aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/wtap-int.h
AgeCommit message (Collapse)AuthorFilesLines
2010-04-21From Chris Maynard:Guy Harris1-1/+17
Support PPP-over-USB. Don't remove the USB pseudo-header from the packet data for Linux USB packets, just byte-swap it if necessary and have the USB dissector fetch the pseudo-header from the raw packet data. Update USB language ID values. svn path=/trunk/; revision=32534
2010-02-26Move the definitions of all the private data structures out ofGuy Harris1-149/+2
wtap-int.h, and change the unions of pointers to those private data structures into just void *'s. Have the generic wtap close routine free up the private data, rather than the type-specific close routine, just as the wtap_dumper close routine does for its private data. Get rid of close routines that don't do anything any more. svn path=/trunk/; revision=32015
2010-02-24Move the definition of the private data structure from wtap-int.h to theGuy Harris1-7/+0
iSeries capture processor. Parse the start date into year/month/day at the time we see it, rather than for every packet; that means we don't need to allocate a buffer to hold the date as a string (a buffer which we weren't ever freeing). svn path=/trunk/; revision=31981
2010-02-24Define the private data structures for some particular capture fileGuy Harris1-48/+0
types in the modules for those capture file types, not in wtap-int.h, so wtap-int.h doesn't have to change when the code to handle that particular capture type changes, or a new capture file type is added. (Ultimately, we should do this for all the private data structures.) svn path=/trunk/; revision=31974
2009-10-26Get rid of capture.catapult_dct2000, move start time of capture into ↵Martin Mathieson1-6/+0
file_externals instead. Thanks Guy for helping to simplify this file! svn path=/trunk/; revision=30708
2009-06-27Add support for writing pcapng files with multipleMichael Tüxen1-0/+6
encapsulations. This fixes a bug reported by Sake during the Sharkfest 09. Thanks for providing a Netscreen tracefile with multiple link layer types. This patch will be included in Wireshark 1.2.1 and higher. svn path=/trunk/; revision=28862
2009-06-18Fix for bug 3539: Address as signess issue for fcs_len.Michael Tüxen1-1/+1
Bugfix scheduled for 1.2.1. svn path=/trunk/; revision=28768
2009-06-01From Ravi Kondamuru via bug 3457: Stig Bjørlykke1-0/+21
Add support to read citrix netscaler capture file format. From me: - Renamed packet-ns.c to packet-nstrace.c - Rewrote to not use "goto" in netscaler.c - Moved dissecting of coreid svn path=/trunk/; revision=28564
2009-05-22From Kovarththanan Rajaratnam via bug 2680:Gerald Combs1-0/+1
Currently Wireshark doesn't support saving WTAP_ENCAP_BLUETOOTH_H4_WITH_PHDR files as btsnoop files. svn path=/trunk/; revision=28442
2009-05-03Use a dynamic glib array instead of a static C array forMichael Tüxen1-3/+5
storing the interface specific data. svn path=/trunk/; revision=28264
2009-05-02Whitespace change.Michael Tüxen1-1/+1
svn path=/trunk/; revision=28252
2009-03-09P64 fixes.Gerald Combs1-2/+2
svn path=/trunk/; revision=27683
2008-10-24Windows build: #include winsock2.h only when needed.Bill Meier1-1/+2
#include winsock2.h pulls in about 90 distinct .h files and about 140 total .h files. Currently winsock2.h is (mostly unnecessarily) included for each dissector via packet.h/wtap.h. This patch removes #include winsock2.h from wtap.h and then includes winsock2.h (or windows.h) in the few specific places required. With this patch, my Windows Wireshark build takes about 30% less time. svn path=/trunk/; revision=26535
2008-02-10Do the time calculations with 64-bit integers, rather than in floatingGuy Harris1-1/+1
point, so we don't have issues with numbers not being exactly representable; that makes it less likely that the change described below will change a time stamp if it's not fixing the time stamp (i.e., if time_day is 0). The Sniffer manual "Expert Sniffer(R) Network Analyzer Operations, Release 5.50" says that a frame2_rec has a time stamp with an 8-bit time_high field and an 8-bit time_day field. Interpreting the time stamp that way fixes the time stamps in at least some captures; see, for example, bug 2251. Fix/update some comments (for example, the Sniffer documentation is no longer at that URL). svn path=/trunk/; revision=24296
2008-02-09Fix (Sun) compiler warnings as reported by David Kirkby: Part 1Bill Meier1-1/+1
svn path=/trunk/; revision=24295
2008-01-20Introduce BSWAP64() and use it in the pcapng codeStephen Fisher1-1/+10
