forked from osmocom/wireshark
Use pcapng as the name of the file format.
At one point, I remember a discussion resulting in the official name of the next-generation replacement for pcap format being changed to "pcapng", with no hyphen. Make Wireshark reflect that. Change-Id: Ie66fb13a0fe3a8682143106dab601952e9154e2a Reviewed-on: https://code.wireshark.org/review/25214 Reviewed-by: Guy Harris <guy@alum.mit.edu>
This commit is contained in:
Guy Harris
parent
94479aded1
commit
af0f49e80d
|
|
@ -62,7 +62,7 @@ option(ENABLE_PDF_GUIDES "Build PDF User & Developer Guides" OFF)
|
|||
if(WIN32)
|
||||
option(ENABLE_CHM_GUIDES "Build HTML Help User & Developer Guides" OFF)
|
||||
endif()
|
||||
option(ENABLE_PCAP_NG_DEFAULT "Enable pcap-ng as default file format" ON)
|
||||
option(ENABLE_PCAP_NG_DEFAULT "Enable pcapng as default file format" ON)
|
||||
|
||||
option(ENABLE_PORTAUDIO "Build with PortAudio support" ON)
|
||||
option(ENABLE_ZLIB "Build with zlib compression support" ON)
|
||||
|
|
|
|||
|
|
@ -86,7 +86,7 @@ capture_opts_init(capture_options *capture_opts)
|
|||
capture_opts->save_file = NULL;
|
||||
capture_opts->group_read_access = FALSE;
|
||||
#ifdef PCAP_NG_DEFAULT
|
||||
capture_opts->use_pcapng = TRUE; /* Save as pcap-ng by default */
|
||||
capture_opts->use_pcapng = TRUE; /* Save as pcapng by default */
|
||||
#else
|
||||
capture_opts->use_pcapng = FALSE; /* Save as pcap by default */
|
||||
#endif
|
||||
|
|
|
|||
|
|
@ -1157,9 +1157,9 @@ open_capture_device_pcap_create(capture_options *capture_opts
|
|||
|
||||
#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
|
||||
/*
|
||||
* If we're writing pcap-ng files, try to enable
|
||||
* If we're writing pcapng files, try to enable
|
||||
* nanosecond-resolution capture; any code that
|
||||
* can read pcap-ng files must be able to handle
|
||||
* can read pcapng files must be able to handle
|
||||
* nanosecond-resolution time stamps. We don't
|
||||
* care whether it succeeds or fails - if it fails,
|
||||
* we just use the microsecond-precision time stamps
|
||||
|
|
|
|||
|
|
@ -366,7 +366,7 @@
|
|||
/* Define to the version of this package. */
|
||||
#cmakedefine PACKAGE_VERSION
|
||||
|
||||
/* Support for pcap-ng */
|
||||
/* Support for pcapng */
|
||||
#cmakedefine PCAP_NG_DEFAULT 1
|
||||
|
||||
/* Define if we are using version of of the Portaudio library API */
|
||||
|
|
|
|||
|
|
@ -1795,13 +1795,13 @@ fi
|
|||
AC_SUBST(fuzzshark_bin)
|
||||
|
||||
|
||||
dnl Use pcap-ng by default
|
||||
dnl Use pcapng by default
|
||||
AC_ARG_ENABLE(pcap-ng-default,
|
||||
AC_HELP_STRING( [--enable-pcap-ng-default],
|
||||
[use the pcap-ng file format by default instead of pcap @<:@default=yes@:>@]),
|
||||
[use the pcapng file format by default instead of pcap @<:@default=yes@:>@]),
|
||||
enable_pcap_ng_default=$enableval,enable_pcap_ng_default=yes)
|
||||
if test x$enable_pcap_ng_default = xyes; then
|
||||
AC_DEFINE(PCAP_NG_DEFAULT, 1, [Support for pcap-ng])
|
||||
AC_DEFINE(PCAP_NG_DEFAULT, 1, [Support for pcapng])
|
||||
fi
|
||||
|
||||
dnl zlib check
|
||||
|
|
@ -2978,7 +2978,7 @@ echo " Build randpktdump : $enable_randpktdump"
|
|||
echo " Build udpdump : $enable_udpdump"
|
||||
echo " Build User's Guide : $wsug_message"
|
||||
echo ""
|
||||
echo " Save files as pcap-ng by default : $enable_pcap_ng_default"
|
||||
echo " Save files as pcapng by default : $enable_pcap_ng_default"
|
||||
echo " Install dumpcap with capabilities : $setcap_message"
|
||||
echo " Install dumpcap setuid : $setuid_message"
|
||||
echo " Use dumpcap group : $dumpcap_group_message"
|
||||
|
|
|
|||
|
|
@ -39,7 +39,7 @@ S<[ B<--time-stamp-type> E<lt>typeE<gt> ]>
|
|||
|
||||
B<Dumpcap> is a network traffic dump tool. It lets you capture packet
|
||||
data from a live network and write the packets to a file. B<Dumpcap>'s
|
||||
default capture file format is B<pcap-ng> format.
|
||||
default capture file format is B<pcapng> format.
|
||||
When the B<-P> option is specified, the output file is written in the
|
||||
B<pcap> format.
|
||||
|
||||
|
|
@ -226,7 +226,7 @@ read data from the standard input. Data read from pipes must be in
|
|||
standard pcap format.
|
||||
|
||||
This option can occur multiple times. When capturing from multiple
|
||||
interfaces, the capture file will be saved in pcap-ng format.
|
||||
interfaces, the capture file will be saved in pcapng format.
|
||||
|
||||
Note: the Win32 version of B<Dumpcap> doesn't support capturing from
|
||||
pipes or stdin!
|
||||
|
|
@ -263,7 +263,7 @@ B<TShark>; its format is subject to change from release to release.
|
|||
|
||||
=item -n
|
||||
|
||||
Save files as pcap-ng. This is the default.
|
||||
Save files as pcapng. This is the default.
|
||||
|
||||
=item -N E<lt>packet limitE<gt>
|
||||
|
||||
|
|
@ -290,8 +290,8 @@ promiscuous mode.
|
|||
|
||||
=item -P
|
||||
|
||||
Save files as pcap instead of the default pcap-ng. In situations that require
|
||||
pcap-ng, such as capturing from multiple interfaces, this option will be
|
||||
Save files as pcap instead of the default pcapng. In situations that require
|
||||
pcapng, such as capturing from multiple interfaces, this option will be
|
||||
overridden.
|
||||
|
||||
=item -q
|
||||
|
|
@ -352,7 +352,7 @@ the default capture link type is used if provided.
|
|||
Add a capture comment to the output file.
|
||||
|
||||
This option is only available if we output the captured packets to a
|
||||
single file in pcap-ng format. Only one capture comment may be set per
|
||||
single file in pcapng format. Only one capture comment may be set per
|
||||
output file.
|
||||
|
||||
=item --list-time-stamp-types
|
||||
|
|
|
|||
|
|
@ -111,7 +111,7 @@ multiple times to generate more debugging information.
|
|||
|
||||
The text before the packet starts either with an I or O indicating that
|
||||
the packet is inbound or outbound.
|
||||
This is only stored if the output format is PCAP-NG.
|
||||
This is only stored if the output format is pcapng.
|
||||
|
||||
=item -e E<lt>l3pidE<gt>
|
||||
|
||||
|
|
@ -163,7 +163,7 @@ TCP packets.
|
|||
|
||||
=item -n
|
||||
|
||||
Write PCAP-NG file instead of a PCAP.
|
||||
Write the file in pcapng format rather than pcap format.
|
||||
|
||||
=item -o hex|oct|dec
|
||||
|
||||
|
|
|
|||
|
|
@ -539,7 +539,7 @@ read data from the standard input. Data read from pipes must be in
|
|||
standard pcap format.
|
||||
|
||||
This option can occur multiple times. When capturing from multiple
|
||||
interfaces, the capture file will be saved in pcap-ng format.
|
||||
interfaces, the capture file will be saved in pcapng format.
|
||||
|
||||
Note: the Win32 version of B<TShark> doesn't support capturing from
|
||||
pipes!
