aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap
AgeCommit message (Collapse)AuthorFilesLines
2001-02-13Changes from Chris Jepeway toGuy Harris3-41/+111
in some places use "guint64", on plaforms where it's available, rather than floating point (we don't yet use it universally, as we'd have to provide code to do 64-bit arithmetic on platforms/compilers where 64-bit integral types aren't supported); use .838096 microseconds rather than 1 microseconds as the time stamp units for NetXRay 2.x format, as those capture files seem to use that time stamp (that's the Sniffer "PC" time stamp; perhaps when Network Associates assimilated Cinco, they changed the time stamp units). svn path=/trunk/; revision=3027
2001-01-27"autoheader" recognizes AC_CHECK_HEADERS as a macro that definesGuy Harris1-2/+2
HAVE_XXX_H if xxx.h is present, but doesn't recognize AC_CHECK_HEADER as such, and thus doesn't put anything about HAVE_XXX_H into "config.h.in", and thus HAVE_XXX_H doesn't get defined even if xxx.h is present. svn path=/trunk/; revision=2942
2001-01-25Finish up support for writing NetMon 2.x capture files.Guy Harris2-7/+22
(We really need to put in some rudimentary 64-bit integer support, for the benefit of platforms+compilers that don't support it; the floating-point calculations we're doing now appear not to get exactly the right answer, from an experiment at reading a NetMon 2.x file and writing it back out as NetMon 2.x with editcap.) svn path=/trunk/; revision=2939
2001-01-17Update a comment to reflect reality (we no longer skip all the extraGuy Harris1-2/+4
headers, we look at REC_HEADER2 records). svn path=/trunk/; revision=2911
2001-01-17Fixed potential buffer overflow in skip_header_records when processingJeff Foster1-17/+15
REC_HEADER2 encapsulation type. Modified skip_header_records to accept REC_HEADER3-REC_HEADER7. These header records would cause file read error if the capture file was compressed. svn path=/trunk/; revision=2910
2001-01-16Update a comment to reflect reality (we no longer skip all the extraGuy Harris1-3/+6
headers, we look at REC_HEADER2 records). svn path=/trunk/; revision=2904
2001-01-16Moved settingg wth->file_encap from sniffer_encap to precede theJeff Foster1-2/+6
skip_header_records call because skip_header_records function may set the field based upon the header records svn path=/trunk/; revision=2903
2001-01-16Code to get a putative network subtype from a type 7 record in anGuy Harris1-6/+86
"Internetwork analyzer" capture, from Jeff Foster. (It's not a replacement for the heuristics, as 1) at least one PPP capture doesn't have a type 7 record and 2) LAPB/X.25 and LAPD/ISDN might both be "HDLC" captures and we'd need to figure out how to tell them apart.) svn path=/trunk/; revision=2902
2001-01-10Fix up Gerald's e-mail address to be his "ethereal.com" address.Guy Harris1-1/+1
svn path=/trunk/; revision=2859
2001-01-08Code to handle Frame Relay Sniffer captures, from Jeff Foster.Guy Harris3-5/+14
Code to register the Frame Relay dissector to handle Frame Relay captures, from Paul Ionescu. svn path=/trunk/; revision=2845
2000-12-23Add support for the DLT_LINUX_SLL capture type in the current CVSGuy Harris3-4/+13
version of libpcap; that's used on Linux for captures on the "any" device (which captures from all interfaces simultaneously) and for captures on devices whose link-layer type libpcap doesn't (yet) support natively. The spanning tree code, when checking for GV{M,R,...}P packets, must first check whether the link-layer destination address is, in fact, an Ethernet-style address; on Linux cooked captures, there *is* no destination address, so it's of type AT_NONE, not AT_ETHER. svn path=/trunk/; revision=2772
2000-12-09Fix for pppdump buffer-overflow check.Gilbert Ramirez2-5/+16
From Daniel Thompson <daniel.thompson@st.com> svn path=/trunk/; revision=2748
2000-11-29Catch Sniffer packets where the record length for a record containing aGuy Harris1-1/+14
packet is too small to contain all the data that the frame header claims was captured for the packet; treat that as a bad record, and return an error. svn path=/trunk/; revision=2711
2000-11-22Generated Bison and Flex files test whether __STDC__ is definedGuy Harris1-0/+21
