1999-02-20 06:49:27 +00:00
|
|
|
/* netxray.c
|
|
|
|
*
|
2003-10-01 07:11:49 +00:00
|
|
|
* $Id: netxray.c,v 1.84 2003/10/01 07:11:48 guy Exp $
|
1999-02-20 06:49:27 +00:00
|
|
|
*
|
|
|
|
* Wiretap Library
|
2001-11-13 23:55:44 +00:00
|
|
|
* Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
|
2002-08-28 20:30:45 +00:00
|
|
|
*
|
1999-02-20 06:49:27 +00:00
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 20:30:45 +00:00
|
|
|
*
|
1999-02-20 06:49:27 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 20:30:45 +00:00
|
|
|
*
|
1999-02-20 06:49:27 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
2002-02-27 08:57:25 +00:00
|
|
|
|
1999-07-13 02:53:26 +00:00
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
#include "config.h"
|
|
|
|
#endif
|
1999-02-20 06:49:27 +00:00
|
|
|
|
|
|
|
#include <stdlib.h>
|
Have the per-capture-file-type open routines "wtap_open_offline()" calls
return 1 on success, -1 if they got an error, and 0 if the file isn't of
the type that file is checking for, and supply an error code if they
return -1; have "wtap_open_offline()" use that error code. Also, have
the per-capture-file-type open routines treat errors accessing the file
as errors, and return -1, rather than just returning 0 so that we try
another file type.
Have the per-capture-file-type read routines "wtap_loop()" calls return
-1 and supply an error code on error (and not, as they did in some
cases, call "g_error()" and abort), and have "wtap_loop()", if the read
routine returned an error, return FALSE (and pass an error-code-pointer
argument onto the read routines, so they fill it in), and return TRUE on
success.
Add some new error codes for them to return.
Now that "wtap_loop()" can return a success/failure indication and an
error code, in "read_cap_file()" put up a message box if we get an error
reading the file, and return the error code.
Handle the additional errors we can get when opening a capture file.
If the attempt to open a capture file succeeds, but the attempt to read
it fails, don't treat that as a complete failure - we may have managed
to read some of the capture file, and we should display what we managed
to read.
svn path=/trunk/; revision=516
1999-08-19 05:31:38 +00:00
|
|
|
#include <errno.h>
|
1999-12-14 05:34:30 +00:00
|
|
|
#include <string.h>
|
2000-05-19 23:07:04 +00:00
|
|
|
#include "wtap-int.h"
|
2000-01-13 07:09:20 +00:00
|
|
|
#include "file_wrappers.h"
|
1999-02-20 06:49:27 +00:00
|
|
|
#include "netxray.h"
|
1999-03-01 18:57:07 +00:00
|
|
|
#include "buffer.h"
|
2003-01-07 06:09:08 +00:00
|
|
|
#include "atm.h"
|
1999-02-20 06:49:27 +00:00
|
|
|
|
|
|
|
/* Capture file header, *including* magic number, is padded to 128 bytes. */
|
|
|
|
#define CAPTUREFILE_HEADER_SIZE 128
|
|
|
|
|
2002-05-28 02:39:15 +00:00
|
|
|
/* Magic number in NetXRay 1.x files. */
|
|
|
|
static const char old_netxray_magic[] = {
|
|
|
|
'V', 'L', '\0', '\0'
|
|
|
|
};
|
|
|
|
|
|
|
|
/* Magic number in NetXRay 2.0 and later, and Windows Sniffer, files. */
|
1999-02-20 06:49:27 +00:00
|
|
|
static const char netxray_magic[] = { /* magic header */
|
|
|
|
'X', 'C', 'P', '\0'
|
|
|
|
};
|
|
|
|
|
|
|
|
/* NetXRay file header (minus magic number). */
|
|
|
|
struct netxray_hdr {
|
|
|
|
char version[8]; /* version number */
|
1999-03-01 22:59:47 +00:00
|
|
|
guint32 start_time; /* UNIX time when capture started */
|
1999-12-15 01:34:17 +00:00
|
|
|
guint32 nframes; /* number of packets */
|
|
|
|
guint32 xxx; /* unknown */
|
1999-03-01 18:57:07 +00:00
|
|
|
guint32 start_offset; /* offset of first packet in capture */
|
|
|
|
guint32 end_offset; /* offset after last packet in capture */
|
|
|
|
guint32 xxy[3]; /* unknown */
|
2003-07-07 21:08:49 +00:00
|
|
|
guint8 network; /* datalink type */
|
|
|
|
guint8 xxz[3]; /* XXX - is this the upper 3 bytes of the datalink type? */
|
2001-05-09 04:42:27 +00:00
|
|
|
guint8 timeunit; /* encodes length of a tick */
|
2002-10-29 06:12:35 +00:00
|
|
|
guint8 xxa[3]; /* XXX - is this the upper 3 bytes of the time units? */
|
2001-03-23 23:16:29 +00:00
|
|
|
guint32 timelo; /* lower 32 bits of time stamp of capture start */
|
|
|
|
guint32 timehi; /* upper 32 bits of time stamp of capture start */
|
2002-10-29 06:12:35 +00:00
|
|
|
guint32 linespeed; /* speed of network, in bits/second */
|
2003-01-03 07:51:26 +00:00
|
|
|
guint8 xxb[64]; /* other stuff */
|
1999-02-20 06:49:27 +00:00
|
|
|
};
|
|
|
|
|
2003-03-03 23:29:59 +00:00
|
|
|
/*
|
|
|
|
* Capture type, in xxb[20].
|
|
|
|
*/
|
|
|
|
#define CAPTYPE_NDIS 0 /* Capture on network interface using NDIS */
|
|
|
|
#define CAPTYPE_BROUTER 1 /* Bridge/router captured with pod */
|
|
|
|
#define CAPTYPE_GIGPOD 2 /* gigabit Ethernet captured with pod */
|
|
|
|
#define CAPTYPE_PPP 3 /* PPP captured with pod */
|
|
|
|
#define CAPTYPE_FRELAY 4 /* Frame Relay captured with pod */
|
|
|
|
#define CAPTYPE_BROUTER2 5 /* Bridge/router captured with pod */
|
|
|
|
#define CAPTYPE_HDLC 6 /* HDLC (X.25, ISDN) captured with pod */
|
|
|
|
#define CAPTYPE_SDLC 7 /* SDLC captured with pod */
|
|
|
|
#define CAPTYPE_HDLC2 8 /* HDLC captured with pod */
|
|
|
|
#define CAPTYPE_BROUTER3 9 /* Bridge/router captured with pod */
|
|
|
|
#define CAPTYPE_SMDS 10 /* SMDS DXI */
|
|
|
|
#define CAPTYPE_BROUTER4 11 /* Bridge/router captured with pod */
|
|
|
|
#define CAPTYPE_BROUTER5 12 /* Bridge/router captured with pod */
|
|
|
|
|
2003-03-31 21:11:49 +00:00
|
|
|
/*
|
|
|
|
* # of ticks that equal 1 second
|
|
|
|
*
|
|
|
|
* XXX - the third item was 1193180.0, presumably because somebody found
|
|
|
|
* it gave the right answer for some captures, but 3 times that, i.e.
|
|
|
|
* 3579540.0, appears to give the right answer for some other captures.
|
|
|
|
*
|
|
|
|
* Is there something else in the file header to indicate which of those
|
|
|
|
* is correct?
|
|
|
|
*/
|
|
|
|
static double TpS[] = { 1e6, 1193000.0, 3579540.0 };
|
|
|
|
#define NUM_NETXRAY_TIMEUNITS (sizeof TpS / sizeof TpS[0])
|
|
|
|
|
1999-02-20 06:49:27 +00:00
|
|
|
/* Version number strings. */
|
|
|
|
static const char vers_1_0[] = {
|
|
|
|
'0', '0', '1', '.', '0', '0', '0', '\0'
|
|
|
|
};
|
|
|
|
|
|
|
|
static const char vers_1_1[] = {
|
|
|
|
'0', '0', '1', '.', '1', '0', '0', '\0'
|
|
|
|
};
|
|
|
|
|
2003-01-03 02:24:56 +00:00
|
|
|
static const char vers_2_000[] = {
|
|
|
|
'0', '0', '2', '.', '0', '0', '0', '\0'
|
|
|
|
};
|
|
|
|
|
1999-03-20 09:10:49 +00:00
|
|
|
static const char vers_2_001[] = {
|
|
|
|
'0', '0', '2', '.', '0', '0', '1', '\0'
|
|
|
|
};
|
|
|
|
|
2000-06-24 05:32:48 +00:00
|
|
|
static const char vers_2_002[] = {
|
|
|
|
'0', '0', '2', '.', '0', '0', '2', '\0'
|
|
|
|
};
|
|
|
|
|
2002-05-28 02:39:15 +00:00
|
|
|
/* Old NetXRay data record format - followed by frame data. */
|
|
|
|
struct old_netxrayrec_hdr {
|
|
|
|
guint32 timelo; /* lower 32 bits of time stamp */
|
|
|
|
guint32 timehi; /* upper 32 bits of time stamp */
|
|
|
|
guint16 len; /* packet length */
|
|
|
|
guint8 xxx[6]; /* unknown */
|
|
|
|
};
|
|
|
|
|
|
|
|
/* NetXRay format version 1.x data record format - followed by frame data. */
|
1999-03-20 09:10:49 +00:00
|
|
|
struct netxrayrec_1_x_hdr {
|
2001-03-23 23:16:29 +00:00
|
|
|
guint32 timelo; /* lower 32 bits of time stamp */
|
|
|
|
guint32 timehi; /* upper 32 bits of time stamp */
|
1999-02-20 06:49:27 +00:00
|
|
|
guint16 orig_len; /* packet length */
|
|
|
|
guint16 incl_len; /* capture length */
|
2002-04-08 09:09:49 +00:00
|
|
|
guint8 xxx[16]; /* unknown */
|
1999-02-20 06:49:27 +00:00
|
|
|
};
|
|
|
|
|
2002-05-28 02:39:15 +00:00
|
|
|
/* NetXRay format version 2.x data record format - followed by frame data. */
|
1999-03-20 09:10:49 +00:00
|
|
|
struct netxrayrec_2_x_hdr {
|
2001-03-23 23:16:29 +00:00
|
|
|
guint32 timelo; /* lower 32 bits of time stamp */
|
|
|
|
guint32 timehi; /* upper 32 bits of time stamp */
|
1999-03-20 09:10:49 +00:00
|
|
|
guint16 orig_len; /* packet length */
|
|
|
|
guint16 incl_len; /* capture length */
|
2003-01-07 02:21:38 +00:00
|
|
|
guint8 xxx[28]; /* various data */
|
2002-04-08 09:09:49 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
/*
|
2002-05-28 02:39:15 +00:00
|
|
|
* Union of the data record headers.
|
2002-04-08 09:09:49 +00:00
|
|
|
*/
|
|
|
|
union netxrayrec_hdr {
|
2002-05-28 02:39:15 +00:00
|
|
|
struct old_netxrayrec_hdr old_hdr;
|
2002-04-08 09:09:49 +00:00
|
|
|
struct netxrayrec_1_x_hdr hdr_1_x;
|
|
|
|
struct netxrayrec_2_x_hdr hdr_2_x;
|
1999-03-20 09:10:49 +00:00
|
|
|
};
|
|
|
|
|
2001-10-04 08:30:36 +00:00
|
|
|
static gboolean netxray_read(wtap *wth, int *err, long *data_offset);
|
2002-04-08 09:09:49 +00:00
|
|
|
static gboolean netxray_seek_read(wtap *wth, long seek_off,
|
2002-07-29 06:09:59 +00:00
|
|
|
union wtap_pseudo_header *pseudo_header, guchar *pd, int length, int *err);
|
2002-04-08 09:09:49 +00:00
|
|
|
static int netxray_read_rec_header(wtap *wth, FILE_T fh,
|
|
|
|
union netxrayrec_hdr *hdr, int *err);
|
2003-10-01 07:11:49 +00:00
|
|
|
static guint netxray_set_pseudo_header(wtap *wth, const guint8 *pd, int len,
|
2002-04-08 09:09:49 +00:00
|
|
|
union wtap_pseudo_header *pseudo_header, union netxrayrec_hdr *hdr);
|
|
|
|
static gboolean netxray_read_rec_data(FILE_T fh, guint8 *data_ptr,
|
|
|
|
guint32 packet_size, int *err);
|
2000-03-22 07:06:59 +00:00
|
|
|
static void netxray_close(wtap *wth);
|
2002-05-04 10:00:18 +00:00
|
|
|
static gboolean netxray_dump_1_1(wtap_dumper *wdh,
|
|
|
|
const struct wtap_pkthdr *phdr,
|
2002-07-29 06:09:59 +00:00
|
|
|
const union wtap_pseudo_header *pseudo_header, const guchar *pd, int *err);
|
1999-12-14 01:12:59 +00:00
|
|
|
static gboolean netxray_dump_close_1_1(wtap_dumper *wdh, int *err);
|
2002-05-04 10:00:18 +00:00
|
|
|
static gboolean netxray_dump_2_0(wtap_dumper *wdh,
|
|
|
|
const struct wtap_pkthdr *phdr,
|
2002-07-29 06:09:59 +00:00
|
|
|
const union wtap_pseudo_header *pseudo_header, const guchar *pd, int *err);
|
2002-05-04 10:00:18 +00:00
|
|
|
static gboolean netxray_dump_close_2_0(wtap_dumper *wdh, int *err);
|
Have the per-capture-file-type open routines "wtap_open_offline()" calls
return 1 on success, -1 if they got an error, and 0 if the file isn't of
the type that file is checking for, and supply an error code if they
return -1; have "wtap_open_offline()" use that error code. Also, have
the per-capture-file-type open routines treat errors accessing the file
as errors, and return -1, rather than just returning 0 so that we try
another file type.
