| Wireshark 4.7.3 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
wtap.h
Go to the documentation of this file.
1
8
9#ifndef __WTAP_H__
10#define __WTAP_H__
11
12#include <wireshark.h>
13#include <time.h>
14#include <wsutil/array.h>
15#include <wsutil/buffer.h>
16#include <wsutil/nstime.h>
17#include <wsutil/inet_addr.h>
18#include <wsutil/file_compressed.h>
19#include "wtap_opttypes.h"
20
21#ifdef __cplusplus
22 extern "C" {
23#endif /* __cplusplus */
24
25/* Encapsulation types. Choose names that truly reflect
26 * what is contained in the packet trace file.
27 *
28 * WTAP_ENCAP_PER_PACKET is a value passed to "wtap_dump_open()" or
29 * "wtap_dump_fdopen()" to indicate that there is no single encapsulation
30 * type for all packets in the file; this may cause those routines to
31 * fail if the capture file format being written can't support that.
32 * It's also returned by "wtap_file_encap()" for capture files that
33 * don't have a single encapsulation type for all packets in the file.
34 *
35 * WTAP_ENCAP_UNKNOWN is returned by "wtap_pcap_encap_to_wtap_encap()"
36 * if it's handed an unknown encapsulation. It is also used by file
37 * types for encapsulations which are unsupported by libwiretap.
38 *
39 * WTAP_ENCAP_NONE is an initial value used by file types like pcapng
40 * that do not have a single file level encapsulation type. If and when
41 * something that indicate encapsulation is read, the encapsulation will
42 * change (possibly to WTAP_ENCAP_PER_PACKET) and appropriate IDBs will
43 * be generated. If a file type uses this value, it MUST provide IDBs
44 * (possibly fake) when the encapsulation changes; otherwise, it should
45 * return WTAP_ENCAP_UNKNOWN so that attempts to write an output file
46 * without reading the entire input file first fail gracefully.
47 *
48 * WTAP_ENCAP_FDDI_BITSWAPPED is for FDDI captures on systems where the
49 * MAC addresses you get from the hardware are bit-swapped. Ideally,
50 * the driver would tell us that, but I know of none that do, so, for
51 * now, we base it on the machine on which we're *reading* the
52 * capture, rather than on the machine on which the capture was taken
53 * (they're probably likely to be the same). We assume that they're
54 * bit-swapped on everything except for systems running Ultrix, Alpha
55 * systems, and BSD/OS systems (that's what "tcpdump" does; I guess
56 * Digital decided to bit-swap addresses in the hardware or in the
57 * driver, and I guess BSDI bit-swapped them in the driver, given that
58 * BSD/OS generally runs on Boring Old PC's). If we create a wiretap
59 * save file format, we'd use the WTAP_ENCAP values to flag the
60 * encapsulation of a packet, so there we'd at least be able to base
61 * it on the machine on which the capture was taken.
62 *
63 * WTAP_ENCAP_LINUX_ATM_CLIP is the encapsulation you get with the
64 * ATM on Linux code from <http://linux-atm.sourceforge.net/>;
65 * that code adds a DLT_ATM_CLIP DLT_ code of 19, and that
66 * encapsulation isn't the same as the DLT_ATM_RFC1483 encapsulation
67 * presumably used on some BSD systems, which we turn into
68 * WTAP_ENCAP_ATM_RFC1483.
69 *
70 * WTAP_ENCAP_NULL corresponds to DLT_NULL from "libpcap". This
71 * corresponds to
72 *
73 * 1) PPP-over-HDLC encapsulation, at least with some versions
74 * of ISDN4BSD (but not the current ones, it appears, unless
75 * I've missed something);
76 *
77 * 2) a 4-byte header containing the AF_ address family, in
78 * the byte order of the machine that saved the capture,
79 * for the packet, as used on many BSD systems for the
80 * loopback device and some other devices, or a 4-byte header
81 * containing the AF_ address family in network byte order,
82 * as used on recent OpenBSD systems for the loopback device;
83 *
84 * 3) a 4-byte header containing 2 octets of 0 and an Ethernet
85 * type in the byte order from an Ethernet header, that being
86 * what older versions of "libpcap" on Linux turn the Ethernet
87 * header for loopback interfaces into (0.6.0 and later versions
88 * leave the Ethernet header alone and make it DLT_EN10MB). */
89#define WTAP_ENCAP_NONE -2
90#define WTAP_ENCAP_PER_PACKET -1
91#define WTAP_ENCAP_UNKNOWN 0
92#define WTAP_ENCAP_ETHERNET 1
93#define WTAP_ENCAP_TOKEN_RING 2
94#define WTAP_ENCAP_SLIP 3
95#define WTAP_ENCAP_PPP 4
96#define WTAP_ENCAP_FDDI 5
97#define WTAP_ENCAP_FDDI_BITSWAPPED 6
98#define WTAP_ENCAP_RAW_IP 7
99#define WTAP_ENCAP_ARCNET 8
100#define WTAP_ENCAP_ARCNET_LINUX 9
101#define WTAP_ENCAP_ATM_RFC1483 10
102#define WTAP_ENCAP_LINUX_ATM_CLIP 11
103#define WTAP_ENCAP_LAPB 12
104#define WTAP_ENCAP_ATM_PDUS 13
105#define WTAP_ENCAP_ATM_PDUS_UNTRUNCATED 14
106#define WTAP_ENCAP_NULL 15
107#define WTAP_ENCAP_ASCEND 16
108#define WTAP_ENCAP_ISDN 17
109#define WTAP_ENCAP_IP_OVER_FC 18
110#define WTAP_ENCAP_PPP_WITH_PHDR 19
111#define WTAP_ENCAP_IEEE_802_11 20
112#define WTAP_ENCAP_IEEE_802_11_PRISM 21
113#define WTAP_ENCAP_IEEE_802_11_WITH_RADIO 22
114#define WTAP_ENCAP_IEEE_802_11_RADIOTAP 23
115#define WTAP_ENCAP_IEEE_802_11_AVS 24
116#define WTAP_ENCAP_SLL 25
117#define WTAP_ENCAP_FRELAY 26
118#define WTAP_ENCAP_FRELAY_WITH_PHDR 27
119#define WTAP_ENCAP_CHDLC 28
120#define WTAP_ENCAP_CISCO_IOS 29
121#define WTAP_ENCAP_LOCALTALK 30
122#define WTAP_ENCAP_OLD_PFLOG 31
123#define WTAP_ENCAP_HHDLC 32
124#define WTAP_ENCAP_DOCSIS 33
125#define WTAP_ENCAP_COSINE 34
126#define WTAP_ENCAP_WFLEET_HDLC 35
127#define WTAP_ENCAP_SDLC 36
128#define WTAP_ENCAP_TZSP 37
129#define WTAP_ENCAP_ENC 38
130#define WTAP_ENCAP_PFLOG 39
131#define WTAP_ENCAP_CHDLC_WITH_PHDR 40
132#define WTAP_ENCAP_BLUETOOTH_H4 41
133#define WTAP_ENCAP_MTP2 42
134#define WTAP_ENCAP_MTP3 43
135#define WTAP_ENCAP_IRDA 44
136#define WTAP_ENCAP_USER0 45
137#define WTAP_ENCAP_USER1 46
138#define WTAP_ENCAP_USER2 47
139#define WTAP_ENCAP_USER3 48
140#define WTAP_ENCAP_USER4 49
141#define WTAP_ENCAP_USER5 50
142#define WTAP_ENCAP_USER6 51
143#define WTAP_ENCAP_USER7 52
144#define WTAP_ENCAP_USER8 53
145#define WTAP_ENCAP_USER9 54
146#define WTAP_ENCAP_USER10 55
147#define WTAP_ENCAP_USER11 56
148#define WTAP_ENCAP_USER12 57
149#define WTAP_ENCAP_USER13 58
150#define WTAP_ENCAP_USER14 59
151#define WTAP_ENCAP_USER15 60
152#define WTAP_ENCAP_SYMANTEC 61
153#define WTAP_ENCAP_APPLE_IP_OVER_IEEE1394 62
154#define WTAP_ENCAP_BACNET_MS_TP 63
155#define WTAP_ENCAP_NETTL_RAW_ICMP 64
156#define WTAP_ENCAP_NETTL_RAW_ICMPV6 65
157#define WTAP_ENCAP_GPRS_LLC 66
158#define WTAP_ENCAP_JUNIPER_ATM1 67
159#define WTAP_ENCAP_JUNIPER_ATM2 68
160#define WTAP_ENCAP_REDBACK 69
161#define WTAP_ENCAP_NETTL_RAW_IP 70
162#define WTAP_ENCAP_NETTL_ETHERNET 71
163#define WTAP_ENCAP_NETTL_TOKEN_RING 72
164#define WTAP_ENCAP_NETTL_FDDI 73
165#define WTAP_ENCAP_NETTL_UNKNOWN 74
166#define WTAP_ENCAP_MTP2_WITH_PHDR 75
167#define WTAP_ENCAP_JUNIPER_PPPOE 76
168#define WTAP_ENCAP_GCOM_TIE1 77
169#define WTAP_ENCAP_GCOM_SERIAL 78
170#define WTAP_ENCAP_NETTL_X25 79
171#define WTAP_ENCAP_K12 80
172#define WTAP_ENCAP_JUNIPER_MLPPP 81
173#define WTAP_ENCAP_JUNIPER_MLFR 82
174#define WTAP_ENCAP_JUNIPER_ETHER 83
175#define WTAP_ENCAP_JUNIPER_PPP 84
176#define WTAP_ENCAP_JUNIPER_FRELAY 85
177#define WTAP_ENCAP_JUNIPER_CHDLC 86
178#define WTAP_ENCAP_JUNIPER_GGSN 87
179#define WTAP_ENCAP_LINUX_LAPD 88
