aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/snoop.c
AgeCommit message (Collapse)AuthorFilesLines
2004-07-18Set the svn:eol-style property on all text files to "native", so thatGuy Harris1-1/+1
they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-03-03Have "wtap_read()" set "wth->phdr.pkt_encap" to "wth->file_encap",Guy Harris1-2/+1
rather than requiring individual capture file type handlers to do it (unless they're doing per-packet encapsulation, in which case we check to make sure they didn't *leave* it as WTAP_ENCAP_PER_PACKET). svn path=/trunk/; revision=10290
2004-01-25Have the Wiretap open, read, and seek-and-read routines return, inGuy Harris1-19/+23
addition to an error code, an error info string, for WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with "g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed strings returned as the error info string, and change the callers of those routines to, for those errors, put the info string into the printed message or alert box for the error. Add messages for cases where those errors were returned without printing an additional message. Nobody uses the error code from "cf_read()" - "cf_read()" puts up the alert box itself for failures; get rid of the error code, so it just returns a success/failure indication. Rename "file_read_error_message()" to "cf_read_error_message()", as it handles read errors from Wiretap, and have it take an error info string as an argument. (That handles a lot of the work of putting the info string into the error message.) Make some variables in "ascend-grammar.y" static. Check the return value of "erf_read_header()" in "erf_seek_read()". Get rid of an unused #define in "i4btrace.c". svn path=/trunk/; revision=9852
2004-01-05 removed some MSVC warnings (level 3)Ulf Lamping1-2/+2
svn path=/trunk/; revision=9558
2003-12-19Add some additional sanity checking.Guy Harris1-1/+10
svn path=/trunk/; revision=9360
2003-11-11From Brian Ginsbach: fix handling of IRIX and UNICOS/mp snoop capturesGuy Harris1-3/+3
on loopback interfaces. svn path=/trunk/; revision=8945
2003-11-04Sigh. Some snoop files have 6 bytes of padding; assume the file is aGuy Harris1-29/+77
snoop file unless it has enoguh padding to hold a Shomiti trailer record. (DEAR SUN MICROSYSTEMS: PLEASE DO NOT STUFF 16 OR MORE BYTES OF PADDING INTO A SNOOP PACKET. THANK YOU. HAVE A NICE DAY.) Add a little paranoia about the record and captured data lengths. svn path=/trunk/; revision=8883
2003-10-01Have a pseudo-header for Ethernet packets, giving the size of the FCS -Guy Harris1-3/+33
0 means "there is no FCS in the packet data", 4 means "there is an FCS in the packet data", -1 means "I don't know whether there's an FCS in the packet data, guess based on the packet size". Assume that Ethernet encapsulated inside other protocols has no FCS, by having the "eth" dissector assume that (and not check for an Ethernet pseudo-header). Have "ethertype()" take an argument giving the FCS size; pass 0 when appropriate. Fix up Wiretap routines to set the pseudo-header. This means we no longer use the "generic" seek-and-read routine, so get rid of it. svn path=/trunk/; revision=8574
2003-02-18Sigh. It appears that atmsnoop might, at least for some packets, put 4Guy Harris1-7/+11
bytes of padding into the packet (possibly more, as if it's putting extra stuff in the padding as Shomiti/Finisar Surveyor does, it might be up to 7). Fortunately, Surveyor puts lots of stuff into the padding, so we'll crank up the "snoop vs. Surveyor" check to look for 4 or more bytes. svn path=/trunk/; revision=7167
2003-01-10The Sniffer file formats include a file to identify raw cells; exportGuy Harris1-1/+2
that flag in the ATM pseudo-header, and use it to determine whether a frame is a raw cell or a reassembled frame, rather than using the AAL, as you can have raw AAL5 cells in a capture. svn path=/trunk/; revision=6889
2003-01-09It appears that a channel number of 0 means DTE->DCE, and a channelGuy Harris1-3/+3
number of 1 means DCE->DTE, in DOS Sniffer ATM captures. svn path=/trunk/; revision=6881
2003-01-03Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not justGuy Harris1-9/+9
used for the DOS-based ATM Sniffer. (That's not a great name, but I couldn't think of a better one.) Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture files where reassembled frames don't have trailers, such as the AAL5 trailer, chopped off. That's what at least some versions of the Windows-based ATM Sniffer appear to have. Map the ATM capture file type for NetXRay captures to WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've reverse-engineered, so far, for the pseudo-header; there's more that needs to be done on it, e.g. getting the channel, AAL type, and traffic type (or inferring them if they're not in the packet header). svn path=/trunk/; revision=6840
2002-12-05Sigh. We really *do* have to check whether a capture is a snoop orGuy Harris1-57/+104
