aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap
AgeCommit message (Collapse)AuthorFilesLines
2000-11-22Generated Bison and Flex files test whether __STDC__ is definedGuy Harris1-0/+21
in order to check whether to use ANSI C features such as "const". GCC defines it as 1 even if extensions that render the implementation non-conformant are enabled; Sun's C compiler (and, I think, other AT&T-derived C compilers) define it as 0 if extensions that render the implementation non-conformant are enabled; Microsoft Visual C++ 6.0 doesn't define it at all if extensions that render the implementation non-conformant are enabled. We define it as 0 in "config.h.win32", so that those generated files will use those features (and thus not get type warnings when compiled with MSVC++). svn path=/trunk/; revision=2698
2000-11-22Change Ethereal homepage URL from etheral.zing.org to www.ethereal.com.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=2696
2000-11-19Add an overflow check to process_data().Gerald Combs1-1/+6
svn path=/trunk/; revision=2675
2000-11-19"wtap_read()" must *always* set "*err" when it returns FALSE - if it'sGuy Harris8-11/+25
just an EOF, it should set "*err" to 0. Fix up a bunch of read routines for various capture file types to set "*err" appropriately. svn path=/trunk/; revision=2667
2000-11-17Add #include <string.h>, to get prototypes for mem* and str* functions.Gilbert Ramirez5-5/+10
svn path=/trunk/; revision=2654
2000-11-15IEEE 802.11 support, from Johan Jorgensen of Axis Communications AB.Guy Harris3-5/+44
Add in stuff for a bunch of libpcap formats either in libpcap 0.5.2 or in the current CVS version; we don't implement all of them in Ethereal/Wiretap (those are "#if 0"ed out), but we do implement the IEEE 802.11 stuff (which isn't yet in libpcap or tcpdump, but the CVS version of libpcap *does* reserve 105 as the encapsulation type number for 802.11). svn path=/trunk/; revision=2646
2000-11-13Support for the BASE100 and GSC100BT subsystems by Jeff Foster.Olivier Abad2-62/+77
svn path=/trunk/; revision=2640
2000-11-13Improve the detection of the encapsulation used in a radcom file.Olivier Abad1-13/+11
svn path=/trunk/; revision=2639
2000-11-12"wtap_loop()" no longer has problems with packet offsets of 0, so weGuy Harris2-22/+73
don't need to work around that. The offset, for a given packet, at which "ascend_seek()" should start searching for that packet's header must be computed separately from the offset, for that packet, at which "ascend_seek()" should start searching for the *next* packet - if the file is a "wdd" capture, and the packet has a "Date:" header and a WD_DIALOUT_DISP header, the search for that packet should start at the beginning of the "Date:" header, but the search for the next packet should start after the WD_DIALOUT_DISP header, as if we start it after the "Date:" header, the search will stop at the packet's own WD_DIALOUT_DISP header, as a packet could have a WD_DIALOUT_DISP header but no "Date:" header. svn path=/trunk/; revision=2620
2000-11-12Not all packets in a "wdd" dump necessarily have a "Cause an attempt toGuy Harris3-21/+42
place call to" header (I presume this can happen if there was a call in progress when the packet was sent or received); don't require the Date: 01/12/1990. Time: 12:22:33 Cause an attempt to place call to 14082750382 to be present in every packet. (Only the date on the first packet is used, and only if it's present in the first packet; if the first packet doesn't have a date, we can't easily go back and fix up the previous packets, *especially* in programs such as Tethereal and editcap which make only one pass through the capture. We set the called number to a null string if that's the case; we could assume, in the sequential pass, that it's the phone number from the last call, and remember that for use when doing random access.) svn path=/trunk/; revision=2617
2000-11-11We have to set "x25.flags" in the Wiretap pseudo-header if the captureGuy Harris2-26/+123
