1berry/wireshark
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

In pcapng.c use the units per second value from the interface instead of

Browse Source 
the default.

Add support for reading nseclibpcap files to dumpcap.

svn path=/trunk/; revision=41455
This commit is contained in:
Gerald Combs 2012-03-10 00:24:42 +00:00
parent bb71a9c96a
commit 7a8df2f485
4 changed files with 94 additions and 86 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
dumpcap.c
View File

@ -227,6 +227,7 @@ typedef struct _pcap_options {
GThread *tid;
int snaplen;
int linktype;
gboolean ts_nsec; /* TRUE if we're using nanosecond precision. */
/* capture pipe (unix only "input file") */
gboolean from_cap_pipe; /* TRUE if we are capturing data from a capture pipe */
struct pcap_hdr cap_pipe_hdr; /* Pcap header when capturing from a pipe */
@ -1970,10 +1971,12 @@ cap_pipe_open_live(char *pipename,
switch (magic) {
case PCAP_MAGIC:
case PCAP_NSEC_MAGIC:
/* Host that wrote it has our byte order, and was running
a program using either standard or ss990417 libpcap. */
pcap_opts->cap_pipe_byte_swapped = FALSE;
pcap_opts->cap_pipe_modified = FALSE;
pcap_opts->ts_nsec = magic == PCAP_NSEC_MAGIC;
break;
case PCAP_MODIFIED_MAGIC:
/* Host that wrote it has our byte order, but was running
@ -1982,11 +1985,13 @@ cap_pipe_open_live(char *pipename,
pcap_opts->cap_pipe_modified = TRUE;
break;
case PCAP_SWAPPED_MAGIC:
case PCAP_SWAPPED_NSEC_MAGIC:
/* Host that wrote it has a byte order opposite to ours,
and was running a program using either standard or
ss990417 libpcap. */
pcap_opts->cap_pipe_byte_swapped = TRUE;
pcap_opts->cap_pipe_modified = FALSE;
pcap_opts->ts_nsec = magic == PCAP_SWAPPED_NSEC_MAGIC;
break;
case PCAP_SWAPPED_MODIFIED_MAGIC:
/* Host that wrote it out has a byte order opposite to
@ -1995,7 +2000,6 @@ cap_pipe_open_live(char *pipename,
pcap_opts->cap_pipe_byte_swapped = TRUE;
pcap_opts->cap_pipe_modified = TRUE;
break;
/* XXX - Add support for PCAP_NSEC_MAGIC and PCAP_SWAPPED_NSEC_MAGIC? */
default:
/* Not a "libpcap" type we know about. */
g_snprintf(errmsg, errmsgl, "Unrecognized libpcap format");
@ -2368,6 +2372,7 @@ capture_loop_open_input(capture_options *capture_opts, loop_data *ld,
pcap_opts->tid = NULL;
pcap_opts->snaplen = 0;
pcap_opts->linktype = -1;
pcap_opts->ts_nsec = FALSE;
pcap_opts->from_cap_pipe = FALSE;
memset(&pcap_opts->cap_pipe_hdr, 0, sizeof(struct pcap_hdr));
memset(&pcap_opts->cap_pipe_rechdr, 0, sizeof(struct pcaprec_modified_hdr));
@ -2656,7 +2661,7 @@ capture_loop_init_output(capture_options *capture_opts, loop_data *ld, char *err
pcap_opts->snaplen,
&(global_ld.bytes_written),
0, /* IDB_IF_SPEED 8 */
6, /* IDB_TSRESOL 9 */
pcap_opts->ts_nsec ? 9 : 6, /* IDB_TSRESOL 9 */
&global_ld.err);
}
@ -2670,7 +2675,7 @@ capture_loop_init_output(capture_options *capture_opts, loop_data *ld, char *err
pcap_opts->snaplen = pcap_snapshot(pcap_opts->pcap_h);
}
successful = libpcap_write_file_header(ld->pdh, pcap_opts->linktype, pcap_opts->snaplen,
&ld->bytes_written, &err);
pcap_opts->ts_nsec, &ld->bytes_written, &err);
}
if (!successful) {
fclose(ld->pdh);
@ -3114,7 +3119,7 @@ do_file_switch_or_stop(capture_options *capture_opts,
pcap_opts->snaplen,
&(global_ld.bytes_written),
0, /* IDB_IF_SPEED 8 */
0, /* IDB_TSRESOL 9 */
pcap_opts->ts_nsec ? 9 : 6, /* IDB_TSRESOL 9 */
&global_ld.err);
}
@ -3123,7 +3128,7 @@ do_file_switch_or_stop(capture_options *capture_opts,
} else {
pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, 0);
successful = libpcap_write_file_header(global_ld.pdh, pcap_opts->linktype, pcap_opts->snaplen,
&global_ld.bytes_written, &global_ld.err);
pcap_opts->ts_nsec, &global_ld.bytes_written, &global_ld.err);
}
if (!successful) {
fclose(global_ld.pdh);
@ -3724,6 +3729,7 @@ capture_loop_write_packet_cb(u_char *pcap_opts_p, const struct pcap_pkthdr *phdr
{
pcap_options *pcap_opts = (pcap_options *) (void *) pcap_opts_p;
int err;
guint ts_mul = pcap_opts->ts_nsec ? 1000000000 : 1000000;
/* We may be called multiple times from pcap_dispatch(); if we've set
the "stop capturing" flag, ignore this packet, as we're not
@ -3738,7 +3744,7 @@ capture_loop_write_packet_cb(u_char *pcap_opts_p, const struct pcap_pkthdr *phdr
If this fails, set "ld->go" to FALSE, to stop the capture, and set
"ld->err" to the error. */
if (global_capture_opts.use_pcapng) {
successful = libpcap_write_enhanced_packet_block(global_ld.pdh, phdr, pcap_opts->interface_id, pd, &global_ld.bytes_written, &err);
successful = libpcap_write_enhanced_packet_block(global_ld.pdh, phdr, pcap_opts->interface_id, ts_mul, pd, &global_ld.bytes_written, &err);
} else {
successful = libpcap_write_packet(global_ld.pdh, phdr, pd, &global_ld.bytes_written, &err);
}