Surveyor capture, as there's one link-layer type that UNICOS/mp snoop treats one way and Shomiti Surveyor treats another way. The only way to check that is to look at the first record to see how much padding it has. svn path=/trunk/; revision=6750
2002-11-13From Brian Ginsbach: upport for additional snoop file encapsulations inGuy Harris1-4/+4
UNICOS/mp. svn path=/trunk/; revision=6621
2002-09-04Update some comments.Guy Harris1-9/+17
svn path=/trunk/; revision=6176
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-5/+5
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6115
2002-07-29From Joerg Mayer:Guy Harris1-26/+22
All files: - Replace types from sys/types.h by those from glib.h - Replace ntoh family of macros from netinet/in.h and winsock2.h by g_ntoh family from glib.h - Remove now unneeded includes of sys/types.h, netinet/in.h and winsock2.h wtap.h Move includes to the top svn path=/trunk/; revision=5909
2002-07-16From Graeme Hewson:Guy Harris1-2/+2
Allow "-" as the output file name in Wiretap, referring to the standard error. Optimize the capture loop. Fix some of the error-message printing code in Ethereal and Tethereal. Have Wiretap check whether it can seek on a file descriptor, and pass the results of that test to the file-type-specific "open for output" routine. Have the "open for output" routines for files where we need to seek when writing the file return an error if seeks don't work. svn path=/trunk/; revision=5884
2002-06-07Graeme Hewson noted that zlib has a bug wherein "gzseek()" doesn't setGuy Harris1-4/+2
the internal z_err value for the stream if an "fseek()" call it makes fails, so that if "gzerror()" is subsequently called, it returns Z_OK rather than an error. To work around this, we pass "file_seek()" an "int *err", and have the with-zlib version of "file_seek()" check, if "gzseek()" fails, whether the return value of "file_error()" is 0 and, if so, have it return "errno" instead. svn path=/trunk/; revision=5642
2002-05-26Get rid of an unused variable.Guy Harris1-3/+1
svn path=/trunk/; revision=5571
2002-05-23Set the LANE subtype in the "seek and read" routine.Guy Harris1-2/+14
svn path=/trunk/; revision=5529
2002-05-07Traffic with a traffic type of 0x06 is Signalling AAL traffic, includingGuy Harris1-3/+3
non-Q.2931 SSCOP traffic; change comments to reflect that. svn path=/trunk/; revision=5411
2002-04-30Move the code to guess the traffic type based on the packet contentsGuy Harris1-1/+12
into Wiretap, so that if you read a frame from Wiretap you have what traffic type information could be gleaned from the information in the capture file, and can write the frame out to a capture file where the file contains some or all of that information without having to determine it outside of Wiretap. svn path=/trunk/; revision=5314
2002-04-30Support writing Sun atmsnoop files.Guy Harris1-19/+81
Map MARS to TRAF_UNKNOWN, not TRAF_ILMI. Don't support writing WTAP_ENCAP_NULL files. svn path=/trunk/; revision=5304
2002-04-30Replace the "ngsniffer_atm" with an "atm" pseudo-header, which isn'tGuy Harris1-21/+46
just an image of the ATM Sniffer data. This means that Ethereal doesn't have to know any ATM Sniffer-specific details (that's all hidden in Wiretap), and allows us to add to that pseudo-header fields, traffic types, etc. unknown to ATM Sniffers. Have Wiretap map VPI 0/VCI 5 to the signalling AAL - for some capture files, this might not be necessary, as they may mark all signalling traffic as such, but, on other platforms, we don't know the AAL, so we assume AAL5 except for 0/5 traffic. Doing it in Wiretap lets us hide those details from Ethereal (and lets Ethereal interpret 0/5 traffic as non-signalling traffic, in case that happens to be what it is). We may know that traffic is LANE, but not whether it's LE Control or emulated 802.3/802.5; handle that case. svn path=/trunk/; revision=5302
2002-04-30The first byte of the frame header in atmsnoop does, in fact, contain anGuy Harris1-10/+36
indication of the type of traffic; use it. svn path=/trunk/; revision=5301
2002-03-05Make "wtap_seek_read()" return TRUE on success and FALSE on error, likeGuy Harris1-22/+20
"wtap_read()". Add some additional error checks to the Sniffer file reader. svn path=/trunk/; revision=4875
2002-03-05Have "wtap_seek_read()" return 0 on success and -1 on failure, and takeGuy Harris1-7/+9
an "err" argument that points to an "int" into which to put an error code if it fails. Check for errors in one call to it, and note that we should do so in other places. In the "wtap_seek_read()" call in the TCP graphing code, don't overwrite "cfile.pseudo_header", and make the buffer into which we read the data WTAP_MAX_PACKET_SIZE bytes, as it should be. In some of the file readers for text files, check for errors from the "parse the record header" and "parse the hex dump" routines when reading sequentially. In "csids_seek_read()", fix some calls to "file_error()" to check the error on the random stream (that being what we're reading). svn path=/trunk/; revision=4874
