summaryrefslogtreecommitdiff
path: root/wiretap/wtap.h
AgeCommit message (Collapse)AuthorFilesLines
2012-02-11Add the abillity to read and write option comments unedited.Anders Broman1-5/+3
This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-09Add pcapng variables to wtap_pkthdr.Anders Broman1-2/+10
svn path=/trunk/; revision=40947
2012-02-06From Guy Martin:Anders Broman1-0/+1
Add new linktype 243 for MPEG2-TS. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6796 svn path=/trunk/; revision=40884
2012-01-28From Tobias Witek:Anders Broman1-0/+1
Allow dissectors to indicate that an ATM AAL5 frame contains SSCOP. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6717 svn path=/trunk/; revision=40750
2012-01-24Add a routine to Wiretap that takes a file type value and anGuy Harris1-1/+8
encapsulation value and returns a GArray containing all the file types that could be used to save a file of that file type and that encapsulation value (which could be WTAP_ENCAP_PER_PACKET), with the input file type first if that can be used and pcap or pcap-ng first if not and if one of them can be used, and with pcap and pcap-ng clustered together if they're among the file types that can be used. Use that routine for the GTK+ file save dialog. svn path=/trunk/; revision=40685
2012-01-23In the table of capture file types, have:Guy Harris1-6/+8
a field that gives the default extension for the file type, *without* a leading "." (i.e., just the extension, not the "." that separates it from the rest of the file name), which is NULL if there are no known extensions; a field that gives a semicolon-separated list of *other* extensions, without "*." or ".", which is NULL if there are no known extensions or there are no known extensions other than the default. Rename wtap_file_extension_default_string() to wtap_default_file_extension() (matches the name of the field). svn path=/trunk/; revision=40678
2012-01-21Replace wtap_file_extensions_string() with a routine that returns aGuy Harris1-1/+2
GSList of extensions for a file type, including extensions for the compressed versions of those file types that we can read. svn path=/trunk/; revision=40623
2012-01-21It's the Xoraya file type, not the Xoraya encapsulation, that was bogus.Guy Harris1-43/+43
svn path=/trunk/; revision=40622
2012-01-21Get rid of an unused file type. If somebody wants it in the officialGuy Harris1-33/+32
Wireshark distribution, give us code to read it. If somebody wants it in their private version of Wireshark, they can manage that themselves. (We should support plugins for file types at some point; I think we already have support for Lua file readers.) svn path=/trunk/; revision=40620
2012-01-14Get rid of unused WTAP_FILE_WTAP file type.Guy Harris1-15/+14
Move pcap-NG right after standard pcap in the list of file types, so that it shows up early in the list of output file types in the "Save As..." dialog box (if, that is, it's supported; if not, neither is pcap, as they use the same link-layer header type values). svn path=/trunk/; revision=40493
2011-12-28Prepend the sita_phdr fields with "sita_" to make them lessGerald Combs1-5/+5
collision-prone. svn path=/trunk/; revision=40320
2011-12-13Rename WTAP_ERR_BAD_RECORD to WTAP_ERR_BAD_FILE; it really reports anyGuy Harris1-2/+2
form of corruption/bogosity in a file, including in a file header as well as in records in the file. Change the error message wtap_strerror() returns for it to reflect that. Use it for some file header problems for which it wasn't already being used - WTAP_ERR_UNSUPPORTED shouldn't be used for that, it should only be used for files that we have no reason to believe are invalid but that have a version number we don't know about or some other non-link-layer-encapsulation-type value we don't know about. svn path=/trunk/; revision=40175
2011-12-02from Petr Sumbera:Jaap Keuter1-0/+1
Solaris 11 snoop files with IP over Infiniband data are not recognized. Attached patch allows to view such data. svn path=/trunk/; revision=40072
2011-11-12From Holger Pfrommer:Anders Broman1-0/+2
Enhancement of Hilscher Analyzer Dissector. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6082 svn path=/trunk/; revision=39804
2011-10-26Initial support for .aps files from Aethra Telecommunications' PC108Guy Harris1-0/+1
software. More work is needed: we don't know where the capture start time is yet; we aren't handling the "stop capture" record; we don't know where the ISDN channel is; there might be non-ISDN file formats; but this at least is easier than trying to text2pcap hex dumps from that software into pcap files. svn path=/trunk/; revision=39588
2011-10-12From Tobias Witek: Anders Broman1-0/+1
This patch extends the ATM parser so as to allow GPRS NS traffic encapsulated in ATM AAL5. Additionally, added support for this into the 'Meta' dissector. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6447 svn path=/trunk/; revision=39394
