aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/wtap-int.h
AgeCommit message (Collapse)AuthorFilesLines
2004-02-06Whether frames in an AiroPeek V9 802.11 capture have 4 bytes of 0 or anGuy Harris1-1/+6
FCS at the end appears to depend on the network subtype value. svn path=/trunk/; revision=10001
2004-01-25Have the Wiretap open, read, and seek-and-read routines return, inGuy Harris1-3/+3
addition to an error code, an error info string, for WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with "g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed strings returned as the error info string, and change the callers of those routines to, for those errors, put the info string into the printed message or alert box for the error. Add messages for cases where those errors were returned without printing an additional message. Nobody uses the error code from "cf_read()" - "cf_read()" puts up the alert box itself for failures; get rid of the error code, so it just returns a success/failure indication. Rename "file_read_error_message()" to "cf_read_error_message()", as it handles read errors from Wiretap, and have it take an error info string as an argument. (That handles a lot of the work of putting the info string into the error message.) Make some variables in "ascend-grammar.y" static. Check the return value of "erf_read_header()" in "erf_seek_read()". Get rid of an unused #define in "i4btrace.c". svn path=/trunk/; revision=9852
2004-01-05 removed some MSVC warnings (level 3)Ulf Lamping1-3/+3
svn path=/trunk/; revision=9558
2003-11-06From Scott Emberley: support for writing Network Instruments ObserverGuy Harris1-1/+7
files. svn path=/trunk/; revision=8900
2003-10-24Move the version number checking for libpcap files, to see whether toGuy Harris1-1/+8
swap the "captured length" and "length" fields, to the open-file code; store a tri-state (definitely swapped, definitely not swapped, maybe swapped) value in the per-capture-file-format information for libpcap format, and use that when processing packets. svn path=/trunk/; revision=8774
2003-10-01Have a pseudo-header for Ethernet packets, giving the size of the FCS -Guy Harris1-2/+2
0 means "there is no FCS in the packet data", 4 means "there is an FCS in the packet data", -1 means "I don't know whether there's an FCS in the packet data, guess based on the packet size". Assume that Ethernet encapsulated inside other protocols has no FCS, by having the "eth" dissector assume that (and not check for an Ethernet pseudo-header). Have "ethertype()" take an argument giving the FCS size; pass 0 when appropriate. Fix up Wiretap routines to set the pseudo-header. This means we no longer use the "generic" seek-and-read routine, so get rid of it. svn path=/trunk/; revision=8574
2003-08-26From Jesper Peterson: support for Endace ERF file format.Guy Harris1-1/+8
svn path=/trunk/; revision=8272
2003-07-29Clean up argument names.Guy Harris1-3/+3
svn path=/trunk/; revision=8097
2003-07-29Use GLib's macros for converting from host byte order to little-endian.Guy Harris1-17/+3
svn path=/trunk/; revision=8096
2003-07-29From Thierry Martin: support for reading files from Accellent 5Views LANGuy Harris1-1/+6
agents. svn path=/trunk/; revision=8093
2003-01-10It looks as if a value of 0xfa in the second byte of a REC_HEADER2Guy Harris1-2/+1
record might indicate an ISDN capture; treat that as an indication that a capture is an ISDN capture. svn path=/trunk/; revision=6893
2003-01-09It appears that ATM sniffer files with 4.x versions 4.95 and greaterGuy Harris1-1/+3
have a bogus record length for type 4 records, but earlier 4.x versions, and 5.x versions, don't. svn path=/trunk/; revision=6880
2003-01-07Properly turn the raw ISDN channel number field into an actual channelGuy Harris1-1/+2
number. Put in some commented-out code to deal with some end-of-packet crud in some ISDN captures - not all ISDN captures have it, so we can't unconditionally slice it out. svn path=/trunk/; revision=6867
2002-11-27The arguments to the "pntoh" and "pletoh" macros could be constGuy Harris1-41/+41
pointers, so cast them to "const guint8 *". svn path=/trunk/; revision=6678
2002-11-01Fix up the handling of WAN captures somewhat, based on looking at aGuy Harris1-2/+3
bunch of those captures. svn path=/trunk/; revision=6536
2002-10-31Discard the WTAP_ENCAP_LAPD encapsulation type in favor of aGuy Harris1-2/+1
WTAP_ENCAP_ISDN encapsulation type, which includes a pseudo-header giving the direction (user-to-network or network-to-user) and the channel number. Add a new circuit type, using the ISDN channel number as the circuit ID. Add an ISDN dissector to put the direction and channel number into the protocol tree and to call the appropriate dissector for the payload based on the channel (LAPD for the D channel; V.120, PPP, or data for B channels, based on some heuristics). svn path=/trunk/; revision=6521
2002-10-15From Jason House: include <winsock2.h> early in "wtap-int.h" on Win32Guy Harris1-1/+4
builds with zlib - "zlib.h", alas, includes <winsock.h>, and you can't include <winsock.h> before including <winsock2.h> (at least you can include <winsock2.h> before including <winsock.h>; thank heaven for small favors). svn path=/trunk/; revision=6427
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-4/+4
