Commit Graph

650 Commits

Author SHA1 Message Date
Guy Harris 7110082aa4 From Neils Koot:
add the ability to read Ethernet captures;

	add the ability to read hex-only dumps.

svn path=/trunk/; revision=9468
2003-12-29 00:36:12 +00:00
Guy Harris 1b6d16c7cc Make all the byte arrays for writing out stuff "guint8" rather than
"gint8" - there's no reason for them to be signed, and making them
signed can cause compiler warnings if a value won't fit in 8 bits if
sign-extended.

svn path=/trunk/; revision=9467
2003-12-29 00:25:39 +00:00
Ulf Lamping cb2658031d removed some MSVC warnings (warning level 2)
svn path=/trunk/; revision=9459
2003-12-28 12:43:40 +00:00
Jörg Mayer 982b7a3f2b Add -pedantic to --with-extra-gcc-checks
svn path=/trunk/; revision=9443
2003-12-24 14:45:48 +00:00
Ulf Lamping 467c05b3ea removed some MSVC warnings (conversions between double/float and int)
svn path=/trunk/; revision=9422
2003-12-23 00:16:46 +00:00
Ulf Lamping 3b77bfee59 removed some MSVC warnings (moved pcap.h before glib.h)
svn path=/trunk/; revision=9393
2003-12-21 12:19:39 +00:00
Jörg Mayer 8d1f1c9b4f libpcap.c:1777: warning: implicit declaration of function htons
svn path=/trunk/; revision=9388
2003-12-21 06:02:06 +00:00
Guy Harris 8b0f0d5b7e Add some additional sanity checking.
svn path=/trunk/; revision=9360
2003-12-19 22:23:05 +00:00
Guy Harris 95e6fb64c0 Add support for a link-layer type value of 143 as DOCSIS in libpcap
captures.

svn path=/trunk/; revision=9350
2003-12-18 23:50:44 +00:00
Guy Harris b8299f0b98 From Jan Kiszka: IrDA support.
svn path=/trunk/; revision=9345
2003-12-18 19:07:14 +00:00
Guy Harris a98aa75a58 WildPackets' EtherHelp appears to write EtherPeek-compatible files,
except that the 0x80 bit is turned on in the file version number field.
Turn that bit off before processing that field.

svn path=/trunk/; revision=9342
2003-12-18 03:43:40 +00:00
Guy Harris c642c44ad8 Fix more "CPPLAGS" typoes.
svn path=/trunk/; revision=9310
2003-12-17 02:41:04 +00:00
Ulf Lamping 10e3320115 prevent MSVC warning:
"warning C4761: Gr��enkonflikt im Argument. Konvertierung vorgenommen"
-> size conflict in argument, conversion done

svn path=/trunk/; revision=9244
2003-12-11 21:23:37 +00:00
Guy Harris 02260b4056 From Jeff Morriss: add support for libpcap MTP2 and MTP3 captures.
Add a missing entry in "encap_table[]" for Bluetooth H4, and fix some
comments.

svn path=/trunk/; revision=9157
2003-12-03 22:40:39 +00:00
Guy Harris 95f25d46c1 "strtoul()" returns a "long", not a "long long".
svn path=/trunk/; revision=9154
2003-12-03 19:47:36 +00:00
Guy Harris 98c4d5d030 Check for errors and EOF, and handle them appropriately; don't treat all
errors when reading the header as indications that the file isn't an
AiroPeek V9 file.

Put in comments nothing some additional checks we should do.

svn path=/trunk/; revision=9145
2003-12-02 20:27:14 +00:00
Guy Harris fe73d8e3b6 From Martijn Schipper: support for reading AiroPeek files in V9 capture
file format (AiroPeek 2.x).

svn path=/trunk/; revision=9144
2003-12-02 19:37:05 +00:00
Richard Sharpe da672d6f17 It's RedHat, not Red Hat.
svn path=/trunk/; revision=9126
2003-12-01 06:59:10 +00:00
Guy Harris e3f791ebea "file_seek()" sets "*err" - we don't have to set it ourselves.
The same is true of "parse_cosine_rec_hdr()".

svn path=/trunk/; revision=9079
2003-11-25 05:58:56 +00:00
Guy Harris 6939f62da0 "file_seek()" sets "*err" - there's no need to set it ourselves. It
returns -1 on errors, so just check for that.

svn path=/trunk/; revision=9078
2003-11-25 05:56:16 +00:00
Guy Harris 240c946b82 From Olivier Biot: add a "--enable-profile-build" flag to request that
"-pg" binaries be built.

svn path=/trunk/; revision=9001
2003-11-18 08:13:10 +00:00
Guy Harris f0887775c2 From Brian Ginsbach: fix handling of IRIX and UNICOS/mp snoop captures
on loopback interfaces.

