void
capture_sll(const guchar *pd, int len, packet_counts *ld)
{
guint16 protocol;
if (!BYTES_ARE_IN_FRAME(0, len, SLL_HEADER_SIZE)) {
ld->other++;
return;
}
protocol = pntohs(&pd[14]);
if (protocol <= 1536) { /* yes, 1536 - that's how Linux does it */
/*
* "proto" is *not* a length field, it's a Linux internal
* protocol type.
*/
switch (protocol) {
case LINUX_SLL_P_802_2:
/*
* 802.2 LLC.
*/
capture_llc(pd, len, SLL_HEADER_SIZE, ld);
break;
case LINUX_SLL_P_ETHERNET:
/*
* Ethernet.
*/
capture_eth(pd, SLL_HEADER_SIZE, len, ld);
break;
case LINUX_SLL_P_802_3:
/*
* Novell IPX inside 802.3 with no 802.2 LLC
* header.
*/
capture_ipx(ld);
break;
case LINUX_SLL_P_PPPHDLC:
/*
* PPP HDLC.
*/
capture_ppp_hdlc(pd, len, SLL_HEADER_SIZE, ld);
break;
default:
ld->other++;
break;
}
} else
capture_ethertype(protocol, pd, SLL_HEADER_SIZE, len, ld);
}
int
decode_ospf(u_char *buf, int len, u_char *obuf, int olen)
{
if (len < 25)
return (0);
if (pntohs(buf + 14) != 1)
return (0);
buf[24] = '\0';
return (snprintf(obuf, olen, "%s\n", buf + 16));
}
/* Find the next packet and parse it; called from wtap_read(). */
static gboolean csids_read(wtap *wth, int *err, gchar **err_info,
gint64 *data_offset)
{
csids_t *csids = (csids_t *)wth->priv;
guint8 *buf;
int bytesRead = 0;
struct csids_header hdr;
*data_offset = file_tell(wth->fh);
bytesRead = file_read( &hdr, sizeof( struct csids_header) , wth->fh );
if( bytesRead != sizeof( struct csids_header) ) {
*err = file_error( wth->fh, err_info );
if (*err == 0 && bytesRead != 0)
*err = WTAP_ERR_SHORT_READ;
return FALSE;
}
hdr.seconds = pntohl(&hdr.seconds);
hdr.caplen = pntohs(&hdr.caplen);
/* Make sure we have enough room for the packet */
buffer_assure_space(wth->frame_buffer, hdr.caplen);
buf = buffer_start_ptr(wth->frame_buffer);
bytesRead = file_read( buf, hdr.caplen, wth->fh );
if( bytesRead != hdr.caplen ) {
*err = file_error( wth->fh, err_info );
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
return FALSE;
}
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.len = hdr.caplen;
wth->phdr.caplen = hdr.caplen;
wth->phdr.ts.secs = hdr.seconds;
wth->phdr.ts.nsecs = 0;
if( csids->byteswapped ) {
if( hdr.caplen >= 2 ) {
PBSWAP16(buf); /* the ip len */
if( hdr.caplen >= 4 ) {
PBSWAP16(buf+2); /* ip id */
if( hdr.caplen >= 6 )
PBSWAP16(buf+4); /* ip flags and fragoff */
}
}
}
return TRUE;
}
void
capture_chdlc( const guchar *pd, int offset, int len, packet_counts *ld ) {
if (!BYTES_ARE_IN_FRAME(offset, len, 4)) {
ld->other++;
return;
}
switch (pntohs(&pd[offset + 2])) {
case ETHERTYPE_IP:
capture_ip(pd, offset + 4, len, ld);
break;
default:
ld->other++;
break;
}
}
void
capture_snap(const guchar *pd, int offset, int len, packet_counts *ld)
{
guint32 oui;
guint16 etype;
if (!BYTES_ARE_IN_FRAME(offset, len, 5)) {
ld->other++;
return;
}
oui = pd[offset] << 16 | pd[offset+1] << 8 | pd[offset+2];
etype = pntohs(&pd[offset+3]);
switch (oui) {
case OUI_ENCAP_ETHER:
case OUI_CISCO_90:
case OUI_APPLE_ATALK:
/* No, I have no idea why Apple used
one of their own OUIs, rather than
OUI_ENCAP_ETHER, and an Ethernet
packet type as protocol ID, for
AppleTalk data packets - but used
OUI_ENCAP_ETHER and an Ethernet
packet type for AARP packets. */
capture_ethertype(etype, pd, offset+5, len, ld);
break;
case OUI_CISCO:
capture_ethertype(etype, pd, offset+5, len, ld);
break;
case OUI_MARVELL:
/*
* OLPC packet. The PID is an Ethertype, but
* there's a mesh header between the PID and
* the payload. (We assume the header is
* 5 bytes, for now).
*/
capture_ethertype(etype, pd, offset+5+5, len, ld);
break;
default:
ld->other++;
break;
}
}
void
capture_ap1394(const guchar *pd, int offset, int len, packet_counts *ld)
{
guint16 etype;
if (!BYTES_ARE_IN_FRAME(offset, len, 18)) {
ld->other++;
return;
}
/* Skip destination and source addresses */
offset += 16;
etype = pntohs(&pd[offset]);
offset += 2;
capture_ethertype(etype, pd, offset, len, ld);
}
static gboolean
peekclassic_seek_read_v56(wtap *wth, gint64 seek_off,
struct wtap_pkthdr *phdr, guint8 *pd, int length,
int *err, gchar **err_info)
{
union wtap_pseudo_header *pseudo_header = &phdr->pseudo_header;
guint8 ep_pkt[PEEKCLASSIC_V56_PKT_SIZE];
int pkt_encap;
guint16 protoNum;
unsigned int i;
if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
return FALSE;
wtap_file_read_expected_bytes(ep_pkt, sizeof(ep_pkt), wth->random_fh,
err, err_info);
protoNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_PROTONUM_OFFSET]);
pkt_encap = WTAP_ENCAP_UNKNOWN;
for (i=0; i<NUM_PEEKCLASSIC_ENCAPS; i++) {
if (peekclassic_encap[i].protoNum == protoNum) {
pkt_encap = peekclassic_encap[i].encap;
}
}
switch (pkt_encap) {
case WTAP_ENCAP_ETHERNET:
/* We assume there's no FCS in this frame. */
pseudo_header->eth.fcs_len = 0;
break;
}
/*
* XXX - should "errno" be set in "wtap_file_read_expected_bytes()"?
*/
errno = WTAP_ERR_CANT_READ;
wtap_file_read_expected_bytes(pd, length, wth->random_fh, err,
err_info);
return TRUE;
}
static gboolean
csids_read_packet(FILE_T fh, csids_t *csids, struct wtap_pkthdr *phdr,
Buffer *buf, int *err, gchar **err_info)
{
struct csids_header hdr;
int bytesRead = 0;
guint8 *pd;
bytesRead = file_read( &hdr, sizeof( struct csids_header), fh );
if( bytesRead != sizeof( struct csids_header) ) {
*err = file_error( fh, err_info );
if (*err == 0 && bytesRead != 0)
*err = WTAP_ERR_SHORT_READ;
return FALSE;
}
hdr.seconds = pntohl(&hdr.seconds);
hdr.caplen = pntohs(&hdr.caplen);
phdr->presence_flags = WTAP_HAS_TS;
phdr->len = hdr.caplen;
phdr->caplen = hdr.caplen;
phdr->ts.secs = hdr.seconds;
phdr->ts.nsecs = 0;
if( !wtap_read_packet_bytes( fh, buf, phdr->caplen, err, err_info ) )
return FALSE;
pd = buffer_start_ptr( buf );
if( csids->byteswapped ) {
if( phdr->caplen >= 2 ) {
PBSWAP16(pd); /* the ip len */
if( phdr->caplen >= 4 ) {
PBSWAP16(pd+2); /* ip id */
if( phdr->caplen >= 6 )
PBSWAP16(pd+4); /* ip flags and fragoff */
}
}
}
return TRUE;
}
static guint get_gwtb_message_len(packet_info *pinfo, tvbuff_t *tvb, int offset)
{
gwtb_info_t *info_ptr = (gwtb_info_t*) p_get_proto_data(pinfo->fd, proto_gwtb, 0);
rc4_state_struct rc4 = *info_ptr->rc4;
guint32 length = tvb_length(tvb);
guchar *data;
guint len;
if (!info_ptr->length) {
data = (guchar*) ep_alloc(length);
if (data) {
tvb_memcpy(tvb, data, offset, length);
crypt_rc4(&rc4, data, length);
while (info_ptr->length < length) {
len = ((guint) pntohs((guint16*) (data+offset)))+FRAME_HEADER_LEN;
offset += len;
info_ptr->length += len;
}
}
}
return info_ptr->length;
}
/*
* Name: dissect_esis()
*
* Description:
* Main entry area for esis de-mangling. This will build the
* main esis tree data and call the sub-protocols as needed.
*
* Input:
* tvbuff * : tvbuff referring to packet data
* packet_info * : info for current packet
* proto_tree * : tree of display data. May be NULL.
*
* Output:
* void, but we will add to the proto_tree if it is not NULL.
