aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/netxray.c
AgeCommit message (Collapse)AuthorFilesLines
2004-03-03Have "wtap_read()" set "wth->phdr.pkt_encap" to "wth->file_encap",Guy Harris1-2/+1
rather than requiring individual capture file type handlers to do it (unless they're doing per-packet encapsulation, in which case we check to make sure they didn't *leave* it as WTAP_ENCAP_PER_PACKET). svn path=/trunk/; revision=10290
2004-01-27Supply a pseudo-header for all 802.11 packets; add an "fcs_len" field toGuy Harris1-18/+10
it, similar to the Ethernet pseudo-header's "fcs_len" field, and use it in the 802.11 dissector. svn path=/trunk/; revision=9884
2004-01-25Don't muck with the Ethernet pseudo-header if we have an 802.11 capture.Guy Harris1-1/+9
svn path=/trunk/; revision=9857
2004-01-25Have the Wiretap open, read, and seek-and-read routines return, inGuy Harris1-17/+21
addition to an error code, an error info string, for WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with "g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed strings returned as the error info string, and change the callers of those routines to, for those errors, put the info string into the printed message or alert box for the error. Add messages for cases where those errors were returned without printing an additional message. Nobody uses the error code from "cf_read()" - "cf_read()" puts up the alert box itself for failures; get rid of the error code, so it just returns a success/failure indication. Rename "file_read_error_message()" to "cf_read_error_message()", as it handles read errors from Wiretap, and have it take an error info string as an argument. (That handles a lot of the work of putting the info string into the error message.) Make some variables in "ascend-grammar.y" static. Check the return value of "erf_read_header()" in "erf_seek_read()". Get rid of an unused #define in "i4btrace.c". svn path=/trunk/; revision=9852
2004-01-19It appears that, for ISDN captures, the rules for whether there's 4Guy Harris1-10/+30
bytes of extra stuff at the end of the packet or not are the same as for Ethernet and 802.11. svn path=/trunk/; revision=9728
2004-01-05 removed some MSVC warnings (level 3)Ulf Lamping1-3/+3
svn path=/trunk/; revision=9558
2003-10-01Have a pseudo-header for Ethernet packets, giving the size of the FCS -Guy Harris1-29/+137
0 means "there is no FCS in the packet data", 4 means "there is an FCS in the packet data", -1 means "I don't know whether there's an FCS in the packet data, guess based on the packet size". Assume that Ethernet encapsulated inside other protocols has no FCS, by having the "eth" dissector assume that (and not check for an Ethernet pseudo-header). Have "ethertype()" take an argument giving the FCS size; pass 0 when appropriate. Fix up Wiretap routines to set the pseudo-header. This means we no longer use the "generic" seek-and-read routine, so get rid of it. svn path=/trunk/; revision=8574
2003-09-28It appears that, at least for gigabit pod captures, there are time stampGuy Harris1-21/+52
differences between versions 002.001 and 002.002. svn path=/trunk/; revision=8563
2003-07-07A couple of captures have been seen with the first (low-order) byte ofGuy Harris1-41/+94
the network type being 1 and the byte after it being 2; we assume, for now, that the network type is 1 byte, and that if the byte after it is 0, the network type is an NDIS type - 1, and if it's 2, it's an NDIS type. svn path=/trunk/; revision=7973
2003-03-31The units, in non-whizzo-gigabit-pod captures, for hdr.timeunit = 2Guy Harris1-11/+21
aren't 1/1193000.0 second; the code used to use 1/1193180.0 second, but at least one capture appears to have units of somewhere around 1/3579540.0 second. svn path=/trunk/; revision=7388
2003-03-28Ian Schorr discovered that, for gigabit pod captures, if hdr.timeunit isGuy Harris1-23/+31
2 the time stamps are in units of 1/31250000 seconds rather than nanoseconds - and, by generating Windows Sniffer captures with various hdr.timeunit values, that for all the non-zero values he tested, the time stamps for non-gigabit pod captures are in units of 1/1193000 second. Instead of having a TpS array, just test for the exception value (0 for non-gigabit pod captures, 2 for gigabit pod captures). svn path=/trunk/; revision=7380