Have the per-capture-file-type read routines "wtap_loop()" calls return
-1 and supply an error code on error (and not, as they did in some
cases, call "g_error()" and abort), and have "wtap_loop()", if the read
routine returned an error, return FALSE (and pass an error-code-pointer
argument onto the read routines, so they fill it in), and return TRUE on
success.
Add some new error codes for them to return.
Now that "wtap_loop()" can return a success/failure indication and an
error code, in "read_cap_file()" put up a message box if we get an error
reading the file, and return the error code.
Handle the additional errors we can get when opening a capture file.
If the attempt to open a capture file succeeds, but the attempt to read
it fails, don't treat that as a complete failure - we may have managed
to read some of the capture file, and we should display what we managed
to read.
svn path=/trunk/; revision=516
1999-08-19 05:31:38 +00:00
|
|
|
|
|
|
|
int netxray_open(wtap *wth, int *err)
|
1999-02-20 06:49:27 +00:00
|
|
|
{
|
|
|
|
int bytes_read;
|
|
|
|
char magic[sizeof netxray_magic];
|
2002-05-28 02:39:15 +00:00
|
|
|
gboolean is_old;
|
1999-02-20 06:49:27 +00:00
|
|
|
struct netxray_hdr hdr;
|
2003-07-07 21:08:49 +00:00
|
|
|
guint network_type;
|
1999-03-01 18:57:07 +00:00
|
|
|
double timeunit;
|
2003-09-28 23:15:40 +00:00
|
|
|
int version_major, version_minor;
|
Add to Wiretap the ability to write capture files; for now, it can only
write them in "libpcap" format, but the mechanism can have other formats
added.
When creating the temporary file for a capture, use "create_tempfile()",
to close a security hole opened by the fact that "tempnam()" creates a
temporary file, but doesn't open it, and we open the file with the name
it gives us - somebody could remove the file and plant a link to some
file, and, if as may well be the case when Ethereal is capturing
packets, it's running as "root", that means we write a capture on top of
that file.... (The aforementioned changes to Wiretap let you open a
capture file for writing given an file descriptor, "fdopen()"-style,
which this change requires.)
svn path=/trunk/; revision=509
1999-08-18 04:17:38 +00:00
|
|
|
int file_type;
|
2003-09-28 23:15:40 +00:00
|
|
|
double start_timestamp;
|
1999-03-01 18:57:07 +00:00
|
|
|
static const int netxray_encap[] = {
|
2003-07-07 21:08:49 +00:00
|
|
|
WTAP_ENCAP_UNKNOWN,
|
1999-03-01 18:57:07 +00:00
|
|
|
WTAP_ENCAP_ETHERNET,
|
2000-09-21 04:41:37 +00:00
|
|
|
WTAP_ENCAP_TOKEN_RING,
|
Add a new Wiretap encapsulation type WTAP_ENCAP_FDDI_BITSWAPPED, meaning
"FDDI with the MAC addresses bit-swapped"; whether the MAC addresses are
bit-swapped is a property of the machine on which the capture was taken,
not of the machine on which the capture is being read - right now, none
of the capture file formats we read indicate whether FDDI MAC addresses
are bit-swapped, but this does let us treat non-"libpcap" captures as
being bit-swapped or not bit-swapped independent of the machine on which
they're being read (and of the machine on which they were captured, but
I have the impression they're bit-swapped on most platforms), and allows
us to, if, as, and when we implement packet capture in Wiretap, mark
packets in a capture file written in Wiretap-native format based on the
machine on which they are captured (assuming the rule "Ultrix, Alpha,
and BSD/OS are the only platforms that don't bit-swap", or some other
compile-time rule, gets the right answer, or that some platform has
drivers that can tell us whether the addresses are bit-swapped).
(NOTE: if, for any of the capture file formats used only on one
platform, FDDI MAC addresses aren't bit-swapped, the code to read that
capture file format should be fixed to flag them as not bit-swapped.)
Use the encapsulation type to decide whether to bit-swap addresses in
"dissect_fddi()".
svn path=/trunk/; revision=557
1999-08-24 03:19:34 +00:00
|
|
|
WTAP_ENCAP_FDDI_BITSWAPPED,
|
2002-10-22 18:48:15 +00:00
|
|
|
/*
|
|
|
|
* XXX - PPP captures may look like Ethernet, perhaps
|
|
|
|
* because they're using NDIS to capture on the
|
|
|
|
* same machine and it provides simulated-Ethernet
|
|
|
|
* packets, but at least one ISDN capture uses the
|
|
|
|
* same network type value but isn't shaped like
|
|
|
|
* Ethernet.
|
|
|
|
*/
|
2002-04-08 09:09:49 +00:00
|
|
|
WTAP_ENCAP_ETHERNET, /* WAN(PPP), but shaped like Ethernet */
|
1999-08-22 02:29:40 +00:00
|
|
|
WTAP_ENCAP_UNKNOWN, /* LocalTalk */
|
|
|
|
WTAP_ENCAP_UNKNOWN, /* "DIX" - should not occur */
|
|
|
|
WTAP_ENCAP_UNKNOWN, /* ARCNET raw */
|
|
|
|
WTAP_ENCAP_UNKNOWN, /* ARCNET 878.2 */
|
Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not just
used for the DOS-based ATM Sniffer. (That's not a great name, but I
couldn't think of a better one.)
Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture
files where reassembled frames don't have trailers, such as the AAL5
trailer, chopped off. That's what at least some versions of the
Windows-based ATM Sniffer appear to have.
Map the ATM capture file type for NetXRay captures to
WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've
reverse-engineered, so far, for the pseudo-header; there's more that
needs to be done on it, e.g. getting the channel, AAL type, and traffic
type (or inferring them if they're not in the packet header).
svn path=/trunk/; revision=6840
2003-01-03 06:45:45 +00:00
|
|
|
WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, /* ATM */
|
2002-04-08 09:09:49 +00:00
|
|
|
WTAP_ENCAP_IEEE_802_11_WITH_RADIO,
|
|
|
|
/* Wireless WAN with radio information */
|
1999-08-22 02:29:40 +00:00
|
|
|
WTAP_ENCAP_UNKNOWN /* IrDA */
|
1999-03-01 18:57:07 +00:00
|
|
|
};
|
|
|
|
#define NUM_NETXRAY_ENCAPS (sizeof netxray_encap / sizeof netxray_encap[0])
|
2003-01-03 07:51:26 +00:00
|
|
|
int file_encap;
|
2003-01-07 01:06:58 +00:00
|
|
|
guint isdn_type = 0;
|
1999-02-20 06:49:27 +00:00
|
|
|
|
|
|
|
/* Read in the string that should be at the start of a NetXRay
|
|
|
|
* file */
|
Have the per-capture-file-type open routines "wtap_open_offline()" calls
return 1 on success, -1 if they got an error, and 0 if the file isn't of
the type that file is checking for, and supply an error code if they
return -1; have "wtap_open_offline()" use that error code. Also, have
the per-capture-file-type open routines treat errors accessing the file
as errors, and return -1, rather than just returning 0 so that we try
another file type.
Have the per-capture-file-type read routines "wtap_loop()" calls return
-1 and supply an error code on error (and not, as they did in some
cases, call "g_error()" and abort), and have "wtap_loop()", if the read
routine returned an error, return FALSE (and pass an error-code-pointer
argument onto the read routines, so they fill it in), and return TRUE on
success.
Add some new error codes for them to return.
Now that "wtap_loop()" can return a success/failure indication and an
error code, in "read_cap_file()" put up a message box if we get an error
reading the file, and return the error code.
Handle the additional errors we can get when opening a capture file.
If the attempt to open a capture file succeeds, but the attempt to read
it fails, don't treat that as a complete failure - we may have managed
to read some of the capture file, and we should display what we managed
to read.
svn path=/trunk/; revision=516
1999-08-19 05:31:38 +00:00
|
|
|
errno = WTAP_ERR_CANT_READ;
|
1999-09-22 01:26:50 +00:00
|
|
|
bytes_read = file_read(magic, 1, sizeof magic, wth->fh);
|
1999-02-20 06:49:27 +00:00
|
|
|
if (bytes_read != sizeof magic) {
|
1999-10-05 07:06:08 +00:00
|
|
|
*err = file_error(wth->fh);
|
|
|
|
if (*err != 0)
|
Have the per-capture-file-type open routines "wtap_open_offline()" calls
return 1 on success, -1 if they got an error, and 0 if the file isn't of
the type that file is checking for, and supply an error code if they
return -1; have "wtap_open_offline()" use that error code. Also, have
the per-capture-file-type open routines treat errors accessing the file
as errors, and return -1, rather than just returning 0 so that we try
another file type.
Have the per-capture-file-type read routines "wtap_loop()" calls return
-1 and supply an error code on error (and not, as they did in some
cases, call "g_error()" and abort), and have "wtap_loop()", if the read
routine returned an error, return FALSE (and pass an error-code-pointer
argument onto the read routines, so they fill it in), and return TRUE on
success.
Add some new error codes for them to return.
Now that "wtap_loop()" can return a success/failure indication and an
error code, in "read_cap_file()" put up a message box if we get an error
reading the file, and return the error code.
Handle the additional errors we can get when opening a capture file.
If the attempt to open a capture file succeeds, but the attempt to read
it fails, don't treat that as a complete failure - we may have managed
to read some of the capture file, and we should display what we managed
to read.
svn path=/trunk/; revision=516
1999-08-19 05:31:38 +00:00
|
|
|
return -1;
|
|
|
|
return 0;
|
1999-02-20 06:49:27 +00:00
|
|
|
}
|
1999-08-28 01:19:45 +00:00
|
|
|
wth->data_offset += sizeof magic;
|
1999-02-20 06:49:27 +00:00
|
|
|
|
2002-05-28 02:39:15 +00:00
|
|
|
if (memcmp(magic, netxray_magic, sizeof magic) == 0) {
|
|
|
|
is_old = FALSE;
|
|
|
|
} else if (memcmp(magic, old_netxray_magic, sizeof magic) == 0) {
|
|
|
|
is_old = TRUE;
|
|
|
|
} else {
|
Have the per-capture-file-type open routines "wtap_open_offline()" calls
return 1 on success, -1 if they got an error, and 0 if the file isn't of
the type that file is checking for, and supply an error code if they
return -1; have "wtap_open_offline()" use that error code. Also, have
the per-capture-file-type open routines treat errors accessing the file
as errors, and return -1, rather than just returning 0 so that we try
another file type.
Have the per-capture-file-type read routines "wtap_loop()" calls return
-1 and supply an error code on error (and not, as they did in some
cases, call "g_error()" and abort), and have "wtap_loop()", if the read
routine returned an error, return FALSE (and pass an error-code-pointer
argument onto the read routines, so they fill it in), and return TRUE on
success.
Add some new error codes for them to return.
Now that "wtap_loop()" can return a success/failure indication and an
error code, in "read_cap_file()" put up a message box if we get an error
reading the file, and return the error code.
Handle the additional errors we can get when opening a capture file.
If the attempt to open a capture file succeeds, but the attempt to read
it fails, don't treat that as a complete failure - we may have managed
to read some of the capture file, and we should display what we managed
to read.
svn path=/trunk/; revision=516
1999-08-19 05:31:38 +00:00
|
|
|
return 0;
|
1999-02-20 06:49:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Read the rest of the header. */
|
Have the per-capture-file-type open routines "wtap_open_offline()" calls
return 1 on success, -1 if they got an error, and 0 if the file isn't of
the type that file is checking for, and supply an error code if they
return -1; have "wtap_open_offline()" use that error code. Also, have
the per-capture-file-type open routines treat errors accessing the file
as errors, and return -1, rather than just returning 0 so that we try
another file type.
Have the per-capture-file-type read routines "wtap_loop()" calls return
-1 and supply an error code on error (and not, as they did in some
cases, call "g_error()" and abort), and have "wtap_loop()", if the read
routine returned an error, return FALSE (and pass an error-code-pointer
argument onto the read routines, so they fill it in), and return TRUE on
success.
Add some new error codes for them to return.
Now that "wtap_loop()" can return a success/failure indication and an
error code, in "read_cap_file()" put up a message box if we get an error
reading the file, and return the error code.
Handle the additional errors we can get when opening a capture file.
