| Wireshark 4.7.0 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
wtap.h
Go to the documentation of this file.
1
9#ifndef __WTAP_H__
10#define __WTAP_H__
11
12#include <wireshark.h>
13#include <time.h>
14#include <wsutil/array.h>
15#include <wsutil/buffer.h>
16#include <wsutil/nstime.h>
17#include <wsutil/inet_addr.h>
18#include <wsutil/file_compressed.h>
19#include "wtap_opttypes.h"
20
21#ifdef __cplusplus
22 extern "C" {
23#endif /* __cplusplus */
24
25/* Encapsulation types. Choose names that truly reflect
26 * what is contained in the packet trace file.
27 *
28 * WTAP_ENCAP_PER_PACKET is a value passed to "wtap_dump_open()" or
29 * "wtap_dump_fdopen()" to indicate that there is no single encapsulation
30 * type for all packets in the file; this may cause those routines to
31 * fail if the capture file format being written can't support that.
32 * It's also returned by "wtap_file_encap()" for capture files that
33 * don't have a single encapsulation type for all packets in the file.
34 *
35 * WTAP_ENCAP_UNKNOWN is returned by "wtap_pcap_encap_to_wtap_encap()"
36 * if it's handed an unknown encapsulation. It is also used by file
37 * types for encapsulations which are unsupported by libwiretap.
38 *
39 * WTAP_ENCAP_NONE is an initial value used by file types like pcapng
40 * that do not have a single file level encapsulation type. If and when
41 * something that indicate encapsulation is read, the encapsulation will
42 * change (possibly to WTAP_ENCAP_PER_PACKET) and appropriate IDBs will
43 * be generated. If a file type uses this value, it MUST provide IDBs
44 * (possibly fake) when the encapsulation changes; otherwise, it should
45 * return WTAP_ENCAP_UNKNOWN so that attempts to write an output file
46 * without reading the entire input file first fail gracefully.
47 *
48 * WTAP_ENCAP_FDDI_BITSWAPPED is for FDDI captures on systems where the
49 * MAC addresses you get from the hardware are bit-swapped. Ideally,
50 * the driver would tell us that, but I know of none that do, so, for
51 * now, we base it on the machine on which we're *reading* the
52 * capture, rather than on the machine on which the capture was taken
53 * (they're probably likely to be the same). We assume that they're
54 * bit-swapped on everything except for systems running Ultrix, Alpha
55 * systems, and BSD/OS systems (that's what "tcpdump" does; I guess
56 * Digital decided to bit-swap addresses in the hardware or in the
57 * driver, and I guess BSDI bit-swapped them in the driver, given that
58 * BSD/OS generally runs on Boring Old PC's). If we create a wiretap
59 * save file format, we'd use the WTAP_ENCAP values to flag the
60 * encapsulation of a packet, so there we'd at least be able to base
61 * it on the machine on which the capture was taken.
62 *
63 * WTAP_ENCAP_LINUX_ATM_CLIP is the encapsulation you get with the
64 * ATM on Linux code from <http://linux-atm.sourceforge.net/>;
65 * that code adds a DLT_ATM_CLIP DLT_ code of 19, and that
66 * encapsulation isn't the same as the DLT_ATM_RFC1483 encapsulation
67 * presumably used on some BSD systems, which we turn into
68 * WTAP_ENCAP_ATM_RFC1483.
69 *
70 * WTAP_ENCAP_NULL corresponds to DLT_NULL from "libpcap". This
71 * corresponds to
72 *
73 * 1) PPP-over-HDLC encapsulation, at least with some versions
74 * of ISDN4BSD (but not the current ones, it appears, unless
75 * I've missed something);
76 *
77 * 2) a 4-byte header containing the AF_ address family, in
78 * the byte order of the machine that saved the capture,
79 * for the packet, as used on many BSD systems for the
80 * loopback device and some other devices, or a 4-byte header
81 * containing the AF_ address family in network byte order,
82 * as used on recent OpenBSD systems for the loopback device;
83 *
84 * 3) a 4-byte header containing 2 octets of 0 and an Ethernet
85 * type in the byte order from an Ethernet header, that being
86 * what older versions of "libpcap" on Linux turn the Ethernet
87 * header for loopback interfaces into (0.6.0 and later versions
88 * leave the Ethernet header alone and make it DLT_EN10MB). */
89#define WTAP_ENCAP_NONE -2
90#define WTAP_ENCAP_PER_PACKET -1
91#define WTAP_ENCAP_UNKNOWN 0
92#define WTAP_ENCAP_ETHERNET 1
93#define WTAP_ENCAP_TOKEN_RING 2
94#define WTAP_ENCAP_SLIP 3
95#define WTAP_ENCAP_PPP 4
96#define WTAP_ENCAP_FDDI 5
97#define WTAP_ENCAP_FDDI_BITSWAPPED 6
98#define WTAP_ENCAP_RAW_IP 7
99#define WTAP_ENCAP_ARCNET 8
100#define WTAP_ENCAP_ARCNET_LINUX 9
101#define WTAP_ENCAP_ATM_RFC1483 10
102#define WTAP_ENCAP_LINUX_ATM_CLIP 11
103#define WTAP_ENCAP_LAPB 12
104#define WTAP_ENCAP_ATM_PDUS 13
105#define WTAP_ENCAP_ATM_PDUS_UNTRUNCATED 14
106#define WTAP_ENCAP_NULL 15
107#define WTAP_ENCAP_ASCEND 16
108#define WTAP_ENCAP_ISDN 17
109#define WTAP_ENCAP_IP_OVER_FC 18
110#define WTAP_ENCAP_PPP_WITH_PHDR 19
111#define WTAP_ENCAP_IEEE_802_11 20
112#define WTAP_ENCAP_IEEE_802_11_PRISM 21
113#define WTAP_ENCAP_IEEE_802_11_WITH_RADIO 22
114#define WTAP_ENCAP_IEEE_802_11_RADIOTAP 23
115#define WTAP_ENCAP_IEEE_802_11_AVS 24
116#define WTAP_ENCAP_SLL 25
117#define WTAP_ENCAP_FRELAY 26
118#define WTAP_ENCAP_FRELAY_WITH_PHDR 27
119#define WTAP_ENCAP_CHDLC 28
120#define WTAP_ENCAP_CISCO_IOS 29
121#define WTAP_ENCAP_LOCALTALK 30
122#define WTAP_ENCAP_OLD_PFLOG 31
123#define WTAP_ENCAP_HHDLC 32
124#define WTAP_ENCAP_DOCSIS 33
125#define WTAP_ENCAP_COSINE 34
126#define WTAP_ENCAP_WFLEET_HDLC 35
127#define WTAP_ENCAP_SDLC 36
128#define WTAP_ENCAP_TZSP 37
129#define WTAP_ENCAP_ENC 38
130#define WTAP_ENCAP_PFLOG 39
131#define WTAP_ENCAP_CHDLC_WITH_PHDR 40
132#define WTAP_ENCAP_BLUETOOTH_H4 41
133#define WTAP_ENCAP_MTP2 42
134#define WTAP_ENCAP_MTP3 43
135#define WTAP_ENCAP_IRDA 44
136#define WTAP_ENCAP_USER0 45
137#define WTAP_ENCAP_USER1 46
138#define WTAP_ENCAP_USER2 47
139#define WTAP_ENCAP_USER3 48
140#define WTAP_ENCAP_USER4 49
141#define WTAP_ENCAP_USER5 50
142#define WTAP_ENCAP_USER6 51
143#define WTAP_ENCAP_USER7 52
144#define WTAP_ENCAP_USER8 53
145#define WTAP_ENCAP_USER9 54
146#define WTAP_ENCAP_USER10 55
147#define WTAP_ENCAP_USER11 56
148#define WTAP_ENCAP_USER12 57
149#define WTAP_ENCAP_USER13 58
150#define WTAP_ENCAP_USER14 59
151#define WTAP_ENCAP_USER15 60
152#define WTAP_ENCAP_SYMANTEC 61
153#define WTAP_ENCAP_APPLE_IP_OVER_IEEE1394 62
154#define WTAP_ENCAP_BACNET_MS_TP 63
155#define WTAP_ENCAP_NETTL_RAW_ICMP 64
156#define WTAP_ENCAP_NETTL_RAW_ICMPV6 65
157#define WTAP_ENCAP_GPRS_LLC 66
158#define WTAP_ENCAP_JUNIPER_ATM1 67
159#define WTAP_ENCAP_JUNIPER_ATM2 68
160#define WTAP_ENCAP_REDBACK 69
161#define WTAP_ENCAP_NETTL_RAW_IP 70
162#define WTAP_ENCAP_NETTL_ETHERNET 71
163#define WTAP_ENCAP_NETTL_TOKEN_RING 72
164#define WTAP_ENCAP_NETTL_FDDI 73
165#define WTAP_ENCAP_NETTL_UNKNOWN 74
166#define WTAP_ENCAP_MTP2_WITH_PHDR 75
167#define WTAP_ENCAP_JUNIPER_PPPOE 76
168#define WTAP_ENCAP_GCOM_TIE1 77
169#define WTAP_ENCAP_GCOM_SERIAL 78
170#define WTAP_ENCAP_NETTL_X25 79
171#define WTAP_ENCAP_K12 80
172#define WTAP_ENCAP_JUNIPER_MLPPP 81
173#define WTAP_ENCAP_JUNIPER_MLFR 82
174#define WTAP_ENCAP_JUNIPER_ETHER 83
175#define WTAP_ENCAP_JUNIPER_PPP 84
176#define WTAP_ENCAP_JUNIPER_FRELAY 85
177#define WTAP_ENCAP_JUNIPER_CHDLC 86
178#define WTAP_ENCAP_JUNIPER_GGSN 87
179#define WTAP_ENCAP_LINUX_LAPD 88
180#define WTAP_ENCAP_CATAPULT_DCT2000 89
181#define WTAP_ENCAP_BER 90
182#define WTAP_ENCAP_JUNIPER_VP 91
183#define WTAP_ENCAP_USB_FREEBSD 92
184#define WTAP_ENCAP_IEEE802_16_MAC_CPS 93
185#define WTAP_ENCAP_NETTL_RAW_TELNET 94
186#define WTAP_ENCAP_USB_LINUX 95
187#define WTAP_ENCAP_MPEG 96
188#define WTAP_ENCAP_PPI 97
189#define WTAP_ENCAP_ERF 98
190#define WTAP_ENCAP_BLUETOOTH_H4_WITH_PHDR 99
191#define WTAP_ENCAP_SITA 100
192#define WTAP_ENCAP_SCCP 101
193#define WTAP_ENCAP_BLUETOOTH_HCI 102 /*raw packets without a transport layer header e.g. H4*/
194#define WTAP_ENCAP_IPMB_KONTRON 103
195#define WTAP_ENCAP_IEEE802_15_4 104
196#define WTAP_ENCAP_X2E_XORAYA 105
197#define WTAP_ENCAP_FLEXRAY 106
198#define WTAP_ENCAP_LIN 107
199#define WTAP_ENCAP_MOST 108
200#define WTAP_ENCAP_CAN20B 109
201#define WTAP_ENCAP_LAYER1_EVENT 110
202#define WTAP_ENCAP_X2E_SERIAL 111
203#define WTAP_ENCAP_I2C_LINUX 112
204#define WTAP_ENCAP_IEEE802_15_4_NONASK_PHY 113
205#define WTAP_ENCAP_TNEF 114
206#define WTAP_ENCAP_USB_LINUX_MMAPPED 115
207#define WTAP_ENCAP_GSM_UM 116
208#define WTAP_ENCAP_DPNSS 117
209#define WTAP_ENCAP_PACKETLOGGER 118
210#define WTAP_ENCAP_NSTRACE_1_0 119
211#define WTAP_ENCAP_NSTRACE_2_0 120
212#define WTAP_ENCAP_FIBRE_CHANNEL_FC2 121
213#define WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS 122
214#define WTAP_ENCAP_JPEG_JFIF 123 /* obsoleted by WTAP_ENCAP_MIME*/
215#define WTAP_ENCAP_IPNET 124
216#define WTAP_ENCAP_SOCKETCAN 125
217#define WTAP_ENCAP_IEEE_802_11_NETMON 126
218#define WTAP_ENCAP_IEEE802_15_4_NOFCS 127
219#define WTAP_ENCAP_RAW_IPFIX 128
220#define WTAP_ENCAP_RAW_IP4 129
221#define WTAP_ENCAP_RAW_IP6 130
222#define WTAP_ENCAP_LAPD 131
223#define WTAP_ENCAP_DVBCI 132
224#define WTAP_ENCAP_MUX27010 133
225#define WTAP_ENCAP_MIME 134
226#define WTAP_ENCAP_NETANALYZER 135
227#define WTAP_ENCAP_NETANALYZER_TRANSPARENT 136
228#define WTAP_ENCAP_IP_OVER_IB_SNOOP 137
229#define WTAP_ENCAP_MPEG_2_TS 138
230#define WTAP_ENCAP_PPP_ETHER 139
231#define WTAP_ENCAP_NFC_LLCP 140
232#define WTAP_ENCAP_NFLOG 141
233#define WTAP_ENCAP_V5_EF 142
234#define WTAP_ENCAP_BACNET_MS_TP_WITH_PHDR 143
235#define WTAP_ENCAP_IXVERIWAVE 144
236#define WTAP_ENCAP_SDH 145
237#define WTAP_ENCAP_DBUS 146
238#define WTAP_ENCAP_AX25_KISS 147
239#define WTAP_ENCAP_AX25 148
240#define WTAP_ENCAP_SCTP 149
241#define WTAP_ENCAP_INFINIBAND 150
242#define WTAP_ENCAP_JUNIPER_SVCS 151
243#define WTAP_ENCAP_USBPCAP 152
244#define WTAP_ENCAP_RTAC_SERIAL 153
245#define WTAP_ENCAP_BLUETOOTH_LE_LL 154
246#define WTAP_ENCAP_WIRESHARK_UPPER_PDU 155
247#define WTAP_ENCAP_STANAG_4607 156
248#define WTAP_ENCAP_STANAG_5066_D_PDU 157
249#define WTAP_ENCAP_NETLINK 158
250#define WTAP_ENCAP_BLUETOOTH_LINUX_MONITOR 159
251#define WTAP_ENCAP_BLUETOOTH_BREDR_BB 160
252#define WTAP_ENCAP_BLUETOOTH_LE_LL_WITH_PHDR 161
253#define WTAP_ENCAP_NSTRACE_3_0 162
254#define WTAP_ENCAP_LOGCAT 163
255#define WTAP_ENCAP_LOGCAT_BRIEF 164
256#define WTAP_ENCAP_LOGCAT_PROCESS 165
257#define WTAP_ENCAP_LOGCAT_TAG 166
258#define WTAP_ENCAP_LOGCAT_THREAD 167
259#define WTAP_ENCAP_LOGCAT_TIME 168
260#define WTAP_ENCAP_LOGCAT_THREADTIME 169
261#define WTAP_ENCAP_LOGCAT_LONG 170
262#define WTAP_ENCAP_PKTAP 171
263#define WTAP_ENCAP_EPON 172
264#define WTAP_ENCAP_IPMI_TRACE 173
265#define WTAP_ENCAP_LOOP 174
266#define WTAP_ENCAP_JSON 175
267#define WTAP_ENCAP_NSTRACE_3_5 176
268#define WTAP_ENCAP_ISO14443 177
269#define WTAP_ENCAP_GFP_T 178
270#define WTAP_ENCAP_GFP_F 179
271#define WTAP_ENCAP_IP_OVER_IB_PCAP 180
272#define WTAP_ENCAP_JUNIPER_VN 181
273#define WTAP_ENCAP_USB_DARWIN 182
274#define WTAP_ENCAP_LORATAP 183
275#define WTAP_ENCAP_3MB_ETHERNET 184
276#define WTAP_ENCAP_VSOCK 185
277#define WTAP_ENCAP_NORDIC_BLE 186
278#define WTAP_ENCAP_NETMON_NET_NETEVENT 187
279#define WTAP_ENCAP_NETMON_HEADER 188
280#define WTAP_ENCAP_NETMON_NET_FILTER 189
281#define WTAP_ENCAP_NETMON_NETWORK_INFO_EX 190
282#define WTAP_ENCAP_MA_WFP_CAPTURE_V4 191
283#define WTAP_ENCAP_MA_WFP_CAPTURE_V6 192
284#define WTAP_ENCAP_MA_WFP_CAPTURE_2V4 193
285#define WTAP_ENCAP_MA_WFP_CAPTURE_2V6 194
286#define WTAP_ENCAP_MA_WFP_CAPTURE_AUTH_V4 195
287#define WTAP_ENCAP_MA_WFP_CAPTURE_AUTH_V6 196
288#define WTAP_ENCAP_JUNIPER_ST 197
289#define WTAP_ENCAP_ETHERNET_MPACKET 198
290#define WTAP_ENCAP_DOCSIS31_XRA31 199
291#define WTAP_ENCAP_DPAUXMON 200
292#define WTAP_ENCAP_RUBY_MARSHAL 201
293#define WTAP_ENCAP_RFC7468 202
294#define WTAP_ENCAP_SYSTEMD_JOURNAL 203 /* Event, not a packet */
295#define WTAP_ENCAP_EBHSCR 204
296#define WTAP_ENCAP_VPP 205
297#define WTAP_ENCAP_IEEE802_15_4_TAP 206
298#define WTAP_ENCAP_LOG_3GPP 207
299#define WTAP_ENCAP_USB_2_0 208
300#define WTAP_ENCAP_MP4 209
301#define WTAP_ENCAP_SLL2 210
302#define WTAP_ENCAP_ZWAVE_SERIAL 211
303#define WTAP_ENCAP_ETW 212
304#define WTAP_ENCAP_ERI_ENB_LOG 213
305#define WTAP_ENCAP_ZBNCP 214
306#define WTAP_ENCAP_USB_2_0_LOW_SPEED 215
307#define WTAP_ENCAP_USB_2_0_FULL_SPEED 216
308#define WTAP_ENCAP_USB_2_0_HIGH_SPEED 217
309#define WTAP_ENCAP_AUTOSAR_DLT 218
310#define WTAP_ENCAP_AUERSWALD_LOG 219
311#define WTAP_ENCAP_ATSC_ALP 220
312#define WTAP_ENCAP_FIRA_UCI 221
313#define WTAP_ENCAP_SILABS_DEBUG_CHANNEL 222
314#define WTAP_ENCAP_MDB 223
315#define WTAP_ENCAP_EMS 224
316#define WTAP_ENCAP_DECT_NR 225
317#define WTAP_ENCAP_MMODULE 226
318#define WTAP_ENCAP_PROCMON 227
319
320/* After adding new item here, please also add new item to encap_table_base array */
321
322#define WTAP_NUM_ENCAP_TYPES wtap_get_num_encap_types()
323
324/* Value to be used as a file type/subtype value if the type is unknown */
325#define WTAP_FILE_TYPE_SUBTYPE_UNKNOWN -1
326
327/* timestamp precision (currently only these values are supported) */
328#define WTAP_TSPREC_UNKNOWN -2
329#define WTAP_TSPREC_PER_PACKET -1 /* as a per-file value, means per-packet */
330/*
331 * These values are the number of digits of precision after the integral part.
