support; TShark has read+write support. Additionally TShark can read a
"hosts" file and write those records to a capture file.
This uses "struct addrinfo" in many places and probably won't compile on
some platforms.
svn path=/trunk/; revision=36318
netscreen_read(), checking the return value of
parse_netscreen_hex_dump() against -1 and explicitly returning FALSE if
it's -1, otherwise driving on.
svn path=/trunk/; revision=36237
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5654
From me:
- Entry for DVBCI added to wtap.c encap_table_base[];
- Some code simplification with respect to the use of col_...() for COL_INFO;
- Certain tests for "enough bytes available" not really needed;
- (Other minor tweaks);
- #include<stdio.h> not req'd;
- Minor reformatting and whitespace cleanup;
svn path=/trunk/; revision=36149
either the VC++ analyzer can't determine that or it *can*, in fact,
happen). Pick an error code that's not too far off.
svn path=/trunk/; revision=35957
pseudo-header, and hence there's no direction indication. Don't set
pinfo->p2p_dir for it. Use WTAP_ENCAP_BLUETOOTH_H4_WITH_PHDR, not
WTAP_ENCAP_BLUETOOTH_H4, for capture files where we have the direction.
Don't assume pinfo->p2p_dir is either P2P_DIR_SENT or P2P_DIR_RECV when
setting the info column in various Bluetooth dissectors; it might be
unknown.
In the HCI H4 dissector, put the direction into the info column
regardless of whether we have a type match or not; the dissectors for
HCI packet types appear to assume it's been set (as they put a blank at
the beginning of the stuff they append to the direction).
svn path=/trunk/; revision=35933
Get rid of debugging printouts that are equivalent to the "additional
error information" messages.
Return additional error info for all WTAP_ERR_BAD_RECORD errors.
svn path=/trunk/; revision=35800
- Define macros for certain CFLAGS in config.nmake iso of having defs in each makefile;
a. -DHAVE_CONFIG_H and -D_U_="" are now part of a macro named STANDARD_CFLAGS;
b. -WX has been replaced by WARNINGS_ARE_ERRORS (defined as -WX in config.nmake)
(This allows disabling "Warnings as Errors" by just changing config.nmake)
c. CVARSDLL definitions (not usage) have been removed from the various makefiles.
XXX: It appears the usage of CVARSDLL can also be removed (not yet done) since:
-DWIN32 and -DNULL=0 do not appear to be needed (any more);
-D_MT and _D_DLL are not needed since /MP causes these definitions.
d. Define a macro WARNINGS_CFLAGS with additional specific compiler (level4) warnings to be enabled.
E.G., 4295: array is too small to include a terminating null character
- config.nmake: reformat some long lines for readability;
- plugins\Makefile.nmake: clean-deps does nothing: remove it (and usage in top-level makefile);
- dissectors/Makefile.nmake: test to enable packet-rrc.obj target needs to include MSVC2010 ...
svn path=/trunk/; revision=35747
will see random crap as the error code.
However, if we're skipping a "TCPIPTRACE-W-BUFFERSFUL" error, if the
"error" we get is an end-of-file indication, that's *not* an error.
It is, however, ultimately a "we dropped some packets" indication; add a
comment noting that we should eventually treat it as such.
svn path=/trunk/; revision=35337
From me: For ipfix_open() don't actually return with *err=WTAP_ERR_BAD_RECORD.
Also: Move #define RECORDS_FOR_IPFIX_CHECK to ipfix.c from ipfix.h since
the definition is only used in ipfix.c.
svn path=/trunk/; revision=34589
http://www.opensync.org/browser/branches/3rd-party-cmake-modules/modules
+ split out FindGMODULE2.cmake
+ contains /sw/... by default
+ supposedly tested on OSX
- Disable pcre for cmake builds by default, gregex should be
picked up automatically if glib2 is not too old.
