This enables a Lua script to implement a brand new capture file format reader/writer, so that for example one could write a script to read from vendor-specific "logs" of packets, and show them as normal packets in wireshark.
Change-Id: Id394edfffa94529f39789844c382b7ab6cc2d814
Reviewed-on: https://code.wireshark.org/review/431
Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
And rename to #define for the stats block trailer length to indicate
that it's the length of the trailer, not the length of the stats block
in its entirety.
Change-Id: Iec82c971b32f2d3f4a604fe75a91633e1813ebd5
Reviewed-on: https://code.wireshark.org/review/701
Reviewed-by: Guy Harris <guy@alum.mit.edu>
There have been discussions on -dev about removing this and I believe I was the last holdout. Finally convinced that I should just have a local copy (ignored by git)
Change-Id: Ic72a22baf58e3412023cf851f0fce16eb07113b0
Reviewed-on: https://code.wireshark.org/review/681
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
The #defines came from Radiotap, but this isn't Radiotap (I see no
presence bits here), and Radiotap has to handle stuff that this code
doesn't (such as, for example, Atheros Wi-Fi adapters that, annoyingly,
pad the space between the 802.11 header and the 802.11 payload when in
monitor mode, hence the "datapad" flag).
Change-Id: I87ca3539e0f9254ab94cc8897bdf69e4574f0525
Reviewed-on: https://code.wireshark.org/review/690
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Pull the packet data copying code into the routines that parse the rest
of the record data. Have those routines directly fill in the metadata
headers in the packet data, without bothering to fill in a structure
first.
As a result, those routines no longer can set phdr->caplen to a value
different from phdr->len, so don't set WTAP_HAS_CAP_LEN.
Have the existing sanity checking code cause the read to fail if the
checks fail, and add some additional sanity checking.
Use #defines for some offsets into the statistics header and trailer.
Change-Id: Ie936683b96888961d6e2598131cc0eb6146b37e9
Reviewed-on: https://code.wireshark.org/review/689
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Always include the length of the metadata headers, as we're always
copying them.
Do a straightforward check to make sure the data length is >= 4 before
subtracting out the FCS (which appears not to actually be an FCS; at
least in the captures I've seen, it looks like random junk).
Improve the comments for that code.
Get rid of some tabs, in favor of spaces, while we're at it, and make
the 3 sections of code where that's done more alike.
Change-Id: Ica338cd492ac535833933a8b7cd5191217c5ab5b
Reviewed-on: https://code.wireshark.org/review/685
Reviewed-by: Guy Harris <guy@alum.mit.edu>
In some cases, we know, based on the FPGA code, what vwr->STATS_LEN is,
so use that #define.
While we're at it, replace some hardcoded numbers that represent the
statistics trailer length with the appropriate #define.
Also, combine two identical case arms for Ethernet into one.
Change-Id: I0bdea8e5aab146094ad21fa7e67dca2913da688b
Reviewed-on: https://code.wireshark.org/review/672
Reviewed-by: Guy Harris <guy@alum.mit.edu>
vwr->STATS_LEN is the length of the statistics trailer at the end of the
packet, and it's the same for S2 and S3 versions of the WLAN card. It
should *not* be set to the length of the metadata headers that we
*generate and put in front of the packet data that we hand to our
callers*.
Get rid of a debugging message while we're at it.
Change-Id: I465b5ba4dedb88f1f401d34439b44b16a4bb01cc
Reviewed-on: https://code.wireshark.org/review/671
Reviewed-by: Guy Harris <guy@alum.mit.edu>
The so-called "radiotap headers" bear no resemblance to actual
radiotap.org radiotap headers; there are no presence bits, for example.
Get rid of the words "radiotap" and "radio tap", get rid of #defines
that aren't used, get rid of duplicate definitions.
Change-Id: I0bb6abda5d13bf20810dc865a567f4ec51a38056
Reviewed-on: https://code.wireshark.org/review/670
Reviewed-by: Guy Harris <guy@alum.mit.edu>
In the S1 FPGA code, copy the "MPDU starts at 4 or 6" comment.
Get rid of misleading comment in the S2/S3 FPGA code; we're using the
MPDU_OFF field from the private data structure, so we're not calculating
*anything* at that point. Put in comments indicating what's being done
at the point where those calculations are actually done.
Change-Id: Ifda709a6b2aa7edad964f639086012c72c0a71fe
Reviewed-on: https://code.wireshark.org/review/668
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Add a comment describing (some of) the record, while we're at it, and
update another comment to reflect reality.
