aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/wtap.h
AgeCommit message (Collapse)AuthorFilesLines
2018-02-18Fix some source headers, reformat SPDX license lines in comment block.Jaap Keuter1-1/+2
Change-Id: Ibae6a64a9915003435a3fb17763535a3844143be Reviewed-on: https://code.wireshark.org/review/25891 Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Michael Mann <mmann78@netscape.net>
2018-02-13Added dissector for Excentis DOCSIS31 XRA header. DLT 273. Builtin version.Bruno Verstuyft1-0/+1
Change-Id: I7d4a9cf094e8ae6af05d5599489fc609456c5645 Reviewed-on: https://code.wireshark.org/review/25768 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-09Rename ft_specific_data to reflect what we're actually using it for.Guy Harris1-2/+3
It's only being used as a working buffer to hold the raw options data we read in. Change-Id: I17b812e447f575ad92394b9f957658fc655cdf8e Reviewed-on: https://code.wireshark.org/review/25701 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-09Remove redundant members from wtap_syscall_header.Guy Harris1-5/+4
No need for len, and call caplen event_filelen and move it after event_len. Change-Id: I8b3825d4022ee083ee52f83f7a69f22829ed9fc4 Reviewed-on: https://code.wireshark.org/review/25698 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-09Generalize wtap_pkthdr into a structure for packet and non-packet records.Guy Harris1-41/+55
Separate the stuff that any record could have from the stuff that only particular record types have; put the latter into a union, and put all that into a wtap_rec structure. Add some record-type checks as necessary. Change-Id: Id6b3486858f826fce4b096c59231f463e44bfaa2 Reviewed-on: https://code.wireshark.org/review/25696 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-08replace SPDX identifier GPL-2.0+ with GPL-2.0-or-later.Dario Lombardo1-1/+1
The first is deprecated, as per https://spdx.org/licenses/. Change-Id: I8e21e1d32d09b8b94b93a2dc9fbdde5ffeba6bed Reviewed-on: https://code.wireshark.org/review/25661 Petri-Dish: Anders Broman <a.broman58@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-04Give an IDB and an NRB as examples of the third type of block.Guy Harris1-0/+16
There are events, there are reports, and there are "here's metadata that doesn't correspond to something that happened at this point in the capture"; IDBs and NRBs are the third type. Change-Id: I89e4f9bf51dc1be5766e8df61c6337ed3e484577 Reviewed-on: https://code.wireshark.org/review/25587 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-01-20wiretap: more SPDX license convertions.Dario Lombardo1-14/+1
Change-Id: I12695d0713b1d7fe58f09b2037303fab523085e9 Reviewed-on: https://code.wireshark.org/review/25394 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-01-14Check for gzipped files even if we don't have libz.Guy Harris1-0/+3
If we aren't built with libz, report a new "decompression not supported" error if the file is gzipped; the problem isn't that it's a new capture file format we don't support, it's that a *compressed* capture file, in some format, but we don't support the *compression* format used. This can be extended if we add support for other compression formats. Change-Id: I19239525d4e02357e3ca7189996556839af8fce2 Reviewed-on: https://code.wireshark.org/review/25315 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-01-09wiretap: add a parameter to wtap_init() indicating whether plugins must be ↵Pascal Quantin1-2/+6
loaded g995812c5f1 moved wiretap plugins registration from applications to wiretap library init function. As we do not want to load plugins for all users of libwiretap, let's make it configurable. Bug: 14314 Change-Id: Id8fdcc484e2d0d31d3ab0bd357d3a6678570f700 Reviewed-on: https://code.wireshark.org/review/25194 Reviewed-by: Dario Lombardo <lomato@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-01-09Use pcapng as the name of the file format.Guy Harris1-4/+4
At one point, I remember a discussion resulting in the official name of the next-generation replacement for pcap format being changed to "pcapng", with no hyphen. Make Wireshark reflect that. Change-Id: Ie66fb13a0fe3a8682143106dab601952e9154e2a Reviewed-on: https://code.wireshark.org/review/25214 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-12-29Do the right check for "no name resolution information to save".Guy Harris1-0/+2