If the attempt to open a capture file succeeds, but the attempt to read
it fails, don't treat that as a complete failure - we may have managed
to read some of the capture file, and we should display what we managed
to read.
svn path=/trunk/; revision=516
1999-08-19 05:31:38 +00:00
|
|
|
errno = WTAP_ERR_CANT_READ;
|
1999-09-22 01:26:50 +00:00
|
|
|
bytes_read = file_read(&hdr, 1, sizeof hdr, wth->fh);
|
1999-02-20 06:49:27 +00:00
|
|
|
if (bytes_read != sizeof hdr) {
|
1999-10-05 07:06:08 +00:00
|
|
|
*err = file_error(wth->fh);
|
|
|
|
if (*err != 0)
|
Have the per-capture-file-type open routines "wtap_open_offline()" calls
return 1 on success, -1 if they got an error, and 0 if the file isn't of
the type that file is checking for, and supply an error code if they
return -1; have "wtap_open_offline()" use that error code. Also, have
the per-capture-file-type open routines treat errors accessing the file
as errors, and return -1, rather than just returning 0 so that we try
another file type.
Have the per-capture-file-type read routines "wtap_loop()" calls return
-1 and supply an error code on error (and not, as they did in some
cases, call "g_error()" and abort), and have "wtap_loop()", if the read
routine returned an error, return FALSE (and pass an error-code-pointer
argument onto the read routines, so they fill it in), and return TRUE on
success.
Add some new error codes for them to return.
Now that "wtap_loop()" can return a success/failure indication and an
error code, in "read_cap_file()" put up a message box if we get an error
reading the file, and return the error code.
Handle the additional errors we can get when opening a capture file.
If the attempt to open a capture file succeeds, but the attempt to read
it fails, don't treat that as a complete failure - we may have managed
to read some of the capture file, and we should display what we managed
to read.
svn path=/trunk/; revision=516
1999-08-19 05:31:38 +00:00
|
|
|
return -1;
|
|
|
|
return 0;
|
1999-02-20 06:49:27 +00:00
|
|
|
}
|
1999-08-28 01:19:45 +00:00
|
|
|
wth->data_offset += sizeof hdr;
|
1999-02-20 06:49:27 +00:00
|
|
|
|
2002-05-28 02:39:15 +00:00
|
|
|
if (is_old) {
|
|
|
|
version_major = 0;
|
2003-09-28 23:15:40 +00:00
|
|
|
version_minor = 0;
|
2002-05-28 02:39:15 +00:00
|
|
|
file_type = WTAP_FILE_NETXRAY_OLD;
|
|
|
|
} else {
|
|
|
|
/* It appears that version 1.1 files (as produced by Windows
|
|
|
|
* Sniffer Pro 2.0.01) have the time stamp in microseconds,
|
|
|
|
* rather than the milliseconds version 1.0 files appear to
|
|
|
|
* have.
|
|
|
|
*
|
2003-01-03 02:24:56 +00:00
|
|
|
* It also appears that version 2.00x files have per-packet
|
|
|
|
* headers with some extra fields. */
|
2002-05-28 02:39:15 +00:00
|
|
|
if (memcmp(hdr.version, vers_1_0, sizeof vers_1_0) == 0) {
|
|
|
|
timeunit = 1000.0;
|
|
|
|
version_major = 1;
|
2003-09-28 23:15:40 +00:00
|
|
|
version_minor = 0;
|
2002-05-28 02:39:15 +00:00
|
|
|
file_type = WTAP_FILE_NETXRAY_1_0;
|
|
|
|
} else if (memcmp(hdr.version, vers_1_1, sizeof vers_1_1) == 0) {
|
|
|
|
timeunit = 1000000.0;
|
|
|
|
version_major = 1;
|
2003-09-28 23:15:40 +00:00
|
|
|
version_minor = 1;
|
2002-05-28 02:39:15 +00:00
|
|
|
file_type = WTAP_FILE_NETXRAY_1_1;
|
2003-09-28 23:15:40 +00:00
|
|
|
} else if (memcmp(hdr.version, vers_2_000, sizeof vers_2_000) == 0) {
|
2003-03-28 21:59:12 +00:00
|
|
|
version_major = 2;
|
2003-09-28 23:15:40 +00:00
|
|
|
version_minor = 0;
|
|
|
|
file_type = WTAP_FILE_NETXRAY_2_00x;
|
|
|
|
} else if (memcmp(hdr.version, vers_2_001, sizeof vers_2_001) == 0) {
|
|
|
|
version_major = 2;
|
|
|
|
version_minor = 1;
|
|
|
|
file_type = WTAP_FILE_NETXRAY_2_00x;
|
|
|
|
} else if (memcmp(hdr.version, vers_2_002, sizeof vers_2_002) == 0) {
|
|
|
|
version_major = 2;
|
|
|
|
version_minor = 2;
|
2003-03-28 21:59:12 +00:00
|
|
|
file_type = WTAP_FILE_NETXRAY_2_00x;
|
2002-05-28 02:39:15 +00:00
|
|
|
} else {
|
|
|
|
g_message("netxray: version \"%.8s\" unsupported", hdr.version);
|
2001-05-09 04:42:27 +00:00
|
|
|
*err = WTAP_ERR_UNSUPPORTED;
|
|
|
|
return -1;
|
|
|
|
}
|
1999-02-20 06:49:27 +00:00
|
|
|
}
|
|
|
|
|
2003-07-07 21:08:49 +00:00
|
|
|
switch (hdr.xxz[0]) {
|
|
|
|
|
|
|
|
case 0:
|
|
|
|
/*
|
|
|
|
* The byte after hdr.network is usually 0, in which case
|
|
|
|
* the hdr.network byte is an NDIS network type value - 1.
|
|
|
|
*/
|
|
|
|
network_type = hdr.network + 1;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 2:
|
|
|
|
/*
|
|
|
|
* However, in some Ethernet captures, it's 2, and the
|
|
|
|
* hdr.network byte is 1 rather than 0. We assume
|
|
|
|
* that if there's a byte after hdr.network with the value
|
|
|
|
* 2, the hdr.network byte is an NDIS network type, rather
|
|
|
|
* than an NDIS network type - 1.
|
|
|
|
*/
|
|
|
|
network_type = hdr.network;
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
g_message("netxray: the byte after the network type has the value %u, which I don't understand",
|
|
|
|
hdr.xxz[0]);
|
|
|
|
*err = WTAP_ERR_UNSUPPORTED;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (network_type >= NUM_NETXRAY_ENCAPS
|
|
|
|
|| netxray_encap[network_type] == WTAP_ENCAP_UNKNOWN) {
|
|
|
|
g_message("netxray: network type %u (%u) unknown or unsupported",
|
|
|
|
network_type, hdr.xxz[0]);
|
2000-02-19 08:00:08 +00:00
|
|
|
*err = WTAP_ERR_UNSUPPORTED_ENCAP;
|
Have the per-capture-file-type open routines "wtap_open_offline()" calls
return 1 on success, -1 if they got an error, and 0 if the file isn't of
the type that file is checking for, and supply an error code if they
return -1; have "wtap_open_offline()" use that error code. Also, have
the per-capture-file-type open routines treat errors accessing the file
as errors, and return -1, rather than just returning 0 so that we try
another file type.
Have the per-capture-file-type read routines "wtap_loop()" calls return
-1 and supply an error code on error (and not, as they did in some
cases, call "g_error()" and abort), and have "wtap_loop()", if the read
routine returned an error, return FALSE (and pass an error-code-pointer
argument onto the read routines, so they fill it in), and return TRUE on
success.
Add some new error codes for them to return.
Now that "wtap_loop()" can return a success/failure indication and an
error code, in "read_cap_file()" put up a message box if we get an error
reading the file, and return the error code.
Handle the additional errors we can get when opening a capture file.
If the attempt to open a capture file succeeds, but the attempt to read
it fails, don't treat that as a complete failure - we may have managed
to read some of the capture file, and we should display what we managed
to read.
svn path=/trunk/; revision=516
1999-08-19 05:31:38 +00:00
|
|
|
return -1;
|
1999-03-01 18:57:07 +00:00
|
|
|
}
|
|
|
|
|
2003-07-07 21:08:49 +00:00
|
|
|
/*
|
2003-09-28 23:15:40 +00:00
|
|
|
* Figure out the time stamp units and start time stamp.
|
2003-07-07 21:08:49 +00:00
|
|
|
*/
|
2003-09-28 23:15:40 +00:00
|
|
|
start_timestamp = (double)pletohl(&hdr.timelo)
|
|
|
|
+ (double)pletohl(&hdr.timehi)*4294967296.0;
|
2003-07-07 21:08:49 +00:00
|
|
|
switch (file_type) {
|
|
|
|
|
|
|
|
case WTAP_FILE_NETXRAY_OLD:
|
|
|
|
timeunit = 1000.0;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case WTAP_FILE_NETXRAY_1_0:
|
|
|
|
timeunit = 1000.0;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case WTAP_FILE_NETXRAY_1_1:
|
|
|
|
timeunit = 1000000.0;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case WTAP_FILE_NETXRAY_2_00x:
|
|
|
|
/*
|
|
|
|
* It appears that, at least for Ethernet
|
|
|
|
* captures, if hdr.xxb[20] is 2, that indicates
|
|
|
|
* that it's a gigabit Ethernet capture, possibly
|
|
|
|
* from a special whizzo gigabit pod, and also
|
|
|
|
* indicates that the time stamps have some
|
|
|
|
* higher resolution than in other captures,
|
|
|
|
* possibly thanks to a high-resolution
|
|
|
|
* timer on the pod.
|
2003-09-28 23:15:40 +00:00
|
|
|
*
|
|
|
|
* It also appears that the time units might differ
|
|
|
|
* for gigabit pod captures between version 002.001
|
|
|
|
* and 002.002.
|
2003-07-07 21:08:49 +00:00
|
|
|
*/
|
|
|
|
if (network_type == 1 && hdr.xxb[20] == CAPTYPE_GIGPOD) {
|
2003-09-28 23:15:40 +00:00
|
|
|
if (version_minor == 1) {
|
|
|
|
/*
|
|
|
|
* It appears that the time units for
|
|
|
|
* these captures are nanoseconds, unless
|
|
|
|
* hdr.timeunit is 2, in which case it's
|
|
|
|
* 1/31250000.0 of a second.
|
|
|
|
*/
|
|
|
|
if (hdr.timeunit == 2)
|
|
|
|
timeunit = 31250000.0;
|
|
|
|
else
|
|
|
|
timeunit = 1e9;
|
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* These just seem to be 1000 times
|
|
|
|
* the regular time stamp units, unless
|
|
|
|
* hdr.timeunit is 2, in which case it's
|
|
|
|
* 1/1125000 of a second.
|
|
|
|
*
|
|
|
|
* In addition, the start timestamp
|
|
|
|
* appears to be 0.
|
|
|
|
*/
|
|
|
|
if (hdr.timeunit == 2)
|
|
|
|
timeunit = 1250000.0;
|
|
|
|
else
|
|
|
|
timeunit = TpS[hdr.timeunit]*1000.0;
|
|
|
|
start_timestamp = 0.0;
|
|
|
|
}
|
2003-07-07 21:08:49 +00:00
|
|
|
} else {
|
|
|
|
if (hdr.timeunit > NUM_NETXRAY_TIMEUNITS) {
|
|
|
|
g_message("netxray: Unknown timeunit %u",
|
|
|
|
hdr.timeunit);
|
|
|
|
*err = WTAP_ERR_UNSUPPORTED;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
timeunit = TpS[hdr.timeunit];
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
g_assert_not_reached();
|
|
|
|
timeunit = 0.0;
|
|
|
|
}
|
2003-09-28 23:15:40 +00:00
|
|
|
start_timestamp = start_timestamp/timeunit;
|
2003-07-07 21:08:49 +00:00
|
|
|
|
|
|
|
if (network_type == 4) {
|
2002-10-29 06:12:35 +00:00
|
|
|
/*
|
|
|
|
* In version 0 and 1, we assume, for now, that all
|
|
|
|
* WAN captures have frames that look like Ethernet
|
|
|
|
* frames (as a result, presumably, of having passed
|
|
|
|
* through NDISWAN).
|
|
|
|
*
|
2003-01-03 07:51:26 +00:00
|
|
|
* In version 2, it looks as if there's stuff in the "xxb"
|
2002-10-29 06:12:35 +00:00
|
|
|
* words of the file header to specify what particular
|
2003-03-03 23:29:59 +00:00
|
|
|
* type of WAN capture we have.
|
2002-10-29 06:12:35 +00:00
|
|
|
*/
|
2003-01-03 07:51:26 +00:00
|
|
|
if (version_major == 2) {
|
|
|
|
switch (hdr.xxb[20]) {
|
|
|
|
|
2003-03-03 23:29:59 +00:00
|
|
|
case CAPTYPE_PPP:
|
|
|
|
/*
|
|
|
|
* PPP.
|
|
|
|
*/
|
|
|
|
file_encap = WTAP_ENCAP_PPP_WITH_PHDR;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case CAPTYPE_FRELAY:
|
2003-01-03 07:51:26 +00:00
|
|
|
/*
|
|
|
|
* Frame Relay.
|
|
|
|
*/
|
2003-01-31 01:02:14 +00:00
|
|
|
file_encap = WTAP_ENCAP_FRELAY_WITH_PHDR;
|
2003-01-03 07:51:26 +00:00
|
|
|
break;
|
|
|
|
|
2003-03-03 23:29:59 +00:00
|
|
|
case CAPTYPE_HDLC:
|
|
|
|
case CAPTYPE_HDLC2:
|
2003-01-03 07:51:26 +00:00
|
|
|
/*
|
|
|
|
* Various HDLC flavors?
