summaryrefslogtreecommitdiff
path: root/wiretap/netxray.c
AgeCommit message (Collapse)AuthorFilesLines
2012-02-25Add a presence flag field to the packet information structure filled inGuy Harris1-0/+2
by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2011-09-01Use guint8 rather than guchar for raw octets and pointers to arrays ofGuy Harris1-6/+6
same. Add to wiretap/pcap-common.c a routine to fill in the pseudo-header for ATM (by looking at the VPI, VCI, and packet data, and guessing) and Ethernet (setting the FCS length appropriately). Use it for both pcap and pcap-ng files. svn path=/trunk/; revision=38840
2011-04-28#include <stdlib.h> not needed;Bill Meier1-306/+305
use consistent indentation. svn path=/trunk/; revision=36921
2011-04-21Add a new WTAP_ERR_DECOMPRESS error, and use that for errors discoveredGuy Harris1-14/+15
by the gunzipping code. Have it also supply a err_info string, and report it. Have file_error() supply an err_info string. Put "the file" - or, for WTAP_ERR_DECOMPRESS, "the compressed file", to suggest a decompression error - into the rawshark and tshark errors, along the lines of what other programs print. Fix a case in the Netscaler code where we weren't fetching the error code on a read failure. svn path=/trunk/; revision=36748
2011-04-12"This file format can't be written to a pipe" and "this file formatGuy Harris1-18/+2
can't be saved in compress form" are both equivalent to "this file file format requires seeking when writing it". Change the "can compress" Boolean in the file format table to "writing requires seeking", give all the entries the proper value, and do the checks for attempting to write a file format to a pipe or write it in compressed format to common code. This means we don't need to pass the "can't seek" flag to the dump open routines. svn path=/trunk/; revision=36575
2011-04-06From Jakub Zawadzki:Guy Harris1-4/+4
file_read(buf, bsize, count, file) macro is compilant with fread function and takes elements count+ size of each element, however to make it compilant with gzread() it always returns number of bytes. In wiretap file_read() this is not really used, file_read is called either with bsize set to 1 or count to 1. Attached patch remove bsize argument from macro. svn path=/trunk/; revision=36491
2011-02-25From Robert Bullen: ... code is not incrementing wtap_dumper.bytes_dumped.Bill Meier1-0/+6
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5666 Fro me: use 4 -space indentation (not tab) to match surrounding code lines. svn path=/trunk/; revision=36074
2010-08-08Add a note.Guy Harris1-0/+4
svn path=/trunk/; revision=33741
2010-06-06Don't use fwrite directly when writing a dump file; call it throughGuy Harris1-68/+8
wtap_dump_file_write(). Replace various wrappers around fwrite() with wtap_dump_file_write(), or at least make the wrappers call wtap_dump_file_write(). svn path=/trunk/; revision=33116
2010-02-26Move the definitions of all the private data structures out ofGuy Harris1-51/+73
wtap-int.h, and change the unions of pointers to those private data structures into just void *'s. Have the generic wtap close routine free up the private data, rather than the type-specific close routine, just as the wtap_dumper close routine does for its private data. Get rid of close routines that don't do anything any more. svn path=/trunk/; revision=32015
2009-04-24[Trivial] Constify a few thingsBill Meier1-5/+5
svn path=/trunk/; revision=28144
2009-04-22Clean up some 64-bit issues.Guy Harris1-5/+5
svn path=/trunk/; revision=28117
2009-01-06Fix a typo in a commentBill Meier1-1/+1
svn path=/trunk/; revision=27164
2009-01-04Oops: Revert SVN #27152: There weren't actually any memory leaks ...Bill Meier1-6/+0
svn path=/trunk/; revision=27155
2009-01-04Fix a few minor memory leaks...Bill Meier1-0/+6
svn path=/trunk/; revision=27152
2007-08-17At least some LAPB Windows Sniffer captures have 4 bytes of extra stuffGuy Harris1-0/+23
at the ends of packets. svn path=/trunk/; revision=22540
2007-06-11Note invalidity of realtick for Bill Meier1-5/+7
captypes ETH_CAPTYPE_OTHERPOD2 and ETH_CAPTYPE_GIGPOD2 in comments for the associated TpS tables. svn path=/trunk/; revision=22074