180#define WTAP_ENCAP_CATAPULT_DCT2000 89
181#define WTAP_ENCAP_BER 90
182#define WTAP_ENCAP_JUNIPER_VP 91
183#define WTAP_ENCAP_USB_FREEBSD 92
184#define WTAP_ENCAP_IEEE802_16_MAC_CPS 93
185#define WTAP_ENCAP_NETTL_RAW_TELNET 94
186#define WTAP_ENCAP_USB_LINUX 95
187#define WTAP_ENCAP_MPEG 96
188#define WTAP_ENCAP_PPI 97
189#define WTAP_ENCAP_ERF 98
190#define WTAP_ENCAP_BLUETOOTH_H4_WITH_PHDR 99
191#define WTAP_ENCAP_SITA 100
192#define WTAP_ENCAP_SCCP 101
193#define WTAP_ENCAP_BLUETOOTH_HCI 102 /*raw packets without a transport layer header e.g. H4*/
194#define WTAP_ENCAP_IPMB_KONTRON 103
195#define WTAP_ENCAP_IEEE802_15_4 104
196#define WTAP_ENCAP_X2E_XORAYA 105
197#define WTAP_ENCAP_FLEXRAY 106
198#define WTAP_ENCAP_LIN 107
199#define WTAP_ENCAP_MOST 108
200#define WTAP_ENCAP_CAN20B 109
201#define WTAP_ENCAP_LAYER1_EVENT 110
202#define WTAP_ENCAP_X2E_SERIAL 111
203#define WTAP_ENCAP_I2C_LINUX 112
204#define WTAP_ENCAP_IEEE802_15_4_NONASK_PHY 113
205#define WTAP_ENCAP_TNEF 114
206#define WTAP_ENCAP_USB_LINUX_MMAPPED 115
207#define WTAP_ENCAP_GSM_UM 116
208#define WTAP_ENCAP_DPNSS 117
209#define WTAP_ENCAP_PACKETLOGGER 118
210#define WTAP_ENCAP_NSTRACE_1_0 119
211#define WTAP_ENCAP_NSTRACE_2_0 120
212#define WTAP_ENCAP_FIBRE_CHANNEL_FC2 121
213#define WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS 122
214#define WTAP_ENCAP_JPEG_JFIF 123 /* obsoleted by WTAP_ENCAP_MIME*/
215#define WTAP_ENCAP_IPNET 124
216#define WTAP_ENCAP_SOCKETCAN 125
217#define WTAP_ENCAP_IEEE_802_11_NETMON 126
218#define WTAP_ENCAP_IEEE802_15_4_NOFCS 127
219#define WTAP_ENCAP_RAW_IPFIX 128
220#define WTAP_ENCAP_RAW_IP4 129
221#define WTAP_ENCAP_RAW_IP6 130
222#define WTAP_ENCAP_LAPD 131
223#define WTAP_ENCAP_DVBCI 132
224#define WTAP_ENCAP_MUX27010 133
225#define WTAP_ENCAP_MIME 134
226#define WTAP_ENCAP_NETANALYZER 135
227#define WTAP_ENCAP_NETANALYZER_TRANSPARENT 136
228#define WTAP_ENCAP_IP_OVER_IB_SNOOP 137
229#define WTAP_ENCAP_MPEG_2_TS 138
230#define WTAP_ENCAP_PPP_ETHER 139
231#define WTAP_ENCAP_NFC_LLCP 140
232#define WTAP_ENCAP_NFLOG 141
233#define WTAP_ENCAP_V5_EF 142
234#define WTAP_ENCAP_BACNET_MS_TP_WITH_PHDR 143
235#define WTAP_ENCAP_IXVERIWAVE 144
236#define WTAP_ENCAP_SDH 145
237#define WTAP_ENCAP_DBUS 146
238#define WTAP_ENCAP_AX25_KISS 147
239#define WTAP_ENCAP_AX25 148
240#define WTAP_ENCAP_SCTP 149
241#define WTAP_ENCAP_INFINIBAND 150
242#define WTAP_ENCAP_JUNIPER_SVCS 151
243#define WTAP_ENCAP_USBPCAP 152
244#define WTAP_ENCAP_RTAC_SERIAL 153
245#define WTAP_ENCAP_BLUETOOTH_LE_LL 154
246#define WTAP_ENCAP_WIRESHARK_UPPER_PDU 155
247#define WTAP_ENCAP_STANAG_4607 156
248#define WTAP_ENCAP_STANAG_5066_D_PDU 157
249#define WTAP_ENCAP_NETLINK 158
250#define WTAP_ENCAP_BLUETOOTH_LINUX_MONITOR 159
251#define WTAP_ENCAP_BLUETOOTH_BREDR_BB 160
252#define WTAP_ENCAP_BLUETOOTH_LE_LL_WITH_PHDR 161
253#define WTAP_ENCAP_NSTRACE_3_0 162
254#define WTAP_ENCAP_LOGCAT 163
255#define WTAP_ENCAP_LOGCAT_BRIEF 164
256#define WTAP_ENCAP_LOGCAT_PROCESS 165
257#define WTAP_ENCAP_LOGCAT_TAG 166
258#define WTAP_ENCAP_LOGCAT_THREAD 167
259#define WTAP_ENCAP_LOGCAT_TIME 168
260#define WTAP_ENCAP_LOGCAT_THREADTIME 169
261#define WTAP_ENCAP_LOGCAT_LONG 170
262#define WTAP_ENCAP_PKTAP 171
263#define WTAP_ENCAP_EPON 172
264#define WTAP_ENCAP_IPMI_TRACE 173
265#define WTAP_ENCAP_LOOP 174
266#define WTAP_ENCAP_JSON 175
267#define WTAP_ENCAP_NSTRACE_3_5 176
268#define WTAP_ENCAP_ISO14443 177
269#define WTAP_ENCAP_GFP_T 178
270#define WTAP_ENCAP_GFP_F 179
271#define WTAP_ENCAP_IP_OVER_IB_PCAP 180
272#define WTAP_ENCAP_JUNIPER_VN 181
273#define WTAP_ENCAP_USB_DARWIN 182
274#define WTAP_ENCAP_LORATAP 183
275#define WTAP_ENCAP_3MB_ETHERNET 184
276#define WTAP_ENCAP_VSOCK 185
277#define WTAP_ENCAP_NORDIC_BLE 186
278#define WTAP_ENCAP_NETMON_NET_NETEVENT 187
279#define WTAP_ENCAP_NETMON_HEADER 188
280#define WTAP_ENCAP_NETMON_NET_FILTER 189
281#define WTAP_ENCAP_NETMON_NETWORK_INFO_EX 190
282#define WTAP_ENCAP_MA_WFP_CAPTURE_V4 191
283#define WTAP_ENCAP_MA_WFP_CAPTURE_V6 192
284#define WTAP_ENCAP_MA_WFP_CAPTURE_2V4 193
285#define WTAP_ENCAP_MA_WFP_CAPTURE_2V6 194
286#define WTAP_ENCAP_MA_WFP_CAPTURE_AUTH_V4 195
287#define WTAP_ENCAP_MA_WFP_CAPTURE_AUTH_V6 196
288#define WTAP_ENCAP_JUNIPER_ST 197
289#define WTAP_ENCAP_ETHERNET_MPACKET 198
290#define WTAP_ENCAP_DOCSIS31_XRA31 199
291#define WTAP_ENCAP_DPAUXMON 200
292#define WTAP_ENCAP_RUBY_MARSHAL 201
293#define WTAP_ENCAP_RFC7468 202
294#define WTAP_ENCAP_SYSTEMD_JOURNAL 203 /* Event, not a packet */
295#define WTAP_ENCAP_EBHSCR 204
296#define WTAP_ENCAP_VPP 205
297#define WTAP_ENCAP_IEEE802_15_4_TAP 206
298#define WTAP_ENCAP_LOG_3GPP 207
299#define WTAP_ENCAP_USB_2_0 208
300#define WTAP_ENCAP_MP4 209
301#define WTAP_ENCAP_SLL2 210
302#define WTAP_ENCAP_ZWAVE_SERIAL 211
303#define WTAP_ENCAP_ETW 212
304#define WTAP_ENCAP_ERI_ENB_LOG 213
305#define WTAP_ENCAP_ZBNCP 214
306#define WTAP_ENCAP_USB_2_0_LOW_SPEED 215
307#define WTAP_ENCAP_USB_2_0_FULL_SPEED 216
308#define WTAP_ENCAP_USB_2_0_HIGH_SPEED 217
309#define WTAP_ENCAP_AUTOSAR_DLT 218
310#define WTAP_ENCAP_AUERSWALD_LOG 219
311#define WTAP_ENCAP_ATSC_ALP 220
312#define WTAP_ENCAP_FIRA_UCI 221
313#define WTAP_ENCAP_SILABS_DEBUG_CHANNEL 222
314#define WTAP_ENCAP_MDB 223
315#define WTAP_ENCAP_EMS 224
316#define WTAP_ENCAP_DECT_NR 225
317#define WTAP_ENCAP_MMODULE 226
318#define WTAP_ENCAP_PROCMON 227
319#define WTAP_ENCAP_ZWAVE_TAP 228
320#define WTAP_ENCAP_DECT_NR_TAP 229
321#define WTAP_ENCAP_GSMTAP_UM 230
322
323/* After adding new item here, please also add new item to encap_table_base array */
324
325#define WTAP_NUM_ENCAP_TYPES wtap_get_num_encap_types()
326
327/* Value to be used as a file type/subtype value if the type is unknown */
328#define WTAP_FILE_TYPE_SUBTYPE_UNKNOWN -1
329
330/* timestamp precision (currently only these values are supported) */
331#define WTAP_TSPREC_UNKNOWN -2
332#define WTAP_TSPREC_PER_PACKET -1
333
334/*
335 * These values are the number of digits of precision after the integral part.
336 * They're the same as WS_TSPREC values; we define them here so that
337 * tools/make-enums.py sees them.
338 */
339#define WTAP_TSPREC_SEC 0
340#define WTAP_TSPREC_100_MSEC 1
341#define WTAP_TSPREC_DSEC 1
342#define WTAP_TSPREC_10_MSEC 2
343#define WTAP_TSPREC_CSEC 2
344#define WTAP_TSPREC_MSEC 3
345#define WTAP_TSPREC_100_USEC 4
346#define WTAP_TSPREC_10_USEC 5
347#define WTAP_TSPREC_USEC 6
348#define WTAP_TSPREC_100_NSEC 7
349#define WTAP_TSPREC_10_NSEC 8
350#define WTAP_TSPREC_NSEC 9
351/* if you add to the above, update wtap_tsprec_string() */
352
353/*
354 * Maximum packet sizes.
355 *
356 * For most link-layer types, we use 262144, which is currently
357 * libpcap's MAXIMUM_SNAPLEN.
358 *
359 * For WTAP_ENCAP_DBUS, the maximum is 128MiB, as per
360 *
361 * https://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages
362 *
363 * For WTAP_ENCAP_EBHSCR, the maximum is 8MiB, as per
364 *
365 * https://www.elektrobit.com/ebhscr
366 *
367 * For WTAP_ENCAP_USBPCAP, the maximum is 128MiB, as per
368 *
369 * https://gitlab.com/wireshark/wireshark/-/issues/15985
370 *
371 * We don't want to write out files that specify a maximum packet size
372 * greater than 262144 if we don't have to, as software reading those
373 * files might allocate a buffer much larger than necessary, wasting memory.