|
|
|
|
*/
|
|
|
|
switch (hdr.xxb[28]) {
|
|
|
|
|
|
|
|
case 0: /* LAPB/X.25 */
|
|
|
|
file_encap = WTAP_ENCAP_LAPB;
|
|
|
|
break;
|
|
|
|
|
2003-01-07 01:06:58 +00:00
|
|
|
case 1: /* E1 PRI */
|
|
|
|
case 2: /* T1 PRI */
|
2003-01-03 07:51:26 +00:00
|
|
|
case 3: /* BRI */
|
|
|
|
file_encap = WTAP_ENCAP_ISDN;
|
2003-01-07 01:06:58 +00:00
|
|
|
isdn_type = hdr.xxb[28];
|
2003-01-03 07:51:26 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
g_message("netxray: WAN HDLC capture subsubtype 0x%02x unknown or unsupported",
|
|
|
|
hdr.xxb[28]);
|
|
|
|
*err = WTAP_ERR_UNSUPPORTED_ENCAP;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
2003-03-03 23:29:59 +00:00
|
|
|
case CAPTYPE_SDLC:
|
|
|
|
/*
|
|
|
|
* SDLC.
|
|
|
|
*/
|
|
|
|
file_encap = WTAP_ENCAP_SDLC;
|
|
|
|
break;
|
|
|
|
|
2003-01-03 07:51:26 +00:00
|
|
|
default:
|
|
|
|
g_message("netxray: WAN capture subtype 0x%02x unknown or unsupported",
|
|
|
|
hdr.xxb[20]);
|
|
|
|
*err = WTAP_ERR_UNSUPPORTED_ENCAP;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
} else
|
|
|
|
file_encap = WTAP_ENCAP_ETHERNET;
|
2002-10-29 06:12:35 +00:00
|
|
|
} else
|
2003-07-07 21:08:49 +00:00
|
|
|
file_encap = netxray_encap[network_type];
|
2003-01-03 07:51:26 +00:00
|
|
|
|
|
|
|
/* This is a netxray file */
|
|
|
|
wth->file_type = file_type;
|
|
|
|
wth->capture.netxray = g_malloc(sizeof(netxray_t));
|
|
|
|
wth->subtype_read = netxray_read;
|
|
|
|
wth->subtype_seek_read = netxray_seek_read;
|
|
|
|
wth->subtype_close = netxray_close;
|
|
|
|
wth->file_encap = file_encap;
|
Have Wiretap set the snapshot length to 0 if it can't be derived from
reading the capture file. Have callers of "wtap_snapshot_length()"
treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so
that, when writing a capture file in a format that *does* store the
snapshot length, we can at least put *something* in the file).
If we don't know the snapshot length of the current capture file, don't
display a value in the summary window.
Don't use "cfile.snap" as the snapshot length option when capturing -
doing so causes Ethereal to default, when capturing, to the snapshot
length of the last capture file that you read in, rather than to the
snapshot length of the last capture you did (or the initial default of
"no snapshot length").
Redo the "Capture Options" dialog box to group options into sections
with frames around them, and add units to the snapshot length, maximum
file size, and capture duration options, as per a suggestion by Ulf
Lamping. Also add units to the capture count option.
Make the snapshot length, capture count, maximum file size, and capture
duration options into a combination of a check box and a spin button.
If the check box is not checked, the limit in question is inactive
(snapshot length of 65535, no max packet count, no max file size, no max
capture duration); if it's checked, the spinbox specifies the limit.
Default all of the check boxes to "not checked" and all of the spin
boxes to small values.
Use "gtk_toggle_button_get_active()" rather than directly fetching the
state of a check box.
svn path=/trunk/; revision=4709
2002-02-08 10:07:41 +00:00
|
|
|
wth->snapshot_length = 0; /* not available in header */
|
1999-03-01 22:59:47 +00:00
|
|
|
wth->capture.netxray->start_time = pletohl(&hdr.start_time);
|
1999-02-20 06:49:27 +00:00
|
|
|
wth->capture.netxray->timeunit = timeunit;
|
2003-09-28 23:15:40 +00:00
|
|
|
wth->capture.netxray->start_timestamp = start_timestamp;
|
1999-03-20 09:10:49 +00:00
|
|
|
wth->capture.netxray->version_major = version_major;
|
2002-04-07 21:29:01 +00:00
|
|
|
|
|
|
|
/*
|
2003-10-01 07:11:49 +00:00
|
|
|
* If frames have an extra 4 bytes of stuff at the end, is
|
|
|
|
* it an FCS, or just junk?
|
2002-04-07 21:29:01 +00:00
|
|
|
*/
|
2003-10-01 07:11:49 +00:00
|
|
|
wth->capture.netxray->fcs_valid = FALSE;
|
2003-01-07 07:16:24 +00:00
|
|
|
switch (file_encap) {
|
|
|
|
|
2003-10-01 07:11:49 +00:00
|
|
|
case WTAP_ENCAP_ETHERNET:
|
2003-01-07 07:16:24 +00:00
|
|
|
case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
|
|
|
|
/*
|
2003-10-01 07:11:49 +00:00
|
|
|
* It appears that, in at least some version 2 Ethernet
|
|
|
|
* captures, for frames that have 0xff in hdr_2_x.xxx[2]
|
|
|
|
* and hdr_2_x.xxx[3] in the per-packet header:
|
|
|
|
*
|
|
|
|
* if, in the file header, hdr.xxb[13] is 0x34 and
|
|
|
|
* hdr.xxb[14] is 0x12, the frames have an FCS at
|
|
|
|
* the end;
|
|
|
|
*
|
|
|
|
* otherwise, they have 4 bytes of junk at the end.
|
|
|
|
*
|
|
|
|
* For now, we assume that to be true for 802.11 captures
|
|
|
|
* as well; it appears to be the case for at least one
|
|
|
|
* such capture.
|
2003-01-07 07:16:24 +00:00
|
|
|
*/
|
2003-10-01 07:11:49 +00:00
|
|
|
if (version_major == 2) {
|
|
|
|
if (hdr.xxb[13] == 0x34 && hdr.xxb[14] == 0x12)
|
|
|
|
wth->capture.netxray->fcs_valid = TRUE;
|
|
|
|
}
|
2003-01-07 07:16:24 +00:00
|
|
|
break;
|
|
|
|
}
|
1999-02-20 06:49:27 +00:00
|
|
|
|
2003-01-07 01:06:58 +00:00
|
|
|
/*
|
|
|
|
* Remember the ISDN type, as we need it to interpret the
|
|
|
|
* channel number in ISDN captures.
|
|
|
|
*/
|
|
|
|
wth->capture.netxray->isdn_type = isdn_type;
|
|
|
|
|
1999-03-01 18:57:07 +00:00
|
|
|
/* Remember the offset after the last packet in the capture (which
|
|
|
|
* isn't necessarily the last packet in the file), as it appears
|
|
|
|
* there's sometimes crud after it. */
|
2002-04-08 09:09:49 +00:00
|
|
|
wth->capture.netxray->wrapped = FALSE;
|
1999-03-01 18:57:07 +00:00
|
|
|
wth->capture.netxray->end_offset = pletohl(&hdr.end_offset);
|
|
|
|
|
1999-02-20 06:49:27 +00:00
|
|
|
/* Seek to the beginning of the data records. */
|
2002-06-07 07:27:35 +00:00
|
|
|
if (file_seek(wth->fh, pletohl(&hdr.start_offset), SEEK_SET, err) == -1) {
|
2002-03-04 00:25:35 +00:00
|
|
|
g_free(wth->capture.netxray);
|
|
|
|
return -1;
|
2002-08-28 20:30:45 +00:00
|
|
|
}
|
1999-08-28 01:19:45 +00:00
|
|
|
wth->data_offset = pletohl(&hdr.start_offset);
|
1999-02-20 06:49:27 +00:00
|
|
|
|
Have the per-capture-file-type open routines "wtap_open_offline()" calls
return 1 on success, -1 if they got an error, and 0 if the file isn't of
the type that file is checking for, and supply an error code if they
return -1; have "wtap_open_offline()" use that error code. Also, have
the per-capture-file-type open routines treat errors accessing the file
as errors, and return -1, rather than just returning 0 so that we try
another file type.
Have the per-capture-file-type read routines "wtap_loop()" calls return
-1 and supply an error code on error (and not, as they did in some
cases, call "g_error()" and abort), and have "wtap_loop()", if the read
routine returned an error, return FALSE (and pass an error-code-pointer
argument onto the read routines, so they fill it in), and return TRUE on
success.
Add some new error codes for them to return.
Now that "wtap_loop()" can return a success/failure indication and an
error code, in "read_cap_file()" put up a message box if we get an error
reading the file, and return the error code.
Handle the additional errors we can get when opening a capture file.
If the attempt to open a capture file succeeds, but the attempt to read
it fails, don't treat that as a complete failure - we may have managed
to read some of the capture file, and we should display what we managed
to read.
svn path=/trunk/; revision=516
1999-08-19 05:31:38 +00:00
|
|
|
return 1;
|
1999-02-20 06:49:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Read the next packet */
|
2001-10-04 08:30:36 +00:00
|
|
|
static gboolean netxray_read(wtap *wth, int *err, long *data_offset)
|
1999-02-20 06:49:27 +00:00
|
|
|
{
|
2002-04-07 21:29:01 +00:00
|
|
|
guint32 packet_size;
|
2002-04-08 09:09:49 +00:00
|
|
|
union netxrayrec_hdr hdr;
|
|
|
|
int hdr_size;
|
1999-02-20 06:49:27 +00:00
|
|
|
double t;
|
2003-01-07 06:09:08 +00:00
|
|
|
guint8 *pd;
|
2003-10-01 07:11:49 +00:00
|
|
|
guint padding;
|
1999-02-20 06:49:27 +00:00
|
|
|
|
1999-03-01 18:57:07 +00:00
|
|
|
reread:
|
|
|
|
/* Have we reached the end of the packet data? */
|
1999-08-28 01:19:45 +00:00
|
|
|
if (wth->data_offset == wth->capture.netxray->end_offset) {
|
1999-03-01 18:57:07 +00:00
|
|
|
/* Yes. */
|
2000-11-19 03:47:36 +00:00
|
|
|
*err = 0; /* it's just an EOF, not an error */
|
2000-09-07 05:34:23 +00:00
|
|
|
return FALSE;
|
1999-03-01 18:57:07 +00:00
|
|
|
}
|
1999-02-20 06:49:27 +00:00
|
|
|
/* Read record header. */
|
2002-04-08 09:09:49 +00:00
|
|
|
hdr_size = netxray_read_rec_header(wth, wth->fh, &hdr, err);
|
|
|
|
if (hdr_size == 0) {
|
|
|
|
/*
|
|
|
|
* Error or EOF.
|
|
|
|
*/
|
|
|
|
if (*err != 0) {
|
|
|
|
/*
|
|
|
|
* Error of some sort; give up.
|
|
|
|
*/
|
2000-09-07 05:34:23 +00:00
|
|
|
return FALSE;
|
1999-02-20 06:49:27 +00:00
|
|
|
}
|
1999-03-01 18:57:07 +00:00
|
|
|
|
|
|
|
/* We're at EOF. Wrap? */
|
|
|
|
if (!wth->capture.netxray->wrapped) {
|
|
|
|
/* Yes. Remember that we did. */
|
2002-04-08 09:09:49 +00:00
|
|
|
wth->capture.netxray->wrapped = TRUE;
|
2002-03-04 00:25:35 +00:00
|
|
|
if (file_seek(wth->fh, CAPTUREFILE_HEADER_SIZE,
|
2002-06-07 07:27:35 +00:00
|
|
|
SEEK_SET, err) == -1)
|
2002-03-04 00:25:35 +00:00
|
|
|
return FALSE;
|
1999-08-28 01:19:45 +00:00
|
|
|
wth->data_offset = CAPTUREFILE_HEADER_SIZE;
|
1999-03-01 18:57:07 +00:00
|
|
|
goto reread;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* We've already wrapped - don't wrap again. */
|
2000-09-07 05:34:23 +00:00
|
|
|
return FALSE;
|
1999-02-20 06:49:27 +00:00
|
|
|
}
|
2002-04-08 09:09:49 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Return the offset of the record header, so we can reread it
|
|
|
|
* if we go back to this frame.
|
|
|
|
*/
|
|
|
|
*data_offset = wth->data_offset;
|
1999-08-28 01:19:45 +00:00
|
|
|
wth->data_offset += hdr_size;
|
1999-02-20 06:49:27 +00:00
|
|
|
|
2002-04-08 09:09:49 +00:00
|
|
|
/*
|
|
|
|
* Read the packet data.
