aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/wtap-int.h
AgeCommit message (Collapse)AuthorFilesLines
2006-11-05change all file offsets from long to gint64 so we can - theoretically - ↵Ulf Lamping1-9/+9
handle files > 2GB correct. Please distclean Win32 builds! svn path=/trunk/; revision=19814
2006-04-14From Martin Mathieson:Anders Broman1-0/+11
patch and new files provide support for Catapult DCT2000 .out files to wiretap and ethereal. This wiretap support (catapult_dct2000.c+h) appends a short header to each packet giving some context, and a corresponding ethereal dissector (packet-catapult-dct2000.c) parses this before passing the real payload onto an existing ethereal dissector (for ethernet, ip, lapd, ppp, frame-relay,...). For now, there is only support for saving dct2000 files in their own format, although I may add support for converting between dct2000 and libpcap later. updated version of these files and patch, now with support for MTP2. Olivier's trace used the ANSI variant - the MTP2 and MTP3 decode fine with the right preferences set (although the ISUP dissector reports a reserved/retired message type). Witha a change to NOT to declare gboolean catapult_dct2000_board_ports_only; as extern as MSVC choked on it. svn path=/trunk/; revision=17862
2005-11-25From Martin Warnes:Anders Broman1-0/+7
Add Support for reading of IBM iSeries (AS/400) Comms traces svn path=/trunk/; revision=16588
2005-10-22Add #defines for the DOS Sniffer network types and for various frameGuy Harris1-1/+1
status field bits". Check for "Internetwork analyzer" captures by checking the Sniffer network type, and save that type rather than just an "ATM or not" flag in the private data. svn path=/trunk/; revision=16283
2005-09-14added compression support for capture file output. The Save/As dialog now ↵Ulf Lamping1-0/+3
has a checkbox "Compress with gzip" currently limited to Ethereal and all the variants of libpcap filetypes only. We might want to add output compression support to the other tools as well (tethereal, mergecap, ...). We might also want to add support for the other filetypes, but this is only possible if the filetype functions doesn't use special output operations like fseek. One bug is still left: if the input and output filetypes while saving are the same, Ethereal currently optimizes this by simply copy the binary file instead of using wiretap (so it will be faster but it will ignore the compress setting). Don't know a good workaround for this, as I don't know a way to find out if the input file is currently compressed or not. One idea might be to use a heuristic on the filesize (compared to the packet size summmary). Another workaround I see is to remove this optimization, which is of course not the way I like to do it ... svn path=/trunk/; revision=15804
2005-09-09From Bill Meier:Guy Harris1-1/+3
define "timezone" as "gint16", as it can be positive (west of UTC) or negative (east of UTC); update comments to refer to the new names for structure members; say the precision of the time stamps is 1 nanosecond only if the ticks per second is > 10 million; fix the handling of files truncated exactly on a frame boundary. svn path=/trunk/; revision=15739
2005-08-30Add support for slightly modified libpcap file format with nanosecond ↵Ulf Lamping1-0/+3
resolution (currently supported by Ethereal only). Support for both read and write was added. The file format stays the same as the common libpcap format, only the lower part of the timestamp field uses nanoseconds instead of microseconds. This file format uses the libpcap magic number 0xa1b23c4d. svn path=/trunk/; revision=15623
2005-08-26Ethereal now requires 64-bit integer support, so get rid of the tests ofGuy Harris1-10/+2
G_HAVE_GINT64. Get rid of the floating-point stuff in the Etherpeek Classic file reading code, just use 64-bit integers. Fix up the calculation of the nanoseconds portion of the time stamp. svn path=/trunk/; revision=15544
2005-08-25timestamp display precision:Ulf Lamping1-1/+1
- automatic adjustment depending on file format - manual adjustment through menu items save the setting in the recent file svn path=/trunk/; revision=15534
2005-08-24EVERYTHING IN THE BUILDBOT IS GOING TO BE RED!!! Sorry! Ulf Lamping1-2/+4
