aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/pcap-common.c
AgeCommit message (Collapse)AuthorFilesLines
2017-03-31Add packet capture support for Darwin USBScott Deandrea1-0/+3
Change-Id: Iec9e4ac2362cf8e88a3cf6ae3483cefe938967e5 Reviewed-on: https://code.wireshark.org/review/20814 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-22Handle LINKTYPE_SDLC.Guy Harris1-1/+4
Change-Id: I16a67f2d459cd6ebdbc7bdefd481fd95607af22a Reviewed-on: https://code.wireshark.org/review/20662 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-25Handle ETH_P_CANFD as well as ETH_P_CAN.Guy Harris1-1/+7
Both of them need to have the CAN ID/flags field of the header byte-swapped as necessary to make sure it's in the *reading* host's byte order, not the *writing* host's byte order, if the two are different. Change-Id: Iac1589fdd9fe4d9ee6fbac8d821b48694d68919b Reviewed-on: https://code.wireshark.org/review/17333 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-25Go back to having only one SocketCAN LINKTYPE_ value.Guy Harris1-41/+2
Libpcap just backed out the "host-endian" SocketCAN LINKTYPE_ value; we don't need it any more. Change-Id: I33a7dc21207a0009e20b4abaefe1119eb649c39a Reviewed-on: https://code.wireshark.org/review/17327 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-19Handle the new LINKTYPE_CAN_SOCKETCAN_HOSTENDIAN.Guy Harris1-3/+104
Unfortunately, only one libpcap code path puts the CAN ID in the SocketCAN header in network byte order; the others leave it in host byte order. Therefore, a new LINKTYPE_/DLT_ value was introduced, and libpcap was changed to use that for the cases where the CAN ID is in host byte order. Support them both. This means we need to, when reading pcap and pcapng files, fix up the CAN ID if the host that wrote the file has a different byte order from ours (as libpcap also now does). This includes Linux "cooked" captures, which can include CAN packets. Change-Id: I75ff2d68d1fbdb42753ce85d18f04166f21736dd Reviewed-on: https://code.wireshark.org/review/17155 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-06-21Add support for Opencontrail virtual networkRudra Rugge1-0/+2
Change-Id: Ia6012e0f6425be069e222538eafb1191b398ec83 Reviewed-on: https://code.wireshark.org/review/15930 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-06*_stdup_printf -> strdup for "single string only" formatting.Michael Mann1-1/+1
Done for performance improvements. This could probably be done in checkAPIs.pl, but this was just a quick manual check with grepping. Change-Id: I91ff102cb528bb00fa2f65489de53890e7e46f2d Reviewed-on: https://code.wireshark.org/review/15751 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2016-05-15pcap-common: Account for padding in ENCAP_ERF len and caplenAnthony Coddington1-1/+20
Set len and caplen in pcap_read_post_process to actual wlen/payload length like for native ERF. This fixes padding incorrectly showing as an Ethernet trailer or equivalent as well as packet length calculations being incorrect. Fix up rlen when writing ENCAP_ERF so it isn't longer than the actual record length. This differs from native ERF behaviour which pads the record instead but there is currently no non-hackish way to do this for pcap/pcap-ng. Note: This means records captured from a DAG card in Wireshark (or old PCAP(-NG) files opened) will have padding stripped when saved as PCAP(-NG) and thus cannot be transmitted when converted to native ERF without aligning first. However, if the file is saved as native ERF originally the padding will be preserved (and zeroed). Given that extension header write support was very broken and transmission of PCAP(-NG) is not supported without conversion this is not expected to have been common. Ping-Bug: 3606 Change-Id: I49dce03984d7f07431b6eb7e16a993aeb571f288 Reviewed-on: https://code.wireshark.org/review/15359 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-05-12pcap-common: Fix several serious ENCAP_ERF extension header writing issuesAnthony Coddington1-8/+29