|
|
|
|
*/
|
2002-05-28 02:39:15 +00:00
|
|
|
if (wth->capture.netxray->version_major == 0)
|
|
|
|
packet_size = pletohs(&hdr.old_hdr.len);
|
|
|
|
else
|
|
|
|
packet_size = pletohs(&hdr.hdr_1_x.incl_len);
|
2002-04-07 21:29:01 +00:00
|
|
|
buffer_assure_space(wth->frame_buffer, packet_size);
|
2003-01-07 06:09:08 +00:00
|
|
|
pd = buffer_start_ptr(wth->frame_buffer);
|
|
|
|
if (!netxray_read_rec_data(wth->fh, pd, packet_size, err))
|
2000-09-07 05:34:23 +00:00
|
|
|
return FALSE;
|
1999-08-28 01:19:45 +00:00
|
|
|
wth->data_offset += packet_size;
|
1999-02-20 06:49:27 +00:00
|
|
|
|
2002-04-08 09:09:49 +00:00
|
|
|
/*
|
|
|
|
* Set the pseudo-header.
|
|
|
|
*/
|
2003-10-01 07:11:49 +00:00
|
|
|
padding = netxray_set_pseudo_header(wth, pd, packet_size,
|
|
|
|
&wth->pseudo_header, &hdr);
|
2002-04-08 09:09:49 +00:00
|
|
|
|
2002-05-28 02:39:15 +00:00
|
|
|
if (wth->capture.netxray->version_major == 0) {
|
|
|
|
t = (double)pletohl(&hdr.old_hdr.timelo)
|
|
|
|
+ (double)pletohl(&hdr.old_hdr.timehi)*4294967296.0;
|
|
|
|
t /= wth->capture.netxray->timeunit;
|
|
|
|
t -= wth->capture.netxray->start_timestamp;
|
|
|
|
wth->phdr.ts.tv_sec = wth->capture.netxray->start_time + (long)t;
|
|
|
|
wth->phdr.ts.tv_usec = (unsigned long)((t-(double)(unsigned long)(t))
|
|
|
|
*1.0e6);
|
|
|
|
/*
|
|
|
|
* We subtract the padding from the packet size, so our caller
|
|
|
|
* doesn't see it.
|
|
|
|
*/
|
2003-10-01 07:11:49 +00:00
|
|
|
wth->phdr.caplen = packet_size - padding;
|
2002-05-28 02:39:15 +00:00
|
|
|
wth->phdr.len = wth->phdr.caplen;
|
|
|
|
} else {
|
|
|
|
t = (double)pletohl(&hdr.hdr_1_x.timelo)
|
|
|
|
+ (double)pletohl(&hdr.hdr_1_x.timehi)*4294967296.0;
|
|
|
|
t /= wth->capture.netxray->timeunit;
|
|
|
|
t -= wth->capture.netxray->start_timestamp;
|
|
|
|
wth->phdr.ts.tv_sec = wth->capture.netxray->start_time + (long)t;
|
|
|
|
wth->phdr.ts.tv_usec = (unsigned long)((t-(double)(unsigned long)(t))
|
|
|
|
*1.0e6);
|
|
|
|
/*
|
|
|
|
* We subtract the padding from the packet size, so our caller
|
|
|
|
* doesn't see it.
|
|
|
|
*/
|
2003-10-01 07:11:49 +00:00
|
|
|
wth->phdr.caplen = packet_size - padding;
|
|
|
|
wth->phdr.len = pletohs(&hdr.hdr_1_x.orig_len) - padding;
|
2002-05-28 02:39:15 +00:00
|
|
|
}
|
2002-10-31 07:12:42 +00:00
|
|
|
wth->phdr.pkt_encap = wth->file_encap;
|
1999-02-20 06:49:27 +00:00
|
|
|
|
2000-09-07 05:34:23 +00:00
|
|
|
return TRUE;
|
1999-02-20 06:49:27 +00:00
|
|
|
}
|
1999-12-14 01:12:59 +00:00
|
|
|
|
2002-04-08 09:09:49 +00:00
|
|
|
static gboolean
|
|
|
|
netxray_seek_read(wtap *wth, long seek_off,
|
2002-07-29 06:09:59 +00:00
|
|
|
union wtap_pseudo_header *pseudo_header, guchar *pd, int length, int *err)
|
2002-04-08 09:09:49 +00:00
|
|
|
{
|
|
|
|
union netxrayrec_hdr hdr;
|
2003-01-07 06:09:08 +00:00
|
|
|
gboolean ret;
|
2002-04-08 09:09:49 +00:00
|
|
|
|
2002-06-07 07:27:35 +00:00
|
|
|
if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
|
2002-04-08 09:09:49 +00:00
|
|
|
return FALSE;
|
|
|
|
|
|
|
|
if (!netxray_read_rec_header(wth, wth->random_fh, &hdr, err)) {
|
|
|
|
if (*err == 0) {
|
|
|
|
/*
|
|
|
|
* EOF - we report that as a short read, as
|
|
|
|
* we've read this once and know that it
|
|
|
|
* should be there.
|
|
|
|
*/
|
|
|
|
*err = WTAP_ERR_SHORT_READ;
|
|
|
|
}
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2003-01-07 06:09:08 +00:00
|
|
|
* Read the packet data.
|
2002-04-08 09:09:49 +00:00
|
|
|
*/
|
2003-01-07 06:09:08 +00:00
|
|
|
ret = netxray_read_rec_data(wth->random_fh, pd, length, err);
|
|
|
|
if (!ret)
|
|
|
|
return FALSE;
|
2003-10-01 07:11:49 +00:00
|
|
|
|
2002-04-08 09:09:49 +00:00
|
|
|
/*
|
2003-01-07 06:09:08 +00:00
|
|
|
* Set the pseudo-header.
|
2002-04-08 09:09:49 +00:00
|
|
|
*/
|
2003-01-07 06:09:08 +00:00
|
|
|
netxray_set_pseudo_header(wth, pd, length, pseudo_header, &hdr);
|
|
|
|
return TRUE;
|
2002-04-08 09:09:49 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
netxray_read_rec_header(wtap *wth, FILE_T fh, union netxrayrec_hdr *hdr,
|
|
|
|
int *err)
|
|
|
|
{
|
|
|
|
int bytes_read;
|
|
|
|
int hdr_size = 0;
|
|
|
|
|
|
|
|
/* Read record header. */
|
|
|
|
switch (wth->capture.netxray->version_major) {
|
|
|
|
|
2002-05-28 02:39:15 +00:00
|
|
|
case 0:
|
|
|
|
hdr_size = sizeof (struct old_netxrayrec_hdr);
|
|
|
|
break;
|
|
|
|
|
2002-04-08 09:09:49 +00:00
|
|
|
case 1:
|
|
|
|
hdr_size = sizeof (struct netxrayrec_1_x_hdr);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 2:
|
|
|
|
hdr_size = sizeof (struct netxrayrec_2_x_hdr);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
errno = WTAP_ERR_CANT_READ;
|
|
|
|
bytes_read = file_read(hdr, 1, hdr_size, fh);
|
|
|
|
if (bytes_read != hdr_size) {
|
|
|
|
*err = file_error(wth->fh);
|
|
|
|
if (*err != 0)
|
|
|
|
return 0;
|
|
|
|
if (bytes_read != 0) {
|
|
|
|
*err = WTAP_ERR_SHORT_READ;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* We're at EOF. "*err" is 0; we return FALSE - that
|
|
|
|
* combination tells our caller we're at EOF.
|
|
|
|
*/
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
return hdr_size;
|
|
|
|
}
|
|
|
|
|
2003-10-01 07:11:49 +00:00
|
|
|
static guint
|
2003-01-07 06:09:08 +00:00
|
|
|
netxray_set_pseudo_header(wtap *wth, const guint8 *pd, int len,
|
|
|
|
union wtap_pseudo_header *pseudo_header, union netxrayrec_hdr *hdr)
|
2002-04-08 09:09:49 +00:00
|
|
|
{
|
2003-10-01 07:11:49 +00:00
|
|
|
guint padding = 0;
|
|
|
|
|
2002-04-08 09:09:49 +00:00
|
|
|
/*
|
2003-10-01 07:11:49 +00:00
|
|
|
* If this is Ethernet, 802.11, ISDN, X.25, or ATM, set the
|
|
|
|
* pseudo-header.
|
2002-04-08 09:09:49 +00:00
|
|
|
*/
|
2003-10-01 07:11:49 +00:00
|
|
|
switch (wth->capture.netxray->version_major) {
|
|
|
|
|
|
|
|
case 1:
|
|
|
|
switch (wth->file_encap) {
|
|
|
|
|
|
|
|
case WTAP_ENCAP_ETHERNET:
|
|
|
|
/*
|
|
|
|
* XXX - if hdr->hdr_1_x.xxx[15] is 1
|
|
|
|
* the frame appears not to have any extra
|
|
|
|
* stuff at the end, but if it's 0,
|
|
|
|
* there appears to be 4 bytes of stuff
|
|
|
|
* at the end, but it's not an FCS.
|
|
|
|
*
|
|
|
|
* Or is that just the low-order bit?
|
|
|
|
*
|
|
|
|
* For now, we just say "no FCS".
|
|
|
|
*/
|
|
|
|
pseudo_header->eth.fcs_len = 0;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 2:
|
2002-10-29 06:12:35 +00:00
|
|
|
switch (wth->file_encap) {
|
|
|
|
|
2003-10-01 07:11:49 +00:00
|
|
|
case WTAP_ENCAP_ETHERNET:
|
|
|
|
/*
|
|
|
|
* It appears, at least with version 2 captures,
|
|
|
|
* that we have 4 bytes of stuff (which might be
|
|
|
|
* a valid FCS or might be junk) at the end of
|
|
|
|
* the packet if hdr->hdr_2_x.xxx[2] and
|
|
|
|
* hdr->hdr_2_x.xxx[3] are 0xff, and we don't if
|
|
|
|
* they don't.
|
|
|
|
*
|
|
|
|
* It also appears that if the low-order bit of
|
|
|
|
* hdr->hdr_2_x.xxx[8] is set, the packet has a
|
|
|
|
* bad FCS.
|
|
|
|
*/
|
|
|
|
if (hdr->hdr_2_x.xxx[2] == 0xff &&
|
|
|
|
hdr->hdr_2_x.xxx[3] == 0xff) {
|
|
|
|
/*
|
|
|
|
* We have 4 bytes of stuff at the
|
|
|
|
* end of the frame - FCS, or junk?
|
|
|
|
*/
|
|
|
|
if (wth->capture.netxray->fcs_valid) {
|
|
|
|
/*
|
|
|
|
* FCS.
|
|
|
|
*/
|
|
|
|
pseudo_header->eth.fcs_len = 4;
|
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* Junk.
|
|
|
|
*/
|
|
|
|
padding = 4;
|
|
|
|
}
|
|
|
|
} else
|
|
|
|
pseudo_header->eth.fcs_len = 0;
|
|
|
|
break;
|
|
|
|
|
2002-10-29 06:12:35 +00:00
|
|
|
case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
|
|
|
|
pseudo_header->ieee_802_11.channel =
|
|
|
|
hdr->hdr_2_x.xxx[12];
|
|
|
|
pseudo_header->ieee_802_11.data_rate =
|
|
|
|
hdr->hdr_2_x.xxx[13];
|
|
|
|
pseudo_header->ieee_802_11.signal_level =
|
|
|
|
hdr->hdr_2_x.xxx[14];
|
2003-10-01 07:11:49 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* It appears, in one 802.11 capture, that
|
|
|
|
* we have 4 bytes of junk at the ends of
|
|
|
|
* frames in which hdr->hdr_2_x.xxx[2] and
|
|
|
|
* hdr->hdr_2_x.xxx[3] are 0xff; we assume
|
|
|
|
* for now that it works like Ethernet.
|
|
|
|
*/
|
|
|
|
if (hdr->hdr_2_x.xxx[2] == 0xff &&
|
|
|
|
hdr->hdr_2_x.xxx[3] == 0xff) {
|
|
|
|
/*
|
|
|
|
* We have 4 bytes of stuff at the
|
|
|
|
* end of the frame - FCS, or junk?
|
|
|
|
*/
|
|
|
|
if (wth->capture.netxray->fcs_valid) {
|
|
|
|
/*
|
|
|
|
* FCS.
|
|
|
|
*/
|
|
|
|
pseudo_header->eth.fcs_len = 4;
|
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* Junk.
|
|
|
|
*/
|
|
|
|
padding = 4;
|
|
|
|
}
|
|
|
|
} else
|
|
|
|
pseudo_header->eth.fcs_len = 0;
|
2002-10-29 06:12:35 +00:00
|
|
|
break;
|
|
|
|
|
2002-10-31 07:12:42 +00:00
|
|
|
case WTAP_ENCAP_ISDN:
|
2002-10-29 06:12:35 +00:00
|
|
|
/*
|
|
|
|
* ISDN.
|
2002-10-31 07:12:42 +00:00
|
|
|
*
|
2003-01-07 02:21:38 +00:00
|
|
|
* The bottommost bit of byte 12 of "hdr.hdr_2_x.xxx"
|
|
|
|
* is the direction flag.
|
2003-01-03 08:00:51 +00:00
|
|
|
*
|
2003-01-07 01:11:34 +00:00
|
|
|
* The bottom 5 bits of byte 13 of "hdr.hdr_2_x.xxx"
|
|
|
|
* are the channel number, but some mapping is
|
2003-01-07 06:09:08 +00:00
|
|
|
* required for PRI. (Is it really just the time
|
|
|
|
* slot?)
