osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

Add a presence flag field to the packet information structure filled in 

by Wiretap, to indicate whether certain fields in that structure
actually have data in them.

Use the "time stamp present" flag to omit showing time stamp information
for packets (and "packets") that don't have time stamps; don't bother
working very hard to "fake" a time stamp for data files.

Use the "interface ID present" flag to omit the interface ID for packets
that don't have an interface ID.

We don't use the "captured length, separate from packet length, present"
flag to omit the captured length; that flag might be present but equal
to the packet length, and if you want to know if a packet was cut short
by a snapshot length, comparing the values would be the way to do that.

More work is needed to have wiretap/pcapng.c properly report the flags,
e.g. reporting no time stamp being present for a Simple Packet Block.

svn path=/trunk/; revision=41185
daniel/osmux
Guy Harris 2012-02-25 23:24:34 +00:00
parent e994e78412
commit b6ff142f60
48 changed files with 249 additions and 106 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

120
epan/column-utils.c
View File

@ -626,11 +626,14 @@ set_abs_date_time(const frame_data *fd, gchar *buf, gboolean local)
struct tm *tmp;
time_t then;
then = fd->abs_ts.secs;
if (local)
tmp = localtime(&then);
else
tmp = gmtime(&then);
if (fd->flags.has_ts) {
then = fd->abs_ts.secs;
if (local)
tmp = localtime(&then);
else
tmp = gmtime(&then);
} else
tmp = NULL;
if (tmp != NULL) {
switch(timestamp_get_precision()) {
case TS_PREC_FIXED_SEC:
@ -919,6 +922,10 @@ set_time_hour_min_sec(const nstime_t *ts, gchar *buf)
static void
col_set_rel_time(const frame_data *fd, column_info *cinfo, const int col)
{
if (!fd->flags.has_ts) {
cinfo->col_buf[col][0] = '\0';
return;
}
switch (timestamp_get_seconds_type()) {
case TS_SECONDS_DEFAULT:
set_time_seconds(&fd->rel_ts, cinfo->col_buf[col]);
@ -960,6 +967,10 @@ col_set_delta_time(const frame_data *fd, column_info *cinfo, const int col)
static void
col_set_delta_time_dis(const frame_data *fd, column_info *cinfo, const int col)
{
if (!fd->flags.has_ts) {
cinfo->col_buf[col][0] = '\0';
return;
}
switch (timestamp_get_seconds_type()) {
case TS_SECONDS_DEFAULT:
set_time_seconds(&fd->del_dis_ts, cinfo->col_buf[col]);
@ -984,11 +995,14 @@ set_abs_time(const frame_data *fd, gchar *buf, gboolean local)
struct tm *tmp;
time_t then;
then = fd->abs_ts.secs;
if (local)
tmp = localtime(&then);
else
tmp = gmtime(&then);
if (fd->flags.has_ts) {
then = fd->abs_ts.secs;
if (local)
tmp = localtime(&then);
else
tmp = gmtime(&then);
} else
tmp = NULL;
if (tmp != NULL) {
switch(timestamp_get_precision()) {
case TS_PREC_FIXED_SEC:
@ -1067,9 +1081,13 @@ col_set_utc_time(const frame_data *fd, column_info *cinfo, const int col)
cinfo->col_data[col] = cinfo->col_buf[col];
}
static gint
static gboolean
set_epoch_time(const frame_data *fd, gchar *buf)
{
if (!fd->flags.has_ts) {
buf[0] = '\0';
return FALSE;
}
switch(timestamp_get_precision()) {
case TS_PREC_FIXED_SEC:
case TS_PREC_AUTO_SEC:
@ -1104,7 +1122,7 @@ set_epoch_time(const frame_data *fd, gchar *buf)
default:
g_assert_not_reached();
}
return 1;
return TRUE;
}
static void
@ -1131,42 +1149,54 @@ set_fd_time(frame_data *fd, gchar *buf)
break;
case TS_RELATIVE:
switch (timestamp_get_seconds_type()) {
case TS_SECONDS_DEFAULT:
set_time_seconds(&fd->rel_ts, buf);
break;
case TS_SECONDS_HOUR_MIN_SEC:
set_time_seconds(&fd->rel_ts, buf);
break;
default:
g_assert_not_reached();
}
if (fd->flags.has_ts) {
switch (timestamp_get_seconds_type()) {
case TS_SECONDS_DEFAULT:
set_time_seconds(&fd->rel_ts, buf);
break;
case TS_SECONDS_HOUR_MIN_SEC:
set_time_seconds(&fd->rel_ts, buf);
break;
default:
g_assert_not_reached();
}
} else {
buf[0] = '\0';
}
break;
case TS_DELTA:
switch (timestamp_get_seconds_type()) {
case TS_SECONDS_DEFAULT:
set_time_seconds(&fd->del_cap_ts, buf);
break;
case TS_SECONDS_HOUR_MIN_SEC:
set_time_hour_min_sec(&fd->del_cap_ts, buf);
break;
default:
g_assert_not_reached();
}
if (fd->flags.has_ts) {
switch (timestamp_get_seconds_type()) {
case TS_SECONDS_DEFAULT:
set_time_seconds(&fd->del_cap_ts, buf);
break;
case TS_SECONDS_HOUR_MIN_SEC:
set_time_hour_min_sec(&fd->del_cap_ts, buf);
break;
default:
g_assert_not_reached();
}
} else {
buf[0] = '\0';
}
break;
case TS_DELTA_DIS:
switch (timestamp_get_seconds_type()) {
case TS_SECONDS_DEFAULT:
set_time_seconds(&fd->del_dis_ts, buf);
break;
case TS_SECONDS_HOUR_MIN_SEC:
set_time_hour_min_sec(&fd->del_dis_ts, buf);
break;
default:
g_assert_not_reached();
}
if (fd->flags.has_ts) {
switch (timestamp_get_seconds_type()) {
case TS_SECONDS_DEFAULT:
set_time_seconds(&fd->del_dis_ts, buf);
break;
case TS_SECONDS_HOUR_MIN_SEC:
set_time_hour_min_sec(&fd->del_dis_ts, buf);
break;
default:
g_assert_not_reached();
}
} else {
buf[0] = '\0';
}
break;
case TS_EPOCH:
@ -1182,9 +1212,9 @@ set_fd_time(frame_data *fd, gchar *buf)
break;
case TS_NOT_SET:
/* code is missing for this case, but I don't know which [jmayer20051219] */
g_assert(FALSE);
break;
/* code is missing for this case, but I don't know which [jmayer20051219] */
g_assert(FALSE);
break;
}
}