2011-09-01Use guint8 rather than guchar for raw octets and pointers to arrays ofGuy Harris1-2/+2
same. Add to wiretap/pcap-common.c a routine to fill in the pseudo-header for ATM (by looking at the VPI, VCI, and packet data, and guessing) and Ethernet (setting the FCS length appropriately). Use it for both pcap and pcap-ng files. svn path=/trunk/; revision=38840
2011-08-31From Andrew Kampjes via bug 6260:Stig Bjørlykke1-1/+4
Added support for saving ERF files. From me: Use crc routines from libwsutil. svn path=/trunk/; revision=38826
2011-06-09- Replace jpeg_jfif decoder, with more generic mime_file (no more 64KB limit!).Jakub Zawadzki1-2/+4
- Add new dissector packet-mime-encap which understands mime_file fragmentation. svn path=/trunk/; revision=37636
2011-06-04Fix wiretap headers to allow error-free ABI dumping.Balint Reczey1-0/+2
svn path=/trunk/; revision=37543
2011-05-31Declare the snapshot_length as unsigned.Chris Maynard1-1/+1
svn path=/trunk/; revision=37479
2011-05-17Declare wtap_dump_has_name_resolution().Guy Harris1-0/+1
svn path=/trunk/; revision=37215
2011-05-09From Jakub Zawadzki: for file read progress bars, use the raw offset inGuy Harris1-1/+1
the file, rather than the offset in the uncompressed data stream. That way we don't get the "hey, we're more than 100% into the file, better refigure this" surprise. svn path=/trunk/; revision=37025
2011-05-03From Tom Brezinski - fix for bug 5869:Guy Harris1-1/+1
This patch incorporates the following fixes from the patch attached to bug 5671 with changes as noted below: 1.) Files where the packet header and packet data are noncontiguous are handled improperly, resulting in read misalignment and ultimately the error message, "Observer: bad record: Invalid magic number 0xXXXXXXXX." This bug is caused by not obeying the packet_entry_header.offset_to_frame field. 2.) Daylight savings time is not properly accounted for in files using local time encoding. 3.) As of Observer/GigaStor v13.10 (bug 5671 incorrectly stated v14), timestamps in the file format changed from local time encoding to GMT encoding. Wiretap has been changed to support reading both formats. Patch submitted with bug 5671 added a separate file type to allow writing local format. This patch does not add the separate file type and always writes GMT. 4.) The wtap_dumper.bytes_dumped field is not being properly incremented as data is written to files. This patch also incorporates the following additional enhancements / fixes not in bug 5671: 1.) Support for reading BFR files which contain Fibre Channel captures. Test file Fibre_Channel_Capture.bfr attached. 2.) Support for modified file header used in upcoming v15. New header file format takes an unused byte from the version string to allow for a larger offset to the first packet to be specified. Test file V15_Lrg_Hdr_Test.bfr is attached, it is also a fuzz test as the number of TLV items given in the header is less then the actual. 3.) It was found that if the number of TLV items given in the header was larger then present it would fail to open the file. Test file V9_Num_TLVs_Too_Big.bfr is attached. svn path=/trunk/; revision=36970
2011-04-28From Hans-Christoph Schemmel:Anders Broman1-0/+1
A variant of 3GPP TS 27.010 multiplexing protocol dissector. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5829 svn path=/trunk/; revision=36927
2011-04-21In file_wrappers.c, explicitly set err_info to null for all errors thatGuy Harris1-11/+2
don't have an "additional information" string. Get rid of WTAP_ERR_ZLIB; just report an internal error with WTAP_ERR_INTERNAL instead. (If they start happening, we can think about supplying an "additional information" string for compression errors on output.) svn path=/trunk/; revision=36774
2011-04-21Add a new WTAP_ERR_DECOMPRESS error, and use that for errors discoveredGuy Harris1-1/+3
by the gunzipping code. Have it also supply a err_info string, and report it. Have file_error() supply an err_info string. Put "the file" - or, for WTAP_ERR_DECOMPRESS, "the compressed file", to suggest a decompression error - into the rawshark and tshark errors, along the lines of what other programs print. Fix a case in the Netscaler code where we weren't fetching the error code on a read failure. svn path=/trunk/; revision=36748
2011-04-12Now that wtap_read() checks for delayed errors on EOF, there's no needGuy Harris1-2/+2
to check for it on close. svn path=/trunk/; revision=36593
2011-04-12Allow wtap_sequential_close() and wtap_close() to return an error; thisGuy Harris1-2/+2
