aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/wtap.h
AgeCommit message (Collapse)AuthorFilesLines
2003-05-15From Can Erkin Acar: OpenBSD is now using tcpdump.org-assigned DLT_Guy Harris1-3/+4
value for DLT_PFLOG, and that goes along with a change to the link-layer header for DLT_PFLOG - support both the old and new values and format. svn path=/trunk/; revision=7676
2003-03-08WTAP_ENCAP_ENC was, in fact, intended for use for DLT_ENC, so justGuy Harris1-2/+2
rename WTAP_ENCAP_ENC0 to WTAP_ENCAP_ENC. un-#if 0 out the code to handle the value 109 for DLT_ENC, as I've just checked in support for DLT_ENC in tcpdump.org libpcap and tcpdump, which maps DLT_ENC to 109 in the file header. Give packet-enc.c an RCS ID. svn path=/trunk/; revision=7323
2003-03-07From Markus Friedl:Gerald Combs1-2/+3
Add support for the OpenBSD enc(4) encapsulating interface. Add support for Ethernet over IP (RFC 3378). Fold Markus' .h files into their respective .c files, add a define to ipproto.h and use it. svn path=/trunk/; revision=7310
2003-01-31Add WTAP_ENCAP_FRELAY_WITH_PHDR for use with Frame Relay capture filesGuy Harris1-14/+15
that have direction information. Support writing WTAP_ENCAP_FRELAY_WITH_PHDR and WTAP_ENCAP_PPP_WITH_PHDR captures out in libpcap format - we throw away the direction information, but so it goes. When reading/writing Windows Sniffer format, read and write the direction flag. svn path=/trunk/; revision=7052
2003-01-23In the BSDs, ARCNET packets don't have an offset field between theGuy Harris1-28/+29
addresses and the protocol type, as supplied by BPF; on Linux, they *do* have an offset field, as supplied by PF_PACKET sockets. Add a new WTAP_ENCAP_ARCNET_LINUX, with packets that include the offset field, and don't dissect an offset in WTAP_ENCAP_ARCNET packets. Map a libpcap link-layer type of 129 to WTAP_ENCAP_ARCNET_LINUX; that value was recently assigned to Linux-style ARCNET. Add some more ARCNET protocol IDs. For most protocol IDs, dissect an ATA 878.2 fragmentation header; don't do it for RFC 1051 IP and ARP, and Diagnose packets. Set the length of the ARCNET protocol tree item appropriately. Dissect both the RFC 1051 and RFC 1201 styles of IP and ARP over ARCNET, and dissect the RFC 1201 style of RARP as well. svn path=/trunk/; revision=6981
2003-01-10The Sniffer file formats include a file to identify raw cells; exportGuy Harris1-1/+7
that flag in the ATM pseudo-header, and use it to determine whether a frame is a raw cell or a reassembled frame, rather than using the AAL, as you can have raw AAL5 cells in a capture. svn path=/trunk/; revision=6889
2003-01-09It appears that a channel number of 0 means DTE->DCE, and a channelGuy Harris1-2/+2
number of 1 means DCE->DTE, in DOS Sniffer ATM captures. svn path=/trunk/; revision=6881
2003-01-08From Chris Waters: support Tazmen Sniffer Protocol and DLT_TZSP capturesGuy Harris1-2/+3
from network-based libpcaps that use that protocol. svn path=/trunk/; revision=6875
2003-01-03Add support for SDLC encapsulation in DOS Sniffer captures; thatGuy Harris1-3/+4
includes adding an SDLC dissector. svn path=/trunk/; revision=6848
2003-01-03Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not justGuy Harris1-22/+23
used for the DOS-based ATM Sniffer. (That's not a great name, but I couldn't think of a better one.) Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture files where reassembled frames don't have trailers, such as the AAL5 trailer, chopped off. That's what at least some versions of the Windows-based ATM Sniffer appear to have. Map the ATM capture file type for NetXRay captures to WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've reverse-engineered, so far, for the pseudo-header; there's more that needs to be done on it, e.g. getting the channel, AAL type, and traffic type (or inferring them if they're not in the packet header). svn path=/trunk/; revision=6840
2002-12-20This adds the beginning of support for Wellfleet HDLC to ngsniffer.c asRichard Sharpe1-2/+3