|
||||
|
|
|
|||
|
|
@ -75,7 +75,7 @@ and various other tools using libpcap's/WinPcap's/tcpdump's/WinDump's
|
|||
capture format
|
||||
|
||||
=item *
|
||||
pcap-ng - "next-generation" successor to pcap format
|
||||
pcapng - "next-generation" successor to pcap format
|
||||
|
||||
=item *
|
||||
B<snoop> and B<atmsnoop> captures
|
||||
|
|
@ -415,7 +415,7 @@ of the form ``\\pipe\.\B<pipename>''. Data read from pipes must be in
|
|||
standard pcap format.
|
||||
|
||||
This option can occur multiple times. When capturing from multiple
|
||||
interfaces, the capture file will be saved in pcap-ng format.
|
||||
interfaces, the capture file will be saved in pcapng format.
|
||||
|
||||
=item -I
|
||||
|
||||
|
|
|
|||
|
|
@ -272,12 +272,12 @@ _Use multiple files_::
|
|||
Instead of using a single file Wireshark will automatically switch to a new
|
||||
one if a specific trigger condition is reached.
|
||||
|
||||
_Use pcap-ng format_:: This checkbox allows you to specify that
|
||||
Wireshark saves the captured packets in pcap-ng format. This next
|
||||
_Use pcapng format_:: This checkbox allows you to specify that
|
||||
Wireshark saves the captured packets in pcapng format. This next
|
||||
generation capture file format is currently in development. If more than
|
||||
one interface is chosen for capturing, this checkbox is set by default.
|
||||
See {wireshark-wiki-url}Development/PcapNg for more details on
|
||||
pcap-ng.
|
||||
pcapng.
|
||||
|
||||
_Next file every n megabyte(s)_::
|
||||
Multiple files only. Switch to the next file after the given number of
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@ Input:
|
|||
used as the default for unspecified fields.
|
||||
-D the text before the packet starts with an I or an O,
|
||||
indicating that the packet is inbound or outbound.
|
||||
This is only stored if the output format is PCAP-NG.
|
||||
This is only stored if the output format is pcapng.
|
||||
-a enable ASCII text dump identification.
|
||||
The start of the ASCII text dump can be identified
|
||||
and excluded from the packet data, even if it looks
|
||||
|
|
@ -76,4 +76,4 @@ Miscellaneous:
|
|||
-h display this help and exit.
|
||||
-d show detailed debug of parser states.
|
||||
-q generate no output at all (automatically disables -d).
|
||||
-n use PCAP-NG instead of PCAP as output format.
|
||||
-n use pcapng instead of pcap as output format.
|
||||
|
|
|
|||
|
|
@ -846,7 +846,7 @@ static const erf_meta_hf_template_t erf_meta_tags[] = {
|
|||
{ ERF_META_TAG_ns_dns_ipv6, { "Nameserver IPv6 address", "ns_dns_ipv6", FT_IPv6, BASE_NONE, NULL, 0x0, NULL, HFILL } },
|
||||
|
||||
{ ERF_META_TAG_exthdr, { "ERF Extension Header", "exthdr", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
|
||||
{ ERF_META_TAG_pcap_ng_block, { "PCAP-NG Block", "pcap_ng_block", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
|
||||
{ ERF_META_TAG_pcap_ng_block, { "Pcapng Block", "pcap_ng_block", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
|
||||
{ ERF_META_TAG_asn1, { "ASN.1", "asn1", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
|
||||
|
||||
{ ERF_META_TAG_clk_source, { "Clock Source", "clk_source", FT_UINT32, BASE_DEC, VALS(erf_clk_source), 0x0, NULL, HFILL } },
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
/* packet-pcapng.c
|
||||
* Dissector to handle pcap-ng file-type-specific blocks.
|
||||
* Dissector to handle pcapng file-type-specific blocks.
|
||||
*
|
||||
* Wireshark - Network traffic analyzer
|
||||
* By Gerald Combs <gerald@wireshark.org>
|
||||
|
|
@ -45,8 +45,8 @@ dissect_pcapng_block(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void*
|
|||
/*
|
||||
* There isn't one; just do a minimal display.
|
||||
*/
|
||||
col_set_str(pinfo->cinfo, COL_PROTOCOL, "PCAP-NG");
|
||||
col_add_fstr(pinfo->cinfo, COL_INFO, "PCAP-NG block, type %u",
|
||||
col_set_str(pinfo->cinfo, COL_PROTOCOL, "PCAPNG");
|
||||
col_add_fstr(pinfo->cinfo, COL_INFO, "Pcapng block, type %u",
|
||||
pinfo->pseudo_header->ftsrec.record_type);
|
||||
|
||||
proto_tree_add_item(tree, proto_pcapng_block, tvb, 0, -1, ENC_NA);
|
||||
|
|
@ -56,10 +56,10 @@ dissect_pcapng_block(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void*
|
|||
|
||||
void proto_register_pcapng_block(void)
|
||||
{
|
||||
proto_pcapng_block = proto_register_protocol("PCAP-NG block",
|
||||
"PCAP-NG", "pcapng");
|
||||
proto_pcapng_block = proto_register_protocol("Pcapng block",
|
||||
"PCAPNG", "pcapng");
|
||||
pcapng_block_type_dissector_table = register_dissector_table("pcapng.block_type",
|
||||
"pcap-ng block type", proto_pcapng_block, FT_UINT32, BASE_DEC);
|
||||
"pcapng block type", proto_pcapng_block, FT_UINT32, BASE_DEC);
|
||||
}
|
||||
|
||||
void
|
||||
|
|
|
|||
|
|
@ -28,7 +28,7 @@
|
|||
|
||||
/*
|
||||
* Sysdig is a tool that captures and analyzes system state.
|
||||
* This dissects pcap-ng Sysdig Event Blocks (0x00000204), which contains
|
||||
* This dissects pcapng Sysdig Event Blocks (0x00000204), which contains
|
||||
* a system call entry or exit along with its associated parameters.
|
||||
*/
|
||||
|
||||
|
|
|
|||
|
|
@ -3464,8 +3464,8 @@ prefs_register_modules(void)
|
|||
"Interface capture filter (Ex: en0(tcp),en1(udp),...)",
|
||||
&prefs.capture_devices_filter, PREF_STRING, NULL, FALSE);
|
||||
|
||||
prefs_register_bool_preference(capture_module, "pcap_ng", "Capture in Pcap-NG format",
|
||||
"Capture in Pcap-NG format?", &prefs.capture_pcap_ng);
|
||||
prefs_register_bool_preference(capture_module, "pcap_ng", "Capture in pcapng format",
|
||||
"Capture in pcapng format?", &prefs.capture_pcap_ng);
|
||||
|
||||
prefs_register_bool_preference(capture_module, "real_time_update", "Update packet list in real time during capture",
|
||||
"Update packet list in real time during capture?", &prefs.capture_real_time);
|
||||
|
|
|
|||
|
|
@ -332,7 +332,7 @@ WS_DLL_PUBLIC gdouble tvb_get_ieee_double(tvbuff_t *tvb, const gint offset, cons
|
|||
|
||||
/*
|
||||
* Fetch 16-bit and 32-bit values in host byte order.
|
||||
* Used for some pseudo-headers in pcap/pcap-ng files, in which the
|
||||
* Used for some pseudo-headers in pcap/pcapng files, in which the
|
||||
* headers are, when capturing, in the byte order of the host, and
|
||||
* are converted to the byte order of the host reading the file
|
||||
* when reading a capture file.
