aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap
AgeCommit message (Collapse)AuthorFilesLines
2011-12-03Update some comments to reflect current reality (as in "a lot of stuffGuy Harris1-16/+25
is no longer available, but there's an IETF list of snoop datalink types, at least"). svn path=/trunk/; revision=40080
2011-12-02from Petr Sumbera:Jaap Keuter4-2/+8
Solaris 11 snoop files with IP over Infiniband data are not recognized. Attached patch allows to view such data. svn path=/trunk/; revision=40072
2011-11-18Fail if somebody tries to write out a packet with an unsupportedGuy Harris1-7/+16
encapsulation. svn path=/trunk/; revision=39944
2011-11-18Make sure pcap-ng supports a particular encapsulation type beforeGuy Harris1-1/+17
trying to write out an interface description block for an interface with that type. svn path=/trunk/; revision=39930
2011-11-17Add checks to make sure we don't overflow the maximum 32-bit fileGuy Harris1-0/+37
offset. svn path=/trunk/; revision=39915
2011-11-17Rename pletonll() to reflect what it actually does, namely convert aGuy Harris3-4/+4
host-byte-order 64-bit integral quantity to little-endian byte order. svn path=/trunk/; revision=39900
2011-11-17A new macro needed by the WTAP_ENCAP_PER_PACKET support for writingGuy Harris1-0/+8
NetMon files. svn path=/trunk/; revision=39899
2011-11-17Add support for writing WTAP_ENCAP_PER_PACKET files; they are writtenGuy Harris1-13/+77
out in version 2.1 of the file format (the minimum version to support that). Change some data types to avoid having file offsets that are before the beginning of the file. Clean up some other data types and some comments. svn path=/trunk/; revision=39898
2011-11-17Return *some* error if we end up trying to seek before the beginning ofGuy Harris1-1/+1
the file, so you don't get weird random errors. EINVAL is as good as anything. svn path=/trunk/; revision=39896
2011-11-17Put back the check for dates that can be represented in DOS format theGuy Harris1-1/+1
way it was *supposed* to be done, rather than backwards. svn path=/trunk/; revision=39895
2011-11-17Revert part of r39883 to avoid dereferencing a NULL pointer. Thanks Clang.Chris Maynard1-1/+1
svn path=/trunk/; revision=39894
2011-11-16Support nanosecond-resolution time for NetMon 2.x format (it's onlyGuy Harris1-41/+125
100-nanosecond resolution, but that's still better than microsecond resolution). For NetMon 1.x format, only claim to support millisecond resolution, as that's all you get. Fix handling of negative time deltas in NetMon 2.x format. When writing a NetMon file, trim the time of the first packet to millisecond precision to get the capture start time, so that the start time written to the file (which has millisecond precision) is the same as the start time used to calculate the deltas written to the packet headers. svn path=/trunk/; revision=39886
2011-11-16OK, this should do it.Guy Harris1-1/+1
svn path=/trunk/; revision=39885
2011-11-16Fix build on Windows.Guy Harris1-2/+2
svn path=/trunk/; revision=39884
2011-11-16Another place where we have to protect against MSVC's time-conversionGuy Harris1-1/+9
routines blowing up if handed a too-large time_t. While we're at it, also check for dates that can't be represented in DOS format (pre-1980 dates). svn path=/trunk/; revision=39883
2011-11-16Another place where we have to protect against MSVC's time-conversionGuy Harris1-0/+8
routines blowing up if handed a too-large time_t. svn path=/trunk/; revision=39882
2011-11-13Clean up white space.Guy Harris1-8/+11
Note that we don't need to set the FCS length, but might as well do so anyway. svn path=/trunk/; revision=39816
2011-11-12Add entries for WTAP_ENCAP_NETANALYZER... to encap_table_base[]Bill Meier1-1/+7
svn path=/trunk/; revision=39810
2011-11-12From Holger Pfrommer:Anders Broman2-0/+13
Enhancement of Hilscher Analyzer Dissector. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6082 svn path=/trunk/; revision=39804
2011-11-11Add (missing) "mime" entry to encap_table_base[].Bill Meier1-3/+6