may happen if, when reading a compressed file, we find an error in the file's contents past the last packet (e.g., the file being cut short so that we can't get a full buffer worth of compressed data), and that reporting of that error is delayed (so that you can get all of the packets that we *can* decompress). Check for those errors, at least on the sequential read pass (the only errors we should see when closing the random stream are errors we've already seen in the sequential stream). svn path=/trunk/; revision=36576
2011-04-12"This file format can't be written to a pipe" and "this file formatGuy Harris1-4/+3
can't be saved in compress form" are both equivalent to "this file file format requires seeking when writing it". Change the "can compress" Boolean in the file format table to "writing requires seeking", give all the entries the proper value, and do the checks for attempting to write a file format to a pipe or write it in compressed format to common code. This means we don't need to pass the "can't seek" flag to the dump open routines. svn path=/trunk/; revision=36575
2011-03-28More updates to the wtap_open_offline() comment.Guy Harris1-2/+4
svn path=/trunk/; revision=36384
2011-03-28Update a comment.Anders Broman1-4/+6
svn path=/trunk/; revision=36376
2011-03-24Add initial pcapng name resolution record support. Wireshark has readGerald Combs1-1/+18
support; TShark has read+write support. Additionally TShark can read a "hosts" file and write those records to a capture file. This uses "struct addrinfo" in many places and probably won't compile on some platforms. svn path=/trunk/; revision=36318
2011-03-07From Martin Kaiser: dissector for DVB-CI (Common Interface)Bill Meier1-0/+1
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5654 From me: - Entry for DVBCI added to wtap.c encap_table_base[]; - Some code simplification with respect to the use of col_...() for COL_INFO; - Certain tests for "enough bytes available" not really needed; - (Other minor tweaks); - #include<stdio.h> not req'd; - Minor reformatting and whitespace cleanup; svn path=/trunk/; revision=36149
2011-02-02From njohnkev:Jaap Keuter1-0/+1
Add support for LAPD data link type. svn path=/trunk/; revision=35771
2010-12-19Prepare for handling DLT_IPV4 and DLT_IPV6.Jaap Keuter1-1/+3
svn path=/trunk/; revision=35223
2010-10-20From Hadriel Kaplan: IPFIX file format support.Bill Meier1-0/+2
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5242 svn path=/trunk/; revision=34576
2010-07-30Define WTAP_ENCAP_IEEE802_15_4_NOFCS, for use in file formats that don'tGuy Harris1-1/+2
include the FCS, and use it for the Daintree SNA file format. While we're at it, explicitly check to make sure the purported packet length gives it at least one byte of packet data, and fix some print formats to use %u for unsigned values. svn path=/trunk/; revision=33678
2010-07-19Initial support for Network Monitor 802.11 radio header.Guy Harris1-0/+1
svn path=/trunk/; revision=33583
2010-06-06Clean up indentation.Guy Harris1-5/+5
svn path=/trunk/; revision=33118
2010-05-16Attempt to handle isochronous descriptors between the 64-byte header andGuy Harris1-115/+0
the payload. Should fix bug 4401. svn path=/trunk/; revision=32828
2010-05-07Zlib has an officially-sanctioned way of clearing EOF when we're tailingGerald Combs1-1/+8
a file. Use it. svn path=/trunk/; revision=32716
2010-04-22A bit more information.Guy Harris1-0/+6
svn path=/trunk/; revision=32537
2010-04-22More updates to reflect all the hairy details of Linux USB capture.Guy Harris1-30/+70
svn path=/trunk/; revision=32536
2010-04-22Update a comment to reflect recent changes and to reflect behavior ofGuy Harris1-3/+17
later Linux kernels. svn path=/trunk/; revision=32535
2010-04-21From Chris Maynard:Guy Harris1-5/+6
Support PPP-over-USB. Don't remove the USB pseudo-header from the packet data for Linux USB packets, just byte-swap it if necessary and have the USB dissector fetch the pseudo-header from the raw packet data. Update USB language ID values. svn path=/trunk/; revision=32534
2010-02-02From Stephen Donnelly:Anders Broman1-1/+2
Endace ATM and AAL2 enhancements. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4447 svn path=/trunk/; revision=31766
2010-02-01From Tobias Witek:Anders Broman1-0/+1
Replace ERF dissector with ATM dissector for protocols 'FP Hint' and 'META' https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4384 svn path=/trunk/; revision=31761
2009-12-08From Felix Obenhuber via bug #4299: SocketCAN dissector patchStephen Fisher1-0/+1
From me: Remove changes related to the ARP protocol because it doesn't appear to be necessary for SocketCAN. Will add later if Felix says it is needed. svn path=/trunk/; revision=31196
2009-12-03Renamed some wtap defines:Stig Bjørlykke1-2/+2
WTAP_GCOM_TIE1 => WTAP_ENCAP_GCOM_TIE1 WTAP_GCOM_SERIAL => WTAP_ENCAP_GCOM_SERIAL svn path=/trunk/; revision=31161
generated by cgit v1.2.1 (git 2.18.0) at 2024-07-04 02:36:24 +0000