summaryrefslogtreecommitdiff
path: root/wiretap/wtap.h
AgeCommit message (Collapse)AuthorFilesLines
2017-06-22Add WTAP_ENCAP_3MB_ETHERNET for Xerox 3MB Ethernet.Guy Harris1-0/+1
It needed to be done: https://github.com/shirriff/pup-wireshark (And, yes, there really *is* a DLT_/LINKTYPE_ for it! The original DLT_ values were ARP hardware types, and 3MB Ethernet was assigned an ARP hardware type of 2.) Change-Id: I60d96c28e67854adcb28c7e3579ae5dd1f07df4b Reviewed-on: https://code.wireshark.org/review/22336 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-09Add URL for link specifying D-Bus maximum message length.Guy Harris1-1/+6
Change-Id: I5797407a18fda674b2c9b2cc1c192c211c91c496 Reviewed-on: https://code.wireshark.org/review/22052 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-05Allow bigger snapshot lengths for D-Bus captures.Guy Harris1-5/+9
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except for D-Bus captures. Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for them, because that's the largest possible D-Bus message size. See https://bugs.freedesktop.org/show_bug.cgi?id=100220 for an example of the problems caused by limiting the snapshot length to 256KB for D-Bus. Have a snapshot length of 0 in a capture_file structure mean "there is no snapshot length for the file"; we don't need the has_snap field in that case, a value of 0 mean "no, we don't have a snapshot length". In dumpcap, start out with a pipe buffer size of 2KB, and grow it as necessary. When checking for a too-big packet from a pipe, check against the appropriate maximum - 128MB for DLT_DBUS, 256KB for everything else. Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20 Reviewed-on: https://code.wireshark.org/review/21952 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-03LoRaTap DLT and dissectorErik de Jong1-0/+1
Add support for handling LoRaTap (https://github.com/eriknl/LoRaTap) DLT in wiretap and add dissector for LoRaTap headers. Exposes Syncword for subdissectors to dissect frame payload. Change-Id: Ie4ba2189964376938f45eb3da93f2c3376042e85 Reviewed-on: https://code.wireshark.org/review/21915 Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2017-06-03Don't keep the pcap/pcapng link-layer header type as interface data.Guy Harris1-1/+0
Either 1) it can be determined from the libwiretap encapsulation type, in which case it's redundant information or 2) there *is* no pcap/pcapng link-layer header type for that encapsulation type, in which case you need to check for the attempt to determine it failing and handle that failure appropriately. Change-Id: Ie9557b513365c1fc8c6df74b9c8239e29aad46bc Reviewed-on: https://code.wireshark.org/review/21924 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-30packet-ieee80211-radio.c: Minor refactor and whitespace cleanupSimon Barber1-9/+11
Change-Id: Idad8f7eeed968eeed9f553fef98d58453f328afb Reviewed-on: https://code.wireshark.org/review/21421 Petri-Dish: Michael Mann <mmann78@netscape.net> Reviewed-by: Michael Mann <mmann78@netscape.net> Tested-by: Michael Mann <mmann78@netscape.net>
2017-03-31Add packet capture support for Darwin USBScott Deandrea1-0/+1
Change-Id: Iec9e4ac2362cf8e88a3cf6ae3483cefe938967e5 Reviewed-on: https://code.wireshark.org/review/20814 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-02-18wiretap: add open_routines cleanup function.Dario Lombardo1-0/+2
Change-Id: Id88fe84189b8baa597eaa69159395cdc4bc56195 Reviewed-on: https://code.wireshark.org/review/19951 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-02-14wiretap: add cleanup routine.Dario Lombardo1-0/+3
The cleanup routine has been added to exit section of the applications. Those which required a exit restyle have been patched as well. Change-Id: I3a8787f0718ac7fef00dc58176869c7510fda7b1 Reviewed-on: https://code.wireshark.org/review/19949 Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Dario Lombardo <lomato@gmail.com>
2016-12-04Have a routine to do all the work of initializing libwiretap.Guy Harris1-2/+4