332 * They're the same as WS_TSPREC values; we define them here so that
333 * tools/make-enums.py sees them.
334 */
335#define WTAP_TSPREC_SEC 0
336#define WTAP_TSPREC_100_MSEC 1
337#define WTAP_TSPREC_DSEC 1 /* Backwards compatibility */
338#define WTAP_TSPREC_10_MSEC 2
339#define WTAP_TSPREC_CSEC 2 /* Backwards compatibility */
340#define WTAP_TSPREC_MSEC 3
341#define WTAP_TSPREC_100_USEC 4
342#define WTAP_TSPREC_10_USEC 5
343#define WTAP_TSPREC_USEC 6
344#define WTAP_TSPREC_100_NSEC 7
345#define WTAP_TSPREC_10_NSEC 8
346#define WTAP_TSPREC_NSEC 9
347/* if you add to the above, update wtap_tsprec_string() */
348
349/*
350 * Maximum packet sizes.
351 *
352 * For most link-layer types, we use 262144, which is currently
353 * libpcap's MAXIMUM_SNAPLEN.
354 *
355 * For WTAP_ENCAP_DBUS, the maximum is 128MiB, as per
356 *
357 * https://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages
358 *
359 * For WTAP_ENCAP_EBHSCR, the maximum is 8MiB, as per
360 *
361 * https://www.elektrobit.com/ebhscr
362 *
363 * For WTAP_ENCAP_USBPCAP, the maximum is 128MiB, as per
364 *
365 * https://gitlab.com/wireshark/wireshark/-/issues/15985
366 *
367 * We don't want to write out files that specify a maximum packet size
368 * greater than 262144 if we don't have to, as software reading those
369 * files might allocate a buffer much larger than necessary, wasting memory.
370 */
371#define WTAP_MAX_PACKET_SIZE_STANDARD 262144U
372#define WTAP_MAX_PACKET_SIZE_USBPCAP (128U*1024U*1024U)
373#define WTAP_MAX_PACKET_SIZE_EBHSCR (32U*1024U*1024U)
374#define WTAP_MAX_PACKET_SIZE_DBUS (128U*1024U*1024U)
375
376/*
377 * "Pseudo-headers" are used to supply to the clients of wiretap
378 * per-packet information that's not part of the packet payload
379 * proper.
380 *
381 * NOTE: do not use pseudo-header structures to hold information
382 * used by the code to read a particular capture file type; to
383 * keep that sort of state information, define a private structure
384 * to hold that information in your code, and allocate one of those
385 * structures and set the "priv" member of the wth strucure to
386 * point to the allocated structure in the "open" routine for that
387 * capture file type if the open succeeds. See various other capture
388 * file type handlers for examples of that.
389 */
390
391
392/* Packet "pseudo-header" information for Ethernet capture files. */
393 struct eth_phdr {
394 int fcs_len; /* Number of bytes of FCS - -1 means "unknown" */
395};
396
397/* Packet "pseudo-header" information for capture files for traffic
398 between DTE and DCE. */
399#define FROM_DCE 0x80
400 struct dte_dce_phdr {
401 uint8_t flags; /* ENCAP_LAPB, ENCAP_V120, ENCAP_FRELAY: 1st bit means From DCE */
402};
403
404/* Packet "pseudo-header" information for ISDN capture files. */
405
406/* Direction */
407 struct isdn_phdr {
408 bool uton;
409 uint8_t channel; /* 0 = D-channel; n = B-channel n */
410};
411
412/* Packet "pseudo-header" for ATM capture files.
413 Not all of this information is supplied by all capture types.
414 These originally came from the Network General (DOS-based)
415 ATM Sniffer file format, but we've added some additional
416 items. */
417
418/*
419 * Status bits.
420 */
421#define ATM_RAW_CELL 0x01 /* true if the packet is a single cell */
422#define ATM_NO_HEC 0x02 /* true if the cell has HEC stripped out */
423#define ATM_AAL2_NOPHDR 0x04 /* true if the AAL2 PDU has no pseudo-header */
424#define ATM_REASSEMBLY_ERROR 0x08 /* true if this is an incompletely-reassembled PDU */
425
426/*
427 * AAL types.
428 */
429#define AAL_UNKNOWN 0 /* AAL unknown */
430#define AAL_1 1 /* AAL1 */
431#define AAL_2 2 /* AAL2 */
432#define AAL_3_4 3 /* AAL3/4 */
433#define AAL_5 4 /* AAL5 */
434#define AAL_USER 5 /* User AAL */
435#define AAL_SIGNALLING 6 /* Signaling AAL */
436#define AAL_OAMCELL 7 /* OAM cell */
437
438/*
439 * Traffic types.
440 */
441#define TRAF_UNKNOWN 0 /* Unknown */
442#define TRAF_LLCMX 1 /* LLC multiplexed (RFC 1483) */
443#define TRAF_VCMX 2 /* VC multiplexed (RFC 1483) */
444#define TRAF_LANE 3 /* LAN Emulation */
445#define TRAF_ILMI 4 /* ILMI */
446#define TRAF_FR 5 /* Frame Relay */
447#define TRAF_SPANS 6 /* FORE SPANS */
448#define TRAF_IPSILON 7 /* Ipsilon */
449#define TRAF_UMTS_FP 8 /* UMTS Frame Protocol */
450#define TRAF_GPRS_NS 9 /* GPRS Network Services */
451#define TRAF_SSCOP 10 /* SSCOP */
452
453/*
454 * Traffic subtypes.
455 */
456#define TRAF_ST_UNKNOWN 0 /* Unknown */
457
458/*
459 * For TRAF_VCMX:
460 */
461#define TRAF_ST_VCMX_802_3_FCS 1 /* 802.3 with an FCS */
462#define TRAF_ST_VCMX_802_4_FCS 2 /* 802.4 with an FCS */
463#define TRAF_ST_VCMX_802_5_FCS 3 /* 802.5 with an FCS */
464#define TRAF_ST_VCMX_FDDI_FCS 4 /* FDDI with an FCS */
465#define TRAF_ST_VCMX_802_6_FCS 5 /* 802.6 with an FCS */
466#define TRAF_ST_VCMX_802_3 7 /* 802.3 without an FCS */
467#define TRAF_ST_VCMX_802_4 8 /* 802.4 without an FCS */
468#define TRAF_ST_VCMX_802_5 9 /* 802.5 without an FCS */
469#define TRAF_ST_VCMX_FDDI 10 /* FDDI without an FCS */
470#define TRAF_ST_VCMX_802_6 11 /* 802.6 without an FCS */
471#define TRAF_ST_VCMX_FRAGMENTS 12 /* Fragments */
472#define TRAF_ST_VCMX_BPDU 13 /* BPDU */
473
474/*
475 * For TRAF_LANE:
476 */
477#define TRAF_ST_LANE_LE_CTRL 1 /* LANE: LE Ctrl */
478#define TRAF_ST_LANE_802_3 2 /* LANE: 802.3 */
479#define TRAF_ST_LANE_802_5 3 /* LANE: 802.5 */
480#define TRAF_ST_LANE_802_3_MC 4 /* LANE: 802.3 multicast */
481#define TRAF_ST_LANE_802_5_MC 5 /* LANE: 802.5 multicast */
482
483/*
484 * For TRAF_IPSILON:
485 */
486#define TRAF_ST_IPSILON_FT0 1 /* Ipsilon: Flow Type 0 */
487#define TRAF_ST_IPSILON_FT1 2 /* Ipsilon: Flow Type 1 */
488#define TRAF_ST_IPSILON_FT2 3 /* Ipsilon: Flow Type 2 */
489
490 struct atm_phdr {
491 uint32_t flags; /* status flags */
492 uint8_t aal; /* AAL of the traffic */
493 uint8_t type; /* traffic type */
494 uint8_t subtype; /* traffic subtype */
495 uint16_t vpi; /* virtual path identifier */
496 uint16_t vci; /* virtual circuit identifier */
497 uint8_t aal2_cid; /* channel id */
498 uint16_t channel; /* link: 0 for DTE->DCE, 1 for DCE->DTE */
499 uint16_t cells; /* number of cells */
500 uint16_t aal5t_u2u; /* user-to-user indicator */
501 uint16_t aal5t_len; /* length of the packet */
502 uint32_t aal5t_chksum; /* checksum for AAL5 packet */
503};
504
505/* Packet "pseudo-header" for the output from "wandsession", "wannext",
506 "wandisplay", and similar commands on Lucent/Ascend access equipment. */
507
508#define ASCEND_MAX_STR_LEN 64
509
510#define ASCEND_PFX_WDS_X 1
511#define ASCEND_PFX_WDS_R 2
512#define ASCEND_PFX_WDD 3
513#define ASCEND_PFX_ISDN_X 4
514#define ASCEND_PFX_ISDN_R 5
515#define ASCEND_PFX_ETHER 6
516
517 struct ascend_phdr {
518 uint16_t type; /* ASCEND_PFX_*, as defined above */
519 char user[ASCEND_MAX_STR_LEN]; /* Username, from wandsession header */
520 uint32_t sess; /* Session number, from wandsession header */
521 char call_num[ASCEND_MAX_STR_LEN]; /* Called number, from WDD header */
522 uint32_t chunk; /* Chunk number, from WDD header */
523 uint32_t task; /* Task number */
524};
525
526/* Packet "pseudo-header" for point-to-point links with direction flags. */
527 struct p2p_phdr {
528 bool sent;
529};
530
531/*
532 * Packet "pseudo-header" information for 802.11.
533 * Radio information is only present in this form for
534 * WTAP_ENCAP_IEEE_802_11_WITH_RADIO. This is used for file formats in
535 * which the radio information isn't provided as a pseudo-header in the
536 * packet data. It is also used by the dissectors for the pseudo-headers
537 * in the packet data to supply radio information, in a form independent
538 * of the file format and pseudo-header format, to the "802.11 radio"
539 * dissector.
540 *
541 * Signal strength, etc. information:
542 *
543 * Raw signal strength can be measured in milliwatts.
544 * It can also be represented as dBm, which is 10 times the log base 10
545 * of the signal strength in mW.
546 *
547 * The Receive Signal Strength Indicator is an integer in the range 0 to 255.
548 * The actual RSSI value for a given signal strength is dependent on the
549 * vendor (and perhaps on the adapter). The maximum possible RSSI value
550 * is also dependent on the vendor and perhaps the adapter.
551 *
552 * The signal strength can be represented as a percentage, which is 100
553 * times the ratio of the RSSI and the maximum RSSI.
554 */
555
556/*
557 * PHY types.
558 */
559#define PHDR_802_11_PHY_UNKNOWN 0 /* PHY not known */
560#define PHDR_802_11_PHY_11_FHSS 1 /* 802.11 FHSS */
561#define PHDR_802_11_PHY_11_IR 2 /* 802.11 IR */
562#define PHDR_802_11_PHY_11_DSSS 3 /* 802.11 DSSS */
563#define PHDR_802_11_PHY_11B 4 /* 802.11b */
564#define PHDR_802_11_PHY_11A 5 /* 802.11a */
565#define PHDR_802_11_PHY_11G 6 /* 802.11g */
566#define PHDR_802_11_PHY_11N 7 /* 802.11n */
567#define PHDR_802_11_PHY_11AC 8 /* 802.11ac */
568#define PHDR_802_11_PHY_11AD 9 /* 802.11ad */
569#define PHDR_802_11_PHY_11AH 10 /* 802.11ah */
570#define PHDR_802_11_PHY_11AX 11 /* 802.11ax */
571#define PHDR_802_11_PHY_11BE 12 /* 802.11be - EHT */
572
573/*
574 * PHY-specific information.
575 */
576
577/*
578 * 802.11 legacy FHSS.
579 */
580 struct ieee_802_11_fhss {
581 unsigned has_hop_set:1;
582 unsigned has_hop_pattern:1;
583 unsigned has_hop_index:1;
584
585 uint8_t hop_set; /* Hop set */
586 uint8_t hop_pattern; /* Hop pattern */
587 uint8_t hop_index; /* Hop index */
588};
589
590/*
591 * 802.11b.
592 */
593 struct ieee_802_11b {
594 /* Which of this information is present? */
595 unsigned has_short_preamble:1;
596
597 bool short_preamble; /* Short preamble */
598};
599
600/*
601 * 802.11a.
602 */
603 struct ieee_802_11a {
604 /* Which of this information is present? */
605 unsigned has_channel_type:1;
606 unsigned has_turbo_type:1;
607
608 unsigned channel_type:2;
609 unsigned turbo_type:2;
610};
611
612/*
613 * Channel type values.
614 */
615#define PHDR_802_11A_CHANNEL_TYPE_NORMAL 0
616#define PHDR_802_11A_CHANNEL_TYPE_HALF_CLOCKED 1
617#define PHDR_802_11A_CHANNEL_TYPE_QUARTER_CLOCKED 2
618
619/*
620 * "Turbo" is an Atheros proprietary extension with 40 MHz-wide channels.
621 * It can be dynamic or static.
622 *
623 * See
624 *
625 * http://wifi-insider.com/atheros/turbo.htm
626 */
627#define PHDR_802_11A_TURBO_TYPE_NORMAL 0
628#define PHDR_802_11A_TURBO_TYPE_TURBO 1 /* If we don't know whether it's static or dynamic */
629#define PHDR_802_11A_TURBO_TYPE_DYNAMIC_TURBO 2
630#define PHDR_802_11A_TURBO_TYPE_STATIC_TURBO 3
631
632/*
633 * 802.11g.
634 *
635 * This should only be used for packets sent using OFDM; packets
636 * sent on an 11g network using DSSS should have the PHY set to
637 * 11b.
638 */
639 struct ieee_802_11g {
640 /* Which of this information is present? */
641 unsigned has_mode:1;
642
643 uint32_t mode; /* Various proprietary extensions */
644};
645
646/*
647 * Mode values.