Should you have trouble linking due to some libgmodule... stuff
undefined, please add "${GMODULE2_LIBRARIES}" after "${GLIB2_LIBRARIES}"
an report back.
svn path=/trunk/; revision=34248
I try to configure Wireshark with cmake on macosx 10.6.
It fails with : set_target_properties called with incorrect number of arguments.
Attached a patch to fix this issue.
svn path=/trunk/; revision=34201
This fix adds back two lines of code removed in SVN #33678.
"Define WTAP_ENCAP_IEEE802_15_4_NOFCS, for use in file formats that don't
include the FCS, and use it for the Daintree SNA file format. [...]"
This fix just restores the discarding of two end-of-frame "pad" bytes as each frame is read
from the capture file; This seems to me to be the correct behaviour.
svn path=/trunk/; revision=33909
include the FCS, and use it for the Daintree SNA file format. While
we're at it, explicitly check to make sure the purported packet length
gives it at least one byte of packet data, and fix some print formats to
use %u for unsigned values.
svn path=/trunk/; revision=33678
is 0, but the packets have Ethernet headers. We handle this by mapping
0 to WTAP_ENCAP_ETHERNET.
(XXX - should we, instead, use the per-file link-layer type?)
svn path=/trunk/; revision=33620
to a gint64 (which won't sign-extend it) before multiplying by 1000, so
that the product is 64-bit and won't overflow.
svn path=/trunk/; revision=33609
format, the time offset from the start of the capture always had a
positive value, so it's an unsigned value. (In newer versions of NetMon
3.x, the capture can start before the "capture start" time stamp is set,
so packets can have a *negative* offset from the capture start time
stamp. Those captures are in the 2.x file format.)
svn path=/trunk/; revision=33607
the NetMon file format. Currently, we just use the network type field,
and we ignore all the special record types and don't try to handle any
of the other special network types.
We also catch bogus frame tables where the record is bigger than the
frame table says it is.
svn path=/trunk/; revision=33572
wtap_dump_file_write() (it does the right error checking for you, and
returns FALSE on failure and gives you the right error code).
svn path=/trunk/; revision=33117
wtap_dump_file_write(). Replace various wrappers around fwrite() with
wtap_dump_file_write(), or at least make the wrappers call
wtap_dump_file_write().
svn path=/trunk/; revision=33116
done.
Use the wtap_dump_file_ routines to write out capture files, and check
for errors.
Use the phton macros, when available, to translate to big-endian byte
order. Add a new phton24() macro.
Clean up indentation.
svn path=/trunk/; revision=33114
everybody use it; the places using the old wtap_dump_file_write() were
using it in the same way the old wtap_dump_file_write_all() did.
That also lets us get rid of wtap_dump_file_ferror().
Also, have the new wtap_dump_file_write() check for errors from
gzwrite() and fwrite() differently - the former returns 0 on error, the
latter can return a short write on error.
svn path=/trunk/; revision=33113
reach EOF, zlib's file handle seems to stay at EOF even when more data
is appended to the file. Add a check for 1.2.5 which calls gzseek in
order to unset EOF. Fixes bugs 4708 and 4748.
svn path=/trunk/; revision=32715
Support PPP-over-USB.
Don't remove the USB pseudo-header from the packet data for
Linux USB packets, just byte-swap it if necessary and have the
USB dissector fetch the pseudo-header from the raw packet data.
Update USB language ID values.
svn path=/trunk/; revision=32534
1) if it's not an SHB, just say "this is not a pcap-ng file",
don't try to process it (we can't process it, as we haven't
finished setting up all the state information yet);
2) if it has the right SHB type code, but isn't a valid SHB,
just say "this is not a pcap-ng file".
For all other SHB's, treat anything that renders it invalid as an error.
svn path=/trunk/; revision=32393
- Add checking for linker flags
- Install plugins with the name including the Wireshark version.
This will make it easier to find matching plugin versions if
files get just copied over.
svn path=/trunk/; revision=32231
wtap-int.h, and change the unions of pointers to those private data
structures into just void *'s.