in order to check whether to use ANSI C features such as "const". GCC defines it as 1 even if extensions that render the implementation non-conformant are enabled; Sun's C compiler (and, I think, other AT&T-derived C compilers) define it as 0 if extensions that render the implementation non-conformant are enabled; Microsoft Visual C++ 6.0 doesn't define it at all if extensions that render the implementation non-conformant are enabled. We define it as 0 in "config.h.win32", so that those generated files will use those features (and thus not get type warnings when compiled with MSVC++). svn path=/trunk/; revision=2698
2000-11-22Change Ethereal homepage URL from etheral.zing.org to www.ethereal.com.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=2696
2000-11-19Add an overflow check to process_data().Gerald Combs1-1/+6
svn path=/trunk/; revision=2675
2000-11-19"wtap_read()" must *always* set "*err" when it returns FALSE - if it'sGuy Harris8-11/+25
just an EOF, it should set "*err" to 0. Fix up a bunch of read routines for various capture file types to set "*err" appropriately. svn path=/trunk/; revision=2667
2000-11-17Add #include <string.h>, to get prototypes for mem* and str* functions.Gilbert Ramirez5-5/+10
svn path=/trunk/; revision=2654
2000-11-15IEEE 802.11 support, from Johan Jorgensen of Axis Communications AB.Guy Harris3-5/+44
Add in stuff for a bunch of libpcap formats either in libpcap 0.5.2 or in the current CVS version; we don't implement all of them in Ethereal/Wiretap (those are "#if 0"ed out), but we do implement the IEEE 802.11 stuff (which isn't yet in libpcap or tcpdump, but the CVS version of libpcap *does* reserve 105 as the encapsulation type number for 802.11). svn path=/trunk/; revision=2646
2000-11-13Support for the BASE100 and GSC100BT subsystems by Jeff Foster.Olivier Abad2-62/+77
svn path=/trunk/; revision=2640
2000-11-13Improve the detection of the encapsulation used in a radcom file.Olivier Abad1-13/+11
svn path=/trunk/; revision=2639
2000-11-12"wtap_loop()" no longer has problems with packet offsets of 0, so weGuy Harris2-22/+73
don't need to work around that. The offset, for a given packet, at which "ascend_seek()" should start searching for that packet's header must be computed separately from the offset, for that packet, at which "ascend_seek()" should start searching for the *next* packet - if the file is a "wdd" capture, and the packet has a "Date:" header and a WD_DIALOUT_DISP header, the search for that packet should start at the beginning of the "Date:" header, but the search for the next packet should start after the WD_DIALOUT_DISP header, as if we start it after the "Date:" header, the search will stop at the packet's own WD_DIALOUT_DISP header, as a packet could have a WD_DIALOUT_DISP header but no "Date:" header. svn path=/trunk/; revision=2620
2000-11-12Not all packets in a "wdd" dump necessarily have a "Cause an attempt toGuy Harris3-21/+42
place call to" header (I presume this can happen if there was a call in progress when the packet was sent or received); don't require the Date: 01/12/1990. Time: 12:22:33 Cause an attempt to place call to 14082750382 to be present in every packet. (Only the date on the first packet is used, and only if it's present in the first packet; if the first packet doesn't have a date, we can't easily go back and fix up the previous packets, *especially* in programs such as Tethereal and editcap which make only one pass through the capture. We set the called number to a null string if that's the case; we could assume, in the sequential pass, that it's the phone number from the last call, and remember that for use when doing random access.) svn path=/trunk/; revision=2617
2000-11-11We have to set "x25.flags" in the Wiretap pseudo-header if the captureGuy Harris2-26/+123
is WTAP_ENCAP_LAPB *or* WTAP_ENCAP_V120, and we have to set "p2p.sent" in the capture file for *all* WTAP_ENCAP_LAPD captures; fix the i4btrace and Sniffer capture file readers to do so. (XXX - should we eliminate "x25.flags", and use "p2p.sent" instead? The directions for X.25 are DTE->DCE and DCE->DTE, not "sent" and "received", but I suspect that "sent" and "received" should be thought of from the point of view of the DTE, so DTE->DCE is "sent" and DCE->DTE is "received"; the directions for ISDN are user->network and network->user, but I suspect that "sent" and "received" should be thought of from the standpoint of the user equipment, so user->network is "sent" and network->user is "received".) svn path=/trunk/; revision=2606