|
||||
|
|
|
|||
|
|
@ -133,7 +133,7 @@
|
|||
<key>CFBundleTypeIconFile</key>
|
||||
<string>Wiresharkdoc.icns</string>
|
||||
<key>CFBundleTypeName</key>
|
||||
<string>Pcap-NG Network Capture</string>
|
||||
<string>Pcapng Network Capture</string>
|
||||
<key>CFBundleTypeRole</key>
|
||||
<string>Viewer</string>
|
||||
</dict>
|
||||
|
|
|
|||
|
|
@ -416,9 +416,9 @@ function State:get_timestamp(line, file_position, seeking)
|
|||
|
||||
-- XXX - but for purposes of testing, we just force the year to
|
||||
-- 2014, so that we can compare the result of this code reading
|
||||
-- an Acme log with the result of the pcap-ng reader reading a
|
||||
-- pcap-ng file with the same packets - the time stamps in
|
||||
-- pcap-ng files are times since the Epoch, so the year is known
|
||||
-- an Acme log with the result of the pcapng reader reading a
|
||||
-- pcapng file with the same packets - the time stamps in
|
||||
-- pcapng files are times since the Epoch, so the year is known
|
||||
self.tyear = 2014
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -71,52 +71,52 @@ ff_step_nsec_pcap_direct() {
|
|||
test_step_ok
|
||||
}
|
||||
|
||||
# Microsecond pcap-ng / stdin
|
||||
# Microsecond pcapng / stdin
|
||||
ff_step_usec_pcapng_stdin() {
|
||||
$TSHARK $TS_FF_ARGS -r - < "${CAPTURE_DIR}dhcp.pcapng" > ./ff-ts-usec-pcapng-stdin.txt 2> /dev/null
|
||||
diff -u $FF_BASELINE ./ff-ts-usec-pcapng-stdin.txt > $DIFF_OUT 2>&1
|
||||
RETURNVALUE=$?
|
||||
if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
|
||||
test_step_failed "Output of microsecond pcap direct read vs microsecond pcap-ng via stdin differ"
|
||||
test_step_failed "Output of microsecond pcap direct read vs microsecond pcapng via stdin differ"
|
||||
cat $DIFF_OUT
|
||||
return
|
||||
fi
|
||||
test_step_ok
|
||||
}
|
||||
|
||||
# Microsecond pcap-ng / direct
|
||||
# Microsecond pcapng / direct
|
||||
ff_step_usec_pcapng_direct() {
|
||||
$TSHARK $TS_FF_ARGS -r "${CAPTURE_DIR}dhcp.pcapng" > ./ff-ts-usec-pcapng-direct.txt 2> /dev/null
|
||||
diff -u $FF_BASELINE ./ff-ts-usec-pcapng-direct.txt > $DIFF_OUT 2>&1
|
||||
RETURNVALUE=$?
|
||||
if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
|
||||
test_step_failed "Output of microsecond pcap direct read vs microsecond pcap-ng direct read differ"
|
||||
test_step_failed "Output of microsecond pcap direct read vs microsecond pcapng direct read differ"
|
||||
cat $DIFF_OUT
|
||||
return
|
||||
fi
|
||||
test_step_ok
|
||||
}
|
||||
|
||||
# Nanosecond pcap-ng / stdin
|
||||
# Nanosecond pcapng / stdin
|
||||
ff_step_nsec_pcapng_stdin() {
|
||||
$TSHARK $TS_FF_ARGS -r - < "${CAPTURE_DIR}dhcp-nanosecond.pcapng" > ./ff-ts-nsec-pcapng-stdin.txt 2> /dev/null
|
||||
diff -u $FF_BASELINE ./ff-ts-nsec-pcapng-stdin.txt > $DIFF_OUT 2>&1
|
||||
RETURNVALUE=$?
|
||||
if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
|
||||
test_step_failed "Output of microsecond pcap direct read vs nanosecond pcap-ng via stdin differ"
|
||||
test_step_failed "Output of microsecond pcap direct read vs nanosecond pcapng via stdin differ"
|
||||
cat $DIFF_OUT
|
||||
return
|
||||
fi
|
||||
test_step_ok
|
||||
}
|
||||
|
||||
# Nanosecond pcap-ng / direct
|
||||
# Nanosecond pcapng / direct
|
||||
ff_step_nsec_pcapng_direct() {
|
||||
$TSHARK $TS_FF_ARGS -r "${CAPTURE_DIR}dhcp-nanosecond.pcapng" > ./ff-ts-nsec-pcapng-direct.txt 2> /dev/null
|
||||
diff -u $FF_BASELINE ./ff-ts-nsec-pcapng-direct.txt > $DIFF_OUT 2>&1
|
||||
RETURNVALUE=$?
|
||||
if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
|
||||
test_step_failed "Output of microsecond pcap direct read vs nanosecond pcap-ng direct read differ"
|
||||
test_step_failed "Output of microsecond pcap direct read vs nanosecond pcapng direct read differ"
|
||||
cat $DIFF_OUT
|
||||
return
|
||||
fi
|
||||
|
|
@ -128,10 +128,10 @@ tshark_ff_suite() {
|
|||
test_step_add "Microsecond pcap via stdin" ff_step_usec_pcap_stdin
|
||||
test_step_add "Nanosecond pcap via stdin" ff_step_nsec_pcap_stdin
|
||||
test_step_add "Nanosecond pcap direct read" ff_step_nsec_pcap_direct
|
||||
test_step_add "Microsecond pcap-ng via stdin" ff_step_usec_pcapng_stdin
|
||||
test_step_add "Microsecond pcap-ng direct read" ff_step_usec_pcapng_direct
|
||||
test_step_add "Nanosecond pcap-ng via stdin" ff_step_nsec_pcapng_stdin
|
||||
test_step_add "Nanosecond pcap-ng direct read" ff_step_nsec_pcapng_direct
|
||||
test_step_add "Microsecond pcapng via stdin" ff_step_usec_pcapng_stdin
|
||||
test_step_add "Microsecond pcapng direct read" ff_step_usec_pcapng_direct
|
||||
test_step_add "Nanosecond pcapng via stdin" ff_step_nsec_pcapng_stdin
|
||||
test_step_add "Nanosecond pcapng direct read" ff_step_nsec_pcapng_direct
|
||||
}
|
||||
|
||||
ff_cleanup_step() {
|
||||
|
|
|
|||
|
|
@ -1383,7 +1383,7 @@ print_usage (FILE *output)
|
|||
" used as the default for unspecified fields.\n"
|
||||
" -D the text before the packet starts with an I or an O,\n"
|
||||
" indicating that the packet is inbound or outbound.\n"
|
||||
" This is only stored if the output format is PCAP-NG.\n"
|
||||
" This is only stored if the output format is pcapng.\n"
|
||||
" -a enable ASCII text dump identification.\n"
|
||||
" The start of the ASCII text dump can be identified\n"
|
||||
" and excluded from the packet data, even if it looks\n"
|
||||
|
|
@ -1437,7 +1437,7 @@ print_usage (FILE *output)
|
|||
" -h display this help and exit.\n"
|
||||
" -d show detailed debug of parser states.\n"
|
||||
" -q generate no output at all (automatically disables -d).\n"
|
||||
" -n use PCAP-NG instead of PCAP as output format.\n"
|
||||
" -n use pcapng instead of pcap as output format.\n"
|
||||
"",
|
||||
WTAP_MAX_PACKET_SIZE_STANDARD);
|
||||
}
|
||||
|
|
@ -1845,7 +1845,7 @@ parse_options (int argc, char *argv[])
|
|||
if (!quiet) {
|
||||
fprintf(stderr, "Input from: %s\n", input_filename);
|
||||
fprintf(stderr, "Output to: %s\n", output_filename);
|
||||
fprintf(stderr, "Output format: %s\n", use_pcapng ? "PCAP-NG" : "PCAP");
|
||||
fprintf(stderr, "Output format: %s\n", use_pcapng ? "pcapng" : "pcap");
|
||||
|
||||
if (hdr_ethernet) fprintf(stderr, "Generate dummy Ethernet header: Protocol: 0x%0X\n",
|
||||
hdr_ethernet_proto);
|
||||
|
|
|
|||
2
tshark.c
2
tshark.c
|
|
@ -1686,7 +1686,7 @@ main(int argc, char *argv[])
|
|||
if (global_capture_opts.saving_to_file) {
|
||||
/* They specified a "-w" flag, so we'll be saving to a capture file. */
|
||||
|
||||
/* When capturing, we only support writing pcap or pcap-ng format. */
|
||||
/* When capturing, we only support writing pcap or pcapng format. */
|
||||
if (out_file_type != WTAP_FILE_TYPE_SUBTYPE_PCAP &&
|
||||
out_file_type != WTAP_FILE_TYPE_SUBTYPE_PCAPNG) {
|
||||
cmdarg_err("Live captures can only be saved in pcap or pcapng format.");
|
||||
|
|
|
|||
|
|
@ -822,7 +822,7 @@ capture_filter_check_syntax_cb(GtkWidget *w _U_, gpointer user_data _U_)
|
|||
* header types; we will not have it if, for example, we have a named
|
||||
* pipe rather than an interface, as a named pipe doesn't *have* a
|
||||
* link-layer header type until the capture is started and the
|
||||
* pcap file header or pcap-ng interface description block is
|
||||
* pcap file header or pcapng interface description block is
|
||||
* written, and we can't wait for that. We won't have it if we can't
|
||||
* open the interface, either.
