aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/wtap.h
AgeCommit message (Collapse)AuthorFilesLines
2018-11-20wiretap: add read/write support for Decryption Secrets Block (DSB)Peter Wu1-0/+25
Support reading and writing pcapng files with DSBs. A DSB may occur multiple times but should appear before packets that need those decryption secrets (so it cannot be moved to the end like NRB). The TLS dissector will be updated in the future to make use of these secrets. pcapng spec update: https://github.com/pcapng/pcapng/pull/54 As DSBs may be interleaved with packets, do not even try to read it in pcapng_open (as is done for IDBs). Instead process them during the sequential read, appending them to the 'wtap::dsbs' array. Writing is more complicated, secrets may initially not be available when 'wtap_dumper' is created. As they may become available in 'wtap::dsbs' as more packets are read, allow 'wtap_dumper::dsbs_growing' to reference this array. This saves every user from checking/dumping DSBs. If the wtap user needs to insert extra DSBs (while preserving existing DSBs), they can set the 'wtap_dumper::dsbs_initial' field. The test file was creating using a patched editcap (future patch) and combined using mergecap (which required a change to preserve the DSBs). Change-Id: I74e4ee3171bd852a89ea0f6fbae9e0f65ed6eda9 Ping-Bug: 15252 Reviewed-on: https://code.wireshark.org/review/30692 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-11-20Add an API to get a list of compressed-file extensions, and use it.Guy Harris1-10/+10
Move all the compressed-file type stuff to wiretap/file_wrappers.c. Rename wtap_compressed_file_extension() to wtap_compression_type_extension() for consistency with the other compression-type-extension routine names. Move the declarations of the compression-type-extension routines in the header file. wtap_compression_type_extension() now returns NULL for WTAP_UNCOMPRESSED; there's no need to special-case it. Get rid of the now-unused wtap_compression_type_supported() and WTAP_NUM_COMPRESSION_TYPES. Change-Id: Ib93874079bea669a0c87104513dba0d21390455a Reviewed-on: https://code.wireshark.org/review/30729 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-11-19wtap.h: Fix documentation warningsJoerg Mayer1-2/+0
Change-Id: Ib0b5ae47047d3f574bd35cab045cefb8fcb8778d Reviewed-on: https://code.wireshark.org/review/30710 Reviewed-by: Jörg Mayer <jmayer@loplof.de>
2018-11-18Add an API to get the file extension for a compression type, and use it.Guy Harris1-0/+4
Add wtap_compressed_file_extension(), which returns NULL for WTAP_UNCOMPRESSED and the appropriate file extension for other compression types. Add wtap_compression_type_supported(), which returns TRUE for WTAP_UNCOMPRESSED and all supported compression types and FALSE otherwise. ("Supported" means "the code can decompmress files in that compression format and can write files in that compression format", so WTAP_GAIP_COMPRESSED is supported iff libwiretap is built with zlib.) In MainWindow::fileAddExtension, instead of checking for WTAP_GZIP_COMPRESSED and using ".gz" as the extension, use the extension returned by wtap_compressed_file_extension() for the compression type. Change-Id: I47cb0eca8c887ada3562df30b54e76509008180f Reviewed-on: https://code.wireshark.org/review/30707 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-11-16Add an API to get a description of a compression type, and use it.Guy Harris1-1/+4
Add wtap_compression_type_description(), which returns NULL for WTAP_UNCOMPRESSED and a descriptive string for other compression types. Instead of checking for WTAP_GZIP_COMPRESSED and appending "(gzip compressed)", just pass the compression type to wtap_compression_type_description() and, if the result is non-null, append its result, wrapped in parentheses, with a space before the left parenthesis. Change-Id: I79a999c7838a883953795d5cbab009966e14b65e Reviewed-on: https://code.wireshark.org/review/30666 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-11-16Use an enum for compression types in various interfaces.Guy Harris1-9/+20
This: 1) means that we don't have to flag the compression argument with a comment to indicate what it means (FALSE doesn't obviously say "not compressed", WTAP_UNCOMPRESSED does); 2) leaves space in the interfaces in question for additional compression types. (No, this is not part 1 of an implementation of additional compression types, it's just an API cleanup. Implementing additional compression types involves significant work in libwiretap, as well as UI changes to replace "compress the file" checkboxes with something to indicate *how* to compress the file, or to always use some other form of compression). Change-Id: I1d23dc720be10158e6b34f97baa247ba8a537abf Reviewed-on: https://code.wireshark.org/review/30660 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-11-16Use the dump parameters structure for non-pcapng-specific stuff.Guy Harris1-35/+30