2003-03-04Handle the direction bit in SDLC and PPP Sniffer files.Guy Harris1-1/+7
svn path=/trunk/; revision=7267
2003-03-03Handle packet direction information for SDLC Sniffer captures.Guy Harris1-8/+60
Add a bunch of capture types discovered by stuffing them into Windows Sniffer captures and seeing what a Sniffer thought they were. Add support for writing at least some of them. svn path=/trunk/; revision=7265
2003-03-01A "hdr.xxb[20]" value of 2 in a version 2 capture appears to mean thatGuy Harris1-1/+13
it's a gigabit Ethernet capture, possibly, with special hardware, and that time stamps have 1000 times the resolution that they have in other captures (perhaps due to the special hardware having a higher-resolution clock?). svn path=/trunk/; revision=7240
2003-01-31Add WTAP_ENCAP_FRELAY_WITH_PHDR for use with Frame Relay capture filesGuy Harris1-14/+21
that have direction information. Support writing WTAP_ENCAP_FRELAY_WITH_PHDR and WTAP_ENCAP_PPP_WITH_PHDR captures out in libpcap format - we throw away the direction information, but so it goes. When reading/writing Windows Sniffer format, read and write the direction flag. svn path=/trunk/; revision=7052
2003-01-30Add support for writing Frame Relay files in NetXRay format 2.x.Guy Harris1-21/+72
svn path=/trunk/; revision=7048
2003-01-10The Sniffer file formats include a file to identify raw cells; exportGuy Harris1-1/+7
that flag in the ATM pseudo-header, and use it to determine whether a frame is a raw cell or a reassembled frame, rather than using the AAL, as you can have raw AAL5 cells in a capture. svn path=/trunk/; revision=6889
2003-01-09It appears that a channel number of 0 means DTE->DCE, and a channelGuy Harris1-2/+2
number of 1 means DCE->DTE, in DOS Sniffer ATM captures. svn path=/trunk/; revision=6881
2003-01-07PRI captures appear to be the ISDN captures with padding.Guy Harris1-12/+20
The Windows Sniffer does *not* appear to know the difference between 802.3 and 802.3 multicast LANE traffic. svn path=/trunk/; revision=6870
2003-01-07Use some fields in the per-packet header for ATM to get the AAL typeGuy Harris1-22/+92
and traffic type. svn path=/trunk/; revision=6868
2003-01-07The direction flag for LAPB/X.25 and ISDN appears to be in theGuy Harris1-11/+17
bottommost bit of the 12th byte of "hdr.hdr_2_x.xxx". svn path=/trunk/; revision=6866
2003-01-07Update a comment.Guy Harris1-18/+7
svn path=/trunk/; revision=6865
2003-01-07Properly turn the raw ISDN channel number field into an actual channelGuy Harris1-6/+53
number. Put in some commented-out code to deal with some end-of-packet crud in some ISDN captures - not all ISDN captures have it, so we can't unconditionally slice it out. svn path=/trunk/; revision=6863
2003-01-03Add some more comments.Guy Harris1-2/+5
svn path=/trunk/; revision=6843
2003-01-03Get rid of some bogus commented-out statements.Guy Harris1-5/+2
svn path=/trunk/; revision=6842
2003-01-03It appears there are, indeed, two fields in the "xxb" part of the fileGuy Harris1-17/+57
header that specify the detailed capture type for WAN captures; use those fields. svn path=/trunk/; revision=6841
2003-01-03Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not justGuy Harris1-8/+20
used for the DOS-based ATM Sniffer. (That's not a great name, but I couldn't think of a better one.) Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture files where reassembled frames don't have trailers, such as the AAL5 trailer, chopped off. That's what at least some versions of the Windows-based ATM Sniffer appear to have. Map the ATM capture file type for NetXRay captures to WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've reverse-engineered, so far, for the pseudo-header; there's more that needs to be done on it, e.g. getting the channel, AAL type, and traffic type (or inferring them if they're not in the packet header). svn path=/trunk/; revision=6840
2003-01-03Add support for version 002.000, and note that there's probablyGuy Harris1-5/+14