648 */
649#define PHDR_802_11G_MODE_NORMAL 0
650#define PHDR_802_11G_MODE_SUPER_G 1 /* Atheros Super G */
651
652/*
653 * 802.11n.
654 */
655 struct ieee_802_11n {
656 /* Which of this information is present? */
657 unsigned has_mcs_index:1;
658 unsigned has_bandwidth:1;
659 unsigned has_short_gi:1;
660 unsigned has_greenfield:1;
661 unsigned has_fec:1;
662 unsigned has_stbc_streams:1;
663 unsigned has_ness:1;
664
665 uint16_t mcs_index; /* MCS index */
666 unsigned bandwidth; /* Bandwidth = 20 MHz, 40 MHz, etc. */
667 unsigned short_gi:1; /* True for short guard interval */
668 unsigned greenfield:1; /* True for greenfield, short for mixed */
669 unsigned fec:1; /* FEC: 0 = BCC, 1 = LDPC */
670 unsigned stbc_streams:2; /* Number of STBC streams */
671 unsigned ness; /* Number of extension spatial streams */
672};
673
674/*
675 * Bandwidth values; used for both 11n and 11ac.
676 */
677#define PHDR_802_11_BANDWIDTH_20_MHZ 0 /* 20 MHz */
678#define PHDR_802_11_BANDWIDTH_40_MHZ 1 /* 40 MHz */
679#define PHDR_802_11_BANDWIDTH_20_20L 2 /* 20 + 20L, 40 MHz */
680#define PHDR_802_11_BANDWIDTH_20_20U 3 /* 20 + 20U, 40 MHz */
681#define PHDR_802_11_BANDWIDTH_80_MHZ 4 /* 80 MHz */
682#define PHDR_802_11_BANDWIDTH_40_40L 5 /* 40 + 40L MHz, 80 MHz */
683#define PHDR_802_11_BANDWIDTH_40_40U 6 /* 40 + 40U MHz, 80 MHz */
684#define PHDR_802_11_BANDWIDTH_20LL 7 /* ???, 80 MHz */
685#define PHDR_802_11_BANDWIDTH_20LU 8 /* ???, 80 MHz */
686#define PHDR_802_11_BANDWIDTH_20UL 9 /* ???, 80 MHz */
687#define PHDR_802_11_BANDWIDTH_20UU 10 /* ???, 80 MHz */
688#define PHDR_802_11_BANDWIDTH_160_MHZ 11 /* 160 MHz */
689#define PHDR_802_11_BANDWIDTH_80_80L 12 /* 80 + 80L, 160 MHz */
690#define PHDR_802_11_BANDWIDTH_80_80U 13 /* 80 + 80U, 160 MHz */
691#define PHDR_802_11_BANDWIDTH_40LL 14 /* ???, 160 MHz */
692#define PHDR_802_11_BANDWIDTH_40LU 15 /* ???, 160 MHz */
693#define PHDR_802_11_BANDWIDTH_40UL 16 /* ???, 160 MHz */
694#define PHDR_802_11_BANDWIDTH_40UU 17 /* ???, 160 MHz */
695#define PHDR_802_11_BANDWIDTH_20LLL 18 /* ???, 160 MHz */
696#define PHDR_802_11_BANDWIDTH_20LLU 19 /* ???, 160 MHz */
697#define PHDR_802_11_BANDWIDTH_20LUL 20 /* ???, 160 MHz */
698#define PHDR_802_11_BANDWIDTH_20LUU 21 /* ???, 160 MHz */
699#define PHDR_802_11_BANDWIDTH_20ULL 22 /* ???, 160 MHz */
700#define PHDR_802_11_BANDWIDTH_20ULU 23 /* ???, 160 MHz */
701#define PHDR_802_11_BANDWIDTH_20UUL 24 /* ???, 160 MHz */
702#define PHDR_802_11_BANDWIDTH_20UUU 25 /* ???, 160 MHz */
703
704/*
705 * 802.11ac.
706 */
707 struct ieee_802_11ac {
708 /* Which of this information is present? */
709 unsigned has_stbc:1;
710 unsigned has_txop_ps_not_allowed:1;
711 unsigned has_short_gi:1;
712 unsigned has_short_gi_nsym_disambig:1;
713 unsigned has_ldpc_extra_ofdm_symbol:1;
714 unsigned has_beamformed:1;
715 unsigned has_bandwidth:1;
716 unsigned has_fec:1;
717 unsigned has_group_id:1;
718 unsigned has_partial_aid:1;
719
720 unsigned stbc:1; /* 1 if all spatial streams have STBC */
721 unsigned txop_ps_not_allowed:1;
722 unsigned short_gi:1; /* True for short guard interval */
723 unsigned short_gi_nsym_disambig:1;
724 unsigned ldpc_extra_ofdm_symbol:1;
725 unsigned beamformed:1;
726 uint8_t bandwidth; /* Bandwidth = 20 MHz, 40 MHz, etc. */
727 uint8_t mcs[4]; /* MCS index per user */
728 uint8_t nss[4]; /* NSS per user */
729 uint8_t fec; /* Bit array of FEC per user: 0 = BCC, 1 = LDPC */
730 uint8_t group_id;
731 uint16_t partial_aid;
732};
733
734/*
735 * 802.11ad.
736 */
737
738/*
739 * Min and Max frequencies for 802.11ad and a macro for checking for 802.11ad.
740 */
741
742#define PHDR_802_11AD_MIN_FREQUENCY 57000
743#define PHDR_802_11AD_MAX_FREQUENCY 71000
744
745#define IS_80211AD(frequency) (((frequency) >= PHDR_802_11AD_MIN_FREQUENCY) &&\
746 ((frequency) <= PHDR_802_11AD_MAX_FREQUENCY))
747
748 struct ieee_802_11ad {
749 /* Which of this information is present? */
750 unsigned has_mcs_index:1;
751
752 uint8_t mcs; /* MCS index */
753};
754
755/*
756 * 802.11ax (HE).
757 */
758 struct ieee_802_11ax {
759 /* Which of this information is present? */
760 unsigned has_mcs_index:1;
761 unsigned has_bwru:1;
762 unsigned has_gi:1;
763
764 uint8_t nsts:4; /* Number of Space-time Streams */
765 uint8_t mcs:4; /* MCS index */
766 uint8_t bwru:4; /* Bandwidth/RU allocation */
767 uint8_t gi:2; /* Guard Interval */
768};
769
770/*
771 * 802.11be (EHT).
772 */
773 struct ieee_802_11be_user_info {
774 unsigned sta_id_known:1;
775 unsigned mcs_known:1;
776 unsigned coding_known:1;
777 unsigned rsv_known:1;
778 unsigned nsts_known:1;
779 unsigned bf_known:1;
780 unsigned spatial_config_known:1;
781 unsigned data_for_this_user:1;
782 unsigned sta_id:11;
783 unsigned ldpc_coding:1;
784 unsigned mcs:4;
785 unsigned nsts:4;
786 unsigned rsv:1;
787 unsigned beamform:1;
788 unsigned rsv2:2;
789};
790
791#define PHDR_802_11BE_MAX_USERS 4
792 struct ieee_802_11be {
793 /* Which of this information is present? */
794 unsigned has_ru_mru_size:1;
795 unsigned has_gi:1;
796 unsigned has_bandwidth:1;
797
798 uint8_t bandwidth;
799 uint8_t ru_mru_size:4; /* RU/MRU allocation */
800 uint8_t gi:2; /* Guard Interval */
801 uint8_t num_users;
802 struct ieee_802_11be_user_info user[PHDR_802_11BE_MAX_USERS]; /* Adding info for only upto 4 users */
803};
804
805
816 union ieee_802_11_phy_info {
817 struct ieee_802_11_fhss info_11_fhss;
818 struct ieee_802_11b info_11b;
819 struct ieee_802_11a info_11a;
820 struct ieee_802_11g info_11g;
821 struct ieee_802_11n info_11n;
822 struct ieee_802_11ac info_11ac;
823 struct ieee_802_11ad info_11ad;
824 struct ieee_802_11ax info_11ax;
825 struct ieee_802_11be info_11be;
826};
827
828 struct ieee_802_11_phdr {
829 int fcs_len; /* Number of bytes of FCS - -1 means "unknown" */
830 unsigned decrypted:1; /* true if frame is decrypted even if "protected" bit is set */
831 unsigned datapad:1; /* true if frame has padding between 802.11 header and payload */
832 unsigned no_a_msdus:1; /* true if we should ignore the A-MSDU bit */
833 unsigned phy; /* PHY type */
834 union ieee_802_11_phy_info phy_info;
835
836 /* Which of this information is present? */
837 unsigned has_channel:1;
838 unsigned has_frequency:1;
839 unsigned has_data_rate:1;
840 unsigned has_signal_percent:1;
841 unsigned has_noise_percent:1;
842 unsigned has_signal_dbm:1;
843 unsigned has_noise_dbm:1;
844 unsigned has_signal_db:1;
845 unsigned has_noise_db:1;
846 unsigned has_tsf_timestamp:1;
847 unsigned has_aggregate_info:1; /* aggregate flags and ID */
848 unsigned has_zero_length_psdu_type:1; /* zero-length PSDU type */
849
850 uint16_t channel; /* Channel number */
851 uint32_t frequency; /* Channel center frequency */
852 uint16_t data_rate; /* Data rate, in .5 Mb/s units */
853 uint8_t signal_percent; /* Signal level, as a percentage */
854 uint8_t noise_percent; /* Noise level, as a percentage */
855 int8_t signal_dbm; /* Signal level, in dBm */
856 int8_t noise_dbm; /* Noise level, in dBm */
857 uint8_t signal_db; /* Signal level, in dB from an arbitrary point */
858 uint8_t noise_db; /* Noise level, in dB from an arbitrary point */
859 uint64_t tsf_timestamp;
860 uint32_t aggregate_flags; /* A-MPDU flags */
861 uint32_t aggregate_id; /* ID for A-MPDU reassembly */
862 uint8_t zero_length_psdu_type; /* type of zero-length PSDU */
863};
864
865/*
866 * A-MPDU flags.
867 */
868#define PHDR_802_11_LAST_PART_OF_A_MPDU 0x00000001 /* this is the last part of an A-MPDU */
869#define PHDR_802_11_A_MPDU_DELIM_CRC_ERROR 0x00000002 /* delimiter CRC error after this part */
870
871/*
872 * Zero-length PSDU types.
873 */
874#define PHDR_802_11_SOUNDING_PSDU 0 /* sounding PPDU */
875#define PHDR_802_11_DATA_NOT_CAPTURED 1 /* data not captured, (e.g. multi-user PPDU) */
876#define PHDR_802_11_0_LENGTH_PSDU_VENDOR_SPECIFIC 0xff
877
878/* Packet "pseudo-header" for the output from CoSine L2 debug output. */
879
880#define COSINE_MAX_IF_NAME_LEN 128
881
882#define COSINE_ENCAP_TEST 1
883#define COSINE_ENCAP_PPoATM 2
884#define COSINE_ENCAP_PPoFR 3
885#define COSINE_ENCAP_ATM 4
886#define COSINE_ENCAP_FR 5
887#define COSINE_ENCAP_HDLC 6
888#define COSINE_ENCAP_PPP 7
889#define COSINE_ENCAP_ETH 8
890#define COSINE_ENCAP_UNKNOWN 99
891
892#define COSINE_DIR_TX 1
893#define COSINE_DIR_RX 2
894
895 struct cosine_phdr {
896 uint8_t encap; /* COSINE_ENCAP_* as defined above */
897 uint8_t direction; /* COSINE_DIR_*, as defined above */
898 char if_name[COSINE_MAX_IF_NAME_LEN]; /* Encap & Logical I/F name */
899 uint16_t pro; /* Protocol */
900 uint16_t off; /* Offset */
901 uint16_t pri; /* Priority */
902 uint16_t rm; /* Rate Marking */
903 uint16_t err; /* Error Code */
904};
905
906/* Packet "pseudo-header" for IrDA capture files. */
907
908/*
909 * Direction of the packet
910 */
911#define IRDA_INCOMING 0x0000
912#define IRDA_OUTGOING 0x0004
913
914/*
915 * "Inline" log messages produced by IrCOMM2k on Windows
916 */
917#define IRDA_LOG_MESSAGE 0x0100 /* log message */
918#define IRDA_MISSED_MSG 0x0101 /* missed log entry or frame */
919
920/*
921 * Differentiate between frames and log messages
922 */
923#define IRDA_CLASS_FRAME 0x0000
924#define IRDA_CLASS_LOG 0x0100
925#define IRDA_CLASS_MASK 0xFF00
926
927 struct irda_phdr {
928 uint16_t pkttype; /* packet type */
929};
930
931/* Packet "pseudo-header" for nettl (HP-UX) capture files. */
932
933 struct nettl_phdr {
934 uint16_t subsys;
935 uint32_t devid;
936 uint32_t kind;
937 int32_t pid;
938 uint32_t uid;
939};
940
941/* Packet "pseudo-header" for MTP2 files. */
942
943#define MTP2_ANNEX_A_NOT_USED 0
944#define MTP2_ANNEX_A_USED 1
945#define MTP2_ANNEX_A_USED_UNKNOWN 2
946
947 struct mtp2_phdr {
948 uint8_t sent;
949 uint8_t annex_a_used;
950 uint16_t link_number;
951};
952
960 typedef union {
966 struct {
967 uint16_t vp;
968 uint16_t vc;
969 uint16_t cid;
970 } atm;
971
978 uint32_t ds0mask;
979} k12_input_info_t;
980
981 struct k12_phdr {
982 uint32_t input;
983 const char *input_name;
984 const char *stack_file;
985 uint32_t input_type;
986 k12_input_info_t input_info;
987 uint8_t *extra_info;
988 uint32_t extra_length;
989 void* stuff;
990};
991
992#define K12_PORT_DS0S 0x00010008
993#define K12_PORT_DS1 0x00100008
994#define K12_PORT_ATMPVC 0x01020000
995
1003 struct lapd_phdr {
1004 uint16_t pkttype;
1005 uint8_t we_network;
1006};
1007
1015 struct catapult_dct2000_phdr {
1016 union {
1017 struct isdn_phdr isdn;
1018 struct atm_phdr atm;
1019 struct p2p_phdr p2p;
1020 } inner_pseudo_header;
1021
1022 int64_t seek_off;
1023 struct wtap *wth;
1024};
1025
1026/*
1027 * Endace Record Format pseudo header
1028 */
1029 struct erf_phdr {
1030 uint64_t ts; /* Time stamp */
1031 uint8_t type;
1032 uint8_t flags;
1033 uint16_t rlen;
1034 uint16_t lctr;
1035 uint16_t wlen;
1036};
1037
1038 struct erf_ehdr {
1039 uint64_t ehdr;
1040};
1041
1042/*
1043 * ERF pseudo header with optional subheader
1044 * (Multichannel or Ethernet)
1045 */
1046
1047#define MAX_ERF_EHDR 16
1048
1049 struct wtap_erf_eth_hdr {
1050 uint8_t offset;
1051 uint8_t pad;
1052};
1053
1062 struct erf_mc_phdr {
1063 struct erf_phdr phdr;
1065 struct erf_ehdr ehdr_list[MAX_ERF_EHDR];
1072 union {
1073 struct wtap_erf_eth_hdr eth_hdr;
1074 uint32_t mc_hdr;
1075 uint32_t aal2_hdr;
1076 } subhdr;
1077};
1078
1079#define SITA_FRAME_DIR_TXED (0x00) /* values of sita_phdr.flags */
1080#define SITA_FRAME_DIR_RXED (0x01)
1081#define SITA_FRAME_DIR (0x01) /* mask */
1082#define SITA_ERROR_NO_BUFFER (0x80)
1083
1084#define SITA_SIG_DSR (0x01) /* values of sita_phdr.signals */
1085#define SITA_SIG_DTR (0x02)
1086#define SITA_SIG_CTS (0x04)
1087#define SITA_SIG_RTS (0x08)
1088#define SITA_SIG_DCD (0x10)
1089#define SITA_SIG_UNDEF1 (0x20)
1090#define SITA_SIG_UNDEF2 (0x40)
1091#define SITA_SIG_UNDEF3 (0x80)
1092
1093#define SITA_ERROR_TX_UNDERRUN (0x01) /* values of sita_phdr.errors2 (if SITA_FRAME_DIR_TXED) */
1094#define SITA_ERROR_TX_CTS_LOST (0x02)
1095#define SITA_ERROR_TX_UART_ERROR (0x04)
1096#define SITA_ERROR_TX_RETX_LIMIT (0x08)
1097#define SITA_ERROR_TX_UNDEF1 (0x10)
1098#define SITA_ERROR_TX_UNDEF2 (0x20)
1099#define SITA_ERROR_TX_UNDEF3 (0x40)
1100#define SITA_ERROR_TX_UNDEF4 (0x80)
1101
1102#define SITA_ERROR_RX_FRAMING (0x01) /* values of sita_phdr.errors1 (if SITA_FRAME_DIR_RXED) */
1103#define SITA_ERROR_RX_PARITY (0x02)
1104#define SITA_ERROR_RX_COLLISION (0x04)
1105#define SITA_ERROR_RX_FRAME_LONG (0x08)
1106#define SITA_ERROR_RX_FRAME_SHORT (0x10)
1107#define SITA_ERROR_RX_UNDEF1 (0x20)
1108#define SITA_ERROR_RX_UNDEF2 (0x40)
1109#define SITA_ERROR_RX_UNDEF3 (0x80)
1110
1111#define SITA_ERROR_RX_NONOCTET_ALIGNED (0x01) /* values of sita_phdr.errors2 (if SITA_FRAME_DIR_RXED) */
1112#define SITA_ERROR_RX_ABORT (0x02)
1113#define SITA_ERROR_RX_CD_LOST (0x04)
1114#define SITA_ERROR_RX_DPLL (0x08)
1115#define SITA_ERROR_RX_OVERRUN (0x10)
1116#define SITA_ERROR_RX_FRAME_LEN_VIOL (0x20)
1117#define SITA_ERROR_RX_CRC (0x40)
1118#define SITA_ERROR_RX_BREAK (0x80)
