aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/wtap.c
AgeCommit message (Collapse)AuthorFilesLines
2003-12-03From Jeff Morriss: add support for libpcap MTP2 and MTP3 captures.Guy Harris1-3/+12
Add a missing entry in "encap_table[]" for Bluetooth H4, and fix some comments. svn path=/trunk/; revision=9157
2003-10-25Add a new WTAP_ENCAP_CHDLC_WITH_PHDR type, to distinguish Cisco HDLCGuy Harris1-1/+4
captures with packet direction information from captures without it. Use them appropriately. svn path=/trunk/; revision=8780
2003-05-16Fix a typo.Guy Harris1-2/+2
svn path=/trunk/; revision=7681
2003-05-15From Can Erkin Acar: OpenBSD is now using tcpdump.org-assigned DLT_Guy Harris1-2/+8
value for DLT_PFLOG, and that goes along with a change to the link-layer header for DLT_PFLOG - support both the old and new values and format. svn path=/trunk/; revision=7676
2003-03-04A captured length bigger than the actual length makes no sense; clip theGuy Harris1-2/+11
captured length so it's <= the actual length. svn path=/trunk/; revision=7268
2003-01-31Add WTAP_ENCAP_FRELAY_WITH_PHDR for use with Frame Relay capture filesGuy Harris1-1/+4
that have direction information. Support writing WTAP_ENCAP_FRELAY_WITH_PHDR and WTAP_ENCAP_PPP_WITH_PHDR captures out in libpcap format - we throw away the direction information, but so it goes. When reading/writing Windows Sniffer format, read and write the direction flag. svn path=/trunk/; revision=7052
2003-01-23In the BSDs, ARCNET packets don't have an offset field between theGuy Harris1-1/+4
addresses and the protocol type, as supplied by BPF; on Linux, they *do* have an offset field, as supplied by PF_PACKET sockets. Add a new WTAP_ENCAP_ARCNET_LINUX, with packets that include the offset field, and don't dissect an offset in WTAP_ENCAP_ARCNET packets. Map a libpcap link-layer type of 129 to WTAP_ENCAP_ARCNET_LINUX; that value was recently assigned to Linux-style ARCNET. Add some more ARCNET protocol IDs. For most protocol IDs, dissect an ATA 878.2 fragmentation header; don't do it for RFC 1051 IP and ARP, and Diagnose packets. Set the length of the ARCNET protocol tree item appropriately. Dissect both the RFC 1051 and RFC 1201 styles of IP and ARP over ARCNET, and dissect the RFC 1201 style of RARP as well. svn path=/trunk/; revision=6981
2003-01-08From Chris Waters: support Tazmen Sniffer Protocol and DLT_TZSP capturesGuy Harris1-1/+4
from network-based libpcaps that use that protocol. svn path=/trunk/; revision=6875
2003-01-03Add support for SDLC encapsulation in DOS Sniffer captures; thatGuy Harris1-1/+4
includes adding an SDLC dissector. svn path=/trunk/; revision=6848
2003-01-03Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not justGuy Harris1-3/+6
used for the DOS-based ATM Sniffer. (That's not a great name, but I couldn't think of a better one.) Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture files where reassembled frames don't have trailers, such as the AAL5 trailer, chopped off. That's what at least some versions of the Windows-based ATM Sniffer appear to have. Map the ATM capture file type for NetXRay captures to WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've reverse-engineered, so far, for the pseudo-header; there's more that needs to be done on it, e.g. getting the channel, AAL type, and traffic type (or inferring them if they're not in the packet header). svn path=/trunk/; revision=6840
2002-12-20Add an item for Wellfleet HDLC.Guy Harris1-1/+3
svn path=/trunk/; revision=6813
2002-11-06From Solomon Peachy: support for new "wlancap" 802.11 extra-informationGuy Harris1-1/+5
header. Add overflow checks to "BYTES_ARE_IN_FRAME()", and cast all arguments to unsigned values (negative values should never be passed) to squelch compiler warnings. svn path=/trunk/; revision=6567
2002-10-31Discard the WTAP_ENCAP_LAPD encapsulation type in favor of aGuy Harris1-8/+5