Use it for all the per-file information, including the per-file link-layer type and the per-file snapshot length. Change-Id: Id75687c7faa6418a2bfcf7f8198206a9f95db629 Reviewed-on: https://code.wireshark.org/review/30616 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2018-11-13Fix function name in comment.Guy Harris1-1/+1
Change-Id: Ice41094e6cc91df7e1f8286f35d49e1a20a89cc7 Reviewed-on: https://code.wireshark.org/review/30598 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-11-13Don't have _ng versions of the dumper open routines.Guy Harris1-21/+4
Have the routines always take a parameters pointer; pass either null or a pointer to an initialized-to-nothing structure in cases where we were calling the non-_ng versions. Change-Id: I23b779d87f3fbd29306ebe1df568852be113d3b2 Reviewed-on: https://code.wireshark.org/review/30590 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-11-12wiretap: refactor common parameters for pcapng dump routinesPeter Wu1-36/+49
Four variants of wtap_dump_open_ng exists, each of them take the same three parameters for the SHB, IDB and NRB blocks that has to be written before packets are even written. Similarly, a lot of tools always create these arguments based on an existing capture file session (wth). Address the former duplication by creating a new data structure to hold the arguments. Address the second issue by creating new helper functions to initialize the parameters based on a wth. This refactoring should make it easier to add the new Decryption Secrets Block (DSB). No functional change intended. Change-Id: I42c019dc1d48a476773459212ca213de91a55684 Reviewed-on: https://code.wireshark.org/review/30578 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2018-10-29The signal strength and noise in dB from an arbitrary reference are unsigned.Guy Harris1-2/+2
The radiotap spec says "dB antenna signal" and "dB antenna noise" are unsigned. Make it universally so. Change-Id: Iea2c5360d7352ca5e84862ea338d1fc689272191 Reviewed-on: https://code.wireshark.org/review/30410 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-10-29Handle signal/noise in dB from an arbitrary point in the 802.11 radio dissector.Guy Harris1-0/+4
While we're at it, only set the RSSI column once - no need to do it at the beginning and later when we're setting fields. Change-Id: Ia729019e5e6dfbe1cdad61f1f8397b0a3a171996 Reviewed-on: https://code.wireshark.org/review/30405 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-09-26Make systemd journal entries events.Gerald Combs1-1/+2
Treat systemd journal entries filetype-specific events instead of packets. Add support for reading and writing systemd journal entries to pcapng. Note that pcapng IDBs should be optional. Add support for REC_TYPE_FT_SPECIFIC_EVENT where needed. Change-Id: Ided999b1732108f480c6c75323a0769a9d9ef09f Reviewed-on: https://code.wireshark.org/review/29611 Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-09-26The sent field of the p2p pseudo-header is a Boolean.Guy Harris1-6/+1
Either it's TRUE, meaning sent, or it's FALSE, meaning received. Make it a gboolean and get rid of the #defines for it. ("Unknown" is handled by the WTAP_ENCAP_ value not *having* a p2p pseudo-header.) Change-Id: I650d7213523b49e7531d9555a98cde1be519a294 Reviewed-on: https://code.wireshark.org/review/29836 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-09-26Rename the pseudo-header for X.25, V.120, and Frame Relay.Guy Harris1-4/+5
It's not just for X.25, it's for anything that has the notion of Data Terminal Equipment and Data Communications Equipment; call it "dte_dce", not "x25". Change-Id: I3d51fec8b424e91ffd6d59895f50fc5ece791b08 Reviewed-on: https://code.wireshark.org/review/29834 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-08-31Add a systemd Journal Export Format parser and dissector.Gerald Combs1-0/+2
Add a file parser and dissector that can handle the output of `journalctl -o export`. From here we can add a systemd journal extcap and possibly support for the JSON and binary formats. Change-Id: I01576959b2c347ce7ac9aa57cdb5c119c81d61e9 Reviewed-on: https://code.wireshark.org/review/29311 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-08-09Pass zero-length PSDU type information to the radio dissector.Guy Harris1-15/+24