374 */
375#define WTAP_MAX_PACKET_SIZE_STANDARD 262144U
376#define WTAP_MAX_PACKET_SIZE_USBPCAP (128U*1024U*1024U)
377#define WTAP_MAX_PACKET_SIZE_EBHSCR (32U*1024U*1024U)
378#define WTAP_MAX_PACKET_SIZE_DBUS (128U*1024U*1024U)
379
380/*
381 * "Pseudo-headers" are used to supply to the clients of wiretap
382 * per-packet information that's not part of the packet payload
383 * proper.
384 *
385 * NOTE: do not use pseudo-header structures to hold information
386 * used by the code to read a particular capture file type; to
387 * keep that sort of state information, define a private structure
388 * to hold that information in your code, and allocate one of those
389 * structures and set the "priv" member of the wth structure to
390 * point to the allocated structure in the "open" routine for that
391 * capture file type if the open succeeds. See various other capture
392 * file type handlers for examples of that.
393 */
394
395
399 struct eth_phdr {
400 int fcs_len;
401};
402
403#define FROM_DCE 0x80
404
408 struct dte_dce_phdr {
409 uint8_t flags;
410};
411
415 struct isdn_phdr {
416 bool uton;
417 uint8_t channel;
418};
419
420/* Packet "pseudo-header" for ATM capture files.
421 Not all of this information is supplied by all capture types.
422 These originally came from the Network General (DOS-based)
423 ATM Sniffer file format, but we've added some additional
424 items. */
425
426/*
427 * Status bits.
428 */
429#define ATM_RAW_CELL 0x01 /* true if the packet is a single cell */
430#define ATM_NO_HEC 0x02 /* true if the cell has HEC stripped out */
431#define ATM_AAL2_NOPHDR 0x04 /* true if the AAL2 PDU has no pseudo-header */
432#define ATM_REASSEMBLY_ERROR 0x08 /* true if this is an incompletely-reassembled PDU */
433
434/*
435 * AAL types.
436 */
437#define AAL_UNKNOWN 0 /* AAL unknown */
438#define AAL_1 1 /* AAL1 */
439#define AAL_2 2 /* AAL2 */
440#define AAL_3_4 3 /* AAL3/4 */
441#define AAL_5 4 /* AAL5 */
442#define AAL_USER 5 /* User AAL */
443#define AAL_SIGNALLING 6 /* Signaling AAL */
444#define AAL_OAMCELL 7 /* OAM cell */
445
446/*
447 * Traffic types.
448 */
449#define TRAF_UNKNOWN 0 /* Unknown */
450#define TRAF_LLCMX 1 /* LLC multiplexed (RFC 1483) */
451#define TRAF_VCMX 2 /* VC multiplexed (RFC 1483) */
452#define TRAF_LANE 3 /* LAN Emulation */
453#define TRAF_ILMI 4 /* ILMI */
454#define TRAF_FR 5 /* Frame Relay */
455#define TRAF_SPANS 6 /* FORE SPANS */
456#define TRAF_IPSILON 7 /* Ipsilon */
457#define TRAF_UMTS_FP 8 /* UMTS Frame Protocol */
458#define TRAF_GPRS_NS 9 /* GPRS Network Services */
459#define TRAF_SSCOP 10 /* SSCOP */
460
461/*
462 * Traffic subtypes.
463 */
464#define TRAF_ST_UNKNOWN 0 /* Unknown */
465
466/*
467 * For TRAF_VCMX:
468 */
469#define TRAF_ST_VCMX_802_3_FCS 1 /* 802.3 with an FCS */
470#define TRAF_ST_VCMX_802_4_FCS 2 /* 802.4 with an FCS */
471#define TRAF_ST_VCMX_802_5_FCS 3 /* 802.5 with an FCS */
472#define TRAF_ST_VCMX_FDDI_FCS 4 /* FDDI with an FCS */
473#define TRAF_ST_VCMX_802_6_FCS 5 /* 802.6 with an FCS */
474#define TRAF_ST_VCMX_802_3 7 /* 802.3 without an FCS */
475#define TRAF_ST_VCMX_802_4 8 /* 802.4 without an FCS */
476#define TRAF_ST_VCMX_802_5 9 /* 802.5 without an FCS */
477#define TRAF_ST_VCMX_FDDI 10 /* FDDI without an FCS */
478#define TRAF_ST_VCMX_802_6 11 /* 802.6 without an FCS */
479#define TRAF_ST_VCMX_FRAGMENTS 12 /* Fragments */
480#define TRAF_ST_VCMX_BPDU 13 /* BPDU */
481
482/*
483 * For TRAF_LANE:
484 */
485#define TRAF_ST_LANE_LE_CTRL 1 /* LANE: LE Ctrl */
486#define TRAF_ST_LANE_802_3 2 /* LANE: 802.3 */
487#define TRAF_ST_LANE_802_5 3 /* LANE: 802.5 */
488#define TRAF_ST_LANE_802_3_MC 4 /* LANE: 802.3 multicast */
489#define TRAF_ST_LANE_802_5_MC 5 /* LANE: 802.5 multicast */
490
491/*
492 * For TRAF_IPSILON:
493 */
494#define TRAF_ST_IPSILON_FT0 1 /* Ipsilon: Flow Type 0 */
495#define TRAF_ST_IPSILON_FT1 2 /* Ipsilon: Flow Type 1 */
496#define TRAF_ST_IPSILON_FT2 3 /* Ipsilon: Flow Type 2 */
497
501 struct atm_phdr {
502 uint32_t flags;
503 uint8_t aal;
504 uint8_t type;
505 uint8_t subtype;
506 uint16_t vpi;
507 uint16_t vci;
508 uint8_t aal2_cid;
509 uint16_t channel;
510 uint16_t cells;
511 uint16_t aal5t_u2u;
512 uint16_t aal5t_len;
513 uint32_t aal5t_chksum;
514};
515
516/* Packet "pseudo-header" for the output from "wandsession", "wannext",
517 "wandisplay", and similar commands on Lucent/Ascend access equipment. */
518
519#define ASCEND_MAX_STR_LEN 64
520
521#define ASCEND_PFX_WDS_X 1
522#define ASCEND_PFX_WDS_R 2
523#define ASCEND_PFX_WDD 3
524#define ASCEND_PFX_ISDN_X 4
525#define ASCEND_PFX_ISDN_R 5
526#define ASCEND_PFX_ETHER 6
527
531 struct ascend_phdr {
532 uint16_t type;
533 char user[ASCEND_MAX_STR_LEN];
534 uint32_t sess;
535 char call_num[ASCEND_MAX_STR_LEN];
536 uint32_t chunk;
537 uint32_t task;
538};
539
543 struct p2p_phdr {
544 bool sent;
545};
546
547/*
548 * Packet "pseudo-header" information for 802.11.
549 * Radio information is only present in this form for
550 * WTAP_ENCAP_IEEE_802_11_WITH_RADIO. This is used for file formats in
551 * which the radio information isn't provided as a pseudo-header in the
552 * packet data. It is also used by the dissectors for the pseudo-headers
553 * in the packet data to supply radio information, in a form independent
554 * of the file format and pseudo-header format, to the "802.11 radio"
555 * dissector.
556 *
557 * Signal strength, etc. information:
558 *
559 * Raw signal strength can be measured in milliwatts.
560 * It can also be represented as dBm, which is 10 times the log base 10
561 * of the signal strength in mW.
562 *
563 * The Receive Signal Strength Indicator is an integer in the range 0 to 255.
564 * The actual RSSI value for a given signal strength is dependent on the
565 * vendor (and perhaps on the adapter). The maximum possible RSSI value
566 * is also dependent on the vendor and perhaps the adapter.
567 *
568 * The signal strength can be represented as a percentage, which is 100
569 * times the ratio of the RSSI and the maximum RSSI.
570 */
571
572/*
573 * PHY types.
574 */
575#define PHDR_802_11_PHY_UNKNOWN 0 /* PHY not known */
576#define PHDR_802_11_PHY_11_FHSS 1 /* 802.11 FHSS */
577#define PHDR_802_11_PHY_11_IR 2 /* 802.11 IR */
578#define PHDR_802_11_PHY_11_DSSS 3 /* 802.11 DSSS */
579#define PHDR_802_11_PHY_11B 4 /* 802.11b */
580#define PHDR_802_11_PHY_11A 5 /* 802.11a */
581#define PHDR_802_11_PHY_11G 6 /* 802.11g */
582#define PHDR_802_11_PHY_11N 7 /* 802.11n */
583#define PHDR_802_11_PHY_11AC 8 /* 802.11ac */
584#define PHDR_802_11_PHY_11AD 9 /* 802.11ad */
585#define PHDR_802_11_PHY_11AH 10 /* 802.11ah */
586#define PHDR_802_11_PHY_11AX 11 /* 802.11ax */
587#define PHDR_802_11_PHY_11BE 12 /* 802.11be - EHT */
588
589/*
590 * PHY-specific information.
591 */
592
596 struct ieee_802_11_fhss {
597 unsigned has_hop_set : 1;
598 unsigned has_hop_pattern : 1;
599 unsigned has_hop_index : 1;
600
601 uint8_t hop_set;
602 uint8_t hop_pattern;
603 uint8_t hop_index;
604};
605
606
610 struct ieee_802_11b {
611 unsigned has_short_preamble : 1;
612
613 bool short_preamble;
614};
615
616
620 struct ieee_802_11a {
621 unsigned has_channel_type : 1;
622 unsigned has_turbo_type : 1;
623
624 unsigned channel_type : 2;
625 unsigned turbo_type : 2;
626};
627
628/*
629 * Channel type values.
630 */
631#define PHDR_802_11A_CHANNEL_TYPE_NORMAL 0
632#define PHDR_802_11A_CHANNEL_TYPE_HALF_CLOCKED 1
633#define PHDR_802_11A_CHANNEL_TYPE_QUARTER_CLOCKED 2
634
635/*
636 * "Turbo" is an Atheros proprietary extension with 40 MHz-wide channels.
637 * It can be dynamic or static.