2000-11-11In "wdd" captures:Guy Harris3-17/+41
fix the interpretation of the date and time reported in capture files; use that date and time only to set the start date and time of the capture, not to generate the time stamp for every packet. Make the "struct tm" used for that local to the code to handle that production in the grammar, rather than global. For all captures, we *can* now fstat a compressed file (and have been able to do so for a while, in fact), so revert to doing so and using the ctime of the capture file if we can't get a date and time from the file's contents. svn path=/trunk/; revision=2605
2000-11-11Add some comments, and fix one comment.Guy Harris1-4/+9
Remove what appear to be a pair of dangling "else"s. Before calling "mktime()" on a "struct tm", you have to set "tm_isdst", so it knows what to do about daylight savings time; set it to -1, so it picks the appropriate time (except, presumably, for those times that don't exist, when the clock is moved forward, where there is no appropriate time, and those times that exist twice, when the clock is moved backward, where there are *two* times and you can't tell which is appropriate). svn path=/trunk/; revision=2604
2000-10-17Add initial support for "type 12" frames. I have no documentation forGerald Combs1-1/+92
these other than a trace file a client sent me. The header appears to be similar to frame2 and frame4 records, but with extra bytes at the end. The trace file also contains record types 13 - 17 which appear to contain metainformation such as retransmit counts. svn path=/trunk/; revision=2508
2000-10-17Do checks for platform-specific compiler flags in the libethereal andGuy Harris1-1/+28
wiretap configure scripts as well as in the main configure script. svn path=/trunk/; revision=2501
2000-10-17Wiretap no longer works with "GLib 1.0[.x]" (the version that cameGuy Harris2-10/+2
bundled with GTK+ 1.0[.x]), it works only with 1.2[.x] and later, so we no longer need to check for 1.0[.x] and define HAVE_GLIB10. svn path=/trunk/; revision=2500
2000-09-28Add string representation for WTAP_ENCAP_PPP_WITH_PHDRGilbert Ramirez1-1/+5
svn path=/trunk/; revision=2464
2000-09-23Windows Sniffers appear to write out ATM traces with a network type ofGuy Harris1-2/+2
8, which is NDIS's ATM type. At least one capture appears to have LLC-encapsulated frames in it; for now, we'll map it to WTAP_ENCAP_ATM_RFC1483 - and make Ethereal dissect WTAP_ENCAP_ATM_RFC1483 by handing the frames to "dissect_llc()". While we're at it, we'll have Ethereal panic if handed a Wiretap packet type it doesn't dissect, rather than giving you a rather blank dissection. svn path=/trunk/; revision=2457
2000-09-21Make sure to pass the sent/received direction from pppdump.c inGilbert Ramirez10-31/+37
pseudo_header. Use generic "p2p_phdr" instead of "lapd_phdr". Modify toshiba.c and packet-lapd.c to take that into account. Add frame.p2p_dir, a filterable field, 0=sent, 1=recvd Make p2p_dir available in packe_info, as I think it will be needed in VJ COMP and UNCOMP dissection. Rename WTAP_ENCAP_TR to WTAP_ENCAP_TOKEN_RING. Mention pppd-log support in man page. Mention atmsnoop in README. svn path=/trunk/; revision=2455
2000-09-20Mention support for reading pppd log files.Gilbert Ramirez1-1/+6
svn path=/trunk/; revision=2452
2000-09-19Oh well, get rid of the debug printf's.Gilbert Ramirez1-89/+1
svn path=/trunk/; revision=2450
2000-09-19Add pppdump.obj to win32 makefile.Gilbert Ramirez1-1/+2
svn path=/trunk/; revision=2449
2000-09-19Add support for reading pppd log files in wiretap.Gilbert Ramirez6-5/+735
svn path=/trunk/; revision=2448
2000-09-19Shomiti Surveyor 3.x appears to have changed the version number in theGuy Harris1-3/+9