The check that the pcapng code does is "do we have a non-null addrinfo_lists_t * and, if so, does it have a non-null ipv4_addr_list or ipv6_addr_list"? The check that the file-save code was using was just "do we have a non-null addrinfo_lists_t *", so sometimes it'd think we couldn't do a "quick save" even though we had no name resolution information to write out to the capture file. Make a routine that does that check, and use it in *both* places. Change-Id: Id4720f4fe4940354320b2b7621ca5e37e45ec1f3 Reviewed-on: https://code.wireshark.org/review/25055 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-12-21Add IEEE 802.3br Frame Preemption Protocol dissectorAnton Glukhov1-0/+1
Bug: 14280 Change-Id: I25444b069af4bb78db6ae5ff649596599eba2a0c Signed-off-by: Anton Glukhov <anton.a.glukhov@gmail.com> Reviewed-on: https://code.wireshark.org/review/24881 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com> Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-12-14Refactor plugin registration and loadingJoão Valverde1-2/+12
Put different types of plugins (libwiretap, libwireshark) in different subdirectories, give libwiretap and libwireshark init routines that load the plugins, and have them scan the appropriate subdirectories so that we don't even *try* to, for example, load libwireshark plugins in programs that only use libwiretap. Compiled plugins are stored in subfolders of the plugin folders, with the subfolder name being the Wireshark minor version number (X.Y). There is another hierarchical level for each Wireshark library (libwireshark, libwscodecs and libwiretap). The folder names are respectively plugins/X.Y/{epan,codecs,wiretap}. Currently we only distribute "epan" (libwireshark) plugins. Change-Id: I3438787a6f45820d64ba4ca91cbe3c8864708acb Reviewed-on: https://code.wireshark.org/review/23983 Petri-Dish: João Valverde <j@v6e.pt> Tested-by: Petri Dish Buildbot Reviewed-by: João Valverde <j@v6e.pt>
2017-11-15Handle LINKTYPE_JUNIPER_ST 200.Anders1-0/+1
Bug: 14195 Change-Id: Ic6be8e1f8169968c48376984c0d1a1a69c67f32a Reviewed-on: https://code.wireshark.org/review/24415 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-10-29wtap.h: Replace literal buffer size with WS_INET_ADDRSTRLENJoão Valverde1-2/+3
Bug: 14149 Change-Id: Ib7d60f93373eb23f5c950607f4cf6fc832c79670 Reviewed-on: https://code.wireshark.org/review/24154 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-09-06plugins: config.h must not be included by public headersJoão Valverde1-0/+1
For a sane plugin build environment. Include config.h as the first header in the .c file instead. Fix by moving required compiler attribute macros to a new "ws_attributes.h" API header. Change-Id: I34f58a927f68c1a0e59686c14d214825149749e1 Reviewed-on: https://code.wireshark.org/review/23400 Petri-Dish: João Valverde <j@v6e.pt> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: João Valverde <j@v6e.pt>
2017-09-04Add support for WPFCapture "formats" from Microsoft Analyzer.Michael Mann1-0/+7
Normally a .cap file contains a network type that when masked with 0xFFF will convert to a pcap LINKTYPE_ value. However, Microsoft Analyzer used 0xE080-0xE08A for their own purposes within a .cap file. Add support for the WPFCapture formats and give a "not supported" error message to the few left unsupported. Bug: 10556 Change-Id: I321a75ce769fdec75bdc6b595936c25932950a97 Reviewed-on: https://code.wireshark.org/review/23386 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-09-01Add support for NetMon NetmonFilter and NetworkInfoEx frame types.Michael Mann1-0/+2
Bug: 4221 Change-Id: I59aff777c364af1a064e1e99ea9ac6692a4cedfa Reviewed-on: https://code.wireshark.org/review/23333 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-30Add support for reading comments in Network Monitor filesMichael Mann1-0/+17