well as Cisco HDLC support. It compiles OK, but I do not claim that it is not borken. I will have to add a small dissector that eats the first two bytes and then calls the Ethernet dissector as well, to complete the work. svn path=/trunk/; revision=6809
2002-12-05Sigh. We really *do* have to check whether a capture is a snoop orGuy Harris1-23/+24
Surveyor capture, as there's one link-layer type that UNICOS/mp snoop treats one way and Shomiti Surveyor treats another way. The only way to check that is to look at the first record to see how much padding it has. svn path=/trunk/; revision=6750
2002-11-06From Solomon Peachy: support for new "wlancap" 802.11 extra-informationGuy Harris1-2/+3
header. Add overflow checks to "BYTES_ARE_IN_FRAME()", and cast all arguments to unsigned values (negative values should never be passed) to squelch compiler warnings. svn path=/trunk/; revision=6567
2002-10-31Discard the WTAP_ENCAP_LAPD encapsulation type in favor of aGuy Harris1-5/+13
WTAP_ENCAP_ISDN encapsulation type, which includes a pseudo-header giving the direction (user-to-network or network-to-user) and the channel number. Add a new circuit type, using the ISDN channel number as the circuit ID. Add an ISDN dissector to put the direction and channel number into the protocol tree and to call the appropriate dissector for the payload based on the channel (LAPD for the D channel; V.120, PPP, or data for B channels, based on some heuristics). svn path=/trunk/; revision=6521
2002-10-22Add a Wiretap encapsulation type for RFC 2625 IP-over-Fibre Channel, andGuy Harris1-2/+3
map libpcap's DLT_IP_OVER_FC to it. svn path=/trunk/; revision=6473
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-4/+4
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6115
2002-08-16Updates from Motonori Shindo.Guy Harris1-11/+7
svn path=/trunk/; revision=6000
2002-07-31Add conditional include of winsock2.h again, so compilation with MSVC++Jörg Mayer1-1/+5
will work again without complaints. svn path=/trunk/; revision=5925
2002-07-31From Motonori Shindo: support for reading CoSine L2 debug output.Guy Harris1-3/+38
svn path=/trunk/; revision=5922
2002-07-29From Joerg Mayer:Guy Harris1-20/+12
All files: - Replace types from sys/types.h by those from glib.h - Replace ntoh family of macros from netinet/in.h and winsock2.h by g_ntoh family from glib.h - Remove now unneeded includes of sys/types.h, netinet/in.h and winsock2.h wtap.h Move includes to the top svn path=/trunk/; revision=5909
2002-07-16From Graeme Hewson:Guy Harris1-13/+15
Allow "-" as the output file name in Wiretap, referring to the standard error. Optimize the capture loop. Fix some of the error-message printing code in Ethereal and Tethereal. Have Wiretap check whether it can seek on a file descriptor, and pass the results of that test to the file-type-specific "open for output" routine. Have the "open for output" routines for files where we need to seek when writing the file return an error if seeks don't work. svn path=/trunk/; revision=5884
2002-07-12From Anand V. Narwani:Guy Harris1-2/+3
DOCSIS support, including support for "Ethernet" captures where the raw frame is a DOCSIS frame rather than an Ethernet frame (some Cisco cable-modem head-end gear can send out a trace of all traffic on an Ethernet, but what it sends are the raw bytes of DOCSIS frames, not Ethernet frames) Get rid of second AUTHORS entry for Devin Heitmueller, merging its item into the older entry. Clean up the order of some lists of plugin items. svn path=/trunk/; revision=5861
2002-06-23WinPcap 2.3's <pcap.h> includes <packet32.h>, and WinPcap 2.3'sGuy Harris1-3/+3
<packet32.h> includes <winsock2.h>; we include that rather than <winsock.h>, to avoid errors due to conflicting declarations in <winsock.h> and <winsock2.h>. svn path=/trunk/; revision=5742
2002-06-07Add a Wiretap routine to process packets captured via libpcap, possiblyGuy Harris1-4/+1
extracting a pseudo-header, for the use of SunATM captures. Add support for SunATM capture. svn path=/trunk/; revision=5652
2002-06-07Add a new error for attempts to open a pipe or FIFO for random access.Guy Harris1-16/+18
