aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap
AgeCommit message (Collapse)AuthorFilesLines
2002-01-30Bug fixes from Marc Milgram.Guy Harris1-49/+46
svn path=/trunk/; revision=4632
2002-01-29Untested support for AiroPeek captures.Guy Harris3-10/+11
svn path=/trunk/; revision=4619
2002-01-29Support a libpcap link-layer type of 17 as DLT_PFLOG unless DLT_LANE8023Guy Harris1-3/+4
is defined as 17. svn path=/trunk/; revision=4617
2002-01-29Support for capturing on, and reading captures from, OpenBSD firewallGuy Harris3-4/+20
logging virtual interface, from Mike Frantzen. svn path=/trunk/; revision=4616
2002-01-25From Motonori Shindo: protect include of <netinet/in.h> with #ifdefGuy Harris1-1/+3
HAVE_NETINET_IN_H. svn path=/trunk/; revision=4610
2002-01-24Add support for ATM captures (based on writing one out and handing it toGuy Harris1-34/+171
NetMon 2.0; I don't have any ATM captures *from* NetMon to try it on, so I don't know what significance the "destination address" and "source address" fields have, but we can at least read the captures we ourselves write out, as can NetMon). svn path=/trunk/; revision=4606
2002-01-23Get rid of "m"/"M" and other Macintosh references in names - it appearsGuy Harris3-104/+172
that EtherPeek for Windows uses the same format as EtherPeek for MacOS, so the code isn't specific to the MacOS version. Check the physMedium value in the secondary header, and leave a placeholder for a value of 1, which is presumably used in AiroPeek captures. Treat unknown mediaType and physMedium values as indications that we don't have a *Peek file, not as unsupported *Peek files - we need all the heuristics we can get. svn path=/trunk/; revision=4601
2002-01-22Fix up various product names and descriptions in the lists of fileGuy Harris1-3/+3
formats we can read; include vendor names. We should be able to read TokenPeek captures, as well as captures from the Windows versions of EtherPeek. Don't list the version numbers for EtherPeek and TokenPeek - those are file format version numbers, not program version numbers. svn path=/trunk/; revision=4599
2002-01-22From Alan Harrison: set "wth->phdr.pkt_encap" to "wth->file_encap" inGuy Harris1-1/+2
the V7-format read routine. svn path=/trunk/; revision=4597
2002-01-21Fixes to EtherPeek file reader code, from Alan Harrison.Guy Harris1-15/+44
svn path=/trunk/; revision=4593
2002-01-18The time base in an EtherPeek capture isn't necessarily the start timeGuy Harris2-15/+14
of the capture, so change some names and comments. svn path=/trunk/; revision=4563
2002-01-18It's EtherPeek, not Etherpeek, as WildPackets' Web site indicates.Guy Harris2-11/+11
svn path=/trunk/; revision=4562
2002-01-18In the EtherPeek file reader, keep the capture start time in a privateGuy Harris3-68/+99
data structure attached to the "wtap" structure, rather than in a pseudo-header structure; get rid of the EtherPeek pseudo-header structure, as it's not actually used as a pseudo-header, it's just used as private data for the EtherPeek reader. Get rid of an extra level of indentation in switch statements. svn path=/trunk/; revision=4561
2002-01-15From Marc Milgram: fix to allow VMS TCPIPtrace files that don't haveGuy Harris1-2/+2
exactly 3 spaces before the word "TCPIPtrace" to be recognized. svn path=/trunk/; revision=4547
2002-01-11Oh, what the heck, write out FDDI and bit-swapped FDDI as the same typeGuy Harris1-2/+2
in Sniffer Classic files; there's nothing we can do about those platforms that bit-swap FDDI addresses before handing them to DLPI or whatever, so we'll just let people live with wrong FDDI addresses (or maybe someday put in code to bit-swap them before writing them out to the capture file). svn path=/trunk/; revision=4519
2002-01-09Provide a --disable-usr-local flag to configure so thatGilbert Ramirez1-26/+36
-I/usr/local/include and -L/usr/local/lib aren't automatically added to the build flags. svn path=/trunk/; revision=4507
2002-01-08From Marc Milgram: all packets in DBS Etherwatch and VMS TCPIPTRACEGuy Harris2-4/+4
captures are IP packets, so make the file encapsulation WTAP_ENCAP_RAW_IP rather than WTAP_ENCAP_PER_PACKET, so you can save those captures in other formats. svn path=/trunk/; revision=4503
