't sign-extend it) before multiplying by 1000, so that the product is 64-bit and won't overflow. svn path=/trunk/; revision=33609
2010-07-21According to mail from Paul Long at Microsoft, in the 1.x NetMon fileGuy Harris1-1/+7
format, the time offset from the start of the capture always had a positive value, so it's an unsigned value. (In newer versions of NetMon 3.x, the capture can start before the "capture start" time stamp is set, so packets can have a *negative* offset from the capture start time stamp. Those captures are in the 2.x file format.) svn path=/trunk/; revision=33607
2010-07-19Initial support for Network Monitor 802.11 radio header.Guy Harris1-1/+2
svn path=/trunk/; revision=33583
2010-07-18The time delta in a NetMon frame header is signed - it can be negative.Guy Harris1-3/+5
svn path=/trunk/; revision=33576
2010-07-18NetMon per-packet link-layer types with 0xE000 in the upper 4 bits areGuy Harris1-8/+37
converted pcap files; the LINKTYPE_ value is in the lower 12 bits. svn path=/trunk/; revision=33574
2010-07-18Initial support for the trailer information in versions 2.1 and later ofGuy Harris1-19/+135
the NetMon file format. Currently, we just use the network type field, and we ignore all the special record types and don't try to handle any of the other special network types. We also catch bogus frame tables where the record is bigger than the frame table says it is. svn path=/trunk/; revision=33572
2010-06-06Don't use fwrite directly when writing a dump file; call it throughGuy Harris1-50/+6
wtap_dump_file_write(). Replace various wrappers around fwrite() with wtap_dump_file_write(), or at least make the wrappers call wtap_dump_file_write(). svn path=/trunk/; revision=33116
2010-02-26Move the definitions of all the private data structures out ofGuy Harris1-36/+49
wtap-int.h, and change the unions of pointers to those private data structures into just void *'s. Have the generic wtap close routine free up the private data, rather than the type-specific close routine, just as the wtap_dumper close routine does for its private data. Get rid of close routines that don't do anything any more. svn path=/trunk/; revision=32015
2009-12-09When reading NetMon capture files version 2.1 and higher (the latest is 2.2 ↵Stephen Fisher1-1/+10
right now), the capture file's header encapsulation type is set to 1 for Ethernet for backwards compability only. These files use per-packet encapsulation types instead. For now, set it to Unknown file encapsulation until we can find a way to set it to WTAP_ENCAP_PER_PACKET without having to assert in wtap_read() so the user can see that it is a per-packet encapulation in places such as the capinfos program. svn path=/trunk/; revision=31213
2009-06-02No newlines in the additional-error-information string, please.Guy Harris1-1/+1
svn path=/trunk/; revision=28584
2009-04-22Clean up some 64-bit issues.Guy Harris1-3/+3
svn path=/trunk/; revision=28117
2009-03-09P64 fixes.Gerald Combs1-1/+1
svn path=/trunk/; revision=27683
2007-06-05Note the version numbers in NetMon 3.0 files.Guy Harris1-2/+5
svn path=/trunk/; revision=22050
2006-11-05change all file offsets from long to gint64 so we can - theoretically - ↵Ulf Lamping1-4/+4
handle files > 2GB correct. Please distclean Win32 builds! svn path=/trunk/; revision=19814
2005-08-25timestamp display precision:Ulf Lamping1-0/+1
- automatic adjustment depending on file format - manual adjustment through menu items save the setting in the recent file svn path=/trunk/; revision=15534
2005-08-24EVERYTHING IN THE BUILDBOT IS GOING TO BE RED!!! Sorry! Ulf Lamping1-8/+8
I've done more than a day to change the timestamp resolution from microseconds to nanoseconds. As I really don't want to loose those changes, I'm going to check in the changes I've done so far. Hopefully someone else will give me a helping hand with the things left ... What's done: I've changed the timestamp resolution from usec to nsec in almost any place in the sources. I've changed parts of the implementation in nstime.s/.h and a lot of places elsewhere. As I don't understand the editcap source (well, I'm maybe just too tired right now), hopefully someone else might be able to fix this soon. Doing all those changes, we get native nanosecond timestamp resolution in Ethereal. After fixing all the remaining issues, I'll take a look how to display this in a convenient way... As I've also changed the wiretap timestamp resolution from usec to nsec we might want to change the wiretap version number... svn path=/trunk/; revision=15520