2007-05-31Note realtick's invalidity for ETH_CAPTYPE_OTHERPOD in the comment forGuy Harris1-0/+4
TpS_otherpod[]. Ask about its validity for ETH_CAPTYPE_OTHERPOD2 and ETH_CAPTYPE_GIGPOD2. svn path=/trunk/; revision=22016
2007-05-31My comment is redundant with Bill's more-detailed comment; remove it.Guy Harris1-3/+0
svn path=/trunk/; revision=22015
2007-05-30Update CommentsBill Meier1-3/+9
svn path=/trunk/; revision=22005
2007-05-30Update a comment.Guy Harris1-2/+2
svn path=/trunk/; revision=21998
2007-05-29Give more detail on a captype of 6 for an Ethernet capture.Guy Harris1-1/+1
svn path=/trunk/; revision=21997
2007-05-29It's pretty clear that hdr.captype's interpretation depends on theGuy Harris1-7/+10
network type; there's no "presumably" about it. Suggest that "realtick" might have the right time stamp in other cases (if not, a comment should explicitly indicate that, so that in all cases where we either know that realtick is wrong or have a lot of evidence to show that it's right, we note that fact). svn path=/trunk/; revision=21996
2007-05-29Update the big time unit comment to reflect Bill Meier's recent changes.Guy Harris1-20/+32
Fix some other comments. Add a suggestion for why the realtick values might correlate with packets having an FCS. svn path=/trunk/; revision=21993
2007-05-29(fix comment)Bill Meier1-2/+2
svn path=/trunk/; revision=21983
2007-05-29Another sniffer timestamp display fix; addresses bug 866 and other reports.Bill Meier1-17/+47
(Also: change variable name to correctly reflect usage). svn path=/trunk/; revision=21982
2007-04-26From Jeff Foster: add support for Cisco HDLC captures.Guy Harris1-0/+9
svn path=/trunk/; revision=21598
2006-11-05change all file offsets from long to gint64 so we can - theoretically - ↵Ulf Lamping1-4/+4
handle files > 2GB correct. Please distclean Win32 builds! svn path=/trunk/; revision=19814
2006-10-23Use G_GINT64_CONSTANT to handle 64-bit constants in the code.Michael Tüxen1-4/+4
svn path=/trunk/; revision=19663
2006-10-20fix 'save' to store hi-order 32 bits of time offset for each pkt; fixes bug 1168Bill Meier1-10/+16
svn path=/trunk/; revision=19622
2006-04-15Sake Blok wrote....Jaap Keuter1-1/+11
I have taken a look at the trace myself and calculated the TpS to be 20000000.0 for this particular trace. If I also discard the start_timestamp like it has been done for other versions of the netxray format, then I get the proper results. svn path=/trunk/; revision=17869
2006-03-11Remove an entire horde of off-by-one errors pointed out by Coverity's CID: 83Luis Ontanon1-5/+5
(Coverity finds just one at a time...) svn path=/trunk/; revision=17580
2006-03-08Another off by one error found by coverity (CID 83), using > instead of >= ↵Luis Ontanon1-1/+1
when comparing index against array size. svn path=/trunk/; revision=17521
2006-01-12The attached patch to fix bug 663 allows Ethereal to read WindowsJaap Keuter1-3/+38
Sniffer V2 format capture files with captyp=5, timeunit=0. The ticks_per_sec for this case apparently is 1e6. Bill Meier svn path=/trunk/; revision=17019
2005-09-09From Bill Meier:Guy Harris1-23/+51
define "timezone" as "gint16", as it can be positive (west of UTC) or negative (east of UTC); update comments to refer to the new names for structure members; say the precision of the time stamps is 1 nanosecond only if the ticks per second is > 10 million; fix the handling of files truncated exactly on a frame boundary. svn path=/trunk/; revision=15739
2005-08-29Get rid of the old file header definition.Guy Harris1-31/+17
Set the time stamp resolution based on whether the number of ticks per second is > 1 million or not. svn path=/trunk/; revision=15606
2005-08-28From Bill Meier:Guy Harris1-34/+91