Change-Id: Ia7f1432402b843b96983375c0e0842c030de0cee
Reviewed-on: https://code.wireshark.org/review/667
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Instead of throwing in 48 and 64 as numbers, use vwr->STATS_LEN to
indicate what the lengths are. Yeah, it has to be fetched at run time,
but big deal.
That also shows that, as we've already rejected records whose size is
less than vwr->STATS_LEN, we don't have to check for that, so eliminate
those checks.
Change-Id: Id4822b3e5a02abfffb2da96a50999e36548a4279
Reviewed-on: https://code.wireshark.org/review/663
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Fix presumed typo while we're at it.
Change-Id: Ic8ae6e6669e5c5fc618ec2516af98ba2390487ce
Reviewed-on: https://code.wireshark.org/review/660
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Adds support for BLUETOOTH_LE_LL_WITH_PHDR, dissector integrates with existing
BTLE dissector.
Fixes BTLE dissector to correctly extract packet CRC.
Adds CRC checking to BTLE dissector.
Provides optional context to BTLE dissector that allows RF captures to provide
link-layer hints for dissection details. Significantly, parameters for
determining CRC correctness are provided, as well as Access Address validity
information.
Change-Id: I7d4936b053353a7f9c524021c01f67f5828253fb
Reviewed-on: https://code.wireshark.org/review/310
Reviewed-by: Anders Broman <a.broman58@gmail.com>
When capturing, they'll be in host byte order. The top of the libpcap
trunk and 1.5 branch, when reading a file, will, if necessary, byte-swap
the type and length values so that they're in the byte order of the host
reading the file (rather than the host that wrote the file).
Do the same when we read a file, and have the NFLOG dissector assume
host byte order for those fields.
Change-Id: I493aed1e07b626af1157d75f3bc293b0a694ad07
Reviewed-on: https://code.wireshark.org/review/148
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Now that we have the ability to choose input file format type
in the GUI, we might as well have it in the command-line too.
Plus it would help me in test-stuies if we had a commandline.
So I've added a '-X read_format:Foo' for this. Using just
'-X read_format:', or with a bad name, will make it print out
the full list (in tshark); just like the '-F' does for output
file formats.
Note: I am *not* putting in code for Win32 GUI,
because I can't compile that and I wouldn't have even
done the GTK one if I could compile Qt originally. (I don't think we need
to add any more features to GTK or Win32, just Qt from now on,
right?)
Change-Id: I2fe6481d186f63bd2303b9e591edf397a2e14b64
Reviewed-on: https://code.wireshark.org/review/493
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
(Using sed : sed -i '/^ \* \$Id\$/,+1 d')
Fix manually some typo (in export_object_dicom.c and crc16-plain.c)
Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8
Reviewed-on: https://code.wireshark.org/review/497
Reviewed-by: Anders Broman <a.broman58@gmail.com>
The best heuristic can fail, so add possibility to manually choose
capture file format type, so not correctly recognize file format can be
loaded in Wireshark.
On the other side now it is possible to open capture file
as file format to be dissected.
Change-Id: I5a9f662b32ff7e042f753a92eaaa86c6e41f400a
Reviewed-on: https://code.wireshark.org/review/16
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com>
Reviewed-by: Evan Huus <eapache@gmail.com>
Tested-by: Evan Huus <eapache@gmail.com>
BlueZ 5/Linux Kernel introduced new way to sniffing Bluetooth interfaces.
We are ready to use it. Libpcap provide new interface called
"bluetooth-monior".
Also fix trivial typos.
Change-Id: Ic608a3d8553bbebbb21f2733ec92c758cbf8f707
Reviewed-on: https://code.wireshark.org/review/253
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Combine the check for whether the field is within the packet data and
the swapping of the field into macros that do both, and use them.
Change-Id: I1db4c5fd76172edd44abc9fb111d79a2537c6c9d
Reviewed-on: https://code.wireshark.org/review/130
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
For some routines that take multiple arguments that come from a struct
wtap_pkthdr, pass a pointer to the struct wtap_pkthdr in question,
rather than the separate arguments. Do this even if we're passing
expressions that were earlier assigned to the struct wtap_pkthdr fields
in question. This simplifies the calling sequences and ensures that the
right values are picked up by the called routine; in at least one case
we were *not* passing the right values (the code to handle Simple Packet
Blocks in pcap-ng files).
