1998-11-12 06:01:27 +00:00
|
|
|
/* wtap.c
|
|
|
|
|
*
|
2004-07-18 00:24:25 +00:00
|
|
|
* $Id$
|
1998-11-12 06:01:27 +00:00
|
|
|
*
|
|
|
|
|
* Wiretap Library
|
2001-11-13 23:55:44 +00:00
|
|
|
* Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
|
2002-08-28 20:30:45 +00:00
|
|
|
*
|
1998-11-12 06:01:27 +00:00
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 20:30:45 +00:00
|
|
|
*
|
1998-11-12 06:01:27 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 20:30:45 +00:00
|
|
|
*
|
1998-11-12 06:01:27 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
|
* along with this program; if not, write to the Free Software
|
2007-01-01 14:48:18 +00:00
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
1998-11-12 06:01:27 +00:00
|
|
|
*/
|
2002-03-05 05:58:41 +00:00
|
|
|
|
1999-07-13 02:53:26 +00:00
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
|
#include "config.h"
|
|
|
|
|
#endif
|
2004-03-30 19:37:31 +00:00
|
|
|
|
|
|
|
|
#include <string.h>
|
|
|
|
|
#include <errno.h>
|
|
|
|
|
|
2005-08-19 19:40:00 +00:00
|
|
|
#ifdef HAVE_SYS_TYPES_H
|
|
|
|
|
#include <sys/types.h>
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
#ifdef HAVE_UNISTD_H
|
|
|
|
|
#include <unistd.h>
|
|
|
|
|
#endif
|
|
|
|
|
|
2010-05-07 19:45:47 +00:00
|
|
|
#ifdef HAVE_LIBZ
|
|
|
|
|
#include <zlib.h>
|
|
|
|
|
#endif
|
|
|
|
|
|
2000-05-19 23:07:04 +00:00
|
|
|
#include "wtap-int.h"
|
2005-08-20 16:19:22 +00:00
|
|
|
|
2000-01-13 07:09:20 +00:00
|
|
|
#include "file_wrappers.h"
|
2008-05-22 15:46:27 +00:00
|
|
|
#include <wsutil/file_util.h>
|
1999-03-01 18:57:07 +00:00
|
|
|
#include "buffer.h"
|
1998-11-12 00:06:47 +00:00
|
|
|
|
2005-08-19 19:40:00 +00:00
|
|
|
/*
|
|
|
|
|
* Return the size of the file, as reported by the OS.
|
|
|
|
|
* (gint64, in case that's 64 bits.)
|
|
|
|
|
*/
|
|
|
|
|
gint64
|
|
|
|
|
wtap_file_size(wtap *wth, int *err)
|
1999-09-23 04:39:01 +00:00
|
|
|
{
|
2011-04-10 19:56:06 +00:00
|
|
|
ws_statb64 statb;
|
2005-08-19 19:40:00 +00:00
|
|
|
|
2011-04-10 18:55:06 +00:00
|
|
|
if (ws_fstat64(wth->fd, &statb) == -1) {
|
2005-08-19 19:40:00 +00:00
|
|
|
if (err != NULL)
|
|
|
|
|
*err = errno;
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
|
|
|
|
return statb.st_size;
|
1999-09-23 04:39:01 +00:00
|
|
|
}
|
|
|
|
|
|
2000-09-07 05:34:23 +00:00
|
|
|
int
|
|
|
|
|
wtap_file_type(wtap *wth)
|
1998-11-12 00:06:47 +00:00
|
|
|
{
|
|
|
|
|
return wth->file_type;
|
|
|
|
|
}
|
|
|
|
|
|
2000-09-07 05:34:23 +00:00
|
|
|
int
|
|
|
|
|
wtap_snapshot_length(wtap *wth)
|
1998-11-12 00:06:47 +00:00
|
|
|
{
|
1998-11-15 05:29:17 +00:00
|
|
|
return wth->snapshot_length;
|
1998-11-12 00:06:47 +00:00
|
|
|
}
|
|
|
|
|
|
2000-09-07 05:34:23 +00:00
|
|
|
int
|
|
|
|
|
wtap_file_encap(wtap *wth)
|
Add "wtap_file_encap()", to return the encapsulation of packets in the
file (which could be WTAP_ENCAP_UNKNOWN, if we couldn't determine it, or
WTAP_ENCAP_PER_PACKET, if we could determine the encapsulation of
packets in the file, but they didn't all have the same encapsulation).
This may be useful in the future, if we allow files to be saved in
different capture file formats - we'd have to specify, when creating the
capture file, the per-file encapsulation, for those formats that don't
support per-packet encapsulations (we wouldn't be able to save a
multi-encapsulation capture in those formats).
Make the code to read "iptrace" files set the per-file packet
encapsulation - set it to the type of the first packet seen, and, if any
subsequent packets have a different encapsulation, set it to
WTAP_ENCAP_PER_PACKET.
svn path=/trunk/; revision=772
1999-10-06 03:29:36 +00:00
|
|
|
{
|
|
|
|
|
return wth->file_encap;
|
|
|
|
|
}
|
|
|
|
|
|
2005-08-24 21:31:56 +00:00
|
|
|
int
|
|
|
|
|
wtap_file_tsprecision(wtap *wth)
|
|
|
|
|
{
|
|
|
|
|
return wth->tsprecision;
|
|
|
|
|
}
|
|
|
|
|
|
1999-12-05 01:24:54 +00:00
|
|
|
/* Table of the encapsulation types we know about. */
|
2007-05-04 21:10:55 +00:00
|
|
|
struct encap_type_info {
|
1999-12-05 01:24:54 +00:00
|
|
|
const char *name;
|
|
|
|
|
const char *short_name;
|
2007-05-04 21:10:55 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static struct encap_type_info encap_table_base[] = {
|
1999-12-05 01:24:54 +00:00
|
|
|
/* WTAP_ENCAP_UNKNOWN */
|
2009-06-16 03:16:55 +00:00
|
|
|
{ "Unknown", "unknown" },
|
1999-12-05 01:24:54 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_ETHERNET */
|
|
|
|
|
{ "Ethernet", "ether" },
|
|
|
|
|
|
2003-12-03 22:40:39 +00:00
|
|
|
/* WTAP_ENCAP_TOKEN_RING */
|
1999-12-05 01:24:54 +00:00
|
|
|
{ "Token Ring", "tr" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_SLIP */
|
|
|
|
|
{ "SLIP", "slip" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_PPP */
|
|
|
|
|
{ "PPP", "ppp" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_FDDI */
|
|
|
|
|
{ "FDDI", "fddi" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_FDDI_BITSWAPPED */
|
|
|
|
|
{ "FDDI with bit-swapped MAC addresses", "fddi-swapped" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_RAW_IP */
|
|
|
|
|
{ "Raw IP", "rawip" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_ARCNET */
|
|
|
|
|
{ "ARCNET", "arcnet" },
|
|
|
|
|
|
2003-01-23 04:04:01 +00:00
|
|
|
/* WTAP_ENCAP_ARCNET_LINUX */
|
|
|
|
|
{ "Linux ARCNET", "arcnet_linux" },
|
|
|
|
|
|
1999-12-05 01:24:54 +00:00
|
|
|
/* WTAP_ENCAP_ATM_RFC1483 */
|
|
|
|
|
{ "RFC 1483 ATM", "atm-rfc1483" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_LINUX_ATM_CLIP */
|
|
|
|
|
{ "Linux ATM CLIP", "linux-atm-clip" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_LAPB */
|
|
|
|
|
{ "LAPB", "lapb" },
|
|
|
|
|
|
Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not just
used for the DOS-based ATM Sniffer. (That's not a great name, but I
couldn't think of a better one.)
Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture
files where reassembled frames don't have trailers, such as the AAL5
trailer, chopped off. That's what at least some versions of the
Windows-based ATM Sniffer appear to have.
Map the ATM capture file type for NetXRay captures to
WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've
reverse-engineered, so far, for the pseudo-header; there's more that
needs to be done on it, e.g. getting the channel, AAL type, and traffic
type (or inferring them if they're not in the packet header).
svn path=/trunk/; revision=6840
2003-01-03 06:45:45 +00:00
|
|
|
/* WTAP_ENCAP_ATM_PDUS */
|
|
|
|
|
{ "ATM PDUs", "atm-pdus" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_ATM_PDUS_UNTRUNCATED */
|
|
|
|
|
{ "ATM PDUs - untruncated", "atm-pdus-untruncated" },
|
1999-12-05 01:24:54 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_NULL */
|
|
|
|
|
{ "NULL", "null" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_ASCEND */
|
|
|
|
|
{ "Lucent/Ascend access equipment", "ascend" },
|
|
|
|
|
|
2002-10-31 07:12:42 +00:00
|
|
|
/* WTAP_ENCAP_ISDN */
|
|
|
|
|
{ "ISDN", "isdn" },
|
1999-12-12 22:40:10 +00:00
|
|
|
|
2002-10-31 07:12:42 +00:00
|
|
|
/* WTAP_ENCAP_IP_OVER_FC */
|
|
|
|
|
{ "RFC 2625 IP-over-Fibre Channel", "ip-over-fc" },
|
2000-09-28 04:19:09 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_PPP_WITH_PHDR */
|
|
|
|
|
{ "PPP with Directional Info", "ppp-with-direction" },
|
|
|
|
|
|
2000-11-15 05:42:35 +00:00
|
|
|
/* WTAP_ENCAP_IEEE_802_11 */
|
|
|
|
|
{ "IEEE 802.11 Wireless LAN", "ieee-802-11" },
|
|
|
|
|
|
2004-01-29 10:58:28 +00:00
|
|
|
/* WTAP_ENCAP_PRISM_HEADER */
|
|
|
|
|
{ "IEEE 802.11 plus Prism II monitor mode header", "prism" },
|
|
|
|
|
|
2002-04-08 09:09:49 +00:00
|
|
|
/* WTAP_ENCAP_IEEE_802_11_WITH_RADIO */
|
|
|
|
|
{ "IEEE 802.11 Wireless LAN with radio information", "ieee-802-11-radio" },
|
|
|
|
|
|
2004-10-29 02:40:01 +00:00
|
|
|
/* WTAP_ENCAP_IEEE_802_11_WLAN_RADIOTAP */
|
|
|
|
|
{ "IEEE 802.11 plus radiotap WLAN header", "ieee-802-11-radiotap" },
|
2004-01-29 10:58:28 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_IEEE_802_11_WLAN_AVS */
|
|
|
|
|
{ "IEEE 802.11 plus AVS WLAN header", "ieee-802-11-avs" },
|
|
|
|
|
|
2000-12-23 08:06:16 +00:00
|
|
|
/* WTAP_ENCAP_SLL */
|
|
|
|
|
{ "Linux cooked-mode capture", "linux-sll" },
|
2001-01-08 22:18:22 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_FRELAY */
|
|
|
|
|
{ "Frame Relay", "frelay" },
|
Add a new Wiretap encapsulation type for Cisco HDLC. Map the NetBSD
DLT_HDLC to it.
Make a separate dissector for Cisco HDLC, and add a dissector for Cisco
SLARP. Have the PPP dissector call the Cisco HDLC dissector if the
address field is the Cisco HDLC unicast or multicast address. Use the
Cisco HDLC dissector for the Cisco HDLC Wiretap encapsulation type.
Add a new dissector table "chdlctype", for Cisco HDLC packet types
(they're *almost* the same as Ethernet types, but 0x8035 is SLARP, not
Reverse ARP, and 0x2000 is the Cisco Discovery protocol, for example),
replacing "fr.chdlc".
Have a "chdlctype()" routine, similar to "ethertype()", used both by the
Cisco HDLC and Frame Relay dissectors. Have a "chdlc_vals[]"
"value_string" table for Cisco HDLC types and protocol names. Split the
packet type field in the Frame Relay dissector into separate SNAP and
Cisco HDLC fields, and give them the Ethernet type and Cisco HDLC type
"value_string" tables, respectively.
svn path=/trunk/; revision=3133
2001-03-15 09:11:03 +00:00
|
|
|
|
2003-01-31 01:02:14 +00:00
|
|
|
/* WTAP_ENCAP_FRELAY_WITH_PHDR */
|
|
|
|
|
{ "Frame Relay with Directional Info", "frelay-with-direction" },
|
|
|
|
|
|
Add a new Wiretap encapsulation type for Cisco HDLC. Map the NetBSD
DLT_HDLC to it.
Make a separate dissector for Cisco HDLC, and add a dissector for Cisco
SLARP. Have the PPP dissector call the Cisco HDLC dissector if the
address field is the Cisco HDLC unicast or multicast address. Use the
Cisco HDLC dissector for the Cisco HDLC Wiretap encapsulation type.
Add a new dissector table "chdlctype", for Cisco HDLC packet types
(they're *almost* the same as Ethernet types, but 0x8035 is SLARP, not
Reverse ARP, and 0x2000 is the Cisco Discovery protocol, for example),
replacing "fr.chdlc".
Have a "chdlctype()" routine, similar to "ethertype()", used both by the
Cisco HDLC and Frame Relay dissectors. Have a "chdlc_vals[]"
"value_string" table for Cisco HDLC types and protocol names. Split the
packet type field in the Frame Relay dissector into separate SNAP and
Cisco HDLC fields, and give them the Ethernet type and Cisco HDLC type
"value_string" tables, respectively.