1119
1120#define SITA_PROTO_UNUSED (0x00) /* values of sita_phdr.proto */
1121#define SITA_PROTO_BOP_LAPB (0x01)
1122#define SITA_PROTO_ETHERNET (0x02)
1123#define SITA_PROTO_ASYNC_INTIO (0x03)
1124#define SITA_PROTO_ASYNC_BLKIO (0x04)
1125#define SITA_PROTO_ALC (0x05)
1126#define SITA_PROTO_UTS (0x06)
1127#define SITA_PROTO_PPP_HDLC (0x07)
1128#define SITA_PROTO_SDLC (0x08)
1129#define SITA_PROTO_TOKENRING (0x09)
1130#define SITA_PROTO_I2C (0x10)
1131#define SITA_PROTO_DPM_LINK (0x11)
1132#define SITA_PROTO_BOP_FRL (0x12)
1133
1134 struct sita_phdr {
1135 uint8_t sita_flags;
1136 uint8_t sita_signals;
1137 uint8_t sita_errors1;
1138 uint8_t sita_errors2;
1139 uint8_t sita_proto;
1140};
1141
1142/*pseudo header for Bluetooth HCI*/
1143 struct bthci_phdr {
1144 bool sent;
1145 uint32_t channel;
1146};
1147
1148#define BTHCI_CHANNEL_COMMAND 1
1149#define BTHCI_CHANNEL_ACL 2
1150#define BTHCI_CHANNEL_SCO 3
1151#define BTHCI_CHANNEL_EVENT 4
1152#define BTHCI_CHANNEL_ISO 5
1153
1154/* pseudo header for WTAP_ENCAP_BLUETOOTH_LINUX_MONITOR */
1155 struct btmon_phdr {
1156 uint16_t adapter_id;
1157 uint16_t opcode;
1158};
1159
1160/* pseudo header for WTAP_ENCAP_LAYER1_EVENT */
1161 struct l1event_phdr {
1162 bool uton;
1163};
1164
1165/* * I2C pseudo header */
1166 struct i2c_phdr {
1167 uint8_t is_event;
1168 uint8_t bus;
1169 uint32_t flags;
1170};
1171
1172/* pseudo header for WTAP_ENCAP_GSM_UM */
1173 struct gsm_um_phdr {
1174 bool uplink;
1175 uint8_t channel;
1176 /* The following are only populated for downlink */
1177 uint8_t bsic;
1178 uint16_t arfcn;
1179 uint32_t tdma_frame;
1180 uint8_t error;
1181 uint16_t timeshift;
1182};
1183
1184#define GSM_UM_CHANNEL_UNKNOWN 0
1185#define GSM_UM_CHANNEL_BCCH 1
1186#define GSM_UM_CHANNEL_SDCCH 2
1187#define GSM_UM_CHANNEL_SACCH 3
1188#define GSM_UM_CHANNEL_FACCH 4
1189#define GSM_UM_CHANNEL_CCCH 5
1190#define GSM_UM_CHANNEL_RACH 6
1191#define GSM_UM_CHANNEL_AGCH 7
1192#define GSM_UM_CHANNEL_PCH 8
1193
1194/* Pseudo-header for nstrace packets */
1195 struct nstr_phdr {
1196 int64_t rec_offset;
1197 int32_t rec_len;
1198 uint8_t nicno_offset;
1199 uint8_t nicno_len;
1200 uint8_t dir_offset;
1201 uint8_t dir_len;
1202 uint16_t eth_offset;
1203 uint8_t pcb_offset;
1204 uint8_t l_pcb_offset;
1205 uint8_t rec_type;
1206 uint8_t vlantag_offset;
1207 uint8_t coreid_offset;
1208 uint8_t srcnodeid_offset;
1209 uint8_t destnodeid_offset;
1210 uint8_t clflags_offset;
1211 uint8_t src_vmname_len_offset;
1212 uint8_t dst_vmname_len_offset;
1213 uint8_t ns_activity_offset;
1214 uint8_t data_offset;
1215};
1216
1217/* Packet "pseudo-header" for Nokia output */
1218 struct nokia_phdr {
1219 struct eth_phdr eth;
1220 uint8_t stuff[4]; /* mysterious stuff */
1221};
1222
1223#define LLCP_PHDR_FLAG_SENT 0
1224 struct llcp_phdr {
1225 uint8_t adapter;
1226 uint8_t flags;
1227};
1228
1229/* pseudo header for WTAP_ENCAP_LOGCAT */
1230 struct logcat_phdr {
1231 int version;
1232};
1233
1241 struct netmon_phdr {
1242 uint8_t* title;
1243 uint32_t descLength;
1244 uint8_t* description;
1246 unsigned sub_encap;
1253 union sub_wtap_pseudo_header {
1254 struct eth_phdr eth;
1255 struct atm_phdr atm;
1256 struct ieee_802_11_phdr ieee_802_11;
1257 } subheader;
1258};
1259
1260/* Record "pseudo-header" information for header data from MS ProcMon files. */
1261
1262 struct procmon_process_t;
1263 struct procmon_phdr {
1264 uint32_t *process_index_map; /* Map of process index to process array index */
1265 size_t process_index_map_size;
1266 struct procmon_process_t *process_array; /* Array of processes */
1267 size_t process_array_size;
1268 bool system_bitness; /* System bitness: 1 if the system is 64 bit, 0 otherwise. */
1269};
1270
1271/* File "pseudo-header" for BER data files. */
1272 struct ber_phdr {
1273 const char *pathname; /* Path name of file. */
1274};
1275
1276/* File "pseudo-header" for M-Module files. */
1277 struct mmodule_phdr {
1278 uint8_t chunktype;
1279};
1280
1281 union wtap_pseudo_header {
1282 struct eth_phdr eth;
1283 struct dte_dce_phdr dte_dce;
1284 struct isdn_phdr isdn;
1285 struct atm_phdr atm;
1286 struct ascend_phdr ascend;
1287 struct p2p_phdr p2p;
1288 struct ieee_802_11_phdr ieee_802_11;
1289 struct cosine_phdr cosine;
1290 struct irda_phdr irda;
1291 struct nettl_phdr nettl;
1292 struct mtp2_phdr mtp2;
1293 struct k12_phdr k12;
1294 struct lapd_phdr lapd;
1295 struct catapult_dct2000_phdr dct2000;
1296 struct erf_mc_phdr erf;
1297 struct sita_phdr sita;
1298 struct bthci_phdr bthci;
1299 struct btmon_phdr btmon;
1300 struct l1event_phdr l1event;
1301 struct i2c_phdr i2c;
1302 struct gsm_um_phdr gsm_um;
1303 struct nstr_phdr nstr;
1304 struct nokia_phdr nokia;
1305 struct llcp_phdr llcp;
1306 struct logcat_phdr logcat;
1307 struct netmon_phdr netmon;
1308 struct procmon_phdr procmon;
1309 struct ber_phdr ber;
1310 struct mmodule_phdr mmodule;
1311};
1312
1313/*
1314 * Record type values.
1315 *
1316 * This list will expand over time, so don't assume everything will
1317 * forever be one of the types listed below.
1318 *
1319 * For file-type-specific records, the "ftsrec" field of the pseudo-header
1320 * contains a file-type-specific subtype value, such as a block type for
1321 * a pcapng file.
1322 *
1323 * An "event" is an indication that something happened during the capture
1324 * process, such as a status transition of some sort on the network.
1325 * These should, ideally, have a time stamp and, if they're relevant to
1326 * a particular interface on a multi-interface capture, should also have
1327 * an interface ID. The data for the event is file-type-specific and
1328 * subtype-specific. These should be dissected and displayed just as
1329 * packets are.
1330 *
1331 * A "report" supplies information not corresponding to an event;
1332 * for example, a pcapng Interface Statistics Block would be a report,
1333 * as it doesn't correspond to something happening on the network.
1334 * They may have a time stamp, and should be dissected and displayed
1335 * just as packets are.
1336 *
1337 * We distinguish between "events" and "reports" so that, for example,
1338 * the packet display can show the delta between a packet and an event
1339 * but not show the delta between a packet and a report, as the time
1340 * stamp of a report may not correspond to anything interesting on
1341 * the network but the time stamp of an event would.
1342 *
1343 * XXX - are there any file-type-specific records that *shouldn't* be
1344 * dissected and displayed? If so, they should be parsed and the
1345 * information in them stored somewhere, and used somewhere, whether
1346 * it's just used when saving the file in its native format or also
1347 * used to parse *other* file-type-specific records.
1348 *
1349 * These would be similar to, for example, pcapng Interface Description
1350 * Blocks, for which the position within the file is significant only
1351 * in that an IDB for an interface must appear before any packets from
1352 * the interface; the fact that an IDB appears at some point doesn't
1353 * necessarily mean something happened in the capture at that point.
1354 * Name Resolution Blocks are another example of such a record.
1355 *
1356 * (XXX - if you want to have a record that says "this interface first
1357 * showed up at this time", that needs to be a separate record type
1358 * from the IDB. We *could* add a "New Interface Description Block",
1359 * with a time stamp, for that purpose, but we'd *still* have to
1360 * provide IDBs for those interfaces, for compatibility with programs
1361 * that don't know about the NIDB. An ISB with only an isb_starttime
1362 * option would suffice for this purpose, so nothing needs to be
1363 * added to pcapng for this.)
1364 */
1365#define REC_TYPE_PACKET 0
1366#define REC_TYPE_FT_SPECIFIC_EVENT 1
1367#define REC_TYPE_FT_SPECIFIC_REPORT 2
1368#define REC_TYPE_SYSCALL 3
1369#define REC_TYPE_SYSTEMD_JOURNAL_EXPORT 4
1370#define REC_TYPE_CUSTOM_BLOCK 5
1372 typedef struct {
1373 uint32_t caplen; /* data length in the file */
1374 uint32_t len; /* data length on the wire */
1375 int pkt_encap; /* WTAP_ENCAP_ value for this packet */
1376 /* pcapng variables */
1377 uint32_t interface_id; /* identifier of the interface. */
1378 /* options */
1379
1380 union wtap_pseudo_header pseudo_header;
1381} wtap_packet_header;
1382
1383/*
1384 * The pcapng specification says "The word is encoded as an unsigned
1385 * 32-bit integer, using the endianness of the Section Header Block
1386 * scope it is in. In the following table, the bits are numbered with
1387 * 0 being the most-significant bit and 31 being the least-significant
1388 * bit of the 32-bit unsigned integer."
1389 *
1390 * From that, the direction, in bits 0 and 1, is at the *top* of the word.
1391 *
1392 * However, several implementations, such as:
1393 *
1394 * the Wireshark pcapng file reading code;
1395 *
1396 * macOS libpcap and tcpdump;
1397 *
1398 * text2pcap;
1399 *
1400 * and probably the software that generated the capture in bug 11665;
1401 *
1402 * treat 0 as the *least*-significant bit and bit 31 being the *most*-
1403 * significant bit of the flags word, and put the direction at the
1404 * *bottom* of the word.
1405 *
1406 * For now, we go with the known implementations.
1407 */
1408
1409/* Direction field of the packet flags */
1410#define PACK_FLAGS_DIRECTION_MASK 0x00000003 /* unshifted */
1411#define PACK_FLAGS_DIRECTION_SHIFT 0
1412#define PACK_FLAGS_DIRECTION(pack_flags) (((pack_flags) & PACK_FLAGS_DIRECTION_MASK) >> PACK_FLAGS_DIRECTION_SHIFT)
1413#define PACK_FLAGS_DIRECTION_UNKNOWN 0
1414#define PACK_FLAGS_DIRECTION_INBOUND 1
1415#define PACK_FLAGS_DIRECTION_OUTBOUND 2
1416
1417/* Reception type field of the packet flags */
1418#define PACK_FLAGS_RECEPTION_TYPE_MASK 0x0000001C /* unshifted */
1419#define PACK_FLAGS_RECEPTION_TYPE_SHIFT 2
1420#define PACK_FLAGS_RECEPTION_TYPE(pack_flags) (((pack_flags) & PACK_FLAGS_RECEPTION_TYPE_MASK) >> PACK_FLAGS_RECEPTION_TYPE_SHIFT)
1421#define PACK_FLAGS_RECEPTION_TYPE_UNSPECIFIED 0
1422#define PACK_FLAGS_RECEPTION_TYPE_UNICAST 1
1423#define PACK_FLAGS_RECEPTION_TYPE_MULTICAST 2
1424#define PACK_FLAGS_RECEPTION_TYPE_BROADCAST 3
1425#define PACK_FLAGS_RECEPTION_TYPE_PROMISCUOUS 4
1426
1427/* FCS length field of the packet flags */
1428#define PACK_FLAGS_FCS_LENGTH_MASK 0x000001E0 /* unshifted */
1429#define PACK_FLAGS_FCS_LENGTH_SHIFT 5
1430#define PACK_FLAGS_FCS_LENGTH(pack_flags) (((pack_flags) & PACK_FLAGS_FCS_LENGTH_MASK) >> PACK_FLAGS_FCS_LENGTH_SHIFT)
1431
1432/* Reserved bits of the packet flags */
1433#define PACK_FLAGS_RESERVED_MASK 0x0000FE00
1434
1435/* Link-layer-dependent errors of the packet flags */
1436
1437/* For Ethernet and possibly some other network types */
1438#define PACK_FLAGS_CRC_ERROR 0x01000000
1439#define PACK_FLAGS_PACKET_TOO_LONG 0x02000000
1440#define PACK_FLAGS_PACKET_TOO_SHORT 0x04000000
1441#define PACK_FLAGS_WRONG_INTER_FRAME_GAP 0x08000000
1442#define PACK_FLAGS_UNALIGNED_FRAME 0x10000000
1443#define PACK_FLAGS_START_FRAME_DELIMITER_ERROR 0x20000000
1444#define PACK_FLAGS_PREAMBLE_ERROR 0x40000000
1445#define PACK_FLAGS_SYMBOL_ERROR 0x80000000
1446
1447/* Construct a pack_flags value from its subfield values */
1448#define PACK_FLAGS_VALUE(direction, reception_type, fcs_length, ll_dependent_errors) \
1449 (((direction) << 30) | \
1450 ((reception_type) << 27) | \
1451 ((fcs_length) << 23) | \
1452 (ll_dependent_errors))
1453
1454 typedef struct {
1455 int file_type_subtype; /* the type of file this is for */
1456 unsigned record_type; /* the type of record this is - file type-specific value */
1457 uint32_t record_len; /* length of the record */
1458 union wtap_pseudo_header pseudo_header;
1459
1460} wtap_ft_specific_header;
1461
1462 typedef struct {
1463 const char *pathname; /* Path name of file. */
1464 unsigned record_type; /* XXX match ft_specific_record_phdr so that we chain off of packet-pcapng_block for now. */
1465 int byte_order;
1466 /* uint32_t sentinel; */
1467 uint64_t timestamp; /* ns since epoch - XXX dup of ts */
1468 uint64_t thread_id;
1469 uint32_t event_len; /* length of the event (ppm event len) */
1470 uint32_t event_data_len; /* length of the event data (ppm event len - ppm event header len) */
1471 uint32_t nparams; /* number of parameters of the event */
1472 uint32_t flags;
1473 uint16_t event_type;
1474 uint16_t cpu_id;
1475 /* ... Event ... */
1476} wtap_syscall_header;
1477
1478 typedef struct {
1479 uint32_t record_len; /* length of the record */
1480} wtap_systemd_journal_export_header;
1481
1482 typedef struct {
1483 uint32_t pen; /* private enterprise number */
1484 uint32_t length; /* length of the Custom Data plus options */
1485 bool copy_allowed; /* CB can be written */
1486} wtap_custom_block_header;
1487
1488/*
1489 * The largest nstime.secs value that can be put into an unsigned
1490 * 32-bit quantity.