The NetMon wiretap reads the title and description comment fields from a NetMon file and saves it in the wiretap private structure. Then when it's time to make a frame, the comment fields are added to a NetMon pseudoheader with a new WTAP ENCAP type, with the potential for netmon pseudoheader to contain pseudoheader data from "base" wiretap. Then the netmon_header dissector displays the comment fields and passes any "base" wiretap pseudoheader data when calling the wtap_encap dissector table that the frame dissector normally calls. Bug: 4225 Change-Id: I8f772bc9494364c98434c78b61eb5a64012ff3b9 Reviewed-on: https://code.wireshark.org/review/23210 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-29Add Network Monitor Event Tracing eventMichael Mann1-0/+1
Assigned a WTAP_ENCAP value (WTAP_ENCAP_NETMON_NET_NETEVENT) for the dissection of Event Tracing records inside a NetworkMonitor file. Ping-Bug: 6520 Ping-Bug: 6694 Change-Id: Ib100f3779095842e78f9b7741e80258aa866d818 Reviewed-on: https://code.wireshark.org/review/23278 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-08-26wiretap: Add WTAP_ENCAP_NORDIC_BLEStig Bjørlykke1-0/+1
Use this for nordic_ble dissection. Change-Id: I5323cbd8c244c4e3b645825c60d040e1ae8f3b81 Reviewed-on: https://code.wireshark.org/review/23219 Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2017-07-17ERF_TYPE_META write and comment supportAnthony Coddington1-1/+5
Support per-packet comments in ERF_TYPE_META through a new Anchor ID extension header with per-Host unique 48-bit Anchor ID which links an ERF_TYPE_META record with a packet record. There may be more than one Anchor ID associated with a packet, where they are grouped by Host ID extension header in the extension header list. Like other ERF_TYPE_META existing comments should not be overwritten and instead a new record generated. See erf_write_anchor_meta_update_phdr() for detailed comments on the extension header stack required. As Wireshark only supports one comment currently, use the one one with the latest metadata generation time (gen_time). Do this for capture comment too. Write various wtap metadata in periodic per-second ERF_TYPE_META records if non-WTAP_ENCAP_ERF or we have an updated capture comment. Refactor erf_dump to create fake ERF header first then follow common pseudoheadr and payload write code rather than two separate code paths. Support an ERF_HOST_ID environment variable to define Wireshark's Host ID when writing. Defaults to 0 for now. ERF dissector updates to support Anchor ID extension header with basic frame linking. Update ERF_TYPE_META naming and descriptions to official name (Provenance) Core changes: Add has_comment_changed to wtap_pkthdr, TRUE when a packet opt_comment has unsaved changes by the user. Add needs_reload to wtap_dumper which forces a full reload of the file on save, otherwise wireshark gets confused by additional packets being written. Change-Id: I0bb04411548c7bcd2d6ed82af689fbeed104546c Ping-Bug: 12303 Reviewed-on: https://code.wireshark.org/review/21873 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Stephen Donnelly <stephen.donnelly@endace.com> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-07-14vsock: add WTAP_ENCAP_VSOCK constantStefan Hajnoczi1-0/+1
A linktype was recently assigned to Linux vsock in libpcap commit cfdded36ddcf5d01e1ed9f5d4db596b744a6cda5 ("added DLT_VSOCK for http://qemu-project.org/Features/VirtioVsock"). The Wireshark vsock dissector can now be automatically applied when wtap_encap matches the new WTAP_ENCAP_VSOCK constant. This patch makes Wireshark dissect vsock packet captures without manually specifying the dissector. Change-Id: If252071499a61554f624c9ce0ce45a0ccfa88d7a Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-on: https://code.wireshark.org/review/22611 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2017-06-22Add WTAP_ENCAP_3MB_ETHERNET for Xerox 3MB Ethernet.Guy Harris1-0/+1
It needed to be done: https://github.com/shirriff/pup-wireshark (And, yes, there really *is* a DLT_/LINKTYPE_ for it! The original DLT_ values were ARP hardware types, and 3MB Ethernet was assigned an ARP hardware type of 2.) Change-Id: I60d96c28e67854adcb28c7e3579ae5dd1f07df4b Reviewed-on: https://code.wireshark.org/review/22336 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-09Add URL for link specifying D-Bus maximum message length.Guy Harris1-1/+6