svn path=/trunk/; revision=8945
2003-11-11 20:49:46 +00:00
Guy Harris 4192ad9770 Let people configure whether to build with Zlib or not solely by
controlling whether ZLIB_DIR is defined or not in config.nmake.

svn path=/trunk/; revision=8911
2003-11-07 23:27:13 +00:00
Guy Harris 0543fbd427 From Scott Emberley: support for writing Network Instruments Observer
files.

svn path=/trunk/; revision=8900
2003-11-06 22:45:28 +00:00
Guy Harris 7fc668fbf9 Sigh. Some snoop files have 6 bytes of padding; assume the file is a
snoop file unless it has enoguh padding to hold a Shomiti trailer
record.  (DEAR SUN MICROSYSTEMS: PLEASE DO NOT STUFF 16 OR MORE BYTES OF
PADDING INTO A SNOOP PACKET.  THANK YOU.  HAVE A NICE DAY.)

Add a little paranoia about the record and captured data lengths.

svn path=/trunk/; revision=8883
2003-11-04 22:14:50 +00:00
Guy Harris 1cfad682cb The time in Observer files is in nanoseconds since midnight, January 1,
2000, 00:00:00 *local* time.  The amount to add to that is just the UNIX
time stamp value for that point in time; get it with "mktime()".

svn path=/trunk/; revision=8854
2003-11-01 03:38:10 +00:00
Guy Harris 1131dafe62 Temporarily get rid of the "struct tm" in "struct observer_time", and
get rid of the reference to its "tm_gmtoff" member - there are platforms
on which Ethereal runs that don't have "tm_gmtoff" in "struct tm".  If
the time stamp in the packets is nanoseconds since midnight 2001-01-01
*local* time, we'd need to compute the offset between that and midnight
2000-01-01 GMT, and adjust the time with that.

svn path=/trunk/; revision=8842
2003-10-31 08:06:25 +00:00
Guy Harris 0247fbeb15 From Scott Emberley: support for reading Network Instruments version 9
capture files.

svn path=/trunk/; revision=8840
2003-10-31 00:43:21 +00:00
Guy Harris 305afc4e97 The quantities in the hcidump header are little-endian, not big-endian.
svn path=/trunk/; revision=8831
2003-10-30 11:53:48 +00:00
Guy Harris 95c1f2f7c9 From Marcel Holtmann: support for reading Linux Bluez Bluetooth stack
"hcidump -w" traces.

Note that Jesper Peterson contributed support for reading Endace ERF
files.

svn path=/trunk/; revision=8824
2003-10-30 03:11:03 +00:00
Guy Harris b624dce63b Add a new WTAP_ENCAP_CHDLC_WITH_PHDR type, to distinguish Cisco HDLC
captures with packet direction information from captures without it.
Use them appropriately.

svn path=/trunk/; revision=8780
2003-10-25 07:17:28 +00:00
Guy Harris 4bd5126925 Move the version number checking for libpcap files, to see whether to
swap the "captured length" and "length" fields, to the open-file code;
store a tri-state (definitely swapped, definitely not swapped, maybe
swapped) value in the per-capture-file-format information for libpcap
format, and use that when processing packets.

svn path=/trunk/; revision=8774
2003-10-24 23:55:34 +00:00
Ronnie Sahlberg 7cb2dc0099 The capture tools for DGUX has swapped the included/original packet lengths of the frame header.
they specify the pcap version as 543.0

svn path=/trunk/; revision=8772
2003-10-24 10:52:04 +00:00
Guy Harris 02e1d2680a Give every Makefile.nmake file a "distclean" rule, and have "distclean"
recurse into subdirectories doing "nmake -f Makefile.nmake distclean".

Have "nmake -f Makefile.nmake clean" not remove stuff that "make clean"
doesn't remove (such as Flex/Bison output and config.h files) - and have
"nmake -f Makefile.nmake distclean" remove stuff that "make distclean"
removes, including "tethereal-tap-register.c" and
"ethereal-tap-register.c".

svn path=/trunk/; revision=8672
2003-10-10 21:31:53 +00:00
Jörg Mayer 391152faa5 Use #ifndef HAVE_UNISTD_H instead of #ifdef _WIN32
svn path=/trunk/; revision=8603
2003-10-03 21:12:49 +00:00
Guy Harris 6f1da2e1b2 From Graham Bloice: define YY_NO_UNISTD_H on Win32, so that if Flex was
a UNIX version generating code that, by default, assumes you have
<unistd.h> (as might be the case with recent versions of Cygwin, which I
assume *does* supply <unistd.h>), but you're building on a platform that
lacks <unistd.h> (e.g., building with MSVC++ or MinGW), you can still
compile.

svn path=/trunk/; revision=8602
2003-10-03 21:03:00 +00:00
Guy Harris 8f0aa18626 Have a pseudo-header for Ethernet packets, giving the size of the FCS -
0 means "there is no FCS in the packet data", 4 means "there is an FCS
in the packet data", -1 means "I don't know whether there's an FCS in
the packet data, guess based on the packet size".