7
pcapio.c
View File

@ -212,12 +212,12 @@ libpcap_fdopen(int fd, int *err)
Returns TRUE on success, FALSE on failure.
Sets "*err" to an error code, or 0 for a short write, on failure*/
gboolean
libpcap_write_file_header(FILE *fp, int linktype, int snaplen, long *bytes_written, int *err)
libpcap_write_file_header(FILE *fp, int linktype, int snaplen, gboolean ts_nsecs, long *bytes_written, int *err)
{
struct pcap_hdr file_hdr;
size_t nwritten;
file_hdr.magic = PCAP_MAGIC;
file_hdr.magic = ts_nsecs ? PCAP_NSEC_MAGIC : PCAP_MAGIC;
/* current "libpcap" format is 2.4 */
file_hdr.version_major = 2;
file_hdr.version_minor = 4;
@ -554,6 +554,7 @@ gboolean
libpcap_write_enhanced_packet_block(FILE *fp,
const struct pcap_pkthdr *phdr,
guint32 interface_id,
guint ts_mul,
const u_char *pd,
long *bytes_written,
int *err)
@ -566,7 +567,7 @@ libpcap_write_enhanced_packet_block(FILE *fp,
block_total_length = sizeof(struct epb) +
ADD_PADDING(phdr->caplen) +
sizeof(guint32);
timestamp = (guint64)(phdr->ts.tv_sec) * 1000000 +
timestamp = (guint64)(phdr->ts.tv_sec) * ts_mul +
(guint64)(phdr->ts.tv_usec);
epb.block_type = ENHANCED_PACKET_BLOCK_TYPE;
epb.block_total_length = block_total_length;

3
pcapio.h
View File

@ -33,7 +33,7 @@ libpcap_fdopen(int fd, int *err);
Returns TRUE on success, FALSE on failure.
Sets "*err" to an error code, or 0 for a short write, on failure*/
extern gboolean
libpcap_write_file_header(FILE *fp, int linktype, int snaplen, long *bytes_written, int *err);
libpcap_write_file_header(FILE *fp, int linktype, int snaplen, gboolean ts_nsecs, long *bytes_written, int *err);
/** Write a record for a packet to a dump file.
Returns TRUE on success, FALSE on failure. */
@ -90,6 +90,7 @@ extern gboolean
libpcap_write_enhanced_packet_block(FILE *fp,
const struct pcap_pkthdr *phdr,
guint32 interface_id,
guint ts_mul,
const u_char *pd,
long *bytes_written,
int *err);

4
wiretap/pcapng.c
View File

@ -817,9 +817,9 @@ pcapng_read_if_descr_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn,
if (time_units_per_second > (((guint64)1) << 32)) {
pcapng_debug0("pcapng_open: time conversion might be inaccurate");
}
pcapng_debug1("pcapng_read_if_descr_block: if_tsresol %u", wblock->data.if_descr.if_tsresol);
wblock->data.if_descr.time_units_per_second = time_units_per_second;
wblock->data.if_descr.if_tsresol = if_tsresol;
pcapng_debug2("pcapng_read_if_descr_block: if_tsresol %u, units/s %" G_GINT64_MODIFIER "u", wblock->data.if_descr.if_tsresol, wblock->data.if_descr.time_units_per_second);
} else {
pcapng_debug1("pcapng_read_if_descr_block: if_tsresol length %u not 1 as expected", oh.option_length);
}
@ -2077,7 +2077,7 @@ pcapng_open(wtap *wth, int *err, gchar **err_info)
wth->number_of_interfaces++;
interface_data.wtap_encap = wblock.data.if_descr.wtap_encap;
interface_data.time_units_per_second = 1000000; /* default */
interface_data.time_units_per_second = wblock.data.if_descr.time_units_per_second;
g_array_append_val(pcapng->interface_data, interface_data);
pcapng->number_of_interfaces++;