89
epan/dissectors/packet-frame.c
View File

@ -195,9 +195,11 @@ dissect_frame(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
generating any tree items. */
if(!proto_field_is_referenced(tree, proto_frame)) {
tree=NULL;
if(pinfo->fd->abs_ts.nsecs < 0 || pinfo->fd->abs_ts.nsecs >= 1000000000)
expert_add_info_format(pinfo, NULL, PI_MALFORMED, PI_WARN,
"Arrival Time: Fractional second out of range (0-1000000000)");
if(pinfo->fd->flags.has_ts) {
if(pinfo->fd->abs_ts.nsecs < 0 || pinfo->fd->abs_ts.nsecs >= 1000000000)
expert_add_info_format(pinfo, NULL, PI_MALFORMED, PI_WARN,
"Arrival Time: Fractional second out of range (0-1000000000)");
}
} else {
proto_tree *fh_tree;
gboolean old_visible;
@ -209,52 +211,61 @@ dissect_frame(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
cap_plurality = plurality(cap_len, "", "s");
frame_plurality = plurality(frame_len, "", "s");
ti = proto_tree_add_protocol_format(tree, proto_frame, tvb, 0, -1,
"Frame %u: %u byte%s on wire",
pinfo->fd->num, frame_len, frame_plurality);
if (generate_bits_field)
ti = proto_tree_add_protocol_format(tree, proto_frame, tvb, 0, -1,
"Frame %u: %u byte%s on wire (%u bits), %u byte%s captured (%u bits) on interface %u",
pinfo->fd->num, frame_len, frame_plurality, frame_len * 8,
cap_len, cap_plurality, cap_len * 8, pinfo->fd->interface_id);
else
ti = proto_tree_add_protocol_format(tree, proto_frame, tvb, 0, -1,
"Frame %u: %u byte%s on wire, %u byte%s captured, on interface %u", pinfo->fd->num,
frame_len, frame_plurality, cap_len, cap_plurality, pinfo->fd->interface_id);
proto_item_append_text(ti, " (%u bits)", frame_len * 8);
proto_item_append_text(ti, ", %u byte%s captured",
cap_len, cap_plurality);
if (generate_bits_field) {
proto_item_append_text(ti, " (%u bits)",
cap_len * 8);
}
if (pinfo->fd->flags.has_if_id) {
proto_item_append_text(ti, " on interface %u",
pinfo->fd->interface_id);
}
fh_tree = proto_item_add_subtree(ti, ett_frame);
proto_tree_add_uint(fh_tree, hf_frame_interface_id, tvb, 0, 0, pinfo->fd->interface_id);
if (pinfo->fd->flags.has_if_id)
proto_tree_add_uint(fh_tree, hf_frame_interface_id, tvb, 0, 0, pinfo->fd->interface_id);
proto_tree_add_time(fh_tree, hf_frame_arrival_time, tvb,
0, 0, &(pinfo->fd->abs_ts));
if(pinfo->fd->abs_ts.nsecs < 0 || pinfo->fd->abs_ts.nsecs >= 1000000000) {
item = proto_tree_add_none_format(fh_tree, hf_frame_time_invalid, tvb,
0, 0, "Arrival Time: Fractional second %09ld is invalid, the valid range is 0-1000000000", (long) pinfo->fd->abs_ts.nsecs);
PROTO_ITEM_SET_GENERATED(item);
expert_add_info_format(pinfo, item, PI_MALFORMED, PI_WARN, "Arrival Time: Fractional second out of range (0-1000000000)");
}
item = proto_tree_add_time(fh_tree, hf_frame_shift_offset, tvb,
0, 0, &(pinfo->fd->shift_offset));
PROTO_ITEM_SET_GENERATED(item);
if(generate_epoch_time) {
proto_tree_add_time(fh_tree, hf_frame_arrival_time_epoch, tvb,