WTAP_ENCAP_ISDN encapsulation type, which includes a pseudo-header giving the direction (user-to-network or network-to-user) and the channel number. Add a new circuit type, using the ISDN channel number as the circuit ID. Add an ISDN dissector to put the direction and channel number into the protocol tree and to call the appropriate dissector for the payload based on the channel (LAPD for the D channel; V.120, PPP, or data for B channels, based on some heuristics). svn path=/trunk/; revision=6521
2002-10-22Add a Wiretap encapsulation type for RFC 2625 IP-over-Fibre Channel, andGuy Harris1-1/+4
map libpcap's DLT_IP_OVER_FC to it. svn path=/trunk/; revision=6473
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-5/+5
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6115
2002-08-06From Anand V. Narwani: add an entry for the DOCSIS encapsulation to theGuy Harris1-1/+4
Wiretap table of encapsuations. svn path=/trunk/; revision=5955
2002-07-31From Motonori Shindo: support for reading CoSine L2 debug output.Guy Harris1-1/+4
svn path=/trunk/; revision=5922
2002-07-29From Joerg Mayer:Guy Harris1-2/+2
All files: - Replace types from sys/types.h by those from glib.h - Replace ntoh family of macros from netinet/in.h and winsock2.h by g_ntoh family from glib.h - Remove now unneeded includes of sys/types.h, netinet/in.h and winsock2.h wtap.h Move includes to the top svn path=/trunk/; revision=5909
2002-07-16From Graeme Hewson:Guy Harris1-3/+4
Allow "-" as the output file name in Wiretap, referring to the standard error. Optimize the capture loop. Fix some of the error-message printing code in Ethereal and Tethereal. Have Wiretap check whether it can seek on a file descriptor, and pass the results of that test to the file-type-specific "open for output" routine. Have the "open for output" routines for files where we need to seek when writing the file return an error if seeks don't work. svn path=/trunk/; revision=5884
2002-06-07Add a new error for attempts to open a pipe or FIFO for random access.Guy Harris1-1/+2
Have "wtap_open_offline()", if asked to open a FIFO, return that error if it was asked to open the file for random access. svn path=/trunk/; revision=5643
2002-04-08Use WTAP_ENCAP_IEEE_802_11_WITH_RADIO for AiroPeek files, rather thanGuy Harris1-4/+1
having a special encapsulation type for AiroPeek files. svn path=/trunk/; revision=5123
2002-04-08Add an encapsulation type for "802.11 with radio information"; that typeGuy Harris1-1/+4
returns radio information such as signal strength, channel, and data rate in a pseudo-header. Add that pseudo-header. Use the "802.11 with radio information" encapsulation type for Wireless Sniffer files; extract the radio information from where it appears to be in the header. Add dissector code for that encapsulation type. Fix an error in the code to put radio information into the AiroPeek tree. Make the "wrapped" flag for NetXRay/Windows Sniffer captures a "gboolean". svn path=/trunk/; revision=5122
2002-03-05Make "wtap_seek_read()" return TRUE on success and FALSE on error, likeGuy Harris1-2/+2
"wtap_read()". Add some additional error checks to the Sniffer file reader. svn path=/trunk/; revision=4875
2002-03-05Have "wtap_seek_read()" return 0 on success and -1 on failure, and takeGuy Harris1-4/+6
an "err" argument that points to an "int" into which to put an error code if it fails. Check for errors in one call to it, and note that we should do so in other places. In the "wtap_seek_read()" call in the TCP graphing code, don't overwrite "cfile.pseudo_header", and make the buffer into which we read the data WTAP_MAX_PACKET_SIZE bytes, as it should be. In some of the file readers for text files, check for errors from the "parse the record header" and "parse the hex dump" routines when reading sequentially. In "csids_seek_read()", fix some calls to "file_error()" to check the error on the random stream (that being what we're reading). svn path=/trunk/; revision=4874
2002-02-07Support in Wiretap for DLT_HHDLC, from Tomas Kukosa.Guy Harris1-1/+4
svn path=/trunk/; revision=4707
2002-01-29Untested support for AiroPeek captures.Guy Harris1-1/+4
svn path=/trunk/; revision=4619
2002-01-29Support for capturing on, and reading captures from, OpenBSD firewallGuy Harris1-1/+4
logging virtual interface, from Mike Frantzen. svn path=/trunk/; revision=4616
