aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap
AgeCommit message (Collapse)AuthorFilesLines
2003-04-02Add a new README.developer file for wiretap; it's currently just someGuy Harris2-3/+71
stuff I sent out in a mail message to somebody asking how to add support for a new file format, but hopefully it'll get improved by various contributors over time (hint hint). svn path=/trunk/; revision=7397
2003-03-31The units, in non-whizzo-gigabit-pod captures, for hdr.timeunit = 2Guy Harris1-11/+21
aren't 1/1193000.0 second; the code used to use 1/1193180.0 second, but at least one capture appears to have units of somewhere around 1/3579540.0 second. svn path=/trunk/; revision=7388
2003-03-28Ian Schorr discovered that, for gigabit pod captures, if hdr.timeunit isGuy Harris1-23/+31
2 the time stamps are in units of 1/31250000 seconds rather than nanoseconds - and, by generating Windows Sniffer captures with various hdr.timeunit values, that for all the non-zero values he tested, the time stamps for non-gigabit pod captures are in units of 1/1193000 second. Instead of having a TpS array, just test for the exception value (0 for non-gigabit pod captures, 2 for gigabit pod captures). svn path=/trunk/; revision=7380
2003-03-25AIX's BPF, and thus its tcpdump, appears to use 24 as the link-layerGuy Harris1-4/+17
type for loopback devices; map it to DLT_NULL when reading libpcap files with a major version of 2 and a minor version of 2, and when capturing from an "loN" device on AIX. svn path=/trunk/; revision=7361
2003-03-08WTAP_ENCAP_ENC was, in fact, intended for use for DLT_ENC, so justGuy Harris2-5/+5
rename WTAP_ENCAP_ENC0 to WTAP_ENCAP_ENC. un-#if 0 out the code to handle the value 109 for DLT_ENC, as I've just checked in support for DLT_ENC in tcpdump.org libpcap and tcpdump, which maps DLT_ENC to 109 in the file header. Give packet-enc.c an RCS ID. svn path=/trunk/; revision=7323
2003-03-07From Markus Friedl:Gerald Combs2-4/+5
Add support for the OpenBSD enc(4) encapsulating interface. Add support for Ethernet over IP (RFC 3378). Fold Markus' .h files into their respective .c files, add a define to ipproto.h and use it. svn path=/trunk/; revision=7310
2003-03-04A captured length bigger than the actual length makes no sense; clip theGuy Harris1-2/+11
captured length so it's <= the actual length. svn path=/trunk/; revision=7268
2003-03-04Handle the direction bit in SDLC and PPP Sniffer files.Guy Harris1-1/+7
svn path=/trunk/; revision=7267
2003-03-03Handle packet direction information for SDLC Sniffer captures.Guy Harris2-9/+62
Add a bunch of capture types discovered by stuffing them into Windows Sniffer captures and seeing what a Sniffer thought they were. Add support for writing at least some of them. svn path=/trunk/; revision=7265
2003-03-01A "hdr.xxb[20]" value of 2 in a version 2 capture appears to mean thatGuy Harris1-1/+13
it's a gigabit Ethernet capture, possibly, with special hardware, and that time stamps have 1000 times the resolution that they have in other captures (perhaps due to the special hardware having a higher-resolution clock?). svn path=/trunk/; revision=7240
2003-02-26From Pavel Roskin:Guy Harris2-30/+2
Get rid of acconfig.h, as it's an archaism; put descriptions into AC_DEFINE instead. That squelches some warnings from later versions of autoconf. Fix an unquoted call to AC_MSG_ERROR. Move the stuff to define HAVE_SOME_SNMP into configure.in. svn path=/trunk/; revision=7203
2003-02-18Sigh. It appears that atmsnoop might, at least for some packets, put 4Guy Harris1-7/+11
bytes of padding into the packet (possibly more, as if it's putting extra stuff in the padding as Shomiti/Finisar Surveyor does, it might be up to 7). Fortunately, Surveyor puts lots of stuff into the padding, so we'll crank up the "snoop vs. Surveyor" check to look for 4 or more bytes. svn path=/trunk/; revision=7167