|
||||
*
|
||||
|
|
@ -5021,8 +5021,8 @@ capture_prep_cb(GtkWidget *w _U_, gpointer d _U_)
|
|||
ws_gtk_grid_attach_extended(GTK_GRID (multi_grid), multi_files_on_cb, 0, row, 1, 1,
|
||||
(GtkAttachOptions)(GTK_FILL), (GtkAttachOptions)(GTK_FILL), 0, 0);
|
||||
|
||||
/* Pcap-NG row */
|
||||
pcap_ng_cb = gtk_check_button_new_with_mnemonic("Use pcap-ng format");
|
||||
/* Pcapng row */
|
||||
pcap_ng_cb = gtk_check_button_new_with_mnemonic("Use pcapng format");
|
||||
gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(pcap_ng_cb), global_capture_opts.use_pcapng);
|
||||
gtk_widget_set_tooltip_text(pcap_ng_cb, "Capture packets in the next-generation capture file format. "
|
||||
"This is still experimental.");
|
||||
|
|
|
|||
|
|
@ -1350,8 +1350,8 @@ do_file_save(capture_file *cf, gboolean dont_reopen)
|
|||
it to a permanent file. Prompt the user for a location
|
||||
to which to save it. Don't require that the file format
|
||||
support comments - if it's a temporary capture file, it's
|
||||
probably pcap-ng, which supports comments and, if it's
|
||||
not pcap-ng, let the user decide what they want to do
|
||||
probably pcapng, which supports comments and, if it's
|
||||
not pcapng, let the user decide what they want to do
|
||||
if they've added comments. */
|
||||
return file_save_as_cmd(cf, FALSE, dont_reopen);
|
||||
} else {
|
||||
|
|
@ -1443,7 +1443,7 @@ file_save_cmd_cb(GtkWidget *w _U_, gpointer data _U_) {
|
|||
/* Attach a list of the valid 'save as' file types to a combo_box by
|
||||
checking what Wiretap supports. Make the default type the first
|
||||
in the list. If must_supprt_comments is true, restrict the list
|
||||
to those formats that support comments (currently, just pcap-ng).
|
||||
to those formats that support comments (currently, just pcapng).
|
||||
|
||||
Returns the default file type. */
|
||||
static int
|
||||
|
|
@ -1589,7 +1589,7 @@ gtk_check_save_as_with_comments(GtkWidget *w, capture_file *cf, int file_type)
|
|||
switch (response) {
|
||||
|
||||
case RESPONSE_SAVE_IN_ANOTHER_FORMAT:
|
||||
/* OK, the only other format we support is pcap-ng. Make that
|
||||
/* OK, the only other format we support is pcapng. Make that
|
||||
the one and only format in the combo box, and return to
|
||||
let the user continue with the dialog.
|
||||
|
||||
|
|
@ -1597,7 +1597,7 @@ gtk_check_save_as_with_comments(GtkWidget *w, capture_file *cf, int file_type)
|
|||
the compressed checkbox; get the current value and restore
|
||||
it.
|
||||
|
||||
XXX - we know pcap-ng can be compressed; if we ever end up
|
||||
XXX - we know pcapng can be compressed; if we ever end up
|
||||
supporting saving comments in a format that *can't* be
|
||||
compressed, such as NetMon format, we must check this. */
|
||||
/* XXX - need a compressed checkbox here! */
|
||||
|
|
|
|||
|
|
@ -103,7 +103,7 @@ export_pdu_show_cb(GtkWidget *w _U_, gpointer d _U_)
|
|||
exp_pdu_dlg_data = (exp_pdu_dlg_t *)g_malloc(sizeof(exp_pdu_dlg_t));
|
||||
exp_pdu_dlg_data->exp_pdu_tap_data.pkt_encap = wtap_wtap_encap_to_pcap_encap(WTAP_ENCAP_WIRESHARK_UPPER_PDU);
|
||||
|
||||
export_pdu_dlg = window_new(GTK_WINDOW_TOPLEVEL, "Wireshark: Export PDUs to pcap-ng file");
|
||||
export_pdu_dlg = window_new(GTK_WINDOW_TOPLEVEL, "Wireshark: Export PDUs to pcapng file");
|
||||
|
||||
g_signal_connect(export_pdu_dlg, "delete_event", G_CALLBACK(window_delete_event_cb), NULL);
|
||||
g_signal_connect(export_pdu_dlg, "destroy", G_CALLBACK(export_pdu_destroy_cb), NULL);
|
||||
|
|
|
|||
|
|
@ -211,9 +211,9 @@ capture_prefs_show(void)
|
|||
g_signal_connect(promisc_cb, "toggled", G_CALLBACK(prom_mode_cb), NULL);
|
||||
g_object_set_data(G_OBJECT(capture_window), PROM_MODE_KEY, promisc_cb);
|
||||
|
||||
/* Pcap-NG format */
|
||||
/* Pcapng format */
|
||||
pcap_ng_cb = create_preference_check_button(main_grid, row++,
|
||||
"Capture packets in pcap-ng format:",
|
||||
"Capture packets in pcapng format:",
|
||||
"Capture packets in the next-generation capture file format.",
|
||||
prefs.capture_pcap_ng);
|
||||
g_object_set_data(G_OBJECT(capture_window), PCAP_NG_KEY, pcap_ng_cb);
|
||||
|
|
|
|||
|
|
@ -177,7 +177,7 @@ check_savability_t CaptureFileDialog::checkSaveAsWithComments(QWidget *
|
|||
* Therefore we should use clickedButton() to determine which button was clicked. */
|
||||
|
||||
if (msg_dialog.clickedButton() == save_button) {
|
||||
/* OK, the only other format we support is pcap-ng. Make that
|
||||
/* OK, the only other format we support is pcapng. Make that
|
||||
the one and only format in the combo box, and return to
|
||||
let the user continue with the dialog.
|
||||
|
||||
|
|
@ -185,7 +185,7 @@ check_savability_t CaptureFileDialog::checkSaveAsWithComments(QWidget *
|
|||
the compressed checkbox; get the current value and restore
|
||||
it.