Write ERF subheader after extension headers, especially important for Ethernet (other types predate extension headers for the most part). Add missing ERF_TYPE_MC_AAL2 and ERF_TYPE_COLOR_HASH_ETH. Truncate final ERF extension header when too many. Rlen is not currently adjusted so may be incorrect (see followup patch). Existing tools generally check against PCAP incl_len anyway as there are other scenarios where this can happen like naive snapping or Wireshark ERF-to-PCAP. Properly fixing this will involve getting rid of the ERF pseudoheader. Consistent with the ERF wiretap (except for different padding behaviour). Bug: 3606 Change-Id: I6086cbc3fef948586fbad6f585f648d99adfff4f Reviewed-on: https://code.wireshark.org/review/15358 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-04-01support for IP-over-Infiniband - pcap encapsulationPetr Sumbera1-1/+1
Bug: 12279 Change-Id: Ib6c54f8b86d95c5546bc800749f124cd0dbb8ff0 Reviewed-on: https://code.wireshark.org/review/14585 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2016-02-20Initial support for FreeBSD USB captures.Guy Harris1-0/+2
(There's also work needed in libpcap; that's also in progress.) Change-Id: Iff5a34c139a000865e2d78cc17a4af5ff24fb44b Reviewed-on: https://code.wireshark.org/review/14025 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-19Get rid of PCAP_ENCAP_USB.Guy Harris1-2/+0
It doesn't correspond to anything we support - and the old Linux USB LINKTYPE_ value of 186 doesn't give enough information to dissect the packets (it discards the event type, for example), so we drop the rest of our support for it as well. Change-Id: I6f537d9263174aba4320edf5140e1d1540e979c8 Reviewed-on: https://code.wireshark.org/review/14020 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-19Don't bother setting phdr->pkt_encap to wth->file_encap.Guy Harris1-2/+0
wtap_read() and wtap_seek_read() now do so before calling the read or seek-read routine, so there's no need to do so in those routines. Rename hcidump_process_packet() to hcidump_read_packet() while we're at it, as it doesn't just process an already-read packet, it does the reading as well as the processing. Change-Id: Ic13da6a2096e68550d80f2eff31f03d0edb58147 Reviewed-on: https://code.wireshark.org/review/13998 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-16Add WTAP_ENCAP_NFC_LLCP to the list of types require a pseudo-header.Guy Harris1-13/+15
Discovered by changing wtap_encap_requires_phdr() to use a switch statement and comparing the case arms. Change-Id: I2a23b86ddfbc88c1b3251a0e97f7f00ee93f630e Reviewed-on: https://code.wireshark.org/review/13341 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-13Clean up handling of the data before the Ethernet packet in ERF files.Guy Harris1-4/+13
The data before the Ethernet packet isn't a 16-bit little-endian integer, it's two bytes, one byte of offset and one byte of padding. Change-Id: I327b88f058dda184b79d3c2c6cf0dea52c0d28b1 Reviewed-on: https://code.wireshark.org/review/13254 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-05GFP: Add support for Generic Framing Procedure (ITU-T G.7041/Y.1303)John A. Thacker1-4/+3
Add support for Generic Framing Procedure. Generic Framing Procedure (GFP) is used to map octet-aligned variable length payloads (e.g. Ethernet, MPLS, octet-aligned PPP, IP) into octet-synchronous signals such as SONET/SDH (ITU-T G.707) and OTN (ITU-T G.709). GFP is a telecommunications industry standard defined in ITU-T G.7041/Y.1303. (https://www.itu.int/rec/T-REC-G.7041/) Bug: 11961 Change-Id: Idf5b311e82b051b1ee65bde5149b3de405537b02 Reviewed-on: https://code.wireshark.org/review/13043 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-12-24Refactor 802.11 radio flags.Simon Barber1-1/+1
The use of a flag field here is aesthetically unpleasing when the flags are referred to frequently. Convert these into bitfield entries. Change-Id: I6f47e31558439dfd343ec7f856d04480366a1237 Reviewed-on: https://code.wireshark.org/review/12511 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-19use the official DLT for ISO14443Martin Kaiser1-0/+3
add DLT_ISO14443 to pcap_to_wtap_map[] define WTAP_ENCAP_ISO14443, link it to the iso14443 dissector Change-Id: Id837197c4d66071094f9336d60db36a371424807 Reviewed-on: https://code.wireshark.org/review/11959 Petri-Dish: Martin Kaiser <wireshark@kaiser.cx> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-06-20Call the "802.11 radio information" dissector for radio headers.Guy Harris1-1/+2