2003-01-31Add WTAP_ENCAP_FRELAY_WITH_PHDR for use with Frame Relay capture filesGuy Harris6-59/+116
that have direction information. Support writing WTAP_ENCAP_FRELAY_WITH_PHDR and WTAP_ENCAP_PPP_WITH_PHDR captures out in libpcap format - we throw away the direction information, but so it goes. When reading/writing Windows Sniffer format, read and write the direction flag. svn path=/trunk/; revision=7052
2003-01-30Add support for writing Frame Relay files in NetXRay format 2.x.Guy Harris3-27/+79
svn path=/trunk/; revision=7048
2003-01-30AC_ARG_ENABLE takes 4 argument: The 3rd specifies what to do in case aJörg Mayer1-2/+2
configure option is given on the command line. The value of the arguement is passwd in the enableval variable. The 4th argument tells what to do in case no command line argument was given. This causes --disable-gtk2 (which is the default) to behave differently from the case when no option is given. I do not really understand where the difference in the behaviour of the generated codes comes from, but I definitely see a difference. Fixed all occurrences where the 3rd arguement was empty. svn path=/trunk/; revision=7044
2003-01-23In the BSDs, ARCNET packets don't have an offset field between theGuy Harris3-30/+35
addresses and the protocol type, as supplied by BPF; on Linux, they *do* have an offset field, as supplied by PF_PACKET sockets. Add a new WTAP_ENCAP_ARCNET_LINUX, with packets that include the offset field, and don't dissect an offset in WTAP_ENCAP_ARCNET packets. Map a libpcap link-layer type of 129 to WTAP_ENCAP_ARCNET_LINUX; that value was recently assigned to Linux-style ARCNET. Add some more ARCNET protocol IDs. For most protocol IDs, dissect an ATA 878.2 fragmentation header; don't do it for RFC 1051 IP and ARP, and Diagnose packets. Set the length of the ARCNET protocol tree item appropriately. Dissect both the RFC 1051 and RFC 1201 styles of IP and ARP over ARCNET, and dissect the RFC 1201 style of RARP as well. svn path=/trunk/; revision=6981
2003-01-21Check for pcap in before /usr/local and stop on first hitJörg Mayer1-2/+3
svn path=/trunk/; revision=6962
2003-01-17From Marc Milgram: e-mail address update.Guy Harris5-9/+9
svn path=/trunk/; revision=6936
2003-01-14We don't know what, in captures with a major version number of 3,Guy Harris1-10/+30
indicates the subtype of an "Internetwork analyzer" capture; we've seen only one such capture, and it was a frame relay capture, so we just wire it to frame relay for now. svn path=/trunk/; revision=6923
2003-01-11If it doesn't begin with FF 00 it can't be LANE LE Control; if it'sGuy Harris1-5/+29
LANE, claimed to be LE Control, but doesn't begin with FF 00, call it 802.3. svn path=/trunk/; revision=6901
2003-01-10Rename the "version" argument to "process_header_records()" "maj_vers",Guy Harris1-48/+66
as it's the major version number. Try using the first word of "rsvd" to determine whether a capture is an ISDN capture or not in version 1 captures. Version 1 captures look as if they might also have a REC_HEADER2 record - it's longer than the ones in version 4 and 5 captures, but it still appears to have a network subtype in the 5th byte. Get rid of the heuristic that checks for WTAP_ENCAP_ISDN by looking at the packet data; if we fail to recognize an ISDN capture, we should look for stuff in the headers to determine whether the capture is one or not. svn path=/trunk/; revision=6894
2003-01-10It looks as if a value of 0xfa in the second byte of a REC_HEADER2Guy Harris2-52/+49
record might indicate an ISDN capture; treat that as an indication that a capture is an ISDN capture. svn path=/trunk/; revision=6893