1491 *
1492 * We assume that time_t is signed; it is signed on Windows/MSVC and
1493 * on many UN*Xes.
1494 *
1495 * So, if time_t is 32-bit, we define this as INT32_MAX, as that's
1496 * the largest value a time_t can have, and it fits in an unsigned
1497 * 32-bit quantity. If it's 64-bit or larger, we define this as
1498 * UINT32_MAX, as, even if it's signed, it can be as large as
1499 * UINT32_MAX, and that's the largest value that can fit in
1500 * a 32-bit unsigned quantity.
1501 *
1502 * Comparing against this, rather than against G_MAXINT2, when checking
1503 * whether a time stamp will fit in a 32-bit unsigned integer seconds
1504 * field in a capture file being written avoids signed vs. unsigned
1505 * warnings if time_t is a signed 32-bit type.
1506 *
1507 * XXX - what if time_t is unsigned? Are there any platforms where
1508 * it is?
1509 */
1510#define WTAP_NSTIME_32BIT_SECS_MAX ((time_t)(sizeof(time_t) > sizeof(int32_t) ? UINT32_MAX : INT32_MAX))
1511
1512 typedef struct wtap_rec {
1513 unsigned rec_type; /* what type of record is this? */
1514 uint32_t presence_flags; /* what stuff do we have? */
1515 unsigned section_number; /* section, within file, containing this record */
1516 nstime_t ts; /* time stamp */
1517 int tsprec; /* WTAP_TSPREC_ value for this record */
1518 const char *rec_type_name; /* name of this record type */
1519 union {
1520 wtap_packet_header packet_header;
1521 wtap_ft_specific_header ft_specific_header;
1522 wtap_syscall_header syscall_header;
1523 wtap_systemd_journal_export_header systemd_journal_export_header;
1524 wtap_custom_block_header custom_block_header;
1525 } rec_header;
1526
1527 /*
1528 * XXX - some if not all of the rec_header information may belong
1529 * here, or may already be here. Eliminating rec_header in favor
1530 * of this might simplify the process of adding new record/block
1531 * types. For example, some of it might belong in block->mandatory_data.
1532 *
1533 * It also has a type field that's somewhat equivalent to rec_type.
1534 *
1535 * It's null for some record types.
1536 */
1537 wtap_block_t block; /* block information */
1538 bool block_was_modified; /* true if ANY aspect of the block has been modified */
1539
1540 /*
1541 * We use a Buffer so that we don't have to allocate and free
1542 * a buffer for the options for each record.
1543 */
1544 Buffer options_buf; /* file-type specific data */
1545
1546 /* Buffer for the record data. */
1547 Buffer data;
1548} wtap_rec;
1549
1550/*
1551 * Bits in presence_flags, indicating which of the fields we have.
1552 *
1553 * For the time stamp, we may need some more flags to indicate
1554 * whether the time stamp is an absolute date-and-time stamp, an
1555 * absolute time-only stamp (which can make relative time
1556 * calculations tricky, as you could in theory have two time
1557 * stamps separated by an unknown number of days), or a time stamp
1558 * relative to some unspecified time in the past (see mpeg.c).
1559 *
1560 * There is no presence flag for len - there has to be *some* length
1561 * value for the packet. (The "captured length" can be missing if
1562 * the file format doesn't report a captured length distinct from
1563 * the on-the-network length because the application(s) producing those
1564 * files don't support slicing packets.)
1565 *
1566 * There could be a presence flag for the packet encapsulation - if it's
1567 * absent, use the file encapsulation - but it's not clear that's useful;
1568 * we currently do that in the module for the file format.
1569 *
1570 * Only WTAP_HAS_TS and WTAP_HAS_SECTION_NUMBER apply to all record types.
1571 */
1572#define WTAP_HAS_TS 0x00000001
1573#define WTAP_HAS_CAP_LEN 0x00000002
1574#define WTAP_HAS_INTERFACE_ID 0x00000004
1575#define WTAP_HAS_SECTION_NUMBER 0x00000008
1577/*
1578 * The old max name length define, both for backwards compatibility and because
1579 * other name types (in epan) use it. While Name Resolution Blocks (NRBs) only
1580 * support IPv4 and IPv6 currently, they could later support other name types.
1581 */
1582#ifndef MAXNAMELEN
1583#define MAXNAMELEN 64 /* max name length (most names: DNS labels, services, eth) */
1584#endif
1585
1586#ifndef MAXDNSNAMELEN
1587#define MAXDNSNAMELEN 256 /* max total length of a domain name in DNS */
1588#endif
1589
1590 typedef struct hashipv4 {
1591 unsigned addr;
1592 uint8_t flags; /* B0 dummy_entry, B1 resolve, B2 If the address is used in the trace */
1593 char ip[WS_INET_ADDRSTRLEN];
1594 char name[MAXDNSNAMELEN];
1595 char cidr_addr[WS_INET_CIDRADDRSTRLEN];
1596} hashipv4_t;
1597
1598 typedef struct hashipv6 {
1599 uint8_t addr[16];
1600 uint8_t flags; /* B0 dummy_entry, B1 resolve, B2 If the address is used in the trace */
1601 char ip6[WS_INET6_ADDRSTRLEN];
1602 char name[MAXDNSNAMELEN];
1603} hashipv6_t;
1604
1608 typedef struct addrinfo_lists {
1609 GList *ipv4_addr_list;
1610 GList *ipv6_addr_list;
1611} addrinfo_lists_t;
1612
1629 typedef struct wtap_dump_params {
1630 int encap;
1631 int snaplen;
1632 int tsprec;
1633 GArray *shb_hdrs;
1634 const GArray *shb_iface_to_global;
1637 wtapng_iface_descriptions_t *idb_inf;
1638 const GArray *nrbs_growing;
1641 GArray *dsbs_initial;
1642 const GArray *dsbs_growing;
1645 const GArray *mevs_growing;
1648 const GArray *dpibs_growing;
1651 bool dont_copy_idbs;
1652} wtap_dump_params;
1653
1654/* Zero-initializer for wtap_dump_params. */
1655#define WTAP_DUMP_PARAMS_INIT {.snaplen=0}
1656
1657 struct wtap_dumper;
1658
1659 typedef struct wtap wtap;
1660 typedef struct wtap_dumper wtap_dumper;
1661
1662 typedef struct wtap_reader *FILE_T;
1663
1664/* Similar to the wtap_open_routine_info for open routines, the following
1665 * wtap_wslua_file_info struct is used by wslua code for Lua-based file writers.
1666 *
1667 * This concept is necessary because when wslua goes to invoke the
1668 * registered dump/write_open routine callback in Lua, it needs the ref number representing
1669 * the hooked function inside Lua. This will be stored in the thing pointed to
1670 * by the void* data here. This 'data' pointer will be copied into the
1671 * wtap_dumper struct's 'void* data' member when calling the dump_open function,
1672 * which is how wslua finally retrieves it. Unlike wtap_dumper's 'priv' member, its
1673 * 'data' member is not free'd in wtap_dump_close().
1674 */
1675 typedef struct wtap_wslua_file_info {
1676 int (*wslua_can_write_encap)(int, void*); /* a can_write_encap func for wslua uses */
1677 void* wslua_data; /* holds the wslua data */
1678} wtap_wslua_file_info_t;
1679
1718 struct file_extension_info {
1719 const char *name;
1720 bool is_capture_file;
1721 const char *extensions;
1722};
1723
1750 typedef enum {
1751 WTAP_OPEN_NOT_MINE = 0,
1752 WTAP_OPEN_MINE = 1,
1753 WTAP_OPEN_ERROR = -1
1754} wtap_open_return_val;
1755
1756 typedef wtap_open_return_val (*wtap_open_routine_t)(struct wtap*, int *,
1757 char **);
1758
1779 typedef enum {
1780 OPEN_INFO_MAGIC = 0,
1781 OPEN_INFO_HEURISTIC = 1
1782} wtap_open_type;
1783
1784WS_DLL_PUBLIC void init_open_routines(void);
1785
1792 void cleanup_open_routines(void);
1793
1820 struct open_info {
1821 const char *name;
1822 wtap_open_type type;
1823 wtap_open_routine_t open_routine;
1824 const char *extensions;
1825 char **extensions_set;
1826 void* wslua_data;
1827};
1828
1835WS_DLL_PUBLIC struct open_info *open_routines;
1836
1837/*
1838 * Types of comments.
1839 */
1845#define WTAP_COMMENT_PER_SECTION 0x00000001 /* per-file/per-file-section */
1846
1852#define WTAP_COMMENT_PER_INTERFACE 0x00000002 /* per-interface */
1853
1859#define WTAP_COMMENT_PER_PACKET 0x00000004 /* per-packet */
1860
1871 typedef enum {
1872 OPTION_NOT_SUPPORTED,
1873 ONE_OPTION_SUPPORTED,
1874 MULTIPLE_OPTIONS_SUPPORTED
1875} option_support_t;
1876
1883 struct supported_option_type {
1884 unsigned opt;
1885 option_support_t support;
1886};
1887
1893#define OPTION_TYPES_SUPPORTED(option_type_array) \
1894 array_length(option_type_array), option_type_array
1895
1901#define NO_OPTIONS_SUPPORTED \
1902 0, NULL
1903
1904/*
1905 * For a given block type, does a file format not support it, support
1906 * only one such block, or support multiple such blocks?
1907 */
1908 typedef enum {
1909 BLOCK_NOT_SUPPORTED,
1910 ONE_BLOCK_SUPPORTED,
1911 MULTIPLE_BLOCKS_SUPPORTED
1912} block_support_t;
1913
1914/*
1915 * Entry in a table of supported block types.
1916 */
1917 struct supported_block_type {
1918 wtap_block_type_t type;
1919 block_support_t support; /* BLOCK_NOT_SUPPORTED allowed, equivalent to absence */
1920 size_t num_supported_options;
1921 const struct supported_option_type *supported_options;
1922};
1923
1924#define BLOCKS_SUPPORTED(block_type_array) \
1925 array_length(block_type_array), block_type_array
1926
1927 struct file_type_subtype_info {
1931 const char *description;
1932
1937 const char *name;
1938
1943 const char *default_file_extension;
1944
1951 const char *additional_file_extensions;
1952
1956 bool writing_must_seek;
1957
1961 size_t num_supported_blocks;
1962
1966 const struct supported_block_type *supported_blocks;
1967
1976 int (*can_write_encap)(int);
1977
1982 bool (*dump_open)(wtap_dumper *, int *, char **);
1983
1988 wtap_wslua_file_info_t *wslua_info;
1989};
1990
1991#define WTAP_TYPE_AUTO 0
1992
2001WS_DLL_PUBLIC
2002 void wtap_init(bool load_wiretap_plugins, const char* app_env_var_prefix, const struct file_extension_info* file_extensions, unsigned num_extensions);
2003
2021WS_DLL_PUBLIC
2022 struct wtap* wtap_open_offline(const char *filename, unsigned int type, int *err,
2023 char **err_info, bool do_random, const char* app_env_var_prefix);
2024
2033WS_DLL_PUBLIC
2034 void wtap_cleareof(wtap *wth);
2035
2046 typedef void (*wtap_new_ipv4_callback_t) (const unsigned addr, const char *name, const bool static_entry);
2047
2057WS_DLL_PUBLIC
2058 void wtap_set_cb_new_ipv4(wtap *wth, wtap_new_ipv4_callback_t add_new_ipv4);
2059
2070 typedef void (*wtap_new_ipv6_callback_t) (const ws_in6_addr *addrp, const char *name, const bool static_entry);
2071
2081WS_DLL_PUBLIC
2082 void wtap_set_cb_new_ipv6(wtap *wth, wtap_new_ipv6_callback_t add_new_ipv6);
2083
2094 typedef void (*wtap_new_secrets_callback_t)(uint32_t secrets_type, const void *secrets, unsigned size);
2095
2105WS_DLL_PUBLIC
2106 void wtap_set_cb_new_secrets(wtap *wth, wtap_new_secrets_callback_t add_new_secrets);
2107
2123WS_DLL_PUBLIC
2124 bool wtap_read(wtap *wth, wtap_rec *rec, int *err, char **err_info,
2125 int64_t *offset);
2126
2143WS_DLL_PUBLIC
2144 bool wtap_seek_read(wtap *wth, int64_t seek_off, wtap_rec *rec,
2145 int *err, char **err_info);
2146
2155WS_DLL_PUBLIC
2156 void wtap_rec_init(wtap_rec *rec, size_t space);
2157
2166WS_DLL_PUBLIC
2167 void wtap_rec_apply_snapshot(wtap_rec *rec, uint32_t snaplen);
2168
2176WS_DLL_PUBLIC
2177 void wtap_rec_reset(wtap_rec *rec);
2178
2186WS_DLL_PUBLIC
2187 void wtap_rec_cleanup(wtap_rec *rec);
2188
2198WS_DLL_PUBLIC
2199 char *wtap_unwritable_rec_type_err_string(const wtap_rec *rec);
2200
2209WS_DLL_PUBLIC
2210 void wtap_setup_packet_rec(wtap_rec *rec, int encap);
2211
2221WS_DLL_PUBLIC
2222 void wtap_setup_ft_specific_event_rec(wtap_rec *rec, int file_type_subtype,
2223 unsigned record_type);
2224
2234WS_DLL_PUBLIC
2235 void wtap_setup_ft_specific_report_rec(wtap_rec *rec, int file_type_subtype,
2236 unsigned record_type);
2237
2245WS_DLL_PUBLIC
2246 void wtap_setup_syscall_rec(wtap_rec *rec);
2247
2255WS_DLL_PUBLIC
2256 void wtap_setup_systemd_journal_export_rec(wtap_rec *rec);
2257
2269WS_DLL_PUBLIC
2270 void wtap_setup_custom_block_rec(wtap_rec *rec, uint32_t pen,
2271 uint32_t payload_length, bool copy_allowed);
2272
2281WS_DLL_PUBLIC
2282ws_compression_type wtap_get_compression_type(wtap *wth);
2283
2284/*** get various information snippets about the current file ***/
2285
2295WS_DLL_PUBLIC
2296int64_t wtap_read_so_far(wtap *wth);
2297
2307WS_DLL_PUBLIC
2308int64_t wtap_file_size(wtap *wth, int *err);
2309
2318WS_DLL_PUBLIC
2319 unsigned wtap_snapshot_length(wtap *wth);
2320
2329WS_DLL_PUBLIC
2330 int wtap_file_type_subtype(wtap *wth);
2331
2340WS_DLL_PUBLIC
2341 int wtap_file_encap(wtap *wth);
2342
2351WS_DLL_PUBLIC