if (pinfo->fd->flags.has_ts) {
proto_tree_add_time(fh_tree, hf_frame_arrival_time, tvb,
0, 0, &(pinfo->fd->abs_ts));
}
if(pinfo->fd->abs_ts.nsecs < 0 || pinfo->fd->abs_ts.nsecs >= 1000000000) {
item = proto_tree_add_none_format(fh_tree, hf_frame_time_invalid, tvb,
0, 0, "Arrival Time: Fractional second %09ld is invalid, the valid range is 0-1000000000", (long) pinfo->fd->abs_ts.nsecs);
PROTO_ITEM_SET_GENERATED(item);
expert_add_info_format(pinfo, item, PI_MALFORMED, PI_WARN, "Arrival Time: Fractional second out of range (0-1000000000)");
}
item = proto_tree_add_time(fh_tree, hf_frame_shift_offset, tvb,
0, 0, &(pinfo->fd->shift_offset));
PROTO_ITEM_SET_GENERATED(item);
item = proto_tree_add_time(fh_tree, hf_frame_time_delta, tvb,
0, 0, &(pinfo->fd->del_cap_ts));
PROTO_ITEM_SET_GENERATED(item);
if(generate_epoch_time) {
proto_tree_add_time(fh_tree, hf_frame_arrival_time_epoch, tvb,
0, 0, &(pinfo->fd->abs_ts));
}
item = proto_tree_add_time(fh_tree, hf_frame_time_delta_displayed, tvb,
0, 0, &(pinfo->fd->del_dis_ts));
PROTO_ITEM_SET_GENERATED(item);
item = proto_tree_add_time(fh_tree, hf_frame_time_delta, tvb,
0, 0, &(pinfo->fd->del_cap_ts));
PROTO_ITEM_SET_GENERATED(item);
item = proto_tree_add_time(fh_tree, hf_frame_time_relative, tvb,
0, 0, &(pinfo->fd->rel_ts));
PROTO_ITEM_SET_GENERATED(item);
item = proto_tree_add_time(fh_tree, hf_frame_time_delta_displayed, tvb,
0, 0, &(pinfo->fd->del_dis_ts));
PROTO_ITEM_SET_GENERATED(item);
if(pinfo->fd->flags.ref_time){
ti = proto_tree_add_item(fh_tree, hf_frame_time_reference, tvb, 0, 0, ENC_NA);
PROTO_ITEM_SET_GENERATED(ti);
item = proto_tree_add_time(fh_tree, hf_frame_time_relative, tvb,
0, 0, &(pinfo->fd->rel_ts));
PROTO_ITEM_SET_GENERATED(item);
if(pinfo->fd->flags.ref_time){
ti = proto_tree_add_item(fh_tree, hf_frame_time_reference, tvb, 0, 0, ENC_NA);
PROTO_ITEM_SET_GENERATED(ti);
}
}
proto_tree_add_uint(fh_tree, hf_frame_number, tvb,

2
epan/frame_data.c
View File

@ -212,6 +212,8 @@ frame_data_init(frame_data *fdata, guint32 num,
fdata->flags.marked = 0;
fdata->flags.ref_time = 0;
fdata->flags.ignored = 0;
fdata->flags.has_ts = (phdr->presence_flags & WTAP_HAS_TS) ? 1 : 0;
fdata->flags.has_if_id = (phdr->presence_flags & WTAP_HAS_INTERFACE_ID) ? 1 : 0;
fdata->color_filter = NULL;
fdata->opt_comment = phdr->opt_comment;
}

2
epan/frame_data.h
View File

@ -56,6 +56,8 @@ typedef struct _frame_data {
unsigned int marked : 1; /**< 1 = marked by user, 0 = normal */
unsigned int ref_time : 1; /**< 1 = marked as a reference time frame, 0 = normal */
unsigned int ignored : 1; /**< 1 = ignore this frame, 0 = normal */
unsigned int has_ts : 1; /**< 1 = has time stamp, 0 = no time stamp */
unsigned int has_if_id : 1; /**< 1 = has interface ID, 0 = no interface ID */
} flags;
const void *color_filter; /**< Per-packet matching color_filter_t object */