Have dissectors of various forms of radio information headers in the packets fill in a struct ieee_802_11_phdr with radio information as appropriate, and call the "802.11 radio information" dissector rather than the raw 802.11 dissector. This means that the radio information can be found in a protocol-independent and encapsulation-independent form when you're looking at the packet; that information can be presented in a form somewhat easier to read than the raw metadata header format. It also enables having a single "radio information" tap that allows statistics to handle all different sorts of radio information encapsulation. In addition, it lets us clean up some of the arguments passed to the common 802.11 dissector routine, by having it pull that information from the struct ieee_802_11_phdr. Ensure that the right structure gets passed to that routine, and that all the appropriate parts of that structure are filled in. Rename the 802.11 radio protocol to "wlan_radio", rather than just "radio", as it's 802.11-specific. Give all its fields "wlan_radio." names rather than "wlan." names. Change-Id: I78d79afece0ce0cf5fc17293c1e29596413b31c8 Reviewed-on: https://code.wireshark.org/review/8992 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-15Move some structures used only in pcap-common.c there.Guy Harris1-0/+30
Those aren't pseudo-headers exported from libwiretap, they're just structures corresponding to the pseudo-headers for some pcap/pcap-ng link-layer header types. Change-Id: Iec37cfc162b64adacdeb57e14e546bced7b673fa Reviewed-on: https://code.wireshark.org/review/8941 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-24pcap-common: fix build error with gcc5Daniel Mack1-1/+1
gcc5 complains about the issue below, so add a trivial fixup. CC libwiretap_la-pcap-common.lo pcap-common.c: In function 'pcap_byteswap_nflog_pseudoheader': pcap-common.c:1290:30: error: logical not is only applied to the left hand side of comparison [-Werror=logical-not-parentheses] if (!(nfhdr->nflog_version) == 0) { ^ cc1: all warnings being treated as errors Change-Id: I9f5b090ffd564f203cc3fb4ff302f2e4752865f0 Reviewed-on: https://code.wireshark.org/review/7336 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-21Set phdr encap for pcap fileMichal Labedzki1-0/+2
Change-Id: Id600b395d6fd2711c9b392a60454e5bd9a3eb465 Reviewed-on: https://code.wireshark.org/review/7288 Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
2015-02-15Handle DLT_LOOP differently from DLT_NULL.Guy Harris1-5/+5
That's a little cleaner, and lets us preserve the LINKTYPE_ value for DLT_LOOP captures. ("Preserve" here doesn't mean "write files with a link-layer header type of 12", as that's ambiguous; we write it with a link-layer header type of LINKTYPE_LOOP, i.e. 108. If programs on OpenBSD don't recognize that as DLT_LOOP, that's a bug in OpenBSD's libpcap or in the program.) Change-Id: I48a2e04aed41c013823ffb5c588d2a8e8b376e15 Reviewed-on: https://code.wireshark.org/review/7143 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-15Don't base interpretation of LINKTYPE_ values on DLT_ value definitions.Guy Harris1-27/+16
Instead, explicitly check for particular build platforms. This means that the interpretation of the link-layer type values with different meanings on different platforms won't be dependent on the particular version of libpcap with which Wireshark happens to be built, and also means that we don't have to fix pcap-common.c to include pcap.h or net/bpf.h. Fix some comments while we're at it. Bug: 10956 Change-Id: If331d9b92081fb0bdf416620fb2ad8dce57dea6b Reviewed-on: https://code.wireshark.org/review/7140 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-01-02Add "Editor modelines"; Adjust whitespace as needed.Bill Meier1-131/+144
Change-Id: Ic5a5acb0f36d3aa144edbfb1ae71097b18426db4 Reviewed-on: https://code.wireshark.org/review/6216 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-10-29Expand the 802.11 pseudo-header and support new radio metadata.Guy Harris1-6/+7
Add a set of presence bits, so we can indicate which bits of radio metadata we do and don't have. Fill in more radio metadata from capture files, and display it. (More to come.) Change-Id: Idea2c05442c74af17c14c4d5a8d8025ab27fbd15 Reviewed-on: https://code.wireshark.org/review/4987 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07No need for WTAP_ERR_CANT_READ.Guy Harris1-16/+0