|
||||
|
||||
XXX - we know pcap-ng can be compressed; if we ever end up
|
||||
XXX - we know pcapng can be compressed; if we ever end up
|
||||
supporting saving comments in a format that *can't* be
|
||||
compressed, such as NetMon format, we must check this. */
|
||||
/* XXX - need a compressed checkbox here! */
|
||||
|
|
|
|||
|
|
@ -221,7 +221,7 @@
|
|||
<item>
|
||||
<widget class="QRadioButton" name="rbPcapng">
|
||||
<property name="text">
|
||||
<string>pcap-ng</string>
|
||||
<string>pcapng</string>
|
||||
</property>
|
||||
</widget>
|
||||
</item>
|
||||
|
|
|
|||
|
|
@ -73,7 +73,7 @@
|
|||
<string><html><head/><body><p>Capture packets in the next-generation capture file format.</p></body></html></string>
|
||||
</property>
|
||||
<property name="text">
|
||||
<string>Capture packets in pcap-ng format</string>
|
||||
<string>Capture packets in pcapng format</string>
|
||||
</property>
|
||||
</widget>
|
||||
</item>
|
||||
|
|
|
|||
|
|
@ -1315,8 +1315,8 @@ bool MainWindow::saveCaptureFile(capture_file *cf, bool dont_reopen) {
|
|||
it to a permanent file. Prompt the user for a location
|
||||
to which to save it. Don't require that the file format
|
||||
support comments - if it's a temporary capture file, it's
|
||||
probably pcap-ng, which supports comments and, if it's
|
||||
not pcap-ng, let the user decide what they want to do
|
||||
probably pcapng, which supports comments and, if it's
|
||||
not pcapng, let the user decide what they want to do
|
||||
if they've added comments. */
|
||||
return saveAsCaptureFile(cf, FALSE, dont_reopen);
|
||||
} else {
|
||||
|
|
|
|||
|
|
@ -1025,8 +1025,8 @@
|
|||
<translation>Ausgabeformat:</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>pcap-ng</source>
|
||||
<translation>pcap-ng</translation>
|
||||
<source>pcapng</source>
|
||||
<translation>pcapng</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>pcap</source>
|
||||
|
|
@ -1320,8 +1320,8 @@ Achtung: Eine Option MUSS ausgewählt sein.</translation>
|
|||
<translation><html><head/><body><p>Pakete im pcapng Dateiformat aufzeichnen.</p></body></html></translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>Capture packets in pcap-ng format</source>
|
||||
<translation>Pakte im pcap-ng Format mitschneiden</translation>
|
||||
<source>Capture packets in pcapng format</source>
|
||||
<translation>Pakte im pcapng Format mitschneiden</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source><html><head/><body><p>Update the list of packets while capture is in progress. This can result in dropped packets on high-speed networks.</p></body></html></source>
|
||||
|
|
|
|||
|
|
@ -1023,7 +1023,7 @@
|
|||
<translation type="unfinished"></translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>pcap-ng</source>
|
||||
<source>pcapng</source>
|
||||
<translation type="unfinished"></translation>
|
||||
</message>
|
||||
<message>
|
||||
|
|
@ -1317,7 +1317,7 @@ PLEASE NOTE: One option MUST be selected.</source>
|
|||
<translation type="unfinished"></translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>Capture packets in pcap-ng format</source>
|
||||
<source>Capture packets in pcapng format</source>
|
||||
<translation type="unfinished"></translation>
|
||||
</message>
|
||||
<message>
|
||||
|
|
|
|||
|
|
@ -1025,8 +1025,8 @@
|
|||
<translation>Format de sortie:</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>pcap-ng</source>
|
||||
<translation>pcap-ng</translation>
|
||||
<source>pcapng</source>
|
||||
<translation>pcapng</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>pcap</source>
|
||||
|
|
@ -1317,11 +1317,11 @@ NOTE: Une option DOIT être sélectionnée.</translation>
|
|||
</message>
|
||||
<message>
|
||||
<source><html><head/><body><p>Capture packets in the next-generation capture file format.</p></body></html></source>
|
||||
<translation><html><head/><body><p>Paquets de capture dans le nouveau format (pcap-ng) de fichier de capture.</p></body></html></translation>
|
||||
<translation><html><head/><body><p>Paquets de capture dans le nouveau format (pcapng) de fichier de capture.</p></body></html></translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>Capture packets in pcap-ng format</source>
|
||||
<translation>Capture de paquet au format pcap-ng</translation>
|
||||
<source>Capture packets in pcapng format</source>
|
||||
<translation>Capture de paquet au format pcapng</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source><html><head/><body><p>Update the list of packets while capture is in progress. This can result in dropped packets on high-speed networks.</p></body></html></source>
|
||||
|
|
|
|||
|
|
@ -1025,8 +1025,8 @@
|
|||
<translation>Formato dell'output:</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>pcap-ng</source>
|
||||
<translation>pcap-ng</translation>
|
||||
<source>pcapng</source>
|
||||
<translation>pcapng</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>pcap</source>
|
||||
|
|
@ -1320,8 +1320,8 @@ NOTA: un'opzione DEVE essere selezionata.</translation>
|
|||
<translation><html><head/><body><p>Cattura i pacchetti nel formato di file di nuova generazione.</p></body></html></translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>Capture packets in pcap-ng format</source>
|
||||
<translation>Cattura i pacchetti nel formato pcap-ng</translation>
|
||||
<source>Capture packets in pcapng format</source>
|
||||
<translation>Cattura i pacchetti nel formato pcapng</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source><html><head/><body><p>Update the list of packets while capture is in progress. This can result in dropped packets on high-speed networks.</p></body></html></source>
|
||||
|
|
|
|||
|
|
@ -1020,8 +1020,8 @@
|
|||
<translation>出力形式:</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>pcap-ng</source>
|
||||
<translation>pcap-ng形式</translation>
|
||||
<source>pcapng</source>
|
||||
<translation>pcapng形式</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>pcap</source>
|
||||
|
|
@ -1315,8 +1315,8 @@ PLEASE NOTE: One option MUST be selected.</source>
|
|||
<translation><html><head/><body><p>次世代のキャプチャファイル形式でパケットをキャプチャします</p></body></html></translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>Capture packets in pcap-ng format</source>
|
||||
<translation>pcap-ng形式でパケットをキャプチャします</translation>
|
||||
<source>Capture packets in pcapng format</source>
|
||||
<translation>pcapng形式でパケットをキャプチャします</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source><html><head/><body><p>Update the list of packets while capture is in progress. This can result in dropped packets on high-speed networks.</p></body></html></source>
|
||||
|
|
|
|||
|
|
@ -1026,8 +1026,8 @@
|
|||
<translation>Format wyjściowy:</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>pcap-ng</source>
|
||||
<translation>pcap-ng</translation>
|
||||
<source>pcapng</source>
|
||||
<translation>pcapng</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>pcap</source>
|
||||
|
|
@ -1318,11 +1318,11 @@ UWAGA: Przynajmniej jedna opcja MUSI zostać zaznaczona.</translation>
|
|||
</message>
|
||||
<message>
|
||||
<source><html><head/><body><p>Capture packets in the next-generation capture file format.</p></body></html></source>
|
||||
<translation><html><head/><body><p>Zapisuj pakiety w formacie pcap-ng</p></body></html></translation>
|
||||
<translation><html><head/><body><p>Zapisuj pakiety w formacie pcapng</p></body></html></translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>Capture packets in pcap-ng format</source>
|
||||
<translation>Zapisuj pakiety w formacie pcap-ng</translation>
|
||||
<source>Capture packets in pcapng format</source>
|
||||
<translation>Zapisuj pakiety w formacie pcapng</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source><html><head/><body><p>Update the list of packets while capture is in progress. This can result in dropped packets on high-speed networks.</p></body></html></source>
|
||||
|
|
|
|||
|
|
@ -1020,8 +1020,8 @@
|
|||
<translation>输出格式：</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>pcap-ng</source>
|
||||
<translation>pcap-ng</translation>
|
||||
<source>pcapng</source>
|
||||
<translation>pcapng</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>pcap</source>
|
||||
|
|
@ -1316,8 +1316,8 @@ PLEASE NOTE: One option MUST be selected.</source>
|
|||
<translation><html><head/><body><p>使用下一代捕获文件格式来捕获分组。</p></body></html></translation>
|
||||
</message>
|
||||
<message>
|
||||
<source>Capture packets in pcap-ng format</source>
|
||||
<translation>使用pcap-ng格式捕获分组</translation>
|
||||
<source>Capture packets in pcapng format</source>
|
||||
<translation>使用pcapng格式捕获分组</translation>
|
||||
</message>
|
||||
<message>
|
||||
<source><html><head/><body><p>Update the list of packets while capture is in progress. This can result in dropped packets on high-speed networks.</p></body></html></source>
|
||||
|
|
|
|||
|
|
@ -297,7 +297,7 @@ win32_check_save_as_with_comments(HWND parent, capture_file *cf, int file_type)
|
|||
switch (response) {
|
||||
|
||||
case IDNO: /* "No" means "Save in another format" in the first dialog */
|
||||
/* OK, the only other format we support is pcap-ng. Make that
|
||||
/* OK, the only other format we support is pcapng. Make that
|
||||
the one and only format in the combo box, and return to
|
||||
let the user continue with the dialog.
|
||||
|
||||
|
|
@ -305,7 +305,7 @@ win32_check_save_as_with_comments(HWND parent, capture_file *cf, int file_type)
|
|||
the compressed checkbox; get the current value and restore
|
||||
it.
|
||||
|
||||
XXX - we know pcap-ng can be compressed; if we ever end up
|
||||
XXX - we know pcapng can be compressed; if we ever end up
|
||||
supporting saving comments in a format that *can't* be
|
||||
compressed, such as NetMon format, we must check this. */
|
||||
/* XXX - need a compressed checkbox here! */
|
||||
|
|
|
|||
|
|
@ -730,16 +730,16 @@ static gboolean erf_read_header(wtap *wth, FILE_T fh,
|
|||
/*
|
||||
* XXX: ERF_TYPE_META records should ideally be FT_SPECIFIC for display
|
||||
* purposes, but currently ft_specific_record_phdr clashes with erf_mc_phdr
|
||||
* and the PCAP-NG dumper assumes it is a PCAP-NG block type. Ideally we
|
||||
* would register a block handler with PCAP-NG and write out the closest
|
||||
* PCAP-NG block, or a custom block/Provenance record.