is WTAP_ENCAP_LAPB *or* WTAP_ENCAP_V120, and we have to set "p2p.sent" in the capture file for *all* WTAP_ENCAP_LAPD captures; fix the i4btrace and Sniffer capture file readers to do so. (XXX - should we eliminate "x25.flags", and use "p2p.sent" instead? The directions for X.25 are DTE->DCE and DCE->DTE, not "sent" and "received", but I suspect that "sent" and "received" should be thought of from the point of view of the DTE, so DTE->DCE is "sent" and DCE->DTE is "received"; the directions for ISDN are user->network and network->user, but I suspect that "sent" and "received" should be thought of from the standpoint of the user equipment, so user->network is "sent" and network->user is "received".) svn path=/trunk/; revision=2606
2000-11-11In "wdd" captures:Guy Harris3-17/+41
fix the interpretation of the date and time reported in capture files; use that date and time only to set the start date and time of the capture, not to generate the time stamp for every packet. Make the "struct tm" used for that local to the code to handle that production in the grammar, rather than global. For all captures, we *can* now fstat a compressed file (and have been able to do so for a while, in fact), so revert to doing so and using the ctime of the capture file if we can't get a date and time from the file's contents. svn path=/trunk/; revision=2605
2000-11-11Add some comments, and fix one comment.Guy Harris1-4/+9
Remove what appear to be a pair of dangling "else"s. Before calling "mktime()" on a "struct tm", you have to set "tm_isdst", so it knows what to do about daylight savings time; set it to -1, so it picks the appropriate time (except, presumably, for those times that don't exist, when the clock is moved forward, where there is no appropriate time, and those times that exist twice, when the clock is moved backward, where there are *two* times and you can't tell which is appropriate). svn path=/trunk/; revision=2604
2000-10-17Add initial support for "type 12" frames. I have no documentation forGerald Combs1-1/+92
these other than a trace file a client sent me. The header appears to be similar to frame2 and frame4 records, but with extra bytes at the end. The trace file also contains record types 13 - 17 which appear to contain metainformation such as retransmit counts. svn path=/trunk/; revision=2508
2000-10-17Do checks for platform-specific compiler flags in the libethereal andGuy Harris1-1/+28
wiretap configure scripts as well as in the main configure script. svn path=/trunk/; revision=2501
2000-10-17Wiretap no longer works with "GLib 1.0[.x]" (the version that cameGuy Harris2-10/+2
bundled with GTK+ 1.0[.x]), it works only with 1.2[.x] and later, so we no longer need to check for 1.0[.x] and define HAVE_GLIB10. svn path=/trunk/; revision=2500
2000-09-28Add string representation for WTAP_ENCAP_PPP_WITH_PHDRGilbert Ramirez1-1/+5
svn path=/trunk/; revision=2464
2000-09-23Windows Sniffers appear to write out ATM traces with a network type ofGuy Harris1-2/+2
8, which is NDIS's ATM type. At least one capture appears to have LLC-encapsulated frames in it; for now, we'll map it to WTAP_ENCAP_ATM_RFC1483 - and make Ethereal dissect WTAP_ENCAP_ATM_RFC1483 by handing the frames to "dissect_llc()". While we're at it, we'll have Ethereal panic if handed a Wiretap packet type it doesn't dissect, rather than giving you a rather blank dissection. svn path=/trunk/; revision=2457
2000-09-21Make sure to pass the sent/received direction from pppdump.c inGilbert Ramirez10-31/+37
pseudo_header. Use generic "p2p_phdr" instead of "lapd_phdr". Modify toshiba.c and packet-lapd.c to take that into account. Add frame.p2p_dir, a filterable field, 0=sent, 1=recvd Make p2p_dir available in packe_info, as I think it will be needed in VJ COMP and UNCOMP dissection. Rename WTAP_ENCAP_TR to WTAP_ENCAP_TOKEN_RING. Mention pppd-log support in man page. Mention atmsnoop in README. svn path=/trunk/; revision=2455
2000-09-20Mention support for reading pppd log files.Gilbert Ramirez1-1/+6
svn path=/trunk/; revision=2452
2000-09-19Oh well, get rid of the debug printf's.Gilbert Ramirez1-89/+1
svn path=/trunk/; revision=2450
2000-09-19Add pppdump.obj to win32 makefile.Gilbert Ramirez1-1/+2
svn path=/trunk/; revision=2449
2000-09-19Add support for reading pppd log files in wiretap.Gilbert Ramirez6-5/+735
svn path=/trunk/; revision=2448
2000-09-19Shomiti Surveyor 3.x appears to have changed the version number in theGuy Harris1-3/+9