*/
static void
dissect_esis(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
const char *pdu_type_string = NULL;
const char *pdu_type_format_string = "PDU Type : %s (R:%s%s%s)";
esis_hdr_t ehdr;
proto_item *ti;
proto_tree *esis_tree = NULL;
guint8 variable_len;
guint tmp_uint = 0;
const char *cksum_status;
col_set_str(pinfo->cinfo, COL_PROTOCOL, "ESIS");
col_clear(pinfo->cinfo, COL_INFO);
tvb_memcpy(tvb, (guint8 *)&ehdr, 0, sizeof ehdr);
if (tree) {
ti = proto_tree_add_item(tree, proto_esis, tvb, 0, -1, ENC_NA);
esis_tree = proto_item_add_subtree(ti, ett_esis);
if (ehdr.esis_version != ESIS_REQUIRED_VERSION){
esis_dissect_unknown(tvb, esis_tree,
"Unknown ESIS version (%u vs %u)",
ehdr.esis_version, ESIS_REQUIRED_VERSION );
return;
}
if (ehdr.esis_length < ESIS_HDR_FIXED_LENGTH) {
esis_dissect_unknown(tvb, esis_tree,
"Bogus ESIS length (%u, must be >= %u)",
ehdr.esis_length, ESIS_HDR_FIXED_LENGTH );
return;
}
proto_tree_add_uint( esis_tree, hf_esis_nlpi, tvb, 0, 1, ehdr.esis_nlpi );
proto_tree_add_uint( esis_tree, hf_esis_length, tvb,
1, 1, ehdr.esis_length );
proto_tree_add_uint( esis_tree, hf_esis_version, tvb, 2, 1,
ehdr.esis_version );
proto_tree_add_uint( esis_tree, hf_esis_reserved, tvb, 3, 1,
ehdr.esis_reserved );
pdu_type_string = val_to_str(ehdr.esis_type&OSI_PDU_TYPE_MASK,
esis_vals, "Unknown (0x%x)");
proto_tree_add_uint_format( esis_tree, hf_esis_type, tvb, 4, 1,
ehdr.esis_type,
pdu_type_format_string,
pdu_type_string,
(ehdr.esis_type&BIT_8) ? "1" : "0",
(ehdr.esis_type&BIT_7) ? "1" : "0",
(ehdr.esis_type&BIT_6) ? "1" : "0");
tmp_uint = pntohs( ehdr.esis_holdtime );
proto_tree_add_uint_format(esis_tree, hf_esis_holdtime, tvb, 5, 2,
tmp_uint, "Holding Time : %u seconds",
tmp_uint );
tmp_uint = pntohs( ehdr.esis_checksum );
switch (calc_checksum( tvb, 0, ehdr.esis_length, tmp_uint )) {
case NO_CKSUM:
cksum_status = "Not Used";
break;
case DATA_MISSING:
cksum_status = "Not checkable - not all of packet was captured";
break;
case CKSUM_OK:
cksum_status = "Is good";
break;
case CKSUM_NOT_OK:
cksum_status = "Is wrong";
break;
default:
cksum_status = NULL;
DISSECTOR_ASSERT_NOT_REACHED();
}
proto_tree_add_uint_format( esis_tree, hf_esis_checksum, tvb, 7, 2,
tmp_uint, "Checksum : 0x%x ( %s )",
tmp_uint, cksum_status );
}
/*
* Let us make sure we use the same names for all our decodes
* here. First, dump the name into info column, and THEN
* dispatch the sub-type.
*/
if (check_col(pinfo->cinfo, COL_INFO)) {
col_add_str(pinfo->cinfo, COL_INFO,
val_to_str( ehdr.esis_type&OSI_PDU_TYPE_MASK, esis_vals,
"Unknown (0x%x)" ) );
}
variable_len = ehdr.esis_length - ESIS_HDR_FIXED_LENGTH;
switch (ehdr.esis_type & OSI_PDU_TYPE_MASK) {
case ESIS_ESH_PDU:
esis_dissect_esh_pdu( variable_len, tvb, esis_tree);
break;
case ESIS_ISH_PDU:
esis_dissect_ish_pdu( variable_len, tvb, esis_tree);
break;
case ESIS_RD_PDU:
esis_dissect_redirect_pdu( variable_len, tvb, esis_tree);
break;
default:
esis_dissect_unknown(tvb, esis_tree,
"Unknown ESIS packet type 0x%x",
ehdr.esis_type & OSI_PDU_TYPE_MASK );
}
} /* dissect_esis */
/* XXX - return -1 on I/O error and actually do something with 'err'. */
int csids_open(wtap *wth, int *err, gchar **err_info)
{
/* There is no file header. There is only a header for each packet
* so we read a packet header and compare the caplen with iplen. They
* should always be equal except with the wierd byteswap version.
*
* THIS IS BROKEN-- anytime the caplen is 0x0101 or 0x0202 up to 0x0505
* this will byteswap it. I need to fix this. XXX --mlh
*/
int tmp,iplen,bytesRead;
gboolean byteswap = FALSE;
struct csids_header hdr;
csids_t *csids;
/* check the file to make sure it is a csids file. */
bytesRead = file_read( &hdr, sizeof( struct csids_header), wth->fh );
if( bytesRead != sizeof( struct csids_header) ) {
*err = file_error( wth->fh, err_info );
if( *err != 0 ) {
return -1;
} else {
return 0;
}
}
if( hdr.zeropad != 0 || hdr.caplen == 0 ) {
return 0;
}
hdr.seconds = pntohl( &hdr.seconds );
hdr.caplen = pntohs( &hdr.caplen );
bytesRead = file_read( &tmp, 2, wth->fh );
if( bytesRead != 2 ) {
*err = file_error( wth->fh, err_info );
if( *err != 0 ) {
return -1;
} else {
return 0;
}
}
bytesRead = file_read( &iplen, 2, wth->fh );
if( bytesRead != 2 ) {
*err = file_error( wth->fh, err_info );
if( *err != 0 ) {
return -1;
} else {
return 0;
}
}
iplen = pntohs(&iplen);
if ( iplen == 0 )
return(0);
/* if iplen and hdr.caplen are equal, default to no byteswap. */
if( iplen > hdr.caplen ) {
/* maybe this is just a byteswapped version. the iplen ipflags */
/* and ipid are swapped. We cannot use the normal swaps because */
/* we don't know the host */
iplen = BSWAP16(iplen);
if( iplen <= hdr.caplen ) {
/* we know this format */
byteswap = TRUE;
} else {
/* don't know this one */
return 0;
}
} else {
byteswap = FALSE;
}
/* no file header. So reset the fh to 0 so we can read the first packet */
if (file_seek(wth->fh, 0, SEEK_SET, err) == -1)
return -1;
wth->data_offset = 0;
csids = (csids_t *)g_malloc(sizeof(csids_t));
wth->priv = (void *)csids;
csids->byteswapped = byteswap;
wth->file_encap = WTAP_ENCAP_RAW_IP;
wth->file_type = WTAP_FILE_CSIDS;
wth->snapshot_length = 0; /* not known */
wth->subtype_read = csids_read;
wth->subtype_seek_read = csids_seek_read;
wth->tsprecision = WTAP_FILE_TSPREC_SEC;
return 1;
}
static gboolean k12_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset) {
k12_t *k12 = (k12_t *)wth->priv;
k12_src_desc_t* src_desc;
guint8* buffer = NULL;
gint64 offset;
gint len;
guint32 type;
guint32 src_id;
guint64 ts;
guint32 extra_len;
offset = wth->data_offset;
/* ignore the record if it isn't a packet */
do {
K12_DBG(5,("k12_read: offset=%i",offset));
*data_offset = offset;
len = get_record(&buffer, wth->fh, offset, err, err_info);
if (len < 0) {
return FALSE;
} else if (len == 0) {
*err = 0;
return FALSE;
}
type = pntohl(buffer + K12_RECORD_TYPE);
src_id = pntohl(buffer + K12_RECORD_SRC_ID);
if ( ! (src_desc = g_hash_table_lookup(k12->src_by_id,GUINT_TO_POINTER(src_id))) ) {
/*
* Some records from K15 files have a port ID of an undeclared
* interface which happens to be the only one with the first byte changed.
* It is still unknown how to recognize when this happens.
* If the lookup of the interface record fails we'll mask it
* and retry.