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6115
2002-07-31Use <zlib.h> instead of "zlib.h"Jörg Mayer1-2/+2
svn path=/trunk/; revision=5926
2002-07-29From Joerg Mayer:Guy Harris1-10/+2
All files: - Replace types from sys/types.h by those from glib.h - Replace ntoh family of macros from netinet/in.h and winsock2.h by g_ntoh family from glib.h - Remove now unneeded includes of sys/types.h, netinet/in.h and winsock2.h wtap.h Move includes to the top svn path=/trunk/; revision=5909
2002-06-23WinPcap 2.3's <pcap.h> includes <packet32.h>, and WinPcap 2.3'sGuy Harris1-3/+3
<packet32.h> includes <winsock2.h>; we include that rather than <winsock.h>, to avoid errors due to conflicting declarations in <winsock.h> and <winsock2.h>. svn path=/trunk/; revision=5742
2002-04-08Add an encapsulation type for "802.11 with radio information"; that typeGuy Harris1-8/+8
returns radio information such as signal strength, channel, and data rate in a pseudo-header. Add that pseudo-header. Use the "802.11 with radio information" encapsulation type for Wireless Sniffer files; extract the radio information from where it appears to be in the header. Add dissector code for that encapsulation type. Fix an error in the code to put radio information into the AiroPeek tree. Make the "wrapped" flag for NetXRay/Windows Sniffer captures a "gboolean". svn path=/trunk/; revision=5122
2002-04-07Make the end-of-packet padding a per-capture-file property.Guy Harris1-1/+2
Read in the entire packet, including the padding, and just tell our caller about the non-padding part; that avoids doing a "file_seek()" ("fseek()"s are inefficient on some platforms, as they flush the standard I/O buffers and do an "lseek()"), and would also let us supply the padding to the caller if it turns out it's an FCS rather than padding. svn path=/trunk/; revision=5107
2002-03-05Make "wtap_seek_read()" return TRUE on success and FALSE on error, likeGuy Harris1-3/+3
"wtap_read()". Add some additional error checks to the Sniffer file reader. svn path=/trunk/; revision=4875
2002-03-05Have "wtap_seek_read()" return 0 on success and -1 on failure, and takeGuy Harris1-3/+2
an "err" argument that points to an "int" into which to put an error code if it fails. Check for errors in one call to it, and note that we should do so in other places. In the "wtap_seek_read()" call in the TCP graphing code, don't overwrite "cfile.pseudo_header", and make the buffer into which we read the data WTAP_MAX_PACKET_SIZE bytes, as it should be. In some of the file readers for text files, check for errors from the "parse the record header" and "parse the hex dump" routines when reading sequentially. In "csids_seek_read()", fix some calls to "file_error()" to check the error on the random stream (that being what we're reading). svn path=/trunk/; revision=4874
2002-01-18The time base in an EtherPeek capture isn't necessarily the start timeGuy Harris1-2/+2
of the capture, so change some names and comments. svn path=/trunk/; revision=4563
2002-01-18In the EtherPeek file reader, keep the capture start time in a privateGuy Harris1-1/+6
data structure attached to the "wtap" structure, rather than in a pseudo-header structure; get rid of the EtherPeek pseudo-header structure, as it's not actually used as a pseudo-header, it's just used as private data for the EtherPeek reader. Get rid of an extra level of indentation in switch statements. svn path=/trunk/; revision=4561
2001-12-13Don't leak memory when closing a pppdump trace file.Gilbert Ramirez1-1/+6
The second argument to g_ptr_array_free() does not indicate to glib to free the objects that the pointers in the GPtrArray refer to, but simply whether or not the free the block of pointers. We have to free the objects ourselves. svn path=/trunk/; revision=4391
2001-12-04Make the bytes-written information from Wiretap a long, as we allowGuy Harris1-2/+2
files to get that big. From Thomas Wittwer and Matthias Nyffenegger: Support for "ring buffer mode", wherein there's a ring buffer of N capture files; as each capture file reaches its maximum size (the ring buffer works only with a maximum capture file size specified), Ethereal rolls over to the next capture file in the ring buffer, replacing whatever packets might be in it with new packets. svn path=/trunk/; revision=4323
2001-12-04Support for stopping capture at specified capture file size or captureGuy Harris1-1/+2
duration, from Thomas Wittwer and Matthias Nyffenegger. svn path=/trunk/; revision=4322
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4199
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris1-4/+4
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
2001-08-25The return value from "fwrite()" is a "size_t"; make the variable intoGuy Harris1-5/+5
which we store it a "size_t", and then fix up the bugs that were revealed by the compiler warnings that produced - "fwrite()" returns 0, not a negative number, on an I/O error. Fix up some other items to have type "size_t", or to have various unsigned types, while we're at it, to squelch compiler warnings. svn path=/trunk/; revision=3867
2001-02-13You have to define "htolell()" on little-endian platforms, too....Guy Harris1-4/+5
svn path=/trunk/; revision=3028
2001-02-13Changes from Chris Jepeway toGuy Harris1-19/+68