Change-Id: I5797407a18fda674b2c9b2cc1c192c211c91c496 Reviewed-on: https://code.wireshark.org/review/22052 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-05Allow bigger snapshot lengths for D-Bus captures.Guy Harris1-5/+9
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except for D-Bus captures. Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for them, because that's the largest possible D-Bus message size. See https://bugs.freedesktop.org/show_bug.cgi?id=100220 for an example of the problems caused by limiting the snapshot length to 256KB for D-Bus. Have a snapshot length of 0 in a capture_file structure mean "there is no snapshot length for the file"; we don't need the has_snap field in that case, a value of 0 mean "no, we don't have a snapshot length". In dumpcap, start out with a pipe buffer size of 2KB, and grow it as necessary. When checking for a too-big packet from a pipe, check against the appropriate maximum - 128MB for DLT_DBUS, 256KB for everything else. Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20 Reviewed-on: https://code.wireshark.org/review/21952 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-03LoRaTap DLT and dissectorErik de Jong1-0/+1
Add support for handling LoRaTap (https://github.com/eriknl/LoRaTap) DLT in wiretap and add dissector for LoRaTap headers. Exposes Syncword for subdissectors to dissect frame payload. Change-Id: Ie4ba2189964376938f45eb3da93f2c3376042e85 Reviewed-on: https://code.wireshark.org/review/21915 Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2017-06-03Don't keep the pcap/pcapng link-layer header type as interface data.Guy Harris1-1/+0
Either 1) it can be determined from the libwiretap encapsulation type, in which case it's redundant information or 2) there *is* no pcap/pcapng link-layer header type for that encapsulation type, in which case you need to check for the attempt to determine it failing and handle that failure appropriately. Change-Id: Ie9557b513365c1fc8c6df74b9c8239e29aad46bc Reviewed-on: https://code.wireshark.org/review/21924 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-30packet-ieee80211-radio.c: Minor refactor and whitespace cleanupSimon Barber1-9/+11
Change-Id: Idad8f7eeed968eeed9f553fef98d58453f328afb Reviewed-on: https://code.wireshark.org/review/21421 Petri-Dish: Michael Mann <mmann78@netscape.net> Reviewed-by: Michael Mann <mmann78@netscape.net> Tested-by: Michael Mann <mmann78@netscape.net>
2017-03-31Add packet capture support for Darwin USBScott Deandrea1-0/+1
Change-Id: Iec9e4ac2362cf8e88a3cf6ae3483cefe938967e5 Reviewed-on: https://code.wireshark.org/review/20814 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-02-18wiretap: add open_routines cleanup function.Dario Lombardo1-0/+2
Change-Id: Id88fe84189b8baa597eaa69159395cdc4bc56195 Reviewed-on: https://code.wireshark.org/review/19951 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-02-14wiretap: add cleanup routine.Dario Lombardo1-0/+3
The cleanup routine has been added to exit section of the applications. Those which required a exit restyle have been patched as well. Change-Id: I3a8787f0718ac7fef00dc58176869c7510fda7b1 Reviewed-on: https://code.wireshark.org/review/19949 Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Dario Lombardo <lomato@gmail.com>
2016-12-04Have a routine to do all the work of initializing libwiretap.Guy Harris1-2/+4
Have programs that use libwiretap call that routine rather than separately calling some or all of init_open_routines(), wtap_register_plugin_types(), and wtap_opttypes_initialize(). Also don't have routines internal to libwiretap call those. Yes, this means doing some initialization work when it isn't necessary, but scattering on-demand calls throughout the code is a great way to forget to make those calls. Change-Id: I5828e1c5591c9d94fbb3eb0a0e54591e8fc61710 Reviewed-on: https://code.wireshark.org/review/19069 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-09-10wiretap: fix memory leak of interface_data for wtap_dumperPeter Wu1-2/+9