file header to 4; fortunately, as they appear to put their extensions to snoop into the padding at the end of the record, all their capture files look alike to programs such as snoop and Ethereal that ignore the padding, so we can just treat version 4 just like version 2 (unless and until Brent decides a new snoop format is called for, changes the record header, and picks a version number that's the same as one used by Shomiti). svn path=/trunk/; revision=2447
2000-09-17Close the handle for the SNMP library after we're done with it - sharedGuy Harris1-7/+11
objects are reference-counted so that won't make it disappear if Ethereal is also linked with it as a shared SNMP library. svn path=/trunk/; revision=2444
2000-09-15Code to read capture files from some version of tcpdump from some sortGuy Harris4-110/+316
of Nokia box (firewall) - yep, it's yet *another* mutant libpcap format that didn't change the magic number, sigh.... svn path=/trunk/; revision=2440
2000-09-13Updated to ignore Win32 detritusGraham Bloice1-0/+3
svn path=/trunk/; revision=2430
2000-09-12Add support for NetBSD DLT_PPP_SERIAL, which has the value 50, and whichGuy Harris1-1/+55
is, for now, handled as WTAP_ENCAP_PPP (although we may have to split WTAP_ENCAP_PPP into more than one type at some point). svn path=/trunk/; revision=2423
2000-09-07Change wtap_read() API so that the data offset is set via a pointer, andGilbert Ramirez16-214/+186
a "keep reading" boolean value is returned from the function. This avoids having to hack around the fact that some file formats truly do have records that start at offset 0. (i4btrace and csids have no file header. Neither does the pppdump-style file that I'm looking at right now). svn path=/trunk/; revision=2392
2000-08-31Re-arrange size and nmemb arguments in fread() (file_read()) calls soGilbert Ramirez1-8/+8
that these calls work on Win32. I still don't have a good reason as to why this is necessary, but it fixes the problem. I'll continue looking for a reason. svn path=/trunk/; revision=2386
2000-08-25Move #include <time.h> into wtap-int.h instead of requiring it inGilbert Ramirez10-19/+11
every C file. I noticed this because of a build break of csids.obj on Win32. svn path=/trunk/; revision=2378
2000-08-25Redo the way we map between libpcap encapsulation type codes and WiretapGuy Harris3-88/+262
encapsulation type codes - for those libpcap type codes whose numerical value is interpreted differently by different versions of libpcap, include <pcap.h> if you can and, if you can, use what it defines to control which Wiretap code we map those type codes to. Also, map the new libpcap type codes introduced by libpcap 0.5. svn path=/trunk/; revision=2369
2000-08-22More mention of csids support in wiretap.Gilbert Ramirez2-2/+7
svn path=/trunk/; revision=2335
2000-08-19Fix buffer overflow on zlib uncompression errors.Laurent Deniel1-2/+2
svn path=/trunk/; revision=2299
2000-08-15The caplen and iplen are not always going to be equal. Need to use > and <= ↵Mike Hall1-7/+12
instead of != ==. svn path=/trunk/; revision=2273
2000-08-12Initialize "last_blob" and "current_blob" when the file is opened.Guy Harris1-21/+23
Set "current_blob" when the first read is done from the random file, as "current_blob" is the current blob in the random file. svn path=/trunk/; revision=2262
2000-08-11Miscellaneous code cleaningLaurent Deniel21-23/+116
- add <stdarg.h> or <varargs.h> in snprintf.h and remove those inclusions in the other #ifdef NEED_SNPRINTF_H codes - remove the check of multiple inclusions in source (.c) code (there is a bit loss of _cpp_ performance, but I prefer the gain of code reading and maintenance; and nowadays, disk caches and VM are correctly optimized ;-). - protect all (well almost) header files against multiple inclusions - add header (i.e. GPL license) in some include files - reorganize a bit the way header files are included: First: #include <system_include_files> #include <external_package_include_files (e.g. gtk, glib etc.)> Then #include "ethereal_include_files" with the correct HAVE_XXX or NEED_XXX protections. - add some HAVE_XXX checks before including some system header files - add the same HAVE_XXX in wiretap as in ethereal Please forgive me, if I break something (I've only compiled and regression tested on Linux). svn path=/trunk/; revision=2254
2000-08-11If we have a random stream open for a compressed Sniffer file, have theGuy Harris2-174/+354