I've done more than a day to change the timestamp resolution from microseconds to nanoseconds. As I really don't want to loose those changes, I'm going to check in the changes I've done so far. Hopefully someone else will give me a helping hand with the things left ... What's done: I've changed the timestamp resolution from usec to nsec in almost any place in the sources. I've changed parts of the implementation in nstime.s/.h and a lot of places elsewhere. As I don't understand the editcap source (well, I'm maybe just too tired right now), hopefully someone else might be able to fix this soon. Doing all those changes, we get native nanosecond timestamp resolution in Ethereal. After fixing all the remaining issues, I'll take a look how to display this in a convenient way... As I've also changed the wiretap timestamp resolution from usec to nsec we might want to change the wiretap version number... svn path=/trunk/; revision=15520
2005-06-17- Write rf5 files (I don't think tektronix software will be able to read ↵Luis Ontanon1-0/+8
these, ethereal does) - change k12.atm.vci and k12.atm.vpi into atm.vci and atm.vpi svn path=/trunk/; revision=14682
2005-06-10Initial checkin of the 32 bit tektronix k12 binary format (rf5)Luis Ontanon1-0/+3
There is still much to do, but at the very least it can import files allowing the user to choose which protocols handle the diferent sources. svn path=/trunk/; revision=14606
2004-07-18Set the svn:eol-style property on all text files to "native", so thatGuy Harris1-1/+1
they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-02-06Whether frames in an AiroPeek V9 802.11 capture have 4 bytes of 0 or anGuy Harris1-1/+6
FCS at the end appears to depend on the network subtype value. svn path=/trunk/; revision=10001
2004-01-25Have the Wiretap open, read, and seek-and-read routines return, inGuy Harris1-3/+3
addition to an error code, an error info string, for WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with "g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed strings returned as the error info string, and change the callers of those routines to, for those errors, put the info string into the printed message or alert box for the error. Add messages for cases where those errors were returned without printing an additional message. Nobody uses the error code from "cf_read()" - "cf_read()" puts up the alert box itself for failures; get rid of the error code, so it just returns a success/failure indication. Rename "file_read_error_message()" to "cf_read_error_message()", as it handles read errors from Wiretap, and have it take an error info string as an argument. (That handles a lot of the work of putting the info string into the error message.) Make some variables in "ascend-grammar.y" static. Check the return value of "erf_read_header()" in "erf_seek_read()". Get rid of an unused #define in "i4btrace.c". svn path=/trunk/; revision=9852
2004-01-05 removed some MSVC warnings (level 3)Ulf Lamping1-3/+3
svn path=/trunk/; revision=9558
2003-11-06From Scott Emberley: support for writing Network Instruments ObserverGuy Harris1-1/+7
files. svn path=/trunk/; revision=8900
2003-10-24Move the version number checking for libpcap files, to see whether toGuy Harris1-1/+8
swap the "captured length" and "length" fields, to the open-file code; store a tri-state (definitely swapped, definitely not swapped, maybe swapped) value in the per-capture-file-format information for libpcap format, and use that when processing packets. svn path=/trunk/; revision=8774
2003-10-01Have a pseudo-header for Ethernet packets, giving the size of the FCS -Guy Harris1-2/+2
0 means "there is no FCS in the packet data", 4 means "there is an FCS in the packet data", -1 means "I don't know whether there's an FCS in the packet data, guess based on the packet size". Assume that Ethernet encapsulated inside other protocols has no FCS, by having the "eth" dissector assume that (and not check for an Ethernet pseudo-header). Have "ethertype()" take an argument giving the FCS size; pass 0 when appropriate. Fix up Wiretap routines to set the pseudo-header. This means we no longer use the "generic" seek-and-read routine, so get rid of it. svn path=/trunk/; revision=8574
2003-08-26From Jesper Peterson: support for Endace ERF file format.Guy Harris1-1/+8
svn path=/trunk/; revision=8272
2003-07-29Clean up argument names.Guy Harris1-3/+3
svn path=/trunk/; revision=8097
2003-07-29Use GLib's macros for converting from host byte order to little-endian.Guy Harris1-17/+3
svn path=/trunk/; revision=8096
2003-07-29From Thierry Martin: support for reading files from Accellent 5Views LANGuy Harris1-1/+6
agents. svn path=/trunk/; revision=8093