Also, call the byte-swapping routines for pseudo-header fields only if
we need to do byte-swapping.
Change-Id: I3a8badfcfeb0237dfc1d1014185a67f18c0f2ebe
Reviewed-on: https://code.wireshark.org/review/119
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
willing to read or that's bigger than will fit in the file format;
instead, report an error.
For the "I can't write a packet of that type in that file type" error,
report the file type in question.
svn path=/trunk/; revision=54882
heuristic cases broken in r49999 when we permitted packets > 64KB, since that
relaxed so severely the definition of a valid packet header.
64MB is an arbitrary and perhaps suboptimal number, but it seems to do the right
thing in all the examples I have handy.
Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9634
svn path=/trunk/; revision=54812
From Michal Labedski
1. add support for new btsnoop "format" introduced by BlueZ team in "btmon" tool
2. Bluetooth: Make EIR, AD and COD more generic
3. Bluetooth: HCI/LL: Update Error Codes to Core 4.1 Specification
4. Ubertooth: Fix response command handling
5. Ubertooth: Update to support firmware version
6. Ubertooth: Dissect by Vendor Id/Product Id
svn path=/trunk/; revision=54699
This is a VERY PRELIMINARY version of tfshark. It's an attempt to jumpstart FileShark and its architecture. Right now it's mostly just a very stripped down version of tshark with all of the necessary build modifications (including now building filetap library since tfshark depends on it)
This code has helped me identify what I believe to be all of the necessary layers for a complete fileshark architecture. And those layers will slowly be added in time (patches always welcome!).
svn path=/trunk/; revision=54646
seek-read routine does that.
Pass the length we just filled in to buffer_assure_space() in the
seek-read routine, and use that in the memcpy() as well.
svn path=/trunk/; revision=54568
both the read and seek-read routines.
Use the packet length read from the packet header when reading packets
randomly.
svn path=/trunk/; revision=54549
of bytes in them to 0, as there's no data in them, and set the offset in
that buffer of the stream's current position, to 0, as we're currently
at the beginning of the file in both streams.
This fixes some tricky-to-reproduce errors (which show up only if the
ngsniffer_t structure is allocated from data that's been allocated,
written to in those variables, and freed).
#BACKPORT 1.8, 1.10
svn path=/trunk/; revision=54544
ngsniffer_read_rec_data(), and separatelyskip extra data after that.
When reading randomly, use the packet length read from the packet
header.
svn path=/trunk/; revision=54523
and set it in NetXRay/Windows Sniffer files if the putative "ATM
reassembly failed" flag is set and, if reassembly failed, don't attempt
to dissect the packet.
svn path=/trunk/; revision=54503
heuristics, but do have a file extension that files of that format are
likely to have, use the extension of the file we're opening, if it has
one, as a hint for which heuristics to try first.
svn path=/trunk/; revision=54495
numeric values using strtoul and casting it the result to a guint32.
Hopefully no user or session IDs are negative or greater than 32 bits.
svn path=/trunk/; revision=54100
suspect, the change to handle VWR files with no packets); shuffle it
after all the types we've seen misidentified as VWR files.
svn path=/trunk/; revision=54012
knowledge of particular types of plugins. Instead, let particular types
of plugins register with the common plugin code, giving a name and a
routine to recognize that type of plugin.
In particular applications, only process the relevant plugin types.
Add a Makefile.common to the codecs directory.
svn path=/trunk/; revision=53710
From İbrahim Can Yüce
From me: Update to new tcp_dissect_pdus format, minor whitespace issues noticed in wiretap files.
svn path=/trunk/; revision=53669
XXX, people are not aware that expression of this macros might be evaluated multiple times, like:
- BSWAP16(tvb_get_letohs(tvb, off)) : \
+ GUINT16_SWAP_LE_BE(tvb_get_letohs(tvb, off)) : \
Should be tvb_get_ntohs() called?
svn path=/trunk/; revision=53653
handle that file not ending with a 2-byte 0xffff end-of-file record.
This fixes bug 9455, although it doesn't add support for reading an
"index" file for a capture that's in multiple .rf5 files, which is a
separate issue noted in that bug.
It also doesn't attempt to figure out what the data in the new record
type following the data that appears to be the same as that in the other
data record format but preceding the actual packet data is.
svn path=/trunk/; revision=53452
in a source description record, including the stack. Dump some other
fields in those records as well.
Attach separate sequential and random read buffers to the private data
structure, rather than allocating them in various routines (and not
always freeing them) and, in at least one case, allocating a single
*common* buffer for all wth's to use.