2001-11-30Add support for LocalTalk Link Access Protocol.Guy Harris1-2/+5
Rename WTAP_ENCAP_PRISM to WTAP_ENCAP_PRISM_HEADER, to match DLT_PRISM_HEADER. Add in missing capture support for WTAP_ENCAP_PRISM_HEADER when capturing with "pcap_open_live()" rather than reading the capture from a pipe. svn path=/trunk/; revision=4299
2001-11-28Support for 802.11+Prism II monitor-mode link-layer headers, fromGuy Harris1-1/+7
Tim Newsham. Add in missing item for WTAP_ENCAP_CISCO_IOS in the Wiretap encapsulation type table. svn path=/trunk/; revision=4290
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4199
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris1-4/+5
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
2001-07-13From Joerg Mayer:Guy Harris1-3/+3
* gcc 3.0 warning fixes: - text2pcap.c: The number of characters to scan should probably not be 0 - wiretap/csids.c: using preincrement on a variable used on both sides of an assignment might be undefined by the C99(?) standard * turn on additional warnings for epan and wiretap too - epan/configure.in - wiretap/configure.in * Fix some warnings (missing includes, signed/unsigned, missing initializers) found by turning on the warnings - all other files :-) svn path=/trunk/; revision=3709
2001-07-05"open_cap_file()" in Ethereal and Tethereal don't use the FILE_T theyGuy Harris1-7/+1
get from calling "wtap_file()", so get rid of the call and the (otherwise unused) variable to which its result gets assigned. That lets us get rid of "wtap_file()" in Wiretap. It also lets us get rid of the include of "zlib.h" in "file.h"; the #defines of "file_open()", "filed_open()", and "file_close()" are also unnecessary, so we get rid of those as well. However, that means we need to include <zlib.h> in "gtk/main.c" and "tethereal.c", so that the version number of libz is defined and can show up in the version string. svn path=/trunk/; revision=3652
2001-03-15Add a new Wiretap encapsulation type for Cisco HDLC. Map the NetBSDGuy Harris1-1/+4
DLT_HDLC to it. Make a separate dissector for Cisco HDLC, and add a dissector for Cisco SLARP. Have the PPP dissector call the Cisco HDLC dissector if the address field is the Cisco HDLC unicast or multicast address. Use the Cisco HDLC dissector for the Cisco HDLC Wiretap encapsulation type. Add a new dissector table "chdlctype", for Cisco HDLC packet types (they're *almost* the same as Ethernet types, but 0x8035 is SLARP, not Reverse ARP, and 0x2000 is the Cisco Discovery protocol, for example), replacing "fr.chdlc". Have a "chdlctype()" routine, similar to "ethertype()", used both by the Cisco HDLC and Frame Relay dissectors. Have a "chdlc_vals[]" "value_string" table for Cisco HDLC types and protocol names. Split the packet type field in the Frame Relay dissector into separate SNAP and Cisco HDLC fields, and give them the Ethernet type and Cisco HDLC type "value_string" tables, respectively. svn path=/trunk/; revision=3133
2001-01-08Code to handle Frame Relay Sniffer captures, from Jeff Foster.Guy Harris1-1/+4
Code to register the Frame Relay dissector to handle Frame Relay captures, from Paul Ionescu. svn path=/trunk/; revision=2845
2000-12-23Add support for the DLT_LINUX_SLL capture type in the current CVSGuy Harris1-1/+3
version of libpcap; that's used on Linux for captures on the "any" device (which captures from all interfaces simultaneously) and for captures on devices whose link-layer type libpcap doesn't (yet) support natively. The spanning tree code, when checking for GV{M,R,...}P packets, must first check whether the link-layer destination address is, in fact, an Ethernet-style address; on Linux cooked captures, there *is* no destination address, so it's of type AT_NONE, not AT_ETHER. svn path=/trunk/; revision=2772
2000-11-15IEEE 802.11 support, from Johan Jorgensen of Axis Communications AB.Guy Harris1-1/+4
Add in stuff for a bunch of libpcap formats either in libpcap 0.5.2 or in the current CVS version; we don't implement all of them in Ethereal/Wiretap (those are "#if 0"ed out), but we do implement the IEEE 802.11 stuff (which isn't yet in libpcap or tcpdump, but the CVS version of libpcap *does* reserve 105 as the encapsulation type number for 802.11). svn path=/trunk/; revision=2646
