osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

We don't know what, in captures with a major version number of 3, 

indicates the subtype of an "Internetwork analyzer" capture; we've seen
only one such capture, and it was a frame relay capture, so we just wire
it to frame relay for now.

svn path=/trunk/; revision=6923
This commit is contained in:
Guy Harris 2003-01-14 19:52:47 +00:00
parent 7563779cb0
commit 2955489887
1 changed files with 30 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
wiretap/ngsniffer.c
View File

@ -1,6 +1,6 @@
/* ngsniffer.c
*
* $Id: ngsniffer.c,v 1.107 2003/01/11 05:54:52 guy Exp $
* $Id: ngsniffer.c,v 1.108 2003/01/14 19:52:47 guy Exp $
*
* Wiretap Library
* Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
@ -509,24 +509,44 @@ int ngsniffer_open(wtap *wth, int *err)
*
* XXX - in some version 1.16 internetwork analyzer files
* generated by the Windows Sniffer when saving Windows
* Sniffer files as DOS Sniffer files, the first "rsvd" word
* is 1 for PRI ISDN files, 2 for BRI ISDN files, and 0 for
* non-ISDN files; is that something the DOS Sniffer understands?
* Sniffer files as DOS Sniffer files, there's no REC_HEADER2
* record, but the first "rsvd" word is 1 for PRI ISDN files, 2
* for BRI ISDN files, and 0 for non-ISDN files; is that something
* the DOS Sniffer understands?
*/
maj_vers = pletohs(&version.maj_vers);
if (process_header_records(wth, err, maj_vers) < 0)
return -1;
if (wth->file_encap == WTAP_ENCAP_PER_PACKET && maj_vers == 1) {
if (wth->file_encap == WTAP_ENCAP_PER_PACKET) {
/*
* Well, we haven't determined the internetwork analyzer
* subtype yet, and this is a version 1 capture; look
* at the first "rsvd" word.
* subtype yet...
*/
switch (pletohs(&version.rsvd[0])) {
switch (maj_vers) {
case 1:
case 2:
wth->file_encap = WTAP_ENCAP_ISDN;
/*
* ... and this is a version 1 capture; look
* at the first "rsvd" word.
*/
switch (pletohs(&version.rsvd[0])) {
case 1:
case 2:
wth->file_encap = WTAP_ENCAP_ISDN;
break;
}
break;
case 3:
/*
* ...and this is a version 3 capture; we've
* seen nothing in those that obviously
* indicates the capture type, but the only
* one we've seen is a Frame Relay capture,
* so mark it as Frame Relay for now.
*/
wth->file_encap = WTAP_ENCAP_FRELAY;
break;
}
}