2002-03-02From Joerg Mayer: get rid of "-Wno-unused" flag in some configureGuy Harris1-3/+5
scripts, and check in changes to add _U_ to some unused arguments (some other should perhaps be used, so we leave the _U_ out so that the warnings serve as a reminder to check those). svn path=/trunk/; revision=4847
2002-02-27From Joerg Mayer: remove unused variables and declarations ofGuy Harris1-3/+3
non-existent functions. Remove the "filetype" argument from the "can_write_encap" functions for particular capture file types - the argument value is implicit, in that the routine being called is the routine for that particular file type. svn path=/trunk/; revision=4823
2002-02-08Have Wiretap set the snapshot length to 0 if it can't be derived fromGuy Harris1-2/+2
reading the capture file. Have callers of "wtap_snapshot_length()" treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so that, when writing a capture file in a format that *does* store the snapshot length, we can at least put *something* in the file). If we don't know the snapshot length of the current capture file, don't display a value in the summary window. Don't use "cfile.snap" as the snapshot length option when capturing - doing so causes Ethereal to default, when capturing, to the snapshot length of the last capture file that you read in, rather than to the snapshot length of the last capture you did (or the initial default of "no snapshot length"). Redo the "Capture Options" dialog box to group options into sections with frames around them, and add units to the snapshot length, maximum file size, and capture duration options, as per a suggestion by Ulf Lamping. Also add units to the capture count option. Make the snapshot length, capture count, maximum file size, and capture duration options into a combination of a check box and a spin button. If the check box is not checked, the limit in question is inactive (snapshot length of 65535, no max packet count, no max file size, no max capture duration); if it's checked, the spinbox specifies the limit. Default all of the check boxes to "not checked" and all of the spin boxes to small values. Use "gtk_toggle_button_get_active()" rather than directly fetching the state of a check box. svn path=/trunk/; revision=4709
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4199
2001-10-25Get rid of signed/unsigned comparison warnings in wiretap.Gilbert Ramirez1-4/+4
svn path=/trunk/; revision=4077
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris1-5/+5
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
2001-08-25The return value from "fwrite()" is a "size_t"; make the variable intoGuy Harris1-4/+4
which we store it a "size_t", and then fix up the bugs that were revealed by the compiler warnings that produced - "fwrite()" returns 0, not a negative number, on an I/O error. Fix up some other items to have type "size_t", or to have various unsigned types, while we're at it, to squelch compiler warnings. svn path=/trunk/; revision=3867
2001-08-25Sigh. Shomiti apparently didn't know that the RFC 1761 data link typesGuy Harris1-16/+99
were just DLPI data link types, and didn't know that the list had expanded at some point and that Sun *used* some of the new types (e.g., in atmsnoop), or decided on their own to go beyond those types to encode an Oh-So-Useful link speed indication, or just didn't *care* that they were just DLPI data link types. Therefore, we have to map Shomiti link types to wiretap types using a different mapping table. For now, we assume files with a version number of 2 are snoop files, and version numbers of 3, 4, and 5 are Shomiti files; Shomiti claims to use a version number of 2 as well, but to determine whether a file with a version number of 2 is a snoop file or a Shomiti file requires that we look at the header of the first packet and assume that if there's more than 3 bytes of padding it's a Shomiti file. The return value from "fwrite()" is a "size_t"; make the variable into which we store it a "size_t", and then fix up the bugs that were revealed by the compiler warnings that produced - "fwrite()" returns 0, not a negative number, on an I/O error. svn path=/trunk/; revision=3866
2001-03-10Obliging every capture file reader's "open()" routine to seek to theGuy Harris1-3/+1
beginning of the file before reading anything from the file is bogus - do that in the loop that tries each of the open routines, instead. (They may have to reset the seek pointer later if, for example, the capture file begins with the first packet, and the "open()" routine looks at that packet to try to guess whether the packet is in the file format in question.) Set "wth->data_offset" to 0 while you're at it, so capture file readers don't have to do that, either. svn path=/trunk/; revision=3123
2000-11-17Add #include <string.h>, to get prototypes for mem* and str* functions.Gilbert Ramirez1-1/+2
svn path=/trunk/; revision=2654