1
wiretap/5views.c
View File

@ -262,6 +262,7 @@ _5views_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
TimeStamped_Header.Utc = pletohl(&TimeStamped_Header.Utc);
TimeStamped_Header.NanoSecondes =
pletohl(&TimeStamped_Header.NanoSecondes);
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
wth->phdr.ts.secs = TimeStamped_Header.Utc;
wth->phdr.ts.nsecs = TimeStamped_Header.NanoSecondes;
wth->phdr.caplen = packet_size;

1
wiretap/aethra.c
View File

@ -298,6 +298,7 @@ packet, hdr.rec_type, packet_size, hdr.flags);
found:
msecs = pletohl(hdr.timestamp);
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.ts.secs = aethra->start + (msecs / 1000);
wth->phdr.ts.nsecs = (msecs % 1000) * 1000000;
wth->phdr.caplen = packet_size;

2
wiretap/airopeek9.c
View File

@ -517,6 +517,8 @@ static gboolean airopeekv9_read(wtap *wth, int *err, gchar **err_info,
return FALSE;
}
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* fill in packet header length values before slicelength may be
adjusted */
wth->phdr.len = hdr_info.length;

1
wiretap/ascendtext.c
View File

@ -317,6 +317,7 @@ static gboolean ascend_read(wtap *wth, int *err, gchar **err_info,
if (ascend->inittime > header.secs)
ascend->inittime -= header.secs;
}
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
wth->phdr.ts.secs = header.secs + ascend->inittime;
wth->phdr.ts.nsecs = header.usecs * 1000;
wth->phdr.caplen = header.caplen;

8
wiretap/ber.c
View File

@ -47,7 +47,6 @@ static gboolean ber_read(wtap *wth, int *err, gchar **err_info, gint64 *data_off
guint8 *buf;
gint64 file_size;
int packet_size;
ws_statb64 statb;
*err = 0;
@ -79,13 +78,12 @@ static gboolean ber_read(wtap *wth, int *err, gchar **err_info, gint64 *data_off
wth->data_offset += packet_size;
wth->phdr.presence_flags = 0; /* yes, we have no bananas^Wtime stamp */
wth->phdr.caplen = packet_size;
wth->phdr.len = packet_size;
if (wtap_fstat(wth, &statb, err) == -1)
return FALSE;
wth->phdr.ts.secs = statb.st_mtime;
wth->phdr.ts.secs = 0;
wth->phdr.ts.nsecs = 0;
return TRUE;

1
wiretap/btsnoop.c
View File

@ -206,6 +206,7 @@ static gboolean btsnoop_read(wtap *wth, int *err, gchar **err_info,
ts = GINT64_FROM_BE(hdr.ts_usec);
ts -= KUnixTimeBase;
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
wth->phdr.ts.secs = (guint)(ts / 1000000);
wth->phdr.ts.nsecs = (guint)((ts % 1000000) * 1000);
wth->phdr.caplen = packet_size;

2
wiretap/catapult_dct2000.c
View File

@ -334,6 +334,8 @@ catapult_dct2000_read(wtap *wth, int *err, gchar **err_info _U_,
g_snprintf(timestamp_string, MAX_TIMESTAMP_LEN, "%d.%04d", seconds, useconds/100);
wth->phdr.presence_flags = WTAP_HAS_TS;
/* All packets go to Catapult DCT2000 stub dissector */
wth->phdr.pkt_encap = WTAP_ENCAP_CATAPULT_DCT2000;

2
wiretap/commview.c
View File

@ -212,6 +212,8 @@ commview_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
wth->data_offset += cv_hdr.data_len;
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.len = cv_hdr.data_len;
wth->phdr.caplen = cv_hdr.data_len;

1
wiretap/cosine.c
View File

@ -335,6 +335,7 @@ static gboolean cosine_read(wtap *wth, int *err, gchar **err_info,
return FALSE;
wth->data_offset = offset;
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
wth->phdr.caplen = caplen;
*data_offset = offset;
return TRUE;

1
wiretap/csids.c
View File

@ -187,6 +187,7 @@ static gboolean csids_read(wtap *wth, int *err, gchar **err_info,
wth->data_offset += hdr.caplen;
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.len = hdr.caplen;
wth->phdr.caplen = hdr.caplen;
wth->phdr.ts.secs = hdr.seconds;

2
wiretap/daintree-sna.c
View File

@ -152,6 +152,8 @@ daintree_sna_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
wth->data_offset += strlen(readLine);
} while (readLine[0] == COMMENT_LINE);
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* parse one line of capture data */
if (sscanf(readLine, "%*s %18" G_GINT64_MODIFIER "u.%9d %9u %" READDATA_MAX_FIELD_SIZE "s",
&seconds, &wth->phdr.ts.nsecs, &wth->phdr.len, readData) != 4) {