638 *
639 * See
640 *
641 * http://wifi-insider.com/atheros/turbo.htm
642 */
643#define PHDR_802_11A_TURBO_TYPE_NORMAL 0
644#define PHDR_802_11A_TURBO_TYPE_TURBO 1 /* If we don't know whether it's static or dynamic */
645#define PHDR_802_11A_TURBO_TYPE_DYNAMIC_TURBO 2
646#define PHDR_802_11A_TURBO_TYPE_STATIC_TURBO 3
647
655 struct ieee_802_11g {
656 unsigned has_mode : 1;
657
658 uint32_t mode;
659};
660
661/*
662 * Mode values.
663 */
664#define PHDR_802_11G_MODE_NORMAL 0
665#define PHDR_802_11G_MODE_SUPER_G 1 /* Atheros Super G */
666
670 struct ieee_802_11n {
671 unsigned has_mcs_index : 1;
672 unsigned has_bandwidth : 1;
673 unsigned has_short_gi : 1;
674 unsigned has_greenfield : 1;
675 unsigned has_fec : 1;
676 unsigned has_stbc_streams : 1;
677 unsigned has_ness : 1;
678
679 uint16_t mcs_index;
680 unsigned bandwidth;
681 unsigned short_gi : 1;
682 unsigned greenfield : 1;
683 unsigned fec : 1;
684 unsigned stbc_streams : 2;
685 unsigned ness;
686};
687
688/*
689 * Bandwidth values; used for both 11n and 11ac.
690 */
691#define PHDR_802_11_BANDWIDTH_20_MHZ 0 /* 20 MHz */
692#define PHDR_802_11_BANDWIDTH_40_MHZ 1 /* 40 MHz */
693#define PHDR_802_11_BANDWIDTH_20_20L 2 /* 20 + 20L, 40 MHz */
694#define PHDR_802_11_BANDWIDTH_20_20U 3 /* 20 + 20U, 40 MHz */
695#define PHDR_802_11_BANDWIDTH_80_MHZ 4 /* 80 MHz */
696#define PHDR_802_11_BANDWIDTH_40_40L 5 /* 40 + 40L MHz, 80 MHz */
697#define PHDR_802_11_BANDWIDTH_40_40U 6 /* 40 + 40U MHz, 80 MHz */
698#define PHDR_802_11_BANDWIDTH_20LL 7 /* ???, 80 MHz */
699#define PHDR_802_11_BANDWIDTH_20LU 8 /* ???, 80 MHz */
700#define PHDR_802_11_BANDWIDTH_20UL 9 /* ???, 80 MHz */
701#define PHDR_802_11_BANDWIDTH_20UU 10 /* ???, 80 MHz */
702#define PHDR_802_11_BANDWIDTH_160_MHZ 11 /* 160 MHz */
703#define PHDR_802_11_BANDWIDTH_80_80L 12 /* 80 + 80L, 160 MHz */
704#define PHDR_802_11_BANDWIDTH_80_80U 13 /* 80 + 80U, 160 MHz */
705#define PHDR_802_11_BANDWIDTH_40LL 14 /* ???, 160 MHz */
706#define PHDR_802_11_BANDWIDTH_40LU 15 /* ???, 160 MHz */
707#define PHDR_802_11_BANDWIDTH_40UL 16 /* ???, 160 MHz */
708#define PHDR_802_11_BANDWIDTH_40UU 17 /* ???, 160 MHz */
709#define PHDR_802_11_BANDWIDTH_20LLL 18 /* ???, 160 MHz */
710#define PHDR_802_11_BANDWIDTH_20LLU 19 /* ???, 160 MHz */
711#define PHDR_802_11_BANDWIDTH_20LUL 20 /* ???, 160 MHz */
712#define PHDR_802_11_BANDWIDTH_20LUU 21 /* ???, 160 MHz */
713#define PHDR_802_11_BANDWIDTH_20ULL 22 /* ???, 160 MHz */
714#define PHDR_802_11_BANDWIDTH_20ULU 23 /* ???, 160 MHz */
715#define PHDR_802_11_BANDWIDTH_20UUL 24 /* ???, 160 MHz */
716#define PHDR_802_11_BANDWIDTH_20UUU 25 /* ???, 160 MHz */
717
721 struct ieee_802_11ac {
722 unsigned has_stbc : 1;
723 unsigned has_txop_ps_not_allowed : 1;
724 unsigned has_short_gi : 1;
725 unsigned has_short_gi_nsym_disambig: 1;
726 unsigned has_ldpc_extra_ofdm_symbol: 1;
727 unsigned has_beamformed : 1;
728 unsigned has_bandwidth : 1;
729 unsigned has_fec : 1;
730 unsigned has_group_id : 1;
731 unsigned has_partial_aid : 1;
732
733 unsigned stbc : 1;
734 unsigned txop_ps_not_allowed : 1;
735 unsigned short_gi : 1;
736 unsigned short_gi_nsym_disambig: 1;
737 unsigned ldpc_extra_ofdm_symbol: 1;
738 unsigned beamformed : 1;
739 uint8_t bandwidth;
740 uint8_t mcs[4];
741 uint8_t nss[4];
742 uint8_t fec;
743 uint8_t group_id;
744 uint16_t partial_aid;
745};
746
747/*
748 * 802.11ad.
749 */
750
751/*
752 * Min and Max frequencies for 802.11ad and a macro for checking for 802.11ad.
753 */
754
755#define PHDR_802_11AD_MIN_FREQUENCY 57000
756#define PHDR_802_11AD_MAX_FREQUENCY 71000
757
758#define IS_80211AD(frequency) (((frequency) >= PHDR_802_11AD_MIN_FREQUENCY) &&\
759 ((frequency) <= PHDR_802_11AD_MAX_FREQUENCY))
760
764 struct ieee_802_11ad {
765 unsigned has_mcs_index : 1;
766
767 uint8_t mcs;
768};
769
770
774 struct ieee_802_11ax {
775 unsigned has_mcs_index : 1;
776 unsigned has_bwru : 1;
777 unsigned has_gi : 1;
778
779 uint8_t nsts : 4;
780 uint8_t mcs : 4;
781 uint8_t bwru : 4;
782 uint8_t gi : 2;
783};
784
785
789 struct ieee_802_11be_user_info {
790 unsigned sta_id_known : 1;
791 unsigned mcs_known : 1;
792 unsigned coding_known : 1;
793 unsigned rsv_known : 1;
794 unsigned nsts_known : 1;
795 unsigned bf_known : 1;
796 unsigned spatial_config_known : 1;
797 unsigned data_for_this_user : 1;
798 unsigned sta_id : 11;
799 unsigned ldpc_coding : 1;
800 unsigned mcs : 4;
801 unsigned nsts : 4;
802 unsigned rsv : 1;
803 unsigned beamform : 1;
804 unsigned rsv2 : 2;
805};
806
807#define PHDR_802_11BE_MAX_USERS 4
808
812 struct ieee_802_11be {
813 unsigned has_ru_mru_size : 1;
814 unsigned has_gi : 1;
815 unsigned has_bandwidth : 1;
816
817 uint8_t bandwidth;
818 uint8_t ru_mru_size : 4;
819 uint8_t gi : 2;
820 uint8_t num_users;
821 struct ieee_802_11be_user_info user[PHDR_802_11BE_MAX_USERS];
822};
823
824
835 union ieee_802_11_phy_info {
836 struct ieee_802_11_fhss info_11_fhss;
837 struct ieee_802_11b info_11b;
838 struct ieee_802_11a info_11a;
839 struct ieee_802_11g info_11g;
840 struct ieee_802_11n info_11n;
841 struct ieee_802_11ac info_11ac;
842 struct ieee_802_11ad info_11ad;
843 struct ieee_802_11ax info_11ax;
844 struct ieee_802_11be info_11be;
845};
846
850 struct ieee_802_11_phdr {
851 int fcs_len;
852 unsigned decrypted : 1;
853 unsigned datapad : 1;
854 unsigned no_a_msdus : 1;
855 unsigned phy;
856 union ieee_802_11_phy_info phy_info;
857
858 unsigned has_channel : 1;
859 unsigned has_frequency : 1;
860 unsigned has_data_rate : 1;
861 unsigned has_signal_percent : 1;
862 unsigned has_noise_percent : 1;
863 unsigned has_signal_dbm : 1;
864 unsigned has_noise_dbm : 1;
865 unsigned has_signal_db : 1;
866 unsigned has_noise_db : 1;
867 unsigned has_tsf_timestamp : 1;
868 unsigned has_aggregate_info : 1;
869 unsigned has_zero_length_psdu_type: 1;
870
871 uint16_t channel;
872 uint32_t frequency;
873 uint16_t data_rate;
874 uint8_t signal_percent;
875 uint8_t noise_percent;
876 int8_t signal_dbm;
877 int8_t noise_dbm;
878 uint8_t signal_db;
879 uint8_t noise_db;
880 uint64_t tsf_timestamp;
881 uint32_t aggregate_flags;
882 uint32_t aggregate_id;
883 uint8_t zero_length_psdu_type;
884};
885
886/*
887 * A-MPDU flags.
888 */
889#define PHDR_802_11_LAST_PART_OF_A_MPDU 0x00000001 /* this is the last part of an A-MPDU */
890#define PHDR_802_11_A_MPDU_DELIM_CRC_ERROR 0x00000002 /* delimiter CRC error after this part */
891
892/*
893 * Zero-length PSDU types.