sequential pass through the file build a list of information about the compressed blobs, with the starting offset in the compressed file and in the uncompressed byte stream for each blob. When seeking on the random stream, check whether the target location is within the uncompressed buffer we currently have; if not, use that list to figure out which blob contains the target location, and read that blob into the buffer. Then, as we now know that the target location is within the uncompressed buffer we currently have, just move the current pointer into that buffer to the target location. This means we don't have to read forwards through any uninteresting blobs in order to seek forwards, and don't have to go all the way back to the beginning and seek forwards in order to seek backwards. svn path=/trunk/; revision=2251
2000-08-08Added wiretap support to read the Cisco Secure Intrusion Detection System ↵Mike Hall7-6/+298
IPLog format. svn path=/trunk/; revision=2231
2000-08-04Mention IDSN4BSD's i4btrace utility as a supported trace file format.Gilbert Ramirez1-1/+6
svn path=/trunk/; revision=2203
2000-07-31Add a comment explaining why we're defining S_ISDIR and company.Guy Harris1-1/+7
svn path=/trunk/; revision=2189
2000-07-31It appears that, at least with Visual C++ 6.0, the "stat()" supplied inGuy Harris1-4/+15
the C run-time library sets "statb.st_mode" appropriately, at least for plain files and directories; it just doesn't offer the POSIX "S_ISxxx()" macros to test the file type. If those macros aren't defined (which might also be the case on really ancient UNIX systems), define them appropriately, and use them even on Win32 systems, so that we can properly report attempts by a user to read from a directory on Win32, just as we do on UNIX. svn path=/trunk/; revision=2188
2000-07-31In "buffer.h", include <winsock.h> if we have it, so that "u_char" isGuy Harris2-5/+9
defined on Win32 systems - it's not defined in <sys/types.h> on those systems. In "buffer.c", include "config.h", to cause HAVE_WINSOCK_H to be defined, on systems that have it, so that we include it in <buffer.h>. svn path=/trunk/; revision=2187
2000-07-30Support for capturing packet data from a pipe (a FIFO, or standard input).Olivier Abad2-64/+64
capture.c : - modified capture() to try to open an interface as a pipe if pcap_open_live() failed, and then read data in libpcap format from this pipe ; - add new functions used by capture() : pipe_open_live() and pipe_dispatch() which are equivalents to the pcap_ functions. libpcap.[ch] : - moved the MAGIC and headers definitions from libpcap.c to libpcap.h because capture() now needs it. svn path=/trunk/; revision=2181
2000-07-26Add a script, "aclocal-flags", which figures out whereGuy Harris1-1/+3
1) aclocal expects autoconf/automake macros to be hidden; 2) GTK+ hid its autoconf/automake macros; and, if both places exist but aren't the same directory, returns a "-I" flag to tell aclocal to look in GTK+'s directory. Then have "autogen.sh", and Makefiles in directories with "acinclude.m4" files, use that script and pass what flag it supplies, if any, to aclocal. This should, I hope, avoid problems such as those FreeBSD systems where GTK+ was installed from a port or package (and thus stuck its macros in "/usr/X11R6/share/aclocal") but aclocal doesn't look there. (It doesn't solve the problem of somebody downloading and installing, say, libtool from source - which means it probably shows up under "/usr/local", with its macros in "/usr/local/share/aclocal" - on a system that comes with aclocal (meaning it probably just looks in "/usr/share/aclocal", but that may be best fixed by, whenever you download a source tarball for something that's part of your OS, configuring it to install in the standard system directories and *overwriting* your OS's version.) svn path=/trunk/; revision=2165
2000-07-26In the final scene of the horror movie, just when you think the monsterGuy Harris4-130/+184
is finally dead, and you're walking away, it springs up again and attacks. It appears that the ss990915 version of Alexey Kuznetzov's libpcap patch has some extra stuff in the per-packet header for some sort of SMP debugging, and that SuSE Linux 6.3 picked it up. Thus, even if a libpcap file has the modified magic number, we *still* have to go through the usual heuristic hell to figure out what type of file it is. svn path=/trunk/; revision=2164