|
2002-10-29 06:12:35 +00:00
|
|
|
*/
|
2002-10-31 07:12:42 +00:00
|
|
|
pseudo_header->isdn.uton =
|
2003-01-07 02:21:38 +00:00
|
|
|
(hdr->hdr_2_x.xxx[12] & 0x01);
|
2002-10-31 07:12:42 +00:00
|
|
|
pseudo_header->isdn.channel =
|
|
|
|
hdr->hdr_2_x.xxx[13] & 0x1F;
|
2003-01-07 01:06:58 +00:00
|
|
|
switch (wth->capture.netxray->isdn_type) {
|
|
|
|
|
|
|
|
case 1:
|
|
|
|
/*
|
|
|
|
* E1 PRI. Channel numbers 0 and 16
|
|
|
|
* are the D channel; channel numbers 1
|
|
|
|
* through 15 are B1 through B15; channel
|
|
|
|
* numbers 17 through 31 are B16 through
|
|
|
|
* B31.
|
|
|
|
*/
|
|
|
|
if (pseudo_header->isdn.channel == 16)
|
|
|
|
pseudo_header->isdn.channel = 0;
|
|
|
|
else if (pseudo_header->isdn.channel > 16)
|
|
|
|
pseudo_header->isdn.channel -= 1;
|
2003-10-01 07:11:49 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* PRI captures appear to have 4 bytes of
|
|
|
|
* stuff at the end - FCS, or padding?
|
|
|
|
*/
|
|
|
|
padding = 4;
|
2003-01-07 01:06:58 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case 2:
|
|
|
|
/*
|
|
|
|
* T1 PRI. Channel numbers 0 and 24
|
|
|
|
* are the D channel; channel numbers 1
|
|
|
|
* through 23 are B1 through B23.
|
|
|
|
*/
|
|
|
|
if (pseudo_header->isdn.channel == 24)
|
|
|
|
pseudo_header->isdn.channel = 0;
|
|
|
|
else if (pseudo_header->isdn.channel > 24)
|
|
|
|
pseudo_header->isdn.channel -= 1;
|
2003-10-01 07:11:49 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* PRI captures appear to have 4 bytes of
|
|
|
|
* stuff at the end - FCS, or padding?
|
|
|
|
*/
|
|
|
|
padding = 4;
|
2003-01-07 01:06:58 +00:00
|
|
|
break;
|
|
|
|
}
|
2002-10-29 06:12:35 +00:00
|
|
|
break;
|
Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not just
used for the DOS-based ATM Sniffer. (That's not a great name, but I
couldn't think of a better one.)
Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture
files where reassembled frames don't have trailers, such as the AAL5
trailer, chopped off. That's what at least some versions of the
Windows-based ATM Sniffer appear to have.
Map the ATM capture file type for NetXRay captures to
WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've
reverse-engineered, so far, for the pseudo-header; there's more that
needs to be done on it, e.g. getting the channel, AAL type, and traffic
type (or inferring them if they're not in the packet header).
svn path=/trunk/; revision=6840
2003-01-03 06:45:45 +00:00
|
|
|
|
2003-01-07 02:21:38 +00:00
|
|
|
case WTAP_ENCAP_LAPB:
|
2003-01-31 01:02:14 +00:00
|
|
|
case WTAP_ENCAP_FRELAY_WITH_PHDR:
|
2003-01-07 02:21:38 +00:00
|
|
|
/*
|
2003-01-31 01:02:14 +00:00
|
|
|
* LAPB/X.25 and Frame Relay.
|
2003-01-07 02:21:38 +00:00
|
|
|
*
|
|
|
|
* The bottommost bit of byte 12 of "hdr.hdr_2_x.xxx"
|
|
|
|
* is the direction flag. (Probably true for other
|
|
|
|
* HDLC encapsulations as well.)
|
|
|
|
*/
|
|
|
|
pseudo_header->x25.flags =
|
|
|
|
(hdr->hdr_2_x.xxx[12] & 0x01) ? 0x00 : FROM_DCE;
|
|
|
|
break;
|
|
|
|
|
2003-03-03 23:29:59 +00:00
|
|
|
case WTAP_ENCAP_PPP_WITH_PHDR:
|
2003-03-04 02:04:00 +00:00
|
|
|
case WTAP_ENCAP_SDLC:
|
2003-03-03 23:29:59 +00:00
|
|
|
pseudo_header->p2p.sent =
|
|
|
|
(hdr->hdr_2_x.xxx[12] & 0x01) ? TRUE : FALSE;
|
|
|
|
break;
|
|
|
|
|
Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not just
used for the DOS-based ATM Sniffer. (That's not a great name, but I
couldn't think of a better one.)
Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture
files where reassembled frames don't have trailers, such as the AAL5
trailer, chopped off. That's what at least some versions of the
Windows-based ATM Sniffer appear to have.
Map the ATM capture file type for NetXRay captures to
WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've
reverse-engineered, so far, for the pseudo-header; there's more that
needs to be done on it, e.g. getting the channel, AAL type, and traffic
type (or inferring them if they're not in the packet header).
svn path=/trunk/; revision=6840
2003-01-03 06:45:45 +00:00
|
|
|
case WTAP_ENCAP_ATM_PDUS_UNTRUNCATED:
|
2003-01-10 04:04:42 +00:00
|
|
|
pseudo_header->atm.flags = 0;
|
|
|
|
/*
|
|
|
|
* XXX - is 0x08 an "OAM cell" flag?
|
|
|
|
*/
|
|
|
|
if (hdr->hdr_2_x.xxx[9] & 0x04)
|
|
|
|
pseudo_header->atm.flags |= ATM_RAW_CELL;
|
Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not just
used for the DOS-based ATM Sniffer. (That's not a great name, but I
couldn't think of a better one.)
Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture
files where reassembled frames don't have trailers, such as the AAL5
trailer, chopped off. That's what at least some versions of the
Windows-based ATM Sniffer appear to have.
Map the ATM capture file type for NetXRay captures to
WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've
reverse-engineered, so far, for the pseudo-header; there's more that
needs to be done on it, e.g. getting the channel, AAL type, and traffic
type (or inferring them if they're not in the packet header).
svn path=/trunk/; revision=6840
2003-01-03 06:45:45 +00:00
|
|
|
pseudo_header->atm.vpi = hdr->hdr_2_x.xxx[11];
|
|
|
|
pseudo_header->atm.vci = pletohs(&hdr->hdr_2_x.xxx[12]);
|
2003-01-07 06:09:08 +00:00
|
|
|
pseudo_header->atm.channel =
|
2003-01-09 01:55:13 +00:00
|
|
|
(hdr->hdr_2_x.xxx[15] & 0x10)? 1 : 0;
|
Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not just
used for the DOS-based ATM Sniffer. (That's not a great name, but I
couldn't think of a better one.)
Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture
files where reassembled frames don't have trailers, such as the AAL5
trailer, chopped off. That's what at least some versions of the
Windows-based ATM Sniffer appear to have.
Map the ATM capture file type for NetXRay captures to
WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've
reverse-engineered, so far, for the pseudo-header; there's more that
needs to be done on it, e.g. getting the channel, AAL type, and traffic
type (or inferring them if they're not in the packet header).
svn path=/trunk/; revision=6840
2003-01-03 06:45:45 +00:00
|
|
|
pseudo_header->atm.cells = 0;
|
|
|
|
|
2003-01-07 06:09:08 +00:00
|
|
|
switch (hdr->hdr_2_x.xxx[0] & 0xF0) {
|
|
|
|
|
|
|
|
case 0x00: /* Unknown */
|
|
|
|
/*
|
|
|
|
* Infer the AAL, traffic type, and subtype.
|
|
|
|
*/
|
|
|
|
atm_guess_traffic_type(pd, len,
|
|
|
|
pseudo_header);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 0x50: /* AAL5 (including signalling) */
|
|
|
|
pseudo_header->atm.aal = AAL_5;
|
|
|
|
switch (hdr->hdr_2_x.xxx[0] & 0x0F) {
|
|
|
|
|
|
|
|
case 0x09:
|
|
|
|
case 0x0a: /* Signalling traffic */
|
Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not just
used for the DOS-based ATM Sniffer. (That's not a great name, but I
couldn't think of a better one.)
Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture
files where reassembled frames don't have trailers, such as the AAL5
trailer, chopped off. That's what at least some versions of the
Windows-based ATM Sniffer appear to have.
Map the ATM capture file type for NetXRay captures to
WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've
reverse-engineered, so far, for the pseudo-header; there's more that
needs to be done on it, e.g. getting the channel, AAL type, and traffic
type (or inferring them if they're not in the packet header).
svn path=/trunk/; revision=6840
2003-01-03 06:45:45 +00:00
|
|
|
pseudo_header->atm.aal = AAL_SIGNALLING;
|
2003-01-07 06:09:08 +00:00
|
|
|
pseudo_header->atm.type = TRAF_UNKNOWN;
|
|
|
|
pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 0x0b: /* ILMI */
|
Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not just
used for the DOS-based ATM Sniffer. (That's not a great name, but I
couldn't think of a better one.)
Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture
files where reassembled frames don't have trailers, such as the AAL5
trailer, chopped off. That's what at least some versions of the
Windows-based ATM Sniffer appear to have.
Map the ATM capture file type for NetXRay captures to
WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've
reverse-engineered, so far, for the pseudo-header; there's more that
needs to be done on it, e.g. getting the channel, AAL type, and traffic
type (or inferring them if they're not in the packet header).
svn path=/trunk/; revision=6840
2003-01-03 06:45:45 +00:00
|
|
|
pseudo_header->atm.type = TRAF_ILMI;
|
2003-01-07 06:09:08 +00:00
|
|
|
pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 0x0c: /* LANE LE Control */
|
|
|
|
pseudo_header->atm.type = TRAF_LANE;
|
|
|
|
pseudo_header->atm.subtype = TRAF_ST_LANE_LE_CTRL;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 0x0d:
|
|
|
|
/*
|
|
|
|
* 0x0d is *mostly* LANE 802.3,
|
|
|
|
* but I've seen an LE Control frame
|
|
|
|
* with 0x0d.
|
|
|
|
*/
|
|
|
|
pseudo_header->atm.type = TRAF_LANE;
|
|
|
|
atm_guess_lane_type(pd, len,
|
|
|
|
pseudo_header);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 0x0f: /* LLC multiplexed */
|
|
|
|
pseudo_header->atm.type = TRAF_LLCMX; /* XXX */
|
|
|
|
pseudo_header->atm.subtype = TRAF_ST_UNKNOWN; /* XXX */
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
/*
|
|
|
|
* XXX - discover the other types.
|
|
|
|
*/
|
|
|
|
pseudo_header->atm.type = TRAF_UNKNOWN;
|
|
|
|
pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
/*
|
|
|
|
* 0x60 seen, and dissected by Sniffer
|
|
|
|
* Pro as a raw cell.
|
|
|
|
*
|
|
|
|
* XXX - discover what those types are.
|
|
|
|
*/
|
|
|
|
pseudo_header->atm.aal = AAL_UNKNOWN;
|
|
|
|
pseudo_header->atm.type = TRAF_UNKNOWN;
|
|
|
|
pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;
|
|
|
|
break;
|
Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not just
used for the DOS-based ATM Sniffer. (That's not a great name, but I
couldn't think of a better one.)
Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture
files where reassembled frames don't have trailers, such as the AAL5
trailer, chopped off. That's what at least some versions of the
Windows-based ATM Sniffer appear to have.
