aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap
AgeCommit message (Collapse)AuthorFilesLines
2003-08-21Align the --with-pcap help message with other help messages.Guy Harris1-2/+2
svn path=/trunk/; revision=8203
2003-07-29Clean up argument names.Guy Harris1-3/+3
svn path=/trunk/; revision=8097
2003-07-29Use GLib's macros for converting from host byte order to little-endian.Guy Harris1-17/+3
svn path=/trunk/; revision=8096
2003-07-29Don't free "wdh->dump.opaque" in the close routine - "wtap_dump_close()"Guy Harris1-6/+2
does it for you. "wdh->dump.opaque" should never be null, so unconditionally call "lanalyzer_dump_header()". svn path=/trunk/; revision=8095
2003-07-29Use "guint16" and "guint32" for items in data records, rather thanGuy Harris1-55/+65
"unsigned short", "unsigned int" (or "int", as the items appear to be unsigned), or "unsigned long". Convert data to and from the appropriate byte order. Don't free the private data structure in the dumper's close routine - "wtap_dump_close()" does that for you. svn path=/trunk/; revision=8094
2003-07-29From Thierry Martin: support for reading files from Accellent 5Views LANGuy Harris8-11/+526
agents. svn path=/trunk/; revision=8093
2003-07-23Back out the changes made earlier.Gerald Combs1-2/+2
svn path=/trunk/; revision=8075
2003-07-23Make "--enable-usr-local" disabled by default, as suggested by Joerg Mayer.Gerald Combs1-2/+2
svn path=/trunk/; revision=8073
2003-07-08%yynowrap forces "yywrap()" to be a macro that returns 1, so there's noGuy Harris1-3/+1
need to define "ascendwrap()" to return 1 - "ascendwrap()" is no longer used. svn path=/trunk/; revision=7980
2003-07-07A couple of captures have been seen with the first (low-order) byte ofGuy Harris1-41/+94
the network type being 1 and the byte after it being 2; we assume, for now, that the network type is 1 byte, and that if the byte after it is 0, the network type is an NDIS type - 1, and if it's 2, it's an NDIS type. svn path=/trunk/; revision=7973
2003-06-30Use the "rx_frm_len" field from the trace packet data record header,Guy Harris1-2/+25
rathe than the record length minus the record header length, as the number of available (captured) bytes in the packet. Check to make sure that value isn't bigger than the record length minus the header length. Only subtract the 4-byte FCS length from the purported length of the packet on the wire if that would leave the on-the-wire length >= the number of captured bytes, so that we can better handle capture files from programs that produce LANalyzer-format captures where the on-the-wire length *doesn't* include the FCS. svn path=/trunk/; revision=7948
2003-06-25GCC 3.3 noticed that checking whether the length of the slice is > 65535Guy Harris2-14/+3
is pointless, as it's a 16-bit unsigned quantity. Remove those checks - but note in a comment that WTAP_MAX_PACKET_SIZE must be at least 65535 (as there might well be link-layer types with packets at least that large). svn path=/trunk/; revision=7934
2003-06-14Define GLIB_LIBS and GTK_LIBS variables in config.nmake (based onGuy Harris1-2/+2
variables the user configures - the user isn't expected to change GLIB_LIBS or GTK_LIBS, and there's a comment nothing that users shouldn't have to do so), which contain the appropriate libraries for building stuff that requires only GLib, and stuff that required GTK+ and GLib, respectively, and use those macros in the Makefile.nmake files. svn path=/trunk/; revision=7885
2003-06-14Define GLIB_CFLAGS and GTK_CFLAGS variables in config.nmake (based onGuy Harris1-2/+2
variables the user configures - the user isn't expected to change GLIB_CFLAGS or GTK_CFLAGS, and there's a comment nothing that users shouldn't have to do so), which contain the appropriate "/I" flags for building stuff that requires only GLib, and stuff that required GTK+ and GLib, respectively, and use those macros in the Makefile.nmake files. svn path=/trunk/; revision=7884