894 */
895#define PHDR_802_11_SOUNDING_PSDU 0 /* sounding PPDU */
896#define PHDR_802_11_DATA_NOT_CAPTURED 1 /* data not captured, (e.g. multi-user PPDU) */
897#define PHDR_802_11_0_LENGTH_PSDU_VENDOR_SPECIFIC 0xff
898
899/* Packet "pseudo-header" for the output from CoSine L2 debug output. */
900
901#define COSINE_MAX_IF_NAME_LEN 128
902
903#define COSINE_ENCAP_TEST 1
904#define COSINE_ENCAP_PPoATM 2
905#define COSINE_ENCAP_PPoFR 3
906#define COSINE_ENCAP_ATM 4
907#define COSINE_ENCAP_FR 5
908#define COSINE_ENCAP_HDLC 6
909#define COSINE_ENCAP_PPP 7
910#define COSINE_ENCAP_ETH 8
911#define COSINE_ENCAP_UNKNOWN 99
912
913#define COSINE_DIR_TX 1
914#define COSINE_DIR_RX 2
915
919 struct cosine_phdr {
920 uint8_t encap;
921 uint8_t direction;
922 char if_name[COSINE_MAX_IF_NAME_LEN];
923 uint16_t pro;
924 uint16_t off;
925 uint16_t pri;
926 uint16_t rm;
927 uint16_t err;
928};
929
930/* Packet "pseudo-header" for IrDA capture files. */
931
932/*
933 * Direction of the packet
934 */
935#define IRDA_INCOMING 0x0000
936#define IRDA_OUTGOING 0x0004
937
938/*
939 * "Inline" log messages produced by IrCOMM2k on Windows
940 */
941#define IRDA_LOG_MESSAGE 0x0100 /* log message */
942#define IRDA_MISSED_MSG 0x0101 /* missed log entry or frame */
943
944/*
945 * Differentiate between frames and log messages
946 */
947#define IRDA_CLASS_FRAME 0x0000
948#define IRDA_CLASS_LOG 0x0100
949#define IRDA_CLASS_MASK 0xFF00
950
954 struct irda_phdr {
955 uint16_t pkttype;
956};
957
961 struct nettl_phdr {
962 uint16_t subsys;
963 uint32_t devid;
964 uint32_t kind;
965 int32_t pid;
966 uint32_t uid;
967};
968
969/* Packet "pseudo-header" for MTP2 files. */
970
971#define MTP2_ANNEX_A_NOT_USED 0
972#define MTP2_ANNEX_A_USED 1
973#define MTP2_ANNEX_A_USED_UNKNOWN 2
974
978 struct mtp2_phdr {
979 uint8_t sent;
980 uint8_t annex_a_used;
981 uint16_t link_number;
982};
983
991 typedef union {
997 struct {
998 uint16_t vp;
999 uint16_t vc;
1000 uint16_t cid;
1001 } atm;
1002
1009 uint32_t ds0mask;
1010} k12_input_info_t;
1011
1015 struct k12_phdr {
1016 uint32_t input;
1017 const char *input_name;
1018 const char *stack_file;
1019 uint32_t input_type;
1020 k12_input_info_t input_info;
1021 uint8_t *extra_info;
1022 uint32_t extra_length;
1023 void *stuff;
1024};
1025
1026#define K12_PORT_DS0S 0x00010008
1027#define K12_PORT_DS1 0x00100008
1028#define K12_PORT_ATMPVC 0x01020000
1029
1037 struct lapd_phdr {
1038 uint16_t pkttype;
1039 uint8_t we_network;
1040};
1041
1049 struct catapult_dct2000_phdr {
1050 union {
1051 struct isdn_phdr isdn;
1052 struct atm_phdr atm;
1053 struct p2p_phdr p2p;
1054 } inner_pseudo_header;
1055
1056 int64_t seek_off;
1057 struct wtap *wth;
1058};
1059
1063 struct erf_phdr {
1064 uint64_t ts;
1065 uint8_t type;
1066 uint8_t flags;
1067 uint16_t rlen;
1068 uint16_t lctr;
1069 uint16_t wlen;
1070};
1071
1075 struct erf_ehdr {
1076 uint64_t ehdr;
1077};
1078
1079#define MAX_ERF_EHDR 16
1080
1084 struct wtap_erf_eth_hdr {
1085 uint8_t offset;
1086 uint8_t pad;
1087};
1088
1097 struct erf_mc_phdr {
1098 struct erf_phdr phdr;
1099
1100 struct erf_ehdr ehdr_list[MAX_ERF_EHDR];
1101
1107 union {
1108 struct wtap_erf_eth_hdr eth_hdr;
1109 uint32_t mc_hdr;
1110 uint32_t aal2_hdr;
1111 } subhdr;
1112};
1113
1114#define SITA_FRAME_DIR_TXED (0x00) /* values of sita_phdr.flags */
1115#define SITA_FRAME_DIR_RXED (0x01)
1116#define SITA_FRAME_DIR (0x01) /* mask */
1117#define SITA_ERROR_NO_BUFFER (0x80)
1118
1119#define SITA_SIG_DSR (0x01) /* values of sita_phdr.signals */
1120#define SITA_SIG_DTR (0x02)
1121#define SITA_SIG_CTS (0x04)
1122#define SITA_SIG_RTS (0x08)
1123#define SITA_SIG_DCD (0x10)
1124#define SITA_SIG_UNDEF1 (0x20)
1125#define SITA_SIG_UNDEF2 (0x40)
1126#define SITA_SIG_UNDEF3 (0x80)
1127
1128#define SITA_ERROR_TX_UNDERRUN (0x01) /* values of sita_phdr.errors2 (if SITA_FRAME_DIR_TXED) */
1129#define SITA_ERROR_TX_CTS_LOST (0x02)
1130#define SITA_ERROR_TX_UART_ERROR (0x04)
1131#define SITA_ERROR_TX_RETX_LIMIT (0x08)
1132#define SITA_ERROR_TX_UNDEF1 (0x10)
1133#define SITA_ERROR_TX_UNDEF2 (0x20)
1134#define SITA_ERROR_TX_UNDEF3 (0x40)
1135#define SITA_ERROR_TX_UNDEF4 (0x80)
1136
1137#define SITA_ERROR_RX_FRAMING (0x01) /* values of sita_phdr.errors1 (if SITA_FRAME_DIR_RXED) */
1138#define SITA_ERROR_RX_PARITY (0x02)
1139#define SITA_ERROR_RX_COLLISION (0x04)
1140#define SITA_ERROR_RX_FRAME_LONG (0x08)
1141#define SITA_ERROR_RX_FRAME_SHORT (0x10)
1142#define SITA_ERROR_RX_UNDEF1 (0x20)
1143#define SITA_ERROR_RX_UNDEF2 (0x40)
1144#define SITA_ERROR_RX_UNDEF3 (0x80)
1145
1146#define SITA_ERROR_RX_NONOCTET_ALIGNED (0x01) /* values of sita_phdr.errors2 (if SITA_FRAME_DIR_RXED) */
1147#define SITA_ERROR_RX_ABORT (0x02)
1148#define SITA_ERROR_RX_CD_LOST (0x04)
1149#define SITA_ERROR_RX_DPLL (0x08)
1150#define SITA_ERROR_RX_OVERRUN (0x10)
1151#define SITA_ERROR_RX_FRAME_LEN_VIOL (0x20)
1152#define SITA_ERROR_RX_CRC (0x40)
1153#define SITA_ERROR_RX_BREAK (0x80)
1154
1155#define SITA_PROTO_UNUSED (0x00) /* values of sita_phdr.proto */
1156#define SITA_PROTO_BOP_LAPB (0x01)
1157#define SITA_PROTO_ETHERNET (0x02)
1158#define SITA_PROTO_ASYNC_INTIO (0x03)
1159#define SITA_PROTO_ASYNC_BLKIO (0x04)
1160#define SITA_PROTO_ALC (0x05)
1161#define SITA_PROTO_UTS (0x06)
1162#define SITA_PROTO_PPP_HDLC (0x07)
1163#define SITA_PROTO_SDLC (0x08)
1164#define SITA_PROTO_TOKENRING (0x09)
1165#define SITA_PROTO_I2C (0x10)
1166#define SITA_PROTO_DPM_LINK (0x11)
1167#define SITA_PROTO_BOP_FRL (0x12)
1168
1172 struct sita_phdr {
1173 uint8_t sita_flags;
1174 uint8_t sita_signals;
1175 uint8_t sita_errors1;
1176 uint8_t sita_errors2;
1177 uint8_t sita_proto;
1178};
1179
1183 struct bthci_phdr {
1184 bool sent;
1185 uint32_t channel;
1186};
1187
1188#define BTHCI_CHANNEL_COMMAND 1
1189#define BTHCI_CHANNEL_ACL 2
1190#define BTHCI_CHANNEL_SCO 3
1191#define BTHCI_CHANNEL_EVENT 4
1192#define BTHCI_CHANNEL_ISO 5
1193
1197 struct btmon_phdr {
1198 uint16_t adapter_id;
1199 uint16_t opcode;
1200};
1201
1205 struct l1event_phdr {
1206 bool uton;
1207};
1208
1212 struct i2c_phdr {
1213 uint8_t is_event;
1214 uint8_t bus;
1215 uint32_t flags;
1216};
1217
1221 struct gsm_um_phdr {
1222 bool uplink;
1223 uint8_t channel;
1224 /* The following are only populated for downlink */
1225 uint8_t bsic;
1226 uint16_t arfcn;
1227 uint32_t tdma_frame;
1228 uint8_t error;
1229 uint16_t timeshift;
1230};
1231
1232#define GSM_UM_CHANNEL_UNKNOWN 0
1233#define GSM_UM_CHANNEL_BCCH 1
1234#define GSM_UM_CHANNEL_SDCCH 2
1235#define GSM_UM_CHANNEL_SACCH 3
1236#define GSM_UM_CHANNEL_FACCH 4
1237#define GSM_UM_CHANNEL_CCCH 5
1238#define GSM_UM_CHANNEL_RACH 6
1239#define GSM_UM_CHANNEL_AGCH 7
1240#define GSM_UM_CHANNEL_PCH 8
1241
1245 struct nstr_phdr {
1246 int64_t rec_offset;
1247 int32_t rec_len;
1248 uint8_t nicno_offset;
1249 uint8_t nicno_len;
1250 uint8_t dir_offset;
1251 uint8_t dir_len;
1252 uint16_t eth_offset;
1253 uint8_t pcb_offset;
1254 uint8_t l_pcb_offset;
1255 uint8_t rec_type;
1256 uint8_t vlantag_offset;
1257 uint8_t coreid_offset;
1258 uint8_t srcnodeid_offset;
1259 uint8_t destnodeid_offset;
1260 uint8_t clflags_offset;
1261 uint8_t src_vmname_len_offset;
1262 uint8_t dst_vmname_len_offset;
1263 uint8_t ns_activity_offset;
1264 uint8_t data_offset;
1265};
1266
1270 struct nokia_phdr {
1271 struct eth_phdr eth;
1272 uint8_t stuff[4];
1273};
1274
1275#define LLCP_PHDR_FLAG_SENT 0
1276
1280 struct llcp_phdr {
1281 uint8_t adapter;
1282 uint8_t flags;
1283};
1284
1288 struct logcat_phdr {
1289 int version;
1290};
1291
1299 struct netmon_phdr {
1300 uint8_t* title;
1301 uint32_t descLength;
1302 uint8_t* description;
1303
1304 unsigned sub_encap;
1305
1311 union sub_wtap_pseudo_header {
1312 struct eth_phdr eth;
1313 struct atm_phdr atm;
1314 struct ieee_802_11_phdr ieee_802_11;
1315 } subheader;
1316};
1317
1318/* Record "pseudo-header" information for header data from MS ProcMon files. */
1319
1320 struct procmon_process_t;
1321
1325 struct procmon_phdr {
1326 uint32_t *process_index_map;
1327 size_t process_index_map_size;
1328 struct procmon_process_t *process_array;
1329 size_t process_array_size;
1330 bool system_bitness;
1331};
1332
1333
1337 struct ber_phdr {
1338 const char *pathname;
1339};
1340
1341
1345 struct mmodule_phdr {
1346 uint8_t chunktype;
1347};
1348
1355 union wtap_pseudo_header {
1356 struct eth_phdr eth;
1357 struct dte_dce_phdr dte_dce;
1358 struct isdn_phdr isdn;
1359 struct atm_phdr atm;
1360 struct ascend_phdr ascend;
1361 struct p2p_phdr p2p;
1362 struct ieee_802_11_phdr ieee_802_11;
1363 struct cosine_phdr cosine;
1364 struct irda_phdr irda;
1365 struct nettl_phdr nettl;
1366 struct mtp2_phdr mtp2;
1367 struct k12_phdr k12;
1368 struct lapd_phdr lapd;
1369 struct catapult_dct2000_phdr dct2000;
1370 struct erf_mc_phdr erf;
1371 struct sita_phdr sita;
1372 struct bthci_phdr bthci;
1373 struct btmon_phdr btmon;
1374 struct l1event_phdr l1event;
1375 struct i2c_phdr i2c;
1376 struct gsm_um_phdr gsm_um;
1377 struct nstr_phdr nstr;
1378 struct nokia_phdr nokia;
1379 struct llcp_phdr llcp;
1380 struct logcat_phdr logcat;
1381 struct netmon_phdr netmon;
1382 struct procmon_phdr procmon;
1383 struct ber_phdr ber;
1384 struct mmodule_phdr mmodule;
1385};
1386
1387/*
1388 * Record type values.