Have programs that use libwiretap call that routine rather than separately calling some or all of init_open_routines(), wtap_register_plugin_types(), and wtap_opttypes_initialize(). Also don't have routines internal to libwiretap call those. Yes, this means doing some initialization work when it isn't necessary, but scattering on-demand calls throughout the code is a great way to forget to make those calls. Change-Id: I5828e1c5591c9d94fbb3eb0a0e54591e8fc61710 Reviewed-on: https://code.wireshark.org/review/19069 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-09-10wiretap: fix memory leak of interface_data for wtap_dumperPeter Wu1-2/+9
Mirrors the behavior of wtap_close. Change-Id: I1a04878fdd0409fa74931737332f9b8a1ae77fb1 Reviewed-on: https://code.wireshark.org/review/17620 Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-09-10Have "All Capture Files" match only capture files.Guy Harris1-8/+14
We support reading some types of files that aren't capture files, in case we have a dissector for that file format (because, for example, it's often transported over HTTP). Don't include them in the set of files "All Capture Files" matches; you can still look for them as they have individual entries in the drop-down menu of file type patterns. Ultimately, there should be Fileshark/TFileshark programs to read those files - and other file types, and even capture files if the goal is to look at the file structure rather than at the packets - and *that's* the program that should offer the ability to load JPEGs and so on. (No, this does not reduce the "All Capture Files" list down to a level that makes the problem in bug 12837 go away. The right way to fix *that* is to arrange, somehow, that the "All Capture Files" entry not actually list all the suffixes it matches.) Change-Id: I705bff5fcd0694c6c6a11892621a195aa7cd0264 Reviewed-on: https://code.wireshark.org/review/17619 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-25Go back to having only one SocketCAN LINKTYPE_ value.Guy Harris1-2/+1
Libpcap just backed out the "host-endian" SocketCAN LINKTYPE_ value; we don't need it any more. Change-Id: I33a7dc21207a0009e20b4abaefe1119eb649c39a Reviewed-on: https://code.wireshark.org/review/17327 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-19Handle the new LINKTYPE_CAN_SOCKETCAN_HOSTENDIAN.Guy Harris1-1/+2
Unfortunately, only one libpcap code path puts the CAN ID in the SocketCAN header in network byte order; the others leave it in host byte order. Therefore, a new LINKTYPE_/DLT_ value was introduced, and libpcap was changed to use that for the cases where the CAN ID is in host byte order. Support them both. This means we need to, when reading pcap and pcapng files, fix up the CAN ID if the host that wrote the file has a different byte order from ours (as libpcap also now does). This includes Linux "cooked" captures, which can include CAN packets. Change-Id: I75ff2d68d1fbdb42753ce85d18f04166f21736dd Reviewed-on: https://code.wireshark.org/review/17155 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-15Do a deep copy in wtap_block_add_custom_option().Guy Harris1-1/+1
That way, we don't have to worry about multiple instances of an option pointing to the same data. and having to worry about freeing data that's pointed to by another instance. Change-Id: I3470a9eebf346023713fd0d6ff2451d727c25089 Reviewed-on: https://code.wireshark.org/review/16471 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-14Redo the block options APIs.Guy Harris1-38/+21
A block can have zero or more instances of a given option. We distinguish between "one instance only" options, where a block can have zero or one instance, and "multiple instances allowed" options, where a block can have zero or more instances. For "one instance only" options: "add" routines add an instance if there isn't one already and fail if there is; "set" routines add an instance if there isn't one already and change the value of the existing instance if there is one; "set nth" routines fail; "get" routines return the value of the instance if there is one and fail if there isn't; "get nth" routines fail. For "multiple instances allowed" options: "add" routines add an instance; "set" routines