forked from osmocom/wireshark
IXIA lcap support
IXIA^WKeysight Technologies's vitual IxNetwork version 8.30 will create capture files in a modified format: It uses a different magic and adds the total size of all records, i.e. the filesize minus the headersize. Add support for this. v2: Different file types use different magic numbers. Not yet tested/supported: The default fileending is .lcap Bug: 14073 Change-Id: Ida90b188ca66a78ff22dca237e4fd6b22e02dc14 Reviewed-on: https://code.wireshark.org/review/23614 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
This commit is contained in:
parent
dae91bcb90
commit
941fac1be2
|
@ -99,6 +99,8 @@ wtap_open_return_val libpcap_open(wtap *wth, int *err, gchar **err_info)
|
|||
int n_subtypes;
|
||||
int best_subtype;
|
||||
int i;
|
||||
int skip_size = 0;
|
||||
int sizebytes;
|
||||
|
||||
/* Read in the number that should be at the start of a "libpcap" file */
|
||||
if (!wtap_read_bytes(wth->fh, &magic, sizeof magic, err, err_info)) {
|
||||
|
@ -109,6 +111,10 @@ wtap_open_return_val libpcap_open(wtap *wth, int *err, gchar **err_info)
|
|||
|
||||
switch (magic) {
|
||||
|
||||
case PCAP_IXIAHW_MAGIC:
|
||||
case PCAP_IXIASW_MAGIC:
|
||||
skip_size = 1;
|
||||
/* FALLTHROUGH */
|
||||
case PCAP_MAGIC:
|
||||
/* Host that wrote it has our byte order, and was running
|
||||
a program using either standard or ss990417 libpcap. */
|
||||
|
@ -125,6 +131,10 @@ wtap_open_return_val libpcap_open(wtap *wth, int *err, gchar **err_info)
|
|||
wth->file_tsprec = WTAP_TSPREC_USEC;
|
||||
break;
|
||||
|
||||
case PCAP_SWAPPED_IXIAHW_MAGIC:
|
||||
case PCAP_SWAPPED_IXIASW_MAGIC:
|
||||
skip_size = 1;
|
||||
/* FALLTHROUGH */
|
||||
case PCAP_SWAPPED_MAGIC:
|
||||
/* Host that wrote it has a byte order opposite to ours,
|
||||
and was running a program using either standard or
|
||||
|
@ -170,6 +180,8 @@ wtap_open_return_val libpcap_open(wtap *wth, int *err, gchar **err_info)
|
|||
/* Read the rest of the header. */
|
||||
if (!wtap_read_bytes(wth->fh, &hdr, sizeof hdr, err, err_info))
|
||||
return WTAP_OPEN_ERROR;
|
||||
if (skip_size==1 && !wtap_read_bytes(wth->fh, &sizebytes, sizeof sizebytes, err, err_info))
|
||||
return WTAP_OPEN_ERROR;
|
||||
|
||||
if (byte_swapped) {
|
||||
/* Byte-swap the header fields about which we care. */
|
||||
|
|
|
@ -41,6 +41,10 @@
|
|||
|
||||
applied; PCAP_SWAPPED_MODIFIED_MAGIC is the byte-swapped version.
|
||||
|
||||
PCAP_IXIAMODIFIED_MAGIC is used by IXIA's lcap file format. It adds
|
||||
a length field at the end of the file header (size of all records).
|
||||
PCAP_SWAPPED_IXIAMODIFIED_MAGIC is the byte-swapped version.
|
||||
|
||||
PCAP_NSEC_MAGIC is for Ulf Lamping's modified "libpcap" format,
|
||||
which uses the same common file format as PCAP_MAGIC, but the
|
||||
timestamps are saved in nanosecond resolution instead of microseconds.
|
||||
|
@ -49,6 +53,10 @@
|
|||
#define PCAP_SWAPPED_MAGIC 0xd4c3b2a1
|
||||
#define PCAP_MODIFIED_MAGIC 0xa1b2cd34
|
||||
#define PCAP_SWAPPED_MODIFIED_MAGIC 0x34cdb2a1
|
||||
#define PCAP_IXIAHW_MAGIC 0x1c0001ac
|
||||
#define PCAP_SWAPPED_IXIAHW_MAGIC 0xac01001c
|
||||
#define PCAP_IXIASW_MAGIC 0x1c0001ab
|
||||
#define PCAP_SWAPPED_IXIASW_MAGIC 0xab01001c
|
||||
#define PCAP_NSEC_MAGIC 0xa1b23c4d
|
||||
#define PCAP_SWAPPED_NSEC_MAGIC 0x4d3cb2a1
|
||||
|
||||
|
|
Loading…
Reference in New Issue