Mirrors the behavior of wtap_close. Change-Id: I1a04878fdd0409fa74931737332f9b8a1ae77fb1 Reviewed-on: https://code.wireshark.org/review/17620 Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-09-10Have "All Capture Files" match only capture files.Guy Harris1-8/+14
We support reading some types of files that aren't capture files, in case we have a dissector for that file format (because, for example, it's often transported over HTTP). Don't include them in the set of files "All Capture Files" matches; you can still look for them as they have individual entries in the drop-down menu of file type patterns. Ultimately, there should be Fileshark/TFileshark programs to read those files - and other file types, and even capture files if the goal is to look at the file structure rather than at the packets - and *that's* the program that should offer the ability to load JPEGs and so on. (No, this does not reduce the "All Capture Files" list down to a level that makes the problem in bug 12837 go away. The right way to fix *that* is to arrange, somehow, that the "All Capture Files" entry not actually list all the suffixes it matches.) Change-Id: I705bff5fcd0694c6c6a11892621a195aa7cd0264 Reviewed-on: https://code.wireshark.org/review/17619 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-25Go back to having only one SocketCAN LINKTYPE_ value.Guy Harris1-2/+1
Libpcap just backed out the "host-endian" SocketCAN LINKTYPE_ value; we don't need it any more. Change-Id: I33a7dc21207a0009e20b4abaefe1119eb649c39a Reviewed-on: https://code.wireshark.org/review/17327 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-19Handle the new LINKTYPE_CAN_SOCKETCAN_HOSTENDIAN.Guy Harris1-1/+2
Unfortunately, only one libpcap code path puts the CAN ID in the SocketCAN header in network byte order; the others leave it in host byte order. Therefore, a new LINKTYPE_/DLT_ value was introduced, and libpcap was changed to use that for the cases where the CAN ID is in host byte order. Support them both. This means we need to, when reading pcap and pcapng files, fix up the CAN ID if the host that wrote the file has a different byte order from ours (as libpcap also now does). This includes Linux "cooked" captures, which can include CAN packets. Change-Id: I75ff2d68d1fbdb42753ce85d18f04166f21736dd Reviewed-on: https://code.wireshark.org/review/17155 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-15Do a deep copy in wtap_block_add_custom_option().Guy Harris1-1/+1
That way, we don't have to worry about multiple instances of an option pointing to the same data. and having to worry about freeing data that's pointed to by another instance. Change-Id: I3470a9eebf346023713fd0d6ff2451d727c25089 Reviewed-on: https://code.wireshark.org/review/16471 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-14Redo the block options APIs.Guy Harris1-38/+21
A block can have zero or more instances of a given option. We distinguish between "one instance only" options, where a block can have zero or one instance, and "multiple instances allowed" options, where a block can have zero or more instances. For "one instance only" options: "add" routines add an instance if there isn't one already and fail if there is; "set" routines add an instance if there isn't one already and change the value of the existing instance if there is one; "set nth" routines fail; "get" routines return the value of the instance if there is one and fail if there isn't; "get nth" routines fail. For "multiple instances allowed" options: "add" routines add an instance; "set" routines fail; "set nth" routines set the value of the nth instance if there is one and fail otherwise; "get" routines fail; "get nth" routines get the value if the nth instance if there is one and fail otherwise. Rename "optionblock" to just "block"; it describes the contents of a block, including both mandatory items and options. Add some support for NRB options, including IPv4 and IPv6 option types. Change-Id: Iad184f668626c3d1498b2ed00c7f1672e4abf52e Reviewed-on: https://code.wireshark.org/review/16444 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-06-21Add support for Opencontrail virtual networkRudra Rugge1-0/+1