2352 int wtap_file_tsprec(wtap *wth);
2353
2362WS_DLL_PUBLIC
2363 const nstime_t* wtap_file_start_ts(wtap *wth);
2364
2373WS_DLL_PUBLIC
2374 const nstime_t* wtap_file_end_ts(wtap *wth);
2375
2383WS_DLL_PUBLIC
2384 unsigned wtap_file_get_num_shbs(wtap *wth);
2385
2398WS_DLL_PUBLIC
2399 wtap_block_t wtap_file_get_shb(wtap *wth, unsigned shb_num);
2400
2411WS_DLL_PUBLIC
2412 void wtap_write_shb_comment(wtap *wth, char *comment);
2413
2425WS_DLL_PUBLIC
2426 unsigned wtap_file_get_shb_global_interface_id(wtap *wth, unsigned shb_num, uint32_t interface_id);
2427
2438WS_DLL_PUBLIC
2439 wtapng_iface_descriptions_t *wtap_file_get_idb_info(wtap *wth);
2440
2441
2442WS_DLL_PUBLIC
2443 wtapng_dpib_lookup_info_t * wtap_file_get_dpib_lookup_info(wtap *wth);
2444
2454WS_DLL_PUBLIC
2455 wtap_block_t wtap_get_next_interface_description(wtap *wth);
2456
2469WS_DLL_PUBLIC
2470 void wtap_free_idb_info(wtapng_iface_descriptions_t *idb_info);
2471
2483WS_DLL_PUBLIC
2484 char *wtap_get_debug_if_descr(const wtap_block_t if_descr,
2485 const int indent,
2486 const char* line_end);
2487
2500WS_DLL_PUBLIC
2501 wtap_block_t wtap_file_get_nrb(wtap *wth);
2502
2510WS_DLL_PUBLIC
2511 unsigned wtap_file_get_num_dsbs(wtap *wth);
2512
2523WS_DLL_PUBLIC
2524 wtap_block_t wtap_file_get_dsb(wtap *wth, unsigned dsb_num);
2525
2534WS_DLL_PUBLIC
2535 void wtap_file_add_decryption_secrets(wtap *wth, const wtap_block_t dsb);
2536
2545WS_DLL_PUBLIC
2546 bool wtap_file_discard_decryption_secrets(wtap *wth);
2547
2555WS_DLL_PUBLIC
2556 void wtap_fdclose(wtap *wth);
2557
2568WS_DLL_PUBLIC
2569 bool wtap_fdreopen(wtap *wth, const char *filename, int *err);
2570
2578WS_DLL_PUBLIC
2579 void wtap_sequential_close(wtap *wth);
2580
2588WS_DLL_PUBLIC
2589 void wtap_close(wtap *wth);
2590
2599WS_DLL_PUBLIC
2600 bool wtap_dump_can_open(int filetype);
2601
2612WS_DLL_PUBLIC
2613 int wtap_dump_required_file_encap_type(const GArray *file_encaps);
2614
2625WS_DLL_PUBLIC
2626 bool wtap_dump_can_write_encap(int file_type_subtype, int encap);
2627
2636WS_DLL_PUBLIC
2637 bool wtap_dump_can_compress(int file_type_subtype);
2638
2649WS_DLL_PUBLIC
2650 void wtap_dump_params_init(wtap_dump_params *params, wtap *wth);
2651
2668WS_DLL_PUBLIC
2669 void wtap_dump_params_init_no_idbs(wtap_dump_params *params, wtap *wth);
2670
2678WS_DLL_PUBLIC
2679 void wtap_dump_params_discard_name_resolution(wtap_dump_params *params);
2680
2688WS_DLL_PUBLIC
2689 void wtap_dump_params_discard_decryption_secrets(wtap_dump_params *params);
2690
2697WS_DLL_PUBLIC
2698 void wtap_dump_params_cleanup(wtap_dump_params *params);
2699
2712WS_DLL_PUBLIC
2713 wtap_dumper* wtap_dump_open(const char *filename, int file_type_subtype,
2714 ws_compression_type compression_type, const wtap_dump_params *params,
2715 int *err, char **err_info);
2716
2732WS_DLL_PUBLIC
2733 wtap_dumper* wtap_dump_open_tempfile(const char *tmpdir, char **filenamep,
2734 const char *pfx,
2735 int file_type_subtype, ws_compression_type compression_type,
2736 const wtap_dump_params *params, int *err, char **err_info);
2737
2750WS_DLL_PUBLIC
2751 wtap_dumper* wtap_dump_fdopen(int fd, int file_type_subtype,
2752 ws_compression_type compression_type, const wtap_dump_params *params,
2753 int *err, char **err_info);
2754
2766WS_DLL_PUBLIC
2767 wtap_dumper* wtap_dump_open_stdout(int file_type_subtype,
2768 ws_compression_type compression_type, const wtap_dump_params *params,
2769 int *err, char **err_info);
2770
2782WS_DLL_PUBLIC
2783 bool wtap_dump_add_idb(wtap_dumper *wdh, wtap_block_t idb, int *err,
2784 char **err_info);
2785WS_DLL_PUBLIC
2786 bool wtap_dump(wtap_dumper *, const wtap_rec *, int *err, char **err_info);
2787WS_DLL_PUBLIC
2788 bool wtap_dump_flush(wtap_dumper *, int *);
2789WS_DLL_PUBLIC
2790 int wtap_dump_file_type_subtype(const wtap_dumper *wdh);
2791WS_DLL_PUBLIC
2792int64_t wtap_get_bytes_dumped(const wtap_dumper *);
2793WS_DLL_PUBLIC
2794 void wtap_set_bytes_dumped(wtap_dumper *wdh, int64_t bytes_dumped);
2795 struct addrinfo;
2796WS_DLL_PUBLIC
2797 bool wtap_addrinfo_list_empty(const addrinfo_lists_t *addrinfo_lists);
2798WS_DLL_PUBLIC
2799 bool wtap_dump_set_addrinfo_list(wtap_dumper *wdh, addrinfo_lists_t *addrinfo_lists);
2800WS_DLL_PUBLIC
2801 void wtap_dump_discard_name_resolution(wtap_dumper *wdh);
2802WS_DLL_PUBLIC
2803 void wtap_dump_discard_decryption_secrets(wtap_dumper *wdh);
2804
2821WS_DLL_PUBLIC
2822 bool wtap_dump_close(wtap_dumper *wdh, bool *needs_reload,
2823 int *err, char **err_info);
2824
2841WS_DLL_PUBLIC
2842 bool wtap_dump_can_write(const GArray *file_encaps, uint32_t required_comment_types);
2843
2857WS_DLL_PUBLIC
2858 void wtap_buffer_append_epdu_tag(Buffer *buf, uint16_t epdu_tag, const uint8_t *data, uint16_t data_len);
2859
2868WS_DLL_PUBLIC
2869 void wtap_buffer_append_epdu_uint(Buffer *buf, uint16_t epdu_tag, uint32_t val);
2870
2879WS_DLL_PUBLIC
2880 void wtap_buffer_append_epdu_string(Buffer *buf, uint16_t epdu_tag, const char *val);
2881
2890WS_DLL_PUBLIC
2891 int wtap_buffer_append_epdu_end(Buffer *buf);
2892
2893/*
2894 * Sort the file types by name or by description?
2895 */
2896 typedef enum {
2897 FT_SORT_BY_NAME,
2898 FT_SORT_BY_DESCRIPTION
2899} ft_sort_order;
2900
2917WS_DLL_PUBLIC
2918GArray *wtap_get_savable_file_types_subtypes_for_file(int file_type_subtype,
2919 const GArray *file_encaps, uint32_t required_comment_types,
2920 ft_sort_order sort_order);
2921
2933WS_DLL_PUBLIC
2934GArray *wtap_get_writable_file_types_subtypes(ft_sort_order sort_order);
2935
2936/*** various file type/subtype functions ***/
2946WS_DLL_PUBLIC
2947 const char *wtap_file_type_subtype_description(int file_type_subtype);
2948
2957WS_DLL_PUBLIC
2958 const char *wtap_file_type_subtype_name(int file_type_subtype);
2959
2969WS_DLL_PUBLIC
2970 int wtap_name_to_file_type_subtype(const char *name);
2971
2977WS_DLL_PUBLIC
2978 int wtap_pcap_file_type_subtype(void);
2979
2985WS_DLL_PUBLIC
2986 int wtap_pcap_nsec_file_type_subtype(void);
2987
2993WS_DLL_PUBLIC
2994 int wtap_pcapng_file_type_subtype(void);
2995
3006WS_DLL_PUBLIC
3007block_support_t wtap_file_type_subtype_supports_block(int file_type_subtype,
3008 wtap_block_type_t type);
3009
3024WS_DLL_PUBLIC
3025 option_support_t wtap_file_type_subtype_supports_option(int file_type_subtype,
3026 wtap_block_type_t type, unsigned opttype);
3027
3051WS_DLL_PUBLIC
3052GSList *wtap_get_all_capture_file_extensions_list(void);
3053
3069WS_DLL_PUBLIC
3070GSList *wtap_get_all_file_extensions_list(void);
3071
3086WS_DLL_PUBLIC
3087 void wtap_free_extensions_list(GSList *extensions);
3088
3100WS_DLL_PUBLIC
3101 const char *wtap_default_file_extension(int file_type_subtype);
3102
3118WS_DLL_PUBLIC
3119GSList *wtap_get_file_extensions_list(int file_type_subtype, bool include_compressed);
3120
3129WS_DLL_PUBLIC
3130 const char *wtap_encap_name(int encap);
3131
3140WS_DLL_PUBLIC
3141 const char *wtap_encap_description(int encap);
3142
3152WS_DLL_PUBLIC
3153 int wtap_name_to_encap(const char *short_name);
3154
3163WS_DLL_PUBLIC
3164 const char* wtap_tsprec_string(int tsprec);
3165
3174WS_DLL_PUBLIC
3175 const char *wtap_strerror(int err);
3176
3177
3178/*** get available number of file types and encapsulations ***/
3187WS_DLL_PUBLIC
3188 int wtap_get_num_file_type_extensions(void);
3189
3197WS_DLL_PUBLIC
3198 int wtap_get_num_encap_types(void);
3199
3200/*** get information for file type extension ***/
3201
3213WS_DLL_PUBLIC
3214 const char *wtap_get_file_extension_type_name(int extension_type);
3215
3227WS_DLL_PUBLIC
3228GSList *wtap_get_file_extension_type_extensions(unsigned extension_type);
3229
3230/*** dynamically register new file types and encapsulations ***/
3231
3243WS_DLL_PUBLIC
3244 void wtap_register_file_type_extension(const struct file_extension_info *ei);
3245
3256 typedef struct {
3257 void (*register_wtap_module)(void);
3258} wtap_plugin;
3259
3271WS_DLL_PUBLIC
3272 void wtap_register_plugin(const wtap_plugin *plug);
3273
3274
3288WS_DLL_PUBLIC
3289 int wtap_plugins_supported(void);
3290
3291/* Registration and open-info */
3292
3298WS_DLL_PUBLIC
3299 void wtap_register_open_info(struct open_info *oi, const bool first_routine);
3300
3306WS_DLL_PUBLIC
3307 bool wtap_has_open_info(const char *name);
3308
3314WS_DLL_PUBLIC
3315 bool wtap_uses_lua_filehandler(const wtap* wth);
3316
3321WS_DLL_PUBLIC
3322 void wtap_deregister_open_info(const char *name);
3323
3324/* Type mapping and registration */
3325
3331WS_DLL_PUBLIC
3332 unsigned int open_info_name_to_type(const char *name);
3333
3339WS_DLL_PUBLIC
3340 int wtap_register_file_type_subtype(const struct file_type_subtype_info* fi);
3341
3346WS_DLL_PUBLIC
3347 void wtap_deregister_file_type_subtype(const int file_type_subtype);
3348
3349/* Encapsulation and cleanup */
3356WS_DLL_PUBLIC
3357 int wtap_register_encap_type(const char *description, const char *name);
3358
3362WS_DLL_PUBLIC
3363 void wtap_cleanup(void);
3364
3368#define WTAP_ERR_NOT_REGULAR_FILE -1
3371#define WTAP_ERR_RANDOM_OPEN_PIPE -2
3374#define WTAP_ERR_FILE_UNKNOWN_FORMAT -3
3377#define WTAP_ERR_UNSUPPORTED -4
3381#define WTAP_ERR_CANT_WRITE_TO_PIPE -5
3384#define WTAP_ERR_CANT_OPEN -6
3387#define WTAP_ERR_UNWRITABLE_FILE_TYPE -7
3390#define WTAP_ERR_UNWRITABLE_ENCAP -8
3394#define WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED -9
3397#define WTAP_ERR_CANT_WRITE -10
3400#define WTAP_ERR_CANT_CLOSE -11
3403#define WTAP_ERR_SHORT_READ -12
3406#define WTAP_ERR_BAD_FILE -13
3409#define WTAP_ERR_SHORT_WRITE -14
3412#define WTAP_ERR_UNC_OVERFLOW -15
3415#define WTAP_ERR_RANDOM_OPEN_STDIN -16
3418#define WTAP_ERR_COMPRESSION_NOT_SUPPORTED -17
3421#define WTAP_ERR_CANT_SEEK -18
3424#define WTAP_ERR_CANT_SEEK_COMPRESSED -19
3427#define WTAP_ERR_DECOMPRESS -20
3430#define WTAP_ERR_INTERNAL -21
3433#define WTAP_ERR_PACKET_TOO_LARGE -22
3437#define WTAP_ERR_CHECK_WSLUA -23
3441#define WTAP_ERR_UNWRITABLE_REC_TYPE -24
3444#define WTAP_ERR_UNWRITABLE_REC_DATA -25
3447#define WTAP_ERR_DECOMPRESSION_NOT_SUPPORTED -26
3450#define WTAP_ERR_TIME_STAMP_NOT_SUPPORTED -27
3454#define WTAP_ERR_REC_MALFORMED -28
3458#ifdef __cplusplus
3459}
3460#endif /* __cplusplus */
3461
3462#endif /* __WTAP_H__ */
3463
3464/*
3465 * Editor modelines - https://www.wireshark.org/tools/modelines.html
3466 *
3467 * Local variables:
3468 * c-basic-offset: 4
3469 * tab-width: 8
3470 * indent-tabs-mode: nil
3471 * End:
3472 *
3473 * vi: set shiftwidth=4 tabstop=8 expandtab:
3474 * :indentSize=4:tabSize=8:noTabs=true:
3475 */
array.h
buffer.h
inet_addr.h
nstime.h
_eth_hdr
Definition packet-eth.h:15
Buffer
A dynamic byte buffer with adjustable start and end positions.
Definition buffer.h:30
addrinfo_lists
Definition wtap.h:1608
addrinfo_lists::ipv6_addr_list
GList * ipv6_addr_list
Definition wtap.h:1610
addrinfo_lists::ipv4_addr_list
GList * ipv4_addr_list
Definition wtap.h:1609
ascend_phdr
Definition wtap.h:517
atm_phdr
Definition wtap.h:490
ber_phdr
Definition wtap.h:1272
bthci_phdr
Definition wtap.h:1143
btmon_phdr
Definition wtap.h:1155
catapult_dct2000_phdr
Pseudo-header for Catapult DCT2000 captures.
Definition wtap.h:1015
catapult_dct2000_phdr::seek_off
int64_t seek_off
Definition wtap.h:1022
catapult_dct2000_phdr::wth
struct wtap * wth
Definition wtap.h:1023
catapult_dct2000_phdr::isdn
struct isdn_phdr isdn
Definition wtap.h:1017
catapult_dct2000_phdr::p2p
struct p2p_phdr p2p
Definition wtap.h:1019
catapult_dct2000_phdr::atm
struct atm_phdr atm
Definition wtap.h:1018
cosine_phdr
Definition wtap.h:895
dte_dce_phdr
Definition wtap.h:400
e_in6_addr
Represents a 128-bit IPv6 address.
Definition inet_addr.h:27
erf_ehdr
Definition wtap.h:1038
erf_mc_phdr
Extended pseudo-header for ERF multi-channel (MC) packet records.
Definition wtap.h:1062
erf_mc_phdr::ehdr_list
struct erf_ehdr ehdr_list[MAX_ERF_EHDR]
Definition wtap.h:1065
erf_mc_phdr::phdr
struct erf_phdr phdr
Definition wtap.h:1063
erf_mc_phdr::aal2_hdr
uint32_t aal2_hdr
Definition wtap.h:1075
erf_mc_phdr::subhdr
union erf_mc_phdr::@645 subhdr
Protocol-specific subheader union.
erf_mc_phdr::mc_hdr
uint32_t mc_hdr
Definition wtap.h:1074
erf_phdr
Definition wtap.h:1029
eth_phdr
Definition wtap.h:393
file_extension_info
For registering extensions used for file formats.