|
||||
* and the pcapng dumper assumes it is a pcapng block type. Ideally we
|
||||
* would register a block handler with pcapng and write out the closest
|
||||
* pcapng block, or a custom block/Provenance record.
|
||||
*
|
||||
*/
|
||||
#if 0
|
||||
} else {
|
||||
/*
|
||||
* TODO: how to identify, distinguish and timestamp events?
|
||||
* What to do about ENCAP_ERF in PCAP/PCAP-NG? Filetype dissector is
|
||||
* What to do about ENCAP_ERF in pcap/pcapng? Filetype dissector is
|
||||
* chosen by wth->file_type_subtype?
|
||||
*/
|
||||
/* For now just treat all Provenance records as reports */
|
||||
|
|
@ -1154,7 +1154,7 @@ static void erf_write_wtap_option_to_interface_tag(wtap_block_t block _U_,
|
|||
#if 0
|
||||
tag_ptr->type = ERF_META_TAG_if_mac;
|
||||
tag_ptr->length = 6;
|
||||
/*value same format as PCAP-NG (6-byte canonical, padded by write
|
||||
/*value same format as pcapng (6-byte canonical, padded by write
|
||||
* function automatically to 32-bit boundary)*/
|
||||
tag_ptr->value = (guint8*)g_malloc(sizeof(optval->macval));
|
||||
memcpy(tag_ptr->value, &optval->macval, sizeof(optval->macval));
|
||||
|
|
@ -1961,7 +1961,7 @@ static gboolean erf_dump(
|
|||
/*XXX: The user may have changed the comment to cleared! */
|
||||
if(phdr->opt_comment || phdr->has_comment_changed) {
|
||||
if (encap == WTAP_ENCAP_ERF) {
|
||||
/* XXX: What about ERF-in-PCAPNG with existing comment (that wasn't
|
||||
/* XXX: What about ERF-in-pcapng with existing comment (that wasn't
|
||||
* modified)? */
|
||||
if(phdr->has_comment_changed) {
|
||||
memcpy(&other_phdr, pseudo_header, sizeof(union wtap_pseudo_header));
|
||||
|
|
|
|||
|
|
@ -1917,9 +1917,9 @@ wtap_get_savable_file_types_subtypes(int file_type_subtype,
|
|||
/* Put the default file type/subtype first in the list. */
|
||||
g_array_append_val(savable_file_types_subtypes, default_file_type_subtype);
|
||||
|
||||
/* If the default is pcap, put pcap-NG right after it if we can
|
||||
also write it in pcap-NG format; otherwise, if the default is
|
||||
pcap-NG, put pcap right after it if we can also write it in
|
||||
/* If the default is pcap, put pcapng right after it if we can
|
||||
also write it in pcapng format; otherwise, if the default is
|
||||
pcapng, put pcap right after it if we can also write it in
|
||||
pcap format. */
|
||||
if (default_file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_PCAP) {
|
||||
if (wtap_dump_can_write_format(WTAP_FILE_TYPE_SUBTYPE_PCAPNG, file_encaps,
|
||||
|
|
|
|||
|
|
@ -1114,8 +1114,8 @@ netmon_process_record(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
|
|||
/*
|
||||
* List of adapters on which the capture
|
||||
* was done.
|
||||
* XXX - This could be translated into PCAP-NG blocks
|
||||
* but for now, just treat as a frame
|
||||
* XXX - this could be translated into pcapng
|
||||
* blocks but for now, just treat as a frame.
|
||||
*/
|
||||
pkt_encap = WTAP_ENCAP_NETMON_NETWORK_INFO_EX;
|
||||
break;
|
||||
|
|
|
|||
|
|
@ -35,7 +35,7 @@
|
|||
* o Construct a list of interfaces, with interface names, give
|
||||
* them link-layer types based on the interface name and packet
|
||||
* data, and supply interface IDs with each packet (i.e., make
|
||||
* this supply a pcap-ng-style set of interfaces and associate
|
||||
* this supply a pcapng-style set of interfaces and associate
|
||||
* packets with interfaces). This is probably the right way
|
||||
* to "Pass the interface names and the traffic direction to either
|
||||
* the frame-structure, a pseudo-header or use PPI." See the
|
||||
|
|
@ -44,7 +44,7 @@
|
|||
* http://www.wireshark.org/lists/wireshark-dev/200708/msg00029.html
|
||||
*
|
||||
* to see whether any further discussion is still needed. I suspect
|
||||
* it doesn't; pcap-NG existed at the time, as per the final
|
||||
* it doesn't; pcapng existed at the time, as per the final
|
||||
* message in that thread:
|
||||
*
|
||||
* http://www.wireshark.org/lists/wireshark-dev/200708/msg00039.html
|
||||
|
|
@ -56,7 +56,7 @@
|
|||
* information as part of the packet metadata from Wiretap modules.
|
||||
* That should be fixed so that we can show interface information,
|
||||
* such as the interface name, in packet dissections from, for example,
|
||||
* pcap-NG captures.
|
||||
* pcapng captures.
|
||||
*/
|
||||
|
||||
static gboolean info_line(const gchar *line);
|
||||
|
|
|
|||
|
|
@ -805,7 +805,7 @@ create_temp_pcapng_file(wtap *wth, int *err, gchar **err_info, nettrace_3gpp_32_
|
|||
goto end;
|
||||
}
|
||||
|
||||
/* OK we've opend a new pcap-ng file and written the headers, time to do the packets, strt by finding the file size */
|
||||
/* OK we've opend a new pcapng file and written the headers, time to do the packets, strt by finding the file size */
|
||||
|
||||
if ((file_size = wtap_file_size(wth, err)) == -1) {
|
||||
result = WTAP_OPEN_ERROR;
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
/* pcap-common.c
|
||||
* Code common to libpcap and pcap-NG file formats
|
||||
* Code common to pcap and pcapng file formats
|
||||
*
|
||||
* Wiretap Library
|
||||
* Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
|
||||
*
|
||||
* File format support for pcap-ng file format
|
||||
* File format support for pcapng file format
|
||||
* Copyright (c) 2007 by Ulf Lamping <ulf.lamping@web.de>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
|
|
@ -492,7 +492,7 @@ static const struct {
|
|||
*
|
||||
* We put these *after* the entries for the LINKTYPE_ values for
|
||||
* those Wiretap encapsulation types, so that, when writing a
|
||||
* pcap or pcap-ng file, Wireshark writes the LINKTYPE_ value,
|
||||
* pcap or pcapng file, Wireshark writes the LINKTYPE_ value,
|
||||
* not the OS's DLT_ value, as the file's link-layer header type
|
||||
* for pcap or the interface's link-layer header type.
|
||||
*/
|
||||
|
|
@ -1729,7 +1729,7 @@ pcap_process_pseudo_header(FILE_T fh, int file_type, int wtap_encap,
|
|||
* at least in pcap files. For radiotap, that's indicated in
|
||||
* the radiotap header.
|
||||
*
|
||||
* XXX - in pcap-ng, there *could* be a packet option
|
||||
* XXX - in pcapng, there *could* be a packet option
|
||||
* indicating the FCS length.