svn path=/trunk/; revision=39796
2011-11-04Updates based on stuff seen in a new capture.Guy Harris1-21/+58
I'm leaving debug messages in, but #if 0'ed out, for now. svn path=/trunk/; revision=39736
2011-10-28It appears that the "packet" records are actually "stuff from the ISDNGuy Harris1-10/+63
link" records, including stuff that's from a G.704 PRI frame but not from a D or H channel in that frame. Handle them (currently, we ignore them). The low-order bit of the flags field for "packet" records" is "network to user" (NT->TE), not "user to network" (TE->NT). svn path=/trunk/; revision=39663
2011-10-28The version string field isn't followed by 20 bytes of stuff; the last 8Guy Harris1-2/+11
bytes of what we thought was a version string appears to be an 8-byte record of some sort in the captures we originally looked at, and appears to be a non-8-byte record in another capture. If we treat that as a record, the version string field appears to be null-padded and 41 bytes long. svn path=/trunk/; revision=39645
2011-10-27Fix cut-and-pasteo that happened not to cause a problem on *P64Guy Harris1-22/+1
platforms but failed on *P32 platforms. Remove the debugging code (the above was the problem in question). svn path=/trunk/; revision=39628
2011-10-26Add some debugging code; the current code doesn't work when compiledGuy Harris1-0/+21
with MSVC on Win32, and the fix will remove the debugging code as well. svn path=/trunk/; revision=39624
2011-10-26Put the magic number into the aethra_hdr structure, to avoid compilerGuy Harris1-11/+13
padding of the structure getting in the way (it should now not require padding). svn path=/trunk/; revision=39619
2011-10-26Add the code to read Aethra files.Guy Harris1-0/+1
svn path=/trunk/; revision=39592
2011-10-26Ok, we found what appears to be the capture start time. Use it.Guy Harris1-5/+38
Also mark what appear to be strings in the file header. svn path=/trunk/; revision=39591
2011-10-26It appears that the octet in the record header after the record lengthGuy Harris1-27/+42
might be a record type, with 0 being a "Stop Monitor" record and 1 being a packet. Ignore records other than packet records. svn path=/trunk/; revision=39590
2011-10-26Avoid warnings.Guy Harris1-1/+3
svn path=/trunk/; revision=39589
2011-10-26Initial support for .aps files from Aethra Telecommunications' PC108Guy Harris5-1/+259
software. More work is needed: we don't know where the capture start time is yet; we aren't handling the "stop capture" record; we don't know where the ISDN channel is; there might be non-ISDN file formats; but this at least is easier than trying to text2pcap hex dumps from that software into pcap files. svn path=/trunk/; revision=39588
2011-10-21From Huzaifa Sidhpurwala of Red Hat Security Response Team:Gerald Combs1-0/+20
I found a heap-based buffer overflow, when parsing ERF file format. The overflow seems to be controlled by the values read from the file, and hence seems exploitable to me. svn path=/trunk/; revision=39508
2011-10-14Removed newencap as it's unused.Stig Bjørlykke1-2/+1
svn path=/trunk/; revision=39419
2011-10-12From Tobias Witek: Anders Broman1-0/+1
This patch extends the ATM parser so as to allow GPRS NS traffic encapsulated in ATM AAL5. Additionally, added support for this into the 'Meta' dissector. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6447 svn path=/trunk/; revision=39394
2011-10-12From Robert Bullen: Fix for: Two minor bugs in Wiretap library:Bill Meier2-12/+12
First bug: The Network Instruments Observer file format abbreviation is incorrect. It is "niobserverv" instead of "niobserver", which is probably a vestige from 1.4 when the abbreviation was "niobserverv9". Second bug: The packet header magic number field is correctly swapped the first time when reading the entire packet header. It is incorrectly swapped yet again when reporting an invalid value. Both swaps use GUINT_FROM_LE, which is a no-op on little-endian platforms. But the error message that is displayed to users of big-endian platforms will contain a byte-reversed value. svn path=/trunk/; revision=39392