fail; "set nth" routines set the value of the nth instance if there is one and fail otherwise; "get" routines fail; "get nth" routines get the value if the nth instance if there is one and fail otherwise. Rename "optionblock" to just "block"; it describes the contents of a block, including both mandatory items and options. Add some support for NRB options, including IPv4 and IPv6 option types. Change-Id: Iad184f668626c3d1498b2ed00c7f1672e4abf52e Reviewed-on: https://code.wireshark.org/review/16444 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-06-21Add support for Opencontrail virtual networkRudra Rugge1-0/+1
Change-Id: Ia6012e0f6425be069e222538eafb1191b398ec83 Reviewed-on: https://code.wireshark.org/review/15930 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-15More Sysdig / system event support.Gerald Combs1-0/+1
Add REC_TYPE_SYSCALL to wiretap and use it for Sysdig events. Call the Sysdig event dissector from the frame dissector. Create a "syscall" protocol for system calls, but add "frame" items to it for now. Add the ability to write Sysdig events. This lets us merge packet capture and syscall capture files. Change-Id: I12774ec69c89d8e329b6130c67f29aade4e3d778 Reviewed-on: https://code.wireshark.org/review/15078 Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-06Move ip6_to_str_buf() to to_str.c and make it take the buffer length.João Valverde1-1/+1
Also make it use ws_inet_ntop6() (rather than implementing the string conversion ourselves). Remove ip6_to_str_buf_len(). Change-Id: I1eff3a8941e00987c2ff0c4dcfda13476af86191 Reviewed-on: https://code.wireshark.org/review/15692 Reviewed-by: João Valverde <j@v6e.pt> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-01Add data structures necessary to support multiple Name Resolution blocks.Michael Mann1-10/+10
This doesn't try to use any data from multiple Name Resolution blocks, it just converts single Name Resolution block usage into a GArray, so the potential is there to then use/support multiple Name Resolution blocks within a file format (like pcapng) Change-Id: Ib0b584af0bd263f183bd6d31ba18275ab0577d0c Reviewed-on: https://code.wireshark.org/review/15684 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-01Add data structures necessary to support multiple Section Header blocks.Michael Mann1-9/+9
This doesn't try to use any data from multiple Section Header blocks, it just converts single Section Header block usage into a GArray, so the potential is there to then use/support multiple Section Header blocks within a file format (like pcapng) Change-Id: I6ad1f7b8daf4b1ad7ba0eb1ecf2e170421505486 Reviewed-on: https://code.wireshark.org/review/15636 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-04-18wiretap: add support for the mplog capture file formatMartin Kaiser1-0/+1
the mplog format is used by some commercial logging tools that capture ISO 14443 traffic between a card reader and a contactless smartcard Change-Id: If359b8f0f671eb2a7c6315e2b8960a5bd581a9e9 Reviewed-on: https://code.wireshark.org/review/14950 Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
2016-04-01support for IP-over-Infiniband - pcap encapsulationPetr Sumbera1-1/+2
Bug: 12279 Change-Id: Ib6c54f8b86d95c5546bc800749f124cd0dbb8ff0 Reviewed-on: https://code.wireshark.org/review/14585 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2016-02-23Making wiretap option blocks more generic.Michael Mann1-182/+34
This was inspired by https://code.wireshark.org/review/9729/, but takes it in a different direction where all options are put into an array, regardless of whether they are "standard" or "custom". It should be easier to add "custom" options in this design. Some, but not all blocks have been converted. Descriptions of some of the block options have been moved from wtap.h to pcapng.h as it seems to be the one that implements the description of the blocks. Also what could be added/refactored is registering block behavior. Change-Id: I3dffa38f0bb088f98749a4f97a3b7655baa4aa6a Reviewed-on: https://code.wireshark.org/review/13667 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-02-20Initial support for FreeBSD USB captures.Guy Harris1-7/+1