2000-07-26Use unsigned character pointers and arrays rather than signed characterGuy Harris7-26/+28
pointers and arrays in a number of places, to remove warnings some compilers give. svn path=/trunk/; revision=2160
2000-07-20In Tethereal:Guy Harris1-3/+7
When capturing, report errors trying to create the output file with "file_open_error_message()". Make the "for_writing" argument to "file_open_error_message()" a "gboolean", as it's either TRUE (if the file is being opened for writing) or FALSE (if it's being opened for reading). Report EISDIR as "XXX is a directory (folder), not a file.". When checking whether an "open()" of a capture file succeeded, check whether "open()" returns a negative number, not whether it returns 0. In "wtap_open_offline()", if the file to be opened is a directory, return EISDIR, not WTAP_ERR_NOT_REGULAR_FILE, so that the error message can say "that's a directory, not a file". If "wtap_open_offline()" returns WTAP_ERR_NOT_REGULAR_FILE, don't just say the file is "invalid", say it's a "special file" or socket or some other weird type of file. svn path=/trunk/; revision=2144
2000-06-28Don't reposition the random stream in "ngsniffer_open()" if there isn'tGuy Harris1-5/+6
a random stream open. svn path=/trunk/; revision=2097
2000-06-27Add routines to Wiretap to allow a client of Wiretap to get:Guy Harris2-4/+22
a pointer to the "wtap_pkthdr" structure for an open capture file; a pointer to the "wtap_pseudo_header" union for an open capture file; a pointer to the packet buffer for an open capture file; so that a program using "wtap_read()" in a loop can get at those items. Keep, in a "capture_file" structure, an indicator of whether: no file is open; a file is open, and being read; a file is open, and is being read, but the user tried to quit out of reading the file (e.g., by doing "File/Quit"); a file is open, and has been completely read. Abort if we try to close a capture that's being read if the user hasn't tried to quit out of the read. Have "File/Quit" check if a file is being read; if so, just set the state indicator to "user tried to quit out of it", so that the code reading the file can do what's appropriate to clean up, rather than closing the file out from under that code and causing crashes. Have "read_cap_file()" read the capture file with a loop using "wtap_read()", rather than by using "wtap_loop()"; have it check after reading each packet whether the user tried to abort the read and, if so, close the capture and return an indication that the read was aborted by the user. Otherwise, return an indication of whether the read completely succeeded or failed in the middle (and, if it failed, return the error code through a pointer). Have "continue_tail_cap_file()" read the capture file with a loop using "wtap_read()", rather than by using "wtap_loop()"; have it check after reading each packet whether the user tried to abort the read and, if so, quit the loop, and after the loop finishes (even if it read no packets), return an indication that the read was aborted by the user if that happened. Otherwise, return an indication of whether the read completely succeeded or failed in the middle (and, if it failed, return the error code through a pointer). Have "finish_tail_cap_file()" read the capture file with a loop using "wtap_read()", rather than by using "wtap_loop()"; have it check after reading each packet whether the user tried to abort the read and, if so, quit the loop, and after the loop finishes (even if it read no packets), close the capture and return an indication that the read was aborted by the user if that happened. Otherwise, return an indication of whether the read completely succeeded or failed in the middle (and, if it failed, return the error code through a pointer). Have their callers check whether the read was aborted or not and, if it was, bail out in the appropriate fashion (exit if it's reading a file specified by "-r" on the command line; exit the main loop if it's reading a file specified with File->Open; kill the capture child if it's "continue_tail_cap_file()"; exit the main loop if it's "finish_tail_cap_file()". svn path=/trunk/; revision=2095
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-30 12:01:06 +0000