2003-05-27From Graeme Hewson: fix the declaration of "open_routines[]".Guy Harris1-7/+2
svn path=/trunk/; revision=7753
2003-05-27Make "vms_check_file_type()" seek back to the beginning of the line thatGuy Harris1-1/+14
matched if it succeeds, so that it gets re-read when we read the capture file - it's a line containing a time stamp for a packet, so we need to re-read it to get that time stamp. svn path=/trunk/; revision=7752
2003-05-20From Martin Warnes: fix to check the "XXXtrace" part of the per-packetGuy Harris1-98/+121
line, not the "RCV packet" part, so that we recognize files even if they don't have an "RCV packet" line in the first 200 lines. svn path=/trunk/; revision=7699
2003-05-19From Martin Warnes: support for VMS UCX$TRACE output in wiretap.Guy Harris2-9/+43
svn path=/trunk/; revision=7692
2003-05-16Fix a typo.Guy Harris1-2/+2
svn path=/trunk/; revision=7681
2003-05-15From Can Erkin Acar: OpenBSD is now using tcpdump.org-assigned DLT_Guy Harris3-7/+14
value for DLT_PFLOG, and that goes along with a change to the link-layer header for DLT_PFLOG - support both the old and new values and format. svn path=/trunk/; revision=7676
2003-05-05From Mark C. Brown:Guy Harris3-26/+31
Following fixes for nettl (HP-UX): 1) Fixed 11.X timestamp issue there is no difference in 10.X/11.X timestamps, so no need to shift 11.X timestamps 2) Fixed NS_LS_DRIVER trace record handling now works rather than throwing "...network type that Ethereal doesn't support" error 3) Fixed handling of traces with sliced packets (nettl -m xx) now uses correct packet and capture lengths 4) Additional ethernet card support now handles btlan[1,3-6],gelan,igelan,intl100 driver trace records svn path=/trunk/; revision=7642
2003-04-27Newer build tools generate the following warning:Jörg Mayer1-2/+2
Makefile.am:99: `YFLAGS' is a user variable, you should not override it; Makefile.am:99: use `AM_YFLAGS' instead. Fix it in the proposed way. svn path=/trunk/; revision=7582
2003-04-02Add a new README.developer file for wiretap; it's currently just someGuy Harris2-3/+71
stuff I sent out in a mail message to somebody asking how to add support for a new file format, but hopefully it'll get improved by various contributors over time (hint hint). svn path=/trunk/; revision=7397
2003-03-31The units, in non-whizzo-gigabit-pod captures, for hdr.timeunit = 2Guy Harris1-11/+21
aren't 1/1193000.0 second; the code used to use 1/1193180.0 second, but at least one capture appears to have units of somewhere around 1/3579540.0 second. svn path=/trunk/; revision=7388
2003-03-28Ian Schorr discovered that, for gigabit pod captures, if hdr.timeunit isGuy Harris1-23/+31
2 the time stamps are in units of 1/31250000 seconds rather than nanoseconds - and, by generating Windows Sniffer captures with various hdr.timeunit values, that for all the non-zero values he tested, the time stamps for non-gigabit pod captures are in units of 1/1193000 second. Instead of having a TpS array, just test for the exception value (0 for non-gigabit pod captures, 2 for gigabit pod captures). svn path=/trunk/; revision=7380
2003-03-25AIX's BPF, and thus its tcpdump, appears to use 24 as the link-layerGuy Harris1-4/+17
type for loopback devices; map it to DLT_NULL when reading libpcap files with a major version of 2 and a minor version of 2, and when capturing from an "loN" device on AIX. svn path=/trunk/; revision=7361
2003-03-08WTAP_ENCAP_ENC was, in fact, intended for use for DLT_ENC, so justGuy Harris2-5/+5
rename WTAP_ENCAP_ENC0 to WTAP_ENCAP_ENC. un-#if 0 out the code to handle the value 109 for DLT_ENC, as I've just checked in support for DLT_ENC in tcpdump.org libpcap and tcpdump, which maps DLT_ENC to 109 in the file header. Give packet-enc.c an RCS ID. svn path=/trunk/; revision=7323