Map the ATM capture file type for NetXRay captures to
WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've
reverse-engineered, so far, for the pseudo-header; there's more that
needs to be done on it, e.g. getting the channel, AAL type, and traffic
type (or inferring them if they're not in the packet header).
svn path=/trunk/; revision=6840
2003-01-03 06:45:45 +00:00
|
|
|
}
|
|
|
|
break;
|
2002-10-29 06:12:35 +00:00
|
|
|
}
|
2003-10-01 07:11:49 +00:00
|
|
|
break;
|
2002-04-08 09:09:49 +00:00
|
|
|
}
|
2003-10-01 07:11:49 +00:00
|
|
|
return padding;
|
2002-04-08 09:09:49 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static gboolean
|
|
|
|
netxray_read_rec_data(FILE_T fh, guint8 *data_ptr, guint32 packet_size,
|
|
|
|
int *err)
|
|
|
|
{
|
|
|
|
int bytes_read;
|
|
|
|
|
|
|
|
errno = WTAP_ERR_CANT_READ;
|
|
|
|
bytes_read = file_read(data_ptr, 1, packet_size, fh);
|
|
|
|
|
|
|
|
if (bytes_read <= 0 || (guint32)bytes_read != packet_size) {
|
|
|
|
*err = file_error(fh);
|
|
|
|
if (*err == 0)
|
|
|
|
*err = WTAP_ERR_SHORT_READ;
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
2000-03-22 07:06:59 +00:00
|
|
|
static void
|
|
|
|
netxray_close(wtap *wth)
|
|
|
|
{
|
|
|
|
g_free(wth->capture.netxray);
|
|
|
|
}
|
|
|
|
|
2003-01-30 22:38:47 +00:00
|
|
|
static const struct {
|
|
|
|
int wtap_encap_value;
|
|
|
|
int ndis_value;
|
|
|
|
} wtap_encap_1_1[] = {
|
|
|
|
{ WTAP_ENCAP_ETHERNET, 0 }, /* -> NDIS Ethernet */
|
|
|
|
{ WTAP_ENCAP_TOKEN_RING, 1 }, /* -> NDIS Token Ring */
|
|
|
|
{ WTAP_ENCAP_FDDI, 2 }, /* -> NDIS FDDI */
|
|
|
|
{ WTAP_ENCAP_FDDI_BITSWAPPED, 2 }, /* -> NDIS FDDI */
|
1999-12-14 01:12:59 +00:00
|
|
|
};
|
2003-01-30 22:38:47 +00:00
|
|
|
#define NUM_WTAP_ENCAPS_1_1 (sizeof wtap_encap_1_1 / sizeof wtap_encap_1_1[0])
|
|
|
|
|
|
|
|
static int
|
|
|
|
wtap_encap_to_netxray_1_1_encap(int encap)
|
|
|
|
{
|
|
|
|
unsigned int i;
|
|
|
|
|
|
|
|
for (i = 0; i < NUM_WTAP_ENCAPS_1_1; i++) {
|
|
|
|
if (encap == wtap_encap_1_1[i].wtap_encap_value)
|
|
|
|
return wtap_encap_1_1[i].ndis_value;
|
|
|
|
}
|
|
|
|
|
|
|
|
return -1;
|
|
|
|
}
|
1999-12-14 01:12:59 +00:00
|
|
|
|
|
|
|
/* Returns 0 if we could write the specified encapsulation type,
|
|
|
|
an error indication otherwise. */
|
2003-01-30 22:38:47 +00:00
|
|
|
int netxray_dump_can_write_encap_1_1(int encap)
|
1999-12-14 01:12:59 +00:00
|
|
|
{
|
|
|
|
/* Per-packet encapsulations aren't supported. */
|
|
|
|
if (encap == WTAP_ENCAP_PER_PACKET)
|
|
|
|
return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
|
|
|
|
|
2003-01-30 22:38:47 +00:00
|
|
|
if (wtap_encap_to_netxray_1_1_encap(encap) == -1)
|
1999-12-14 01:12:59 +00:00
|
|
|
return WTAP_ERR_UNSUPPORTED_ENCAP;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2002-04-18 21:35:57 +00:00
|
|
|
/* Returns TRUE on success, FALSE on failure; sets "*err" to an error code on
|
|
|
|
failure */
|
2002-07-16 07:15:09 +00:00
|
|
|
gboolean netxray_dump_open_1_1(wtap_dumper *wdh, gboolean cant_seek, int *err)
|
2002-04-18 21:35:57 +00:00
|
|
|
{
|
2002-07-16 07:15:09 +00:00
|
|
|
/* This is a NetXRay file. We can't fill in some fields in the header
|
|
|
|
until all the packets have been written, so we can't write to a
|
|
|
|
pipe. */
|
|
|
|
if (cant_seek) {
|
|
|
|
*err = WTAP_ERR_CANT_WRITE_TO_PIPE;
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
2002-05-04 10:00:18 +00:00
|
|
|
wdh->subtype_write = netxray_dump_1_1;
|
|
|
|
wdh->subtype_close = netxray_dump_close_1_1;
|
2002-04-18 21:35:57 +00:00
|
|
|
|
|
|
|
/* We can't fill in all the fields in the file header, as we
|
|
|
|
haven't yet written any packets. As we'll have to rewrite
|
|
|
|
the header when we've written out all the packets, we just
|
|
|
|
skip over the header for now. */
|
|
|
|
if (fseek(wdh->fh, CAPTUREFILE_HEADER_SIZE, SEEK_SET) == -1) {
|
|
|
|
*err = errno;
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
wdh->dump.netxray = g_malloc(sizeof(netxray_dump_t));
|
|
|
|
wdh->dump.netxray->first_frame = TRUE;
|
|
|
|
wdh->dump.netxray->start.tv_sec = 0;
|
|
|
|
wdh->dump.netxray->start.tv_usec = 0;
|
|
|
|
wdh->dump.netxray->nframes = 0;
|
|
|
|
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Write a record for a packet to a dump file.
|
|
|
|
Returns TRUE on success, FALSE on failure. */
|
2002-05-04 10:00:18 +00:00
|
|
|
static gboolean netxray_dump_1_1(wtap_dumper *wdh,
|
2002-04-18 21:35:57 +00:00
|
|
|
const struct wtap_pkthdr *phdr,
|
|
|
|
const union wtap_pseudo_header *pseudo_header _U_,
|
2002-07-29 06:09:59 +00:00
|
|
|
const guchar *pd, int *err)
|
2002-04-18 21:35:57 +00:00
|
|
|
{
|
|
|
|
netxray_dump_t *netxray = wdh->dump.netxray;
|
|
|
|
guint32 timestamp;
|
2002-05-04 10:00:18 +00:00
|
|
|
struct netxrayrec_1_x_hdr rec_hdr;
|
2002-04-18 21:35:57 +00:00
|
|
|
size_t nwritten;
|
|
|
|
|
|
|
|
/* NetXRay/Windows Sniffer files have a capture start date/time
|
|
|
|
in the header, in a UNIX-style format, with one-second resolution,
|
|
|
|
and a start time stamp with microsecond resolution that's just
|
|
|
|
an arbitrary time stamp relative to some unknown time (boot
|
|
|
|
time?), and have times relative to the start time stamp in
|
|
|
|
the packet headers; pick the seconds value of the time stamp
|
|
|
|
of the first packet as the UNIX-style start date/time, and make
|
|
|
|
the high-resolution start time stamp 0, with the time stamp of
|
|
|
|
packets being the delta between the stamp of the packet and
|
|
|
|
the stamp of the first packet with the microseconds part 0. */
|
|
|
|
if (netxray->first_frame) {
|
|
|
|
netxray->first_frame = FALSE;
|
|
|
|
netxray->start = phdr->ts;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* build the header for each packet */
|
|
|
|
memset(&rec_hdr, '\0', sizeof(rec_hdr));
|
|
|
|
timestamp = (phdr->ts.tv_sec - netxray->start.tv_sec)*1000000 +
|
|
|
|
phdr->ts.tv_usec;
|
|
|
|
rec_hdr.timelo = htolel(timestamp);
|
|
|
|
rec_hdr.timehi = htolel(0);
|
|
|
|
rec_hdr.orig_len = htoles(phdr->len);
|
|
|
|
rec_hdr.incl_len = htoles(phdr->caplen);
|
2002-08-28 20:30:45 +00:00
|
|
|
|
2002-04-18 21:35:57 +00:00
|
|
|
nwritten = fwrite(&rec_hdr, 1, sizeof(rec_hdr), wdh->fh);
|
|
|
|
if (nwritten != sizeof(rec_hdr)) {
|
|
|
|
if (nwritten == 0 && ferror(wdh->fh))
|
|
|
|
*err = errno;
|
|
|
|
else
|
|
|
|
*err = WTAP_ERR_SHORT_WRITE;
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
2002-08-28 20:30:45 +00:00
|
|
|
/* write the packet data */
|
2002-04-18 21:35:57 +00:00
|
|
|
nwritten = fwrite(pd, 1, phdr->caplen, wdh->fh);
|
|
|
|
if (nwritten != phdr->caplen) {
|
|
|
|
if (nwritten == 0 && ferror(wdh->fh))
|
|
|
|
*err = errno;
|
|
|
|
else
|
|
|
|
*err = WTAP_ERR_SHORT_WRITE;
|
|
|
|
return FALSE;
|
|
|
|
}
|
2002-08-28 20:30:45 +00:00
|
|
|
|
2002-04-18 21:35:57 +00:00
|
|
|
netxray->nframes++;
|
|
|
|
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Finish writing to a dump file.
|
|
|
|
Returns TRUE on success, FALSE on failure. */
|
2002-05-04 10:00:18 +00:00
|
|
|
static gboolean netxray_dump_close_1_1(wtap_dumper *wdh, int *err)
|
2002-04-18 21:35:57 +00:00
|
|
|
{
|
|
|
|
char hdr_buf[CAPTUREFILE_HEADER_SIZE - sizeof(netxray_magic)];
|
|
|
|
netxray_dump_t *netxray = wdh->dump.netxray;
|
|
|
|
guint32 filelen;
|
|
|
|
struct netxray_hdr file_hdr;
|
|
|
|
size_t nwritten;
|
|
|
|
|
|
|
|
filelen = ftell(wdh->fh);
|
|
|
|
|
|
|
|
/* Go back to beginning */
|
|
|
|
fseek(wdh->fh, 0, SEEK_SET);
|
|
|
|
|
|
|
|
/* Rewrite the file header. */
|
|
|
|
nwritten = fwrite(netxray_magic, 1, sizeof netxray_magic, wdh->fh);
|
|
|
|
if (nwritten != sizeof netxray_magic) {
|
2002-05-04 10:00:18 +00:00
|
|
|
if (err != NULL) {
|
|
|
|
if (nwritten == 0 && ferror(wdh->fh))
|
|
|
|
*err = errno;
|
|
|
|
else
|
|
|
|
*err = WTAP_ERR_SHORT_WRITE;
|
|
|
|
}
|
2002-04-18 21:35:57 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* "sniffer" version ? */
|
|
|
|
memset(&file_hdr, '\0', sizeof file_hdr);
|
2002-05-04 10:00:18 +00:00
|
|
|
memcpy(file_hdr.version, vers_1_1, sizeof vers_1_1);
|
2002-04-18 21:35:57 +00:00
|
|
|
file_hdr.start_time = htolel(netxray->start.tv_sec);
|
|
|
|
file_hdr.nframes = htolel(netxray->nframes);
|
|
|
|
file_hdr.start_offset = htolel(CAPTUREFILE_HEADER_SIZE);
|
|
|
|
file_hdr.end_offset = htolel(filelen);
|
2003-01-30 22:38:47 +00:00
|
|
|
file_hdr.network = htoles(wtap_encap_to_netxray_1_1_encap(wdh->encap));
|
2002-04-18 21:35:57 +00:00
|
|
|
file_hdr.timelo = htolel(0);
|
|
|
|
file_hdr.timehi = htolel(0);
|
|
|
|
|
|
|
|
memset(hdr_buf, '\0', sizeof hdr_buf);
|
|
|
|
memcpy(hdr_buf, &file_hdr, sizeof(file_hdr));
|
|
|
|
nwritten = fwrite(hdr_buf, 1, sizeof hdr_buf, wdh->fh);
|
|
|
|
if (nwritten != sizeof hdr_buf) {
|
2002-05-04 10:00:18 +00:00
|
|
|
if (err != NULL) {
|
|
|
|
if (nwritten == 0 && ferror(wdh->fh))
|
|
|
|
*err = errno;
|
|
|
|
else
|
|
|
|
*err = WTAP_ERR_SHORT_WRITE;
|
|
|
|
}
|
2002-04-18 21:35:57 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
2002-08-28 20:30:45 +00:00
|
|
|
|
2002-04-18 21:35:57 +00:00
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
2003-01-30 22:38:47 +00:00
|
|
|
static const struct {
|
|
|
|
int wtap_encap_value;
|
|
|
|
int ndis_value;
|
|
|
|
} wtap_encap_2_0[] = {
|
2003-01-31 01:02:14 +00:00
|
|
|
{ WTAP_ENCAP_ETHERNET, 0 }, /* -> NDIS Ethernet */
|
|
|
|
{ WTAP_ENCAP_TOKEN_RING, 1 }, /* -> NDIS Token Ring */
|
|
|
|
{ WTAP_ENCAP_FDDI, 2 }, /* -> NDIS FDDI */
|
|
|
|
{ WTAP_ENCAP_FDDI_BITSWAPPED, 2 }, /* -> NDIS FDDI */
|
2003-03-03 23:29:59 +00:00
|
|
|
{ WTAP_ENCAP_PPP_WITH_PHDR, 3 }, /* -> NDIS WAN */
|
|
|
|
{ WTAP_ENCAP_FRELAY_WITH_PHDR, 3 }, /* -> NDIS WAN */
|
|
|
|
{ WTAP_ENCAP_LAPB, 3 }, /* -> NDIS WAN */
|
|
|
|
{ WTAP_ENCAP_SDLC, 3 }, /* -> NDIS WAN */
|
2003-01-30 22:38:47 +00:00
|
|
|
};
|
|
|
|
#define NUM_WTAP_ENCAPS_2_0 (sizeof wtap_encap_2_0 / sizeof wtap_encap_2_0[0])
|
|
|
|
|
|
|
|
static int
|
|
|
|
wtap_encap_to_netxray_2_0_encap(int encap)
|
|
|
|
{
|
|
|
|
unsigned int i;
|
|
|
|
|
|
|
|
for (i = 0; i < NUM_WTAP_ENCAPS_2_0; i++) {
|
|
|
|
if (encap == wtap_encap_2_0[i].wtap_encap_value)
|
|
|
|
return wtap_encap_2_0[i].ndis_value;
|
|
|
|
}
|
|
|
|
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Returns 0 if we could write the specified encapsulation type,
|
|
|
|
an error indication otherwise. */
|
|
|
|
int netxray_dump_can_write_encap_2_0(int encap)
|
|
|
|
{
|
|
|
|
/* Per-packet encapsulations aren't supported. */
|
|
|
|
if (encap == WTAP_ENCAP_PER_PACKET)
|
|
|
|
return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
|
|
|
|
|
|
|
|
if (wtap_encap_to_netxray_2_0_encap(encap) == -1)
|
|
|
|
return WTAP_ERR_UNSUPPORTED_ENCAP;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
1999-12-14 01:12:59 +00:00
|
|
|
/* Returns TRUE on success, FALSE on failure; sets "*err" to an error code on
|
|
|
|
failure */
|
2002-07-16 07:15:09 +00:00
|
|
|
gboolean netxray_dump_open_2_0(wtap_dumper *wdh, gboolean cant_seek, int *err)
|
1999-12-14 01:12:59 +00:00
|
|
|
{
|
2002-07-16 07:15:09 +00:00
|
|
|
/* This is a NetXRay file. We can't fill in some fields in the header
|
|
|
|
until all the packets have been written, so we can't write to a
|
|
|
|
pipe. */
|
|
|
|
if (cant_seek) {
|
|
|
|
*err = WTAP_ERR_CANT_WRITE_TO_PIPE;
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
2002-05-04 10:00:18 +00:00
|
|
|
wdh->subtype_write = netxray_dump_2_0;
|
|
|
|
wdh->subtype_close = netxray_dump_close_2_0;
|
1999-12-14 01:12:59 +00:00
|
|
|
|
1999-12-15 01:34:17 +00:00
|
|
|
/* We can't fill in all the fields in the file header, as we
|
|
|
|
haven't yet written any packets. As we'll have to rewrite
|
|
|
|
the header when we've written out all the packets, we just
|
|
|
|
skip over the header for now. */
|
2002-03-04 00:25:35 +00:00
|
|
|
if (fseek(wdh->fh, CAPTUREFILE_HEADER_SIZE, SEEK_SET) == -1) {
|
|
|
|
*err = errno;
|
|
|
|
return FALSE;
|
|
|
|
}
|
1999-12-15 01:34:17 +00:00
|
|
|
|
2000-05-10 22:16:31 +00:00
|
|
|
wdh->dump.netxray = g_malloc(sizeof(netxray_dump_t));
|
|
|
|
wdh->dump.netxray->first_frame = TRUE;
|
|
|
|
wdh->dump.netxray->start.tv_sec = 0;
|
|
|
|
wdh->dump.netxray->start.tv_usec = 0;
|
|
|
|
wdh->dump.netxray->nframes = 0;
|
1999-12-14 01:12:59 +00:00
|
|
|
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Write a record for a packet to a dump file.