1389 *
1390 * This list will expand over time, so don't assume everything will
1391 * forever be one of the types listed below.
1392 *
1393 * For file-type-specific records, the "ftsrec" field of the pseudo-header
1394 * contains a file-type-specific subtype value, such as a block type for
1395 * a pcapng file.
1396 *
1397 * An "event" is an indication that something happened during the capture
1398 * process, such as a status transition of some sort on the network.
1399 * These should, ideally, have a time stamp and, if they're relevant to
1400 * a particular interface on a multi-interface capture, should also have
1401 * an interface ID. The data for the event is file-type-specific and
1402 * subtype-specific. These should be dissected and displayed just as
1403 * packets are.
1404 *
1405 * A "report" supplies information not corresponding to an event;
1406 * for example, a pcapng Interface Statistics Block would be a report,
1407 * as it doesn't correspond to something happening on the network.
1408 * They may have a time stamp, and should be dissected and displayed
1409 * just as packets are.
1410 *
1411 * We distinguish between "events" and "reports" so that, for example,
1412 * the packet display can show the delta between a packet and an event
1413 * but not show the delta between a packet and a report, as the time
1414 * stamp of a report may not correspond to anything interesting on
1415 * the network but the time stamp of an event would.
1416 *
1417 * XXX - are there any file-type-specific records that *shouldn't* be
1418 * dissected and displayed? If so, they should be parsed and the
1419 * information in them stored somewhere, and used somewhere, whether
1420 * it's just used when saving the file in its native format or also
1421 * used to parse *other* file-type-specific records.
1422 *
1423 * These would be similar to, for example, pcapng Interface Description
1424 * Blocks, for which the position within the file is significant only
1425 * in that an IDB for an interface must appear before any packets from
1426 * the interface; the fact that an IDB appears at some point doesn't
1427 * necessarily mean something happened in the capture at that point.
1428 * Name Resolution Blocks are another example of such a record.
1429 *
1430 * (XXX - if you want to have a record that says "this interface first
1431 * showed up at this time", that needs to be a separate record type
1432 * from the IDB. We *could* add a "New Interface Description Block",
1433 * with a time stamp, for that purpose, but we'd *still* have to
1434 * provide IDBs for those interfaces, for compatibility with programs
1435 * that don't know about the NIDB. An ISB with only an isb_starttime
1436 * option would suffice for this purpose, so nothing needs to be
1437 * added to pcapng for this.)
1438 */
1439#define REC_TYPE_PACKET 0
1440#define REC_TYPE_FT_SPECIFIC_EVENT 1
1441#define REC_TYPE_FT_SPECIFIC_REPORT 2
1442#define REC_TYPE_SYSCALL 3
1443#define REC_TYPE_SYSTEMD_JOURNAL_EXPORT 4
1444#define REC_TYPE_CUSTOM_BLOCK 5
1445
1449 typedef struct {
1450 uint32_t caplen;
1451 uint32_t len;
1452 int pkt_encap;
1453 uint32_t interface_id;
1454
1455 union wtap_pseudo_header pseudo_header;
1456} wtap_packet_header;
1457
1458/*
1459 * The pcapng specification says "The word is encoded as an unsigned
1460 * 32-bit integer, using the endianness of the Section Header Block
1461 * scope it is in. In the following table, the bits are numbered with
1462 * 0 being the most-significant bit and 31 being the least-significant
1463 * bit of the 32-bit unsigned integer."
1464 *
1465 * From that, the direction, in bits 0 and 1, is at the *top* of the word.
1466 *
1467 * However, several implementations, such as:
1468 *
1469 * the Wireshark pcapng file reading code;
1470 *
1471 * macOS libpcap and tcpdump;
1472 *
1473 * text2pcap;
1474 *
1475 * and probably the software that generated the capture in bug 11665;
1476 *
1477 * treat 0 as the *least*-significant bit and bit 31 being the *most*-
1478 * significant bit of the flags word, and put the direction at the
1479 * *bottom* of the word.
1480 *
1481 * For now, we go with the known implementations.
1482 */
1483
1484/* Direction field of the packet flags */
1485#define PACK_FLAGS_DIRECTION_MASK 0x00000003 /* unshifted */
1486#define PACK_FLAGS_DIRECTION_SHIFT 0
1487#define PACK_FLAGS_DIRECTION(pack_flags) (((pack_flags) & PACK_FLAGS_DIRECTION_MASK) >> PACK_FLAGS_DIRECTION_SHIFT)
1488#define PACK_FLAGS_DIRECTION_UNKNOWN 0
1489#define PACK_FLAGS_DIRECTION_INBOUND 1
1490#define PACK_FLAGS_DIRECTION_OUTBOUND 2
1491
1492/* Reception type field of the packet flags */
1493#define PACK_FLAGS_RECEPTION_TYPE_MASK 0x0000001C /* unshifted */
1494#define PACK_FLAGS_RECEPTION_TYPE_SHIFT 2
1495#define PACK_FLAGS_RECEPTION_TYPE(pack_flags) (((pack_flags) & PACK_FLAGS_RECEPTION_TYPE_MASK) >> PACK_FLAGS_RECEPTION_TYPE_SHIFT)
1496#define PACK_FLAGS_RECEPTION_TYPE_UNSPECIFIED 0
1497#define PACK_FLAGS_RECEPTION_TYPE_UNICAST 1
1498#define PACK_FLAGS_RECEPTION_TYPE_MULTICAST 2
1499#define PACK_FLAGS_RECEPTION_TYPE_BROADCAST 3
1500#define PACK_FLAGS_RECEPTION_TYPE_PROMISCUOUS 4
1501
1502/* FCS length field of the packet flags */
1503#define PACK_FLAGS_FCS_LENGTH_MASK 0x000001E0 /* unshifted */
1504#define PACK_FLAGS_FCS_LENGTH_SHIFT 5
1505#define PACK_FLAGS_FCS_LENGTH(pack_flags) (((pack_flags) & PACK_FLAGS_FCS_LENGTH_MASK) >> PACK_FLAGS_FCS_LENGTH_SHIFT)
1506
1507/* Reserved bits of the packet flags */
1508#define PACK_FLAGS_RESERVED_MASK 0x0000FE00
1509
1510/* Link-layer-dependent errors of the packet flags */
1511
1512/* For Ethernet and possibly some other network types */
1513#define PACK_FLAGS_CRC_ERROR 0x01000000
1514#define PACK_FLAGS_PACKET_TOO_LONG 0x02000000
1515#define PACK_FLAGS_PACKET_TOO_SHORT 0x04000000
1516#define PACK_FLAGS_WRONG_INTER_FRAME_GAP 0x08000000
1517#define PACK_FLAGS_UNALIGNED_FRAME 0x10000000
1518#define PACK_FLAGS_START_FRAME_DELIMITER_ERROR 0x20000000
1519#define PACK_FLAGS_PREAMBLE_ERROR 0x40000000
1520#define PACK_FLAGS_SYMBOL_ERROR 0x80000000
1521
1522/* Construct a pack_flags value from its subfield values */
1523#define PACK_FLAGS_VALUE(direction, reception_type, fcs_length, ll_dependent_errors) \
1524 (((direction) << 30) | \
1525 ((reception_type) << 27) | \
1526 ((fcs_length) << 23) | \
1527 (ll_dependent_errors))
1528
1532 typedef struct {
1533 int file_type_subtype;
1534 unsigned record_type;
1535 uint32_t record_len;
1536
1537 union wtap_pseudo_header pseudo_header;
1538} wtap_ft_specific_header;
1539
1543 typedef struct {
1544 const char *pathname;
1545 unsigned record_type;
1546 int byte_order;
1547 uint64_t timestamp;
1548 uint64_t thread_id;
1549 uint32_t event_len;
1550 uint32_t event_data_len;
1551 uint32_t nparams;
1552 uint32_t flags;
1553 uint16_t event_type;
1554 uint16_t cpu_id;
1555} wtap_syscall_header;
1556
1560 typedef struct {
1561 uint32_t record_len;
1562} wtap_systemd_journal_export_header;
1563
1567 typedef struct {
1568 uint32_t pen;
1569 uint32_t length;
1570 bool copy_allowed;
1571} wtap_custom_block_header;
1572
1573/*
1574 * The largest nstime.secs value that can be put into an unsigned
1575 * 32-bit quantity.
1576 *
1577 * We assume that time_t is signed; it is signed on Windows/MSVC and
1578 * on many UN*Xes.
1579 *
1580 * So, if time_t is 32-bit, we define this as INT32_MAX, as that's
1581 * the largest value a time_t can have, and it fits in an unsigned
1582 * 32-bit quantity. If it's 64-bit or larger, we define this as
1583 * UINT32_MAX, as, even if it's signed, it can be as large as
1584 * UINT32_MAX, and that's the largest value that can fit in
1585 * a 32-bit unsigned quantity.
