Commit Graph

16 Commits

Author SHA1 Message Date
João Valverde 5362d0c31b ws_getopt: Rename struct and macros
This is part of the API and should also be renamed to avoid conflicts.
2021-09-30 13:59:28 +00:00
Guy Harris 0a9ef601d2 Clean up handling of --capture-comment.
Don't store the comments in a capture_options structure, because that's
available only if we're being built with capture support, and
--capture-comment can be used in TShark when reading a capture file and
writing another capture file, with no live capture taking place.

This means we don't handle that option in capture_opts_add_opt(); handle
it in the programs that support it.

Support writing multiple comments in dumpcap when capturing.

These changes also fix builds without pcap, and makes --capture-comment
work in Wireshark when a capture is started from the command line with

Update the help messages to indicate that --capture-comment adds a
capture comment, it doesn't change any comment (much less "the" comment,
as there isn't necessarily a single comment).

Update the man pages:

- not to presume that only pcapng files support file comments (even if
that's true now, it might not be true in the future);
- to note that multiple instances of --capture-comment are supported,
and that multiple comments will be written, whether capturing or reading
one file and writing another;
- clarify that Wireshark doesn't *discard* SHB comments other than the
first one, even though it only displays the first one;
2021-07-15 05:43:36 +00:00
Guy Harris fd88bfa348 Write the if_hardware option, if available, to pcapng files when capturing.
Change-Id: Ib9ff78d148a2364c84d84b4a9b020b3d783654a3
Petri-Dish: Guy Harris <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <>
2020-03-28 03:34:18 +00:00
Guy Harris f77c677f18 Fix some places where we forgot to mention Npcap.
Mostly comments, but a few messages.

Change-Id: Iff7380eb15f064bf6a3078e131c70987e36bca44
Petri-Dish: Guy Harris <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <>
2020-03-12 18:59:44 +00:00
Guy Harris a152e041fa Put various epoch time deltas into wsutil/epochs.h.
There are some deltas between the UN*X epoch and other epochs that are
used in a number of places; put them into a header.

Change-Id: Ia2d9d69b9d91352d730d97d9e4897518635b4861
Petri-Dish: Guy Harris <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <>
2020-01-21 23:37:05 +00:00
Guy Harris 20800366dd HTTPS (almost) everywhere.
Change all URLs to use https.

Fix some broken links while we're at it.

Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c
Reviewed-by: Guy Harris <>
2019-07-26 18:44:40 +00:00
Dario Lombardo 3e53ec5e11 pcapng: fix the magic when bytes are swapped.
This value is used when checking if the file was generated on a
machine with different endianess. The error message changes from

"Unrecognized pcapng format or not pcapng data."


"dumpcap: Interface 0 is big endian but we're little endian."

Fix dumpcap.c and pcapio.c.

Ping-Bug: 15754
Change-Id: I3a31f873f01bcb3f1324410e70f29f285e56c715
Petri-Dish: Peter Wu <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <>
2019-05-20 18:06:25 +00:00
Guy Harris 7c5c7fc985 Don't cast away constness if you don't have to.
Change-Id: I8b13bcd78d327b3ec9903b43e67fcf4a73052962
Reviewed-by: Guy Harris <>
2019-03-19 01:13:31 +00:00
Jaap Keuter afc1265b63 writecap: rename pcapng_write_session_block to _section_block
The pcapng file format specification speaks of a secion block, not
a session block. Let the function name reflect the proper name of
the block it writes.

Change-Id: Id399fae3648c93f4750fedaa297b18f95f2bb96f
Signed-off-by: Jaap Keuter <>
Petri-Dish: Guy Harris <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <>
2018-12-18 23:41:41 +00:00
James Ko 91694e5640 dumpcap: fix some warnings and add some debugs
Ping-Bug: 15149
Change-Id: Ifa530fbdcbffbc188343c03fc7b518325a511f5f
Petri-Dish: Guy Harris <>
Reviewed-by: Gerald Combs <>
Petri-Dish: Gerald Combs <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <>
2018-09-28 20:59:17 +00:00
Dario Lombardo 16b07fa6bc writecap: use SPDX identifiers.
Change-Id: I800f8ccb516f69a15b535ee96a4b34754c008028
Petri-Dish: Anders Broman <>
Petri-Dish: Dario Lombardo <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <>
2018-02-08 16:15:42 +00:00
Guy Harris af0f49e80d Use pcapng as the name of the file format.
At one point, I remember a discussion resulting in the official name of
the next-generation replacement for pcap format being changed to
"pcapng", with no hyphen.

Make Wireshark reflect that.

Change-Id: Ie66fb13a0fe3a8682143106dab601952e9154e2a
Reviewed-by: Guy Harris <>
2018-01-09 00:38:51 +00:00
James Ko 8606062cb3 dumpcap: enable capture of pcapng from pipe
Reads pcapng blocks from a pipe.  Section header blocks are parsed for
endianess.  All other blocks only have the general block header parsed
for type and length, and then endianess converted if necessary.
Outputs all blocks using the original endianess format so none of the
other block types or options require parsing.

Change-Id: I2f4f0175013d8fc2cda42a63e7deacad537951e3
Bug: 11370
Petri-Dish: Dario Lombardo <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <>
2017-12-01 08:18:16 +00:00
Guy Harris b8b9bbcbd3 *Always* write out the trailing pcapng block total length in host byte order.
In the fast-path "no options" case for writing an Enhanced Packet Block,
just copy the block total length to the buffer, don't put it into the
buffer in little-endian byte order.  If we're running on a big-endian
machine, and thus *should* be writing out multi-byte integral block
fields in big-endian byte order, that'll write out a corrupt pcapng

Bug: 13802
Change-Id: I33958e3fc1d205ca6df3ef4057d92b461831c50e
Petri-Dish: Guy Harris <>
Tested-by: Petri Dish Buildbot <>
Reviewed-by: Anders Broman <>
2017-07-21 12:59:28 +00:00
AndersBroman bd9afdddfe Reduce number of fwrite when writing pcap-ng EPB.
According to callgrind with the patch dumping 3000 pakets the number of
calls to write_to_file is reduced from 11541 to 9000 reducing the number
of lr from 4 681 518 to 4 314 101.

If the buffer holding the packet was guaranteed to be padded to 32 bit
boundary the code could be simplified and if there was space "in front"
for the packet header it would be even better.

Change-Id: Ie991c05fa9d831ee4d703bd47b8123f2b1f83277
Petri-Dish: Anders Broman <>
Tested-by: Petri Dish Buildbot <>
Reviewed-by: Anders Broman <>
2017-02-24 04:42:31 +00:00
Guy Harris a4aa8930bb Put pcapio.c into a writecap library, and use it.
Change-Id: Ib89f345c072a38bc01f0513366a4bdae3bf6f08e
Reviewed-by: Guy Harris <>
2016-03-24 20:49:37 +00:00