2003-01-10It looks as if a value of 0xfa in the second byte of a REC_HEADER2Guy Harris1-2/+1
record might indicate an ISDN capture; treat that as an indication that a capture is an ISDN capture. svn path=/trunk/; revision=6893
2003-01-09It appears that ATM sniffer files with 4.x versions 4.95 and greaterGuy Harris1-1/+3
have a bogus record length for type 4 records, but earlier 4.x versions, and 5.x versions, don't. svn path=/trunk/; revision=6880
2003-01-07Properly turn the raw ISDN channel number field into an actual channelGuy Harris1-1/+2
number. Put in some commented-out code to deal with some end-of-packet crud in some ISDN captures - not all ISDN captures have it, so we can't unconditionally slice it out. svn path=/trunk/; revision=6867
2002-11-27The arguments to the "pntoh" and "pletoh" macros could be constGuy Harris1-41/+41
pointers, so cast them to "const guint8 *". svn path=/trunk/; revision=6678
2002-11-01Fix up the handling of WAN captures somewhat, based on looking at aGuy Harris1-2/+3
bunch of those captures. svn path=/trunk/; revision=6536
2002-10-31Discard the WTAP_ENCAP_LAPD encapsulation type in favor of aGuy Harris1-2/+1
WTAP_ENCAP_ISDN encapsulation type, which includes a pseudo-header giving the direction (user-to-network or network-to-user) and the channel number. Add a new circuit type, using the ISDN channel number as the circuit ID. Add an ISDN dissector to put the direction and channel number into the protocol tree and to call the appropriate dissector for the payload based on the channel (LAPD for the D channel; V.120, PPP, or data for B channels, based on some heuristics). svn path=/trunk/; revision=6521
2002-10-15From Jason House: include <winsock2.h> early in "wtap-int.h" on Win32Guy Harris1-1/+4
builds with zlib - "zlib.h", alas, includes <winsock.h>, and you can't include <winsock.h> before including <winsock2.h> (at least you can include <winsock2.h> before including <winsock.h>; thank heaven for small favors). svn path=/trunk/; revision=6427
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-4/+4
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6115
2002-07-31Use <zlib.h> instead of "zlib.h"Jörg Mayer1-2/+2
svn path=/trunk/; revision=5926
2002-07-29From Joerg Mayer:Guy Harris1-10/+2
All files: - Replace types from sys/types.h by those from glib.h - Replace ntoh family of macros from netinet/in.h and winsock2.h by g_ntoh family from glib.h - Remove now unneeded includes of sys/types.h, netinet/in.h and winsock2.h wtap.h Move includes to the top svn path=/trunk/; revision=5909
2002-06-23WinPcap 2.3's <pcap.h> includes <packet32.h>, and WinPcap 2.3'sGuy Harris1-3/+3
<packet32.h> includes <winsock2.h>; we include that rather than <winsock.h>, to avoid errors due to conflicting declarations in <winsock.h> and <winsock2.h>. svn path=/trunk/; revision=5742
2002-04-08Add an encapsulation type for "802.11 with radio information"; that typeGuy Harris1-8/+8
returns radio information such as signal strength, channel, and data rate in a pseudo-header. Add that pseudo-header. Use the "802.11 with radio information" encapsulation type for Wireless Sniffer files; extract the radio information from where it appears to be in the header. Add dissector code for that encapsulation type. Fix an error in the code to put radio information into the AiroPeek tree. Make the "wrapped" flag for NetXRay/Windows Sniffer captures a "gboolean". svn path=/trunk/; revision=5122
2002-04-07Make the end-of-packet padding a per-capture-file property.Guy Harris1-1/+2
Read in the entire packet, including the padding, and just tell our caller about the non-padding part; that avoids doing a "file_seek()" ("fseek()"s are inefficient on some platforms, as they flush the standard I/O buffers and do an "lseek()"), and would also let us supply the padding to the caller if it turns out it's an FCS rather than padding. svn path=/trunk/; revision=5107
2002-03-05Make "wtap_seek_read()" return TRUE on success and FALSE on error, likeGuy Harris1-3/+3
"wtap_read()". Add some additional error checks to the Sniffer file reader. svn path=/trunk/; revision=4875
2002-03-05Have "wtap_seek_read()" return 0 on success and -1 on failure, and takeGuy Harris1-3/+2