*/
src_desc = g_hash_table_lookup(k12->src_by_id,GUINT_TO_POINTER(src_id&K12_RECORD_SRC_ID_MASK));
}
K12_DBG(5,("k12_read: record type=%x src_id=%x",type,src_id));
offset += len;
} while ( ((type & K12_MASK_PACKET) != K12_REC_PACKET) || !src_id || !src_desc );
wth->data_offset = offset;
wth->phdr.presence_flags = WTAP_HAS_TS;
ts = pntohll(buffer + K12_PACKET_TIMESTAMP);
wth->phdr.ts.secs = (guint32) ((ts / 2000000) + 631152000);
wth->phdr.ts.nsecs = (guint32) ( (ts % 2000000) * 500 );
K12_DBG(3,("k12_read: PACKET RECORD type=%x src_id=%x secs=%u nsecs=%u",type,src_id, wth->phdr.ts.secs,wth->phdr.ts.nsecs));
wth->phdr.len = wth->phdr.caplen = pntohl(buffer + K12_RECORD_FRAME_LEN) & 0x00001FFF;
extra_len = len - K12_PACKET_FRAME - wth->phdr.caplen;
/* the frame */
buffer_assure_space(wth->frame_buffer, wth->phdr.caplen);
memcpy(buffer_start_ptr(wth->frame_buffer), buffer + K12_PACKET_FRAME, wth->phdr.caplen);
/* extra information need by some protocols */
buffer_assure_space(&(k12->extra_info), extra_len);
memcpy(buffer_start_ptr(&(k12->extra_info)),
buffer + K12_PACKET_FRAME + wth->phdr.caplen, extra_len);
wth->pseudo_header.k12.extra_info = (void*)buffer_start_ptr(&(k12->extra_info));
wth->pseudo_header.k12.extra_length = extra_len;
wth->pseudo_header.k12.input = src_id;
K12_DBG(5,("k12_read: wth->pseudo_header.k12.input=%x wth->phdr.len=%i input_name='%s' stack_file='%s' type=%x",
wth->pseudo_header.k12.input,wth->phdr.len,src_desc->input_name,src_desc->stack_file,src_desc->input_type));\
wth->pseudo_header.k12.input_name = src_desc->input_name;
wth->pseudo_header.k12.stack_file = src_desc->stack_file;
wth->pseudo_header.k12.input_type = src_desc->input_type;
switch(src_desc->input_type) {
case K12_PORT_ATMPVC:
if ((long)(K12_PACKET_FRAME + wth->phdr.len + K12_PACKET_OFFSET_CID) < len) {
wth->pseudo_header.k12.input_info.atm.vp = pntohs(buffer + (K12_PACKET_FRAME + wth->phdr.caplen + K12_PACKET_OFFSET_VP));
wth->pseudo_header.k12.input_info.atm.vc = pntohs(buffer + (K12_PACKET_FRAME + wth->phdr.caplen + K12_PACKET_OFFSET_VC));
wth->pseudo_header.k12.input_info.atm.cid = *((unsigned char*)(buffer + K12_PACKET_FRAME + wth->phdr.len + K12_PACKET_OFFSET_CID));
break;
}
/* Fall through */
default:
memcpy(&(wth->pseudo_header.k12.input_info),&(src_desc->input_info),sizeof(src_desc->input_info));
break;
}
wth->pseudo_header.k12.stuff = k12;
return TRUE;
}
static gboolean peekclassic_read_packet_v56(wtap *wth, FILE_T fh,
struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info)
{
peekclassic_t *peekclassic = (peekclassic_t *)wth->priv;
guint8 ep_pkt[PEEKCLASSIC_V56_PKT_SIZE];
guint16 length;
guint16 sliceLength;
#if 0
guint8 flags;
guint8 status;
#endif
guint32 timestamp;
#if 0
guint16 destNum;
guint16 srcNum;
#endif
guint16 protoNum;
#if 0
char protoStr[8];
#endif
unsigned int i;
wtap_file_read_expected_bytes(ep_pkt, sizeof(ep_pkt), fh, err,
err_info);
/* Extract the fields from the packet */
length = pntohs(&ep_pkt[PEEKCLASSIC_V56_LENGTH_OFFSET]);
sliceLength = pntohs(&ep_pkt[PEEKCLASSIC_V56_SLICE_LENGTH_OFFSET]);
#if 0
flags = ep_pkt[PEEKCLASSIC_V56_FLAGS_OFFSET];
status = ep_pkt[PEEKCLASSIC_V56_STATUS_OFFSET];
#endif
timestamp = pntohl(&ep_pkt[PEEKCLASSIC_V56_TIMESTAMP_OFFSET]);
#if 0
destNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_DESTNUM_OFFSET]);
srcNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_SRCNUM_OFFSET]);
#endif
protoNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_PROTONUM_OFFSET]);
#if 0
memcpy(protoStr, &ep_pkt[PEEKCLASSIC_V56_PROTOSTR_OFFSET],
sizeof protoStr);
#endif
/*
* XXX - is the captured packet data padded to a multiple
* of 2 bytes?
*/
/* force sliceLength to be the actual length of the packet */
if (0 == sliceLength) {
sliceLength = length;
}
/* fill in packet header values */
phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* timestamp is in milliseconds since reference_time */
phdr->ts.secs = peekclassic->reference_time.tv_sec
+ (timestamp / 1000);
phdr->ts.nsecs = 1000 * (timestamp % 1000) * 1000;
phdr->len = length;
phdr->caplen = sliceLength;
phdr->pkt_encap = WTAP_ENCAP_UNKNOWN;
for (i=0; i<NUM_PEEKCLASSIC_ENCAPS; i++) {
if (peekclassic_encap[i].protoNum == protoNum) {
phdr->pkt_encap = peekclassic_encap[i].encap;
}
}
switch (phdr->pkt_encap) {
case WTAP_ENCAP_ETHERNET:
/* We assume there's no FCS in this frame. */
phdr->pseudo_header.eth.fcs_len = 0;
break;
}
/* read the packet data */
return wtap_read_packet_bytes(fh, buf, sliceLength, err, err_info);
}
static int peekclassic_read_packet_v7(wtap *wth, FILE_T fh,
struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info)
{
guint8 ep_pkt[PEEKCLASSIC_V7_PKT_SIZE];
int bytes_read;
#if 0
guint16 protoNum;
#endif
guint16 length;
guint16 sliceLength;
#if 0
guint8 flags;
#endif
guint8 status;
guint64 timestamp;
time_t tsecs;
guint32 tusecs;
bytes_read = file_read(ep_pkt, sizeof(ep_pkt), fh);
if (bytes_read != (int) sizeof(ep_pkt)) {
*err = file_error(fh, err_info);
if (*err == 0 && bytes_read > 0)
*err = WTAP_ERR_SHORT_READ;
return -1;
}
/* Extract the fields from the packet */
#if 0
protoNum = pntohs(&ep_pkt[PEEKCLASSIC_V7_PROTONUM_OFFSET]);
#endif
length = pntohs(&ep_pkt[PEEKCLASSIC_V7_LENGTH_OFFSET]);
sliceLength = pntohs(&ep_pkt[PEEKCLASSIC_V7_SLICE_LENGTH_OFFSET]);
#if 0
flags = ep_pkt[PEEKCLASSIC_V7_FLAGS_OFFSET];
#endif
status = ep_pkt[PEEKCLASSIC_V7_STATUS_OFFSET];
timestamp = pntohll(&ep_pkt[PEEKCLASSIC_V7_TIMESTAMP_OFFSET]);
/* force sliceLength to be the actual length of the packet */
if (0 == sliceLength) {
sliceLength = length;
}
/* fill in packet header values */
phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
tsecs = (time_t) (timestamp/1000000);
tusecs = (guint32) (timestamp - tsecs*1000000);
phdr->ts.secs = tsecs - mac2unix;
phdr->ts.nsecs = tusecs * 1000;
phdr->len = length;
phdr->caplen = sliceLength;
switch (wth->file_encap) {
case WTAP_ENCAP_IEEE_802_11_AIROPEEK:
phdr->pseudo_header.ieee_802_11.fcs_len = 0; /* no FCS */
phdr->pseudo_header.ieee_802_11.decrypted = FALSE;
/*
* The last 4 bytes appear to be random data - the length
* might include the FCS - so we reduce the length by 4.
*
* Or maybe this is just the same kind of random 4 bytes
* of junk at the end you get in Wireless Sniffer
* captures.
*/
if (phdr->len < 4 || phdr->caplen < 4) {
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("peekclassic: 802.11 packet has length < 4");
return -1;
}
phdr->len -= 4;
phdr->caplen -= 4;
break;
case WTAP_ENCAP_ETHERNET:
/* XXX - it appears that if the low-order bit of
"status" is 0, there's an FCS in this frame,
and if it's 1, there's 4 bytes of 0. */
phdr->pseudo_header.eth.fcs_len = (status & 0x01) ? 0 : 4;
break;
}
/* read the packet data */
if (!wtap_read_packet_bytes(fh, buf, phdr->caplen, err, err_info))
return -1;
return sliceLength;
}
uint16_t Tvbuff::tvb_get_ntohs(tvbuff_t *tvb,int offset)
{
const uint8_t* ptr;
ptr = ensure_contiguous(tvb,offset,sizeof(uint16_t));
return pntohs(ptr);
}
void
capture_tr(const guchar *pd, int offset, int len, packet_counts *ld) {
int source_routed = 0;
int frame_type;
int x;
guint8 trn_rif_bytes;
guint8 actual_rif_bytes;
guint16 first2_sr;
/* The trn_hdr struct, as separate variables */
guint8 trn_fc; /* field control field */
const guint8 *trn_shost; /* source host */
if (!BYTES_ARE_IN_FRAME(offset, len, TR_MIN_HEADER_LEN)) {
ld->other++;
return;
}
if ((x = check_for_old_linux(pd)))
{
/* Actually packet starts x bytes into what we have got but with all
source routing compressed
*/
/* pd = &pd[x]; */ offset+=x;
}
/* get the data */
trn_fc = pd[offset + 1];
trn_shost = &pd[offset + 8];
frame_type = (trn_fc & 192) >> 6;
/* if the high bit on the first byte of src hwaddr is 1, then
this packet is source-routed */
source_routed = trn_shost[0] & 128;
trn_rif_bytes = pd[offset + 14] & 31;
if (fix_linux_botches) {
/* the Linux 2.0 TR code strips source-route bits in
* order to test for SR. This can be removed from most
* packets with oltr, but not all. So, I try to figure out
* which packets should have been SR here. I'll check to
* see if there's a SNAP or IPX field right after
* my RIF fields.
*
* The Linux 2.4.18 code, at least appears to do the
* same thing, from a capture I got from somebody running
* 2.4.18 (RH 7.1, so perhaps this is a Red Hat
* "improvement").
