aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/wtap.h
AgeCommit message (Collapse)AuthorFilesLines
2002-01-29Support for capturing on, and reading captures from, OpenBSD firewallGuy Harris1-2/+3
logging virtual interface, from Mike Frantzen. svn path=/trunk/; revision=4616
2002-01-23Get rid of "m"/"M" and other Macintosh references in names - it appearsGuy Harris1-3/+3
that EtherPeek for Windows uses the same format as EtherPeek for MacOS, so the code isn't specific to the MacOS version. Check the physMedium value in the secondary header, and leave a placeholder for a value of 1, which is presumably used in AiroPeek captures. Treat unknown mediaType and physMedium values as indications that we don't have a *Peek file, not as unsupported *Peek files - we need all the heuristics we can get. svn path=/trunk/; revision=4601
2002-01-18In the EtherPeek file reader, keep the capture start time in a privateGuy Harris1-7/+17
data structure attached to the "wtap" structure, rather than in a pseudo-header structure; get rid of the EtherPeek pseudo-header structure, as it's not actually used as a pseudo-header, it's just used as private data for the EtherPeek reader. Get rid of an extra level of indentation in switch statements. svn path=/trunk/; revision=4561
2001-12-04Support for reading Visual Networks traffic capture files, from TomGuy Harris1-2/+3
Nisbet. Make a comment in "wiretap/file.c" clearer, so people know where to put the entries for their capture file type. svn path=/trunk/; revision=4328
2001-12-04Make the bytes-written information from Wiretap a long, as we allowGuy Harris1-2/+3
files to get that big. From Thomas Wittwer and Matthias Nyffenegger: Support for "ring buffer mode", wherein there's a ring buffer of N capture files; as each capture file reaches its maximum size (the ring buffer works only with a maximum capture file size specified), Ethereal rolls over to the next capture file in the ring buffer, replacing whatever packets might be in it with new packets. svn path=/trunk/; revision=4323
2001-12-04Support for stopping capture at specified capture file size or captureGuy Harris1-1/+2
duration, from Thomas Wittwer and Matthias Nyffenegger. svn path=/trunk/; revision=4322
2001-11-30Add support for LocalTalk Link Access Protocol.Guy Harris1-3/+4
Rename WTAP_ENCAP_PRISM to WTAP_ENCAP_PRISM_HEADER, to match DLT_PRISM_HEADER. Add in missing capture support for WTAP_ENCAP_PRISM_HEADER when capturing with "pcap_open_live()" rather than reading the capture from a pipe. svn path=/trunk/; revision=4299
2001-11-28Support for 802.11+Prism II monitor-mode link-layer headers, fromGuy Harris1-2/+3
Tim Newsham. Add in missing item for WTAP_ENCAP_CISCO_IOS in the Wiretap encapsulation type table. svn path=/trunk/; revision=4290
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4199
2001-11-06Add in some heuristics to try to detect AIX libpcap format. (This worksGuy Harris1-24/+25
with one capture I've seen, but perhaps that was done with an old version of AIX, and newer versions use a minor version number, in the file, of 4. However, libpcap hasn't used a minor version of 2 for ages, so perhaps AIX hasn't updated their libpcap in ages, and aren't about to do so soon. If they do, let's hope they change the magic number. The capture file in question *does* have the capture length and real length in the old, pre-2.3, order, so it really looks as if it's an old version, rather than IBM trying to be "helpful" by using a different minor version number so that you can distinguish between normal libpcap and AIX libpcap formats.) svn path=/trunk/; revision=4164
2001-11-02Support DLT_CISCO_IOS.Gilbert Ramirez1-2/+3
svn path=/trunk/; revision=4126
2001-10-19DBS Etherwatch wiretap module, from Marc Milgram.Guy Harris1-2/+3
svn path=/trunk/; revision=4042
2001-10-18VMS TCPIPtrace wiretap module, from Marc Milgram.Guy Harris1-2/+3
Update the lists of known capture file formats in the Tethereal, editcap, and mergecap man pages to match the current list (as found in the Ethereal man page). svn path=/trunk/; revision=4039
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris1-5/+5
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
2001-09-23Update the URL for ATM-on-Linux.Guy Harris1-2/+2