1586 *
1587 * Comparing against this, rather than against G_MAXINT2, when checking
1588 * whether a time stamp will fit in a 32-bit unsigned integer seconds
1589 * field in a capture file being written avoids signed vs. unsigned
1590 * warnings if time_t is a signed 32-bit type.
1591 *
1592 * XXX - what if time_t is unsigned? Are there any platforms where
1593 * it is?
1594 */
1595#define WTAP_NSTIME_32BIT_SECS_MAX ((time_t)(sizeof(time_t) > sizeof(int32_t) ? UINT32_MAX : INT32_MAX))
1596
1600 typedef struct wtap_rec {
1601 unsigned rec_type;
1602 uint32_t presence_flags;
1603 unsigned section_number;
1604 nstime_t ts;
1605 int tsprec;
1606 const char *rec_type_name;
1607
1611 union {
1612 wtap_packet_header packet_header;
1613 wtap_ft_specific_header ft_specific_header;
1614 wtap_syscall_header syscall_header;
1615 wtap_systemd_journal_export_header systemd_journal_export_header;
1616 wtap_custom_block_header custom_block_header;
1617 } rec_header;
1618
1626 wtap_block_t block;
1627
1628 bool block_was_modified;
1629
1635 Buffer options_buf;
1636
1637 Buffer data;
1638} wtap_rec;
1639
1640/*
1641 * Bits in presence_flags, indicating which of the fields we have.
1642 *
1643 * For the time stamp, we may need some more flags to indicate
1644 * whether the time stamp is an absolute date-and-time stamp, an
1645 * absolute time-only stamp (which can make relative time
1646 * calculations tricky, as you could in theory have two time
1647 * stamps separated by an unknown number of days), or a time stamp
1648 * relative to some unspecified time in the past (see mpeg.c).
1649 *
1650 * There is no presence flag for len - there has to be *some* length
1651 * value for the packet. (The "captured length" can be missing if
1652 * the file format doesn't report a captured length distinct from
1653 * the on-the-network length because the application(s) producing those
1654 * files don't support slicing packets.)
1655 *
1656 * There could be a presence flag for the packet encapsulation - if it's
1657 * absent, use the file encapsulation - but it's not clear that's useful;
1658 * we currently do that in the module for the file format.
1659 *
1660 * Only WTAP_HAS_TS and WTAP_HAS_SECTION_NUMBER apply to all record types.
1661 */
1662#define WTAP_HAS_TS 0x00000001
1663#define WTAP_HAS_CAP_LEN 0x00000002
1664#define WTAP_HAS_INTERFACE_ID 0x00000004
1665#define WTAP_HAS_SECTION_NUMBER 0x00000008
1666
1667/*
1668 * The old max name length define, both for backwards compatibility and because
1669 * other name types (in epan) use it. While Name Resolution Blocks (NRBs) only
1670 * support IPv4 and IPv6 currently, they could later support other name types.
1671 */
1672#ifndef MAXNAMELEN
1673#define MAXNAMELEN 64 /* max name length (most names: DNS labels, services, eth) */
1674#endif
1675
1676#ifndef MAXDNSNAMELEN
1677#define MAXDNSNAMELEN 256 /* max total length of a domain name in DNS */
1678#endif
1679
1683 typedef struct hashipv4 {
1684 unsigned addr;
1685 uint8_t flags;
1686 char ip[WS_INET_ADDRSTRLEN];
1687 char name[MAXDNSNAMELEN];
1688 char cidr_addr[WS_INET_CIDRADDRSTRLEN];
1689} hashipv4_t;
1690
1691
1695 typedef struct hashipv6 {
1696 uint8_t addr[16];
1697 uint8_t flags;
1698 char ip6[WS_INET6_ADDRSTRLEN];
1699 char name[MAXDNSNAMELEN];
1700 char cidr_addr[WS_INET6_CIDRADDRSTRLEN];
1701} hashipv6_t;
1702
1703
1707 typedef struct addrinfo_lists {
1708 GList *ipv4_addr_list;
1709 GList *ipv6_addr_list;
1710} addrinfo_lists_t;
1711
1728 typedef struct wtap_dump_params {
1729 int encap;
1730 int snaplen;
1731 int tsprec;
1732 GArray *shb_hdrs;
1733 const GArray *shb_iface_to_global;
1736 wtapng_iface_descriptions_t *idb_inf;
1737 const GArray *nrbs_growing;
1740 GArray *dsbs_initial;
1741 const GArray *dsbs_growing;
1744 const GArray *mevs_growing;
1747 const GArray *dpibs_growing;
1750 bool dont_copy_idbs;
1751} wtap_dump_params;
1752
1753/* Zero-initializer for wtap_dump_params. */
1754#define WTAP_DUMP_PARAMS_INIT {.snaplen=0}
1755
1756 struct wtap_dumper;
1757
1758 typedef struct wtap wtap;
1759 typedef struct wtap_dumper wtap_dumper;
1760
1761 typedef struct wtap_reader *FILE_T;
1762
1777 typedef struct wtap_wslua_file_info {
1778 int (*wslua_can_write_encap)(int, void*);
1779 void *wslua_data;
1780} wtap_wslua_file_info_t;
1781
1820 struct file_extension_info {
1821 const char *name;
1822 bool is_capture_file;
1823 const char *extensions;
1824};
1825
1852 typedef enum {
1853 WTAP_OPEN_NOT_MINE = 0,
1854 WTAP_OPEN_MINE = 1,
1855 WTAP_OPEN_ERROR = -1
1856} wtap_open_return_val;
1857
1858 typedef wtap_open_return_val (*wtap_open_routine_t)(struct wtap*, int *,
1859 char **);
1860
1881 typedef enum {
1882 OPEN_INFO_MAGIC = 0,
1883 OPEN_INFO_HEURISTIC = 1
1884} wtap_open_type;
1885
1892WS_DLL_PUBLIC void init_open_routines(void);
1893
1900 void cleanup_open_routines(void);
1901
1928 struct open_info {
1929 const char *name;
1930 wtap_open_type type;
1931 wtap_open_routine_t open_routine;
1932 const char *extensions;
1933 char **extensions_set;
1934 void* wslua_data;
1935};
1936
1943WS_DLL_PUBLIC struct open_info *open_routines;
1944
1945/*
1946 * Types of comments.
1947 */
1953#define WTAP_COMMENT_PER_SECTION 0x00000001 /* per-file/per-file-section */
1954
1960#define WTAP_COMMENT_PER_INTERFACE 0x00000002 /* per-interface */
1961
1967#define WTAP_COMMENT_PER_PACKET 0x00000004 /* per-packet */
1968
1979 typedef enum {
1980 OPTION_NOT_SUPPORTED,
1981 ONE_OPTION_SUPPORTED,
1982 MULTIPLE_OPTIONS_SUPPORTED
1983} option_support_t;
1984
1991 struct supported_option_type {
1992 unsigned opt;
1993 option_support_t support;
1994};
1995
2001#define OPTION_TYPES_SUPPORTED(option_type_array) \
2002 array_length(option_type_array), option_type_array
2003
2009#define NO_OPTIONS_SUPPORTED \
2010 0, NULL
2011
2015 typedef enum {
2016 BLOCK_NOT_SUPPORTED,
2017 ONE_BLOCK_SUPPORTED,
2018 MULTIPLE_BLOCKS_SUPPORTED
2019} block_support_t;
2020
2024 struct supported_block_type {
2025 wtap_block_type_t type;
2026 block_support_t support;
2027 size_t num_supported_options;
2028 const struct supported_option_type *supported_options;
2029};
2030
2031#define BLOCKS_SUPPORTED(block_type_array) \
2032 array_length(block_type_array), block_type_array
2033
2037 struct file_type_subtype_info {
2041 const char *description;
2042
2047 const char *name;
2048
2053 const char *default_file_extension;
2054
2061 const char *additional_file_extensions;
2062
2066 bool writing_must_seek;
2067
2071 size_t num_supported_blocks;
2072
2076 const struct supported_block_type *supported_blocks;
2077
2086 int (*can_write_encap)(int);
2087
2092 bool (*dump_open)(wtap_dumper *, int *, char **);
2093
2098 wtap_wslua_file_info_t *wslua_info;
2099};
2100
2101#define WTAP_TYPE_AUTO 0
2102
2111WS_DLL_PUBLIC
2112 void wtap_init(bool load_wiretap_plugins, const char* app_env_var_prefix, const struct file_extension_info* file_extensions, unsigned num_extensions);
2113
2131WS_DLL_PUBLIC
2132 struct wtap* wtap_open_offline(const char *filename, unsigned int type, int *err,
2133 char **err_info, bool do_random, const char* app_env_var_prefix);
2134
2143WS_DLL_PUBLIC
2144 void wtap_cleareof(wtap *wth);
2145
2156 typedef void (*wtap_new_ipv4_callback_t) (const unsigned addr, const char *name, const bool static_entry);
2157
2167WS_DLL_PUBLIC
2168 void wtap_set_cb_new_ipv4(wtap *wth, wtap_new_ipv4_callback_t add_new_ipv4);
2169
2180 typedef void (*wtap_new_ipv6_callback_t) (const ws_in6_addr *addrp, const char *name, const bool static_entry);
2181
2191WS_DLL_PUBLIC
2192 void wtap_set_cb_new_ipv6(wtap *wth, wtap_new_ipv6_callback_t add_new_ipv6);
2193
2204 typedef void (*wtap_new_secrets_callback_t)(uint32_t secrets_type, const void *secrets, unsigned size);
2205
2215WS_DLL_PUBLIC
2216 void wtap_set_cb_new_secrets(wtap *wth, wtap_new_secrets_callback_t add_new_secrets);