*/
if (!source_routed && trn_rif_bytes > 0) {
if (pd[offset + 0x0e] != pd[offset + 0x0f]) {
first2_sr = pntohs(&pd[offset + 0xe0 + trn_rif_bytes]);
if (
(first2_sr == 0xaaaa &&
pd[offset + 0x10 + trn_rif_bytes] == 0x03) ||
first2_sr == 0xe0e0 ||
first2_sr == 0xe0aa ) {
source_routed = 1;
}
}
}
}
if (source_routed) {
actual_rif_bytes = trn_rif_bytes;
}
else {
trn_rif_bytes = 0;
actual_rif_bytes = 0;
}
if (fix_linux_botches) {
/* this is a silly hack for Linux 2.0.x. Read the comment
* below about LLC headers. If we're sniffing our own NIC,
* we get a full RIF, sometimes with garbage
*/
if ((source_routed && trn_rif_bytes == 2 && frame_type == 1) ||
(!source_routed && frame_type == 1)) {
/* look for SNAP or IPX only */
if ( (pd[offset + 0x20] == 0xaa && pd[offset + 0x21] == 0xaa && pd[offset + 0x22] == 03) ||
(pd[offset + 0x20] == 0xe0 && pd[offset + 0x21] == 0xe0) ) {
actual_rif_bytes = 18;
} else if (
pd[offset + 0x23] == 0 &&
pd[offset + 0x24] == 0 &&
pd[offset + 0x25] == 0 &&
pd[offset + 0x26] == 0x00 &&
pd[offset + 0x27] == 0x11) {
actual_rif_bytes = 18;
/* Linux 2.0.x also requires drivers pass up
* a fake SNAP and LLC header before the
* real LLC hdr for all Token Ring frames
* that arrive with DSAP and SSAP != 0xAA
* (i.e. for non SNAP frames e.g. for Netware
* frames) the fake SNAP header has the
* ETH_P_TR_802_2 ether type (0x0011) and the protocol id
* bytes as zero frame looks like :-
* TR Header | Fake LLC | Fake SNAP | Wire LLC | Rest of data
*/
offset += 8; /* Skip fake LLC and SNAP */
}
}
}
offset += actual_rif_bytes + TR_MIN_HEADER_LEN;
/* The package is either MAC or LLC */
switch (frame_type) {
/* MAC */
case 0:
ld->other++;
break;
case 1:
capture_llc(pd, offset, len, ld);
break;
default:
/* non-MAC, non-LLC, i.e., "Reserved" */
ld->other++;
break;
}
}
static void visual_set_pseudo_header(int encap, struct visual_pkt_hdr *vpkt_hdr,
struct visual_atm_hdr *vatm_hdr, union wtap_pseudo_header *pseudo_header)
{
guint32 packet_status;
/* Set status flags. The only status currently supported for all
encapsulations is direction. This either goes in the p2p or the
X.25 pseudo header. It would probably be better to move this up
into the phdr. */
packet_status = pletohl(&vpkt_hdr->status);
switch (encap)
{
case WTAP_ENCAP_ETHERNET:
/* XXX - is there an FCS in the frame? */
pseudo_header->eth.fcs_len = -1;
break;
case WTAP_ENCAP_CHDLC_WITH_PHDR:
case WTAP_ENCAP_PPP_WITH_PHDR:
pseudo_header->p2p.sent = (packet_status & PS_SENT) ? TRUE : FALSE;
break;
case WTAP_ENCAP_FRELAY_WITH_PHDR:
case WTAP_ENCAP_LAPB:
pseudo_header->x25.flags =
(packet_status & PS_SENT) ? 0x00 : FROM_DCE;
break;
case WTAP_ENCAP_ATM_PDUS:
/* Set defaults */
pseudo_header->atm.type = TRAF_UNKNOWN;
pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;
pseudo_header->atm.aal5t_len = 0;
/* Next two items not supported. Defaulting to zero */
pseudo_header->atm.aal5t_u2u = 0;
pseudo_header->atm.aal5t_chksum = 0;
/* Flags appear only to convey that packet is a raw cell. Set to 0 */
pseudo_header->atm.flags = 0;
/* Not supported. Defaulting to zero */
pseudo_header->atm.aal2_cid = 0;
switch(vatm_hdr->category & VN_CAT_TYPE_MASK )
{
case VN_AAL1:
pseudo_header->atm.aal = AAL_1;
break;
case VN_AAL2:
pseudo_header->atm.aal = AAL_2;
break;
case VN_AAL34:
pseudo_header->atm.aal = AAL_3_4;
break;
case VN_AAL5:
pseudo_header->atm.aal = AAL_5;
pseudo_header->atm.type = TRAF_LLCMX;
pseudo_header->atm.aal5t_len = pntohl(&vatm_hdr->data_length);
break;
case VN_OAM:
/* Marking next 3 as OAM versus unknown */
case VN_O191:
case VN_IDLE:
case VN_RM:
pseudo_header->atm.aal = AAL_OAMCELL;
break;
case VN_UNKNOWN:
default:
pseudo_header->atm.aal = AAL_UNKNOWN;
break;
}
pseudo_header->atm.vpi = pntohs(&vatm_hdr->vpi) & 0x0FFF;
pseudo_header->atm.vci = pntohs(&vatm_hdr->vci);
pseudo_header->atm.cells = pntohs(&vatm_hdr->cell_count);
/* Using bit value of 1 (DCE -> DTE) to indicate From Network */
pseudo_header->atm.channel = vatm_hdr->info & FROM_NETWORK;
break;
}
}
static void
fill_fp_info(fp_info *p_fp_info, guchar *extra_info, guint32 length)
{
guint adj = 0;
/* 0x11=control frame 0x30=data frame */
guint info_type = pntohs(extra_info);
/* 1=FDD, 2=TDD 3.84, 3=TDD 1.28 */
guchar radio_mode = extra_info[14];
guchar channel_type = 0;
guint i;
if (!p_fp_info || length < 22)
return;
/* Store division type */
p_fp_info->division = radio_mode;
/* Format used by K15, later fields are shifted by 8 bytes. */
if (pntohs(extra_info+2) == 5)
adj = 8;
p_fp_info->iface_type = IuB_Interface;
p_fp_info->release = 0; /* dummy */
p_fp_info->release_year = 0; /* dummy */
p_fp_info->release_month = 0; /* dummy */
/* 1=UL, 2=DL */
if (extra_info[15] == 1)
p_fp_info->is_uplink = 1;
else
p_fp_info->is_uplink = 0;
if (info_type == 0x11) /* control frame */
channel_type = extra_info[21 + adj];
else if (info_type == 0x30) /* data frame */
channel_type = extra_info[22 + adj];
switch (channel_type) {
case 1:
p_fp_info->channel = CHANNEL_BCH;
break;
case 2:
p_fp_info->channel = CHANNEL_PCH;
p_fp_info->paging_indications = 0; /* dummy */
break;
case 3:
p_fp_info->channel = CHANNEL_CPCH;
break;
case 4:
if (radio_mode == 1)
p_fp_info->channel = CHANNEL_RACH_FDD;
else if (radio_mode == 2)
p_fp_info->channel = CHANNEL_RACH_TDD;
else
p_fp_info->channel = CHANNEL_RACH_TDD_128;
break;
case 5:
if (radio_mode == 1)
p_fp_info->channel = CHANNEL_FACH_FDD;
else
p_fp_info->channel = CHANNEL_FACH_TDD;
break;
case 6:
if (radio_mode == 2)
p_fp_info->channel = CHANNEL_USCH_TDD_384;
else
p_fp_info->channel = CHANNEL_USCH_TDD_128;
break;
case 7:
if (radio_mode == 1)
p_fp_info->channel = CHANNEL_DSCH_FDD;
else
p_fp_info->channel = CHANNEL_DSCH_TDD;
break;
case 8:
p_fp_info->channel = CHANNEL_DCH;
break;
}
p_fp_info->dch_crc_present = 2; /* information not available */
if (info_type == 0x30) { /* data frame */
p_fp_info->num_chans = extra_info[23 + adj];
/* For each channel */
for (i = 0; i < (guint)p_fp_info->num_chans && (36+i*104+adj) <= length; ++i) {
/* Read TB size */
p_fp_info->chan_tf_size[i] = pntohl(extra_info+28+i*104+adj);
if (p_fp_info->chan_tf_size[i])
/* Work out number of TBs on this channel */
p_fp_info->chan_num_tbs[i] = pntohl(extra_info+32+i*104+adj)
/ p_fp_info->chan_tf_size[i];
}
}
}
static int
nettl_read_rec_header(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
union wtap_pseudo_header *pseudo_header, int *err,