2005-06-04Fix some more leaks in error returns from open routines (if the open canGuy Harris1-0/+3
fail after the private data is allocated, you have to free the private data). The file header in nettl files is 128 bytes - use a #define for it, and also a #define for the magic number size. svn path=/trunk/; revision=14553
2005-05-30From Steve Grubb: Fix a memory leak. Fixes part of bug 217.Gerald Combs1-0/+1
svn path=/trunk/; revision=14500
2004-07-18Set the svn:eol-style property on all text files to "native", so thatGuy Harris1-1/+1
they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-03-03Have "wtap_read()" set "wth->phdr.pkt_encap" to "wth->file_encap",Guy Harris1-2/+1
rather than requiring individual capture file type handlers to do it (unless they're doing per-packet encapsulation, in which case we check to make sure they didn't *leave* it as WTAP_ENCAP_PER_PACKET). svn path=/trunk/; revision=10290
2004-01-25Have the Wiretap open, read, and seek-and-read routines return, inGuy Harris1-17/+21
addition to an error code, an error info string, for WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with "g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed strings returned as the error info string, and change the callers of those routines to, for those errors, put the info string into the printed message or alert box for the error. Add messages for cases where those errors were returned without printing an additional message. Nobody uses the error code from "cf_read()" - "cf_read()" puts up the alert box itself for failures; get rid of the error code, so it just returns a success/failure indication. Rename "file_read_error_message()" to "cf_read_error_message()", as it handles read errors from Wiretap, and have it take an error info string as an argument. (That handles a lot of the work of putting the info string into the error message.) Make some variables in "ascend-grammar.y" static. Check the return value of "erf_read_header()" in "erf_seek_read()". Get rid of an unused #define in "i4btrace.c". svn path=/trunk/; revision=9852
2003-12-23removed some MSVC warnings (conversions between double/float and int)Ulf Lamping1-3/+3
svn path=/trunk/; revision=9422
2003-11-06From Scott Emberley: support for writing Network Instruments ObserverGuy Harris1-4/+4
files. svn path=/trunk/; revision=8900
2003-10-01Have a pseudo-header for Ethernet packets, giving the size of the FCS -Guy Harris1-3/+23
0 means "there is no FCS in the packet data", 4 means "there is an FCS in the packet data", -1 means "I don't know whether there's an FCS in the packet data, guess based on the packet size". Assume that Ethernet encapsulated inside other protocols has no FCS, by having the "eth" dissector assume that (and not check for an Ethernet pseudo-header). Have "ethertype()" take an argument giving the FCS size; pass 0 when appropriate. Fix up Wiretap routines to set the pseudo-header. This means we no longer use the "generic" seek-and-read routine, so get rid of it. svn path=/trunk/; revision=8574
2003-01-10The Sniffer file formats include a file to identify raw cells; exportGuy Harris1-1/+2
that flag in the ATM pseudo-header, and use it to determine whether a frame is a raw cell or a reassembled frame, rather than using the AAL, as you can have raw AAL5 cells in a capture. svn path=/trunk/; revision=6889
2003-01-06Cast "secs" to "double" before multiplying by 1000000, so that we don'tGuy Harris1-2/+2
get an overflow if secs*1000000 doesn't fit in 31 bits. svn path=/trunk/; revision=6858
2003-01-03Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not justGuy Harris1-9/+9
used for the DOS-based ATM Sniffer. (That's not a great name, but I couldn't think of a better one.) Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture files where reassembled frames don't have trailers, such as the AAL5 trailer, chopped off. That's what at least some versions of the Windows-based ATM Sniffer appear to have. Map the ATM capture file type for NetXRay captures to WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've reverse-engineered, so far, for the pseudo-header; there's more that needs to be done on it, e.g. getting the channel, AAL type, and traffic type (or inferring them if they're not in the packet header). svn path=/trunk/; revision=6840
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-5/+5