(There's also work needed in libpcap; that's also in progress.) Change-Id: Iff5a34c139a000865e2d78cc17a4af5ff24fb44b Reviewed-on: https://code.wireshark.org/review/14025 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-20Put back a define to make the Lua build happy.Guy Harris1-1/+7
DO NOT USE THIS FOR ANYTHING NEW. Change-Id: Iee2ddaa2eeb735b33aef9e81b32bb4a3535e3451 Reviewed-on: https://code.wireshark.org/review/14023 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-19Get rid of PCAP_ENCAP_USB.Guy Harris1-1/+1
It doesn't correspond to anything we support - and the old Linux USB LINKTYPE_ value of 186 doesn't give enough information to dissect the packets (it discards the event type, for example), so we drop the rest of our support for it as well. Change-Id: I6f537d9263174aba4320edf5140e1d1540e979c8 Reviewed-on: https://code.wireshark.org/review/14020 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-29Add A-MPDU reassembly information to the radio metadata.Guy Harris1-0/+9
Change-Id: I338e7fb60ff62d1d26ca0b32468ada4294d52d8d Reviewed-on: https://code.wireshark.org/review/13594 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-13Move structure definition outside another structure definition.Guy Harris1-4/+6
I guess the ability to define a structure inside another structure is a C-ism discarded by C++, so it causes warnings if you disallow stuff that can't be handled by a C++ compiler, as we do. Change-Id: I8cf52af0424708eb663ab6dbfecbf317fe3bccdb Reviewed-on: https://code.wireshark.org/review/13257 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-13Clean up handling of the data before the Ethernet packet in ERF files.Guy Harris1-1/+4
The data before the Ethernet packet isn't a 16-bit little-endian integer, it's two bytes, one byte of offset and one byte of padding. Change-Id: I327b88f058dda184b79d3c2c6cf0dea52c0d28b1 Reviewed-on: https://code.wireshark.org/review/13254 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-13Dissect the MC and AAL2 headers as 32-bit words.Guy Harris1-0/+1
That's how they're extracted in the libwiretap module, and that's how they're shown in the ERF spec. This gets rid of some compiler warnings about type-punning. Merge some reserved bit fields to match what's in the ERF spec. Renumber others. Process the AAL2 and MC headers differently; yes, they're both big-endian 32-bit values, but that makes the code a bit clearer, and, heck, the optimizer may well combine the two sequences of code. Change-Id: Ief7f976e77e8f2fba1685ad5a50ee677a8070ae7 Reviewed-on: https://code.wireshark.org/review/13251 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-05GFP: Add support for Generic Framing Procedure (ITU-T G.7041/Y.1303)John A. Thacker1-0/+2
Add support for Generic Framing Procedure. Generic Framing Procedure (GFP) is used to map octet-aligned variable length payloads (e.g. Ethernet, MPLS, octet-aligned PPP, IP) into octet-synchronous signals such as SONET/SDH (ITU-T G.707) and OTN (ITU-T G.709). GFP is a telecommunications industry standard defined in ITU-T G.7041/Y.1303. (https://www.itu.int/rec/T-REC-G.7041/) Bug: 11961 Change-Id: Idf5b311e82b051b1ee65bde5149b3de405537b02 Reviewed-on: https://code.wireshark.org/review/13043 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-12-24Refactor 802.11 radio flags.Simon Barber1-75/+51
The use of a flag field here is aesthetically unpleasing when the flags are referred to frequently. Convert these into bitfield entries. Change-Id: I6f47e31558439dfd343ec7f856d04480366a1237 Reviewed-on: https://code.wireshark.org/review/12511 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-26Process the radio information internally for AiroPeek classic files.Guy Harris1-34/+33
Process it in libwiretap; no need to hand it to libwireshark for dissection, it can just dissect the radio information pseudo-header with the processed information. Change-Id: I482697947eecbd3967cf1910ba2fa2bff805cd66 Reviewed-on: https://code.wireshark.org/review/12202 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-19use the official DLT for ISO14443Martin Kaiser1-0/+1