gchar **err_info, gboolean *fddihack)
{
nettl_t *nettl = (nettl_t *)wth->priv;
int bytes_read;
struct nettlrec_hdr rec_hdr;
guint16 hdr_len;
struct nettlrec_ns_ls_drv_eth_hdr drv_eth_hdr;
guint16 length, caplen;
int offset = 0;
int subsys;
int padlen;
guint8 dummyc[16];
errno = WTAP_ERR_CANT_READ;
bytes_read = file_read(&rec_hdr.hdr_len, sizeof rec_hdr.hdr_len, fh);
if (bytes_read != sizeof rec_hdr.hdr_len) {
*err = file_error(fh, err_info);
if (*err != 0)
return -1;
if (bytes_read != 0) {
*err = WTAP_ERR_SHORT_READ;
return -1;
}
return 0;
}
offset += 2;
hdr_len = g_ntohs(rec_hdr.hdr_len);
if (hdr_len < NETTL_REC_HDR_LEN) {
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("nettl: record header length %u too short",
hdr_len);
return -1;
}
bytes_read = file_read(&rec_hdr.subsys, NETTL_REC_HDR_LEN - 2, fh);
if (bytes_read != NETTL_REC_HDR_LEN - 2) {
*err = file_error(fh, err_info);
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
return -1;
}
offset += NETTL_REC_HDR_LEN - 2;
subsys = g_ntohs(rec_hdr.subsys);
hdr_len -= NETTL_REC_HDR_LEN;
if (file_seek(fh, hdr_len, SEEK_CUR, err) == -1)
return -1;
offset += hdr_len;
if ( (pntohl(&rec_hdr.kind) & NETTL_HDR_PDU_MASK) == 0 ) {
/* not actually a data packet (PDU) trace record */
phdr->pkt_encap = WTAP_ENCAP_NETTL_RAW_IP;
length = pntohl(&rec_hdr.length);
caplen = pntohl(&rec_hdr.caplen);
padlen = 0;
} else switch (subsys) {
case NETTL_SUBSYS_LAN100 :
case NETTL_SUBSYS_EISA100BT :
case NETTL_SUBSYS_BASE100 :
case NETTL_SUBSYS_GSC100BT :
case NETTL_SUBSYS_PCI100BT :
case NETTL_SUBSYS_SPP100BT :
case NETTL_SUBSYS_100VG :
case NETTL_SUBSYS_GELAN :
case NETTL_SUBSYS_BTLAN :
case NETTL_SUBSYS_INTL100 :
case NETTL_SUBSYS_IGELAN :
case NETTL_SUBSYS_IETHER :
case NETTL_SUBSYS_IXGBE :
case NETTL_SUBSYS_HSSN :
case NETTL_SUBSYS_IGSSN :
case NETTL_SUBSYS_ICXGBE :
case NETTL_SUBSYS_IEXGBE :
case NETTL_SUBSYS_HPPB_FDDI :
case NETTL_SUBSYS_EISA_FDDI :
case NETTL_SUBSYS_PCI_FDDI :
case NETTL_SUBSYS_HSC_FDDI :
case NETTL_SUBSYS_TOKEN :
case NETTL_SUBSYS_PCI_TR :
case NETTL_SUBSYS_NS_LS_IP :
case NETTL_SUBSYS_NS_LS_LOOPBACK :
case NETTL_SUBSYS_NS_LS_TCP :
case NETTL_SUBSYS_NS_LS_UDP :
case NETTL_SUBSYS_HP_APAPORT :
case NETTL_SUBSYS_HP_APALACP :
case NETTL_SUBSYS_NS_LS_IPV6 :
case NETTL_SUBSYS_NS_LS_ICMPV6 :
case NETTL_SUBSYS_NS_LS_ICMP :
case NETTL_SUBSYS_NS_LS_TELNET :
case NETTL_SUBSYS_NS_LS_SCTP :
if( (subsys == NETTL_SUBSYS_NS_LS_IP)
|| (subsys == NETTL_SUBSYS_NS_LS_LOOPBACK)
|| (subsys == NETTL_SUBSYS_NS_LS_UDP)
|| (subsys == NETTL_SUBSYS_NS_LS_TCP)
|| (subsys == NETTL_SUBSYS_NS_LS_SCTP)
|| (subsys == NETTL_SUBSYS_NS_LS_IPV6)) {
phdr->pkt_encap = WTAP_ENCAP_NETTL_RAW_IP;
} else if (subsys == NETTL_SUBSYS_NS_LS_ICMP) {
phdr->pkt_encap = WTAP_ENCAP_NETTL_RAW_ICMP;
} else if (subsys == NETTL_SUBSYS_NS_LS_ICMPV6) {
phdr->pkt_encap = WTAP_ENCAP_NETTL_RAW_ICMPV6;
} else if (subsys == NETTL_SUBSYS_NS_LS_TELNET) {
phdr->pkt_encap = WTAP_ENCAP_NETTL_RAW_TELNET;
} else if( (subsys == NETTL_SUBSYS_HPPB_FDDI)
|| (subsys == NETTL_SUBSYS_EISA_FDDI)
|| (subsys == NETTL_SUBSYS_PCI_FDDI)
|| (subsys == NETTL_SUBSYS_HSC_FDDI) ) {
phdr->pkt_encap = WTAP_ENCAP_NETTL_FDDI;
} else if( (subsys == NETTL_SUBSYS_PCI_TR)
|| (subsys == NETTL_SUBSYS_TOKEN) ) {
phdr->pkt_encap = WTAP_ENCAP_NETTL_TOKEN_RING;
} else {
phdr->pkt_encap = WTAP_ENCAP_NETTL_ETHERNET;
}
length = pntohl(&rec_hdr.length);
caplen = pntohl(&rec_hdr.caplen);
/* HPPB FDDI has different inbound vs outbound trace records */
if (subsys == NETTL_SUBSYS_HPPB_FDDI) {
if (pntohl(&rec_hdr.kind) == NETTL_HDR_PDUIN) {
/* inbound is very strange...
there are an extra 3 bytes after the DSAP and SSAP
for SNAP frames ???
*/
*fddihack=TRUE;
padlen = 0;
} else {
/* outbound appears to have variable padding */
bytes_read = file_read(dummyc, 9, fh);
if (bytes_read != 9) {
*err = file_error(fh, err_info);
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
return -1;
}
/* padding is usually either a total 11 or 16 bytes??? */
padlen = (int)dummyc[8];
if (file_seek(fh, padlen, SEEK_CUR, err) == -1)
return -1;
padlen += 9;
offset += padlen;
}
} else if ( (subsys == NETTL_SUBSYS_PCI_FDDI)
|| (subsys == NETTL_SUBSYS_EISA_FDDI)
|| (subsys == NETTL_SUBSYS_HSC_FDDI) ) {
/* other flavor FDDI cards have an extra 3 bytes of padding */
if (file_seek(fh, 3, SEEK_CUR, err) == -1)
return -1;
padlen = 3;
offset += padlen;
} else if (subsys == NETTL_SUBSYS_NS_LS_LOOPBACK) {
/* LOOPBACK has an extra 26 bytes of padding */
if (file_seek(fh, 26, SEEK_CUR, err) == -1)
return -1;
padlen = 26;
offset += padlen;
} else if (subsys == NETTL_SUBSYS_NS_LS_SCTP) {
/*
* SCTP 8 byte header that we will ignore...
* 32 bit integer defines format
* 1 = Log
* 2 = ASCII
* 3 = Binary (PDUs should be Binary format)
* 32 bit integer defines type
* 1 = Inbound
* 2 = Outbound
*/
if (file_seek(fh, 8, SEEK_CUR, err) == -1)
return -1;
padlen = 8;
offset += padlen;
} else {
padlen = 0;
}
break;
case NETTL_SUBSYS_NS_LS_DRIVER :
/* XXX we dont know how to identify this as ethernet frames, so
we assumes everything is. We will crash and burn for anything else */
/* for encapsulated 100baseT we do this */
phdr->pkt_encap = WTAP_ENCAP_NETTL_ETHERNET;
bytes_read = file_read(&drv_eth_hdr, NS_LS_DRV_ETH_HDR_LEN, fh);
if (bytes_read != NS_LS_DRV_ETH_HDR_LEN) {
*err = file_error(fh, err_info);
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
return -1;
}
offset += NS_LS_DRV_ETH_HDR_LEN;
length = pntohs(&drv_eth_hdr.length);
caplen = pntohs(&drv_eth_hdr.caplen);
/*
* XXX - is there a length field that would give the length
* of this header, so that we don't have to check for
* nettl files from HP-UX 11?
*
* And what are the extra two bytes?
*/
if (nettl->is_hpux_11) {
if (file_seek(fh, 2, SEEK_CUR, err) == -1) return -1;
offset += 2;
}
padlen = 0;
break;
case NETTL_SUBSYS_SX25L2:
case NETTL_SUBSYS_SX25L3:
/*
* XXX - is the 24-byte padding actually a header with
* packet lengths, time stamps, etc., just as is the case
* for NETTL_SUBSYS_NS_LS_DRIVER? It might be
*
* guint8 caplen[2];
* guint8 length[2];
* guint8 xxc[4];
* guint8 sec[4];
* guint8 usec[4];
* guint8 xxd[4];
*
* or something such as that - if it has 4 bytes before that
* (making it 24 bytes), it'd be like struct
* nettlrec_ns_ls_drv_eth_hdr but with 2 more bytes at the end.
*
* And is "from_dce" at xxa[0] in the nettlrec_hdr structure?