something hidden in the per-packet header for ATM captures that specifies the traffic type (and stuff such as that). svn path=/trunk/; revision=6839
2002-10-31Discard the WTAP_ENCAP_LAPD encapsulation type in favor of aGuy Harris1-43/+19
WTAP_ENCAP_ISDN encapsulation type, which includes a pseudo-header giving the direction (user-to-network or network-to-user) and the channel number. Add a new circuit type, using the ISDN channel number as the circuit ID. Add an ISDN dissector to put the direction and channel number into the protocol tree and to call the appropriate dissector for the payload based on the channel (LAPD for the D channel; V.120, PPP, or data for B channels, based on some heuristics). svn path=/trunk/; revision=6521
2002-10-29Some fields that are treated as 16-bit or 8-bit fields followed byGuy Harris1-14/+83
unknown bytes might actually be 32-bit fields. The field after the upper 32 bits of the time stamp of the capture start appears to be the speed of the network, in bits/second. Put in a field for the rest of the file header, as a bunch of 32-bit values (most fields are 32 bits, and all of them might be, in that header), for use when reverse-engineering. At least in version 002.x of NetXRay-format captures, WAN captures might be ISDN captures; treat all WAN version 002.x captures as ISDN captures for now, until we see some captures where that's wrong (and thus stand a chance of figuring out where in the file header it indicates what type of capture it is). svn path=/trunk/; revision=6519
2002-10-22Put in a comment noting that not *all* captures with a network type of 3Guy Harris1-1/+9
look like Ethernet captures. svn path=/trunk/; revision=6474
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-12/+12
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6115
2002-07-29From Joerg Mayer:Guy Harris1-7/+7
All files: - Replace types from sys/types.h by those from glib.h - Replace ntoh family of macros from netinet/in.h and winsock2.h by g_ntoh family from glib.h - Remove now unneeded includes of sys/types.h, netinet/in.h and winsock2.h wtap.h Move includes to the top svn path=/trunk/; revision=5909
2002-07-16From Graeme Hewson:Guy Harris1-5/+19
Allow "-" as the output file name in Wiretap, referring to the standard error. Optimize the capture loop. Fix some of the error-message printing code in Ethereal and Tethereal. Have Wiretap check whether it can seek on a file descriptor, and pass the results of that test to the file-type-specific "open for output" routine. Have the "open for output" routines for files where we need to seek when writing the file return an error if seeks don't work. svn path=/trunk/; revision=5884
2002-06-07Graeme Hewson noted that zlib has a bug wherein "gzseek()" doesn't setGuy Harris1-9/+4
the internal z_err value for the stream if an "fseek()" call it makes fails, so that if "gzerror()" is subsequently called, it returns Z_OK rather than an error. To work around this, we pass "file_seek()" an "int *err", and have the with-zlib version of "file_seek()" check, if "gzseek()" fails, whether the return value of "file_error()" is 0 and, if so, have it return "errno" instead. svn path=/trunk/; revision=5642
2002-05-28Add support for old NetXRay format.Guy Harris1-46/+95
svn path=/trunk/; revision=5576
2002-05-04Fix capture-file-specific "close output" routines to check whether theGuy Harris1-49/+55
"err" argument is null and return an error code through that argument only if it isn't, to match what "wtap_dump_close()", which calls those routines, does. Put the NetXRay dump routines in order by version number. svn path=/trunk/; revision=5385
2002-04-18Initial support for writing NetXRay 2.x (Windows Sniffer) formatGuy Harris1-3/+152
captures, from Olivier Abad. svn path=/trunk/; revision=5202
2002-04-08Add an encapsulation type for "802.11 with radio information"; that typeGuy Harris1-45/+163