Assume that Ethernet encapsulated inside other protocols has no FCS, by
having the "eth" dissector assume that (and not check for an Ethernet
pseudo-header).

Have "ethertype()" take an argument giving the FCS size; pass 0 when
appropriate.

Fix up Wiretap routines to set the pseudo-header.  This means we no
longer use the "generic" seek-and-read routine, so get rid of it.

svn path=/trunk/; revision=8578
2003-10-01 18:19:16 +00:00
Guy Harris be2736adcf Have a pseudo-header for Ethernet packets, giving the size of the FCS -
0 means "there is no FCS in the packet data", 4 means "there is an FCS
in the packet data", -1 means "I don't know whether there's an FCS in
the packet data, guess based on the packet size".

Assume that Ethernet encapsulated inside other protocols has no FCS, by
having the "eth" dissector assume that (and not check for an Ethernet
pseudo-header).

Have "ethertype()" take an argument giving the FCS size; pass 0 when
appropriate.

Fix up Wiretap routines to set the pseudo-header.  This means we no
longer use the "generic" seek-and-read routine, so get rid of it.

svn path=/trunk/; revision=8574
2003-10-01 07:11:49 +00:00
Guy Harris f4a639c7c1 It appears that, at least for gigabit pod captures, there are time stamp
differences between versions 002.001 and 002.002.

svn path=/trunk/; revision=8563
2003-09-28 23:15:40 +00:00
Guy Harris aaa0e6d7e7 From packet steve: update to give the correct name for "file_access.c",
and add a discussion of how data_offset works.

svn path=/trunk/; revision=8535
2003-09-24 23:53:11 +00:00
Guy Harris 4bd548e034 From Jesper Peterson: add support for AAL5 records in ERF files,
treating them as PDUs with an AAL5 trailer.

svn path=/trunk/; revision=8493
2003-09-19 04:08:11 +00:00
Guy Harris 4f01e65223 Put in a note telling people how to add a new libpcap encapsulation
type, and telling them how it should *NOT* be done, i.e. you should ask
tcpdump-workers for a new DLT_ value, you should not just pick a value
on your own, and you should especially not reuse a value that's already
in use!

Put in comments about reserved values in the current CVS libpcap.

svn path=/trunk/; revision=8367
2003-09-04 06:40:45 +00:00
Guy Harris 982ece89cf From Jesper Peterson:
use WTAP_ENCAP_ATM_PDUS as the default encapsulation for ATM;

	don't use ULL constants, as not all C compilers that support
	gint64 support them, and as there's no need to make them ULL
	constants.

svn path=/trunk/; revision=8278
2003-08-26 23:07:43 +00:00
Guy Harris 4ecb7cb4f2 From Jesper Peterson: support for Endace ERF file format.
svn path=/trunk/; revision=8272
2003-08-26 07:10:39 +00:00
Guy Harris fb0480ae43 Use "file_access.c", not "file_io.c", as the latter is already in use in
a not-yet-ready-for-prime-time project of mine (fast random access to
gzipped files, plus an mechanism to allow support for other forms of
compression).

svn path=/trunk/; revision=8221
2003-08-23 08:34:12 +00:00
Guy Harris 995285fd9c Rename "wiretap/file.c" to "wiretap/file_io.c", as some tools, such as
the MS Visual Studio debugger, get confused by two files with the same
name being in a program's source, even though they're in different
directories.

svn path=/trunk/; revision=8208
2003-08-22 19:07:45 +00:00
Guy Harris 1ee1b5a582 Align the --with-pcap help message with other help messages.
svn path=/trunk/; revision=8203
2003-08-21 07:25:22 +00:00
Guy Harris 98909d9045 Clean up argument names.
svn path=/trunk/; revision=8097
2003-07-29 20:49:32 +00:00
Guy Harris 2a679c88f8 Use GLib's macros for converting from host byte order to little-endian.
svn path=/trunk/; revision=8096
2003-07-29 20:41:19 +00:00
Guy Harris 27022f52e4 Don't free "wdh->dump.opaque" in the close routine - "wtap_dump_close()"
does it for you.

"wdh->dump.opaque" should never be null, so unconditionally call
"lanalyzer_dump_header()".

svn path=/trunk/; revision=8095
2003-07-29 20:30:00 +00:00