svn path=/trunk/; revision=3133
2001-03-15 09:11:03 +00:00
|
|
|
/* WTAP_ENCAP_CHDLC */
|
|
|
|
|
{ "Cisco HDLC", "chdlc" },
|
2001-11-28 07:11:11 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_CISCO_IOS */
|
|
|
|
|
{ "Cisco IOS internal", "ios" },
|
|
|
|
|
|
2001-11-30 07:14:22 +00:00
|
|
|
/* WTAP_ENCAP_LOCALTALK */
|
|
|
|
|
{ "Localtalk", "ltalk" },
|
|
|
|
|
|
2003-12-03 22:40:39 +00:00
|
|
|
/* WTAP_ENCAP_OLD_PFLOG */
|
2003-05-15 07:14:46 +00:00
|
|
|
{ "OpenBSD PF Firewall logs, pre-3.4", "pflog-old" },
|
2002-01-29 09:45:58 +00:00
|
|
|
|
2002-02-07 20:41:28 +00:00
|
|
|
/* WTAP_ENCAP_HHDLC */
|
|
|
|
|
{ "HiPath HDLC", "hhdlc" },
|
2002-07-31 19:27:57 +00:00
|
|
|
|
2002-08-06 05:40:47 +00:00
|
|
|
/* WTAP_ENCAP_DOCSIS */
|
|
|
|
|
{ "Data Over Cable Service Interface Specification", "docsis" },
|
|
|
|
|
|
2002-07-31 19:27:57 +00:00
|
|
|
/* WTAP_ENCAP_COSINE */
|
|
|
|
|
{ "CoSine L2 debug log", "cosine" },
|
2002-11-06 21:49:34 +00:00
|
|
|
|
2002-12-20 21:59:33 +00:00
|
|
|
/* WTAP_ENCAP_WFLEET_HDLC */
|
|
|
|
|
{ "Wellfleet HDLC", "whdlc" },
|
2003-01-03 22:31:26 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_SDLC */
|
|
|
|
|
{ "SDLC", "sdlc" },
|
2003-01-08 05:03:54 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_TZSP */
|
|
|
|
|
{ "Tazmen sniffer protocol", "tzsp" },
|
2003-05-15 07:14:46 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_ENC */
|
2003-05-16 00:34:33 +00:00
|
|
|
{ "OpenBSD enc(4) encapsulating interface", "enc" },
|
2003-05-15 07:14:46 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_PFLOG */
|
|
|
|
|
{ "OpenBSD PF Firewall logs", "pflog" },
|
2003-10-25 07:17:28 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_CHDLC_WITH_PHDR */
|
|
|
|
|
{ "Cisco HDLC with Directional Info", "chdlc-with-direction" },
|
2003-12-03 22:40:39 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_BLUETOOTH_H4 */
|
|
|
|
|
{ "Bluetooth H4", "bluetooth-h4" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_MTP2 */
|
|
|
|
|
{ "SS7 MTP2", "mtp2" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_MTP3 */
|
|
|
|
|
{ "SS7 MTP3", "mtp3" },
|
2003-12-18 19:07:14 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_IRDA */
|
|
|
|
|
{ "IrDA", "irda" },
|
2004-01-28 01:24:30 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER0 */
|
|
|
|
|
{ "USER 0", "user0" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER1 */
|
|
|
|
|
{ "USER 1", "user1" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER2 */
|
|
|
|
|
{ "USER 2", "user2" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER3 */
|
|
|
|
|
{ "USER 3", "user3" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER4 */
|
|
|
|
|
{ "USER 4", "user4" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER5 */
|
|
|
|
|
{ "USER 5", "user5" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER6 */
|
|
|
|
|
{ "USER 6", "user6" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER7 */
|
|
|
|
|
{ "USER 7", "user7" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER8 */
|
|
|
|
|
{ "USER 8", "user8" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER9 */
|
|
|
|
|
{ "USER 9", "user9" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER10 */
|
|
|
|
|
{ "USER 10", "user10" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER11 */
|
|
|
|
|
{ "USER 11", "user11" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER12 */
|
|
|
|
|
{ "USER 12", "user12" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER13 */
|
|
|
|
|
{ "USER 13", "user13" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER14 */
|
|
|
|
|
{ "USER 14", "user14" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USER15 */
|
|
|
|
|
{ "USER 15", "user15" },
|
2004-03-11 09:18:33 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_SYMANTEC */
|
|
|
|
|
{ "Symantec Enterprise Firewall", "symantec" },
|
2004-03-23 01:02:41 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_APPLE_IP_OVER_IEEE1394 */
|
|
|
|
|
{ "Apple IP-over-IEEE 1394", "ap1394" },
|
2004-06-07 20:28:51 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_BACNET_MS_TP */
|
|
|
|
|
{ "BACnet MS/TP", "bacnet-ms-tp" },
|
2004-09-19 07:13:52 +00:00
|
|
|
|
2005-04-03 12:05:05 +00:00
|
|
|
/* WTAP_ENCAP_NETTL_RAW_ICMP */
|
|
|
|
|
{ "Raw ICMP with nettl headers", "raw-icmp-nettl" },
|
2004-09-19 07:13:52 +00:00
|
|
|
|
2005-04-03 12:05:05 +00:00
|
|
|
/* WTAP_ENCAP_NETTL_RAW_ICMPV6 */
|
|
|
|
|
{ "Raw ICMPv6 with nettl headers", "raw-icmpv6-nettl" },
|
2004-12-07 17:54:08 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_GPRS_LLC */
|
|
|
|
|
{ "GPRS LLC", "gprs-llc" },
|
2005-01-20 05:40:56 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_JUNIPER_ATM1 */
|
|
|
|
|
{ "Juniper ATM1", "juniper-atm1" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_JUNIPER_ATM2 */
|
|
|
|
|
{ "Juniper ATM2", "juniper-atm2" },
|
2005-01-31 03:03:02 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_REDBACK */
|
|
|
|
|
{ "Redback SmartEdge", "redback" },
|
2005-04-03 12:05:05 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_NETTL_RAW_IP */
|
|
|
|
|
{ "Raw IP with nettl headers", "rawip-nettl" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_NETTL_ETHERNET */
|
|
|
|
|
{ "Ethernet with nettl headers", "ether-nettl" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_NETTL_TOKEN_RING */
|
|
|
|
|
{ "Token Ring with nettl headers", "tr-nettl" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_NETTL_FDDI */
|
|
|
|
|
{ "FDDI with nettl headers", "fddi-nettl" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_NETTL_UNKNOWN */
|
|
|
|
|
{ "Unknown link-layer type with nettl headers", "unknown-nettl" },
|
2005-05-02 14:07:33 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_MTP2_WITH_PHDR */
|
|
|