Unlike the standard I/O routines, the code we introduced that supports fast random seeking on gzipped files will always supply some specific error code for read errors, so we don't need WTAP_ERR_CANT_READ. Add WTAP_ERR_CANT_WRITE for writing, as we're still using the standard I/O routines for that. Set errno to WTAP_ERR_CANT_WRITE before calling fwrite() in wtap_dump_file_write(), so that it's used if fwrite() fails without setting errno. Change-Id: I6bf066a6838284a532737aa65fd0c9bb3639ad63 Reviewed-on: https://code.wireshark.org/review/4540 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07Whitespace cleanups.Guy Harris1-17/+17
Change-Id: I92f983b2e04defab30eb31c14c484b9f0f582413 Reviewed-on: https://code.wireshark.org/review/4513 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07Add some higher-level file-read APIs and use them.Guy Harris1-114/+19
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an error number pointer, and an error string pointer as arguments, and that treats a short read of any sort, including a read that returns 0 bytes, as a WTAP_ERR_SHORT_READ error, and that returns the error number and string through its last two arguments. Add wtap_read_bytes_or_eof(), which is similar, but that treats a read that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF indication. Use those in file readers; that simplifies the code and makes it less likely that somebody will fail to supply the error number and error string on a file read error. Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210 Reviewed-on: https://code.wireshark.org/review/4512 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-06-09HPM.2 IPMI Trace Data encapsulation formatU-beauty\bdn1-1/+4
Added a mapping between DLT_IPMI_HPM_2 link-layer header type to the IPMI Trace Wiretap encapsulation. Change-Id: I458d44ad0f51beecfe5589e0e9cb75f4771d866b Reviewed-on: https://code.wireshark.org/review/2054 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-05-09Revert "Refactor Wiretap"Guy Harris1-13/+12
This reverts commit 1abeb277f5e6bd27fbaebfecc8184e37ba9d008a. This isn't building, and looks as if it requires significant work to fix. Change-Id: I622b1bb243e353e874883a302ab419532b7601f2 Reviewed-on: https://code.wireshark.org/review/1568 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-09Refactor WiretapMichael Mann1-12/+13
Start of refactoring Wiretap and breaking structures down into "generally useful fields for dissection" and "capture specific". Since this in intended as a "base" for Wiretap and Filetap, the "wft" prefix is used for "common" functionality. The "architectural" changes can be found in cfile.h, wtap.h, wtap-int.h and (new file) wftap-int.h. Most of the other (painstaking) changes were really just the result of compiling those new architecture changes. bug:9607 Change-Id: Ife858a61760d7a8a03be073546c0e7e582cab2ae Reviewed-on: https://code.wireshark.org/review/1485 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-04-28Add dissector for LINKTYPE_EPONPhilip Rosenberg-Watt1-1/+4
See IEEE Standard 802.3-2012 Section 5, Clause 65 and CableLabs DPoE Security and Certificate Specification 1.0, Section 6. Currently dissects 1G mode. 10G mode will be added when hardware is available. Change-Id: I6232af9bf6807644ef66a120d97e5fa5927988fe Reviewed-on: https://code.wireshark.org/review/1284 Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Evan Huus <eapache@gmail.com>
2014-04-01Add a dissector for Apple's PKTAP headers.Guy Harris1-0/+4
It automatically works for LINKTYPE_PKTAP and, by default, for LINKTYPE_USER2; if any other dissector is specified for LINKTYPE_USER2, that dissector overrides PKTAP. Change-Id: Ic00ac8a81c6101e45d638d337aef42df3920da12 Reviewed-on: https://code.wireshark.org/review/903 Reviewed-by: Evan Huus <eapache@gmail.com>
2014-03-24Use tabs instead of spacesMichal Labedzki1-6/+5
Change-Id: I16086216ffcac0a457c8fcdabfc0458d4e701ea0 Reviewed-on: https://code.wireshark.org/review/809 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-07Introduces two new Bluetooth DLTs for RF-based captures.Christopher Kilgour1-0/+5
Adds support for BLUETOOTH_LE_LL_WITH_PHDR, dissector integrates with existing BTLE dissector. Fixes BTLE dissector to correctly extract packet CRC. Adds CRC checking to BTLE dissector. Provides optional context to BTLE dissector that allows RF captures to provide link-layer hints for dissection details. Significantly, parameters for determining CRC correctness are provided, as well as Access Address validity information. Change-Id: I7d4936b053353a7f9c524021c01f67f5828253fb Reviewed-on: https://code.wireshark.org/review/310 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-06Have NFLOG TLV type and length be in host byte order.Guy Harris1-0/+80
