aboutsummaryrefslogtreecommitdiffstats
path: root/writecap/pcapio.c
AgeCommit message (Collapse)AuthorFilesLines
2021-09-30ws_getopt: Rename struct and macrosJoão Valverde1-33/+33
This is part of the API and should also be renamed to avoid conflicts.
2021-07-15Clean up handling of --capture-comment.Guy Harris1-6/+15
Don't store the comments in a capture_options structure, because that's available only if we're being built with capture support, and --capture-comment can be used in TShark when reading a capture file and writing another capture file, with no live capture taking place. This means we don't handle that option in capture_opts_add_opt(); handle it in the programs that support it. Support writing multiple comments in dumpcap when capturing. These changes also fix builds without pcap, and makes --capture-comment work in Wireshark when a capture is started from the command line with -k. Update the help messages to indicate that --capture-comment adds a capture comment, it doesn't change any comment (much less "the" comment, as there isn't necessarily a single comment). Update the man pages: - not to presume that only pcapng files support file comments (even if that's true now, it might not be true in the future); - to note that multiple instances of --capture-comment are supported, and that multiple comments will be written, whether capturing or reading one file and writing another; - clarify that Wireshark doesn't *discard* SHB comments other than the first one, even though it only displays the first one;
2020-03-28Write the if_hardware option, if available, to pcapng files when capturing.Guy Harris1-7/+17
Change-Id: Ib9ff78d148a2364c84d84b4a9b020b3d783654a3 Reviewed-on: https://code.wireshark.org/review/36602 Petri-Dish: Guy Harris <gharris@sonic.net> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <gharris@sonic.net>
2020-03-12Fix some places where we forgot to mention Npcap.Guy Harris1-1/+1
Mostly comments, but a few messages. Change-Id: Iff7380eb15f064bf6a3078e131c70987e36bca44 Reviewed-on: https://code.wireshark.org/review/36381 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2020-01-21Put various epoch time deltas into wsutil/epochs.h.Guy Harris1-1/+3
There are some deltas between the UN*X epoch and other epochs that are used in a number of places; put them into a header. Change-Id: Ia2d9d69b9d91352d730d97d9e4897518635b4861 Reviewed-on: https://code.wireshark.org/review/35895 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-07-26HTTPS (almost) everywhere.Guy Harris1-1/+1
Change all wireshark.org URLs to use https. Fix some broken links while we're at it. Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c Reviewed-on: https://code.wireshark.org/review/34089 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-05-20pcapng: fix the magic when bytes are swapped.Dario Lombardo1-1/+1
This value is used when checking if the file was generated on a machine with different endianess. The error message changes from "Unrecognized pcapng format or not pcapng data." to "dumpcap: Interface 0 is big endian but we're little endian." Fix dumpcap.c and pcapio.c. Ping-Bug: 15754 Change-Id: I3a31f873f01bcb3f1324410e70f29f285e56c715 Reviewed-on: https://code.wireshark.org/review/33274 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2019-03-19Don't cast away constness if you don't have to.Guy Harris1-2/+2
Change-Id: I8b13bcd78d327b3ec9903b43e67fcf4a73052962 Reviewed-on: https://code.wireshark.org/review/32479 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-12-18writecap: rename pcapng_write_session_block to _section_blockJaap Keuter1-1/+1
The pcapng file format specification speaks of a secion block, not a session block. Let the function name reflect the proper name of the block it writes. Change-Id: Id399fae3648c93f4750fedaa297b18f95f2bb96f Signed-off-by: Jaap Keuter <jaap.keuter@xs4all.nl> Reviewed-on: https://code.wireshark.org/review/31099 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-09-28dumpcap: fix some warnings and add some debugsJames Ko1-4/+6
Ping-Bug: 15149 Change-Id: Ifa530fbdcbffbc188343c03fc7b518325a511f5f Reviewed-on: https://code.wireshark.org/review/29906 Petri-Dish: Guy Harris <guy@alum.mit.edu> Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-08writecap: use SPDX identifiers.Dario Lombardo1-13/+1
Change-Id: I800f8ccb516f69a15b535ee96a4b34754c008028 Reviewed-on: https://code.wireshark.org/review/25663 Petri-Dish: Anders Broman <a.broman58@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-01-09Use pcapng as the name of the file format.Guy Harris1-1/+1
At one point, I remember a discussion resulting in the official name of the next-generation replacement for pcap format being changed to "pcapng", with no hyphen. Make Wireshark reflect that. Change-Id: Ie66fb13a0fe3a8682143106dab601952e9154e2a Reviewed-on: https://code.wireshark.org/review/25214 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-12-01dumpcap: enable capture of pcapng from pipeJames Ko1-0/+28
Reads pcapng blocks from a pipe. Section header blocks are parsed for endianess. All other blocks only have the general block header parsed for type and length, and then endianess converted if necessary. Outputs all blocks using the original endianess format so none of the other block types or options require parsing. Change-Id: I2f4f0175013d8fc2cda42a63e7deacad537951e3 Bug: 11370 Reviewed-on: https://code.wireshark.org/review/24536 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-07-21*Always* write out the trailing pcapng block total length in host byte order.Guy Harris1-8/+6
In the fast-path "no options" case for writing an Enhanced Packet Block, just copy the block total length to the buffer, don't put it into the buffer in little-endian byte order. If we're running on a big-endian machine, and thus *should* be writing out multi-byte integral block fields in big-endian byte order, that'll write out a corrupt pcapng file. Bug: 13802 Change-Id: I33958e3fc1d205ca6df3ef4057d92b461831c50e Reviewed-on: https://code.wireshark.org/review/22753 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-02-24Reduce number of fwrite when writing pcap-ng EPB.AndersBroman1-2/+25
According to callgrind with the patch dumping 3000 pakets the number of calls to write_to_file is reduced from 11541 to 9000 reducing the number of lr from 4 681 518 to 4 314 101. If the buffer holding the packet was guaranteed to be padded to 32 bit boundary the code could be simplified and if there was space "in front" for the packet header it would be even better. Change-Id: Ie991c05fa9d831ee4d703bd47b8123f2b1f83277 Reviewed-on: https://code.wireshark.org/review/20256 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-03-24Put pcapio.c into a writecap library, and use it.Guy Harris1-0/+744
Change-Id: Ib89f345c072a38bc01f0513366a4bdae3bf6f08e Reviewed-on: https://code.wireshark.org/review/14615 Reviewed-by: Guy Harris <guy@alum.mit.edu>
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-16 21:21:44 +0000