2
wiretap/dbs-etherwatch.c
View File

@ -477,6 +477,8 @@ parse_dbs_etherwatch_packet(wtap *wth, FILE_T fh, guint8* buf, int *err,
}
if (wth) {
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
p = strstr(months, mon);
if (p)
tm.tm_mon = (int)(p - months) / 3;

1
wiretap/dct3trace.c
View File

@ -352,6 +352,7 @@ static gboolean dct3trace_read(wtap *wth, int *err, gchar **err_info,
}
/* We've got a full packet! */
wth->phdr.presence_flags = 0; /* no time stamp, no separate "on the wire" length */
wth->phdr.ts.secs = 0;
wth->phdr.ts.nsecs = 0;
wth->phdr.caplen = buf_len;

1
wiretap/erf.c
View File

@ -377,6 +377,7 @@ static int erf_read_header(FILE_T fh,
if (phdr != NULL) {
guint64 ts = pletohll(&erf_header->ts);
phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
phdr->ts.secs = (long) (ts >> 32);
ts = ((ts & 0xffffffff) * 1000 * 1000 * 1000);
ts += (ts & 0x80000000) << 1; /* rounding */

2
wiretap/etherpeek.c
View File

@ -402,6 +402,8 @@ static gboolean etherpeek_read_v7(wtap *wth, int *err, gchar **err_info,
sliceLength = length;
}
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* fill in packet header length values before slicelength may be
adjusted */
wth->phdr.len = length;

1
wiretap/eyesdn.c
View File

@ -367,6 +367,7 @@ parse_eyesdn_rec_hdr(wtap *wth, FILE_T fh,
}
if (wth) {
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.ts.secs = secs;
wth->phdr.ts.nsecs = usecs * 1000;
wth->phdr.caplen = pkt_len;

1
wiretap/hcidump.c
View File

@ -80,6 +80,7 @@ static gboolean hcidump_read(wtap *wth, int *err, gchar **err_info,
}
wth->data_offset += packet_size;
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.ts.secs = GUINT32_FROM_LE(dh.ts_sec);
wth->phdr.ts.nsecs = GUINT32_FROM_LE(dh.ts_usec) * 1000;
wth->phdr.caplen = packet_size;

2
wiretap/i4btrace.c
View File

@ -156,6 +156,8 @@ static gboolean i4btrace_read(wtap *wth, int *err, gchar **err_info,
return FALSE;
}
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.len = length;
wth->phdr.caplen = length;

1
wiretap/ipfix.c
View File

@ -275,6 +275,7 @@ ipfix_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
wtap_file_read_expected_bytes(buffer_start_ptr(wth->frame_buffer),
msg_hdr.message_length, wth->fh, err, err_info);
wth->phdr.presence_flags = 0;
wth->phdr.len = msg_hdr.message_length;
wth->phdr.caplen = msg_hdr.message_length;
wth->phdr.ts.secs = 0;

2
wiretap/iptrace.c
View File

@ -212,6 +212,7 @@ static gboolean iptrace_read_1_0(wtap *wth, int *err, gchar **err_info,
return FALSE; /* Read error */
wth->data_offset += packet_size;
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.len = packet_size;
wth->phdr.caplen = packet_size;
wth->phdr.ts.secs = pntohl(&header[4]);
@ -426,6 +427,7 @@ static gboolean iptrace_read_2_0(wtap *wth, int *err, gchar **err_info,
return FALSE; /* Read error */
wth->data_offset += packet_size;
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.len = packet_size;
wth->phdr.caplen = packet_size;
wth->phdr.ts.secs = pntohl(&header[32]);

9
wiretap/iseries.c
View File

@ -616,6 +616,8 @@ iseries_parse_packet (wtap * wth, FILE_T fh,
return -1;
}
wth->phdr.presence_flags = WTAP_HAS_CAP_LEN;
/*
* If we have Wiretap Header then populate it here
*
@ -625,6 +627,7 @@ iseries_parse_packet (wtap * wth, FILE_T fh,
*/
if (iseries->have_date)
{
wth->phdr.presence_flags |= WTAP_HAS_TS;
tm.tm_year = 100 + iseries->year;
tm.tm_mon = iseries->month - 1;
tm.tm_mday = iseries->day;
@ -645,9 +648,9 @@ iseries_parse_packet (wtap * wth, FILE_T fh,
}
}
wth->phdr.caplen = cap_len;
wth->phdr.pkt_encap = WTAP_ENCAP_ETHERNET;
pseudo_header->eth.fcs_len = -1;
wth->phdr.caplen = cap_len;
wth->phdr.pkt_encap = WTAP_ENCAP_ETHERNET;
pseudo_header->eth.fcs_len = -1;
/*
* Start Reading packet contents