*/
phdr->pkt_encap = WTAP_ENCAP_NETTL_X25;
length = pntohl(&rec_hdr.length);
caplen = pntohl(&rec_hdr.caplen);
padlen = 24; /* sizeof (struct nettlrec_sx25l2_hdr) - NETTL_REC_HDR_LEN + 4 */
if (file_seek(fh, padlen, SEEK_CUR, err) == -1)
return -1;
offset += padlen;
break;
default:
/* We're going to assume it's ethernet if we don't recognize the
subsystem -- We'll probably spew junks and core if it isn't... */
wth->file_encap = WTAP_ENCAP_PER_PACKET;
phdr->pkt_encap = WTAP_ENCAP_NETTL_ETHERNET;
length = pntohl(&rec_hdr.length);
caplen = pntohl(&rec_hdr.caplen);
padlen = 0;
break;
}
if (length < padlen) {
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("nettl: packet length %u in record header too short, less than %u",
length, padlen);
return -1;
}
phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
phdr->len = length - padlen;
if (caplen < padlen) {
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("nettl: captured length %u in record header too short, less than %u",
caplen, padlen);
return -1;
}
phdr->caplen = caplen - padlen;
phdr->ts.secs = pntohl(&rec_hdr.sec);
phdr->ts.nsecs = pntohl(&rec_hdr.usec) * 1000;
pseudo_header->nettl.subsys = subsys;
pseudo_header->nettl.devid = pntohl(&rec_hdr.devid);
pseudo_header->nettl.kind = pntohl(&rec_hdr.kind);
pseudo_header->nettl.pid = pntohl(&rec_hdr.pid);
pseudo_header->nettl.uid = pntohs(&rec_hdr.uid);
return offset;
}
static gboolean
peekclassic_read_v56(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
{
peekclassic_t *peekclassic = (peekclassic_t *)wth->priv;
guint8 ep_pkt[PEEKCLASSIC_V56_PKT_SIZE];
guint16 length;
guint16 sliceLength;
#if 0
guint8 flags;
guint8 status;
#endif
guint32 timestamp;
#if 0
guint16 destNum;
guint16 srcNum;
#endif
guint16 protoNum;
char protoStr[8];
unsigned int i;
/*
* XXX - in order to figure out whether this packet is an
* Ethernet packet or not, we have to look at the packet
* header, so we have to remember the address of the header,
* not the address of the data, for random access.
*
* If we can determine that from the file header, rather than
* the packet header, we can remember the offset of the data,
* and not have the seek_read routine read the header.
*/
*data_offset = file_tell(wth->fh);
wtap_file_read_expected_bytes(ep_pkt, sizeof(ep_pkt), wth->fh, err,
err_info);
/* Extract the fields from the packet */
length = pntohs(&ep_pkt[PEEKCLASSIC_V56_LENGTH_OFFSET]);
sliceLength = pntohs(&ep_pkt[PEEKCLASSIC_V56_SLICE_LENGTH_OFFSET]);
#if 0
flags = ep_pkt[PEEKCLASSIC_V56_FLAGS_OFFSET];
status = ep_pkt[PEEKCLASSIC_V56_STATUS_OFFSET];
#endif
timestamp = pntohl(&ep_pkt[PEEKCLASSIC_V56_TIMESTAMP_OFFSET]);
#if 0
destNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_DESTNUM_OFFSET]);
srcNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_SRCNUM_OFFSET]);
#endif
protoNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_PROTONUM_OFFSET]);
memcpy(protoStr, &ep_pkt[PEEKCLASSIC_V56_PROTOSTR_OFFSET],
sizeof protoStr);
/*
* XXX - is the captured packet data padded to a multiple
* of 2 bytes?
*/
/* force sliceLength to be the actual length of the packet */
if (0 == sliceLength) {
sliceLength = length;
}
/* read the frame data */
buffer_assure_space(wth->frame_buffer, sliceLength);
wtap_file_read_expected_bytes(buffer_start_ptr(wth->frame_buffer),
sliceLength, wth->fh, err, err_info);
/* fill in packet header values */
wth->phdr.len = length;
wth->phdr.caplen = sliceLength;
/* timestamp is in milliseconds since reference_time */
wth->phdr.ts.secs = peekclassic->reference_time.tv_sec
+ (timestamp / 1000);
wth->phdr.ts.nsecs = 1000 * (timestamp % 1000) * 1000;
wth->phdr.pkt_encap = WTAP_ENCAP_UNKNOWN;
for (i=0; i<NUM_PEEKCLASSIC_ENCAPS; i++) {
if (peekclassic_encap[i].protoNum == protoNum) {
wth->phdr.pkt_encap = peekclassic_encap[i].encap;
}
}
switch (wth->phdr.pkt_encap) {
case WTAP_ENCAP_ETHERNET:
/* We assume there's no FCS in this frame. */
wth->phdr.pseudo_header.eth.fcs_len = 0;
break;
}
return TRUE;
}
static gboolean
peekclassic_read_v7(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
{
guint8 ep_pkt[PEEKCLASSIC_V7_PKT_SIZE];
#if 0
guint16 protoNum;
#endif
guint16 length;
guint16 sliceLength;
#if 0
guint8 flags;
#endif
guint8 status;
guint64 timestamp;
time_t tsecs;
guint32 tusecs;
*data_offset = file_tell(wth->fh);
wtap_file_read_expected_bytes(ep_pkt, sizeof(ep_pkt), wth->fh, err,
err_info);
/* Extract the fields from the packet */
#if 0
protoNum = pntohs(&ep_pkt[PEEKCLASSIC_V7_PROTONUM_OFFSET]);
#endif
length = pntohs(&ep_pkt[PEEKCLASSIC_V7_LENGTH_OFFSET]);
sliceLength = pntohs(&ep_pkt[PEEKCLASSIC_V7_SLICE_LENGTH_OFFSET]);
#if 0
flags = ep_pkt[PEEKCLASSIC_V7_FLAGS_OFFSET];
#endif
status = ep_pkt[PEEKCLASSIC_V7_STATUS_OFFSET];
timestamp = pntohll(&ep_pkt[PEEKCLASSIC_V7_TIMESTAMP_OFFSET]);
/* force sliceLength to be the actual length of the packet */
if (0 == sliceLength) {
sliceLength = length;
}
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* fill in packet header length values before slicelength may be
adjusted */
wth->phdr.len = length;
wth->phdr.caplen = sliceLength;
if (sliceLength % 2) /* packets are padded to an even length */
sliceLength++;
switch (wth->file_encap) {
case WTAP_ENCAP_IEEE_802_11_AIROPEEK:
wth->phdr.pseudo_header.ieee_802_11.fcs_len = 0; /* no FCS */
wth->phdr.pseudo_header.ieee_802_11.decrypted = FALSE;
break;
case WTAP_ENCAP_ETHERNET:
/* XXX - it appears that if the low-order bit of
"status" is 0, there's an FCS in this frame,
and if it's 1, there's 4 bytes of 0. */
wth->phdr.pseudo_header.eth.fcs_len = (status & 0x01) ? 0 : 4;
break;
}
/* read the frame data */
buffer_assure_space(wth->frame_buffer, sliceLength);
wtap_file_read_expected_bytes(buffer_start_ptr(wth->frame_buffer),
sliceLength, wth->fh, err, err_info);
/* fill in packet header values */
tsecs = (time_t) (timestamp/1000000);
tusecs = (guint32) (timestamp - tsecs*1000000);
wth->phdr.ts.secs = tsecs - mac2unix;
wth->phdr.ts.nsecs = tusecs * 1000;
if (wth->file_encap == WTAP_ENCAP_IEEE_802_11_AIROPEEK) {
/*
* The last 4 bytes appear to be random data - the length
* might include the FCS - so we reduce the length by 4.
*
* Or maybe this is just the same kind of random 4 bytes
* of junk at the end you get in Wireless Sniffer
* captures.
*/
wth->phdr.len -= 4;
wth->phdr.caplen -= 4;
}
return TRUE;
}
void
capture_eth(const guchar *pd, int offset, int len, packet_counts *ld)
{
guint16 etype, length;
int ethhdr_type; /* the type of ethernet frame */
if (!BYTES_ARE_IN_FRAME(offset, len, ETH_HEADER_SIZE)) {
ld->other++;
return;
}
etype = pntohs(&pd[offset+12]);
if (etype <= IEEE_802_3_MAX_LEN) {
/* Oh, yuck. Cisco ISL frames require special interpretation of the
destination address field; fortunately, they can be recognized by
checking the first 5 octets of the destination address, which are
01-00-0C-00-00 or 0C-00-0C-00-00 for ISL frames. */
if ((pd[offset] == 0x01 || pd[offset] == 0x0C) && pd[offset+1] == 0x00
&& pd[offset+2] == 0x0C && pd[offset+3] == 0x00
&& pd[offset+4] == 0x00) {
capture_isl(pd, offset, len, ld);
return;
}
}
/*
* If the type/length field is <= the maximum 802.3 length,
* and is not zero, this is an 802.3 frame, and it's a length
* field; it might be an Novell "raw 802.3" frame, with no
* 802.2 LLC header, or it might be a frame with an 802.2 LLC
* header.
*
* If the type/length field is >= the minimum Ethernet II length,
* this is an Ethernet II frame, and it's a type field.
*
* If the type/length field is > maximum 802.3 length and < minimum
* Ethernet II length, then this is an invalid packet.
*
* If the type/length field is zero (ETHERTYPE_UNK), this is
* a frame used internally by the Cisco MDS switch to contain
* Fibre Channel ("Vegas"). We treat that as an Ethernet II
* frame; the dissector for those frames registers itself with
* an ethernet type of ETHERTYPE_UNK.
*/
if (etype > IEEE_802_3_MAX_LEN && etype < ETHERNET_II_MIN_LEN) {
ld->other++;
return;
}
if (etype <= IEEE_802_3_MAX_LEN && etype != ETHERTYPE_UNK) {
length = etype;
/* Is there an 802.2 layer? I can tell by looking at the first 2
bytes after the 802.3 header. If they are 0xffff, then what
follows the 802.3 header is an IPX payload, meaning no 802.2.