svn path=/trunk/; revision=24142
2008-01-18decode IDB options (if_tsaccur and if_fcslen)Ulf Lamping1-0/+1
svn path=/trunk/; revision=24133
2008-01-13add very experimental support for pcapng "PCAP Next Generation Dump File ↵Ulf Lamping1-0/+7
Format" - this is incomplete and buggy, be careful! svn path=/trunk/; revision=24079
2007-10-08From Florent DROUIN:Anders Broman1-7/+28
This is a replacement of the existing decoding of ERF files (Extensible Record Format from Endace). For the decoding of the ERF files, according to the "type of record" given in the ERF header, several decoders can be used. Up to now, the decoder is determined according to an environment variable, or with a kind of heuristic. And, all the treatment is done during the file extraction. The new architecture, will separate the ERF file decoding, and the ERF record decoding. The ERF records will be decoded with a specific dissector. This dissector can be configured with options, to replace the environment variable. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1839 svn path=/trunk/; revision=23092
2007-08-21From Shaun Jackman <sjackman@gmail.com> / bug 1753:Richard van der Hoff1-1/+1
* asn1/mpeg/packet-mpeg-pes-template.c: Improved decoding of PES extension header and Pack header. Decode SCR, PTS, and DTS. * asn1/mpeg/mpeg-pes.asn (Pack): Remove. * epan/dissectors/packet-mpeg-pes.c: Regenerate. * wiretap/mpeg.c (mpeg_read): Decode the SCR using integer arithmetic instead of double float arithmetic to prevent rounding error. * wiretap/wtap-int.h (mpeg_t) <t0>: Use time_t instead of double. svn path=/trunk/; revision=22577
2007-06-08From Stephen Donnelly of Endace:Guy Harris1-1/+1
The code for reading ERF files has not been significantly updated since 2004. This patch brings it up to date with a number of changes. 1) Increase number of decodable ERF types from 7 to 12. This covers newer DAG card models and firmware updates. 2) Fix timestamp conversion. Was calculating only microsecond precision, now displaying with nanosecond resolution. Hardware precision is 7.5 to 30 ns depending on model. 3) Allow the user to specify HDLC encapsulation as 'chdlc', 'ppp_serial', 'frelay' or 'mtp2'. This is needed because the ERF HDLC capture formats do not include information on what protocol is used at the next level. This is currently done via an environment variable 'ERF_HDLC_ENCAP' and is analagous to the existing 'ERF_ATM_ENCAP' variable. If the user does not specify an HDLC encapsulation it tries to guess, and falls back to MTP2 for backwards compatibility with Florent's existing behaviour. I know environment variables are ugly, suggestions are welcome. 4) When reading HDLC captures as MTP2, use WTAP_ENCAP_MTP2_WITH_PHDR rather than WTAP_ENCAP_MTP2. This allows us to put the 'Multi-Channel ERF' record 'channel number' field into the MTP2 pseudo header > 'link_number' field. This is then displayed in Frame information, and can be filtered on. (Would be nice if it could be made a display column?) Because the ERF record does not specify whether Annex A is used or not, we pass MTP2_ANNEX_A_USED_UNKNOWN and allow the existing user preference to decide. Move the MTP2_ANNEX_A_ definitions into Wiretap, make the annex_a_used field a guint8, and change MTP2_ANNEX_A_USED_UNKNOWN to 2 so it fits in a guint8. (This means that if you can save an ERF MTP2 file as a libpcap file, the pseudo-header will have MTP2_ANNEX_A_USED_UNKNOWN in it.) svn path=/trunk/; revision=22067
2007-05-29Another sniffer timestamp display fix; addresses bug 866 and other reports.Bill Meier1-1/+1
(Also: change variable name to correctly reflect usage). svn path=/trunk/; revision=21982
2007-05-28Throw in some casts to suppress warnings.Guy Harris1-7/+7
svn path=/trunk/; revision=21971
2007-05-28Change the Wiretap code so that it doesn't dereferenceGuy Harris1-14/+46
possibly-unaligned pointers, and turn on -Wcast-align so at least some future code that does that will fail to compile. svn path=/trunk/; revision=21968
2007-05-05fix win32 build by using wtap_get_num_file_types() instead of direct ↵Ulf Lamping1-0/+2
variable access svn path=/trunk/; revision=21689
2007-03-25All private data for a capture in a Wiretap module must be per-file, notGuy Harris1-1/+7
static to the module. Add the older(?) ID tag for MPEG audio. Just use the ID at the beginning to identify MPEG audio files; don't check the file any further. If the read of the magic number doesn't work, get the error, and, if there is no error (i.e., it's a short read), just return 0 (meaning "no error, but this isn't that type of file). Similarly, if the magic number doesn't match, just return 0, so other types of file are tried. svn path=/trunk/; revision=21192