When capturing, they'll be in host byte order. The top of the libpcap trunk and 1.5 branch, when reading a file, will, if necessary, byte-swap the type and length values so that they're in the byte order of the host reading the file (rather than the host that wrote the file). Do the same when we read a file, and have the NFLOG dissector assume host byte order for those fields. Change-Id: I493aed1e07b626af1157d75f3bc293b0a694ad07 Reviewed-on: https://code.wireshark.org/review/148 Reviewed-by: Evan Huus <eapache@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-02-20Add support for Bluetooth Linux MonitorMichal Labedzki1-1/+58
BlueZ 5/Linux Kernel introduced new way to sniffing Bluetooth interfaces. We are ready to use it. Libpcap provide new interface called "bluetooth-monior". Also fix trivial typos. Change-Id: Ic608a3d8553bbebbb21f2733ec92c758cbf8f707 Reviewed-on: https://code.wireshark.org/review/253 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-02-08Have macros to handle the range check and byte swapping.Guy Harris1-56/+44
Combine the check for whether the field is within the packet data and the swapping of the field into macros that do both, and use them. Change-Id: I1db4c5fd76172edd44abc9fb111d79a2537c6c9d Reviewed-on: https://code.wireshark.org/review/130 Reviewed-by: Evan Huus <eapache@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-02-06Make some routines take a struct wtap_pkthdr * as an argument.Guy Harris1-98/+105
For some routines that take multiple arguments that come from a struct wtap_pkthdr, pass a pointer to the struct wtap_pkthdr in question, rather than the separate arguments. Do this even if we're passing expressions that were earlier assigned to the struct wtap_pkthdr fields in question. This simplifies the calling sequences and ensures that the right values are picked up by the called routine; in at least one case we were *not* passing the right values (the code to handle Simple Packet Blocks in pcap-ng files). Also, call the byte-swapping routines for pseudo-header fields only if we need to do byte-swapping. Change-Id: I3a8badfcfeb0237dfc1d1014185a67f18c0f2ebe Reviewed-on: https://code.wireshark.org/review/119 Reviewed-by: Evan Huus <eapache@gmail.com> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2013-12-07Add WTAP_ENCAP_NETLINK which maps to DLT_NETLINK /253/Jakub Zawadzki1-0/+2
svn path=/trunk/; revision=53834
2013-12-03wiretap: start using <wsutil/pint.h>Jakub Zawadzki1-15/+15
svn path=/trunk/; revision=53764
2013-11-30STANAG 5066 DTS Layer dissector. Bug 9217 ↵Michael Mann1-0/+2
(https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9217) From İbrahim Can Yüce From me: Update to new tcp_dissect_pdus format, minor whitespace issues noticed in wiretap files. svn path=/trunk/; revision=53669
2013-11-08The "file types" we have are actually combinations of types andGuy Harris1-3/+3
subtypes, e.g. Network Monitor version 1 and Network Monitor version 2 are separate "file types", even though they both come from Network Monitor. Rename various functions, #defines, and variables appropriately. svn path=/trunk/; revision=53166
2013-08-08Clarify what the special cases in wtap_wtap_encap_to_pcap_encap() areGuy Harris1-17/+17
doing. svn path=/trunk/; revision=51209
2013-08-08Point to the tcpdump.org link-layer header types page.Guy Harris1-1/+2
svn path=/trunk/; revision=51203
2013-08-08Rename "dlt_value" to "linktype_value", and give more details inGuy Harris1-30/+43
comments about LINKTYPE_ values vs. DLT_ values. svn path=/trunk/; revision=51202
2013-07-31Back out previous checkin, which wasn't intended (and which had theGuy Harris1-147/+137
wrong checking message - wrong source tree...). svn path=/trunk/; revision=51051
2013-07-31Copy over r51049 from trunk:Guy Harris1-137/+147
------------------------------------------------------------------------ r51049 | guy | 2013-07-30 22:00:28 -0700 (Tue, 30 Jul 2013) | 5 lines If no target OS version was specified, default to the major version on which we're running, so we *always* build against an SDK. (The "10" in "10.x.y" is not *really* part of the version number, so the "major version" includes the "10" and the major version number following it.) svn path=/trunk/; revision=51050
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-26 21:41:14 +0000