svn path=/trunk/; revision=3949
2001-07-05"open_cap_file()" in Ethereal and Tethereal don't use the FILE_T theyGuy Harris1-2/+1
get from calling "wtap_file()", so get rid of the call and the (otherwise unused) variable to which its result gets assigned. That lets us get rid of "wtap_file()" in Wiretap. It also lets us get rid of the include of "zlib.h" in "file.h"; the #defines of "file_open()", "filed_open()", and "file_close()" are also unnecessary, so we get rid of those as well. However, that means we need to include <zlib.h> in "gtk/main.c" and "tethereal.c", so that the version number of libz is defined and can show up in the version string. svn path=/trunk/; revision=3652
2001-03-15Add a new Wiretap encapsulation type for Cisco HDLC. Map the NetBSDGuy Harris1-2/+3
DLT_HDLC to it. Make a separate dissector for Cisco HDLC, and add a dissector for Cisco SLARP. Have the PPP dissector call the Cisco HDLC dissector if the address field is the Cisco HDLC unicast or multicast address. Use the Cisco HDLC dissector for the Cisco HDLC Wiretap encapsulation type. Add a new dissector table "chdlctype", for Cisco HDLC packet types (they're *almost* the same as Ethernet types, but 0x8035 is SLARP, not Reverse ARP, and 0x2000 is the Cisco Discovery protocol, for example), replacing "fr.chdlc". Have a "chdlctype()" routine, similar to "ethertype()", used both by the Cisco HDLC and Frame Relay dissectors. Have a "chdlc_vals[]" "value_string" table for Cisco HDLC types and protocol names. Split the packet type field in the Frame Relay dissector into separate SNAP and Cisco HDLC fields, and give them the Ethernet type and Cisco HDLC type "value_string" tables, respectively. svn path=/trunk/; revision=3133
2001-02-22Etherpeek version 5, 6, and 7 support, from Daniel Thompson.Guy Harris1-2/+9
svn path=/trunk/; revision=3066
2001-01-08Code to handle Frame Relay Sniffer captures, from Jeff Foster.Guy Harris1-2/+3
Code to register the Frame Relay dissector to handle Frame Relay captures, from Paul Ionescu. svn path=/trunk/; revision=2845
2000-12-23Add support for the DLT_LINUX_SLL capture type in the current CVSGuy Harris1-2/+3
version of libpcap; that's used on Linux for captures on the "any" device (which captures from all interfaces simultaneously) and for captures on devices whose link-layer type libpcap doesn't (yet) support natively. The spanning tree code, when checking for GV{M,R,...}P packets, must first check whether the link-layer destination address is, in fact, an Ethernet-style address; on Linux cooked captures, there *is* no destination address, so it's of type AT_NONE, not AT_ETHER. svn path=/trunk/; revision=2772
2000-11-15IEEE 802.11 support, from Johan Jorgensen of Axis Communications AB.Guy Harris1-2/+3
Add in stuff for a bunch of libpcap formats either in libpcap 0.5.2 or in the current CVS version; we don't implement all of them in Ethereal/Wiretap (those are "#if 0"ed out), but we do implement the IEEE 802.11 stuff (which isn't yet in libpcap or tcpdump, but the CVS version of libpcap *does* reserve 105 as the encapsulation type number for 802.11). svn path=/trunk/; revision=2646
2000-09-21Make sure to pass the sent/received direction from pppdump.c inGilbert Ramirez1-7/+9
pseudo_header. Use generic "p2p_phdr" instead of "lapd_phdr". Modify toshiba.c and packet-lapd.c to take that into account. Add frame.p2p_dir, a filterable field, 0=sent, 1=recvd Make p2p_dir available in packe_info, as I think it will be needed in VJ COMP and UNCOMP dissection. Rename WTAP_ENCAP_TR to WTAP_ENCAP_TOKEN_RING. Mention pppd-log support in man page. Mention atmsnoop in README. svn path=/trunk/; revision=2455
2000-09-19Add support for reading pppd log files in wiretap.Gilbert Ramirez1-2/+3
svn path=/trunk/; revision=2448
2000-09-15Code to read capture files from some version of tcpdump from some sortGuy Harris1-21/+22
of Nokia box (firewall) - yep, it's yet *another* mutant libpcap format that didn't change the magic number, sigh.... svn path=/trunk/; revision=2440
2000-09-07Change wtap_read() API so that the data offset is set via a pointer, andGilbert Ramirez1-3/+11
