if they're not. Also report an error for zero-length names.
Handle multiple names per IP address - the pcap-NG spec says "one or
more zero-terminated strings containing the DNS entries for that
address."
Use a Buffer to hold NRB records, so there's no maximum size (well,
there is a maximum size, because the record length is 16 bits, but let's
not allocate 64KiB on the stack if we don't have to).
svn path=/trunk/; revision=41332
and should not contain the extension in the default_file_extension
member - that's why the name starts with "additional".
svn path=/trunk/; revision=41293
pcap_read_simple_packet_block(), not in pcap_read() - the way the fields
are filled in differs between simple and non-simple packet blocks.
Clean up white space.
svn path=/trunk/; revision=41284
clickable to open an edit window.
- Add checks for NULL pointers.
Help with a different color LED possibly with Jeff's (c) in it apreceated.
Should the LED be placed elsewhere or the whole thing done differently?
svn path=/trunk/; revision=41242
by Wiretap, to indicate whether certain fields in that structure
actually have data in them.
Use the "time stamp present" flag to omit showing time stamp information
for packets (and "packets") that don't have time stamps; don't bother
working very hard to "fake" a time stamp for data files.
Use the "interface ID present" flag to omit the interface ID for packets
that don't have an interface ID.
We don't use the "captured length, separate from packet length, present"
flag to omit the captured length; that flag might be present but equal
to the packet length, and if you want to know if a packet was cut short
by a snapshot length, comparing the values would be the way to do that.
More work is needed to have wiretap/pcapng.c properly report the flags,
e.g. reporting no time stamp being present for a Simple Packet Block.
svn path=/trunk/; revision=41185
That means we don't need to do the block length check in
pcapng_read_block(); each block type reader, including the one for
unknown block types, does a check that's as stringent as that block
length check or more stringent, which means any block whose length is
less than the minimum will fail with the same error in both cases.
Fix the message for a too-short NRB.
svn path=/trunk/; revision=41152
1) contain the block length fields and block type field;
2) contain that plus the fixed-length portion of the block;
3) for blocks that have a variable-length portion other than the
options, contain that variable-length portion.
Fixes a crash we're seeing with a bad pcap-NG file in the Wireshark
menagerie (7799-lastPacketWithoutComment.pcapng - the last packet's
block length is 128, but it claims to have 98 bytes of packet data,
which requires a 132-byte block).
Clean up white space (use 8-space tabs).
svn path=/trunk/; revision=41143
block, which could be the case even in a *valid* file (consider a file
with an SHB, an NRB, an IDB, and a packet block, in that order); even if
there's no IDB before the first packet block, that should be reported to
the user as "interface N not less than interface count M", to more
precisely indicate the problem.
(Yes, the loop should probably keep going until it finds a packet block,
not just a non-IDB block.)
svn path=/trunk/; revision=41132
you provide NULL when you call it via wtap_dump_open.
This does not make the buildbots happy, but at least
tshark doesn't crash anymore.
svn path=/trunk/; revision=41111
Anders Broman