aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/ngsniffer.c
AgeCommit message (Collapse)AuthorFilesLines
2002-03-05Make "wtap_seek_read()" return TRUE on success and FALSE on error, likeGuy Harris1-34/+44
"wtap_read()". Add some additional error checks to the Sniffer file reader. svn path=/trunk/; revision=4875
2002-03-05Have "wtap_seek_read()" return 0 on success and -1 on failure, and takeGuy Harris1-11/+17
an "err" argument that points to an "int" into which to put an error code if it fails. Check for errors in one call to it, and note that we should do so in other places. In the "wtap_seek_read()" call in the TCP graphing code, don't overwrite "cfile.pseudo_header", and make the buffer into which we read the data WTAP_MAX_PACKET_SIZE bytes, as it should be. In some of the file readers for text files, check for errors from the "parse the record header" and "parse the hex dump" routines when reading sequentially. In "csids_seek_read()", fix some calls to "file_error()" to check the error on the random stream (that being what we're reading). svn path=/trunk/; revision=4874
2002-03-04Check for errors in seeks, "tell"s, and "stat()"s/"fstat()"s.Guy Harris1-29/+53
For file types where we allocate private data, add "close" routines where they were missing, to free the private data. Also fix up the code to clean up after some errors by freeing private data where that wasn't being done. Get rid of unused arguments to "wtap_dump_open_finish()". Fix indentation. svn path=/trunk/; revision=4857
2002-03-02From Joerg Mayer: get rid of "-Wno-unused" flag in some configureGuy Harris1-4/+5
scripts, and check in changes to add _U_ to some unused arguments (some other should perhaps be used, so we leave the _U_ out so that the warnings serve as a reminder to check those). svn path=/trunk/; revision=4847
2002-02-27From Joerg Mayer: remove unused variables and declarations ofGuy Harris1-3/+2
non-existent functions. Remove the "filetype" argument from the "can_write_encap" functions for particular capture file types - the argument value is implicit, in that the routine being called is the routine for that particular file type. svn path=/trunk/; revision=4823
2002-02-08Have Wiretap set the snapshot length to 0 if it can't be derived fromGuy Harris1-2/+2
reading the capture file. Have callers of "wtap_snapshot_length()" treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so that, when writing a capture file in a format that *does* store the snapshot length, we can at least put *something* in the file). If we don't know the snapshot length of the current capture file, don't display a value in the summary window. Don't use "cfile.snap" as the snapshot length option when capturing - doing so causes Ethereal to default, when capturing, to the snapshot length of the last capture file that you read in, rather than to the snapshot length of the last capture you did (or the initial default of "no snapshot length"). Redo the "Capture Options" dialog box to group options into sections with frames around them, and add units to the snapshot length, maximum file size, and capture duration options, as per a suggestion by Ulf Lamping. Also add units to the capture count option. Make the snapshot length, capture count, maximum file size, and capture duration options into a combination of a check box and a spin button. If the check box is not checked, the limit in question is inactive (snapshot length of 65535, no max packet count, no max file size, no max capture duration); if it's checked, the spinbox specifies the limit. Default all of the check boxes to "not checked" and all of the spin boxes to small values. Use "gtk_toggle_button_get_active()" rather than directly fetching the state of a check box. svn path=/trunk/; revision=4709
2002-01-11Oh, what the heck, write out FDDI and bit-swapped FDDI as the same typeGuy Harris1-2/+2
in Sniffer Classic files; there's nothing we can do about those platforms that bit-swap FDDI addresses before handing them to DLPI or whatever, so we'll just let people live with wrong FDDI addresses (or maybe someday put in code to bit-swap them before writing them out to the capture file). svn path=/trunk/; revision=4519
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4199
2001-10-25Get rid of signed/unsigned comparison warnings in wiretap.Gilbert Ramirez1-5/+5
svn path=/trunk/; revision=4077
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris1-5/+5
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
2001-08-25The return value from "fwrite()" is a "size_t"; make the variable intoGuy Harris1-11/+11