returns radio information such as signal strength, channel, and data rate in a pseudo-header. Add that pseudo-header. Use the "802.11 with radio information" encapsulation type for Wireless Sniffer files; extract the radio information from where it appears to be in the header. Add dissector code for that encapsulation type. Fix an error in the code to put radio information into the AiroPeek tree. Make the "wrapped" flag for NetXRay/Windows Sniffer captures a "gboolean". svn path=/trunk/; revision=5122
2002-04-08Yes, that stuff really *does* appear to be just padding. Go figure.Guy Harris1-17/+6
svn path=/trunk/; revision=5119
2002-04-07Gerald says the padding has values that don't look like FCSes; note thatGuy Harris1-1/+5
in the comment. svn path=/trunk/; revision=5108
2002-04-07Make the end-of-packet padding a per-capture-file property.Guy Harris1-20/+32
Read in the entire packet, including the padding, and just tell our caller about the non-padding part; that avoids doing a "file_seek()" ("fseek()"s are inefficient on some platforms, as they flush the standard I/O buffers and do an "lseek()"), and would also let us supply the padding to the caller if it turns out it's an FCS rather than padding. svn path=/trunk/; revision=5107
2002-04-07Add support for Sniffer 4.6 wireless captures.Gerald Combs1-8/+23
svn path=/trunk/; revision=5106
2002-03-04Check for errors in seeks, "tell"s, and "stat()"s/"fstat()"s.Guy Harris1-4/+15
For file types where we allocate private data, add "close" routines where they were missing, to free the private data. Also fix up the code to clean up after some errors by freeing private data where that wasn't being done. Get rid of unused arguments to "wtap_dump_open_finish()". Fix indentation. svn path=/trunk/; revision=4857
2002-03-02From Joerg Mayer: get rid of "-Wno-unused" flag in some configureGuy Harris1-3/+5
scripts, and check in changes to add _U_ to some unused arguments (some other should perhaps be used, so we leave the _U_ out so that the warnings serve as a reminder to check those). svn path=/trunk/; revision=4847
2002-02-27From Joerg Mayer: remove unused variables and declarations ofGuy Harris1-3/+3
non-existent functions. Remove the "filetype" argument from the "can_write_encap" functions for particular capture file types - the argument value is implicit, in that the routine being called is the routine for that particular file type. svn path=/trunk/; revision=4823
2002-02-08Have Wiretap set the snapshot length to 0 if it can't be derived fromGuy Harris1-2/+2
reading the capture file. Have callers of "wtap_snapshot_length()" treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so that, when writing a capture file in a format that *does* store the snapshot length, we can at least put *something* in the file). If we don't know the snapshot length of the current capture file, don't display a value in the summary window. Don't use "cfile.snap" as the snapshot length option when capturing - doing so causes Ethereal to default, when capturing, to the snapshot length of the last capture file that you read in, rather than to the snapshot length of the last capture you did (or the initial default of "no snapshot length"). Redo the "Capture Options" dialog box to group options into sections with frames around them, and add units to the snapshot length, maximum file size, and capture duration options, as per a suggestion by Ulf Lamping. Also add units to the capture count option. Make the snapshot length, capture count, maximum file size, and capture duration options into a combination of a check box and a spin button. If the check box is not checked, the limit in question is inactive (snapshot length of 65535, no max packet count, no max file size, no max capture duration); if it's checked, the spinbox specifies the limit. Default all of the check boxes to "not checked" and all of the spin boxes to small values. Use "gtk_toggle_button_get_active()" rather than directly fetching the state of a check box. svn path=/trunk/; revision=4709
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4199
2001-10-25Get rid of signed/unsigned comparison warnings in wiretap.Gilbert Ramirez1-3/+3
svn path=/trunk/; revision=4077
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris1-3/+3
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-21 10:08:21 +0000