2006-12-25Fix indentation.Guy Harris1-1/+1
svn path=/trunk/; revision=20213
2006-11-05change all file offsets from long to gint64 so we can - theoretically - ↵Ulf Lamping1-9/+9
handle files > 2GB correct. Please distclean Win32 builds! svn path=/trunk/; revision=19814
2006-04-14From Martin Mathieson:Anders Broman1-0/+11
patch and new files provide support for Catapult DCT2000 .out files to wiretap and ethereal. This wiretap support (catapult_dct2000.c+h) appends a short header to each packet giving some context, and a corresponding ethereal dissector (packet-catapult-dct2000.c) parses this before passing the real payload onto an existing ethereal dissector (for ethernet, ip, lapd, ppp, frame-relay,...). For now, there is only support for saving dct2000 files in their own format, although I may add support for converting between dct2000 and libpcap later. updated version of these files and patch, now with support for MTP2. Olivier's trace used the ANSI variant - the MTP2 and MTP3 decode fine with the right preferences set (although the ISUP dissector reports a reserved/retired message type). Witha a change to NOT to declare gboolean catapult_dct2000_board_ports_only; as extern as MSVC choked on it. svn path=/trunk/; revision=17862
2005-11-25From Martin Warnes:Anders Broman1-0/+7
Add Support for reading of IBM iSeries (AS/400) Comms traces svn path=/trunk/; revision=16588
2005-10-22Add #defines for the DOS Sniffer network types and for various frameGuy Harris1-1/+1
status field bits". Check for "Internetwork analyzer" captures by checking the Sniffer network type, and save that type rather than just an "ATM or not" flag in the private data. svn path=/trunk/; revision=16283
2005-09-14added compression support for capture file output. The Save/As dialog now ↵Ulf Lamping1-0/+3
has a checkbox "Compress with gzip" currently limited to Ethereal and all the variants of libpcap filetypes only. We might want to add output compression support to the other tools as well (tethereal, mergecap, ...). We might also want to add support for the other filetypes, but this is only possible if the filetype functions doesn't use special output operations like fseek. One bug is still left: if the input and output filetypes while saving are the same, Ethereal currently optimizes this by simply copy the binary file instead of using wiretap (so it will be faster but it will ignore the compress setting). Don't know a good workaround for this, as I don't know a way to find out if the input file is currently compressed or not. One idea might be to use a heuristic on the filesize (compared to the packet size summmary). Another workaround I see is to remove this optimization, which is of course not the way I like to do it ... svn path=/trunk/; revision=15804
2005-09-09From Bill Meier:Guy Harris1-1/+3
define "timezone" as "gint16", as it can be positive (west of UTC) or negative (east of UTC); update comments to refer to the new names for structure members; say the precision of the time stamps is 1 nanosecond only if the ticks per second is > 10 million; fix the handling of files truncated exactly on a frame boundary. svn path=/trunk/; revision=15739
2005-08-30Add support for slightly modified libpcap file format with nanosecond ↵Ulf Lamping1-0/+3
resolution (currently supported by Ethereal only). Support for both read and write was added. The file format stays the same as the common libpcap format, only the lower part of the timestamp field uses nanoseconds instead of microseconds. This file format uses the libpcap magic number 0xa1b23c4d. svn path=/trunk/; revision=15623
2005-08-26Ethereal now requires 64-bit integer support, so get rid of the tests ofGuy Harris1-10/+2
G_HAVE_GINT64. Get rid of the floating-point stuff in the Etherpeek Classic file reading code, just use 64-bit integers. Fix up the calculation of the nanoseconds portion of the time stamp. svn path=/trunk/; revision=15544
2005-08-25timestamp display precision:Ulf Lamping1-1/+1
- automatic adjustment depending on file format - manual adjustment through menu items save the setting in the recent file svn path=/trunk/; revision=15534
2005-08-24EVERYTHING IN THE BUILDBOT IS GOING TO BE RED!!! Sorry! Ulf Lamping1-2/+4