2001-12-24VMS TCPIPtrace efficiency improvments, from Marc Milgram.Gerald Combs1-7/+12
svn path=/trunk/; revision=4446
2001-12-17From Irfan Khan: fix a couple of bugs in the pppdump reader.Guy Harris1-6/+6
svn path=/trunk/; revision=4414
2001-12-13Get rid of newly-introduced signed/unsigned comparison warning.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4392
2001-12-13Don't leak memory when closing a pppdump trace file.Gilbert Ramirez2-3/+12
The second argument to g_ptr_array_free() does not indicate to glib to free the objects that the pointers in the GPtrArray refer to, but simply whether or not the free the block of pointers. We have to free the objects ourselves. svn path=/trunk/; revision=4391
2001-12-12From Motonori Shindo:Guy Harris1-4/+4
fix a bogus batch mode inference rule of make, so that "vc60.pdb" files are created in the proper directory; delete ".pdb" files in a "nmake -f Makefile.nmake clean"; include the text2pcap and mergecap ".pdb" files in the Windows binary distribution. svn path=/trunk/; revision=4385
2001-12-08Fix white space.Guy Harris1-2/+2
svn path=/trunk/; revision=4359
2001-12-07Use "-no-cpp-precomp" rather than "-traditional-cpp" on MacOS X, as perGuy Harris1-4/+18
the "The Compiler and Tools" section on http://fink.sourceforge.net/doc/porting/basics.php Do so on MacOS X regardless of whether the compiler is called "gcc" or not, as that page also indicates that the compiler is installed as "cc". svn path=/trunk/; revision=4354
2001-12-06From Motonori Shindo: get rid of "send output to /dev/null" hack inGuy Harris3-17/+7
Ascend/Lucent trace reading code's Flex scanner. svn path=/trunk/; revision=4346
2001-12-05Update Gilbert's e-mail address.Guy Harris1-2/+2
svn path=/trunk/; revision=4340
2001-12-05The data structure for per-packet headers for Mac V5 and V6 EtherpeekGuy Harris1-64/+96
files would put a 32-bit quantity on a 16-bit boundary without padding; this means that many compilers will insert the padding and thus make the structure not match what's in the file. Instead of using a C structure, #define values for the offsets of fields, read the header into an array of bytes, and extract values using the offsets. svn path=/trunk/; revision=4334
2001-12-04In the NetMon capture file reading code, if we get a short read whenGuy Harris1-4/+4
trying to read the frame table, return -1 with "*err" set to WTAP_ERR_SHORT_READ, don't return 0 - we've already decided that the file is a NetMon file, so we shouldn't return a "this isn't a NetMon file" indication, we should return a "this file is too short" error, as that's what the problem is. Fix up the error messages for WTAP_ERR_SHORT_READ to indicate that the read might have gotten cut short in the middle of data other than a packet. svn path=/trunk/; revision=4331
2001-12-04Support for reading Visual Networks traffic capture files, from TomGuy Harris7-10/+718
Nisbet. Make a comment in "wiretap/file.c" clearer, so people know where to put the entries for their capture file type. svn path=/trunk/; revision=4328
2001-12-04From Motonori Shindo: fix Ascend/Lucent trace reading code to handleGuy Harris2-9/+109
later trace formats that have an ASCII dump at the end of the line. svn path=/trunk/; revision=4327
2001-12-04Make the bytes-written information from Wiretap a long, as we allowGuy Harris4-6/+14
files to get that big. From Thomas Wittwer and Matthias Nyffenegger: Support for "ring buffer mode", wherein there's a ring buffer of N capture files; as each capture file reaches its maximum size (the ring buffer works only with a maximum capture file size specified), Ethereal rolls over to the next capture file in the ring buffer, replacing whatever packets might be in it with new packets. svn path=/trunk/; revision=4323
2001-12-04Support for stopping capture at specified capture file size or captureGuy Harris5-4/+17
duration, from Thomas Wittwer and Matthias Nyffenegger. svn path=/trunk/; revision=4322
2001-11-30Add support for LocalTalk Link Access Protocol.Guy Harris3-7/+13
Rename WTAP_ENCAP_PRISM to WTAP_ENCAP_PRISM_HEADER, to match DLT_PRISM_HEADER. Add in missing capture support for WTAP_ENCAP_PRISM_HEADER when capturing with "pcap_open_live()" rather than reading the capture from a pipe. svn path=/trunk/; revision=4299