Change-Id: Ia6012e0f6425be069e222538eafb1191b398ec83 Reviewed-on: https://code.wireshark.org/review/15930 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-15More Sysdig / system event support.Gerald Combs1-0/+1
Add REC_TYPE_SYSCALL to wiretap and use it for Sysdig events. Call the Sysdig event dissector from the frame dissector. Create a "syscall" protocol for system calls, but add "frame" items to it for now. Add the ability to write Sysdig events. This lets us merge packet capture and syscall capture files. Change-Id: I12774ec69c89d8e329b6130c67f29aade4e3d778 Reviewed-on: https://code.wireshark.org/review/15078 Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-06Move ip6_to_str_buf() to to_str.c and make it take the buffer length.João Valverde1-1/+1
Also make it use ws_inet_ntop6() (rather than implementing the string conversion ourselves). Remove ip6_to_str_buf_len(). Change-Id: I1eff3a8941e00987c2ff0c4dcfda13476af86191 Reviewed-on: https://code.wireshark.org/review/15692 Reviewed-by: João Valverde <j@v6e.pt> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-01Add data structures necessary to support multiple Name Resolution blocks.Michael Mann1-10/+10
This doesn't try to use any data from multiple Name Resolution blocks, it just converts single Name Resolution block usage into a GArray, so the potential is there to then use/support multiple Name Resolution blocks within a file format (like pcapng) Change-Id: Ib0b584af0bd263f183bd6d31ba18275ab0577d0c Reviewed-on: https://code.wireshark.org/review/15684 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-01Add data structures necessary to support multiple Section Header blocks.Michael Mann1-9/+9
This doesn't try to use any data from multiple Section Header blocks, it just converts single Section Header block usage into a GArray, so the potential is there to then use/support multiple Section Header blocks within a file format (like pcapng) Change-Id: I6ad1f7b8daf4b1ad7ba0eb1ecf2e170421505486 Reviewed-on: https://code.wireshark.org/review/15636 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-04-18wiretap: add support for the mplog capture file formatMartin Kaiser1-0/+1
the mplog format is used by some commercial logging tools that capture ISO 14443 traffic between a card reader and a contactless smartcard Change-Id: If359b8f0f671eb2a7c6315e2b8960a5bd581a9e9 Reviewed-on: https://code.wireshark.org/review/14950 Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
2016-04-01support for IP-over-Infiniband - pcap encapsulationPetr Sumbera1-1/+2
Bug: 12279 Change-Id: Ib6c54f8b86d95c5546bc800749f124cd0dbb8ff0 Reviewed-on: https://code.wireshark.org/review/14585 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2016-02-23Making wiretap option blocks more generic.Michael Mann1-182/+34
This was inspired by https://code.wireshark.org/review/9729/, but takes it in a different direction where all options are put into an array, regardless of whether they are "standard" or "custom". It should be easier to add "custom" options in this design. Some, but not all blocks have been converted. Descriptions of some of the block options have been moved from wtap.h to pcapng.h as it seems to be the one that implements the description of the blocks. Also what could be added/refactored is registering block behavior. Change-Id: I3dffa38f0bb088f98749a4f97a3b7655baa4aa6a Reviewed-on: https://code.wireshark.org/review/13667 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-02-20Initial support for FreeBSD USB captures.Guy Harris1-7/+1
(There's also work needed in libpcap; that's also in progress.) Change-Id: Iff5a34c139a000865e2d78cc17a4af5ff24fb44b Reviewed-on: https://code.wireshark.org/review/14025 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-20Put back a define to make the Lua build happy.Guy Harris1-1/+7
DO NOT USE THIS FOR ANYTHING NEW. Change-Id: Iee2ddaa2eeb735b33aef9e81b32bb4a3535e3451 Reviewed-on: https://code.wireshark.org/review/14023 Reviewed-by: Guy Harris <guy@alum.mit.edu>
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-28 13:01:23 +0000