add DLT_ISO14443 to pcap_to_wtap_map[] define WTAP_ENCAP_ISO14443, link it to the iso14443 dissector Change-Id: Id837197c4d66071094f9336d60db36a371424807 Reviewed-on: https://code.wireshark.org/review/11959 Petri-Dish: Martin Kaiser <wireshark@kaiser.cx> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-11-12Add wtap_dump_open_tempfile routines, to write to a temporary file.Guy Harris1-0/+31
It includes the temporary-file generation, so you don't have to do it yourself. Change-Id: I0798df95a5c5646224ec49612f50b423ed78547a Reviewed-on: https://code.wireshark.org/review/11751 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-10Initial Sysdig syscall (event) support.Gerald Combs1-0/+15
Add a dissector for reading Sysdig event blocks. It only handles plain events but it's usable for reading trace files on hand here. Use a script to generate various parts of the dissector. As an experiment, update parts in-place instead of using a template. Ultimately there should probably be a top-level "Syscall" or "Event" dissector alongside the "Frame" dissector, which could then call this. You could then directly compare an executable's system calls alongside its network traffic. For now leverage the pcapng_block dissector and keep everything under "Frame". Next steps: - Items listed at the top of packet-sysdig-event.c. Change-Id: I17077e8d7f40d10a946d61189ebc077d81c4da37 Reviewed-on: https://code.wireshark.org/review/11103 Petri-Dish: Gerald Combs <gerald@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-11-10Skip only the actual file descriptor close when writing to stdout.Guy Harris1-0/+26
Have a "this is stdout" flag for a wtap_dumper, and have "open the standard output for dumping" routines that set that flag. When closing a wtap_dumper, do most of the work regardless of whether we're writing to the standard output or not (so that everything gets written out) and only skip the closing of the underlying file descriptor. Change-Id: I9f7e4d142b3bd598055d806b7ded1cb4c378de8e Reviewed-on: https://code.wireshark.org/review/11673 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-04Don't include libwireshark headers from libwiretap.Guy Harris1-0/+17
Move the definitions of hashipv4_t and hashipv6_t to wiretap/wtap.h, as that's the main place they're used. Change them a bit not to depend on other stuff from libwireshark, and change the code as required by those changes. This should fix the Solaris build; apparently, the Sun^WOracle compiler is generating code for static inline functions even if they're never called, so that libwiretap ends up including code that calls tvbuff and wmem functions. There's probably further cleanup that could be done here, but this should at least fix the build, as well as getting rid of a dependency between two libraries that are at least somewhat independent (libwiretap should *not* depend on libwireshark, as some programs use libwiretap but not libwireshark, and, ultimately, we probably want it to be possible to use libwireshark without libwiretap but that'd be more work). Change-Id: I91c745282f17d7c8bff7809aa277eab2b3cf47c1 Reviewed-on: https://code.wireshark.org/review/11537 Petri-Dish: Guy Harris <guy@alum.mit.edu> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-08-24Add some symbols to wtap.h so that we can correctly support 802.11ad.Richard Sharpe1-1/+27
Currently there are a lot of local hacks in the 802.11ad support and better support can be provided. Also add a structure to track 802.11ad (DMG) specific features in the phdr structure as suggested by Guy Harris. Also, respond to some suggestions by Guy Harris. Change-Id: I8459e3986a134a08ee2e31f0158b8aa5c9b91d86 Signed-off-by: Richard Sharpe <realrichardsharpe@gmail.com> Reviewed-on: https://code.wireshark.org/review/10204 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-08-21Fix memory leaks of dumper SHB and IDB infosHadriel Kaplan1-0/+23
Change-Id: I6b81d3e853d503c6a81f9793957b48ab34c6808c Reviewed-on: https://code.wireshark.org/review/10156 Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-08-19capinfos: add more info about file and interfacesHadriel Kaplan1-1/+9