|
|
{ "MTP2 with pseudoheader", "mtp2-with-phdr" },
|
2005-05-11 11:24:17 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_JUNIPER_PPPOE */
|
|
|
|
|
{ "Juniper PPPoE", "juniper-pppoe" },
|
2005-05-17 19:50:38 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_GCOM_TIE1 */
|
|
|
|
|
{ "GCOM TIE1", "gcom-tie1" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_GCOM_SERIAL */
|
|
|
|
|
{ "GCOM Serial", "gcom-serial" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_NETTL_X25 */
|
|
|
|
|
{ "X25 with nettl headers", "x25-nettl" },
|
|
|
|
|
|
2006-03-02 21:28:05 +00:00
|
|
|
/* WTAP_ENCAP_K12 */
|
|
|
|
|
{ "K12 protocol analyzer", "k12" },
|
|
|
|
|
|
2005-07-22 15:55:06 +00:00
|
|
|
/* WTAP_ENCAP_JUNIPER_MLPPP */
|
|
|
|
|
{ "Juniper MLPPP", "juniper-mlppp" },
|
|
|
|
|
|
2005-08-12 21:08:02 +00:00
|
|
|
/* WTAP_ENCAP_JUNIPER_MLFR */
|
|
|
|
|
{ "Juniper MLFR", "juniper-mlfr" },
|
|
|
|
|
|
2005-09-20 20:25:55 +00:00
|
|
|
/* WTAP_ENCAP_JUNIPER_ETHER */
|
|
|
|
|
{ "Juniper Ethernet", "juniper-ether" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_JUNIPER_PPP */
|
|
|
|
|
{ "Juniper PPP", "juniper-ppp" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_JUNIPER_FRELAY */
|
|
|
|
|
{ "Juniper Frame-Relay", "juniper-frelay" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_JUNIPER_CHDLC */
|
|
|
|
|
{ "Juniper C-HDLC", "juniper-chdlc" },
|
2007-06-13 22:36:58 +00:00
|
|
|
|
2006-03-30 04:58:06 +00:00
|
|
|
/* WTAP_ENCAP_JUNIPER_GGSN */
|
|
|
|
|
{ "Juniper GGSN", "juniper-ggsn" },
|
2006-03-02 21:28:05 +00:00
|
|
|
|
2008-11-20 20:16:07 +00:00
|
|
|
/* WTAP_ENCAP_LINUX_LAPD */
|
|
|
|
|
{ "LAPD", "lapd" },
|
2006-04-14 12:41:06 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_CATAPULT_DCT2000 */
|
|
|
|
|
{ "Catapult DCT2000", "dct2000" },
|
2006-05-08 19:56:36 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_BER */
|
|
|
|
|
{ "ASN.1 Basic Encoding Rules", "ber" },
|
2006-08-17 20:24:05 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_JUNIPER_VP */
|
|
|
|
|
{ "Juniper Voice PIC", "juniper-vp" },
|
2006-10-10 21:00:35 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_USB */
|
|
|
|
|
{ "Raw USB packets", "usb" },
|
2006-11-27 18:10:12 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_IEEE802_16_MAC_CPS */
|
|
|
|
|
{ "IEEE 802.16 MAC Common Part Sublayer", "ieee-802-16-mac-cps" },
|
2007-01-01 14:48:18 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_NETTL_RAW_TELNET */
|
2007-03-22 10:44:33 +00:00
|
|
|
{ "Raw telnet with nettl headers", "raw-telnet-nettl" },
|
|
|
|
|
|
2007-07-12 19:55:12 +00:00
|
|
|
/* WTAP_ENCAP_USB_LINUX */
|
|
|
|
|
{ "USB packets with Linux header", "usb-linux" },
|
|
|
|
|
|
2007-03-22 10:44:33 +00:00
|
|
|
/* WTAP_ENCAP_MPEG */
|
|
|
|
|
{ "MPEG", "mpeg" },
|
2007-06-13 22:36:58 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_PPI */
|
2007-10-08 11:41:21 +00:00
|
|
|
{ "Per-Packet Information header", "ppi" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_ERF */
|
|
|
|
|
{ "Endace Record File", "erf" },
|
2007-10-16 17:19:16 +00:00
|
|
|
|
2009-12-03 15:40:15 +00:00
|
|
|
/* WTAP_ENCAP_BLUETOOTH_H4_WITH_PHDR */
|
2010-03-28 19:35:14 +00:00
|
|
|
{ "Bluetooth H4 with linux header", "bluetooth-h4-linux" },
|
2007-12-16 14:21:37 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_SITA */
|
|
|
|
|
{ "SITA WAN packets", "sita-wan" },
|
2008-02-25 21:55:41 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_SCCP */
|
|
|
|
|
{ "SS7 SCCP", "sccp" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_BLUETOOTH_HCI */
|
|
|
|
|
{ "Bluetooth without transport layer", "bluetooth-hci" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_IPMB */
|
2008-03-05 20:30:03 +00:00
|
|
|
{ "Intelligent Platform Management Bus", "ipmb" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_IEEE802_15_4 */
|
2008-04-23 21:35:36 +00:00
|
|
|
{ "IEEE 802.15.4 Wireless PAN", "wpan" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_X2E_XORAYA */
|
2008-04-24 00:14:18 +00:00
|
|
|
{ "X2E Xoraya", "x2e-xoraya" },
|
2008-04-23 21:35:36 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_FLEXRAY */
|
|
|
|
|
{ "FlexRay", "flexray" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_LIN */
|
2008-04-24 00:14:18 +00:00
|
|
|
{ "Local Interconnect Network", "lin" },
|
2008-04-23 21:35:36 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_MOST */
|
2008-04-24 00:14:18 +00:00
|
|
|
{ "Media Oriented Systems Transport", "most" },
|
2008-04-23 21:35:36 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_CAN20B */
|
2008-04-24 00:14:18 +00:00
|
|
|
{ "Controller Area Network 2.0B", "can20b" },
|
2008-04-23 21:35:36 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_LAYER1_EVENT */
|
2008-04-24 00:14:18 +00:00
|
|
|
{ "EyeSDN Layer 1 event", "layer1-event" },
|
2008-04-23 21:35:36 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_X2E_SERIAL */
|
2008-08-12 04:44:35 +00:00
|
|
|
{ "X2E serial line capture", "x2e-serial" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_I2C */
|
2008-11-16 17:15:49 +00:00
|
|
|
{ "I2C", "i2c" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_IEEE802_15_4_NONASK_PHY */
|
2008-11-27 16:40:45 +00:00
|
|
|
{ "IEEE 802.15.4 Wireless PAN non-ASK PHY", "wpan-nonask-phy" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_TNEF */
|
2008-12-23 19:50:21 +00:00
|
|
|
{ "Transport-Neutral Encapsulation Format", "tnef" },
|
|
|
|
|
|
2009-12-03 15:40:15 +00:00
|
|
|
/* WTAP_ENCAP_USB_LINUX_MMAPPED */
|
2008-12-23 19:50:21 +00:00
|
|
|
{ "USB packets with Linux header and padding", "usb-linux-mmap" },
|
2009-01-07 07:21:31 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_GSM_UM */
|
2009-06-01 17:23:38 +00:00
|
|
|
{ "GSM Um Interface", "gsm_um" },
|
|
|
|
|