which we store it a "size_t", and then fix up the bugs that were revealed by the compiler warnings that produced - "fwrite()" returns 0, not a negative number, on an I/O error. Fix up some other items to have type "size_t", or to have various unsigned types, while we're at it, to squelch compiler warnings. svn path=/trunk/; revision=3867
2001-07-15Fixes, from Scott Renfro, for some calls to "localtime()" that didn'tGuy Harris1-6/+11
check whether the call succeeded (it doesn't always do so on Windows, for example). svn path=/trunk/; revision=3722
2001-07-06Remove a comment that no longer applies - we no longer seek forward inGuy Harris1-18/+1
compressed Sniffer files by sequentially moving forward, and we no longer seek backward by seeking to the beginning and then seeking forward to the new position, we now seek to the beginning of the compressed block that contains the target position, if we're not already in that block, and then move to the appropriate position in that block. svn path=/trunk/; revision=3658
2001-03-10Obliging every capture file reader's "open()" routine to seek to theGuy Harris1-3/+1
beginning of the file before reading anything from the file is bogus - do that in the loop that tries each of the open routines, instead. (They may have to reset the seek pointer later if, for example, the capture file begins with the first packet, and the "open()" routine looks at that packet to try to guess whether the packet is in the file format in question.) Set "wth->data_offset" to 0 while you're at it, so capture file readers don't have to do that, either. svn path=/trunk/; revision=3123
2001-01-17Update a comment to reflect reality (we no longer skip all the extraGuy Harris1-2/+4
headers, we look at REC_HEADER2 records). svn path=/trunk/; revision=2911
2001-01-17Fixed potential buffer overflow in skip_header_records when processingJeff Foster1-17/+15
REC_HEADER2 encapsulation type. Modified skip_header_records to accept REC_HEADER3-REC_HEADER7. These header records would cause file read error if the capture file was compressed. svn path=/trunk/; revision=2910
2001-01-16Update a comment to reflect reality (we no longer skip all the extraGuy Harris1-3/+6
headers, we look at REC_HEADER2 records). svn path=/trunk/; revision=2904
2001-01-16Moved settingg wth->file_encap from sniffer_encap to precede theJeff Foster1-2/+6
skip_header_records call because skip_header_records function may set the field based upon the header records svn path=/trunk/; revision=2903
2001-01-16Code to get a putative network subtype from a type 7 record in anGuy Harris1-6/+86
"Internetwork analyzer" capture, from Jeff Foster. (It's not a replacement for the heuristics, as 1) at least one PPP capture doesn't have a type 7 record and 2) LAPB/X.25 and LAPD/ISDN might both be "HDLC" captures and we'd need to figure out how to tell them apart.) svn path=/trunk/; revision=2902
2001-01-08Code to handle Frame Relay Sniffer captures, from Jeff Foster.Guy Harris1-2/+7
Code to register the Frame Relay dissector to handle Frame Relay captures, from Paul Ionescu. svn path=/trunk/; revision=2845
2000-11-29Catch Sniffer packets where the record length for a record containing aGuy Harris1-1/+14
packet is too small to contain all the data that the frame header claims was captured for the packet; treat that as a bad record, and return an error. svn path=/trunk/; revision=2711
2000-11-19"wtap_read()" must *always* set "*err" when it returns FALSE - if it'sGuy Harris1-1/+2
just an EOF, it should set "*err" to 0. Fix up a bunch of read routines for various capture file types to set "*err" appropriately. svn path=/trunk/; revision=2667
2000-11-11We have to set "x25.flags" in the Wiretap pseudo-header if the captureGuy Harris1-1/+29
is WTAP_ENCAP_LAPB *or* WTAP_ENCAP_V120, and we have to set "p2p.sent" in the capture file for *all* WTAP_ENCAP_LAPD captures; fix the i4btrace and Sniffer capture file readers to do so. (XXX - should we eliminate "x25.flags", and use "p2p.sent" instead? The directions for X.25 are DTE->DCE and DCE->DTE, not "sent" and "received", but I suspect that "sent" and "received" should be thought of from the point of view of the DTE, so DTE->DCE is "sent" and DCE->DTE is "received"; the directions for ISDN are user->network and network->user, but I suspect that "sent" and "received" should be thought of from the standpoint of the user equipment, so user->network is "sent" and network->user is "received".) svn path=/trunk/; revision=2606
2000-10-17Add initial support for "type 12" frames. I have no documentation forGerald Combs1-1/+92
these other than a trace file a client sent me. The header appears to be similar to frame2 and frame4 records, but with extra bytes at the end. The trace file also contains record types 13 - 17 which appear to contain metainformation such as retransmit counts. svn path=/trunk/; revision=2508