We call that dissector even for zero-length PSDUs, so the radio information is shown. We also show the zero-length PSDU type. We don't call the 802.11 dissector for zero-length PSDU frames. That way, you don't have to open up the radiotap information to find out about zero-length PSDU frames, we can support zero-length PSDU information for other pseudo-headers and file types if they support it, and taps using the radio information can get zero-length PSDU frame information. Change-Id: I7d5da4ea978d8ca4889fc76160f11e3416b4d036 Reviewed-on: https://code.wireshark.org/review/29034 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-08-01RFC 7468 is PEM-inspired, but it's not PEM.Guy Harris1-1/+1
Do some renaming. Change-Id: If8fa85370014f9618df38d97048dd1c52a4c389f Reviewed-on: https://code.wireshark.org/review/28918 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-08-01Do most of the RFC 7468 file processing in the dissector.Guy Harris1-0/+1
Have the Wiretap code just do a heuristic test to see if the file looks like a RFC 7468 file and just had the entire blob of raw file data to the caller, with an encapsulation type of WTAP_ENCAP_RFC7468. Have a file-rfc7468.c dissector that processes the lines of the file, displaying all of them. Have it extract the label from the pre-encapsulation boundary line, and, after it's decoded the base64-encoded data lines into a blob of data, try handing the tvbuff with the blob to dissectors that have registered in the "pem.preeb_label" dissector table with the appropriate label value, and hand it to the raw BER dissector only if that fails. This allows some files to have the content dissected as more than just a raw blob of BER-encoded data. Change-Id: I98db9f0beb86e5694fb8e886005a2df4fc96ba71 Reviewed-on: https://code.wireshark.org/review/28914 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-07-06Fix the calculation of a file's "basename".Guy Harris1-0/+2
Strip off only extensions that correspond to file types we know about; QFileInfo::baseName() strips off *all* extensions, where "extension" is "anything preceded by a .", so it turns foo.bar.pcap.gz into foo, not foo.bar. We don't want that; instead, we strip off only those extensions that correspond to file types we know how to read, so we'd strip off .pcap.gz in foo.bar.pcap.gz, and strip off .pcap in foo.bar.pcap, leaving foo.bar in both cases. Change-Id: I5385921ad2f0fef815d52e9902fef15735fd9dae Reviewed-on: https://code.wireshark.org/review/28636 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-07-03The "Ethernet offset" is 16 bits in the file; make it so in the pseudo-header.Guy Harris1-1/+1
This should squelch warnings from Ida7b98af8c44a52ddac2c4ab0702db2519a0c4af. Change-Id: I6803001981c63ddf76a735341ab2cc8dccdb8ab0 Reviewed-on: https://code.wireshark.org/review/28573 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-06-15Convert NetMon comment titles to UTF-8 when reading the file.Guy Harris1-3/+2
Fix indentation, and note that the comment "description" (contents) are RTF (as opposed to plain text). Change-Id: I668a08c06e39a32318454d2ee73933083c5cb516 Reviewed-on: https://code.wireshark.org/review/28279 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-06-07wiretap: add support for ruby marshal object files.Dario Lombardo1-0/+2
Change-Id: Iefba3b15c907966bb0b8d5c0ff9b6bb7097d326e Reviewed-on: https://code.wireshark.org/review/27763 Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-05-15wiretap: Add a reader for files in the PEM-like format specified by RFC 7468Роман Донченко1-0/+1
Change-Id: I8109025120d01c915f3a9d5550aa9272ec83893a Reviewed-on: https://code.wireshark.org/review/27334 Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org> Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2018-05-10wiretap: DPA-400 logfile supportDirk Eibach1-0/+1
Wiretap support for reading the Unigraf DPA-400 DisplayPort AUX channel monitor logfiles. Bug: 14651 Change-Id: Ia8714a72a9439dd566ef604e001ebf45ecaab76d Reviewed-on: https://code.wireshark.org/review/27415 Reviewed-by: Dario Lombardo <lomato@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Petri-Dish: Guy Harris <guy@alum.mit.edu> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-05-10DisplayPort AUX channel protocol dissectorDirk Eibach1-0/+1
Dissector for the VESA DisplayPort AUX channel protocol. Bug: 14651 Change-Id: I5c0c7668bda969086d9d6e5069aad87e929f6340 Reviewed-on: https://code.wireshark.org/review/27311 Reviewed-by: Dario Lombardo <lomato@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-05-07Revert "wiretap: DPA-400 logfile support"Guy Harris1-1/+0
This reverts commit dfd6eb5d68065b47cf19603f34300ed43ae5e858. This change cannot be submitted without change I5c0c7668bda969086d9d6e5069aad87e929f6340. Change-Id: Ieb22f4e9afa1742db861a291202a2790a4784e1b Reviewed-on: https://code.wireshark.org/review/27387 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-05-07wiretap: DPA-400 logfile supportDirk Eibach1-0/+1