a "keep reading" boolean value is returned from the function. This avoids having to hack around the fact that some file formats truly do have records that start at offset 0. (i4btrace and csids have no file header. Neither does the pppdump-style file that I'm looking at right now). svn path=/trunk/; revision=2392
2000-08-11Miscellaneous code cleaningLaurent Deniel1-1/+3
- add <stdarg.h> or <varargs.h> in snprintf.h and remove those inclusions in the other #ifdef NEED_SNPRINTF_H codes - remove the check of multiple inclusions in source (.c) code (there is a bit loss of _cpp_ performance, but I prefer the gain of code reading and maintenance; and nowadays, disk caches and VM are correctly optimized ;-). - protect all (well almost) header files against multiple inclusions - add header (i.e. GPL license) in some include files - reorganize a bit the way header files are included: First: #include <system_include_files> #include <external_package_include_files (e.g. gtk, glib etc.)> Then #include "ethereal_include_files" with the correct HAVE_XXX or NEED_XXX protections. - add some HAVE_XXX checks before including some system header files - add the same HAVE_XXX in wiretap as in ethereal Please forgive me, if I break something (I've only compiled and regression tested on Linux). svn path=/trunk/; revision=2254
2000-08-08Added wiretap support to read the Cisco Secure Intrusion Detection System ↵Mike Hall1-2/+3
IPLog format. svn path=/trunk/; revision=2231
2000-07-26In the final scene of the horror movie, just when you think the monsterGuy Harris1-20/+21
is finally dead, and you're walking away, it springs up again and attacks. It appears that the ss990915 version of Alexey Kuznetzov's libpcap patch has some extra stuff in the per-packet header for some sort of SMP debugging, and that SuSE Linux 6.3 picked it up. Thus, even if a libpcap file has the modified magic number, we *still* have to go through the usual heuristic hell to figure out what type of file it is. svn path=/trunk/; revision=2164
2000-06-27Add routines to Wiretap to allow a client of Wiretap to get:Guy Harris1-1/+4
a pointer to the "wtap_pkthdr" structure for an open capture file; a pointer to the "wtap_pseudo_header" union for an open capture file; a pointer to the packet buffer for an open capture file; so that a program using "wtap_read()" in a loop can get at those items. Keep, in a "capture_file" structure, an indicator of whether: no file is open; a file is open, and being read; a file is open, and is being read, but the user tried to quit out of reading the file (e.g., by doing "File/Quit"); a file is open, and has been completely read. Abort if we try to close a capture that's being read if the user hasn't tried to quit out of the read. Have "File/Quit" check if a file is being read; if so, just set the state indicator to "user tried to quit out of it", so that the code reading the file can do what's appropriate to clean up, rather than closing the file out from under that code and causing crashes. Have "read_cap_file()" read the capture file with a loop using "wtap_read()", rather than by using "wtap_loop()"; have it check after reading each packet whether the user tried to abort the read and, if so, close the capture and return an indication that the read was aborted by the user. Otherwise, return an indication of whether the read completely succeeded or failed in the middle (and, if it failed, return the error code through a pointer). Have "continue_tail_cap_file()" read the capture file with a loop using "wtap_read()", rather than by using "wtap_loop()"; have it check after reading each packet whether the user tried to abort the read and, if so, quit the loop, and after the loop finishes (even if it read no packets), return an indication that the read was aborted by the user if that happened. Otherwise, return an indication of whether the read completely succeeded or failed in the middle (and, if it failed, return the error code through a pointer). Have "finish_tail_cap_file()" read the capture file with a loop using "wtap_read()", rather than by using "wtap_loop()"; have it check after reading each packet whether the user tried to abort the read and, if so, quit the loop, and after the loop finishes (even if it read no packets), close the capture and return an indication that the read was aborted by the user if that happened. Otherwise, return an indication of whether the read completely succeeded or failed in the middle (and, if it failed, return the error code through a pointer). Have their callers check whether the read was aborted or not and, if it was, bail out in the appropriate fashion (exit if it's reading a file specified by "-r" on the command line; exit the main loop if it's reading a file specified with File->Open; kill the capture child if it's "continue_tail_cap_file()"; exit the main loop if it's "finish_tail_cap_file()". svn path=/trunk/; revision=2095