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6115
2002-08-13Get rid of the "vpi" and "vci" arguments to "atm_guess_traffic_type()",Guy Harris1-5/+8
have it get that information from the pseudo-header instead, and set the VPI and VCI fields in the pseudo-header before calling it. Don't call it for non-ATM NetMon captures. svn path=/trunk/; revision=5982
2002-08-13Use "atm_guess_traffic_type()" to guess the ATM traffic type for ATMGuy Harris1-15/+23
NetMon captures. svn path=/trunk/; revision=5981
2002-07-29From Joerg Mayer:Guy Harris1-15/+11
All files: - Replace types from sys/types.h by those from glib.h - Replace ntoh family of macros from netinet/in.h and winsock2.h by g_ntoh family from glib.h - Remove now unneeded includes of sys/types.h, netinet/in.h and winsock2.h wtap.h Move includes to the top svn path=/trunk/; revision=5909
2002-07-16From Graeme Hewson:Guy Harris1-3/+10
Allow "-" as the output file name in Wiretap, referring to the standard error. Optimize the capture loop. Fix some of the error-message printing code in Ethereal and Tethereal. Have Wiretap check whether it can seek on a file descriptor, and pass the results of that test to the file-type-specific "open for output" routine. Have the "open for output" routines for files where we need to seek when writing the file return an error if seeks don't work. svn path=/trunk/; revision=5884
2002-06-07Graeme Hewson noted that zlib has a bug wherein "gzseek()" doesn't setGuy Harris1-9/+4
the internal z_err value for the stream if an "fseek()" call it makes fails, so that if "gzerror()" is subsequently called, it returns Z_OK rather than an error. To work around this, we pass "file_seek()" an "int *err", and have the with-zlib version of "file_seek()" check, if "gzseek()" fails, whether the return value of "file_error()" is 0 and, if so, have it return "errno" instead. svn path=/trunk/; revision=5642
2002-06-04The frame table isn't needed once we've made a sequential pass throughGuy Harris1-3/+17
the packets, as the offsets of the frames have been saved by our caller (because they need them to pass to the random-read routine); add a sequential_close routine for Netmon files and free up the frame table in that routine. svn path=/trunk/; revision=5618
2002-05-04Fix capture-file-specific "close output" routines to check whether theGuy Harris1-32/+39
"err" argument is null and return an error code through that argument only if it isn't, to match what "wtap_dump_close()", which calls those routines, does. Put the NetXRay dump routines in order by version number. svn path=/trunk/; revision=5385
2002-04-30Uniformly use "sizeof (struct netmon_atm_hdr)" for the size of NetworkGuy Harris1-3/+3
Monitor's ATM pseudo-header. Fix a message. svn path=/trunk/; revision=5303
2002-04-30Replace the "ngsniffer_atm" with an "atm" pseudo-header, which isn'tGuy Harris1-15/+24
just an image of the ATM Sniffer data. This means that Ethereal doesn't have to know any ATM Sniffer-specific details (that's all hidden in Wiretap), and allows us to add to that pseudo-header fields, traffic types, etc. unknown to ATM Sniffers. Have Wiretap map VPI 0/VCI 5 to the signalling AAL - for some capture files, this might not be necessary, as they may mark all signalling traffic as such, but, on other platforms, we don't know the AAL, so we assume AAL5 except for 0/5 traffic. Doing it in Wiretap lets us hide those details from Ethereal (and lets Ethereal interpret 0/5 traffic as non-signalling traffic, in case that happens to be what it is). We may know that traffic is LANE, but not whether it's LE Control or emulated 802.3/802.5; handle that case. svn path=/trunk/; revision=5302
2002-03-05Make "wtap_seek_read()" return TRUE on success and FALSE on error, likeGuy Harris1-22/+20
"wtap_read()". Add some additional error checks to the Sniffer file reader. svn path=/trunk/; revision=4875
2002-03-05Have "wtap_seek_read()" return 0 on success and -1 on failure, and takeGuy Harris1-7/+9
an "err" argument that points to an "int" into which to put an error code if it fails. Check for errors in one call to it, and note that we should do so in other places. In the "wtap_seek_read()" call in the TCP graphing code, don't overwrite "cfile.pseudo_header", and make the buffer into which we read the data WTAP_MAX_PACKET_SIZE bytes, as it should be. In some of the file readers for text files, check for errors from the "parse the record header" and "parse the hex dump" routines when reading sequentially. In "csids_seek_read()", fix some calls to "file_error()" to check the error on the random stream (that being what we're reading). svn path=/trunk/; revision=4874