2
wiretap/k12.c
View File

@ -450,6 +450,8 @@ static gboolean k12_read(wtap *wth, int *err, gchar **err_info, gint64 *data_off
wth->data_offset = offset;
wth->phdr.presence_flags = WTAP_HAS_TS;
ts = pntohll(buffer + K12_PACKET_TIMESTAMP);
wth->phdr.ts.secs = (guint32) ((ts / 2000000) + 631152000);

2
wiretap/k12text.l
View File

@ -250,6 +250,8 @@ k12text_read(wtap *wth, int *err, char ** err_info, gint64 *data_offset)
*data_offset = wth->data_offset; /* file position for beginning of this frame */
wth->data_offset += file_bytes_read; /* file position after end of this frame */
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
wth->phdr.ts.secs = 946681200 + (3600*g_h) + (60*g_m) + g_s;
wth->phdr.ts.nsecs = 1000000*g_ms + 1000*g_ns;

2
wiretap/lanalyzer.c
View File

@ -522,6 +522,8 @@ static gboolean lanalyzer_read(wtap *wth, int *err, gchar **err_info,
return FALSE;
}
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
time_low = pletohs(&descriptor[8]);
time_med = pletohs(&descriptor[10]);
time_high = pletohs(&descriptor[12]);

2
wiretap/libpcap.c
View File

@ -661,6 +661,8 @@ static gboolean libpcap_read(wtap *wth, int *err, gchar **err_info,
return FALSE; /* Read error */
wth->data_offset += packet_size;
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* Update the Timestamp, if not already done */
if (wth->file_encap != WTAP_ENCAP_ERF) {
wth->phdr.ts.secs = hdr.hdr.ts_sec;

4
wiretap/mime_file.c
View File

@ -93,7 +93,9 @@ mime_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
return FALSE;
}
wth->phdr.ts.secs = (time_t) wth->data_offset;
wth->phdr.presence_flags = 0;
wth->phdr.ts.secs = 0;
wth->phdr.ts.nsecs = 0;
*data_offset = wth->data_offset;

3
wiretap/mpeg.c
View File

@ -232,6 +232,7 @@ mpeg_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
packet_size, err, err_info))
return FALSE;
wth->data_offset += packet_size;
wth->phdr.presence_flags = WTAP_HAS_TS; /* XXX - relative, not absolute! */
wth->phdr.ts = ts;
wth->phdr.caplen = packet_size;
wth->phdr.len = packet_size;
@ -297,7 +298,7 @@ good_magic:
mpeg = (mpeg_t *)g_malloc(sizeof(mpeg_t));
wth->priv = (void *)mpeg;
mpeg->now.secs = time(NULL);
mpeg->now.secs = 0;
mpeg->now.nsecs = 0;
mpeg->t0 = mpeg->now.secs;

1
wiretap/netmon.c
View File

@ -677,6 +677,7 @@ again:
}
secs += (time_t)(t/1000000000);
nsecs = (guint32)(t%1000000000);
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
wth->phdr.ts.secs = netmon->start_secs + secs;
wth->phdr.ts.nsecs = nsecs;
wth->phdr.caplen = packet_size;

7
wiretap/netscaler.c
View File

@ -700,6 +700,8 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of
case NSPR_PDPKTRACEFULLTXB_V10:
case NSPR_PDPKTRACEFULLRX_V10:
wth->phdr.presence_flags = WTAP_HAS_TS;
nsg_creltime += ns_hrtime2nsec(pletohl(&fp->fp_RelTimeHr));
wth->phdr.ts.secs = nstrace->nspm_curtime + (guint32) (nsg_creltime / 1000000000);
wth->phdr.ts.nsecs = (guint32) (nsg_creltime % 1000000000);
@ -724,6 +726,8 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of
case NSPR_PDPKTRACEPARTTXB_V10:
case NSPR_PDPKTRACEPARTRX_V10:
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
nsg_creltime += ns_hrtime2nsec(pletohl(&pp->pp_RelTimeHr));
wth->phdr.ts.secs = nstrace->nspm_curtime + (guint32) (nsg_creltime / 1000000000);
wth->phdr.ts.nsecs = (guint32) (nsg_creltime % 1000000000);
@ -777,6 +781,7 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of
#define TIMEDEFV20(fp,type) \
do {\
wth->phdr.presence_flags |= WTAP_HAS_TS;\
nsg_creltime += ns_hrtime2nsec(pletohl(fp->type##_RelTimeHr));\
wth->phdr.ts.secs = nstrace->nspm_curtime + (guint32) (nsg_creltime / 1000000000);\
wth->phdr.ts.nsecs = (guint32) (nsg_creltime % 1000000000);\
@ -784,6 +789,7 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of
#define TIMEDEFV23(fp,type) \
do {\
wth->phdr.presence_flags |= WTAP_HAS_TS;\
/* access _AbsTimeHr as a 64bit value */\
nsg_creltime = pletohll(fp->type##_AbsTimeHr);\
wth->phdr.ts.secs = (guint32) (nsg_creltime / 1000000000);\
@ -795,6 +801,7 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of
#define PPSIZEDEFV20(pp,ver) \
do {\
wth->phdr.presence_flags |= WTAP_HAS_CAP_LEN;\
wth->phdr.len = pletohs(&pp->pp_PktSizeOrg) + nspr_pktracepart_v##ver##_s;\
wth->phdr.caplen = nspr_getv20recordsize((nspr_hd_v20_t *)pp);\
}while(0)