Wiretap support for reading the Unigraf DPA-400 DisplayPort AUX channel monitor logfiles. Bug: 14651 Change-Id: I8d3c50575c9806dd04b40053db45564404bad103 Reviewed-on: https://code.wireshark.org/review/27312 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-18Fix some source headers, reformat SPDX license lines in comment block.Jaap Keuter1-1/+2
Change-Id: Ibae6a64a9915003435a3fb17763535a3844143be Reviewed-on: https://code.wireshark.org/review/25891 Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Michael Mann <mmann78@netscape.net>
2018-02-13Added dissector for Excentis DOCSIS31 XRA header. DLT 273. Builtin version.Bruno Verstuyft1-0/+1
Change-Id: I7d4a9cf094e8ae6af05d5599489fc609456c5645 Reviewed-on: https://code.wireshark.org/review/25768 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-09Rename ft_specific_data to reflect what we're actually using it for.Guy Harris1-2/+3
It's only being used as a working buffer to hold the raw options data we read in. Change-Id: I17b812e447f575ad92394b9f957658fc655cdf8e Reviewed-on: https://code.wireshark.org/review/25701 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-09Remove redundant members from wtap_syscall_header.Guy Harris1-5/+4
No need for len, and call caplen event_filelen and move it after event_len. Change-Id: I8b3825d4022ee083ee52f83f7a69f22829ed9fc4 Reviewed-on: https://code.wireshark.org/review/25698 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-09Generalize wtap_pkthdr into a structure for packet and non-packet records.Guy Harris1-41/+55
Separate the stuff that any record could have from the stuff that only particular record types have; put the latter into a union, and put all that into a wtap_rec structure. Add some record-type checks as necessary. Change-Id: Id6b3486858f826fce4b096c59231f463e44bfaa2 Reviewed-on: https://code.wireshark.org/review/25696 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-08replace SPDX identifier GPL-2.0+ with GPL-2.0-or-later.Dario Lombardo1-1/+1
The first is deprecated, as per https://spdx.org/licenses/. Change-Id: I8e21e1d32d09b8b94b93a2dc9fbdde5ffeba6bed Reviewed-on: https://code.wireshark.org/review/25661 Petri-Dish: Anders Broman <a.broman58@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-04Give an IDB and an NRB as examples of the third type of block.Guy Harris1-0/+16
There are events, there are reports, and there are "here's metadata that doesn't correspond to something that happened at this point in the capture"; IDBs and NRBs are the third type. Change-Id: I89e4f9bf51dc1be5766e8df61c6337ed3e484577 Reviewed-on: https://code.wireshark.org/review/25587 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-01-20wiretap: more SPDX license convertions.Dario Lombardo1-14/+1
Change-Id: I12695d0713b1d7fe58f09b2037303fab523085e9 Reviewed-on: https://code.wireshark.org/review/25394 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-01-14Check for gzipped files even if we don't have libz.Guy Harris1-0/+3
If we aren't built with libz, report a new "decompression not supported" error if the file is gzipped; the problem isn't that it's a new capture file format we don't support, it's that a *compressed* capture file, in some format, but we don't support the *compression* format used. This can be extended if we add support for other compression formats. Change-Id: I19239525d4e02357e3ca7189996556839af8fce2 Reviewed-on: https://code.wireshark.org/review/25315 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-01-09wiretap: add a parameter to wtap_init() indicating whether plugins must be ↵Pascal Quantin1-2/+6
loaded g995812c5f1 moved wiretap plugins registration from applications to wiretap library init function. As we do not want to load plugins for all users of libwiretap, let's make it configurable. Bug: 14314 Change-Id: Id8fdcc484e2d0d31d3ab0bd357d3a6678570f700 Reviewed-on: https://code.wireshark.org/review/25194 Reviewed-by: Dario Lombardo <lomato@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-01-09Use pcapng as the name of the file format.Guy Harris1-4/+4
At one point, I remember a discussion resulting in the official name of the next-generation replacement for pcap format being changed to "pcapng", with no hyphen. Make Wireshark reflect that. Change-Id: Ie66fb13a0fe3a8682143106dab601952e9154e2a Reviewed-on: https://code.wireshark.org/review/25214 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-12-29Do the right check for "no name resolution information to save".Guy Harris1-0/+2
The check that the pcapng code does is "do we have a non-null addrinfo_lists_t * and, if so, does it have a non-null ipv4_addr_list or ipv6_addr_list"? The check that the file-save code was using was just "do we have a non-null addrinfo_lists_t *", so sometimes it'd think we couldn't do a "quick save" even though we had no name resolution information to write out to the capture file. Make a routine that does that check, and use it in *both* places. Change-Id: Id4720f4fe4940354320b2b7621ca5e37e45ec1f3 Reviewed-on: https://code.wireshark.org/review/25055 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-12-21Add IEEE 802.3br Frame Preemption Protocol dissectorAnton Glukhov1-0/+1