2003-01-10The Sniffer file formats include a file to identify raw cells; exportGuy Harris7-7/+32
that flag in the ATM pseudo-header, and use it to determine whether a frame is a raw cell or a reassembled frame, rather than using the AAL, as you can have raw AAL5 cells in a capture. svn path=/trunk/; revision=6889
2003-01-09The checksum in DOS ATM Sniffer files appears to be stored in big-endianGuy Harris1-2/+2
format. svn path=/trunk/; revision=6885
2003-01-09It appears that a channel number of 0 means DTE->DCE, and a channelGuy Harris4-10/+10
number of 1 means DCE->DTE, in DOS Sniffer ATM captures. svn path=/trunk/; revision=6881
2003-01-09It appears that ATM sniffer files with 4.x versions 4.95 and greaterGuy Harris2-12/+22
have a bogus record length for type 4 records, but earlier 4.x versions, and 5.x versions, don't. svn path=/trunk/; revision=6880
2003-01-08From Chris Waters: support Tazmen Sniffer Protocol and DLT_TZSP capturesGuy Harris3-4/+9
from network-based libpcaps that use that protocol. svn path=/trunk/; revision=6875
2003-01-07It appears that the first two bytes of "xxz" are, in fact, the actualGuy Harris1-17/+85
length of the packet, and the second two bytes are the captured length of the packet. The old "length" value appears to be the captured length of the packet as well; perhaps it's to be interpreted as the number of bytes of data following the packet header (just in case there's padding, for example). Treat "ATM/", as an encapsulation string, as RFC 1483 ATM. (It may actually be raw ATM, but the only capture I've seen had, in the parts I saw, only RFC 1483 traffic LLC/SNAP traffic.) There are 8 bytes in front of the LLC/SNAP header in ATM captures; skip them, for now. (Perhaps they're a pseudo-header, giving VPI/VCI information and stuff such as that? Or perhaps that's in the record header?) svn path=/trunk/; revision=6871
2003-01-07PRI captures appear to be the ISDN captures with padding.Guy Harris1-12/+20
The Windows Sniffer does *not* appear to know the difference between 802.3 and 802.3 multicast LANE traffic. svn path=/trunk/; revision=6870
2003-01-07If the Windows Sniffer writes out one of its ATM capture files in DOSGuy Harris1-52/+57
Sniffer format, it doesn't distinguish between LE Control and LANE encapsulated LAN frames, so we can't rely on the ATM subtype being correct even when reading DOS Sniffer captures - we force it to TRAF_ST_LANE_LE_CTRL for LANE frames that begin with 0xff 0x00. Move the calls to "infer_pkt_encap()" into "fix_pseudo_header()". svn path=/trunk/; revision=6869
2003-01-07Use some fields in the per-packet header for ATM to get the AAL typeGuy Harris1-22/+92
and traffic type. svn path=/trunk/; revision=6868
2003-01-07Properly turn the raw ISDN channel number field into an actual channelGuy Harris1-1/+2
number. Put in some commented-out code to deal with some end-of-packet crud in some ISDN captures - not all ISDN captures have it, so we can't unconditionally slice it out. svn path=/trunk/; revision=6867
2003-01-07The direction flag for LAPB/X.25 and ISDN appears to be in theGuy Harris1-11/+17
bottommost bit of the 12th byte of "hdr.hdr_2_x.xxx". svn path=/trunk/; revision=6866
2003-01-07Update a comment.Guy Harris1-18/+7
svn path=/trunk/; revision=6865
2003-01-07Properly turn the raw ISDN channel number field into an actual channelGuy Harris1-6/+53
number. Put in some commented-out code to deal with some end-of-packet crud in some ISDN captures - not all ISDN captures have it, so we can't unconditionally slice it out. svn path=/trunk/; revision=6863
2003-01-06Cast "secs" to "double" before multiplying by 1000000, so that we don'tGuy Harris1-2/+2
get an overflow if secs*1000000 doesn't fit in 31 bits. svn path=/trunk/; revision=6858
2003-01-06Don't interpret NET_HDLC as LAPB/X.25 - sometimes it's some otherGuy Harris1-22/+34