Have "wtap_open_offline()", if asked to open a FIFO, return that error if it was asked to open the file for random access. svn path=/trunk/; revision=5643
2002-05-28Add support for old NetXRay format.Guy Harris1-17/+18
svn path=/trunk/; revision=5576
2002-04-30Replace the "ngsniffer_atm" with an "atm" pseudo-header, which isn'tGuy Harris1-64/+76
just an image of the ATM Sniffer data. This means that Ethereal doesn't have to know any ATM Sniffer-specific details (that's all hidden in Wiretap), and allows us to add to that pseudo-header fields, traffic types, etc. unknown to ATM Sniffers. Have Wiretap map VPI 0/VCI 5 to the signalling AAL - for some capture files, this might not be necessary, as they may mark all signalling traffic as such, but, on other platforms, we don't know the AAL, so we assume AAL5 except for 0/5 traffic. Doing it in Wiretap lets us hide those details from Ethereal (and lets Ethereal interpret 0/5 traffic as non-signalling traffic, in case that happens to be what it is). We may know that traffic is LANE, but not whether it's LE Control or emulated 802.3/802.5; handle that case. svn path=/trunk/; revision=5302
2002-04-09Move the definition of the FROM_DCE bit in the "flags" field of aGuy Harris1-3/+3
"struct x25_phdr" to "wiretap/wtap.h". Have two X.25 dissectors, one of which assumes that there's a "struct x25_phdr" pseudo-header and one of which doesn't; the former uses the information in that pseudo-header to determine whether the packet is DTE->DCE or DCE->DTE, and the latter assumes it has no clue whether the packet is DTE->DCE or DCE->TDE. Use the former one in the LAPB dissector, and the latter one in the XOT dissector and in the LLC dissector table. In the X.25-over-TCP dissector, handle multiple X.25 packets per TCP segment, and handle X.25 packets split across TCP segments. svn path=/trunk/; revision=5134
2002-04-08Use WTAP_ENCAP_IEEE_802_11_WITH_RADIO for AiroPeek files, rather thanGuy Harris1-4/+3
having a special encapsulation type for AiroPeek files. svn path=/trunk/; revision=5123
2002-04-08Add an encapsulation type for "802.11 with radio information"; that typeGuy Harris1-11/+20
returns radio information such as signal strength, channel, and data rate in a pseudo-header. Add that pseudo-header. Use the "802.11 with radio information" encapsulation type for Wireless Sniffer files; extract the radio information from where it appears to be in the header. Add dissector code for that encapsulation type. Fix an error in the code to put radio information into the AiroPeek tree. Make the "wrapped" flag for NetXRay/Windows Sniffer captures a "gboolean". svn path=/trunk/; revision=5122
2002-03-05Make "wtap_seek_read()" return TRUE on success and FALSE on error, likeGuy Harris1-3/+3
"wtap_read()". Add some additional error checks to the Sniffer file reader. svn path=/trunk/; revision=4875
2002-03-05Have "wtap_seek_read()" return 0 on success and -1 on failure, and takeGuy Harris1-3/+3
an "err" argument that points to an "int" into which to put an error code if it fails. Check for errors in one call to it, and note that we should do so in other places. In the "wtap_seek_read()" call in the TCP graphing code, don't overwrite "cfile.pseudo_header", and make the buffer into which we read the data WTAP_MAX_PACKET_SIZE bytes, as it should be. In some of the file readers for text files, check for errors from the "parse the record header" and "parse the hex dump" routines when reading sequentially. In "csids_seek_read()", fix some calls to "file_error()" to check the error on the random stream (that being what we're reading). svn path=/trunk/; revision=4874
2002-02-07Support in Wiretap for DLT_HHDLC, from Tomas Kukosa.Guy Harris1-2/+3
svn path=/trunk/; revision=4707
2002-02-01Update a comment.Guy Harris1-4/+7
svn path=/trunk/; revision=4655
2002-01-29Untested support for AiroPeek captures.Guy Harris1-2/+3
svn path=/trunk/; revision=4619
2002-01-29Support for capturing on, and reading captures from, OpenBSD firewallGuy Harris1-2/+3
logging virtual interface, from Mike Frantzen. svn path=/trunk/; revision=4616