2000-09-21Make sure to pass the sent/received direction from pppdump.c inGilbert Ramirez1-3/+3
pseudo_header. Use generic "p2p_phdr" instead of "lapd_phdr". Modify toshiba.c and packet-lapd.c to take that into account. Add frame.p2p_dir, a filterable field, 0=sent, 1=recvd Make p2p_dir available in packe_info, as I think it will be needed in VJ COMP and UNCOMP dissection. Rename WTAP_ENCAP_TR to WTAP_ENCAP_TOKEN_RING. Mention pppd-log support in man page. Mention atmsnoop in README. svn path=/trunk/; revision=2455
2000-09-19Shomiti Surveyor 3.x appears to have changed the version number in theGuy Harris1-3/+9
file header to 4; fortunately, as they appear to put their extensions to snoop into the padding at the end of the record, all their capture files look alike to programs such as snoop and Ethereal that ignore the padding, so we can just treat version 4 just like version 2 (unless and until Brent decides a new snoop format is called for, changes the record header, and picks a version number that's the same as one used by Shomiti). svn path=/trunk/; revision=2447
2000-09-07Change wtap_read() API so that the data offset is set via a pointer, andGilbert Ramirez1-16/+12
a "keep reading" boolean value is returned from the function. This avoids having to hack around the fact that some file formats truly do have records that start at offset 0. (i4btrace and csids have no file header. Neither does the pppdump-style file that I'm looking at right now). svn path=/trunk/; revision=2392
2000-07-26Use unsigned character pointers and arrays rather than signed characterGuy Harris1-3/+3
pointers and arrays in a number of places, to remove warnings some compilers give. svn path=/trunk/; revision=2160
2000-05-19Add wtap-int.h. Move definitions relevant to the internal workins of wiretapGilbert Ramirez1-8/+8
to that file, leave public definitions in wtap.h. Rename "union pseudo_header" to "union wtap_pseudo_header". Make the wtap_pseudo_header pointer available in packet_info struct. svn path=/trunk/; revision=1989
2000-05-19In Wiretap, a file stream handle is a "FILE_T", not a "FILE_T *" (aGuy Harris1-5/+5
"FILE_T" is either a "gzFile" or a "FILE *", depending on whether zlib support is enabled or not). Fix various function declarations and definitions. svn path=/trunk/; revision=1984
2000-05-18Remove the "union pseudo_header" from the "frame_data" structure;Guy Harris1-49/+100
there's no need to keep it around in memory - when the frame data is read in when handing a frame, read in the information, if any, necessary to reconstruct the frame header, and reconstruct it. This saves some memory. This requires that the seek-and-read function be implemented inside Wiretap, and that the Wiretap handle remain open even after we've finished reading the file sequentially. This also points out that we can't really do X.25-over-Ethernet correctly, as we don't know where the direction (DTE->DCE or DCE->DTE) flag is stored; it's not clear how the Ethernet type 0x0805 for X.25 Layer 3 is supposed to be handled in any case. We eliminate X.25-over-Ethernet support (until we find out what we're supposed to do). svn path=/trunk/; revision=1975
2000-02-19Use WTAP_ERR_UNSUPPORTED_ENCAP for all attempts to open or read aGuy Harris1-2/+2
capture file for an unsupported link-layer encapsulation type (as the nettl reader does), and report it correctly if it occurs on an open or read attempt rather than a save attempt. svn path=/trunk/; revision=1647
2000-01-22Fix files that had Gilbert's old e-mail address or that didn't have myGuy Harris1-2/+2
forwarding e-mail address. svn path=/trunk/; revision=1522
2000-01-13We are obliged to define HAVE_UNISTD_H in "config.h"; to avoid theGuy Harris1-2/+2
hideous problem on FreeBSD 3.[23] (and perhaps other BSDs) if HAVE_UNISTD_H is defined before "zlib.h" is included, turn "file_seek()" into a subroutine defined in a file that *undefines* HAVE_UNISTD_H before including "zlib.h", so that the *only* call to "gzseek()" is made from a file that does not have HAVE_UNISTD_H defined when it includes "zlib.h". Move "file_error()" to that file while you're at it, so it holds all the wrappers that hide the presence or absence of zlib from routines to read capture files. Turn "file.h", which declared those wrapper functions as well as wrapper macros, into "file_wrapper.h" - it belongs with the "file_wrapper.c" file that defines the wrapper functions, not with "file.c" which handles higher-layer file access functions. Remove the comment in "configure.in" that explained why defining HAVE_UNISTD_H was a bad idea, as we're not obliged to define it and work around the problem. (The comment in "file_wrapper.c" explains the workaround.) svn path=/trunk/; revision=1463
1999-12-04Fields in the "snoop" file header are big-endian; write them as such.Guy Harris1-3/+3
svn path=/trunk/; revision=1204
1999-12-04Fix some names.Guy Harris1-2/+2
svn path=/trunk/; revision=1203
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-13 02:52:06 +0000