2000-09-28Add string representation for WTAP_ENCAP_PPP_WITH_PHDRGilbert Ramirez1-1/+5
svn path=/trunk/; revision=2464
2000-09-07Change wtap_read() API so that the data offset is set via a pointer, andGilbert Ramirez1-26/+43
a "keep reading" boolean value is returned from the function. This avoids having to hack around the fact that some file formats truly do have records that start at offset 0. (i4btrace and csids have no file header. Neither does the pppdump-style file that I'm looking at right now). svn path=/trunk/; revision=2392
2000-08-19Fix buffer overflow on zlib uncompression errors.Laurent Deniel1-2/+2
svn path=/trunk/; revision=2299
2000-06-27Add routines to Wiretap to allow a client of Wiretap to get:Guy Harris1-3/+18
a pointer to the "wtap_pkthdr" structure for an open capture file; a pointer to the "wtap_pseudo_header" union for an open capture file; a pointer to the packet buffer for an open capture file; so that a program using "wtap_read()" in a loop can get at those items. Keep, in a "capture_file" structure, an indicator of whether: no file is open; a file is open, and being read; a file is open, and is being read, but the user tried to quit out of reading the file (e.g., by doing "File/Quit"); a file is open, and has been completely read. Abort if we try to close a capture that's being read if the user hasn't tried to quit out of the read. Have "File/Quit" check if a file is being read; if so, just set the state indicator to "user tried to quit out of it", so that the code reading the file can do what's appropriate to clean up, rather than closing the file out from under that code and causing crashes. Have "read_cap_file()" read the capture file with a loop using "wtap_read()", rather than by using "wtap_loop()"; have it check after reading each packet whether the user tried to abort the read and, if so, close the capture and return an indication that the read was aborted by the user. Otherwise, return an indication of whether the read completely succeeded or failed in the middle (and, if it failed, return the error code through a pointer). Have "continue_tail_cap_file()" read the capture file with a loop using "wtap_read()", rather than by using "wtap_loop()"; have it check after reading each packet whether the user tried to abort the read and, if so, quit the loop, and after the loop finishes (even if it read no packets), return an indication that the read was aborted by the user if that happened. Otherwise, return an indication of whether the read completely succeeded or failed in the middle (and, if it failed, return the error code through a pointer). Have "finish_tail_cap_file()" read the capture file with a loop using "wtap_read()", rather than by using "wtap_loop()"; have it check after reading each packet whether the user tried to abort the read and, if so, quit the loop, and after the loop finishes (even if it read no packets), close the capture and return an indication that the read was aborted by the user if that happened. Otherwise, return an indication of whether the read completely succeeded or failed in the middle (and, if it failed, return the error code through a pointer). Have their callers check whether the read was aborted or not and, if it was, bail out in the appropriate fashion (exit if it's reading a file specified by "-r" on the command line; exit the main loop if it's reading a file specified with File->Open; kill the capture child if it's "continue_tail_cap_file()"; exit the main loop if it's "finish_tail_cap_file()". svn path=/trunk/; revision=2095
2000-05-25Support for reading compressed Sniffer files, from Tim Farley, JoergGuy Harris1-3/+13
Mayer, and yours truly. svn path=/trunk/; revision=2002
2000-05-19Add wtap-int.h. Move definitions relevant to the internal workins of wiretapGilbert Ramirez1-3/+3
to that file, leave public definitions in wtap.h. Rename "union pseudo_header" to "union wtap_pseudo_header". Make the wtap_pseudo_header pointer available in packet_info struct. svn path=/trunk/; revision=1989