Fix some comments (the DS0 mask is 32 bytes long, but gets turned into a
bitmask).
Put in a description of what a "stack file"'s contents look like. Much
of it may be useless to us (for example, we have the notion that TCP has
protocol number 6 built-in...), but the RELATION entries that map from
"BASE" to a protocol could obviate the need to have the user specify a
map from stack file names to starting protocols, and we might be able to
use, for example, entries that map TCP/UDP/SCTP port numbers to
protocols to obviate the need for the user to explicitly use Decode As
or otherwise configure port-to-protocol mappings themselves.
Add a bunch of record length checks before we fetch data from records.
svn path=/trunk/; revision=53450
Dump the raw contents of records as hex and ASCII, not just hex.
Sort the record types, and add a new one for a type we've seen in a k18
file and about which we know nothing.
For unknown record types, print the type in hex.
svn path=/trunk/; revision=53441
subtypes, e.g. Network Monitor version 1 and Network Monitor version 2
are separate "file types", even though they both come from Network
Monitor.
Rename various functions, #defines, and variables appropriately.
svn path=/trunk/; revision=53166
.cap, for example, doesn't refer to a particular file type - a whole
bunch of file types use .cap.
Also offer, in addition to "All Files", "All Capture Files", which
matches all the extensions we know about.
svn path=/trunk/; revision=53156
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8818
Add support for dissection ELF files. It opens as a "capture" file via wiretap
at the moment for simplicity's sake, but the intention is eventually to have
this (and other file types we dissect) open through some other program sharing
much of the libwireshark infrastructure.
svn path=/trunk/; revision=52775
Compilation fails on (only the ?) OSX-10.6-x64 buildbot with error:
netscaler.c: In function 'nstrace_read_v30':
netscaler.c:1295: warning: implicit conversion shortens 64-bit value into a 32-bit value
(Life is too short for me to dig multiple levels deep into a set of macros to try to see which
actual line of code is causing the problem. Maybe the patch submitter can identify the problem).
svn path=/trunk/; revision=52666
We read a two-byte length field and add a constant number of header
bytes to this length, so we could in theory be larger than guint16.
svn path=/trunk/; revision=52619
range check for array index
don't assign the result of pntohs() to a gint16
range check for the values stored in phdr.(cap)len
svn path=/trunk/; revision=52618
don't assign the output of pntoh24() to a gint16
unfortunately, vwr detection does not work reliably and many pdf files
are recognized as vwr - this commit should prevent wireshark from
crashing when it tries to load the USB 2.0 spec as pdf ;-)
svn path=/trunk/; revision=52599
whether the (zero-based) interface ID is < the number of interface IDs,
so we don't need to do so in pcapng_read().
Unions are tricky - if the compiler doesn't ensure that the right
component of the union is being used at any given time, various problems
can happen.
Remove some members from the "data" union in the wtapng_block_t
structure, and use a local variable of the specified type.
svn path=/trunk/; revision=52262
the number of bytes available for packet data in the block;
the packet length;
*and* the snapshot length for the interface.
One more fix for bug 9200, so it should *now* be fixed.
svn path=/trunk/; revision=52250
subtract out the minimum SPB size, which includes the length of
*everything* except for the packet data.
Fixes one problem found by the file in bug 9200.
svn path=/trunk/; revision=52244
minus the lengths of the two length fields and the packet length field,
it's the minimum of that and the packet length, as there might be
padding.
Fixes one problem found by the file in bug 9200.
While we're at it, pcapng_read_packet_block() and
pcapng_read_simple_packet_block() return an integer, not a Boolean;
return 0, not FALSE (they have the same value, but returning 0 makes it
clearer that the return value isn't restricted to TRUE or FALSE).
svn path=/trunk/; revision=52241
include only extensions used mostly by capture files (i.e., not ".txt"
or ".xml"), and list each extension set only once (it's silly to have,
for example, separate entries for NetMon, Shomiti Surveyor, and
NetScaler with ".cap" when you get all those types no matter which entry
you choose).
svn path=/trunk/; revision=51547
the "All Files" entry (the current UI guidelines from Microsoft say to
do so, and that's what Paint does, at least), and add an "All Capture
Files" entry with all the file extensions for the file types we support
(it'll pick up all text files, but there's not much we can do about
that, and it won't pick up files with *no* extension or weird
extensions, such as you might get from UN*X systems or from WinDump
commands, but at least it'll filter out some other crud).