2
wiretap/netscreen.c
View File

@ -233,6 +233,8 @@ static gboolean netscreen_read(wtap *wth, int *err, gchar **err_info,
if (offset < 0)
return FALSE;
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* Parse the header */
pkt_len = parse_netscreen_rec_hdr(wth, line, cap_int, &cap_dir, cap_dst,
&wth->pseudo_header, err, err_info);

1
wiretap/nettl.c
View File

@ -640,6 +640,7 @@ nettl_read_rec_header(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
length, padlen);
return -1;
}
phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
phdr->len = length - padlen;
if (caplen < padlen) {
*err = WTAP_ERR_BAD_FILE;

1
wiretap/network_instruments.c
View File

@ -303,6 +303,7 @@ static gboolean observer_read(wtap *wth, int *err, gchar **err_info,
}
/* set the wiretap packet header fields */
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
wth->phdr.pkt_encap = observer_to_wtap_encap(packet_header.network_type);
if(wth->file_encap == WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS) {
wth->phdr.len = packet_header.network_size;

2
wiretap/netxray.c
View File

@ -1008,6 +1008,7 @@ reread:
&wth->pseudo_header, &hdr);
if (netxray->version_major == 0) {
wth->phdr.presence_flags = WTAP_HAS_TS;
t = (double)pletohl(&hdr.old_hdr.timelo)
+ (double)pletohl(&hdr.old_hdr.timehi)*4294967296.0;
t /= netxray->ticks_per_sec;
@ -1022,6 +1023,7 @@ reread:
wth->phdr.caplen = packet_size - padding;
wth->phdr.len = wth->phdr.caplen;
} else {
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
t = (double)pletohl(&hdr.hdr_1_x.timelo)
+ (double)pletohl(&hdr.hdr_1_x.timehi)*4294967296.0;
t /= netxray->ticks_per_sec;

1
wiretap/ngsniffer.c
View File

@ -1198,6 +1198,7 @@ found:
return FALSE;
}
wth->phdr.presence_flags = true_size ? WTAP_HAS_TS|WTAP_HAS_CAP_LEN : WTAP_HAS_TS;
wth->phdr.len = true_size ? true_size : size;
wth->phdr.caplen = size;

2
wiretap/packetlogger.c
View File

@ -131,6 +131,8 @@ packetlogger_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
wth->data_offset += (pl_hdr.len + 4);
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.len = pl_hdr.len - 8;
wth->phdr.caplen = pl_hdr.len - 8;

8
wiretap/pcapng.c
View File

@ -2027,6 +2027,14 @@ pcapng_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
id = (gint)wblock.data.packet.interface_id;
int_data = g_array_index(pcapng->interface_data, interface_data_t, id);
time_units_per_second = int_data.time_units_per_second;
/* XXX - not WTAP_HAS_TS for an SPB */
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN|WTAP_HAS_INTERFACE_ID;
if (wblock.data.packet.opt_comment != NULL)
wth->phdr.presence_flags |= WTAP_HAS_COMMENTS;
/* XXX - only if the option is present, for an EPB */
wth->phdr.presence_flags |= WTAP_HAS_DROP_COUNT;
/* XXX - only if the option is present */
wth->phdr.presence_flags |= WTAP_HAS_PACK_FLAGS;
wth->phdr.pkt_encap = int_data.wtap_encap;
wth->phdr.ts.secs = (time_t)(ts / time_units_per_second);
wth->phdr.ts.nsecs = (int)(((ts % time_units_per_second) * 1000000000) / time_units_per_second);

1
wiretap/pppdump.c
View File

@ -356,6 +356,7 @@ pppdump_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
*data_offset = state->pkt_cnt;
state->pkt_cnt++;
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.len = num_bytes;
wth->phdr.caplen = num_bytes;
wth->phdr.ts.secs = state->timestamp;

2
wiretap/radcom.c
View File

@ -308,6 +308,8 @@ static gboolean radcom_read(wtap *wth, int *err, gchar **err_info,
real_length -= 2;
}
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
wth->phdr.len = real_length;
wth->phdr.caplen = length;