2002-01-23Get rid of "m"/"M" and other Macintosh references in names - it appearsGuy Harris1-3/+3
that EtherPeek for Windows uses the same format as EtherPeek for MacOS, so the code isn't specific to the MacOS version. Check the physMedium value in the secondary header, and leave a placeholder for a value of 1, which is presumably used in AiroPeek captures. Treat unknown mediaType and physMedium values as indications that we don't have a *Peek file, not as unsupported *Peek files - we need all the heuristics we can get. svn path=/trunk/; revision=4601
2002-01-18In the EtherPeek file reader, keep the capture start time in a privateGuy Harris1-7/+17
data structure attached to the "wtap" structure, rather than in a pseudo-header structure; get rid of the EtherPeek pseudo-header structure, as it's not actually used as a pseudo-header, it's just used as private data for the EtherPeek reader. Get rid of an extra level of indentation in switch statements. svn path=/trunk/; revision=4561
2001-12-04Support for reading Visual Networks traffic capture files, from TomGuy Harris1-2/+3
Nisbet. Make a comment in "wiretap/file.c" clearer, so people know where to put the entries for their capture file type. svn path=/trunk/; revision=4328
2001-12-04Make the bytes-written information from Wiretap a long, as we allowGuy Harris1-2/+3
files to get that big. From Thomas Wittwer and Matthias Nyffenegger: Support for "ring buffer mode", wherein there's a ring buffer of N capture files; as each capture file reaches its maximum size (the ring buffer works only with a maximum capture file size specified), Ethereal rolls over to the next capture file in the ring buffer, replacing whatever packets might be in it with new packets. svn path=/trunk/; revision=4323
2001-12-04Support for stopping capture at specified capture file size or captureGuy Harris1-1/+2
duration, from Thomas Wittwer and Matthias Nyffenegger. svn path=/trunk/; revision=4322
2001-11-30Add support for LocalTalk Link Access Protocol.Guy Harris1-3/+4
Rename WTAP_ENCAP_PRISM to WTAP_ENCAP_PRISM_HEADER, to match DLT_PRISM_HEADER. Add in missing capture support for WTAP_ENCAP_PRISM_HEADER when capturing with "pcap_open_live()" rather than reading the capture from a pipe. svn path=/trunk/; revision=4299
2001-11-28Support for 802.11+Prism II monitor-mode link-layer headers, fromGuy Harris1-2/+3
Tim Newsham. Add in missing item for WTAP_ENCAP_CISCO_IOS in the Wiretap encapsulation type table. svn path=/trunk/; revision=4290
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4199
2001-11-06Add in some heuristics to try to detect AIX libpcap format. (This worksGuy Harris1-24/+25
with one capture I've seen, but perhaps that was done with an old version of AIX, and newer versions use a minor version number, in the file, of 4. However, libpcap hasn't used a minor version of 2 for ages, so perhaps AIX hasn't updated their libpcap in ages, and aren't about to do so soon. If they do, let's hope they change the magic number. The capture file in question *does* have the capture length and real length in the old, pre-2.3, order, so it really looks as if it's an old version, rather than IBM trying to be "helpful" by using a different minor version number so that you can distinguish between normal libpcap and AIX libpcap formats.) svn path=/trunk/; revision=4164
2001-11-02Support DLT_CISCO_IOS.Gilbert Ramirez1-2/+3
svn path=/trunk/; revision=4126
2001-10-19DBS Etherwatch wiretap module, from Marc Milgram.Guy Harris1-2/+3
svn path=/trunk/; revision=4042
2001-10-18VMS TCPIPtrace wiretap module, from Marc Milgram.Guy Harris1-2/+3
Update the lists of known capture file formats in the Tethereal, editcap, and mergecap man pages to match the current list (as found in the Ethereal man page). svn path=/trunk/; revision=4039
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris1-5/+5
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
2001-09-23Update the URL for ATM-on-Linux.Guy Harris1-2/+2
svn path=/trunk/; revision=3949
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-24 01:55:39 +0000