Fix what appear to be memory leaks; that should be backported unless
I've missed something and they aren't leaks.
Fix an out-of-date comment, and add an additional comment.
svn path=/trunk/; revision=51481
------------------------------------------------------------------------
r51462 | guy | 2013-08-21 20:21:47 -0700 (Wed, 21 Aug 2013) | 8 lines
What was I thinking? ".caz" is used for compressed *Windows* Sniffer
files (which are just gzipped uncompressed Windows Sniffer files, albeit
with the checksum computed differently in some fashion, or perhaps just
being computed incorrectly), not compressed *DOS* Sniffer files (which
use their own form of compression, which doesn't compress the entire
file, just most of it, and which use the same extensions as uncompressed
DOS Sniffer files).
svn path=/trunk/; revision=51465
files (which are just gzipped uncompressed Windows Sniffer files, albeit
with the checksum computed differently in some fashion, or perhaps just
being computed incorrectly), not compressed *DOS* Sniffer files (which
use their own form of compression, which doesn't compress the entire
file, just most of it, and which use the same extensions as uncompressed
DOS Sniffer files).
svn path=/trunk/; revision=51462
With gcc :
pcapng.c: In function 'pcapng_read_packet_block':
pcapng.c:1147:9: error: request for member 'pseudo_header' in something not a structure or union
With clang :
pcapng.c:1150:86: error: member reference type 'struct wtap_pkthdr *' is a pointer; maybe you meant to use '->'?
pcap_get_phdr_size(int_data.wtap_encap, &wblock->packet_header.pseudo_header));
~~~~~~~~~~~~~~~~~~~~~^
->
(Error message from clang is better...)
svn path=/trunk/; revision=51317
and assign float constants, not double constants, to float variables.
Floating-point constants are double by default; you have to add "f" to
the end to make them float.
This squelches 64-bit-to-32-bit warnings.
svn path=/trunk/; revision=51289
This was the 4th patch, but also:
- use gmalloc0() to allocate vwr struct. Otherwise, valgrind says that
many of fields were still uninitialised when parse_s1_W_stats later
read them
- whitespace tidyup, got rid of remaining tabs and trailing whitespace
Did a fair bit of fuzz-testing without seeing any problems.
svn path=/trunk/; revision=51248
------------------------------------------------------------------------
r51049 | guy | 2013-07-30 22:00:28 -0700 (Tue, 30 Jul 2013) | 5 lines
If no target OS version was specified, default to the major version on
which we're running, so we *always* build against an SDK. (The "10" in
"10.x.y" is not *really* part of the version number, so the "major
version" includes the "10" and the major version number following it.)
svn path=/trunk/; revision=51050
mktime(). That eliminates the need for casts.
It should *also* be part of a per-wtap-structure private data structure,
not a global variable; make it so.
svn path=/trunk/; revision=51000
argument to the -F flag for pcap format is "libpcap", not "pcap", we
have a problem. Make it "pcap", and add a backwards-compatibility hack
to support using "libpcap" as well.
Update the man pages to refer to it as pcap as well, and fix the
capitalization of "WinPcap" (see http://www.winpcap.org) while we're at
it.
Also, refer to http://www.tcpdump.org/linktypes.html for the list of
link-layer header types for pcap and pcap-ng.
svn path=/trunk/; revision=50989
split across page boundaries, rather than being a byte stream, and that
the last page may be short.
Fix some comments.
svn path=/trunk/; revision=50025
out there (especially over USB) and we should be able to load them as long as
they are snapped to a sane length.
Also validate that packets do not specify a snapshot length larger than the one
in the file header, though only make it a warning, as this is not necessarily a
fatally corrupt packet.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8808
svn path=/trunk/; revision=49999
as the "where to put the packet data" argument.
This lets more of the libwiretap code be common between the read and
seek-read code paths, and also allows for more flexibility in the "fill
in the data" path - we can expand the buffer as needed in both cases.
svn path=/trunk/; revision=49949
artificial 16MB limit on blocks.
Do some sanity checks when reading options, to make sure we don't read
past the end of the block.
Make some variables unsigned so as not to get inappropriate
sign-extension (which, in practice, should never happen due to the 16MB
block size limit, although if the limit is raised above 2^31-1, the
limit won't protect you).
Fixes bug 8752.
svn path=/trunk/; revision=49833
visual_process_packet_header() and call it in both the read and
seek-read routines.