2000-09-21Make sure to pass the sent/received direction from pppdump.c inGilbert Ramirez1-3/+3
pseudo_header. Use generic "p2p_phdr" instead of "lapd_phdr". Modify toshiba.c and packet-lapd.c to take that into account. Add frame.p2p_dir, a filterable field, 0=sent, 1=recvd Make p2p_dir available in packe_info, as I think it will be needed in VJ COMP and UNCOMP dissection. Rename WTAP_ENCAP_TR to WTAP_ENCAP_TOKEN_RING. Mention pppd-log support in man page. Mention atmsnoop in README. svn path=/trunk/; revision=2455
2000-09-07Change wtap_read() API so that the data offset is set via a pointer, andGilbert Ramirez1-12/+11
a "keep reading" boolean value is returned from the function. This avoids having to hack around the fact that some file formats truly do have records that start at offset 0. (i4btrace and csids have no file header. Neither does the pppdump-style file that I'm looking at right now). svn path=/trunk/; revision=2392
2000-08-25Move #include <time.h> into wtap-int.h instead of requiring it inGilbert Ramirez1-2/+1
every C file. I noticed this because of a build break of csids.obj on Win32. svn path=/trunk/; revision=2378
2000-08-12Initialize "last_blob" and "current_blob" when the file is opened.Guy Harris1-21/+23
Set "current_blob" when the first read is done from the random file, as "current_blob" is the current blob in the random file. svn path=/trunk/; revision=2262
2000-08-11If we have a random stream open for a compressed Sniffer file, have theGuy Harris1-168/+345
sequential pass through the file build a list of information about the compressed blobs, with the starting offset in the compressed file and in the uncompressed byte stream for each blob. When seeking on the random stream, check whether the target location is within the uncompressed buffer we currently have; if not, use that list to figure out which blob contains the target location, and read that blob into the buffer. Then, as we now know that the target location is within the uncompressed buffer we currently have, just move the current pointer into that buffer to the target location. This means we don't have to read forwards through any uninteresting blobs in order to seek forwards, and don't have to go all the way back to the beginning and seek forwards in order to seek backwards. svn path=/trunk/; revision=2251
2000-07-26Use unsigned character pointers and arrays rather than signed characterGuy Harris1-3/+3
pointers and arrays in a number of places, to remove warnings some compilers give. svn path=/trunk/; revision=2160
2000-06-28Don't reposition the random stream in "ngsniffer_open()" if there isn'tGuy Harris1-5/+6
a random stream open. svn path=/trunk/; revision=2097
2000-06-15Patch from Joerg Mayer to fix a problem reading Sniffer files:Guy Harris1-5/+10
Differentiate between LAPB and LAPD sync sniffer traces. Personally I think there must be a better way to find out which protocol is in the trace but I currently lack the time to look at the remaining frame info. svn path=/trunk/; revision=2072
2000-06-15Patch from Joerg Mayer to fix a problem reading Sniffer files:Guy Harris1-27/+24
When trying to decode a sample trace from the NG offline sniffer installation, one trace resulted in a "corrupted" error. The reason was, that the file was a version 2 file format. That format used type 8 for header purposes while version 4 uses it for FRAME4. svn path=/trunk/; revision=2071
2000-05-25Support for reading compressed Sniffer files, from Tim Farley, JoergGuy Harris1-54/+557
Mayer, and yours truly. svn path=/trunk/; revision=2002
2000-05-19Add wtap-int.h. Move definitions relevant to the internal workins of wiretapGilbert Ramirez1-10/+10
to that file, leave public definitions in wtap.h. Rename "union pseudo_header" to "union wtap_pseudo_header". Make the wtap_pseudo_header pointer available in packet_info struct. svn path=/trunk/; revision=1989
2000-05-19In Wiretap, a file stream handle is a "FILE_T", not a "FILE_T *" (aGuy Harris1-9/+9
"FILE_T" is either a "gzFile" or a "FILE *", depending on whether zlib support is enabled or not). Fix various function declarations and definitions. svn path=/trunk/; revision=1984
2000-05-18Remove the "union pseudo_header" from the "frame_data" structure;Guy Harris1-102/+219
there's no need to keep it around in memory - when the frame data is read in when handing a frame, read in the information, if any, necessary to reconstruct the frame header, and reconstruct it. This saves some memory. This requires that the seek-and-read function be implemented inside Wiretap, and that the Wiretap handle remain open even after we've finished reading the file sequentially. This also points out that we can't really do X.25-over-Ethernet correctly, as we don't know where the direction (DTE->DCE or DCE->DTE) flag is stored; it's not clear how the Ethernet type 0x0805 for X.25 Layer 3 is supposed to be handled in any case. We eliminate X.25-over-Ethernet support (until we find out what we're supposed to do). svn path=/trunk/; revision=1975