|
2009-12-03 15:40:15 +00:00
|
|
|
/* WTAP_ENCAP_DPNSS */
|
|
|
|
|
{ "Digital Private Signalling System No 1 Link Layer", "dpnss_link" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_PACKETLOGGER */
|
|
|
|
|
{ "PacketLogger", "packetlogger" },
|
|
|
|
|
|
2009-06-01 17:23:38 +00:00
|
|
|
/* WTAP_ENCAP_NSTRACE_1_0 */
|
|
|
|
|
{ "NetScaler Encapsulation 1.0 of Ethernet", "nstrace10" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_NSTRACE_2_0 */
|
|
|
|
|
{ "NetScaler Encapsulation 2.0 of Ethernet", "nstrace20" },
|
|
|
|
|
|
2009-08-23 19:16:35 +00:00
|
|
|
/* WTAP_ENCAP_FIBRE_CHANNEL_FC2 */
|
|
|
|
|
{ "Fibre Channel FC-2", "fc2" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS */
|
2009-10-17 20:56:06 +00:00
|
|
|
{ "Fibre Channel FC-2 With Frame Delimiter", "fc2sof"},
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_JPEG_JFIF */
|
2009-12-03 15:27:39 +00:00
|
|
|
{ "JPEG/JFIF", "jfif" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_IPNET */
|
2010-07-18 22:14:56 +00:00
|
|
|
{ "Solaris IPNET", "ipnet" },
|
2009-07-16 10:45:14 +00:00
|
|
|
|
2010-07-18 22:14:56 +00:00
|
|
|
/* WTAP_ENCAP_SOCKETCAN */
|
2010-07-19 18:00:20 +00:00
|
|
|
{ "SocketCAN", "socketcan" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_IEEE802_11_NETMON_RADIO */
|
2010-07-30 02:30:50 +00:00
|
|
|
{ "IEEE 802.11 plus Network Monitor radio header", "ieee-802-11-netmon" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_IEEE802_15_4_NOFCS */
|
|
|
|
|
{ "IEEE 802.15.4 Wireless PAN with FCS not present", "wpan-nofcs" },
|
2010-10-20 00:36:53 +00:00
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_RAW_IPFIX */
|
2010-12-19 18:46:08 +00:00
|
|
|
{ "IPFIX", "ipfix" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_RAW_IP4 */
|
|
|
|
|
{ "Raw IPv4", "rawip4" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_RAW_IP6 */
|
2011-02-02 22:49:40 +00:00
|
|
|
{ "Raw IPv6", "rawip6" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_LAPD */
|
2011-03-07 02:22:48 +00:00
|
|
|
{ "Lapd header", "lapd" },
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_DVBCI */
|
2011-04-28 05:36:26 +00:00
|
|
|
{ "DVB-CI (Common Interface)", "dvbci"},
|
|
|
|
|
|
|
|
|
|
/* WTAP_ENCAP_MUX27010 */
|
|
|
|
|
{ "MUX27010", "mux27010"}
|
1999-12-05 01:24:54 +00:00
|
|
|
};
|
|
|
|
|
|
2007-05-04 21:10:55 +00:00
|
|
|
gint wtap_num_encap_types = sizeof(encap_table_base) / sizeof(struct encap_type_info);
|
|
|
|
|
static GArray* encap_table_arr = NULL;
|
|
|
|
|
static const struct encap_type_info* encap_table = NULL;
|
|
|
|
|
|
|
|
|
|
static void wtap_init_encap_types(void) {
|
2007-06-13 22:36:58 +00:00
|
|
|
|
2007-05-04 21:10:55 +00:00
|
|
|
if (encap_table_arr) return;
|
2007-06-13 22:36:58 +00:00
|
|
|
|
2007-05-04 21:10:55 +00:00
|
|
|
encap_table_arr = g_array_new(FALSE,TRUE,sizeof(struct encap_type_info));
|
2007-06-13 22:36:58 +00:00
|
|
|
|
2007-05-04 21:10:55 +00:00
|
|
|
g_array_append_vals(encap_table_arr,encap_table_base,wtap_num_encap_types);
|
2007-06-13 22:36:58 +00:00
|
|
|
|
2007-05-04 21:10:55 +00:00
|
|
|
encap_table = (void*)encap_table_arr->data;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int wtap_get_num_encap_types(void) {
|
|
|
|
|
wtap_init_encap_types();
|
|
|
|
|
return wtap_num_encap_types;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
int wtap_register_encap_type(char* name, char* short_name) {
|
2008-11-20 20:16:07 +00:00
|
|
|
struct encap_type_info e;
|
2007-05-04 21:10:55 +00:00
|
|
|
wtap_init_encap_types();
|
2007-06-13 22:36:58 +00:00
|
|
|
|
2008-11-20 20:16:07 +00:00
|
|
|
e.name = g_strdup(name);
|
|
|
|
|
e.short_name = g_strdup(short_name);
|
2007-06-13 22:36:58 +00:00
|
|
|
|
2007-05-04 21:10:55 +00:00
|
|
|
g_array_append_val(encap_table_arr,e);
|
|
|
|
|
|
|
|
|
|
encap_table = (void*)encap_table_arr->data;
|
2008-11-20 20:16:07 +00:00
|
|
|
|
2007-05-04 21:10:55 +00:00
|
|
|
return wtap_num_encap_types++;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
1999-12-05 01:24:54 +00:00
|
|
|
/* Name that should be somewhat descriptive. */
|
2000-09-07 05:34:23 +00:00
|
|
|
const char
|
|
|
|
|
*wtap_encap_string(int encap)
|
1999-12-05 01:24:54 +00:00
|
|
|
{
|
2009-06-16 03:16:55 +00:00
|
|
|
if (encap < WTAP_ENCAP_PER_PACKET || encap >= WTAP_NUM_ENCAP_TYPES)
|
|
|
|
|
return "Illegal";
|
|
|
|
|
else if (encap == WTAP_ENCAP_PER_PACKET)
|
|
|
|
|
return "Per packet";
|
1999-12-05 01:24:54 +00:00
|
|
|
else
|
|
|
|
|
return encap_table[encap].name;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Name to use in, say, a command-line flag specifying the type. */
|
2000-09-07 05:34:23 +00:00
|
|
|
const char
|
|
|
|
|
*wtap_encap_short_string(int encap)
|
1999-12-05 01:24:54 +00:00
|
|
|
{
|
2009-06-16 03:16:55 +00:00
|
|
|
if (encap < WTAP_ENCAP_PER_PACKET || encap >= WTAP_NUM_ENCAP_TYPES)
|
|
|
|
|
return "illegal";
|
|
|
|
|
else if (encap == WTAP_ENCAP_PER_PACKET)
|
|
|
|
|
return "per-packet";
|
1999-12-05 01:24:54 +00:00
|
|
|
else
|
|
|
|
|
return encap_table[encap].short_name;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Translate a short name to a capture file type. */
|
2000-09-07 05:34:23 +00:00
|
|
|
int
|
|
|
|
|
wtap_short_string_to_encap(const char *short_name)
|
1999-12-05 01:24:54 +00:00
|
|
|
{
|
|
|
|
|
int encap;
|
|
|
|
|
|
|
|
|
|
for (encap = 0; encap < WTAP_NUM_ENCAP_TYPES; encap++) {
|
|
|
|
|
if (encap_table[encap].short_name != NULL &&
|
|
|
|
|
strcmp(short_name, encap_table[encap].short_name) == 0)
|
|
|
|
|
return encap;
|
|
|
|
|
}
|
|
|
|
|
return -1; /* no such encapsulation type */
|
|
|
|
|
}
|
|
|
|
|
|
1999-08-22 02:52:48 +00:00
|
|
|
static const char *wtap_errlist[] = {
|
2002-07-16 07:15:09 +00:00
|
|
|
"The file isn't a plain file or pipe",
|
2002-06-07 07:47:58 +00:00