|
||||
*/
|
||||
memset(&phdr->pseudo_header.ieee_802_11, 0, sizeof(phdr->pseudo_header.ieee_802_11));
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
/* pcap-common.h
|
||||
* Declarations for code common to libpcap and pcap-NG file formats
|
||||
* Declarations for code common to pcap and pcapng file formats
|
||||
*
|
||||
* Wiretap Library
|
||||
* Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
|
||||
*
|
||||
* File format support for pcap-ng file format
|
||||
* File format support for pcapng file format
|
||||
* Copyright (c) 2007 by Ulf Lamping <ulf.lamping@web.de>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
/* pcap-encap.h
|
||||
* Declarations for routines to handle libpcap/pcap-NG linktype values
|
||||
* Declarations for routines to handle pcap/pcapng linktype values
|
||||
*
|
||||
* Wiretap Library
|
||||
* Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
|
||||
*
|
||||
* File format support for pcap-ng file format
|
||||
* File format support for pcapng file format
|
||||
* Copyright (c) 2007 by Ulf Lamping <ulf.lamping@web.de>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
* Wiretap Library
|
||||
* Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
|
||||
*
|
||||
* File format support for pcap-ng file format
|
||||
* File format support for pcapng file format
|
||||
* Copyright (c) 2007 by Ulf Lamping <ulf.lamping@web.de>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
|
|
@ -485,7 +485,7 @@ pcapng_read_section_header_block(FILE_T fh, pcapng_block_header_t *bh,
|
|||
* This block is too short to be an SHB.
|
||||
*
|
||||
* If we're reading this as part of an open,
|
||||
* the file is too short to be a pcap-ng file.
|
||||
* the file is too short to be a pcapng file.
|
||||
*
|
||||
* If we're not, we treat PCAPNG_BLOCK_NOT_SHB and
|
||||
* PCAPNG_BLOCK_ERROR the same, so we can just return
|
||||
|
|
@ -543,7 +543,7 @@ pcapng_read_section_header_block(FILE_T fh, pcapng_block_header_t *bh,
|
|||
return PCAPNG_BLOCK_ERROR;
|
||||
}
|
||||
|
||||
/* OK, at this point we assume it's a pcap-ng file.
|
||||
/* OK, at this point we assume it's a pcapng file.
|
||||
|
||||
Don't try to allocate memory for a huge number of options, as
|
||||
that might fail and, even if it succeeds, it might not leave
|
||||
|
|
@ -551,8 +551,8 @@ pcapng_read_section_header_block(FILE_T fh, pcapng_block_header_t *bh,
|
|||
|
||||
We do that by imposing a maximum block size of MAX_BLOCK_SIZE.
|
||||
We check for this *after* checking the SHB for its byte
|
||||
order magic number, so that non-pcap-ng files are less
|
||||
likely to be treated as bad pcap-ng files. */
|
||||
order magic number, so that non-pcapng files are less
|
||||
likely to be treated as bad pcapng files. */
|
||||
if (bh->block_total_length > MAX_BLOCK_SIZE) {
|
||||
*err = WTAP_ERR_BAD_FILE;
|
||||
*err_info = g_strdup_printf("pcapng_read_section_header_block: total block length %u is too large (> %u)",
|
||||
|
|
@ -702,8 +702,8 @@ pcapng_read_if_descr_block(wtap *wth, FILE_T fh, pcapng_block_header_t *bh,
|
|||
|
||||
We do that by imposing a maximum block size of MAX_BLOCK_SIZE.
|
||||
We check for this *after* checking the SHB for its byte
|
||||
order magic number, so that non-pcap-ng files are less
|
||||
likely to be treated as bad pcap-ng files. */
|
||||
order magic number, so that non-pcapng files are less
|
||||
likely to be treated as bad pcapng files. */
|
||||
if (bh->block_total_length > MAX_BLOCK_SIZE) {
|
||||
*err = WTAP_ERR_BAD_FILE;
|
||||
*err_info = g_strdup_printf("pcapng_read_if_descr_block: total block length %u is too large (> %u)",
|
||||
|
|
@ -1036,8 +1036,8 @@ pcapng_read_packet_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, wta
|
|||
|
||||
We do that by imposing a maximum block size of MAX_BLOCK_SIZE.
|
||||
We check for this *after* checking the SHB for its byte
|
||||
order magic number, so that non-pcap-ng files are less
|
||||
likely to be treated as bad pcap-ng files. */
|
||||
order magic number, so that non-pcapng files are less
|
||||
likely to be treated as bad pcapng files. */
|
||||
if (bh->block_total_length > MAX_BLOCK_SIZE) {
|
||||
*err = WTAP_ERR_BAD_FILE;
|
||||
*err_info = g_strdup_printf("pcapng_read_packet_block: total block length %u is too large (> %u)",
|
||||
|
|
@ -1397,8 +1397,8 @@ pcapng_read_simple_packet_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *
|
|||
|
||||
We do that by imposing a maximum block size of MAX_BLOCK_SIZE.
|
||||
We check for this *after* checking the SHB for its byte
|
||||
order magic number, so that non-pcap-ng files are less
|
||||
likely to be treated as bad pcap-ng files. */
|
||||
order magic number, so that non-pcapng files are less
|
||||
likely to be treated as bad pcapng files. */
|
||||
if (bh->block_total_length > MAX_BLOCK_SIZE) {
|
||||
*err = WTAP_ERR_BAD_FILE;
|
||||
*err_info = g_strdup_printf("pcapng_read_simple_packet_block: total block length %u is too large (> %u)",
|
||||
|
|
@ -1428,7 +1428,7 @@ pcapng_read_simple_packet_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *
|
|||
/*
|
||||
* The captured length is not a field in the SPB; it can be
|
||||
* calculated as the minimum of the snapshot length from the
|
||||
* IDB and the packet length, as per the pcap-ng spec. An IDB
|
||||
* IDB and the packet length, as per the pcapng spec. An IDB
|
||||
* snapshot length of 0 means no limit.
|
||||
*/
|
||||
simple_packet.cap_len = simple_packet.packet_len;
|
||||
|
|
@ -1614,8 +1614,8 @@ pcapng_read_name_resolution_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t
|
|||
|
||||
We do that by imposing a maximum block size of MAX_BLOCK_SIZE.
|
||||
We check for this *after* checking the SHB for its byte
|
||||
order magic number, so that non-pcap-ng files are less
|
||||
likely to be treated as bad pcap-ng files. */
|
||||
order magic number, so that non-pcapng files are less
|
||||
likely to be treated as bad pcapng files. */
|
||||
if (bh->block_total_length > MAX_BLOCK_SIZE) {
|
||||
*err = WTAP_ERR_BAD_FILE;
|
||||
*err_info = g_strdup_printf("pcapng_read_name_resolution_block: total block length %u is too large (> %u)",
|
||||
|
|
@ -1682,7 +1682,7 @@ pcapng_read_name_resolution_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t
|
|||
* a 4-byte IPv4 address, hence a minimum
|
||||
* of 4 bytes.
|
||||
*
|
||||
* (The pcap-NG spec really indicates
|
||||
* (The pcapng spec really indicates
|
||||
* that it must be at least 5 bytes,
|
||||
* as there must be at least one name,
|
||||
* and it really must be at least 6
|
||||
|
|
@ -1744,7 +1744,7 @@ pcapng_read_name_resolution_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t
|
|||
* a 16-byte IPv6 address, hence a minimum
|
||||
* of 16 bytes.
|
||||
*
|
||||
* (The pcap-NG spec really indicates
|
||||
* (The pcapng spec really indicates
|
||||
* that it must be at least 17 bytes,
|
||||
* as there must be at least one name,
|
||||
* and it really must be at least 18
|
||||
|
|
@ -1922,8 +1922,8 @@ pcapng_read_interface_statistics_block(FILE_T fh, pcapng_block_header_t *bh, pca
|
|||
|
||||
We do that by imposing a maximum block size of MAX_BLOCK_SIZE.
|
||||
We check for this *after* checking the SHB for its byte
|
||||
order magic number, so that non-pcap-ng files are less
|
||||
likely to be treated as bad pcap-ng files. */
|
||||
order magic number, so that non-pcapng files are less
|
||||
likely to be treated as bad pcapng files. */
|
||||
if (bh->block_total_length > MAX_BLOCK_SIZE) {
|
||||
*err = WTAP_ERR_BAD_FILE;
|
||||
*err_info = g_strdup_printf("pcapng_read_interface_statistics_block: total block length %u is too large (> %u)",
|
||||
|
|
@ -2311,7 +2311,7 @@ pcapng_read_block(wtap *wth, FILE_T fh, pcapng_t *pn, wtapng_block_t *wblock, in
|
|||
* Short read or EOF.
|
||||
*
|
||||
* If we're reading this as part of an open,
|
||||
* the file is too short to be a pcap-ng file.
|
||||
* the file is too short to be a pcapng file.