1
wiretap/snoop.c
View File

@ -591,6 +591,7 @@ static gboolean snoop_read(wtap *wth, int *err, gchar **err_info,
return FALSE; /* Read error */
wth->data_offset += packet_size;
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
wth->phdr.ts.secs = g_ntohl(hdr.ts_sec);
wth->phdr.ts.nsecs = g_ntohl(hdr.ts_usec) * 1000;
wth->phdr.caplen = packet_size;

8
wiretap/tnef.c
View File

@ -40,7 +40,6 @@ static gboolean tnef_read(wtap *wth, int *err, gchar **err_info, gint64 *data_of
guint8 *buf;
gint64 file_size;
int packet_size;
ws_statb64 statb;
*err = 0;
@ -72,13 +71,12 @@ static gboolean tnef_read(wtap *wth, int *err, gchar **err_info, gint64 *data_of
wth->data_offset += packet_size;
wth->phdr.presence_flags = 0; /* no time stamp, no "real length" */
wth->phdr.caplen = packet_size;
wth->phdr.len = packet_size;
if (wtap_fstat(wth, &statb, err) == -1)
return FALSE;
wth->phdr.ts.secs = statb.st_mtime;
wth->phdr.ts.secs = 0;
wth->phdr.ts.nsecs = 0;
return TRUE;

1
wiretap/toshiba.c
View File

@ -355,6 +355,7 @@ parse_toshiba_rec_hdr(wtap *wth, FILE_T fh,
}
if (wth) {
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
wth->phdr.ts.secs = hr * 3600 + min * 60 + sec;
wth->phdr.ts.nsecs = csec * 10000000;
wth->phdr.caplen = pkt_len;

2
wiretap/visual.c
View File

@ -379,6 +379,8 @@ static gboolean visual_read(wtap *wth, int *err, gchar **err_info,
}
wth->data_offset += packet_size;
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* Set the packet time and length. */
t = visual->start_time;
t += ((double)pletohl(&vpkt_hdr.ts_delta))*1000;

1
wiretap/vms.c
View File

@ -444,6 +444,7 @@ parse_vms_rec_hdr(wtap *wth, FILE_T fh, int *err, gchar **err_info)
tm.tm_year -= 1900;
tm.tm_isdst = -1;
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.ts.secs = mktime(&tm);
wth->phdr.ts.nsecs = csec * 10000000;
wth->phdr.caplen = pkt_len;

42
wiretap/wtap.h
View File

@ -821,18 +821,46 @@ struct wtap_nstime {
};
struct wtap_pkthdr {
guint32 presence_flags; /* what stuff do we have? */
struct wtap_nstime ts;
guint32 caplen; /* data length in the file */
guint32 len; /* data length on the wire */
int pkt_encap;
guint32 caplen; /* data length in the file */
guint32 len; /* data length on the wire */
int pkt_encap;
/* pcapng variables */
guint32 interface_id; /* identifier of the interface. */
guint32 interface_id; /* identifier of the interface. */
/* options */
gchar *opt_comment; /* NULL if not available */
guint64 drop_count; /* number of packets lost (by the interface and the operating system) between this packet and the preceding one. */
guint32 pack_flags; /* XXX - 0 for now (any value for "we don't have it"?) */
gchar *opt_comment; /* NULL if not available */
guint64 drop_count; /* number of packets lost (by the interface and the operating system) between this packet and the preceding one. */
guint32 pack_flags; /* XXX - 0 for now (any value for "we don't have it"?) */
};
/*
* Bits in presence_flags, indicating which of the fields we have.
*
* For the time stamp, we may need some more flags to indicate
* whether the time stamp is an absolute date-and-time stamp, an
* absolute time-only stamp (which can make relative time
* calculations tricky, as you could in theory have two time
* stamps separated by an unknown number of days), or a time stamp
* relative to some unspecified time in the past (see mpeg.c).
*
* There is no presence flag for len - there has to be *some* length
* value for the packet. (The "captured length" can be missing if
* the file format doesn't report a captured length distinct from
* the on-the-network length because the application(s) producing those
* files don't support slicing packets.)
*
* There could be a presence flag for the packet encapsulation - if it's
* absent, use the file encapsulation - but it's not clear that's useful;
* we currently do that in the module for the file format.
*/
#define WTAP_HAS_TS 0x00000001 /* time stamp */
#define WTAP_HAS_CAP_LEN 0x00000002 /* captured length separate from on-the-network length */
#define WTAP_HAS_INTERFACE_ID 0x00000004 /* interface ID */
#define WTAP_HAS_COMMENTS 0x00000008 /* comments */
#define WTAP_HAS_DROP_COUNT 0x00000010 /* drop count */
#define WTAP_HAS_PACK_FLAGS 0x00000020 /* packet flags */
/**
* Holds the option strings from pcapng:s Section Header block(SHB).
*/