file header to 4; fortunately, as they appear to put their extensions to snoop into the padding at the end of the record, all their capture files look alike to programs such as snoop and Ethereal that ignore the padding, so we can just treat version 4 just like version 2 (unless and until Brent decides a new snoop format is called for, changes the record header, and picks a version number that's the same as one used by Shomiti). svn path=/trunk/; revision=2447
2000-09-17Close the handle for the SNMP library after we're done with it - sharedGuy Harris1-7/+11
objects are reference-counted so that won't make it disappear if Ethereal is also linked with it as a shared SNMP library. svn path=/trunk/; revision=2444
2000-09-15Code to read capture files from some version of tcpdump from some sortGuy Harris4-110/+316
of Nokia box (firewall) - yep, it's yet *another* mutant libpcap format that didn't change the magic number, sigh.... svn path=/trunk/; revision=2440
2000-09-13Updated to ignore Win32 detritusGraham Bloice1-0/+3
svn path=/trunk/; revision=2430
2000-09-12Add support for NetBSD DLT_PPP_SERIAL, which has the value 50, and whichGuy Harris1-1/+55
is, for now, handled as WTAP_ENCAP_PPP (although we may have to split WTAP_ENCAP_PPP into more than one type at some point). svn path=/trunk/; revision=2423
2000-09-07Change wtap_read() API so that the data offset is set via a pointer, andGilbert Ramirez16-214/+186
a "keep reading" boolean value is returned from the function. This avoids having to hack around the fact that some file formats truly do have records that start at offset 0. (i4btrace and csids have no file header. Neither does the pppdump-style file that I'm looking at right now). svn path=/trunk/; revision=2392
2000-08-31Re-arrange size and nmemb arguments in fread() (file_read()) calls soGilbert Ramirez1-8/+8
that these calls work on Win32. I still don't have a good reason as to why this is necessary, but it fixes the problem. I'll continue looking for a reason. svn path=/trunk/; revision=2386
2000-08-25Move #include <time.h> into wtap-int.h instead of requiring it inGilbert Ramirez10-19/+11
every C file. I noticed this because of a build break of csids.obj on Win32. svn path=/trunk/; revision=2378
2000-08-25Redo the way we map between libpcap encapsulation type codes and WiretapGuy Harris3-88/+262
encapsulation type codes - for those libpcap type codes whose numerical value is interpreted differently by different versions of libpcap, include <pcap.h> if you can and, if you can, use what it defines to control which Wiretap code we map those type codes to. Also, map the new libpcap type codes introduced by libpcap 0.5. svn path=/trunk/; revision=2369
2000-08-22More mention of csids support in wiretap.Gilbert Ramirez2-2/+7
svn path=/trunk/; revision=2335
2000-08-19Fix buffer overflow on zlib uncompression errors.Laurent Deniel1-2/+2
svn path=/trunk/; revision=2299
2000-08-15The caplen and iplen are not always going to be equal. Need to use > and <= ↵Mike Hall1-7/+12
instead of != ==. svn path=/trunk/; revision=2273
2000-08-12Initialize "last_blob" and "current_blob" when the file is opened.Guy Harris1-21/+23
Set "current_blob" when the first read is done from the random file, as "current_blob" is the current blob in the random file. svn path=/trunk/; revision=2262
2000-08-11Miscellaneous code cleaningLaurent Deniel21-23/+116
- add <stdarg.h> or <varargs.h> in snprintf.h and remove those inclusions in the other #ifdef NEED_SNPRINTF_H codes - remove the check of multiple inclusions in source (.c) code (there is a bit loss of _cpp_ performance, but I prefer the gain of code reading and maintenance; and nowadays, disk caches and VM are correctly optimized ;-). - protect all (well almost) header files against multiple inclusions - add header (i.e. GPL license) in some include files - reorganize a bit the way header files are included: First: #include <system_include_files> #include <external_package_include_files (e.g. gtk, glib etc.)> Then #include "ethereal_include_files" with the correct HAVE_XXX or NEED_XXX protections. - add some HAVE_XXX checks before including some system header files - add the same HAVE_XXX in wiretap as in ethereal Please forgive me, if I break something (I've only compiled and regression tested on Linux). svn path=/trunk/; revision=2254
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-25 06:39:59 +0000