2000-06-24Joerg Mayer's changes to add support for NetXRay file format versionGuy Harris1-2/+2
2.002, as used by release 3.50 of the Network Associates Sniffer for Windows; currently, we treat it just like the 2.001 version, so we rename the version #define WTAP_FILE_NETXRAY_2_001 to WTAP_FILE_NETXRAY_2_00x and use that for both 2.001 and 2.002. svn path=/trunk/; revision=2087
2000-05-25Support for reading compressed Sniffer files, from Tim Farley, JoergGuy Harris1-16/+23
Mayer, and yours truly. svn path=/trunk/; revision=2002
2000-05-19Add wtap-int.h. Move definitions relevant to the internal workins of wiretapGilbert Ramirez1-209/+9
to that file, leave public definitions in wtap.h. Rename "union pseudo_header" to "union wtap_pseudo_header". Make the wtap_pseudo_header pointer available in packet_info struct. svn path=/trunk/; revision=1989
2000-05-18Remove the "union pseudo_header" from the "frame_data" structure;Guy Harris1-9/+17
there's no need to keep it around in memory - when the frame data is read in when handing a frame, read in the information, if any, necessary to reconstruct the frame header, and reconstruct it. This saves some memory. This requires that the seek-and-read function be implemented inside Wiretap, and that the Wiretap handle remain open even after we've finished reading the file sequentially. This also points out that we can't really do X.25-over-Ethernet correctly, as we don't know where the direction (DTE->DCE or DCE->DTE) flag is stored; it's not clear how the Ethernet type 0x0805 for X.25 Layer 3 is supposed to be handled in any case. We eliminate X.25-over-Ethernet support (until we find out what we're supposed to do). svn path=/trunk/; revision=1975
2000-05-12Fix minor typo found by Alan Harrison.Guy Harris1-2/+2
svn path=/trunk/; revision=1951
2000-05-10Rename the "private" member of a "wtap_dumper" structure to "dump", asGuy Harris1-2/+2
per the "capture" member of a "wtap" structure, so that it doesn't collide with the C++ reserved word "private". svn path=/trunk/; revision=1936
2000-04-15Get rid of the "start" field in the private data for RADCOM, i4btrace,Guy Harris1-8/+2
and nettl captures - a "start" field is used for capture files where the time stamps on packets are relative to some initial time stamp, e.g. the time the capture started, but those file formats use absolute time stamps, so no "start" field is needed. Make the "this is an HP-UX 11.x nettl capture" flag a member of the private data structure for a nettl capture, rather than a global - it's per-capture-file state. Once the "start" field is removed from the RADCOM private data structure, there's nothing left, so eliminate the private data structure. svn path=/trunk/; revision=1863
2000-04-08Declare, in "wtap.h", Richard's new "wtap_read()" function.Guy Harris1-1/+2
svn path=/trunk/; revision=1820
2000-03-22In a Network Monitor capture file, get the starting offsets of framesGuy Harris1-2/+3
from the frame table - Network Monitor 2.x, at least, doesn't always write frame N+1 right after frame N. To do that, we need to mallocate a big array to hold the frame table, and free it when we close the capture file; this requires that we have capture-file-type-specific close routines as well as capture-file-type-specific read routines - we let it the pointer to that routine be null if it's not needed. Given that, we might as well get rid of the switch statement in "wtap_close()", in favor of using capture-file-type-specific close routines, as per the comment before that switch statement. svn path=/trunk/; revision=1740
2000-02-19Use WTAP_ERR_UNSUPPORTED_ENCAP for all attempts to open or read aGuy Harris1-2/+2