(IPX/SPX is they only thing that can be contained inside a
straight 802.3 packet). A non-0xffff value means that there's an
802.2 layer inside the 802.3 layer */
if (pd[offset+14] == 0xff && pd[offset+15] == 0xff) {
ethhdr_type = ETHERNET_802_3;
}
else {
ethhdr_type = ETHERNET_802_2;
}
/* Convert the LLC length from the 802.3 header to a total
frame length, by adding in the size of any data that preceded
the Ethernet header, and adding in the Ethernet header size,
and set the payload and captured-payload lengths to the minima
of the total length and the frame lengths. */
length += offset + ETH_HEADER_SIZE;
if (len > length)
len = length;
} else {
ethhdr_type = ETHERNET_II;
}
offset += ETH_HEADER_SIZE;
switch (ethhdr_type) {
case ETHERNET_802_3:
capture_ipx(ld);
break;
case ETHERNET_802_2:
capture_llc(pd, offset, len, ld);
break;
case ETHERNET_II:
capture_ethertype(etype, pd, offset, len, ld);
break;
}
}
static gboolean
visual_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
Buffer *buf, int *err, gchar **err_info)
{
struct visual_read_info *visual = (struct visual_read_info *)wth->priv;
struct visual_pkt_hdr vpkt_hdr;
int bytes_read;
guint32 packet_size;
struct visual_atm_hdr vatm_hdr;
double t;
time_t secs;
guint32 usecs;
guint32 packet_status;
guint8 *pd;
/* Read the packet header. */
errno = WTAP_ERR_CANT_READ;
bytes_read = file_read(&vpkt_hdr, (unsigned int)sizeof vpkt_hdr, fh);
if (bytes_read < 0 || (size_t)bytes_read != sizeof vpkt_hdr)
{
*err = file_error(fh, err_info);
if (*err == 0 && bytes_read != 0)
{
*err = WTAP_ERR_SHORT_READ;
}
return FALSE;
}
/* Get the included length of data. This includes extra headers + payload */
packet_size = pletohs(&vpkt_hdr.incl_len);
phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* Set the packet time and length. */
t = visual->start_time;
t += ((double)pletohl(&vpkt_hdr.ts_delta))*1000;
secs = (time_t)(t/1000000);
usecs = (guint32)(t - secs*1000000);
phdr->ts.secs = secs;
phdr->ts.nsecs = usecs * 1000;
phdr->len = pletohs(&vpkt_hdr.orig_len);
packet_status = pletohl(&vpkt_hdr.status);
/* Do encapsulation-specific processing.
Most Visual capture types include the FCS in the original length
value, but don't include the FCS as part of the payload or captured
length. This is different from the model used in most other capture
file formats, including pcap and pcap-ng in cases where the FCS isn't
captured (which are the typical cases), and causes the RTP audio
payload save to fail since then captured len != orig len.
We adjust the original length to remove the FCS bytes we counted based
on the file encapsualtion type. The only downside to this fix is
throughput calculations will be slightly lower as it won't include
the FCS bytes. However, as noted, that problem also exists with
other capture formats.
We also set status flags. The only status currently supported for
all encapsulations is direction. This either goes in the p2p or the
X.25 pseudo header. It would probably be better to move this up
into the phdr. */
switch (wth->file_encap)
{
case WTAP_ENCAP_ETHERNET:
/* Ethernet has a 4-byte FCS. */
if (phdr->len < 4)
{
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("visual: Ethernet packet has %u-byte original packet, less than the FCS length",
phdr->len);
return FALSE;
}
phdr->len -= 4;
/* XXX - the above implies that there's never an FCS; should this
set the FCS length to 0? */
phdr->pseudo_header.eth.fcs_len = -1;
break;
case WTAP_ENCAP_CHDLC_WITH_PHDR:
/* This has a 2-byte FCS. */
if (phdr->len < 2)
{
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("visual: Cisco HDLC packet has %u-byte original packet, less than the FCS length",
phdr->len);
return FALSE;
}
phdr->len -= 2;
phdr->pseudo_header.p2p.sent = (packet_status & PS_SENT) ? TRUE : FALSE;
break;
case WTAP_ENCAP_PPP_WITH_PHDR:
/* No FCS.
XXX - true? Note that PPP can negotiate no FCS, a 2-byte FCS,
or a 4-byte FCS. */
phdr->pseudo_header.p2p.sent = (packet_status & PS_SENT) ? TRUE : FALSE;
break;
case WTAP_ENCAP_FRELAY_WITH_PHDR:
/* This has a 2-byte FCS. */
if (phdr->len < 2)
{
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("visual: Frame Relay packet has %u-byte original packet, less than the FCS length",
phdr->len);
return FALSE;
}
phdr->len -= 2;
phdr->pseudo_header.x25.flags =
(packet_status & PS_SENT) ? 0x00 : FROM_DCE;
break;
case WTAP_ENCAP_LAPB:
/* This has a 2-byte FCS. */
if (phdr->len < 2)
{
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("visual: Frame Relay packet has %u-byte original packet, less than the FCS length",
phdr->len);
return FALSE;
}
phdr->len -= 2;
phdr->pseudo_header.x25.flags =
(packet_status & PS_SENT) ? 0x00 : FROM_DCE;
break;
case WTAP_ENCAP_ATM_PDUS:
/* ATM original length doesn't include any FCS. Do nothing to
the packet length.
ATM packets have an additional packet header; read and
process it. */
errno = WTAP_ERR_CANT_READ;
bytes_read = file_read(&vatm_hdr, (unsigned int)sizeof vatm_hdr, fh);
if (bytes_read < 0 || (size_t)bytes_read != sizeof vatm_hdr)
{
*err = file_error(fh, err_info);
if (*err == 0)
{
*err = WTAP_ERR_SHORT_READ;
}
return FALSE;
}
/* Remove ATM header from length of included bytes in capture, as
this header was appended by the processor doing the packet
reassembly, and was not transmitted across the wire */
packet_size -= (guint32)sizeof vatm_hdr;
/* Set defaults */
phdr->pseudo_header.atm.type = TRAF_UNKNOWN;
phdr->pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
phdr->pseudo_header.atm.aal5t_len = 0;
/* Next two items not supported. Defaulting to zero */
phdr->pseudo_header.atm.aal5t_u2u = 0;
phdr->pseudo_header.atm.aal5t_chksum = 0;
/* Flags appear only to convey that packet is a raw cell. Set to 0 */
phdr->pseudo_header.atm.flags = 0;
/* Not supported. Defaulting to zero */
phdr->pseudo_header.atm.aal2_cid = 0;
switch(vatm_hdr.category & VN_CAT_TYPE_MASK )
{
case VN_AAL1:
phdr->pseudo_header.atm.aal = AAL_1;
break;
case VN_AAL2:
phdr->pseudo_header.atm.aal = AAL_2;
break;
case VN_AAL34:
phdr->pseudo_header.atm.aal = AAL_3_4;
break;
case VN_AAL5:
phdr->pseudo_header.atm.aal = AAL_5;
phdr->pseudo_header.atm.type = TRAF_LLCMX;
phdr->pseudo_header.atm.aal5t_len = pntohl(&vatm_hdr.data_length);
break;
case VN_OAM:
/* Marking next 3 as OAM versus unknown */
case VN_O191:
case VN_IDLE:
case VN_RM:
phdr->pseudo_header.atm.aal = AAL_OAMCELL;
break;
case VN_UNKNOWN:
default:
phdr->pseudo_header.atm.aal = AAL_UNKNOWN;
break;
}
phdr->pseudo_header.atm.vpi = pntohs(&vatm_hdr.vpi) & 0x0FFF;
phdr->pseudo_header.atm.vci = pntohs(&vatm_hdr.vci);
phdr->pseudo_header.atm.cells = pntohs(&vatm_hdr.cell_count);
/* Using bit value of 1 (DCE -> DTE) to indicate From Network */
phdr->pseudo_header.atm.channel = vatm_hdr.info & FROM_NETWORK;
break;
/* Not sure about token ring. Just leaving alone for now. */
case WTAP_ENCAP_TOKEN_RING:
default:
break;
}
phdr->caplen = packet_size;
/* Check for too-large packet. */
if (packet_size > WTAP_MAX_PACKET_SIZE)
{
/* Probably a corrupt capture file; don't blow up trying
to allocate space for an immensely-large packet. */
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("visual: File has %u-byte packet, bigger than maximum of %u",
packet_size, WTAP_MAX_PACKET_SIZE);
return FALSE;
}
/* Sanity check */
if (phdr->len < phdr->caplen)
{
phdr->len = phdr->caplen;
}
/* Read the packet data */
if (!wtap_read_packet_bytes(fh, buf, packet_size, err, err_info))
return FALSE;
if (wth->file_encap == WTAP_ENCAP_CHDLC_WITH_PHDR)
{
/* Fill in the encapsulation. Visual files have a media type in the
file header and an encapsulation type in each packet header. Files
with a media type of HDLC can be either Cisco EtherType or PPP.
The encapsulation hint values we've seen are:
2 - seen in an Ethernet capture
13 - seen in a PPP capture; possibly also seen in Cisco HDLC
captures
14 - seen in a PPP capture; probably seen only for PPP.