Add more information about the capture file, and about the interface descriptions in it. Also remove long-unused g_options code. Change-Id: I93cbd70fc7b09ec1b8b2fd6c85bb885c7f749543 Reviewed-on: https://code.wireshark.org/review/10073 Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-08-18Improve file merging for mergecap and wiresharkHadriel Kaplan1-0/+12
Refactor the file merging code by removing the duplicate logic from mergecap.c and file.c's cf_merge_files(), into a new merge_files() function in merge.c. Also the following user-visible changes: * Removed the '-T' encap type option from mergecap, as it's illogical for mergecap and would complicate common merge code. * Input files with IDBs of different name, speed, tsprecision, etc., will produce an output PCAPNG file with separate IDBs, even if their encap types are the same. * Added a '-I' IDB merge mode option for mergecap, to control how IDBs are merged. * Changed Wireshark's drag-and-drop merging to use PCAPNG instead of PCAP. Bug: 8795 Bug: 7381 Change-Id: Icc30d217e093d6f40114422204afd2e332834f71 Reviewed-on: https://code.wireshark.org/review/10058 Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-08-18Pcapng: clean up Section Header Block handlingHadriel Kaplan1-8/+63
Change-Id: I8516d0c561ed0b63e49a3594027c9c15bb789258 Reviewed-on: https://code.wireshark.org/review/9726 Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com> Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-08-06Pcapng: support Name Resolution Block optionsHadriel Kaplan1-6/+99
Make pcapng decode options in an NRB during read, and store the comment option, and write it back out as well. Also make it handle plugin handlers for unknown options in received NRB(s). Change-Id: I81863ef8d85cb1c8b5ba6673ba0e562efe77714f Reviewed-on: https://code.wireshark.org/review/9723 Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-07-07Use the NSS provided by the Ixia Veriwave hardware.Guy Harris1-2/+3
It doesn't appear to provide the FEC type, although radiotap does, so add a flag to indicate whether we have that. Change-Id: I298d79bc6b640ee2408c3d70075c32bf331a210c Reviewed-on: https://code.wireshark.org/review/9533 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-07-06Update a comment.Guy Harris1-1/+4
Change-Id: I71e66a8f6faf3b213ab6db2856a36c1d31897166 Reviewed-on: https://code.wireshark.org/review/9527 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-28"Short preamble" is 802.11[bg]-only, so put it in the PHY-specifc info.Guy Harris1-22/+60
We're already only setting it for 11b and 11g; this makes it a bit cleaner, e.g. we don't need to say "oh, wait, we *don't* have short preamble" for 11n and 11ac. Change-Id: Idcf3e8c93d6a417f0319e4bd33247b98f07b6052 Reviewed-on: https://code.wireshark.org/review/9209 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-28Set 802.11.ac Partial AID field sizeGraham Bloice1-1/+1
The assignment of a short to a guint8 in packet-ieee80211-radiotap.c line 1696 generates a narrowing warning. In my reading of the spec which shows the field as 9 bits, and looking at the hf fields for this item I think it should be a guint16. Change-Id: Ic7785c2bfc66d72f7b1e914b1a46f32079fc99d9 Reviewed-on: https://code.wireshark.org/review/9197 Reviewed-by: Graham Bloice <graham.bloice@trihedral.com> Petri-Dish: Graham Bloice <graham.bloice@trihedral.com> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2015-06-26Fix handling of 11ac radio metadata.Guy Harris1-7/+22
Add more fields to the metadata to handle everything radiotap has, and show them. Call the FEC type field just "FEC", and have it be an integer field with 0 meaning BCC and 1 meaning LDPC, rather than a Boolean. 11ac doesn't have *an* MCS, it can have up to 4, one per user. Label the 11ac bandwidth values the same way we do in the radiotap dissector. Change-Id: I2c2415baff3e5d68d49dda497980e8271d26b1f6 Reviewed-on: https://code.wireshark.org/review/9176 Reviewed-by: Guy Harris <guy@alum.mit.edu>
generated by cgit v1.2.1 (git 2.18.0) at 2024-05-18 14:57:10 +0000