|
|
|
"The file is being opened for random access but is a pipe",
|
1999-08-22 02:52:48 +00:00
|
|
|
"The file isn't a capture file in a known format",
|
|
|
|
|
"File contains record data we don't support",
|
2002-07-16 07:15:09 +00:00
|
|
|
"That file format cannot be written to a pipe",
|
1999-08-22 02:52:48 +00:00
|
|
|
NULL,
|
|
|
|
|
"Files can't be saved in that format",
|
1999-08-22 03:50:31 +00:00
|
|
|
"Files from that network type can't be saved in that format",
|
2002-07-16 07:15:09 +00:00
|
|
|
"That file format doesn't support per-packet encapsulations",
|
1999-08-22 02:52:48 +00:00
|
|
|
NULL,
|
|
|
|
|
NULL,
|
|
|
|
|
"Less data was read than was expected",
|
|
|
|
|
"File contains a record that's not valid",
|
2000-05-25 09:00:24 +00:00
|
|
|
"Less data was written than was requested",
|
|
|
|
|
"Uncompression error: data oddly truncated",
|
|
|
|
|
"Uncompression error: data would overflow buffer",
|
|
|
|
|
"Uncompression error: bad LZ77 offset",
|
2011-04-21 09:41:52 +00:00
|
|
|
"The standard input cannot be opened for random access",
|
|
|
|
|
"That file format doesn't support compression",
|
|
|
|
|
NULL,
|
2011-04-21 17:51:19 +00:00
|
|
|
"Uncompression error",
|
|
|
|
|
"Internal error"
|
1999-08-22 02:52:48 +00:00
|
|
|
};
|
|
|
|
|
#define WTAP_ERRLIST_SIZE (sizeof wtap_errlist / sizeof wtap_errlist[0])
|
|
|
|
|
|
2000-09-07 05:34:23 +00:00
|
|
|
const char
|
|
|
|
|
*wtap_strerror(int err)
|
1999-08-22 02:52:48 +00:00
|
|
|
{
|
2000-08-19 18:31:23 +00:00
|
|
|
static char errbuf[128];
|
2001-07-13 00:55:58 +00:00
|
|
|
unsigned int wtap_errlist_index;
|
1999-08-22 02:52:48 +00:00
|
|
|
|
|
|
|
|
if (err < 0) {
|
|
|
|
|
wtap_errlist_index = -1 - err;
|
|
|
|
|
if (wtap_errlist_index >= WTAP_ERRLIST_SIZE) {
|
2008-02-03 15:38:20 +00:00
|
|
|
g_snprintf(errbuf, 128, "Error %d", err);
|
1999-08-22 02:52:48 +00:00
|
|
|
return errbuf;
|
|
|
|
|
}
|
|
|
|
|
if (wtap_errlist[wtap_errlist_index] == NULL)
|
|
|
|
|
return "Unknown reason";
|
|
|
|
|
return wtap_errlist[wtap_errlist_index];
|
|
|
|
|
} else
|
|
|
|
|
return strerror(err);
|
|
|
|
|
}
|
|
|
|
|
|
2000-05-18 09:09:50 +00:00
|
|
|
/* Close only the sequential side, freeing up memory it uses.
|
2000-05-25 09:00:24 +00:00
|
|
|
|
2000-05-18 09:09:50 +00:00
|
|
|
Note that we do *not* want to call the subtype's close function,
|
|
|
|
|
as it would free any per-subtype data, and that data may be
|
2000-05-25 09:00:24 +00:00
|
|
|
needed by the random-access side.
|
2002-08-28 20:30:45 +00:00
|
|
|
|
2000-05-25 09:00:24 +00:00
|
|
|
Instead, if the subtype has a "sequential close" function, we call it,
|
2011-04-12 17:37:05 +00:00
|
|
|
to free up stuff used only by the sequential side. */
|
|
|
|
|
void
|
2000-09-07 05:34:23 +00:00
|
|
|
wtap_sequential_close(wtap *wth)
|
1998-11-12 00:06:47 +00:00
|
|
|
{
|
2000-05-25 09:00:24 +00:00
|
|
|
if (wth->subtype_sequential_close != NULL)
|
|
|
|
|
(*wth->subtype_sequential_close)(wth);
|
|
|
|
|
|
2000-05-18 09:09:50 +00:00
|
|
|
if (wth->fh != NULL) {
|
|
|
|
|
file_close(wth->fh);
|
|
|
|
|
wth->fh = NULL;
|
|
|
|
|
}
|
1999-11-10 19:47:57 +00:00
|
|
|
|
1999-11-10 19:58:54 +00:00
|
|
|
if (wth->frame_buffer) {
|
|
|
|
|
buffer_free(wth->frame_buffer);
|
1999-11-10 19:47:57 +00:00
|
|
|
g_free(wth->frame_buffer);
|
2000-05-18 09:09:50 +00:00
|
|
|
wth->frame_buffer = NULL;
|
1999-11-10 19:58:54 +00:00
|
|
|
}
|
2000-05-18 09:09:50 +00:00
|
|
|
}
|
|
|
|
|
|
2011-04-12 02:40:14 +00:00
|
|
|
static void
|
|
|
|
|
g_fast_seek_item_free(gpointer data, gpointer user_data _U_)
|
|
|
|
|
{
|
|
|
|
|
g_free(data);
|
|
|
|
|
}
|
|
|
|
|
|
2011-04-12 17:37:05 +00:00
|
|
|
void
|
2000-09-07 05:34:23 +00:00
|
|
|
wtap_close(wtap *wth)
|
2000-05-18 09:09:50 +00:00
|
|
|
{
|
2011-04-12 17:37:05 +00:00
|
|
|
wtap_sequential_close(wth);
|
2000-05-18 09:09:50 +00:00
|
|
|
|
|
|
|
|
if (wth->subtype_close != NULL)
|
|
|
|
|
(*wth->subtype_close)(wth);
|
|
|
|
|
|
2011-04-12 17:37:05 +00:00
|
|
|
if (wth->random_fh != NULL)
|
2000-05-18 09:09:50 +00:00
|
|
|
file_close(wth->random_fh);
|
1999-11-10 19:47:57 +00:00
|
|
|
|
2010-02-26 07:59:54 +00:00
|
|
|
if (wth->priv != NULL)
|
|
|
|
|
g_free(wth->priv);
|
|
|
|
|
|
2011-04-12 02:40:14 +00:00
|
|
|
if (wth->fast_seek != NULL) {
|
|
|
|
|
g_ptr_array_foreach(wth->fast_seek, g_fast_seek_item_free, NULL);
|
|
|
|
|
g_ptr_array_free(wth->fast_seek, TRUE);
|
|
|
|
|
}
|
1999-11-10 19:47:57 +00:00
|
|
|
g_free(wth);
|
1998-11-12 00:06:47 +00:00
|
|
|
}
|
|
|
|
|
|
2010-05-07 21:15:24 +00:00
|
|
|
void
|
2010-05-10 12:56:01 +00:00
|
|
|
wtap_cleareof(wtap *wth _U_) {
|
2010-05-07 21:15:24 +00:00
|
|
|
/* Reset EOF */
|
2011-04-07 21:53:31 +00:00
|
|
|
if (file_eof(wth->fh))
|
|
|
|
|
file_clearerr(wth->fh);
|
2010-05-07 21:15:24 +00:00
|
|
|
}
|
|
|
|
|
|
2011-03-24 22:47:57 +00:00
|
|
|
void wtap_set_cb_new_ipv4(wtap *wth, wtap_new_ipv4_callback_t add_new_ipv4) {
|
|
|
|
|
if (wth)
|
|
|
|
|
wth->add_new_ipv4 = add_new_ipv4;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void wtap_set_cb_new_ipv6(wtap *wth, wtap_new_ipv6_callback_t add_new_ipv6) {
|
|
|
|
|
if (wth)
|
|
|
|
|
wth->add_new_ipv6 = add_new_ipv6;
|
|
|
|
|
}
|
|
|
|
|
|
2000-09-07 05:34:23 +00:00
|
|
|
gboolean
|
2006-11-05 22:46:44 +00:00
|
|
|
wtap_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
|
2000-04-08 00:33:04 +00:00
|
|
|
{
|
2004-03-03 22:24:53 +00:00
|
|
|
/*
|
|
|
|
|
* Set the packet encapsulation to the file's encapsulation
|
|
|
|
|
* value; if that's not WTAP_ENCAP_PER_PACKET, it's the
|
|
|
|
|
* right answer (and means that the read routine for this
|
|
|
|
|
* capture file type doesn't have to set it), and if it
|
|
|
|
|
* *is* WTAP_ENCAP_PER_PACKET, the caller needs to set it
|
|
|
|
|
* anyway.