Pull the post-processing code that guesses the encapsulation based on
the first few bytes in the packet into
visual_fill_in_chdlc_encapsulation() and call it in both the read and
seek-routines. Add some length checks.
svn path=/trunk/; revision=49812
Check that the record length we got out of the file is at least as big as
stats block trailer; if not, declare the file bad.
svn path=/trunk/; revision=49739
seek offset is after calling it, they can use file_tell(). (Some
routines were already assuming it returned a gboolean.)
svn path=/trunk/; revision=49733
that the complaints are valid, or that simply zeroing them is the right fix
if they are, but at least it builds now. Should we be erroring if we don't
see a sliceLength header?
svn path=/trunk/; revision=49705
frame_table field to NULL before trying to allocate the frame table, so
that if we fail before we allocate the frame table, the attempt to free
the private data doesn't crash due to the frame_table field containing a
bogus pointer.
svn path=/trunk/; revision=49697
and fail with ENOMEM if that fails (and the frame table is not empty -
g_try_malloc() will return NULL if you ask it to allocate zero bytes).
Have an error message for ENOMEM on an open that attempts to tell the
user what the problem is without making their head explode.
svn path=/trunk/; revision=49673
routines are passed a separate struct wtap_pkthdr to be filled in.
Get rid of the pseudo_header member of the wblock structure - the
pseudo-header is part of the struct wtap_pkthdr.
Get rid of the union wtap_pseudo_header * argument to
pcap_process_pseudo_header() - it's passed a pointer to a struct
pcap_pkthdr, and that structure contains the union in question.
Have libpcap_read_header() take a FILE_T argument, rather than using
only the "sequential" handle of the wtap it's handed. Have the libpcap
read routine return the offset of the beginning of the pcap record, and
have the seek-read routine read the header and fill in the struct
wtap_pkthdr handed to it.
svn path=/trunk/; revision=49401
both the read and the seek-read routines. Have the read routine return
the offset of the record header as the record's offset, so that the
seek-read routine can read that header.
svn path=/trunk/; revision=49397
globals directly. If we ever manage to make them *not* globals (which
might only be possible with newer versions of Flex), then we can do
better.
Get rid of an unused variable.
Squelch a 64-bit-to-32-bit conversion warning.
svn path=/trunk/; revision=49396
doesn't need to return the number of bytes of captured packet data (it
can just stuff that into the struct wtap_pkthdr), so have it return a
Boolean success/failure indication.
svn path=/trunk/; revision=49376
have it return -1 for errors or EOF, and have iseries_read() check for a
negative return value and return FALSE. That simplifies it a bit, and
handles the "no more records in the file" case
(iseries_seek_next_packet() will hit EOF and return -1 with *err set to
0, which is what the callers of a read routine expect at EOF).
Get rid of duplicate (and incorrect before the change) comment.
svn path=/trunk/; revision=49375
ipfix_read_and_process_message_header() call it and then fill in the
wtap_pkthdr structure, and use the latter routine in the read and
seek-read routines.
Expand a comment, and fix indentation.
svn path=/trunk/; revision=49369
not a wtap *, and have it fill in the specified struct wtap_pkthdr.
That makes the seek-read routine do the right thing.
svn path=/trunk/; revision=49358
routine.
Rename daintree_sna_hex_char() to daintree_sna_process_hex_data() (to
more clearly indicate what it does - it doesn't process a single
character, it processes a whole bunch of them), and have it do some
error checking and fill in the length field in the wtap_pkthdr.
svn path=/trunk/; revision=49356
the same point at which the rest of the wtap_pkthdr is filled in (so
it's done in seek-read routines).
parse_cosine_hex_dump()'s return value is used as the return value of
read routines, so it should be Boolean. Make it so (and have it stuff
the actual length of packet data read into a wtap_pkthdr, which also
ensure that this is done in seek-read routines).
svn path=/trunk/; revision=49352
routine, for use both by the seek and read routines, and move some
common code there.
Make the delta between Symbian and UNIX time a static value.
Make the prefix for all routine names "btsnoop" rather than "snoop".
svn path=/trunk/; revision=49348
for read and seek-read.
Clarify a comment. (wtap_open_offline() only rewinds the file before
calling each open routine; once one of those routines has decided the
file belongs to it, the seek offset belongs to it, so it needs to do all
the seeking necessary - files with a file header *don't* want a rewind,
they want to leave the seek offset positioned *past* the file header so
it can read the records that follow the file header.)
svn path=/trunk/; revision=49347
Michael Mann