HDLC-flavored encapsulation (or, at least, it was in at least one capture). Instead, treat it as WTAP_ENCAP_PER_PACKET, and infer the packet type, as we do for NET_ROUTER. For NET_ROUTER captures, if the ISDN channel number is zero, infer the packet type from the contents, rather than wiring it to PPP - it might be, for example, Cisco or Wellfleet HDLC. Fix the check for Cisco HDLC to look for 0x0F 0x00 and 0x8F 0x00, as 0x0F, not 0x08, is the unicast address in Cisco HDLC. When fixing the pseudo-header, fix it for WTAP_ENCAP_WFLEET_HDLC, WTAP_ENCAP_CHDLC, and WTAP_ENCAP_PPP_WITH_PHDR, as well as for WTAP_ENCAP_ISDN, as the three ones listed don't use x25.flags, they use p2p.sent. svn path=/trunk/; revision=6850
2003-01-03Add support for SDLC encapsulation in DOS Sniffer captures; thatGuy Harris3-5/+13
includes adding an SDLC dissector. svn path=/trunk/; revision=6848
2003-01-03Well, at least some version 5 captures have type 7 records, and theyGuy Harris1-16/+23
appear to look like the type 7 records in version 4 captures. Note that sometimes the subtype is misleading. svn path=/trunk/; revision=6847
2003-01-03Well, it's not as simple as "version 5 internetwork analyzer capturesGuy Harris1-5/+6
hide the subtype in the reserved field in the version number", alas.... svn path=/trunk/; revision=6845
2003-01-03Add some more comments.Guy Harris1-2/+5
svn path=/trunk/; revision=6843
2003-01-03Get rid of some bogus commented-out statements.Guy Harris1-5/+2
svn path=/trunk/; revision=6842
2003-01-03It appears there are, indeed, two fields in the "xxb" part of the fileGuy Harris1-17/+57
header that specify the detailed capture type for WAN captures; use those fields. svn path=/trunk/; revision=6841
2003-01-03Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not justGuy Harris8-70/+86
used for the DOS-based ATM Sniffer. (That's not a great name, but I couldn't think of a better one.) Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture files where reassembled frames don't have trailers, such as the AAL5 trailer, chopped off. That's what at least some versions of the Windows-based ATM Sniffer appear to have. Map the ATM capture file type for NetXRay captures to WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've reverse-engineered, so far, for the pseudo-header; there's more that needs to be done on it, e.g. getting the channel, AAL type, and traffic type (or inferring them if they're not in the packet header). svn path=/trunk/; revision=6840
2003-01-03Add support for version 002.000, and note that there's probablyGuy Harris1-5/+14
something hidden in the per-packet header for ATM captures that specifies the traffic type (and stuff such as that). svn path=/trunk/; revision=6839
2002-12-20Update some comments.Guy Harris1-5/+34
Make the "fs" and "flags" fields in type 6 records unsigned, as they are in other per-frame records - they're probably the same set of flag bits. svn path=/trunk/; revision=6814
2002-12-20Add an item for Wellfleet HDLC.Guy Harris1-1/+3
svn path=/trunk/; revision=6813
2002-12-20Make "infer_pkt_encap()" take a pointer and length as arguments.Guy Harris1-26/+58
Update some comments. svn path=/trunk/; revision=6812
2002-12-20Supply more information about "WAN/Synchronous" captures.Guy Harris1-10/+24
svn path=/trunk/; revision=6811
2002-12-20This adds the beginning of support for Wellfleet HDLC to ngsniffer.c asRichard Sharpe2-8/+23
well as Cisco HDLC support. It compiles OK, but I do not claim that it is not borken. I will have to add a small dissector that eats the first two bytes and then calls the Ethernet dissector as well, to complete the work. svn path=/trunk/; revision=6809
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-24 08:43:21 +0000