2002-03-04Check for errors in seeks, "tell"s, and "stat()"s/"fstat()"s.Guy Harris1-4/+14
For file types where we allocate private data, add "close" routines where they were missing, to free the private data. Also fix up the code to clean up after some errors by freeing private data where that wasn't being done. Get rid of unused arguments to "wtap_dump_open_finish()". Fix indentation. svn path=/trunk/; revision=4857
2002-02-27From Joerg Mayer: remove unused variables and declarations ofGuy Harris1-3/+3
non-existent functions. Remove the "filetype" argument from the "can_write_encap" functions for particular capture file types - the argument value is implicit, in that the routine being called is the routine for that particular file type. svn path=/trunk/; revision=4823
2002-02-08Have Wiretap set the snapshot length to 0 if it can't be derived fromGuy Harris1-2/+2
reading the capture file. Have callers of "wtap_snapshot_length()" treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so that, when writing a capture file in a format that *does* store the snapshot length, we can at least put *something* in the file). If we don't know the snapshot length of the current capture file, don't display a value in the summary window. Don't use "cfile.snap" as the snapshot length option when capturing - doing so causes Ethereal to default, when capturing, to the snapshot length of the last capture file that you read in, rather than to the snapshot length of the last capture you did (or the initial default of "no snapshot length"). Redo the "Capture Options" dialog box to group options into sections with frames around them, and add units to the snapshot length, maximum file size, and capture duration options, as per a suggestion by Ulf Lamping. Also add units to the capture count option. Make the snapshot length, capture count, maximum file size, and capture duration options into a combination of a check box and a spin button. If the check box is not checked, the limit in question is inactive (snapshot length of 65535, no max packet count, no max file size, no max capture duration); if it's checked, the spinbox specifies the limit. Default all of the check boxes to "not checked" and all of the spin boxes to small values. Use "gtk_toggle_button_get_active()" rather than directly fetching the state of a check box. svn path=/trunk/; revision=4709
2002-01-25From Motonori Shindo: protect include of <netinet/in.h> with #ifdefGuy Harris1-1/+3
HAVE_NETINET_IN_H. svn path=/trunk/; revision=4610
2002-01-24Add support for ATM captures (based on writing one out and handing it toGuy Harris1-34/+171
NetMon 2.0; I don't have any ATM captures *from* NetMon to try it on, so I don't know what significance the "destination address" and "source address" fields have, but we can at least read the captures we ourselves write out, as can NetMon). svn path=/trunk/; revision=4606
2001-12-04In the NetMon capture file reading code, if we get a short read whenGuy Harris1-4/+4
trying to read the frame table, return -1 with "*err" set to WTAP_ERR_SHORT_READ, don't return 0 - we've already decided that the file is a NetMon file, so we shouldn't return a "this isn't a NetMon file" indication, we should return a "this file is too short" error, as that's what the problem is. Fix up the error messages for WTAP_ERR_SHORT_READ to indicate that the read might have gotten cut short in the middle of data other than a packet. svn path=/trunk/; revision=4331
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4199
2001-10-25Get rid of signed/unsigned comparison warnings in wiretap.Gilbert Ramirez1-4/+4
svn path=/trunk/; revision=4077
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris1-3/+3
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
2001-08-25The return value from "fwrite()" is a "size_t"; make the variable intoGuy Harris1-12/+12
which we store it a "size_t", and then fix up the bugs that were revealed by the compiler warnings that produced - "fwrite()" returns 0, not a negative number, on an I/O error. Fix up some other items to have type "size_t", or to have various unsigned types, while we're at it, to squelch compiler warnings. svn path=/trunk/; revision=3867
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-26 21:32:23 +0000