Have the generic wtap close routine free up the private data, rather
than the type-specific close routine, just as the wtap_dumper close
routine does for its private data. Get rid of close routines that don't
do anything any more.
svn path=/trunk/; revision=32015
PARSED_RECORD if we got a packet;
PARSED_NONRECORD if the parser succeeded but didn't see a packet;
PARSE_FAILED if the parser failed.
Treat anything other than PARSED_RECORD as a failure, for now; I'm not
sure why we were treating "parser succeeded but didn't see a packet" as
success, as that was causing us to recognize some non-Ascend-output text
files as Ascend files and to return "records" with bogus caplen and len
values.
svn path=/trunk/; revision=32009
iSeries capture processor. Parse the start date into year/month/day at
the time we see it, rather than for every packet; that means we don't
need to allocate a buffer to hold the date as a string (a buffer which
we weren't ever freeing).
svn path=/trunk/; revision=31981
types in the modules for those capture file types, not in wtap-int.h, so
wtap-int.h doesn't have to change when the code to handle that
particular capture type changes, or a new capture file type is added.
(Ultimately, we should do this for all the private data structures.)
svn path=/trunk/; revision=31974
wtap_wtap_encap_to_pcap_encap() to wiretap/pcap-encap.h. Include it
where it's needed; don't include other Wiretap headers where they're not
needed.
Include pcapng.h in pcapng.c, to declare the functions defined in
pcapng.c. Add some casts to squelch some warnings, and add to a comment
to indicate one of the problems.
svn path=/trunk/; revision=31960
now), the capture file's header encapsulation type is set to 1 for Ethernet for
backwards compability only. These files use per-packet encapsulation types
instead. For now, set it to Unknown file encapsulation until we can find a
way to set it to WTAP_ENCAP_PER_PACKET without having to assert in wtap_read()
so the user can see that it is a per-packet encapulation in places such as
the capinfos program.
svn path=/trunk/; revision=31213
From me: Remove changes related to the ARP protocol because it doesn't
appear to be necessary for SocketCAN. Will add later if Felix says it is
needed.
svn path=/trunk/; revision=31196
"... a patch to make the netscaler wiretap code independent of the
host system endian-ness.
I have taken care of (1) reading and writing nstrace files (netscaler.c) and
(2) reading in dissector code (packet-nstrace.c) also."
See: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3540#c26
svn path=/trunk/; revision=31171
Added support for Solaris IPNET layer
From me:
Some code cleanup in packet-ipnet.c
Added packet-ipnet.c to CMakeFiles.txt
Added WTAP_ENCAP_IPNET to encap_table_base[]
svn path=/trunk/; revision=31159
to have been set. Do not set it to something g_mallocated in that case,
as that will cause a memory leak - the error string will not be freed by
the caller, as it's presumed not to have been set.
svn path=/trunk/; revision=31001
more than just dumping, indicate what stuff is used for dumping, and
note that it probably shouldn't be used for that (one should not have to
have a Catapult 2000 input file in order to write a Catapult 2000 output
file).
svn path=/trunk/; revision=30719
threads reading from two different wtap_t's in different threads.
file_externals_table considered unnecessary - a wtap_t has a member
specifically intended to point to private data.
Clean up indentation.
svn path=/trunk/; revision=30707
are any BSD/OS users still out there using Wireshark to read RFC 1483
ATM captures from BSD/OS, they can still do so, but all other users get
to read OpenBSD DLT_ENC captures, not just users *on* OpenBSD.
That also lets us simplify some hacks to deal with a link-layer type of
13 on Nokia IPSO captures.
svn path=/trunk/; revision=30159
on the stack! There is no guarantee that the header length won't cause a
buffer overflow - there could be a bug in some version of Surveyor
generating a bad file, there could be a future version of Surveyor that
has a really big pseudo-header, the file could've been written by
something other than Surveyor that has a bug in it, there could be a
file that's corrupted in transit, or there could be a deliberately
malformed packet trying to cause *Shark to execute arbitrary code.
