osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

Allow -C <choplen> to be used more than once so it is now possible to chop bytes from both the beginning and end of a packet in a single step. 

svn path=/trunk/; revision=50536
This commit is contained in:
Chris Maynard 2013-07-12 17:14:19 +00:00
parent 605e212c44
commit cab1f9fc0c
3 changed files with 55 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
doc/editcap.pod
View File

@ -92,13 +92,17 @@ opened. The default is to use a single output file.
=item -C E<lt>choplenE<gt>
Sets the chop length to use when writing the packet data. Each packet is
chopped by a few <choplen> bytes of data. Positive values chop at the packet
chopped by <choplen> bytes of data. Positive values chop at the packet
beginning while negative values chop at the packet end.
This is useful for chopping headers for decapsulation of an entire capture or
in the rare case that the conversion between two file formats leaves some random
bytes at the end of each packet.
NOTE: This option can be used more than once, effectively allowing you to chop
bytes from the beginning of a packet as well as from the end of a packet in a
single step.
=item -d
Attempts to remove duplicate packets. The length and MD5 hash of the

19
docbook/release-notes.asciidoc
View File

@ -22,12 +22,19 @@ The following bugs have been fixed:
The following features are new (or have been significantly updated)
since version 1.10:
* Expert info is now filterable (if the dissector has been updated to support the new API).
* The Windows installer now uninstalls the previous version of Wireshark silently.
You can still run the uninstaller manually beforehand if you wish to run it interactively.
* The "Number" column shows related packets and protocol conversation spans (Qt only).
* When manipulating packets with editcap using the -C <choplen> and/or -s <snaplen> options,
it is now possible to also adjust the original frame length using the -L option.
* Expert info is now filterable (if the dissector has been updated to support
the new API).
* The Windows installer now uninstalls the previous version of Wireshark
silently. You can still run the uninstaller manually beforehand if you wish
to run it interactively.
* The "Number" column shows related packets and protocol conversation spans
(Qt only).
* When manipulating packets with editcap using the -C <choplen> and/or
-s <snaplen> options, it is now possible to also adjust the original frame
length using the -L option.
* You can now pass the -C <choplen> option to editcap multiple times, which
allows you to chop bytes from the beginning of a packet as well as at the end
of a packet in a single step.
=== New Protocol Support

63
editcap.c
View File

@ -733,7 +733,7 @@ usage(gboolean is_error)
fprintf(output, " -s <snaplen> truncate each packet to max. <snaplen> bytes of data.\n");
fprintf(output, " -C <choplen> chop each packet by <choplen> bytes. Positive values\n");
fprintf(output, " chop at the packet beginning, negative values at the\n");
fprintf(output, " packet end.\n");
fprintf(output, " packet end. You can use this option more than once.\n");
fprintf(output, " -L adjust the frame length when chopping and/or snapping\n");
fprintf(output, " -t <time adjustment> adjust the timestamp of each packet;\n");
fprintf(output, " <time adjustment> is in relative seconds (e.g. -0.5).\n");
@ -745,21 +745,21 @@ usage(gboolean is_error)
fprintf(output, " that each packet's delta time is the absolute value\n");
fprintf(output, " of the adjustment specified. A value of -0 will set\n");
fprintf(output, " all packets to the timestamp of the first packet.\n");
fprintf(output, " -E <error probability> set the probability (between 0.0 and 1.0 incl.)\n");
fprintf(output, " that a particular packet byte will be randomly changed.\n");
fprintf(output, " -E <error probability> set the probability (between 0.0 and 1.0 incl.) that\n");
fprintf(output, " a particular packet byte will be randomly changed.\n");
fprintf(output, "\n");
fprintf(output, "Output File(s):\n");
fprintf(output, " -c <packets per file> split the packet output to different files\n");
fprintf(output, " based on uniform packet counts\n");
fprintf(output, " with a maximum of <packets per file> each.\n");
fprintf(output, " -i <seconds per file> split the packet output to different files\n");
fprintf(output, " based on uniform time intervals\n");
fprintf(output, " with a maximum of <seconds per file> each.\n");
fprintf(output, " -F <capture type> set the output file type; default is pcapng.\n");
fprintf(output, " an empty \"-F\" option will list the file types.\n");
fprintf(output, " -T <encap type> set the output file encapsulation type;\n");
fprintf(output, " default is the same as the input file.\n");
fprintf(output, " an empty \"-T\" option will list the encapsulation types.\n");
fprintf(output, " -c <packets per file> split the packet output to different files based on\n");
fprintf(output, " uniform packet counts with a maximum of\n");
fprintf(output, " <packets per file> each.\n");
fprintf(output, " -i <seconds per file> split the packet output to different files based on\n");
fprintf(output, " uniform time intervals with a maximum of\n");
fprintf(output, " <seconds per file> each.\n");
fprintf(output, " -F <capture type> set the output file type; default is pcapng. An empty\n");
fprintf(output, " \"-F\" option will list the file types.\n");
fprintf(output, " -T <encap type> set the output file encapsulation type; default is the\n");
fprintf(output, " same as the input file. An empty \"-T\" option will\n");
fprintf(output, " list the encapsulation types.\n");
fprintf(output, "\n");
fprintf(output, "Miscellaneous:\n");
fprintf(output, " -h display this help and exit.\n");
@ -860,7 +860,8 @@ main(int argc, char *argv[])
char *p;
guint32 snaplen = 0; /* No limit */
int choplen = 0; /* No chop */
int choplen_begin = 0; /* No chop at beginning */
int choplen_end = 0; /* No chop at end */
gboolean adjlen = FALSE;
wtap_dumper *pdh = NULL;
unsigned int count = 1;
@ -961,13 +962,21 @@ main(int argc, char *argv[])
break;
case 'C':
{
int choplen;
choplen = (int)strtol(optarg, &p, 10);
if (p == optarg || *p != '\0') {
fprintf(stderr, "editcap: \"%s\" isn't a valid chop length\n",
optarg);
exit(1);
}
if (choplen > 0)
choplen_begin += choplen;
else if (choplen < 0)
choplen_end += choplen;
break;
}
case 'd':
dup_detect = TRUE;
@ -1294,29 +1303,31 @@ main(int argc, char *argv[])
}
}
if (choplen < 0) {
if (choplen_end < 0) {
snap_phdr = *phdr;
if (((signed int) phdr->caplen + choplen) > 0)
snap_phdr.caplen += choplen;
if (((signed int) phdr->caplen + choplen_end) > 0)
snap_phdr.caplen += choplen_end;
else
snap_phdr.caplen = 0;
if (adjlen) {
if (((signed int) phdr->len + choplen) > 0)
snap_phdr.len += choplen;
if (((signed int) phdr->len + choplen_end) > 0)
snap_phdr.len += choplen_end;
else
snap_phdr.len = 0;
}
phdr = &snap_phdr;
} else if (choplen > 0) {
}
if (choplen_begin > 0) {
snap_phdr = *phdr;
if (phdr->caplen > (unsigned int) choplen) {
snap_phdr.caplen -= choplen;
buf += choplen;
if (phdr->caplen > (unsigned int) choplen_begin) {
snap_phdr.caplen -= choplen_begin;
buf += choplen_begin;
} else
snap_phdr.caplen = 0;
if (adjlen) {
if (phdr->len > (unsigned int) choplen) {
snap_phdr.len -= choplen;
if (phdr->len > (unsigned int) choplen_begin) {
snap_phdr.len -= choplen_begin;
} else
snap_phdr.len = 0;
}