2011-10-04From Andrew Kampjes:Anders Broman1-18/+29
Allows the saving of packets with snapped length to ERF. Prevents the adding of automatic CRC and rounds down to the nearest 8 bytes instead of up, adding zeros. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6409 svn path=/trunk/; revision=39247
2011-09-21Fix ex "modeline" so it works;Bill Meier1-1/+1
See https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5748 svn path=/trunk/; revision=39081
2011-09-13Skip extra info if present (IP with LTE PDCP threading info).Martin Mathieson1-2/+12
svn path=/trunk/; revision=38983
2011-09-06Don't synthesize a CRC if the packet already has one.Guy Harris1-5/+17
svn path=/trunk/; revision=38905
2011-09-03Check return value from wtap_dump_file_write.Stig Bjørlykke1-1/+2
This fixes CID 1272. svn path=/trunk/; revision=38876
2011-09-01Merge pcap_fill_in_pseudo_header() into pcap_read_post_process().Guy Harris4-44/+20
svn path=/trunk/; revision=38844
2011-09-01Use guint8 rather than guchar for raw octets and pointers to arrays ofGuy Harris36-215/+230
same. Add to wiretap/pcap-common.c a routine to fill in the pseudo-header for ATM (by looking at the VPI, VCI, and packet data, and guessing) and Ethernet (setting the FCS length appropriately). Use it for both pcap and pcap-ng files. svn path=/trunk/; revision=38840
2011-09-01Set eth.fcs_len in the pseudo-header for Ethernet packets.Guy Harris1-30/+39
Set the pseudo-header when doing the sequential read as well as when doing random reads. When writing packets to a CommView file, use a slightly less contorted way to get the year/month/day/hour/minute/second values. commview_dump() uses the pseudo_header argument; don't mark it as unused. svn path=/trunk/; revision=38833
2011-08-31Not ideal, but OK for now - alignbytes, at that point, is < 8, so weGuy Harris1-3/+2
know it'll fit in a gint16. (alignbytes really shouldn't need to be 64 bits, as if we have 2^63-1 bytes of alignment, We Have A Problem; fixing that may involve calculating it differently earlier in that routine.) svn path=/trunk/; revision=38828
2011-08-31Try using gint64 for alignbytes.Stig Bjørlykke1-1/+1
svn path=/trunk/; revision=38827
2011-08-31From Andrew Kampjes via bug 6260:Stig Bjørlykke4-3/+218
Added support for saving ERF files. From me: Use crc routines from libwsutil. svn path=/trunk/; revision=38826
2011-08-30Handle multiple extension headers when calculating the pseudo-headerGuy Harris1-3/+35
length, and actually write out the extension headers when writing out the pseudo-header. Fixes bug 6265. svn path=/trunk/; revision=38792
2011-08-30A zero snaplen means "snaplen unknown", as in "the file format fromGuy Harris1-1/+2
which we read the data to be written doesn't record the snapshot length". A snapshot length of 0 in a pcap or pcap-ng file is not handled well by many programs reading those files; for pcap files, we write out WTAP_MAX_PACKET_SIZE as the snapshot length in that case, so do so for pcap-ng files as well. svn path=/trunk/; revision=38790
2011-08-16Based on patch from Denis Ovsienko viaJeff Morriss1-1/+1
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6244 : Fix typo: s/unkown/unknown/ svn path=/trunk/; revision=38561
2011-08-11From Hanspeter via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6229 :Jeff Morriss1-6/+6
If an EnhancedPacketBlock in a pcapng file contains a comment option the content isn't displayed. Instead "Malformed packet" is displayed with the reason Exception occurred. The reason for the problem is a bug in the pcapng.c, where for enhanced packet blocks, interface description blocks and interface statistics blocks the wrong union members are used to set the comment. This way required fields in the structures are overwritten. The attached patch solves the problem. svn path=/trunk/; revision=38491
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-28 08:16:32 +0000