capture file for an unsupported link-layer encapsulation type (as the nettl reader does), and report it correctly if it occurs on an open or read attempt rather than a save attempt. svn path=/trunk/; revision=1647
2000-01-22Fix files that had Gilbert's old e-mail address or that didn't have myGuy Harris1-2/+2
forwarding e-mail address. svn path=/trunk/; revision=1522
1999-12-15Handle i4btrace captures if they're from a machine with the oppositeGuy Harris1-1/+12
byte order from the machine that's reading them. svn path=/trunk/; revision=1338
1999-12-15One field in the NetXRay header appears to be the number of frames inGuy Harris1-3/+3
the capture; set it to that when writing the capture. Support Token Ring and FDDI captures (as per the network type in the file header appearing to be either the NDIS network type, or the NDIS network type minus 1 - I forget whether Ethernet has an NDIS type of 0 or 1). Don't write the file header twice, keeping a static copy of it around, as Wiretap code isn't supposed to keep any static data around; instead, write it only when we're done writing out all the records (as we do on Network Monitor captures). Compute the time stamps when writing the file. Give Windows Sniffer 1.1-format a short name, so "editcap" doesn't dump core or print "(null)" in its usage message. WTAP_ENCAP_NULL isn't supported by NetMon; don't write it. svn path=/trunk/; revision=1336
1999-12-14more work on netxray, still not sniffer compatible thoughNathan Neulinger1-1/+2
svn path=/trunk/; revision=1333
1999-12-14Added support for writing netxray version 1.1 dumps.Nathan Neulinger1-1/+7
It's very basic, and doesn't write out the timestamps currently. It also only handles WTAP_ENCAP_ETHERNET, although it can probably do the others, but I don't have a good way to test them. This code has not yet been tested against a Sniffer Pro, although wiretap can read the files just fine. svn path=/trunk/; revision=1318
1999-12-12Added Bert Driehuis <driehuis@playbeing.org>'s I4B wiretap moduleGilbert Ramirez1-3/+11
and V.120 decoder. svn path=/trunk/; revision=1304
1999-12-11Put in a private data structure hanging off the "wtap_dumper" structureGuy Harris1-3/+9
the "this is the first frame" flag, and the time stamp of the first frame, used when writing Sniffer files, so that more than one could be open at a time (Wiretap doesn't forbid that) and so that they're initialized when you start writing a capture. svn path=/trunk/; revision=1292
1999-12-11Provide different file types for "modified" and Red Hat 6.1 "libpcap"Guy Harris1-16/+19
files (the former have a different per-packet header, and a different magic number, from the standard "libpcap"; the latter have the same per-packet header as "modified" "libpcap" files, but the same magic number as standard "libpcap" files, sigh). Support writing "libpcap" captures in all three formats (so that, for example, people running Ethereal on RH 6.1 can write out captures that the "tcpdump" that comes with RH 6.1 can read, although that's not the default format we save in - there's no way to tell whether you're running on RH 6.1, as far as I know; "uname()" just tells you, on Linux systems, that the kernel is Linux 2.x, and what "x" is, it doesn't say what the *rest* of the system is). Fix the table in "file.c" to use Olivier's code for writing Sniffer files. svn path=/trunk/; revision=1288
1999-12-05Provide a table of descriptive and short (command-line) names forGuy Harris1-1/+7
encapsulation types, and routines to translate encapsulation types to names and short names to encapsulation types, for the benefit of "editcap". svn path=/trunk/; revision=1212
1999-12-04Give those capture file formats we can write a "short name", to be usedGuy Harris1-1/+3
to, for example, specify on a command line the format that a program should write; provide a routine to translate a file type to its short name, and to translate a short name to the corresponding file type. svn path=/trunk/; revision=1207
1999-12-04More infrastructure changes for Ethereal - makeGuy Harris1-2/+2
"wtap_file_type_string()" take, as its argument, a file type, rather than a "wtap *". Fix some range checks of file types to check against WTAP_NUM_FILE_TYPES rather than WTAP_NUM_ENCAP_TYPES. svn path=/trunk/; revision=1201
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-26 23:07:24 +0000