2000-05-19"wtap.h" doesn't need to include "ascend.h" or "toshiba.h".Guy Harris1-3/+1
svn path=/trunk/; revision=1982
2000-05-18Remove the "union pseudo_header" from the "frame_data" structure;Guy Harris1-19/+26
there's no need to keep it around in memory - when the frame data is read in when handing a frame, read in the information, if any, necessary to reconstruct the frame header, and reconstruct it. This saves some memory. This requires that the seek-and-read function be implemented inside Wiretap, and that the Wiretap handle remain open even after we've finished reading the file sequentially. This also points out that we can't really do X.25-over-Ethernet correctly, as we don't know where the direction (DTE->DCE or DCE->DTE) flag is stored; it's not clear how the Ethernet type 0x0805 for X.25 Layer 3 is supposed to be handled in any case. We eliminate X.25-over-Ethernet support (until we find out what we're supposed to do). svn path=/trunk/; revision=1975
2000-05-12In wiretap, set err to 0 before doing anything inside wtap_loop().Gilbert Ramirez1-1/+4
Tethereal was dying on me because err was initialized to some random value. It was this section of code that would exit even if wtap_loop was successful (returned TRUE) because err was never initialized or set to anything. err = load_cap_file(&cf, out_file_type); if (err != 0) { dissect_cleanup(); exit(2); } <BIGGER sheepish grin> Fixed even more errors in LLC dissector. I had inadvertantly used the wrong tvbuff_t* when calling dissect_data_tvb(). There is no way we are going to be successful in this tvbuff conversion w/o regression testing. I'm working on setting up a simple Makefile for regression testing tonight. That's why I'm finding so many bugs in my LLC conversion. </BIGGER sheepish grin> svn path=/trunk/; revision=1946
2000-04-08Some stuff, like libdencode, needs a wiretap routine that allowsRichard Sharpe1-1/+6
them to simply read through the capture file ... svn path=/trunk/; revision=1819
2000-03-22In a Network Monitor capture file, get the starting offsets of framesGuy Harris1-45/+3
from the frame table - Network Monitor 2.x, at least, doesn't always write frame N+1 right after frame N. To do that, we need to mallocate a big array to hold the frame table, and free it when we close the capture file; this requires that we have capture-file-type-specific close routines as well as capture-file-type-specific read routines - we let it the pointer to that routine be null if it's not needed. Given that, we might as well get rid of the switch statement in "wtap_close()", in favor of using capture-file-type-specific close routines, as per the comment before that switch statement. svn path=/trunk/; revision=1740
2000-01-22Fix files that had Gilbert's old e-mail address or that didn't have myGuy Harris1-2/+2
forwarding e-mail address. svn path=/trunk/; revision=1522
2000-01-13We are obliged to define HAVE_UNISTD_H in "config.h"; to avoid theGuy Harris1-2/+2
hideous problem on FreeBSD 3.[23] (and perhaps other BSDs) if HAVE_UNISTD_H is defined before "zlib.h" is included, turn "file_seek()" into a subroutine defined in a file that *undefines* HAVE_UNISTD_H before including "zlib.h", so that the *only* call to "gzseek()" is made from a file that does not have HAVE_UNISTD_H defined when it includes "zlib.h". Move "file_error()" to that file while you're at it, so it holds all the wrappers that hide the presence or absence of zlib from routines to read capture files. Turn "file.h", which declared those wrapper functions as well as wrapper macros, into "file_wrapper.h" - it belongs with the "file_wrapper.c" file that defines the wrapper functions, not with "file.c" which handles higher-layer file access functions. Remove the comment in "configure.in" that explained why defining HAVE_UNISTD_H was a bad idea, as we're not obliged to define it and work around the problem. (The comment in "file_wrapper.c" explains the workaround.) svn path=/trunk/; revision=1463
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-17 17:02:09 +0000