Definition wtap.h:1718
file_extension_info::extensions
const char * extensions
Definition wtap.h:1721
file_extension_info::name
const char * name
Definition wtap.h:1719
file_extension_info::is_capture_file
bool is_capture_file
Definition wtap.h:1720
file_type_subtype_info
Definition wtap.h:1927
file_type_subtype_info::wslua_info
wtap_wslua_file_info_t * wslua_info
Definition wtap.h:1988
file_type_subtype_info::name
const char * name
Definition wtap.h:1937
file_type_subtype_info::additional_file_extensions
const char * additional_file_extensions
Definition wtap.h:1951
file_type_subtype_info::can_write_encap
int(* can_write_encap)(int)
Definition wtap.h:1976
file_type_subtype_info::supported_blocks
const struct supported_block_type * supported_blocks
Definition wtap.h:1966
file_type_subtype_info::writing_must_seek
bool writing_must_seek
Definition wtap.h:1956
file_type_subtype_info::description
const char * description
Definition wtap.h:1931
file_type_subtype_info::dump_open
bool(* dump_open)(wtap_dumper *, int *, char **)
Definition wtap.h:1982
file_type_subtype_info::num_supported_blocks
size_t num_supported_blocks
Definition wtap.h:1961
file_type_subtype_info::default_file_extension
const char * default_file_extension
Definition wtap.h:1943
gsm_um_phdr
Definition wtap.h:1173
hashipv4
Definition wtap.h:1590
hashipv6
Definition wtap.h:1598
i2c_phdr
Definition wtap.h:1166
idb
Definition pcapio.c:117
ieee_802_11_fhss
Definition wtap.h:580
ieee_802_11_phdr
Definition wtap.h:828
ieee_802_11a
Definition wtap.h:603
ieee_802_11ac
Definition wtap.h:707
ieee_802_11ad
Definition wtap.h:748
ieee_802_11ax
Definition wtap.h:758
ieee_802_11b
Definition wtap.h:593
ieee_802_11be_user_info
Definition wtap.h:773
ieee_802_11be
Definition wtap.h:792
ieee_802_11g
Definition wtap.h:639
ieee_802_11n
Definition wtap.h:655
input
Definition tvbuff_lz77huff.c:32
irda_phdr
Definition wtap.h:927
isdn_phdr
Definition wtap.h:407
k12_phdr
Definition wtap.h:981
l1event_phdr
Definition wtap.h:1161
lapd_phdr
LAPD pseudo-header for packet metadata.
Definition wtap.h:1003
lapd_phdr::we_network
uint8_t we_network
Definition wtap.h:1005
lapd_phdr::pkttype
uint16_t pkttype
Definition wtap.h:1004
llcp_phdr
Definition wtap.h:1224
logcat_phdr
Definition wtap.h:1230
mmodule_phdr
Definition wtap.h:1277
mtp2_phdr
Definition wtap.h:947
netmon_phdr
Pseudo-header metadata for packets captured in NetMon (Network Monitor) files.
Definition wtap.h:1241
netmon_phdr::sub_encap
unsigned sub_encap
Definition wtap.h:1246
netmon_phdr::description
uint8_t * description
Definition wtap.h:1244
netmon_phdr::title
uint8_t * title
Definition wtap.h:1242
netmon_phdr::descLength
uint32_t descLength
Definition wtap.h:1243
nettl_phdr
Definition wtap.h:933
nokia_phdr
Definition wtap.h:1218
nstime_t
Definition nstime.h:26
nstr_phdr
Definition wtap.h:1195
open_info
Information about a given file type that applies to all subtypes of the file type.
Definition wtap.h:1820
open_info::name
const char * name
Definition wtap.h:1821
open_info::open_routine
wtap_open_routine_t open_routine
Definition wtap.h:1823
open_info::wslua_data
void * wslua_data
Definition wtap.h:1826
open_info::extensions
const char * extensions
Definition wtap.h:1824
open_info::type
wtap_open_type type
Definition wtap.h:1822
open_info::extensions_set
char ** extensions_set
Definition wtap.h:1825
p2p_phdr
Definition wtap.h:527
procmon_phdr
Definition wtap.h:1263
procmon_process_t
Definition procmon.h:24
rec_header
Definition ngsniffer.c:82
sita_phdr
Definition wtap.h:1134
supported_block_type
Definition wtap.h:1917
supported_option_type
Entry describing support level for a specific option type.
Definition wtap.h:1883
supported_option_type::opt
unsigned opt
Definition wtap.h:1884
supported_option_type::support
option_support_t support
Definition wtap.h:1885
wtap_block
Definition wtap_opttypes.h:272
wtap_custom_block_header
Definition wtap.h:1482
wtap_dump_params
Definition wtap.h:1629
wtap_dump_params::nrbs_growing
const GArray * nrbs_growing
Definition wtap.h:1638
wtap_dump_params::dsbs_growing
const GArray * dsbs_growing
Definition wtap.h:1642
wtap_dump_params::tsprec
int tsprec
Definition wtap.h:1632
wtap_dump_params::shb_hdrs
GArray * shb_hdrs
Definition wtap.h:1633
wtap_dump_params::encap
int encap
Definition wtap.h:1630
wtap_dump_params::dont_copy_idbs
bool dont_copy_idbs
Definition wtap.h:1651
wtap_dump_params::dsbs_initial
GArray * dsbs_initial
Definition wtap.h:1641
wtap_dump_params::idb_inf
wtapng_iface_descriptions_t * idb_inf
Definition wtap.h:1637
wtap_dump_params::mevs_growing
const GArray * mevs_growing
Definition wtap.h:1645
wtap_dump_params::shb_iface_to_global
const GArray * shb_iface_to_global
Definition wtap.h:1634
wtap_dump_params::dpibs_growing
const GArray * dpibs_growing
Definition wtap.h:1648
wtap_dump_params::snaplen
int snaplen
Definition wtap.h:1631
wtap_dumper
Wiretap dumper handle and associated state.
Definition wtap_module.h:163
wtap_erf_eth_hdr
Definition wtap.h:1049
wtap_ft_specific_header
Definition wtap.h:1454
wtap_packet_header
Definition wtap.h:1372
wtap_plugin
Plugin registration callback table.
Definition wtap.h:3256
wtap_reader
Definition file_wrappers.c:97
wtap_rec
Definition wtap.h:1512
wtap_syscall_header
Definition wtap.h:1462
wtap_systemd_journal_export_header
Definition wtap.h:1478
wtap_wslua_file_info
Definition wtap.h:1675
wtap
Definition wtap_module.h:58
wtap::add_new_secrets
wtap_new_secrets_callback_t add_new_secrets
Definition wtap_module.h:113
wtap::app_env_var_prefix
const char * app_env_var_prefix
Definition wtap_module.h:74
wtap::file_type_subtype
int file_type_subtype
Definition wtap_module.h:62
wtap::add_new_ipv4
wtap_new_ipv4_callback_t add_new_ipv4
Definition wtap_module.h:111
wtap::add_new_ipv6
wtap_new_ipv6_callback_t add_new_ipv6
Definition wtap_module.h:112
wtapng_dpib_lookup_info_s
Definition wtap_opttypes.h:308
wtapng_iface_descriptions_s
Definition wtap_opttypes.h:300
ieee_802_11_phy_info
Union representing physical layer information for IEEE 802.11 variants.
Definition wtap.h:816
ieee_802_11_phy_info::info_11_fhss
struct ieee_802_11_fhss info_11_fhss
Definition wtap.h:817
ieee_802_11_phy_info::info_11ac
struct ieee_802_11ac info_11ac
Definition wtap.h:822
ieee_802_11_phy_info::info_11n
struct ieee_802_11n info_11n
Definition wtap.h:821
ieee_802_11_phy_info::info_11g
struct ieee_802_11g info_11g
Definition wtap.h:820
ieee_802_11_phy_info::info_11ax
struct ieee_802_11ax info_11ax
Definition wtap.h:824
ieee_802_11_phy_info::info_11b
struct ieee_802_11b info_11b
Definition wtap.h:818
ieee_802_11_phy_info::info_11be
struct ieee_802_11be info_11be
Definition wtap.h:825
ieee_802_11_phy_info::info_11ad
struct ieee_802_11ad info_11ad
Definition wtap.h:823
ieee_802_11_phy_info::info_11a
struct ieee_802_11a info_11a
Definition wtap.h:819
k12_input_info_t
Pseudo-header metadata for packets in K12 capture files.
Definition wtap.h:960
k12_input_info_t::vp
uint16_t vp
Definition wtap.h:967
k12_input_info_t::cid
uint16_t cid
Definition wtap.h:969
k12_input_info_t::vc
uint16_t vc
Definition wtap.h:968
k12_input_info_t::ds0mask
uint32_t ds0mask
DS0 channel bitmask.
Definition wtap.h:978
netmon_phdr::sub_wtap_pseudo_header
Protocol-specific subheader union.
Definition wtap.h:1253
netmon_phdr::sub_wtap_pseudo_header::eth
struct eth_phdr eth
Definition wtap.h:1254
netmon_phdr::sub_wtap_pseudo_header::atm
struct atm_phdr atm
Definition wtap.h:1255
netmon_phdr::sub_wtap_pseudo_header::ieee_802_11
struct ieee_802_11_phdr ieee_802_11
Definition wtap.h:1256
wtap_pseudo_header
Definition wtap.h:1281
wtap_dump_can_open
WS_DLL_PUBLIC bool wtap_dump_can_open(int filetype)
Check if a file type can be opened for dumping.
Definition file_access.c:2068
wtap_buffer_append_epdu_tag
WS_DLL_PUBLIC void wtap_buffer_append_epdu_tag(Buffer *buf, uint16_t epdu_tag, const uint8_t *data, uint16_t data_len)
Generates arbitrary packet data in "exported PDU" format and appends it to buf.
Definition wtap.c:2196
wtap_get_all_file_extensions_list
WS_DLL_PUBLIC GSList * wtap_get_all_file_extensions_list(void)
Return a list of all extensions that are used by all file types that we can read, including compresse...
Definition file_access.c:2012
wtap_dump_open
WS_DLL_PUBLIC wtap_dumper * wtap_dump_open(const char *filename, int file_type_subtype, ws_compression_type compression_type, const wtap_dump_params *params, int *err, char **err_info)
Opens a new capture file for writing.
Definition file_access.c:2239
wtap_new_secrets_callback_t
void(* wtap_new_secrets_callback_t)(uint32_t secrets_type, const void *secrets, unsigned size)
Callback type for receiving new decryption secrets.
Definition wtap.h:2094
wtap_register_file_type_subtype
WS_DLL_PUBLIC int wtap_register_file_type_subtype(const struct file_type_subtype_info *fi)
Register a file type/subtype.
Definition file_access.c:1172
wtap_file_size
WS_DLL_PUBLIC int64_t wtap_file_size(wtap *wth, int *err)
Get the size of the capture file.
Definition wtap.c:81
wtap_get_all_capture_file_extensions_list
WS_DLL_PUBLIC GSList * wtap_get_all_capture_file_extensions_list(void)
Return a list of all extensions that are used by all capture file types, including compressed extensi...
Definition file_access.c:1963
wtap_dump_open_tempfile
WS_DLL_PUBLIC wtap_dumper * wtap_dump_open_tempfile(const char *tmpdir, char **filenamep, const char *pfx, int file_type_subtype, ws_compression_type compression_type, const wtap_dump_params *params, int *err, char **err_info)
Creates a dumper for a temporary file.
Definition file_access.c:2278
option_support_t
option_support_t
Indicates how a file format supports a given option type.
Definition wtap.h:1871
MULTIPLE_OPTIONS_SUPPORTED
@ MULTIPLE_OPTIONS_SUPPORTED
Definition wtap.h:1874
OPTION_NOT_SUPPORTED
@ OPTION_NOT_SUPPORTED
Definition wtap.h:1872
ONE_OPTION_SUPPORTED
@ ONE_OPTION_SUPPORTED
Definition wtap.h:1873
wtap_get_file_extensions_list
WS_DLL_PUBLIC GSList * wtap_get_file_extensions_list(int file_type_subtype, bool include_compressed)
Return a list of file extensions that are used by the specified file type and subtype.
Definition file_access.c:1906
wtap_get_savable_file_types_subtypes_for_file
WS_DLL_PUBLIC GArray * wtap_get_savable_file_types_subtypes_for_file(int file_type_subtype, const GArray *file_encaps, uint32_t required_comment_types, ft_sort_order sort_order)
Get savable file type/subtype candidates for saving a capture file.
Definition file_access.c:1455
wtap_unwritable_rec_type_err_string
WS_DLL_PUBLIC char * wtap_unwritable_rec_type_err_string(const wtap_rec *rec)
Return an error string for WTAP_ERR_UNWRITABLE_REC_TYPE.
Definition wtap.c:1779
wtap_plugins_supported
WS_DLL_PUBLIC int wtap_plugins_supported(void)
Query whether libwiretap plugin loading is available.
Definition wtap.c:57
wtap_encap_description
WS_DLL_PUBLIC const char * wtap_encap_description(int encap)
Get a human-readable description for an encapsulation type.
Definition wtap.c:1404
wtap_file_get_shb
WS_DLL_PUBLIC wtap_block_t wtap_file_get_shb(wtap *wth, unsigned shb_num)
Gets existing section header block, not for new file.
Definition wtap.c:146
wtap_file_type_subtype_description
WS_DLL_PUBLIC const char * wtap_file_type_subtype_description(int file_type_subtype)
Get a human-readable description for a file type/subtype.
Definition file_access.c:1631
wtap_dump_params_cleanup
WS_DLL_PUBLIC void wtap_dump_params_cleanup(wtap_dump_params *params)
Free memory associated with the wtap_dump_params when it is no longer in use by wtap_dumper.
Definition wtap.c:644
wtap_new_ipv6_callback_t
void(* wtap_new_ipv6_callback_t)(const ws_in6_addr *addrp, const char *name, const bool static_entry)
Callback type for registering new IPv6 hostnames.
Definition wtap.h:2070
wtap_file_get_idb_info
WS_DLL_PUBLIC wtapng_iface_descriptions_t * wtap_file_get_idb_info(wtap *wth)
Gets existing interface descriptions.
Definition wtap.c:198
wtap_setup_packet_rec
WS_DLL_PUBLIC void wtap_setup_packet_rec(wtap_rec *rec, int encap)
Set up a wtap_rec for a packet (REC_TYPE_PACKET).
Definition wtap.c:1789
wtap_get_file_extension_type_extensions
WS_DLL_PUBLIC GSList * wtap_get_file_extension_type_extensions(unsigned extension_type)
Get the list of extensions for a file extension type.
Definition file_access.c:207
wtap_deregister_open_info
WS_DLL_PUBLIC void wtap_deregister_open_info(const char *name)
Deregister an open_info handler by name.
Definition file_access.c:498
wtap_dump_close
WS_DLL_PUBLIC bool wtap_dump_close(wtap_dumper *wdh, bool *needs_reload, int *err, char **err_info)
Definition file_access.c:2577
wtap_get_next_interface_description
WS_DLL_PUBLIC wtap_block_t wtap_get_next_interface_description(wtap *wth)
Gets next interface description.
Definition wtap.c:221
wtap_read
WS_DLL_PUBLIC bool wtap_read(wtap *wth, wtap_rec *rec, int *err, char **err_info, int64_t *offset)
Read the next record in the file, filling in *phdr and *buf.
Definition wtap.c:1850
wtap_buffer_append_epdu_string
WS_DLL_PUBLIC void wtap_buffer_append_epdu_string(Buffer *buf, uint16_t epdu_tag, const char *val)
Generates packet data for a string in "exported PDU" format. For filetype readers to transform non-pa...
Definition wtap.c:2243
wtap_free_idb_info
WS_DLL_PUBLIC void wtap_free_idb_info(wtapng_iface_descriptions_t *idb_info)
Free's a interface description block and all of its members.
Definition wtap.c:396
wtap_open_offline
WS_DLL_PUBLIC struct wtap * wtap_open_offline(const char *filename, unsigned int type, int *err, char **err_info, bool do_random, const char *app_env_var_prefix)
Open a capture file for offline analysis.
Definition file_access.c:846
wtap_file_type_subtype
WS_DLL_PUBLIC int wtap_file_type_subtype(wtap *wth)
Get the file type subtype.
Definition wtap.c:104
wtap_register_file_type_extension
WS_DLL_PUBLIC void wtap_register_file_type_extension(const struct file_extension_info *ei)
Register file extension information for a file type.
Definition file_access.c:151
open_routines
WS_DLL_PUBLIC struct open_info * open_routines
Table of registered wiretap file open handlers.
Definition wtap.h:1835
wtap_get_file_extension_type_name
WS_DLL_PUBLIC const char * wtap_get_file_extension_type_name(int extension_type)
Get the short name for a file extension type.
Definition file_access.c:165
wtap_dump_add_idb
WS_DLL_PUBLIC bool wtap_dump_add_idb(wtap_dumper *wdh, wtap_block_t idb, int *err, char **err_info)
Add an IDB to the list of IDBs for a file we're writing. Makes a copy of the IDB, so it can be freed ...