2000-05-12Use "htoles()" rather than "pletohs()" to convert host-byte-order shortsGuy Harris1-9/+9
to little-endian shorts - and to convert host-byte-order longs to little-endian shorts (if the host-byte-order long will fit into a short, "htoles()" does the right thing; if it doesn't, there is no right thing to do - perhaps we should return a wiretap error, although, at least at present, it's unlikely that we'll have packets bigger than 65535 bytes, so it's unlikely that the values won't fit into a short). svn path=/trunk/; revision=1953
2000-05-10Rename the "private" member of a "wtap_dumper" structure to "dump", asGuy Harris1-5/+5
per the "capture" member of a "wtap" structure, so that it doesn't collide with the C++ reserved word "private". svn path=/trunk/; revision=1936
2000-03-22In a Network Monitor capture file, get the starting offsets of framesGuy Harris1-1/+9
from the frame table - Network Monitor 2.x, at least, doesn't always write frame N+1 right after frame N. To do that, we need to mallocate a big array to hold the frame table, and free it when we close the capture file; this requires that we have capture-file-type-specific close routines as well as capture-file-type-specific read routines - we let it the pointer to that routine be null if it's not needed. Given that, we might as well get rid of the switch statement in "wtap_close()", in favor of using capture-file-type-specific close routines, as per the comment before that switch statement. svn path=/trunk/; revision=1740
2000-02-19Use WTAP_ERR_UNSUPPORTED_ENCAP for all attempts to open or read aGuy Harris1-2/+2
capture file for an unsupported link-layer encapsulation type (as the nettl reader does), and report it correctly if it occurs on an open or read attempt rather than a save attempt. svn path=/trunk/; revision=1647
2000-01-22Fix files that had Gilbert's old e-mail address or that didn't have myGuy Harris1-2/+2
forwarding e-mail address. svn path=/trunk/; revision=1522
2000-01-13We are obliged to define HAVE_UNISTD_H in "config.h"; to avoid theGuy Harris1-2/+2
hideous problem on FreeBSD 3.[23] (and perhaps other BSDs) if HAVE_UNISTD_H is defined before "zlib.h" is included, turn "file_seek()" into a subroutine defined in a file that *undefines* HAVE_UNISTD_H before including "zlib.h", so that the *only* call to "gzseek()" is made from a file that does not have HAVE_UNISTD_H defined when it includes "zlib.h". Move "file_error()" to that file while you're at it, so it holds all the wrappers that hide the presence or absence of zlib from routines to read capture files. Turn "file.h", which declared those wrapper functions as well as wrapper macros, into "file_wrapper.h" - it belongs with the "file_wrapper.c" file that defines the wrapper functions, not with "file.c" which handles higher-layer file access functions. Remove the comment in "configure.in" that explained why defining HAVE_UNISTD_H was a bad idea, as we're not obliged to define it and work around the problem. (The comment in "file_wrapper.c" explains the workaround.) svn path=/trunk/; revision=1463
1999-12-14Changed the meaning of the 0x80 bit in "fs" in a frame2 record (from DTEOlivier Abad1-3/+4
instead of from DCE). I can now open a RADCOM X.25 capture in ethereal, save it as sniffer, and read it with a sniffer. The frame directions are correct. (BTW, the snifconv.exe tool provided by RADCOM doesn't work with X.25 captures). svn path=/trunk/; revision=1331
1999-12-11Put in a private data structure hanging off the "wtap_dumper" structureGuy Harris1-8/+14
the "this is the first frame" flag, and the time stamp of the first frame, used when writing Sniffer files, so that more than one could be open at a time (Wiretap doesn't forbid that) and so that they're initialized when you start writing a capture. svn path=/trunk/; revision=1292
1999-12-11Correct timestamp calculation in ngsniffer_dumpOlivier Abad1-30/+45
svn path=/trunk/; revision=1291
1999-12-09Add support to Wiretap for writing sniffer capture files.Olivier Abad1-8/+185
I'm using 4.0 as the version in the REC_VERS record. It seems to work with sniffer versions 4.40 and 5.0 No ATM support yet. svn path=/trunk/; revision=1270
1999-11-29Update one more comment.Guy Harris1-4/+4
svn path=/trunk/; revision=1150
1999-11-29Update some comments.Guy Harris1-2/+13
svn path=/trunk/; revision=1149
1999-11-28Add in a comment about the "fs" and "flags" fields in the "frame2"Guy Harris1-1/+16
record. svn path=/trunk/; revision=1130
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-14 05:23:09 +0000