I've done more than a day to change the timestamp resolution from microseconds to nanoseconds. As I really don't want to loose those changes, I'm going to check in the changes I've done so far. Hopefully someone else will give me a helping hand with the things left ... What's done: I've changed the timestamp resolution from usec to nsec in almost any place in the sources. I've changed parts of the implementation in nstime.s/.h and a lot of places elsewhere. As I don't understand the editcap source (well, I'm maybe just too tired right now), hopefully someone else might be able to fix this soon. Doing all those changes, we get native nanosecond timestamp resolution in Ethereal. After fixing all the remaining issues, I'll take a look how to display this in a convenient way... As I've also changed the wiretap timestamp resolution from usec to nsec we might want to change the wiretap version number... svn path=/trunk/; revision=15520
2005-06-17- Write rf5 files (I don't think tektronix software will be able to read ↵Luis Ontanon1-0/+8
these, ethereal does) - change k12.atm.vci and k12.atm.vpi into atm.vci and atm.vpi svn path=/trunk/; revision=14682
2005-06-10Initial checkin of the 32 bit tektronix k12 binary format (rf5)Luis Ontanon1-0/+3
There is still much to do, but at the very least it can import files allowing the user to choose which protocols handle the diferent sources. svn path=/trunk/; revision=14606
2004-07-18Set the svn:eol-style property on all text files to "native", so thatGuy Harris1-1/+1
they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-02-06Whether frames in an AiroPeek V9 802.11 capture have 4 bytes of 0 or anGuy Harris1-1/+6
FCS at the end appears to depend on the network subtype value. svn path=/trunk/; revision=10001
2004-01-25Have the Wiretap open, read, and seek-and-read routines return, inGuy Harris1-3/+3
addition to an error code, an error info string, for WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with "g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed strings returned as the error info string, and change the callers of those routines to, for those errors, put the info string into the printed message or alert box for the error. Add messages for cases where those errors were returned without printing an additional message. Nobody uses the error code from "cf_read()" - "cf_read()" puts up the alert box itself for failures; get rid of the error code, so it just returns a success/failure indication. Rename "file_read_error_message()" to "cf_read_error_message()", as it handles read errors from Wiretap, and have it take an error info string as an argument. (That handles a lot of the work of putting the info string into the error message.) Make some variables in "ascend-grammar.y" static. Check the return value of "erf_read_header()" in "erf_seek_read()". Get rid of an unused #define in "i4btrace.c". svn path=/trunk/; revision=9852
2004-01-05 removed some MSVC warnings (level 3)Ulf Lamping1-3/+3
svn path=/trunk/; revision=9558
2003-11-06From Scott Emberley: support for writing Network Instruments ObserverGuy Harris1-1/+7
files. svn path=/trunk/; revision=8900
2003-10-24Move the version number checking for libpcap files, to see whether toGuy Harris1-1/+8
swap the "captured length" and "length" fields, to the open-file code; store a tri-state (definitely swapped, definitely not swapped, maybe swapped) value in the per-capture-file-format information for libpcap format, and use that when processing packets. svn path=/trunk/; revision=8774
2003-10-01Have a pseudo-header for Ethernet packets, giving the size of the FCS -Guy Harris1-2/+2
0 means "there is no FCS in the packet data", 4 means "there is an FCS in the packet data", -1 means "I don't know whether there's an FCS in the packet data, guess based on the packet size". Assume that Ethernet encapsulated inside other protocols has no FCS, by having the "eth" dissector assume that (and not check for an Ethernet pseudo-header). Have "ethertype()" take an argument giving the FCS size; pass 0 when appropriate. Fix up Wiretap routines to set the pseudo-header. This means we no longer use the "generic" seek-and-read routine, so get rid of it. svn path=/trunk/; revision=8574
2003-08-26From Jesper Peterson: support for Endace ERF file format.Guy Harris1-1/+8
svn path=/trunk/; revision=8272
2003-07-29Clean up argument names.Guy Harris1-3/+3
svn path=/trunk/; revision=8097
2003-07-29Use GLib's macros for converting from host byte order to little-endian.Guy Harris1-17/+3
svn path=/trunk/; revision=8096
2003-07-29From Thierry Martin: support for reading files from Accellent 5Views LANGuy Harris1-1/+6
agents. svn path=/trunk/; revision=8093
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-25 08:20:25 +0000