1. Use the new (good work!) 'nanosec' precision only for gig pods; 2. Rework 'struct netxray_hdr' to make it (somewhat) easier to maintain and revise: a. Declare known hdr fields such as 'captype' instead of using offsets in 'xxx placeholder' fields. d. Define 'unknown' hdr fields using placeholder names based upon hex-offset in the netxray header record. (This isn't perfect, but I hope it will make things more manageable). 3. Update hdr field info (based upon examination of various capture files): a. Define a hdr field which appears to be 'time-zone' [offset in hours from UTC] for the machine doing the capture. (Maybe this field can eventually be used for Ethereal to display the (local) time as it was at the time of the capture). b. Describe certain hdr fields as being "file offsets" (altho the exact use is still unclear). Update some comments. svn path=/trunk/; revision=15603
2005-08-25timestamp display precision:Ulf Lamping1-0/+8
- automatic adjustment depending on file format - manual adjustment through menu items save the setting in the recent file svn path=/trunk/; revision=15534
2005-08-24EVERYTHING IN THE BUILDBOT IS GOING TO BE RED!!! Sorry! Ulf Lamping1-16/+16
I've done more than a day to change the timestamp resolution from microseconds to nanoseconds. As I really don't want to loose those changes, I'm going to check in the changes I've done so far. Hopefully someone else will give me a helping hand with the things left ... What's done: I've changed the timestamp resolution from usec to nsec in almost any place in the sources. I've changed parts of the implementation in nstime.s/.h and a lot of places elsewhere. As I don't understand the editcap source (well, I'm maybe just too tired right now), hopefully someone else might be able to fix this soon. Doing all those changes, we get native nanosecond timestamp resolution in Ethereal. After fixing all the remaining issues, I'll take a look how to display this in a convenient way... As I've also changed the wiretap timestamp resolution from usec to nsec we might want to change the wiretap version number... svn path=/trunk/; revision=15520
2005-08-18Try yet another scheme for handling time stamps; realtick isn't alwaysGuy Harris1-44/+146
correct. svn path=/trunk/; revision=15404
2005-07-02Chris Lydick: Support for Sniffer 2.003 files.Jörg Mayer1-1/+9
Modified to match the current codebase. svn path=/trunk/; revision=14832
2005-06-16Note that the WAN_CAPTYPE value of 4 can correspond to Cisco HDLCGuy Harris1-0/+14
traffic as well as Frame Relay traffic, and give some information about the cruft found in the xxc field of the header for one CHDLC and one FR capture. svn path=/trunk/; revision=14659
2005-01-29Add some notes about stuff discovered by Ken Mann.Guy Harris1-1/+11
svn path=/trunk/; revision=13194
2005-01-14Note that the low-order bit of hdr->hdr_2_x.xxx[8] appears to be a "badGuy Harris1-2/+10
FCS" bit for 802.11, just as it appears to be for Ethernet, and give more details on the 4 bytes of junk at the end of the packet (i.e., that we haven't yet seen an 802.11 capture where it's an FCS rather than just junk). svn path=/trunk/; revision=13028
2005-01-03Add some more comments about the FCS issue.Guy Harris1-10/+14
svn path=/trunk/; revision=12939
2005-01-03Give a bit more information on the "are there FCSes in the frame?"Guy Harris1-5/+32
issue. svn path=/trunk/; revision=12938
2005-01-03Rename the CAPTYPE_ definitions as appropriate - many of them areGuy Harris1-25/+39
specific to particular types of captures, and the same value might correspond to more than one CAPTYPE_ definition. Add an additional CAPTYPE_ for some non-gigabit Ethereal capture seen by Bill Meier, and fix the range check the time stamp units value as per his mail. svn path=/trunk/; revision=12937
2005-01-03From James Fields and Kevin Johnson: fix the handling of time stamps inGuy Harris1-69/+86
a number of Windows Sniffer captures - apparently the time stamp units are in a field in the file header. Add a capture type value seen in at least one ATM capture. Update some comments, and add some comments. Get rid of some redundant setting of "timeunit". svn path=/trunk/; revision=12936
2004-10-17file_hdr.network is one byte long, so don't use htoles() on values it'sGuy Harris1-2/+2
set to - that causes it to be set to zero. svn path=/trunk/; revision=12328
2004-07-18Set the svn:eol-style property on all text files to "native", so thatGuy Harris1-1/+1
they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
generated by cgit v1.2.1 (git 2.18.0) at 2024-06-15 10:21:06 +0000