According to bug 2005, the collection probe can be configured
for PPP, in which case the encapsulation hint is 14, or can
be configured for auto-detect, in which case the encapsulation
hint is 13, and the encapsulation must be guessed from the
packet contents. Auto-detect is the default. */
pd = buffer_start_ptr(buf);
/* If PPP is specified in the encap hint, then use that */
if (vpkt_hdr.encap_hint == 14)
{
/* But first we need to examine the first three octets to
try to determine the proper encapsulation, see RFC 2364. */
if (packet_size >= 3 &&
(0xfe == pd[0]) && (0xfe == pd[1]) && (0x03 == pd[2]))
{
/* It is actually LLC encapsulated PPP */
phdr->pkt_encap = WTAP_ENCAP_ATM_RFC1483;
}
else
{
/* It is actually PPP */
phdr->pkt_encap = WTAP_ENCAP_PPP_WITH_PHDR;
}
}
else
{
/* Otherwise, we need to examine the first two octets to
try to determine the encapsulation. */
if (packet_size >= 2 && (0xff == pd[0]) && (0x03 == pd[1]))
{
/* It is actually PPP */
phdr->pkt_encap = WTAP_ENCAP_PPP_WITH_PHDR;
}
}
}
return TRUE;
}
static gboolean
snoop_read_atm_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header,
int *err, gchar **err_info)
{
struct snoop_atm_hdr atm_phdr;
int bytes_read;
guint8 vpi;
guint16 vci;
errno = WTAP_ERR_CANT_READ;
bytes_read = file_read(&atm_phdr, sizeof (struct snoop_atm_hdr), fh);
if (bytes_read != sizeof (struct snoop_atm_hdr)) {
*err = file_error(fh, err_info);
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
return FALSE;
}
vpi = atm_phdr.vpi;
vci = pntohs(&atm_phdr.vci);
/*
* The lower 4 bits of the first byte of the header indicate
* the type of traffic, as per the "atmioctl.h" header in
* SunATM.
*/
switch (atm_phdr.flags & 0x0F) {
case 0x01: /* LANE */
pseudo_header->atm.aal = AAL_5;
pseudo_header->atm.type = TRAF_LANE;
break;
case 0x02: /* RFC 1483 LLC multiplexed traffic */
pseudo_header->atm.aal = AAL_5;
pseudo_header->atm.type = TRAF_LLCMX;
break;
case 0x05: /* ILMI */
pseudo_header->atm.aal = AAL_5;
pseudo_header->atm.type = TRAF_ILMI;
break;
case 0x06: /* Signalling AAL */
pseudo_header->atm.aal = AAL_SIGNALLING;
pseudo_header->atm.type = TRAF_UNKNOWN;
break;
case 0x03: /* MARS (RFC 2022) */
pseudo_header->atm.aal = AAL_5;
pseudo_header->atm.type = TRAF_UNKNOWN;
break;
case 0x04: /* IFMP (Ipsilon Flow Management Protocol; see RFC 1954) */
pseudo_header->atm.aal = AAL_5;
pseudo_header->atm.type = TRAF_UNKNOWN; /* XXX - TRAF_IPSILON? */
break;
default:
/*
* Assume it's AAL5, unless it's VPI 0 and VCI 5, in which
* case assume it's AAL_SIGNALLING; we know nothing more
* about it.
*
* XXX - is this necessary? Or are we guaranteed that
* all signalling traffic has a type of 0x06?
*
* XXX - is this guaranteed to be AAL5? Or, if the type is
* 0x00 ("raw"), might it be non-AAL5 traffic?
*/
if (vpi == 0 && vci == 5)
pseudo_header->atm.aal = AAL_SIGNALLING;
else
pseudo_header->atm.aal = AAL_5;
pseudo_header->atm.type = TRAF_UNKNOWN;
break;
}
pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;
pseudo_header->atm.vpi = vpi;
pseudo_header->atm.vci = vci;
pseudo_header->atm.channel = (atm_phdr.flags & 0x80) ? 0 : 1;
/* We don't have this information */
pseudo_header->atm.flags = 0;
pseudo_header->atm.cells = 0;
pseudo_header->atm.aal5t_u2u = 0;
pseudo_header->atm.aal5t_len = 0;
pseudo_header->atm.aal5t_chksum = 0;
return TRUE;
}
/* Parses a record. */
static gboolean
read_eyesdn_rec(FILE_T fh, struct wtap_pkthdr *phdr, Buffer *buf, int *err,
gchar **err_info)
{
union wtap_pseudo_header *pseudo_header = &phdr->pseudo_header;
guint8 hdr[EYESDN_HDR_LENGTH];
time_t secs;
int usecs;
int pkt_len;
guint8 channel, direction;
int bytes_read;
guint8 *pd;
/* Our file pointer should be at the summary information header
* for a packet. Read in that header and extract the useful
* information.
*/
if (esc_read(hdr, EYESDN_HDR_LENGTH, fh) != EYESDN_HDR_LENGTH) {
*err = file_error(fh, err_info);
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
return FALSE;
}
/* extract information from header */
usecs = pntoh24(&hdr[0]);
#ifdef TV64BITS
secs = hdr[3];
#else
secs = 0;
#endif
secs = (secs << 8) | hdr[4];
secs = (secs << 8) | hdr[5];
secs = (secs << 8) | hdr[6];
secs = (secs << 8) | hdr[7];
channel = hdr[8];
direction = hdr[9];
pkt_len = pntohs(&hdr[10]);
switch(direction >> 1) {
default:
case EYESDN_ENCAP_ISDN: /* ISDN */
pseudo_header->isdn.uton = direction & 1;
pseudo_header->isdn.channel = channel;
if(channel) { /* bearer channels */
phdr->pkt_encap = WTAP_ENCAP_ISDN; /* recognises PPP */
pseudo_header->isdn.uton=!pseudo_header->isdn.uton; /* bug */
} else { /* D channel */
phdr->pkt_encap = WTAP_ENCAP_ISDN;
}
break;
case EYESDN_ENCAP_MSG: /* Layer 1 message */
phdr->pkt_encap = WTAP_ENCAP_LAYER1_EVENT;
pseudo_header->l1event.uton = (direction & 1);
break;
case EYESDN_ENCAP_LAPB: /* X.25 via LAPB */
phdr->pkt_encap = WTAP_ENCAP_LAPB;
pseudo_header->x25.flags = (direction & 1) ? 0 : 0x80;
break;
case EYESDN_ENCAP_ATM: { /* ATM cells */
#define CELL_LEN 53
unsigned char cell[CELL_LEN];
gint64 cur_off;
if(pkt_len != CELL_LEN) {
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf(
"eyesdn: ATM cell has a length != 53 (%u)",
pkt_len);
return FALSE;
}
cur_off = file_tell(fh);
if (esc_read(cell, CELL_LEN, fh) != CELL_LEN) {
*err = file_error(fh, err_info);
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
return FALSE;
}
if (file_seek(fh, cur_off, SEEK_SET, err) == -1)
return FALSE;
phdr->pkt_encap = WTAP_ENCAP_ATM_PDUS_UNTRUNCATED;
pseudo_header->atm.flags=ATM_RAW_CELL;
pseudo_header->atm.aal=AAL_UNKNOWN;
pseudo_header->atm.type=TRAF_UMTS_FP;
pseudo_header->atm.subtype=TRAF_ST_UNKNOWN;
pseudo_header->atm.vpi=((cell[0]&0xf)<<4) + (cell[0]&0xf);
pseudo_header->atm.vci=((cell[0]&0xf)<<4) + cell[0]; /* from cell */
pseudo_header->atm.channel=direction & 1;
}
break;
case EYESDN_ENCAP_MTP2: /* SS7 frames */
pseudo_header->mtp2.sent = direction & 1;
pseudo_header->mtp2.annex_a_used = MTP2_ANNEX_A_USED_UNKNOWN;
pseudo_header->mtp2.link_number = channel;
phdr->pkt_encap = WTAP_ENCAP_MTP2_WITH_PHDR;
break;
case EYESDN_ENCAP_DPNSS: /* DPNSS */
pseudo_header->isdn.uton = direction & 1;
pseudo_header->isdn.channel = channel;
phdr->pkt_encap = WTAP_ENCAP_DPNSS;
break;
case EYESDN_ENCAP_DASS2: /* DASS2 frames */
pseudo_header->isdn.uton = direction & 1;
pseudo_header->isdn.channel = channel;
phdr->pkt_encap = WTAP_ENCAP_DPNSS;
break;
case EYESDN_ENCAP_BACNET: /* BACNET async over HDLC frames */
pseudo_header->isdn.uton = direction & 1;
pseudo_header->isdn.channel = channel;
phdr->pkt_encap = WTAP_ENCAP_BACNET_MS_TP_WITH_PHDR;
break;
case EYESDN_ENCAP_V5_EF: /* V5EF */
pseudo_header->isdn.uton = direction & 1;
pseudo_header->isdn.channel = channel;
phdr->pkt_encap = WTAP_ENCAP_V5_EF;
break;
}
if(pkt_len > EYESDN_MAX_PACKET_LEN) {
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("eyesdn: File has %u-byte packet, bigger than maximum of %u",
pkt_len, EYESDN_MAX_PACKET_LEN);
return FALSE;
}
phdr->presence_flags = WTAP_HAS_TS;
phdr->ts.secs = secs;
phdr->ts.nsecs = usecs * 1000;
phdr->caplen = pkt_len;
phdr->len = pkt_len;
/* Make sure we have enough room for the packet */
buffer_assure_space(buf, EYESDN_MAX_PACKET_LEN);
errno = WTAP_ERR_CANT_READ;
pd = buffer_start_ptr(buf);
bytes_read = esc_read(pd, pkt_len, fh);
if (bytes_read != pkt_len) {
if (bytes_read == -2) {
*err = file_error(fh, err_info);
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
} else if (bytes_read == -1) {
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup("eyesdn: No flag character seen in frame");
} else
*err = WTAP_ERR_SHORT_READ;
return FALSE;
}
return TRUE;
}