|
|
|
|
|
*/
|
|
|
|
|
wth->phdr.pkt_encap = wth->file_encap;
|
|
|
|
|
|
2011-04-12 03:27:10 +00:00
|
|
|
if (!wth->subtype_read(wth, err, err_info, data_offset)) {
|
|
|
|
|
/*
|
|
|
|
|
* If we didn't get an error indication, we read
|
|
|
|
|
* the last packet. See if there's any deferred
|
|
|
|
|
* error, as might, for example, occur if we're
|
|
|
|
|
* reading a compressed file, and we got an error
|
|
|
|
|
* reading compressed data from the file, but
|
|
|
|
|
* got enough compressed data to decompress the
|
|
|
|
|
* last packet of the file.
|
|
|
|
|
*/
|
|
|
|
|
if (*err == 0)
|
2011-04-21 09:41:52 +00:00
|
|
|
*err = file_error(wth->fh, err_info);
|
2003-03-04 02:38:02 +00:00
|
|
|
return FALSE; /* failure */
|
2011-04-12 03:27:10 +00:00
|
|
|
}
|
2003-03-04 02:38:02 +00:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* It makes no sense for the captured data length to be bigger
|
|
|
|
|
* than the actual data length.
|
|
|
|
|
*/
|
|
|
|
|
if (wth->phdr.caplen > wth->phdr.len)
|
|
|
|
|
wth->phdr.caplen = wth->phdr.len;
|
2004-03-03 22:24:53 +00:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Make sure that it's not WTAP_ENCAP_PER_PACKET, as that
|
|
|
|
|
* probably means the file has that encapsulation type
|
|
|
|
|
* but the read routine didn't set this packet's
|
|
|
|
|
* encapsulation type.
|
|
|
|
|
*/
|
|
|
|
|
g_assert(wth->phdr.pkt_encap != WTAP_ENCAP_PER_PACKET);
|
|
|
|
|
|
2003-03-04 02:38:02 +00:00
|
|
|
return TRUE; /* success */
|
Add routines to Wiretap to allow a client of Wiretap to get:
a pointer to the "wtap_pkthdr" structure for an open capture
file;
a pointer to the "wtap_pseudo_header" union for an open capture
file;
a pointer to the packet buffer for an open capture file;
so that a program using "wtap_read()" in a loop can get at those items.
Keep, in a "capture_file" structure, an indicator of whether:
no file is open;
a file is open, and being read;
a file is open, and is being read, but the user tried to quit
out of reading the file (e.g., by doing "File/Quit");
a file is open, and has been completely read.
Abort if we try to close a capture that's being read if the user hasn't
tried to quit out of the read.
Have "File/Quit" check if a file is being read; if so, just set the
state indicator to "user tried to quit out of it", so that the code
reading the file can do what's appropriate to clean up, rather than
closing the file out from under that code and causing crashes.
Have "read_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
close the capture and return an indication that the read was aborted by
the user. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "continue_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
return an indication that the read was aborted by the user if that
happened. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "finish_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
close the capture and return an indication that the read was aborted by
the user if that happened. Otherwise, return an indication of whether
the read completely succeeded or failed in the middle (and, if it
failed, return the error code through a pointer).
Have their callers check whether the read was aborted or not and, if it
was, bail out in the appropriate fashion (exit if it's reading a file
specified by "-r" on the command line; exit the main loop if it's
reading a file specified with File->Open; kill the capture child if it's
"continue_tail_cap_file()"; exit the main loop if it's
"finish_tail_cap_file()".
svn path=/trunk/; revision=2095
2000-06-27 07:13:42 +00:00
|
|
|
}
|
|
|
|
|
|
2005-08-19 19:40:00 +00:00
|
|
|
/*
|
|
|
|
|
* Return an approximation of the amount of data we've read sequentially
|
|
|
|
|
* from the file so far. (gint64, in case that's 64 bits.)
|
|
|
|
|
*/
|
|
|
|
|
gint64
|
2011-05-09 05:30:59 +00:00
|
|
|
wtap_read_so_far(wtap *wth)
|
2005-08-19 19:40:00 +00:00
|
|
|
{
|
2011-05-09 05:30:59 +00:00
|
|
|
return file_tell_raw(wth->fh);
|
2005-08-19 19:40:00 +00:00
|
|
|
}
|
|
|
|
|
|
2000-09-07 05:34:23 +00:00
|
|
|
struct wtap_pkthdr*
|
|
|
|
|
wtap_phdr(wtap *wth)
|
Add routines to Wiretap to allow a client of Wiretap to get:
a pointer to the "wtap_pkthdr" structure for an open capture
file;
a pointer to the "wtap_pseudo_header" union for an open capture
file;
a pointer to the packet buffer for an open capture file;
so that a program using "wtap_read()" in a loop can get at those items.
Keep, in a "capture_file" structure, an indicator of whether:
no file is open;
a file is open, and being read;
a file is open, and is being read, but the user tried to quit
out of reading the file (e.g., by doing "File/Quit");
a file is open, and has been completely read.
Abort if we try to close a capture that's being read if the user hasn't
tried to quit out of the read.
Have "File/Quit" check if a file is being read; if so, just set the
state indicator to "user tried to quit out of it", so that the code
reading the file can do what's appropriate to clean up, rather than
closing the file out from under that code and causing crashes.