2003-03-07From Markus Friedl:Gerald Combs2-4/+5
Add support for the OpenBSD enc(4) encapsulating interface. Add support for Ethernet over IP (RFC 3378). Fold Markus' .h files into their respective .c files, add a define to ipproto.h and use it. svn path=/trunk/; revision=7310
2003-03-04A captured length bigger than the actual length makes no sense; clip theGuy Harris1-2/+11
captured length so it's <= the actual length. svn path=/trunk/; revision=7268
2003-03-04Handle the direction bit in SDLC and PPP Sniffer files.Guy Harris1-1/+7
svn path=/trunk/; revision=7267
2003-03-03Handle packet direction information for SDLC Sniffer captures.Guy Harris2-9/+62
Add a bunch of capture types discovered by stuffing them into Windows Sniffer captures and seeing what a Sniffer thought they were. Add support for writing at least some of them. svn path=/trunk/; revision=7265
2003-03-01A "hdr.xxb[20]" value of 2 in a version 2 capture appears to mean thatGuy Harris1-1/+13
it's a gigabit Ethernet capture, possibly, with special hardware, and that time stamps have 1000 times the resolution that they have in other captures (perhaps due to the special hardware having a higher-resolution clock?). svn path=/trunk/; revision=7240
2003-02-26From Pavel Roskin:Guy Harris2-30/+2
Get rid of acconfig.h, as it's an archaism; put descriptions into AC_DEFINE instead. That squelches some warnings from later versions of autoconf. Fix an unquoted call to AC_MSG_ERROR. Move the stuff to define HAVE_SOME_SNMP into configure.in. svn path=/trunk/; revision=7203
2003-02-18Sigh. It appears that atmsnoop might, at least for some packets, put 4Guy Harris1-7/+11
bytes of padding into the packet (possibly more, as if it's putting extra stuff in the padding as Shomiti/Finisar Surveyor does, it might be up to 7). Fortunately, Surveyor puts lots of stuff into the padding, so we'll crank up the "snoop vs. Surveyor" check to look for 4 or more bytes. svn path=/trunk/; revision=7167
2003-01-31Add WTAP_ENCAP_FRELAY_WITH_PHDR for use with Frame Relay capture filesGuy Harris6-59/+116
that have direction information. Support writing WTAP_ENCAP_FRELAY_WITH_PHDR and WTAP_ENCAP_PPP_WITH_PHDR captures out in libpcap format - we throw away the direction information, but so it goes. When reading/writing Windows Sniffer format, read and write the direction flag. svn path=/trunk/; revision=7052
2003-01-30Add support for writing Frame Relay files in NetXRay format 2.x.Guy Harris3-27/+79
svn path=/trunk/; revision=7048
2003-01-30AC_ARG_ENABLE takes 4 argument: The 3rd specifies what to do in case aJörg Mayer1-2/+2
configure option is given on the command line. The value of the arguement is passwd in the enableval variable. The 4th argument tells what to do in case no command line argument was given. This causes --disable-gtk2 (which is the default) to behave differently from the case when no option is given. I do not really understand where the difference in the behaviour of the generated codes comes from, but I definitely see a difference. Fixed all occurrences where the 3rd arguement was empty. svn path=/trunk/; revision=7044
2003-01-23In the BSDs, ARCNET packets don't have an offset field between theGuy Harris3-30/+35
addresses and the protocol type, as supplied by BPF; on Linux, they *do* have an offset field, as supplied by PF_PACKET sockets. Add a new WTAP_ENCAP_ARCNET_LINUX, with packets that include the offset field, and don't dissect an offset in WTAP_ENCAP_ARCNET packets. Map a libpcap link-layer type of 129 to WTAP_ENCAP_ARCNET_LINUX; that value was recently assigned to Linux-style ARCNET. Add some more ARCNET protocol IDs. For most protocol IDs, dissect an ATA 878.2 fragmentation header; don't do it for RFC 1051 IP and ARP, and Diagnose packets. Set the length of the ARCNET protocol tree item appropriately. Dissect both the RFC 1051 and RFC 1201 styles of IP and ARP over ARCNET, and dissect the RFC 1201 style of RARP as well. svn path=/trunk/; revision=6981