Also, explicitly check for a too-short header length and fail with
WTAP_ERR_BAD_RECORD in that case.
Add some comments asking some questions about the header.
(The previous change was for bug 3856:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3856
not bug 3865.)
svn path=/trunk/; revision=29958
The Shomiti Wireless head was modified in a recent release such that wireshark
can no longer read Shomiti wireless capture files.
This new format is backwards compatible with the old format.
svn path=/trunk/; revision=29956
It's only beginnings, so epan is commented out in
the subdirs statement.
This is more a synch to avoid duplicate work and creating
conflicting patches to the cmake stuff.
svn path=/trunk/; revision=29666
- made it compile with --as-needed
This patch was taken from the opensuse wireshark.spec file.
No thanks go to the author and the package maintainers of
this package for not sending this upstream - it would have
made it into 1.2.0.
svn path=/trunk/; revision=29326
KHciLoggerDatalinkTypeBCSP and KHciLoggerDatalinkTypeH5 aren't supported
- just explicitly say "BSCP" or "H5".
For unknown link-layer types, say "unknown or unsupported", as other
Wiretap modules do.
svn path=/trunk/; revision=28925
This fixes a bug reported by Tyson Key as a follow up of Bug 3560.
Also some cleanups and debug output improvements.
Thanks to Tyson Key for reporting the bug and providing a tracefile.
This fix will be included in Wireshark 1.2.1 and higher.
svn path=/trunk/; revision=28868
text2pcap uses 102400.
This fixes bug 3620. Thanks to Tyson Key for reporting the bug
and providing capture files.
This fix should be included in Wireshark 1.2.1 and higher.
svn path=/trunk/; revision=28866
encapsulations.
This fixes a bug reported by Sake during the
Sharkfest 09. Thanks for providing a
Netscreen tracefile with multiple link layer
types.
This patch will be included in Wireshark 1.2.1
and higher.
svn path=/trunk/; revision=28862
* adds an encapsulation argument to pcap_write_phdr.
* writes the pseudo header when writing pcapng files.
This fixes a bug where you could not write pcapng files
when using encapsulations requiring pseudo headers.
svn path=/trunk/; revision=28859
this a the file encapsulation.
This fixes a bug where you can not save a file
in libpcap format when you captured it as a
pcapng one.
This fix will be scheduled for Wireshark 1.2.1
and higher.
svn path=/trunk/; revision=28858
* adds an encap argument to pcap_process_pseudo_header.
* adds support for reading pseudo headers.
It fixes Bug 3560.
Thanks to Tyson Key for reporting the bug and providing
trace files. This fix will be scheduled for inclusion in
Wireshark 1.2.1 and higher.
svn path=/trunk/; revision=28857
* Initialize pseudoheader.
* Add some input validation / protection code.
* Fix some return values.
* Clean up some whitespaces.
This fixes Bug 3565. Thanks to Tyson Key how reported
the issue and provided capture files for debugging.
This fix is scheduled for inclusion in Wireshark 1.2.1
and higher.
svn path=/trunk/; revision=28850
Because Lucent/Ascend equipment will sometimes omit the hex dump for a packet
or send two headers followed by two hex dumps, Wireshark needs to be very
lenient when parsing a Lucent/Ascend trace. On a busy access server, a packet
like this is pretty likely to appear within a few minutes.
svn path=/trunk/; revision=28749
That way we hopefully won't need the runlex.sh hack any
more. Also the ylwrap stuff is (hopefully) obsolete.
ascend.[hc] -> ascendtext.[hc]
ascend-scanner.l -> ascend_scanner.l
ascend-grammar.y -> ascend.y
svn path=/trunk/; revision=28744
have it (we have the size with the pseudo-header length already
removed); we've already read the packet, and thus have already checked
it. Fixes bug 3501.
svn path=/trunk/; revision=28607
Anders Broman