|
||||
*
|
||||
* If we're not, we treat PCAPNG_BLOCK_NOT_SHB and
|
||||
* PCAPNG_BLOCK_ERROR the same, so we can just return
|
||||
|
|
@ -2325,7 +2325,7 @@ pcapng_read_block(wtap *wth, FILE_T fh, pcapng_t *pn, wtapng_block_t *wblock, in
|
|||
/*
|
||||
* SHBs have to be treated differently from other blocks, as we
|
||||
* might be doing an open and attempting to read a block at the
|
||||
* beginning of the file to see if it's a pcap-ng file or not,
|
||||
* beginning of the file to see if it's a pcapng file or not,
|
||||
* and as they do not necessarily have the same byte order as
|
||||
* previous blocks.
|
||||
*/
|
||||
|
|
@ -2356,7 +2356,7 @@ pcapng_read_block(wtap *wth, FILE_T fh, pcapng_t *pn, wtapng_block_t *wblock, in
|
|||
/*
|
||||
* No SHB seen yet, so we're trying to read the first block
|
||||
* during an open, to see whether it's an SHB; if what we
|
||||
* read doesn't look like an SHB, this isn't a pcap-ng file.
|
||||
* read doesn't look like an SHB, this isn't a pcapng file.
|
||||
*/
|
||||
*err = 0;
|
||||
*err_info = NULL;
|
||||
|
|
@ -2476,14 +2476,14 @@ pcapng_open(wtap *wth, int *err, gchar **err_info)
|
|||
break;
|
||||
|
||||
case PCAPNG_BLOCK_NOT_SHB:
|
||||
/* An error indicating that this isn't a pcap-ng file. */
|
||||
/* An error indicating that this isn't a pcapng file. */
|
||||
wtap_block_free(wblock.block);
|
||||
*err = 0;
|
||||
*err_info = NULL;
|
||||
return WTAP_OPEN_NOT_MINE;
|
||||
|
||||
case PCAPNG_BLOCK_ERROR:
|
||||
/* An I/O error, or this probably *is* a pcap-ng file but not a valid one. */
|
||||
/* An I/O error, or this probably *is* a pcapng file but not a valid one. */
|
||||
wtap_block_free(wblock.block);
|
||||
return WTAP_OPEN_ERROR;
|
||||
}
|
||||
|
|
@ -2502,7 +2502,7 @@ pcapng_open(wtap *wth, int *err, gchar **err_info)
|
|||
pn.shb_read = TRUE;
|
||||
|
||||
/*
|
||||
* At this point, we've decided this is a pcap-NG file, not
|
||||
* At this point, we've decided this is a pcapng file, not
|
||||
* some other type of file, so we can't return WTAP_OPEN_NOT_MINE
|
||||
* past this point.
|
||||
*/
|
||||
|
|
@ -3000,7 +3000,7 @@ pcapng_write_enhanced_packet_block(wtap_dumper *wdh,
|
|||
else {
|
||||
/*
|
||||
* XXX - we should support writing WTAP_ENCAP_PER_PACKET
|
||||
* data to pcap-NG files even if we *don't* have interface
|
||||
* data to pcapng files even if we *don't* have interface
|
||||
* IDs.
|
||||
*/
|
||||
epb.interface_id = 0;
|
||||
|
|
|
|||
|
|
@ -41,7 +41,7 @@
|
|||
*/
|
||||
|
||||
/*
|
||||
* Reader and writer routines for pcap-ng block types.
|
||||
* Reader and writer routines for pcapng block types.
|
||||
*/
|
||||
typedef gboolean (*block_reader)(FILE_T, guint32, gboolean, struct wtap_pkthdr *,
|
||||
Buffer *, int *, gchar **);
|
||||
|
|
@ -49,19 +49,19 @@ typedef gboolean (*block_writer)(wtap_dumper *, const struct wtap_pkthdr *,
|
|||
const guint8 *, int *);
|
||||
|
||||
/*
|
||||
* Register a handler for a pcap-ng block type.
|
||||
* Register a handler for a pcapng block type.
|
||||
*/
|
||||
WS_DLL_PUBLIC
|
||||
void register_pcapng_block_type_handler(guint block_type, block_reader read,
|
||||
block_writer write);
|
||||
|
||||
/*
|
||||
* Handler routine for pcap-ng option type.
|
||||
* Handler routine for pcapng option type.
|
||||
*/
|
||||
typedef gboolean (*option_handler_fn)(gboolean, guint, guint8 *, int *, gchar **);
|
||||
|
||||
/*
|
||||
* Register a handler for a pcap-ng option code for a particular block
|
||||
* Register a handler for a pcapng option code for a particular block
|
||||
* type.
|
||||
*/
|
||||
WS_DLL_PUBLIC
|
||||
|
|
|
|||
|
|
@ -347,7 +347,7 @@ visual_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
|
|||
Most Visual capture types include the FCS in the original length
|
||||
value, but don't include the FCS as part of the payload or captured
|
||||
length. This is different from the model used in most other capture
|
||||
file formats, including pcap and pcap-ng in cases where the FCS isn't
|
||||
file formats, including pcap and pcapng in cases where the FCS isn't
|
||||
captured (which are the typical cases), and causes the RTP audio
|
||||
payload save to fail since then captured len != orig len.
|
||||
|
||||
|
|
|
|||
|
|
@ -1223,7 +1223,7 @@ union wtap_pseudo_header {
|
|||
*
|
||||
* For file-type-specific records, the "ftsrec" field of the pseudo-header
|
||||
* contains a file-type-specific subtype value, such as a block type for
|
||||
* a pcap-ng file.
|
||||
* a pcapng file.
|
||||
*
|
||||
* An "event" is an indication that something happened during the capture
|
||||
* process, such as a status transition of some sort on the network.
|
||||
|
|
@ -1234,7 +1234,7 @@ union wtap_pseudo_header {
|
|||
* packets are.
|
||||
*
|
||||
* A "report" supplies information not corresponding to an event;
|
||||
* for example, a pcap-ng Interface Statistics Block would be a report,
|
||||
* for example, a pcapng Interface Statistics Block would be a report,
|
||||
* as it doesn't correspond to something happening on the network.
|
||||
* They may have a time stamp, and should be dissected and displayed
|
||||
* just as packets are.
|
||||
|
|
@ -1352,7 +1352,7 @@ typedef struct wtapng_if_descr_filter_s {
|
|||
} wtapng_if_descr_filter_t;
|
||||
|
||||
/**
|
||||
* Holds the required data for pcap-ng Interface Statistics Block (ISB).
|
||||
* Holds the required data for pcapng Interface Statistics Block (ISB).
|
||||
*/
|
||||
typedef struct wtapng_if_stats_mandatory_s {
|
||||
guint32 interface_id;
|
||||
|
|
@ -1476,7 +1476,7 @@ typedef wtap_open_return_val (*wtap_open_routine_t)(struct wtap*, int *,
|
|||
/*
|
||||
* Some file formats have defined magic numbers at fixed offsets from
|
||||
* the beginning of the file; those routines should return 1 if and
|
||||
* only if the file has the magic number at that offset. (pcap-ng
|
||||
* only if the file has the magic number at that offset. (pcapng
|
||||
* is a bit of a special case, as it has both the Section Header Block
|
||||
* type field and its byte-order magic field; it checks for both.)
|
||||
* Those file formats do not require a file name extension in order
|
||||
|
|
|
|||
|
|
@ -240,7 +240,7 @@ libpcap_write_packet(FILE* pfile,
|
|||
return write_to_file(pfile, pd, caplen, bytes_written, err);
|
||||
}
|
||||
|
||||
/* Writing pcap-ng files */
|
||||
/* Writing pcapng files */
|
||||
|
||||
static guint32
|
||||
pcapng_count_string_option(const char *option_value)
|
||||
|
|
|
|||
|
|
@ -41,7 +41,7 @@ libpcap_write_packet(FILE* pfile,
|
|||
const guint8 *pd,
|
||||
guint64 *bytes_written, int *err);
|
||||
|
||||
/* Writing pcap-ng files */
|
||||
/* Writing pcapng files */
|
||||
|
||||
/* Write a pre-formatted pcapng block */
|
||||
extern gboolean
|
||||
|
|
|
|||
Loading…
Reference in New Issue