an "err" argument that points to an "int" into which to put an error code if it fails. Check for errors in one call to it, and note that we should do so in other places. In the "wtap_seek_read()" call in the TCP graphing code, don't overwrite "cfile.pseudo_header", and make the buffer into which we read the data WTAP_MAX_PACKET_SIZE bytes, as it should be. In some of the file readers for text files, check for errors from the "parse the record header" and "parse the hex dump" routines when reading sequentially. In "csids_seek_read()", fix some calls to "file_error()" to check the error on the random stream (that being what we're reading). svn path=/trunk/; revision=4874
2002-01-18The time base in an EtherPeek capture isn't necessarily the start timeGuy Harris1-2/+2
of the capture, so change some names and comments. svn path=/trunk/; revision=4563
2002-01-18In the EtherPeek file reader, keep the capture start time in a privateGuy Harris1-1/+6
data structure attached to the "wtap" structure, rather than in a pseudo-header structure; get rid of the EtherPeek pseudo-header structure, as it's not actually used as a pseudo-header, it's just used as private data for the EtherPeek reader. Get rid of an extra level of indentation in switch statements. svn path=/trunk/; revision=4561
2001-12-13Don't leak memory when closing a pppdump trace file.Gilbert Ramirez1-1/+6
The second argument to g_ptr_array_free() does not indicate to glib to free the objects that the pointers in the GPtrArray refer to, but simply whether or not the free the block of pointers. We have to free the objects ourselves. svn path=/trunk/; revision=4391
2001-12-04Make the bytes-written information from Wiretap a long, as we allowGuy Harris1-2/+2
files to get that big. From Thomas Wittwer and Matthias Nyffenegger: Support for "ring buffer mode", wherein there's a ring buffer of N capture files; as each capture file reaches its maximum size (the ring buffer works only with a maximum capture file size specified), Ethereal rolls over to the next capture file in the ring buffer, replacing whatever packets might be in it with new packets. svn path=/trunk/; revision=4323
2001-12-04Support for stopping capture at specified capture file size or captureGuy Harris1-1/+2
duration, from Thomas Wittwer and Matthias Nyffenegger. svn path=/trunk/; revision=4322
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4199
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris1-4/+4
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
2001-08-25The return value from "fwrite()" is a "size_t"; make the variable intoGuy Harris1-5/+5
which we store it a "size_t", and then fix up the bugs that were revealed by the compiler warnings that produced - "fwrite()" returns 0, not a negative number, on an I/O error. Fix up some other items to have type "size_t", or to have various unsigned types, while we're at it, to squelch compiler warnings. svn path=/trunk/; revision=3867
2001-02-13You have to define "htolell()" on little-endian platforms, too....Guy Harris1-4/+5
svn path=/trunk/; revision=3028
2001-02-13Changes from Chris Jepeway toGuy Harris1-19/+68
in some places use "guint64", on plaforms where it's available, rather than floating point (we don't yet use it universally, as we'd have to provide code to do 64-bit arithmetic on platforms/compilers where 64-bit integral types aren't supported); use .838096 microseconds rather than 1 microseconds as the time stamp units for NetXRay 2.x format, as those capture files seem to use that time stamp (that's the Sniffer "PC" time stamp; perhaps when Network Associates assimilated Cinco, they changed the time stamp units). svn path=/trunk/; revision=3027
2000-11-12"wtap_loop()" no longer has problems with packet offsets of 0, so weGuy Harris1-2/+2
don't need to work around that. The offset, for a given packet, at which "ascend_seek()" should start searching for that packet's header must be computed separately from the offset, for that packet, at which "ascend_seek()" should start searching for the *next* packet - if the file is a "wdd" capture, and the packet has a "Date:" header and a WD_DIALOUT_DISP header, the search for that packet should start at the beginning of the "Date:" header, but the search for the next packet should start after the WD_DIALOUT_DISP header, as if we start it after the "Date:" header, the search will stop at the packet's own WD_DIALOUT_DISP header, as a packet could have a WD_DIALOUT_DISP header but no "Date:" header. svn path=/trunk/; revision=2620
2000-09-19Add support for reading pppd log files in wiretap.Gilbert Ramirez1-1/+30
svn path=/trunk/; revision=2448
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-14 18:19:58 +0000