|
|
|
|
Returns TRUE on success, FALSE on failure. */
|
2002-05-04 10:00:18 +00:00
|
|
|
static gboolean netxray_dump_2_0(wtap_dumper *wdh,
|
2002-03-02 20:41:08 +00:00
|
|
|
const struct wtap_pkthdr *phdr,
|
|
|
|
const union wtap_pseudo_header *pseudo_header _U_,
|
2002-07-29 06:09:59 +00:00
|
|
|
const guchar *pd, int *err)
|
1999-12-14 01:12:59 +00:00
|
|
|
{
|
2000-05-10 22:16:31 +00:00
|
|
|
netxray_dump_t *netxray = wdh->dump.netxray;
|
1999-12-15 01:34:17 +00:00
|
|
|
guint32 timestamp;
|
2002-05-04 10:00:18 +00:00
|
|
|
struct netxrayrec_2_x_hdr rec_hdr;
|
2001-08-25 03:18:48 +00:00
|
|
|
size_t nwritten;
|
1999-12-14 01:12:59 +00:00
|
|
|
|
1999-12-15 01:34:17 +00:00
|
|
|
/* NetXRay/Windows Sniffer files have a capture start date/time
|
|
|
|
in the header, in a UNIX-style format, with one-second resolution,
|
|
|
|
and a start time stamp with microsecond resolution that's just
|
|
|
|
an arbitrary time stamp relative to some unknown time (boot
|
|
|
|
time?), and have times relative to the start time stamp in
|
|
|
|
the packet headers; pick the seconds value of the time stamp
|
|
|
|
of the first packet as the UNIX-style start date/time, and make
|
|
|
|
the high-resolution start time stamp 0, with the time stamp of
|
|
|
|
packets being the delta between the stamp of the packet and
|
|
|
|
the stamp of the first packet with the microseconds part 0. */
|
2000-05-10 22:16:31 +00:00
|
|
|
if (netxray->first_frame) {
|
|
|
|
netxray->first_frame = FALSE;
|
|
|
|
netxray->start = phdr->ts;
|
1999-12-14 01:12:59 +00:00
|
|
|
}
|
|
|
|
|
1999-12-15 01:34:17 +00:00
|
|
|
/* build the header for each packet */
|
|
|
|
memset(&rec_hdr, '\0', sizeof(rec_hdr));
|
2001-03-23 23:16:29 +00:00
|
|
|
timestamp = (phdr->ts.tv_sec - netxray->start.tv_sec)*1000000 +
|
|
|
|
phdr->ts.tv_usec;
|
|
|
|
rec_hdr.timelo = htolel(timestamp);
|
|
|
|
rec_hdr.timehi = htolel(0);
|
1999-12-15 01:34:17 +00:00
|
|
|
rec_hdr.orig_len = htoles(phdr->len);
|
|
|
|
rec_hdr.incl_len = htoles(phdr->caplen);
|
2002-05-04 10:00:18 +00:00
|
|
|
|
2003-01-31 01:02:14 +00:00
|
|
|
switch (phdr->pkt_encap) {
|
|
|
|
|
|
|
|
case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
|
|
|
|
rec_hdr.xxx[12] = pseudo_header->ieee_802_11.channel;
|
|
|
|
rec_hdr.xxx[13] = pseudo_header->ieee_802_11.data_rate;
|
|
|
|
rec_hdr.xxx[14] = pseudo_header->ieee_802_11.signal_level;
|
|
|
|
break;
|
|
|
|
|
2003-03-04 02:04:00 +00:00
|
|
|
case WTAP_ENCAP_PPP_WITH_PHDR:
|
|
|
|
case WTAP_ENCAP_SDLC:
|
|
|
|
rec_hdr.xxx[12] |= pseudo_header->p2p.sent ? 0x01 : 0x00;
|
|
|
|
break;
|
|
|
|
|
2003-01-31 01:02:14 +00:00
|
|
|
case WTAP_ENCAP_FRELAY_WITH_PHDR:
|
|
|
|
rec_hdr.xxx[12] |= (pseudo_header->x25.flags & FROM_DCE) ? 0x00 : 0x01;
|
|
|
|
break;
|
2002-05-04 10:00:18 +00:00
|
|
|
}
|
|
|
|
|
1999-12-14 01:12:59 +00:00
|
|
|
nwritten = fwrite(&rec_hdr, 1, sizeof(rec_hdr), wdh->fh);
|
|
|
|
if (nwritten != sizeof(rec_hdr)) {
|
2001-08-25 03:18:48 +00:00
|
|
|
if (nwritten == 0 && ferror(wdh->fh))
|
1999-12-14 01:12:59 +00:00
|
|
|
*err = errno;
|
|
|
|
else
|
|
|
|
*err = WTAP_ERR_SHORT_WRITE;
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
2002-08-28 20:30:45 +00:00
|
|
|
/* write the packet data */
|
1999-12-14 01:12:59 +00:00
|
|
|
nwritten = fwrite(pd, 1, phdr->caplen, wdh->fh);
|
|
|
|
if (nwritten != phdr->caplen) {
|
2001-08-25 03:18:48 +00:00
|
|
|
if (nwritten == 0 && ferror(wdh->fh))
|
1999-12-14 01:12:59 +00:00
|
|
|
*err = errno;
|
|
|
|
else
|
|
|
|
*err = WTAP_ERR_SHORT_WRITE;
|
|
|
|
return FALSE;
|
|
|
|
}
|
2002-08-28 20:30:45 +00:00
|
|
|
|
2000-05-10 22:16:31 +00:00
|
|
|
netxray->nframes++;
|
1999-12-15 01:34:17 +00:00
|
|
|
|
1999-12-14 01:12:59 +00:00
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Finish writing to a dump file.
|
|
|
|
Returns TRUE on success, FALSE on failure. */
|
2002-05-04 10:00:18 +00:00
|
|
|
static gboolean netxray_dump_close_2_0(wtap_dumper *wdh, int *err)
|
1999-12-14 01:12:59 +00:00
|
|
|
{
|
1999-12-15 01:34:17 +00:00
|
|
|
char hdr_buf[CAPTUREFILE_HEADER_SIZE - sizeof(netxray_magic)];
|
2000-05-10 22:16:31 +00:00
|
|
|
netxray_dump_t *netxray = wdh->dump.netxray;
|
1999-12-15 01:34:17 +00:00
|
|
|
guint32 filelen;
|
|
|
|
struct netxray_hdr file_hdr;
|
2001-08-25 03:18:48 +00:00
|
|
|
size_t nwritten;
|
1999-12-14 21:59:07 +00:00
|
|
|
|
1999-12-15 01:34:17 +00:00
|
|
|
filelen = ftell(wdh->fh);
|
1999-12-14 21:59:07 +00:00
|
|
|
|
1999-12-15 01:34:17 +00:00
|
|
|
/* Go back to beginning */
|
|
|
|
fseek(wdh->fh, 0, SEEK_SET);
|
1999-12-14 21:59:07 +00:00
|
|
|
|
|
|
|
/* Rewrite the file header. */
|
|
|
|
nwritten = fwrite(netxray_magic, 1, sizeof netxray_magic, wdh->fh);
|
|
|
|
if (nwritten != sizeof netxray_magic) {
|
2002-05-04 10:00:18 +00:00
|
|
|
if (err != NULL) {
|
|
|
|
if (nwritten == 0 && ferror(wdh->fh))
|
|
|
|
*err = errno;
|
|
|
|
else
|
|
|
|
*err = WTAP_ERR_SHORT_WRITE;
|
|
|
|
}
|
1999-12-14 21:59:07 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
1999-12-15 01:34:17 +00:00
|
|
|
/* "sniffer" version ? */
|
|
|
|
memset(&file_hdr, '\0', sizeof file_hdr);
|
2002-05-04 10:00:18 +00:00
|
|
|
memcpy(file_hdr.version, vers_2_001, sizeof vers_2_001);
|
2000-05-10 22:16:31 +00:00
|
|
|
file_hdr.start_time = htolel(netxray->start.tv_sec);
|
|
|
|
file_hdr.nframes = htolel(netxray->nframes);
|
1999-12-15 01:34:17 +00:00
|
|
|
file_hdr.start_offset = htolel(CAPTUREFILE_HEADER_SIZE);
|
|
|
|
file_hdr.end_offset = htolel(filelen);
|
2003-01-30 22:38:47 +00:00
|
|
|
file_hdr.network = htoles(wtap_encap_to_netxray_2_0_encap(wdh->encap));
|
2001-03-23 23:16:29 +00:00
|
|
|
file_hdr.timelo = htolel(0);
|
|
|
|
file_hdr.timehi = htolel(0);
|
2003-01-30 22:38:47 +00:00
|
|
|
switch (wdh->encap) {
|
|
|
|
|
2003-03-03 23:29:59 +00:00
|
|
|
case WTAP_ENCAP_PPP_WITH_PHDR:
|
|
|
|
file_hdr.xxb[20] = CAPTYPE_PPP;
|
|
|
|
break;
|
|
|
|
|
2003-01-31 01:02:14 +00:00
|
|
|
case WTAP_ENCAP_FRELAY_WITH_PHDR:
|
2003-03-03 23:29:59 +00:00
|
|
|
file_hdr.xxb[20] = CAPTYPE_FRELAY;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case WTAP_ENCAP_LAPB:
|
|
|
|
file_hdr.xxb[20] = CAPTYPE_HDLC;
|
|
|
|
file_hdr.xxb[28] = 0;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case WTAP_ENCAP_SDLC:
|
|
|
|
file_hdr.xxb[20] = CAPTYPE_SDLC;
|
2003-01-30 22:38:47 +00:00
|
|
|
break;
|
2003-10-01 07:11:49 +00:00
|
|
|
|
|
|
|
default:
|
|
|
|
file_hdr.xxb[20] = CAPTYPE_NDIS;
|
|
|
|
break;
|
2003-01-30 22:38:47 +00:00
|
|
|
}
|
1999-12-15 01:34:17 +00:00
|
|
|
|
|
|
|
memset(hdr_buf, '\0', sizeof hdr_buf);
|
|
|
|
memcpy(hdr_buf, &file_hdr, sizeof(file_hdr));
|
|
|
|
nwritten = fwrite(hdr_buf, 1, sizeof hdr_buf, wdh->fh);
|
|
|
|
if (nwritten != sizeof hdr_buf) {
|
2002-05-04 10:00:18 +00:00
|
|
|
if (err != NULL) {
|
|
|
|
if (nwritten == 0 && ferror(wdh->fh))
|
|
|
|
*err = errno;
|
|
|
|
else
|
|
|
|
*err = WTAP_ERR_SHORT_WRITE;
|
|
|
|
}
|
1999-12-15 01:34:17 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
2002-08-28 20:30:45 +00:00
|
|
|
|
1999-12-14 01:12:59 +00:00
|
|
|
return TRUE;
|
|
|
|
}
|