in some places use "guint64", on plaforms where it's available, rather than floating point (we don't yet use it universally, as we'd have to provide code to do 64-bit arithmetic on platforms/compilers where 64-bit integral types aren't supported); use .838096 microseconds rather than 1 microseconds as the time stamp units for NetXRay 2.x format, as those capture files seem to use that time stamp (that's the Sniffer "PC" time stamp; perhaps when Network Associates assimilated Cinco, they changed the time stamp units). svn path=/trunk/; revision=3027
2000-11-12"wtap_loop()" no longer has problems with packet offsets of 0, so weGuy Harris1-2/+2
don't need to work around that. The offset, for a given packet, at which "ascend_seek()" should start searching for that packet's header must be computed separately from the offset, for that packet, at which "ascend_seek()" should start searching for the *next* packet - if the file is a "wdd" capture, and the packet has a "Date:" header and a WD_DIALOUT_DISP header, the search for that packet should start at the beginning of the "Date:" header, but the search for the next packet should start after the WD_DIALOUT_DISP header, as if we start it after the "Date:" header, the search will stop at the packet's own WD_DIALOUT_DISP header, as a packet could have a WD_DIALOUT_DISP header but no "Date:" header. svn path=/trunk/; revision=2620
2000-09-19Add support for reading pppd log files in wiretap.Gilbert Ramirez1-1/+30
svn path=/trunk/; revision=2448
2000-09-07Change wtap_read() API so that the data offset is set via a pointer, andGilbert Ramirez1-2/+2
a "keep reading" boolean value is returned from the function. This avoids having to hack around the fact that some file formats truly do have records that start at offset 0. (i4btrace and csids have no file header. Neither does the pppdump-style file that I'm looking at right now). svn path=/trunk/; revision=2392
2000-08-25Move #include <time.h> into wtap-int.h instead of requiring it inGilbert Ramirez1-1/+2
every C file. I noticed this because of a build break of csids.obj on Win32. svn path=/trunk/; revision=2378
2000-08-11Miscellaneous code cleaningLaurent Deniel1-2/+3
- add <stdarg.h> or <varargs.h> in snprintf.h and remove those inclusions in the other #ifdef NEED_SNPRINTF_H codes - remove the check of multiple inclusions in source (.c) code (there is a bit loss of _cpp_ performance, but I prefer the gain of code reading and maintenance; and nowadays, disk caches and VM are correctly optimized ;-). - protect all (well almost) header files against multiple inclusions - add header (i.e. GPL license) in some include files - reorganize a bit the way header files are included: First: #include <system_include_files> #include <external_package_include_files (e.g. gtk, glib etc.)> Then #include "ethereal_include_files" with the correct HAVE_XXX or NEED_XXX protections. - add some HAVE_XXX checks before including some system header files - add the same HAVE_XXX in wiretap as in ethereal Please forgive me, if I break something (I've only compiled and regression tested on Linux). svn path=/trunk/; revision=2254
2000-08-11If we have a random stream open for a compressed Sniffer file, have theGuy Harris1-6/+9
sequential pass through the file build a list of information about the compressed blobs, with the starting offset in the compressed file and in the uncompressed byte stream for each blob. When seeking on the random stream, check whether the target location is within the uncompressed buffer we currently have; if not, use that list to figure out which blob contains the target location, and read that blob into the buffer. Then, as we now know that the target location is within the uncompressed buffer we currently have, just move the current pointer into that buffer to the target location. This means we don't have to read forwards through any uninteresting blobs in order to seek forwards, and don't have to go all the way back to the beginning and seek forwards in order to seek backwards. svn path=/trunk/; revision=2251
2000-08-08Added wiretap support to read the Cisco Secure Intrusion Detection System ↵Mike Hall1-1/+5
IPLog format. svn path=/trunk/; revision=2231
2000-07-26In the final scene of the horror movie, just when you think the monsterGuy Harris1-2/+1
is finally dead, and you're walking away, it springs up again and attacks. It appears that the ss990915 version of Alexey Kuznetzov's libpcap patch has some extra stuff in the per-packet header for some sort of SMP debugging, and that SuSE Linux 6.3 picked it up. Thus, even if a libpcap file has the modified magic number, we *still* have to go through the usual heuristic hell to figure out what type of file it is. svn path=/trunk/; revision=2164
2000-05-25Support for reading compressed Sniffer files, from Tim Farley, JoergGuy Harris1-1/+13
Mayer, and yours truly. svn path=/trunk/; revision=2002
2000-05-19Add wtap-int.h. Move definitions relevant to the internal workins of wiretapGilbert Ramirez1-0/+250
to that file, leave public definitions in wtap.h. Rename "union pseudo_header" to "union wtap_pseudo_header". Make the wtap_pseudo_header pointer available in packet_info struct. svn path=/trunk/; revision=1989
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-24 13:39:41 +0000