Have "read_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
close the capture and return an indication that the read was aborted by
the user. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "continue_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
return an indication that the read was aborted by the user if that
happened. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "finish_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
close the capture and return an indication that the read was aborted by
the user if that happened. Otherwise, return an indication of whether
the read completely succeeded or failed in the middle (and, if it
failed, return the error code through a pointer).
Have their callers check whether the read was aborted or not and, if it
was, bail out in the appropriate fashion (exit if it's reading a file
specified by "-r" on the command line; exit the main loop if it's
reading a file specified with File->Open; kill the capture child if it's
"continue_tail_cap_file()"; exit the main loop if it's
"finish_tail_cap_file()".
svn path=/trunk/; revision=2095
2000-06-27 07:13:42 +00:00
|
|
|
{
|
|
|
|
|
return &wth->phdr;
|
|
|
|
|
}
|
|
|
|
|
|
2000-09-07 05:34:23 +00:00
|
|
|
union wtap_pseudo_header*
|
|
|
|
|
wtap_pseudoheader(wtap *wth)
|
Add routines to Wiretap to allow a client of Wiretap to get:
a pointer to the "wtap_pkthdr" structure for an open capture
file;
a pointer to the "wtap_pseudo_header" union for an open capture
file;
a pointer to the packet buffer for an open capture file;
so that a program using "wtap_read()" in a loop can get at those items.
Keep, in a "capture_file" structure, an indicator of whether:
no file is open;
a file is open, and being read;
a file is open, and is being read, but the user tried to quit
out of reading the file (e.g., by doing "File/Quit");
a file is open, and has been completely read.
Abort if we try to close a capture that's being read if the user hasn't
tried to quit out of the read.
Have "File/Quit" check if a file is being read; if so, just set the
state indicator to "user tried to quit out of it", so that the code
reading the file can do what's appropriate to clean up, rather than
closing the file out from under that code and causing crashes.
Have "read_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
close the capture and return an indication that the read was aborted by
the user. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "continue_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
return an indication that the read was aborted by the user if that
happened. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "finish_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
close the capture and return an indication that the read was aborted by
the user if that happened. Otherwise, return an indication of whether
the read completely succeeded or failed in the middle (and, if it
failed, return the error code through a pointer).
Have their callers check whether the read was aborted or not and, if it
was, bail out in the appropriate fashion (exit if it's reading a file
specified by "-r" on the command line; exit the main loop if it's
reading a file specified with File->Open; kill the capture child if it's
"continue_tail_cap_file()"; exit the main loop if it's
"finish_tail_cap_file()".
svn path=/trunk/; revision=2095
2000-06-27 07:13:42 +00:00
|
|
|
{
|
|
|
|
|
return &wth->pseudo_header;
|
|
|
|
|
}
|
|
|
|
|
|
2000-09-07 05:34:23 +00:00
|
|
|
guint8*
|
|
|
|
|
wtap_buf_ptr(wtap *wth)
|
Add routines to Wiretap to allow a client of Wiretap to get:
a pointer to the "wtap_pkthdr" structure for an open capture
file;
a pointer to the "wtap_pseudo_header" union for an open capture
file;
a pointer to the packet buffer for an open capture file;
so that a program using "wtap_read()" in a loop can get at those items.
Keep, in a "capture_file" structure, an indicator of whether:
no file is open;
a file is open, and being read;
a file is open, and is being read, but the user tried to quit
out of reading the file (e.g., by doing "File/Quit");
a file is open, and has been completely read.
Abort if we try to close a capture that's being read if the user hasn't
tried to quit out of the read.
Have "File/Quit" check if a file is being read; if so, just set the
state indicator to "user tried to quit out of it", so that the code
reading the file can do what's appropriate to clean up, rather than
closing the file out from under that code and causing crashes.
Have "read_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
close the capture and return an indication that the read was aborted by
the user. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "continue_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
return an indication that the read was aborted by the user if that
happened. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "finish_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
close the capture and return an indication that the read was aborted by
the user if that happened. Otherwise, return an indication of whether
the read completely succeeded or failed in the middle (and, if it
failed, return the error code through a pointer).
Have their callers check whether the read was aborted or not and, if it
was, bail out in the appropriate fashion (exit if it's reading a file
specified by "-r" on the command line; exit the main loop if it's
reading a file specified with File->Open; kill the capture child if it's
"continue_tail_cap_file()"; exit the main loop if it's
"finish_tail_cap_file()".
svn path=/trunk/; revision=2095
2000-06-27 07:13:42 +00:00
|
|
|
{
|
|
|
|
|
return buffer_start_ptr(wth->frame_buffer);
|
2000-04-08 00:33:04 +00:00
|
|
|
}
|
|
|
|
|
|
2002-03-05 08:40:27 +00:00
|
|
|
gboolean
|
2006-11-05 22:46:44 +00:00
|
|
|
wtap_seek_read(wtap *wth, gint64 seek_off,
|
2002-03-05 05:58:41 +00:00
|
|
|
union wtap_pseudo_header *pseudo_header, guint8 *pd, int len,
|
Have the Wiretap open, read, and seek-and-read routines return, in
addition to an error code, an error info string, for
WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and
WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with
"g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed
strings returned as the error info string, and change the callers of
those routines to, for those errors, put the info string into the
printed message or alert box for the error.
Add messages for cases where those errors were returned without printing
an additional message.
Nobody uses the error code from "cf_read()" - "cf_read()" puts up the
alert box itself for failures; get rid of the error code, so it just
returns a success/failure indication.
Rename "file_read_error_message()" to "cf_read_error_message()", as it
handles read errors from Wiretap, and have it take an error info string
as an argument. (That handles a lot of the work of putting the info
string into the error message.)
Make some variables in "ascend-grammar.y" static.
Check the return value of "erf_read_header()" in "erf_seek_read()".
Get rid of an unused #define in "i4btrace.c".
svn path=/trunk/; revision=9852
2004-01-25 21:55:17 +00:00
|
|
|
int *err, gchar **err_info)
|
1999-09-11 06:48:33 +00:00
|
|
|
{
|
2002-03-05 05:58:41 +00:00
|
|
|
return wth->subtype_seek_read(wth, seek_off, pseudo_header, pd, len,
|
Have the Wiretap open, read, and seek-and-read routines return, in
addition to an error code, an error info string, for
WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and
WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with
"g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed
strings returned as the error info string, and change the callers of
those routines to, for those errors, put the info string into the
printed message or alert box for the error.
Add messages for cases where those errors were returned without printing
an additional message.
Nobody uses the error code from "cf_read()" - "cf_read()" puts up the
alert box itself for failures; get rid of the error code, so it just
returns a success/failure indication.
Rename "file_read_error_message()" to "cf_read_error_message()", as it
handles read errors from Wiretap, and have it take an error info string
as an argument. (That handles a lot of the work of putting the info
string into the error message.)
Make some variables in "ascend-grammar.y" static.
Check the return value of "erf_read_header()" in "erf_seek_read()".
Get rid of an unused #define in "i4btrace.c".
svn path=/trunk/; revision=9852
2004-01-25 21:55:17 +00:00
|
|
|
err, err_info);
|
1999-09-11 04:50:44 +00:00
|
|
|
}
|