2001-11-28Support for 802.11+Prism II monitor-mode link-layer headers, fromGuy Harris3-5/+13
Tim Newsham. Add in missing item for WTAP_ENCAP_CISCO_IOS in the Wiretap encapsulation type table. svn path=/trunk/; revision=4290
2001-11-14Back the previous hack out - the padding is often zero, but it's notGuy Harris1-68/+3
*always* zero, so it won't always work, and it's somewhat gross. The right answer is "don't use Digital/Tru64 UNIX's tcpdump, use tcpdump.org's". svn path=/trunk/; revision=4202
2001-11-14Throw in a hack to try to detect FDDI captures from Digital UNIX'sGuy Harris1-3/+68
tcpdump and, if we think we've found one, strip off the 3 padding bytes they put in front of the frame. svn path=/trunk/; revision=4201
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez40-79/+79
svn path=/trunk/; revision=4199
2001-11-09Wrap calls to "pcap_datalink()" in a routine that attempts to compensateGuy Harris1-7/+8
for AIX 5.x's non-standard libpcap, where "pcap_datalink()" doesn't return DLT_ values, it returns RFC 1573 ifType values. Put that wrapper, and the routine to get the interface list, in a separate file, for packet-capture utility routines, so not everybody who includes "util.h" needs to include <pcap.h>. Fix up the Wiretap hack for dealing with said incompatibility to use the correct ifType value for Token Ring. svn path=/trunk/; revision=4184
2001-11-07Expand on the comments about AIX libpcap.Guy Harris1-6/+10
No, Nokia *weren't* kind enough to change the major or minor version number in the capture file when they changed the format, just as they weren't kind enough to change the magic number. svn path=/trunk/; revision=4173
2001-11-06Add in some heuristics to try to detect AIX libpcap format. (This worksGuy Harris3-27/+93
with one capture I've seen, but perhaps that was done with an old version of AIX, and newer versions use a minor version number, in the file, of 4. However, libpcap hasn't used a minor version of 2 for ages, so perhaps AIX hasn't updated their libpcap in ages, and aren't about to do so soon. If they do, let's hope they change the magic number. The capture file in question *does* have the capture length and real length in the old, pre-2.3, order, so it really looks as if it's an old version, rather than IBM trying to be "helpful" by using a different minor version number so that you can distinguish between normal libpcap and AIX libpcap formats.) svn path=/trunk/; revision=4164
2001-11-02Support DLT_CISCO_IOS.Gilbert Ramirez2-3/+6
svn path=/trunk/; revision=4126
2001-10-28Include <unistd.h>, if we have it, to declare "unlink()".Guy Harris1-1/+5
svn path=/trunk/; revision=4094
2001-10-25Interface type 0x07 is Ethernet.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=4078
2001-10-25Get rid of signed/unsigned comparison warnings in wiretap.Gilbert Ramirez6-23/+24
svn path=/trunk/; revision=4077
2001-10-19DBS Etherwatch wiretap module, from Marc Milgram.Guy Harris8-7/+417
svn path=/trunk/; revision=4042
2001-10-18VMS TCPIPtrace wiretap module, from Marc Milgram.Guy Harris8-16/+480
Update the lists of known capture file formats in the Tethereal, editcap, and mergecap man pages to match the current list (as found in the Ethereal man page). svn path=/trunk/; revision=4039
2001-10-16Don't create a Wiretap dump file unless we're at least sure we supportGuy Harris1-32/+69
the specified encapsulation with the specified capture file type, and that we can allocate a "wtap_dumper *". If we could do all that, and could create the dump file, but the file-type-specific create routine fails (e.g., because there's not enough disk space to write out the header), remove the dump file. svn path=/trunk/; revision=4032
2001-10-04Use longs as file offsets, so that on platforms with 64-bit "long" weGuy Harris19-93/+95
can handle capture files bigger than 2GB. svn path=/trunk/; revision=3993
2001-09-28We have our own internal versions of "gzgets()" and "gzgetc()", so weGuy Harris2-8/+8
don't need to check whether zlib has them. We *do*, however, have to check for "gzseek()", as we don't have our own version of that. svn path=/trunk/; revision=3963
2001-09-23Update the URL for ATM-on-Linux.Guy Harris1-2/+2
svn path=/trunk/; revision=3949
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-24 19:43:01 +0000