Bug: 14280 Change-Id: I25444b069af4bb78db6ae5ff649596599eba2a0c Signed-off-by: Anton Glukhov <anton.a.glukhov@gmail.com> Reviewed-on: https://code.wireshark.org/review/24881 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com> Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-12-14Refactor plugin registration and loadingJoão Valverde1-2/+12
Put different types of plugins (libwiretap, libwireshark) in different subdirectories, give libwiretap and libwireshark init routines that load the plugins, and have them scan the appropriate subdirectories so that we don't even *try* to, for example, load libwireshark plugins in programs that only use libwiretap. Compiled plugins are stored in subfolders of the plugin folders, with the subfolder name being the Wireshark minor version number (X.Y). There is another hierarchical level for each Wireshark library (libwireshark, libwscodecs and libwiretap). The folder names are respectively plugins/X.Y/{epan,codecs,wiretap}. Currently we only distribute "epan" (libwireshark) plugins. Change-Id: I3438787a6f45820d64ba4ca91cbe3c8864708acb Reviewed-on: https://code.wireshark.org/review/23983 Petri-Dish: João Valverde <j@v6e.pt> Tested-by: Petri Dish Buildbot Reviewed-by: João Valverde <j@v6e.pt>
2017-11-15Handle LINKTYPE_JUNIPER_ST 200.Anders1-0/+1
Bug: 14195 Change-Id: Ic6be8e1f8169968c48376984c0d1a1a69c67f32a Reviewed-on: https://code.wireshark.org/review/24415 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-10-29wtap.h: Replace literal buffer size with WS_INET_ADDRSTRLENJoão Valverde1-2/+3
Bug: 14149 Change-Id: Ib7d60f93373eb23f5c950607f4cf6fc832c79670 Reviewed-on: https://code.wireshark.org/review/24154 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-09-06plugins: config.h must not be included by public headersJoão Valverde1-0/+1
For a sane plugin build environment. Include config.h as the first header in the .c file instead. Fix by moving required compiler attribute macros to a new "ws_attributes.h" API header. Change-Id: I34f58a927f68c1a0e59686c14d214825149749e1 Reviewed-on: https://code.wireshark.org/review/23400 Petri-Dish: João Valverde <j@v6e.pt> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: João Valverde <j@v6e.pt>
2017-09-04Add support for WPFCapture "formats" from Microsoft Analyzer.Michael Mann1-0/+7
Normally a .cap file contains a network type that when masked with 0xFFF will convert to a pcap LINKTYPE_ value. However, Microsoft Analyzer used 0xE080-0xE08A for their own purposes within a .cap file. Add support for the WPFCapture formats and give a "not supported" error message to the few left unsupported. Bug: 10556 Change-Id: I321a75ce769fdec75bdc6b595936c25932950a97 Reviewed-on: https://code.wireshark.org/review/23386 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-09-01Add support for NetMon NetmonFilter and NetworkInfoEx frame types.Michael Mann1-0/+2
Bug: 4221 Change-Id: I59aff777c364af1a064e1e99ea9ac6692a4cedfa Reviewed-on: https://code.wireshark.org/review/23333 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-30Add support for reading comments in Network Monitor filesMichael Mann1-0/+17
The NetMon wiretap reads the title and description comment fields from a NetMon file and saves it in the wiretap private structure. Then when it's time to make a frame, the comment fields are added to a NetMon pseudoheader with a new WTAP ENCAP type, with the potential for netmon pseudoheader to contain pseudoheader data from "base" wiretap. Then the netmon_header dissector displays the comment fields and passes any "base" wiretap pseudoheader data when calling the wtap_encap dissector table that the frame dissector normally calls. Bug: 4225 Change-Id: I8f772bc9494364c98434c78b61eb5a64012ff3b9 Reviewed-on: https://code.wireshark.org/review/23210 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-29Add Network Monitor Event Tracing eventMichael Mann1-0/+1
Assigned a WTAP_ENCAP value (WTAP_ENCAP_NETMON_NET_NETEVENT) for the dissection of Event Tracing records inside a NetworkMonitor file. Ping-Bug: 6520 Ping-Bug: 6694 Change-Id: Ib100f3779095842e78f9b7741e80258aa866d818 Reviewed-on: https://code.wireshark.org/review/23278 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-08-26wiretap: Add WTAP_ENCAP_NORDIC_BLEStig Bjørlykke1-0/+1
Use this for nordic_ble dissection. Change-Id: I5323cbd8c244c4e3b645825c60d040e1ae8f3b81 Reviewed-on: https://code.wireshark.org/review/23219 Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-30 22:17:54 +0000