2003-01-21Check for pcap in before /usr/local and stop on first hitJörg Mayer1-2/+3
svn path=/trunk/; revision=6962
2003-01-17From Marc Milgram: e-mail address update.Guy Harris5-9/+9
svn path=/trunk/; revision=6936
2003-01-14We don't know what, in captures with a major version number of 3,Guy Harris1-10/+30
indicates the subtype of an "Internetwork analyzer" capture; we've seen only one such capture, and it was a frame relay capture, so we just wire it to frame relay for now. svn path=/trunk/; revision=6923
2003-01-11If it doesn't begin with FF 00 it can't be LANE LE Control; if it'sGuy Harris1-5/+29
LANE, claimed to be LE Control, but doesn't begin with FF 00, call it 802.3. svn path=/trunk/; revision=6901
2003-01-10Rename the "version" argument to "process_header_records()" "maj_vers",Guy Harris1-48/+66
as it's the major version number. Try using the first word of "rsvd" to determine whether a capture is an ISDN capture or not in version 1 captures. Version 1 captures look as if they might also have a REC_HEADER2 record - it's longer than the ones in version 4 and 5 captures, but it still appears to have a network subtype in the 5th byte. Get rid of the heuristic that checks for WTAP_ENCAP_ISDN by looking at the packet data; if we fail to recognize an ISDN capture, we should look for stuff in the headers to determine whether the capture is one or not. svn path=/trunk/; revision=6894
2003-01-10It looks as if a value of 0xfa in the second byte of a REC_HEADER2Guy Harris2-52/+49
record might indicate an ISDN capture; treat that as an indication that a capture is an ISDN capture. svn path=/trunk/; revision=6893
2003-01-10The Sniffer file formats include a file to identify raw cells; exportGuy Harris7-7/+32
that flag in the ATM pseudo-header, and use it to determine whether a frame is a raw cell or a reassembled frame, rather than using the AAL, as you can have raw AAL5 cells in a capture. svn path=/trunk/; revision=6889
2003-01-09The checksum in DOS ATM Sniffer files appears to be stored in big-endianGuy Harris1-2/+2
format. svn path=/trunk/; revision=6885
2003-01-09It appears that a channel number of 0 means DTE->DCE, and a channelGuy Harris4-10/+10
number of 1 means DCE->DTE, in DOS Sniffer ATM captures. svn path=/trunk/; revision=6881
2003-01-09It appears that ATM sniffer files with 4.x versions 4.95 and greaterGuy Harris2-12/+22
have a bogus record length for type 4 records, but earlier 4.x versions, and 5.x versions, don't. svn path=/trunk/; revision=6880
2003-01-08From Chris Waters: support Tazmen Sniffer Protocol and DLT_TZSP capturesGuy Harris3-4/+9
from network-based libpcaps that use that protocol. svn path=/trunk/; revision=6875
2003-01-07It appears that the first two bytes of "xxz" are, in fact, the actualGuy Harris1-17/+85
length of the packet, and the second two bytes are the captured length of the packet. The old "length" value appears to be the captured length of the packet as well; perhaps it's to be interpreted as the number of bytes of data following the packet header (just in case there's padding, for example). Treat "ATM/", as an encapsulation string, as RFC 1483 ATM. (It may actually be raw ATM, but the only capture I've seen had, in the parts I saw, only RFC 1483 traffic LLC/SNAP traffic.) There are 8 bytes in front of the LLC/SNAP header in ATM captures; skip them, for now. (Perhaps they're a pseudo-header, giving VPI/VCI information and stuff such as that? Or perhaps that's in the record header?) svn path=/trunk/; revision=6871
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-20 11:05:32 +0000