Definition file_access.c:2510
wtap_open_type
wtap_open_type
Strategy used to identify a file format.
Definition wtap.h:1779
OPEN_INFO_MAGIC
@ OPEN_INFO_MAGIC
Definition wtap.h:1780
OPEN_INFO_HEURISTIC
@ OPEN_INFO_HEURISTIC
Definition wtap.h:1781
wtap_dump_params_discard_decryption_secrets
WS_DLL_PUBLIC void wtap_dump_params_discard_decryption_secrets(wtap_dump_params *params)
Remove any decryption secret information from the per-file information; used if we're stripping decry...
Definition wtap.c:631
wtap_fdclose
WS_DLL_PUBLIC void wtap_fdclose(wtap *wth)
Close all file descriptors for the current wiretap file.
Definition wtap.c:1597
wtap_open_return_val
wtap_open_return_val
For registering file types that we can open.
Definition wtap.h:1750
WTAP_OPEN_MINE
@ WTAP_OPEN_MINE
Definition wtap.h:1752
WTAP_OPEN_NOT_MINE
@ WTAP_OPEN_NOT_MINE
Definition wtap.h:1751
WTAP_OPEN_ERROR
@ WTAP_OPEN_ERROR
Definition wtap.h:1753
wtap_rec_reset
WS_DLL_PUBLIC void wtap_rec_reset(wtap_rec *rec)
Re-initialize a wtap_rec structure.
Definition wtap.c:2034
wtap_has_open_info
WS_DLL_PUBLIC bool wtap_has_open_info(const char *name)
Check if an open_info handler with the given name is registered.
Definition file_access.c:522
wtap_dump_required_file_encap_type
WS_DLL_PUBLIC int wtap_dump_required_file_encap_type(const GArray *file_encaps)
Determine the required per-file encapsulation type.
Definition file_access.c:1289
wtap_file_encap
WS_DLL_PUBLIC int wtap_file_encap(wtap *wth)
Get the encapsulation type for the capture file.
Definition wtap.c:116
wtap_dump_params_discard_name_resolution
WS_DLL_PUBLIC void wtap_dump_params_discard_name_resolution(wtap_dump_params *params)
Remove any name resolution information from the per-file information; used if we're stripping name re...
Definition wtap.c:625
wtap_dump_open_stdout
WS_DLL_PUBLIC wtap_dumper * wtap_dump_open_stdout(int file_type_subtype, ws_compression_type compression_type, const wtap_dump_params *params, int *err, char **err_info)
Creates a dumper for the standard output.
Definition file_access.c:2375
wtap_dump_params_init_no_idbs
WS_DLL_PUBLIC void wtap_dump_params_init_no_idbs(wtap_dump_params *params, wtap *wth)
Initialize the per-file information based on an existing file, but don't copy over the interface info...
Definition wtap.c:602
wtap_dump_fdopen
WS_DLL_PUBLIC wtap_dumper * wtap_dump_fdopen(int fd, int file_type_subtype, ws_compression_type compression_type, const wtap_dump_params *params, int *err, char **err_info)
Creates a dumper for an existing file descriptor.
Definition file_access.c:2340
wtap_buffer_append_epdu_uint
WS_DLL_PUBLIC void wtap_buffer_append_epdu_uint(Buffer *buf, uint16_t epdu_tag, uint32_t val)
Generates packet data for an unsigned integer in "exported PDU" format. For filetype readers to trans...
Definition wtap.c:2227
wtap_file_start_ts
WS_DLL_PUBLIC const nstime_t * wtap_file_start_ts(wtap *wth)
Get the start timestamp of the capture file.
Definition wtap.c:128
wtap_get_num_file_type_extensions
WS_DLL_PUBLIC int wtap_get_num_file_type_extensions(void)
Return the number of registered file type extension groups.
Definition file_access.c:159
wtap_setup_custom_block_rec
WS_DLL_PUBLIC void wtap_setup_custom_block_rec(wtap_rec *rec, uint32_t pen, uint32_t payload_length, bool copy_allowed)
Set up a wtap_rec for a custom block.
Definition wtap.c:1839
wtap_strerror
WS_DLL_PUBLIC const char * wtap_strerror(int err)
Return a human-readable error string for a WTAP error code.
Definition wtap.c:1546
wtap_file_get_shb_global_interface_id
WS_DLL_PUBLIC unsigned wtap_file_get_shb_global_interface_id(wtap *wth, unsigned shb_num, uint32_t interface_id)
Gets the unique interface id for a SHB's interface.
Definition wtap.c:155
wtap_file_get_num_shbs
WS_DLL_PUBLIC unsigned wtap_file_get_num_shbs(wtap *wth)
Gets number of section header blocks.
Definition wtap.c:140
wtap_register_plugin
WS_DLL_PUBLIC void wtap_register_plugin(const wtap_plugin *plug)
Register a wiretap plugin.
wtap_deregister_file_type_subtype
WS_DLL_PUBLIC void wtap_deregister_file_type_subtype(const int file_type_subtype)
Deregister a previously registered file type/subtype.
Definition file_access.c:1249
wtap_dump_params_init
WS_DLL_PUBLIC void wtap_dump_params_init(wtap_dump_params *params, wtap *wth)
Initialize the per-file information based on an existing file.
Definition wtap.c:575
wtap_free_extensions_list
WS_DLL_PUBLIC void wtap_free_extensions_list(GSList *extensions)
Free a list of file extension strings returned by extension helpers.
Definition file_access.c:2039
wtap_uses_lua_filehandler
WS_DLL_PUBLIC bool wtap_uses_lua_filehandler(const wtap *wth)
Check whether a wtap handle uses a Lua-based file handler.
Definition file_access.c:542
wtap_write_shb_comment
WS_DLL_PUBLIC void wtap_write_shb_comment(wtap *wth, char *comment)
Sets or replaces the section header comment.
Definition wtap.c:190
wtap_read_so_far
WS_DLL_PUBLIC int64_t wtap_read_so_far(wtap *wth)
Return an approximation of the amount of data read sequentially.
Definition wtap.c:1988
wtap_file_add_decryption_secrets
WS_DLL_PUBLIC void wtap_file_add_decryption_secrets(wtap *wth, const wtap_block_t dsb)
Adds a Decryption Secrets Block to the open wiretap session.
Definition wtap.c:262
wtap_set_cb_new_secrets
WS_DLL_PUBLIC void wtap_set_cb_new_secrets(wtap *wth, wtap_new_secrets_callback_t add_new_secrets)
Set the callback for receiving new decryption secrets.
Definition wtap.c:1718
wtap_setup_systemd_journal_export_rec
WS_DLL_PUBLIC void wtap_setup_systemd_journal_export_rec(wtap_rec *rec)
Set up a wtap_rec for a systemd journal export entry.
Definition wtap.c:1829
wtap_cleanup
WS_DLL_PUBLIC void wtap_cleanup(void)
Clean up libwiretap internal registrations and plugin state.
Definition wtap.c:2296
wtap_pcapng_file_type_subtype
WS_DLL_PUBLIC int wtap_pcapng_file_type_subtype(void)
Get the file type/subtype identifier for pcapng.
Definition file_access.c:1728
cleanup_open_routines
void cleanup_open_routines(void)
Clean up registered file open routines.
Definition file_access.c:2838
wtap_cleareof
WS_DLL_PUBLIC void wtap_cleareof(wtap *wth)
Clear EOF status for a wiretap file.
Definition wtap.c:1637
addrinfo_lists_t
struct addrinfo_lists addrinfo_lists_t
wtap_file_end_ts
WS_DLL_PUBLIC const nstime_t * wtap_file_end_ts(wtap *wth)
Get the end timestamp of the capture file.
Definition wtap.c:134
wtap_file_get_num_dsbs
WS_DLL_PUBLIC unsigned wtap_file_get_num_dsbs(wtap *wth)
Gets number of decryption secrets blocks.
Definition wtap.c:244
wtap_get_compression_type
WS_DLL_PUBLIC ws_compression_type wtap_get_compression_type(wtap *wth)
Get the compression type used for the capture file.
Definition file_wrappers.c:47
wtap_pcap_nsec_file_type_subtype
WS_DLL_PUBLIC int wtap_pcap_nsec_file_type_subtype(void)
Get the file type/subtype identifier for pcap with nanosecond timestamps.
Definition file_access.c:1714
wtap_close
WS_DLL_PUBLIC void wtap_close(wtap *wth)
Fully close the wiretap file and release all resources.
Definition wtap.c:1606
wtap_setup_syscall_rec
WS_DLL_PUBLIC void wtap_setup_syscall_rec(wtap_rec *rec)
Set up a wtap_rec for a system call.
Definition pcapng-sysdig.c:40
wtap_rec_apply_snapshot
WS_DLL_PUBLIC void wtap_rec_apply_snapshot(wtap_rec *rec, uint32_t snaplen)
Apply a snapshot length to a wtap_rec.
Definition wtap.c:2008
wtap_file_tsprec
WS_DLL_PUBLIC int wtap_file_tsprec(wtap *wth)
Get the timestamp precision for the capture file.
Definition wtap.c:122
wtap_init
WS_DLL_PUBLIC void wtap_init(bool load_wiretap_plugins, const char *app_env_var_prefix, const struct file_extension_info *file_extensions, unsigned num_extensions)
Initialize the Wiretap library.
Definition wtap.c:2277
wtap_dump_can_write_encap
WS_DLL_PUBLIC bool wtap_dump_can_write_encap(int file_type_subtype, int encap)
Check if a file type/subtype supports writing a given encapsulation.
Definition file_access.c:1302
wtap_dump_can_write
WS_DLL_PUBLIC bool wtap_dump_can_write(const GArray *file_encaps, uint32_t required_comment_types)
Determine whether a capture file can be written with the specified options.
Definition file_access.c:1404
wtap_file_type_subtype_name
WS_DLL_PUBLIC const char * wtap_file_type_subtype_name(int file_type_subtype)
Get a short name for a file type/subtype.
Definition file_access.c:1644
wtap_setup_ft_specific_report_rec
WS_DLL_PUBLIC void wtap_setup_ft_specific_report_rec(wtap_rec *rec, int file_type_subtype, unsigned record_type)
Set up a wtap_rec for a file-type specific report.
Definition wtap.c:1815
wtap_get_num_encap_types
WS_DLL_PUBLIC int wtap_get_num_encap_types(void)
Return the number of known encapsulation types.
Definition wtap.c:1370
wtap_rec_cleanup
WS_DLL_PUBLIC void wtap_rec_cleanup(wtap_rec *rec)
Clean up a wtap_rec structure.
Definition wtap.c:2043
wtap_tsprec_string
WS_DLL_PUBLIC const char * wtap_tsprec_string(int tsprec)
Convert a timestamp precision constant to a string.
Definition wtap.c:1447
open_info_name_to_type
WS_DLL_PUBLIC unsigned int open_info_name_to_type(const char *name)
Convert an open_info short name to its numeric type.
Definition file_access.c:580
wtap_file_get_dsb
WS_DLL_PUBLIC wtap_block_t wtap_file_get_dsb(wtap *wth, unsigned dsb_num)
Gets existing decryption secrets block, not for new file.
Definition wtap.c:253
wtap_dump_can_compress
WS_DLL_PUBLIC bool wtap_dump_can_compress(int file_type_subtype)
Check if a file type/subtype supports compression.
Definition file_access.c:2100
wtap_snapshot_length
WS_DLL_PUBLIC unsigned wtap_snapshot_length(wtap *wth)
Get the snapshot length for the capture file.
Definition wtap.c:110
wtap_fdreopen
WS_DLL_PUBLIC bool wtap_fdreopen(wtap *wth, const char *filename, int *err)
Reopen the random-access file descriptor for the current file.
Definition file_access.c:1031
wtap_rec_init
WS_DLL_PUBLIC void wtap_rec_init(wtap_rec *rec, size_t space)
Initialize a wtap_rec structure.
Definition wtap.c:1995
wtap_file_discard_decryption_secrets
WS_DLL_PUBLIC bool wtap_file_discard_decryption_secrets(wtap *wth)
Remove any decryption secret information from the per-file information; used if we're stripping decry...
Definition wtap.c:271
wtap_setup_ft_specific_event_rec
WS_DLL_PUBLIC void wtap_setup_ft_specific_event_rec(wtap_rec *rec, int file_type_subtype, unsigned record_type)
Set up a wtap_rec for a file-type specific event.
Definition wtap.c:1801
wtap_set_cb_new_ipv6
WS_DLL_PUBLIC void wtap_set_cb_new_ipv6(wtap *wth, wtap_new_ipv6_callback_t add_new_ipv6)
Set the callback for adding new IPv6 hostnames.
Definition wtap.c:1691
wtap_default_file_extension
WS_DLL_PUBLIC const char * wtap_default_file_extension(int file_type_subtype)
Get the default file extension for a file type/subtype.
Definition file_access.c:2055
wtap_pcap_file_type_subtype
WS_DLL_PUBLIC int wtap_pcap_file_type_subtype(void)
Get the file type/subtype identifier for classic pcap (microsecond timestamps).
Definition file_access.c:1700
wtap_register_open_info
WS_DLL_PUBLIC void wtap_register_open_info(struct open_info *oi, const bool first_routine)
Register an open_info probe/open handler.
Definition file_access.c:462
wtap_buffer_append_epdu_end
WS_DLL_PUBLIC int wtap_buffer_append_epdu_end(Buffer *buf)
Close off a set of "exported PDUs" added to the buffer. For filetype readers to transform non-packeti...
Definition wtap.c:2260
wtap_file_type_subtype_supports_block
WS_DLL_PUBLIC block_support_t wtap_file_type_subtype_supports_block(int file_type_subtype, wtap_block_type_t type)
Determine whether a capture file format supports a given block type.
Definition file_access.c:1742
wtap_get_writable_file_types_subtypes
WS_DLL_PUBLIC GArray * wtap_get_writable_file_types_subtypes(ft_sort_order sort_order)
Get a list of all writable file type/subtype values.
Definition file_access.c:1567
wtap_encap_name
WS_DLL_PUBLIC const char * wtap_encap_name(int encap)
Get a short name for an encapsulation type.
Definition wtap.c:1390
wtap_register_encap_type
WS_DLL_PUBLIC int wtap_register_encap_type(const char *description, const char *name)
Register a new packet encapsulation type.
Definition wtap.c:1376
wtap_get_debug_if_descr
WS_DLL_PUBLIC char * wtap_get_debug_if_descr(const wtap_block_t if_descr, const int indent, const char *line_end)
Gets a debug string of an interface description.
Definition wtap.c:406
wtap_file_get_nrb
WS_DLL_PUBLIC wtap_block_t wtap_file_get_nrb(wtap *wth)
Gets existing name resolution block, not for new file.
Definition wtap.c:545
wtap_set_cb_new_ipv4
WS_DLL_PUBLIC void wtap_set_cb_new_ipv4(wtap *wth, wtap_new_ipv4_callback_t add_new_ipv4)
Set the callback for adding new IPv4 hostnames.
Definition wtap.c:1671
wtap_name_to_file_type_subtype
WS_DLL_PUBLIC int wtap_name_to_file_type_subtype(const char *name)
Convert a file type/subtype name to its identifier.
Definition file_access.c:1668
wtap_sequential_close
WS_DLL_PUBLIC void wtap_sequential_close(wtap *wth)
Close the sequential-access side of the file.
Definition wtap.c:1573
wtap_new_ipv4_callback_t
void(* wtap_new_ipv4_callback_t)(const unsigned addr, const char *name, const bool static_entry)
Callback type for registering new IPv4 hostnames.
Definition wtap.h:2046
wtap_file_type_subtype_supports_option
WS_DLL_PUBLIC option_support_t wtap_file_type_subtype_supports_option(int file_type_subtype, wtap_block_type_t type, unsigned opttype)
Determine whether a capture file format supports a specific option for a block.
Definition file_access.c:1777
wtap_name_to_encap
WS_DLL_PUBLIC int wtap_name_to_encap(const char *short_name)
Convert a short encapsulation name to its WTAP_ENCAP_ value.
Definition wtap.c:1418
wtap_seek_read
WS_DLL_PUBLIC bool wtap_seek_read(wtap *wth, int64_t seek_off, wtap_rec *rec, int *err, char **err_info)
Read the record at a specified offset in a capture file, filling in *phdr and *buf.
Definition wtap.c:2065
wtap_opttypes.h