2217
2233WS_DLL_PUBLIC
2234 bool wtap_read(wtap *wth, wtap_rec *rec, int *err, char **err_info,
2235 int64_t *offset);
2236
2253WS_DLL_PUBLIC
2254 bool wtap_seek_read(wtap *wth, int64_t seek_off, wtap_rec *rec,
2255 int *err, char **err_info);
2256
2265WS_DLL_PUBLIC
2266 void wtap_rec_init(wtap_rec *rec, size_t space);
2267
2276WS_DLL_PUBLIC
2277 void wtap_rec_apply_snapshot(wtap_rec *rec, uint32_t snaplen);
2278
2286WS_DLL_PUBLIC
2287 void wtap_rec_reset(wtap_rec *rec);
2288
2296WS_DLL_PUBLIC
2297 void wtap_rec_cleanup(wtap_rec *rec);
2298
2308WS_DLL_PUBLIC
2309 char *wtap_unwritable_rec_type_err_string(const wtap_rec *rec);
2310
2319WS_DLL_PUBLIC
2320 void wtap_setup_packet_rec(wtap_rec *rec, int encap);
2321
2331WS_DLL_PUBLIC
2332 void wtap_setup_ft_specific_event_rec(wtap_rec *rec, int file_type_subtype,
2333 unsigned record_type);
2334
2344WS_DLL_PUBLIC
2345 void wtap_setup_ft_specific_report_rec(wtap_rec *rec, int file_type_subtype,
2346 unsigned record_type);
2347
2355WS_DLL_PUBLIC
2356 void wtap_setup_syscall_rec(wtap_rec *rec);
2357
2365WS_DLL_PUBLIC
2366 void wtap_setup_systemd_journal_export_rec(wtap_rec *rec);
2367
2379WS_DLL_PUBLIC
2380 void wtap_setup_custom_block_rec(wtap_rec *rec, uint32_t pen,
2381 uint32_t payload_length, bool copy_allowed);
2382
2391WS_DLL_PUBLIC
2392ws_compression_type wtap_get_compression_type(wtap *wth);
2393
2394/*** get various information snippets about the current file ***/
2395
2405WS_DLL_PUBLIC
2406int64_t wtap_read_so_far(wtap *wth);
2407
2417WS_DLL_PUBLIC
2418int64_t wtap_file_size(wtap *wth, int *err);
2419
2428WS_DLL_PUBLIC
2429 unsigned wtap_snapshot_length(wtap *wth);
2430
2439WS_DLL_PUBLIC
2440 int wtap_file_type_subtype(wtap *wth);
2441
2450WS_DLL_PUBLIC
2451 int wtap_file_encap(wtap *wth);
2452
2461WS_DLL_PUBLIC
2462 int wtap_file_tsprec(wtap *wth);
2463
2472WS_DLL_PUBLIC
2473 const nstime_t* wtap_file_start_ts(wtap *wth);
2474
2483WS_DLL_PUBLIC
2484 const nstime_t* wtap_file_end_ts(wtap *wth);
2485
2493WS_DLL_PUBLIC
2494 unsigned wtap_file_get_num_shbs(wtap *wth);
2495
2508WS_DLL_PUBLIC
2509wtap_block_t wtap_file_get_shb(wtap *wth, unsigned shb_num);
2510
2521WS_DLL_PUBLIC
2522 void wtap_write_shb_comment(wtap *wth, char *comment);
2523
2535WS_DLL_PUBLIC
2536 unsigned wtap_file_get_shb_global_interface_id(wtap *wth, unsigned shb_num, uint32_t interface_id);
2537
2548WS_DLL_PUBLIC
2549 wtapng_iface_descriptions_t *wtap_file_get_idb_info(wtap *wth);
2550
2551
2558WS_DLL_PUBLIC
2559 wtapng_dpib_lookup_info_t * wtap_file_get_dpib_lookup_info(wtap *wth);
2560
2570WS_DLL_PUBLIC
2571wtap_block_t wtap_get_next_interface_description(wtap *wth);
2572
2585WS_DLL_PUBLIC
2586 void wtap_free_idb_info(wtapng_iface_descriptions_t *idb_info);
2587
2599WS_DLL_PUBLIC
2600 char *wtap_get_debug_if_descr(const wtap_block_t if_descr,
2601 const int indent,
2602 const char* line_end);
2603
2616WS_DLL_PUBLIC
2617wtap_block_t wtap_file_get_nrb(wtap *wth);
2618
2626WS_DLL_PUBLIC
2627 unsigned wtap_file_get_num_dsbs(wtap *wth);
2628
2639WS_DLL_PUBLIC
2640wtap_block_t wtap_file_get_dsb(wtap *wth, unsigned dsb_num);
2641
2650WS_DLL_PUBLIC
2651 void wtap_file_add_decryption_secrets(wtap *wth, const wtap_block_t dsb);
2652
2661WS_DLL_PUBLIC
2662 bool wtap_file_discard_decryption_secrets(wtap *wth);
2663
2671WS_DLL_PUBLIC
2672 void wtap_fdclose(wtap *wth);
2673
2684WS_DLL_PUBLIC
2685 bool wtap_fdreopen(wtap *wth, const char *filename, int *err);
2686
2694WS_DLL_PUBLIC
2695 void wtap_sequential_close(wtap *wth);
2696
2704WS_DLL_PUBLIC
2705 void wtap_close(wtap *wth);
2706
2715WS_DLL_PUBLIC
2716 bool wtap_dump_can_open(int filetype);
2717
2728WS_DLL_PUBLIC
2729 int wtap_dump_required_file_encap_type(const GArray *file_encaps);
2730
2741WS_DLL_PUBLIC
2742 bool wtap_dump_can_write_encap(int file_type_subtype, int encap);
2743
2752WS_DLL_PUBLIC
2753 bool wtap_dump_can_compress(int file_type_subtype);
2754
2765WS_DLL_PUBLIC
2766 void wtap_dump_params_init(wtap_dump_params *params, wtap *wth);
2767
2784WS_DLL_PUBLIC
2785 void wtap_dump_params_init_no_idbs(wtap_dump_params *params, wtap *wth);
2786
2794WS_DLL_PUBLIC
2795 void wtap_dump_params_discard_name_resolution(wtap_dump_params *params);
2796
2804WS_DLL_PUBLIC
2805 void wtap_dump_params_discard_decryption_secrets(wtap_dump_params *params);
2806
2813WS_DLL_PUBLIC
2814 void wtap_dump_params_cleanup(wtap_dump_params *params);
2815
2828WS_DLL_PUBLIC
2829 wtap_dumper* wtap_dump_open(const char *filename, int file_type_subtype,
2830 ws_compression_type compression_type, const wtap_dump_params *params,
2831 int *err, char **err_info);
2832
2848WS_DLL_PUBLIC
2849 wtap_dumper* wtap_dump_open_tempfile(const char *tmpdir, char **filenamep,
2850 const char *pfx,
2851 int file_type_subtype, ws_compression_type compression_type,
2852 const wtap_dump_params *params, int *err, char **err_info);
2853
2866WS_DLL_PUBLIC
2867 wtap_dumper* wtap_dump_fdopen(int fd, int file_type_subtype,
2868 ws_compression_type compression_type, const wtap_dump_params *params,
2869 int *err, char **err_info);
2870
2882WS_DLL_PUBLIC
2883 wtap_dumper* wtap_dump_open_stdout(int file_type_subtype,
2884 ws_compression_type compression_type, const wtap_dump_params *params,
2885 int *err, char **err_info);
2886
2898WS_DLL_PUBLIC
2899 bool wtap_dump_add_idb(wtap_dumper *wdh, wtap_block_t idb, int *err,
2900 char **err_info);
2901
2912WS_DLL_PUBLIC
2913 bool wtap_dump(wtap_dumper *wdh, const wtap_rec *rec, int *err, char **err_info);
2914
2922WS_DLL_PUBLIC
2923 bool wtap_dump_flush(wtap_dumper *wdh, int *err);
2924
2931WS_DLL_PUBLIC
2932 int wtap_dump_file_type_subtype(const wtap_dumper *wdh);
2933
2940WS_DLL_PUBLIC
2941uint64_t wtap_get_bytes_dumped(const wtap_dumper *wdh);
2942
2949WS_DLL_PUBLIC
2950 void wtap_set_bytes_dumped(wtap_dumper *wdh, uint64_t bytes_dumped);
2951
2952 struct addrinfo;
2953
2960WS_DLL_PUBLIC
2961 bool wtap_addrinfo_list_empty(const addrinfo_lists_t *addrinfo_lists);
2962
2970WS_DLL_PUBLIC
2971 bool wtap_dump_set_addrinfo_list(wtap_dumper *wdh, addrinfo_lists_t *addrinfo_lists);
2972
2978WS_DLL_PUBLIC
2979 void wtap_dump_discard_name_resolution(wtap_dumper *wdh);
2980
2986WS_DLL_PUBLIC
2987 void wtap_dump_discard_decryption_secrets(wtap_dumper *wdh);
2988
3005WS_DLL_PUBLIC
3006 bool wtap_dump_close(wtap_dumper *wdh, bool *needs_reload,
3007 int *err, char **err_info);
3008
3025WS_DLL_PUBLIC
3026 bool wtap_dump_can_write(const GArray *file_encaps, uint32_t required_comment_types);
3027
3041WS_DLL_PUBLIC
3042 void wtap_buffer_append_epdu_tag(Buffer *buf, uint16_t epdu_tag, const uint8_t *data, uint16_t data_len);
3043
3052WS_DLL_PUBLIC
3053 void wtap_buffer_append_epdu_uint(Buffer *buf, uint16_t epdu_tag, uint32_t val);
3054
3063WS_DLL_PUBLIC
3064 void wtap_buffer_append_epdu_string(Buffer *buf, uint16_t epdu_tag, const char *val);
3065
3074WS_DLL_PUBLIC
3075 int wtap_buffer_append_epdu_end(Buffer *buf);
3076
3080 typedef enum {
3081 FT_SORT_BY_NAME,
3082 FT_SORT_BY_DESCRIPTION
3083} ft_sort_order;
3084
3101WS_DLL_PUBLIC
3102GArray *wtap_get_savable_file_types_subtypes_for_file(int file_type_subtype,
3103 const GArray *file_encaps, uint32_t required_comment_types,
3104 ft_sort_order sort_order);
3105
3117WS_DLL_PUBLIC
3118GArray *wtap_get_writable_file_types_subtypes(ft_sort_order sort_order);
3119
3120/*** various file type/subtype functions ***/
3130WS_DLL_PUBLIC
3131 const char *wtap_file_type_subtype_description(int file_type_subtype);
3132
3141WS_DLL_PUBLIC
3142 const char *wtap_file_type_subtype_name(int file_type_subtype);
3143
3153WS_DLL_PUBLIC
3154 int wtap_name_to_file_type_subtype(const char *name);
3155
3161WS_DLL_PUBLIC
3162 int wtap_pcap_file_type_subtype(void);
3163
3169WS_DLL_PUBLIC
3170 int wtap_pcap_nsec_file_type_subtype(void);
3171
3177WS_DLL_PUBLIC
3178 int wtap_pcapng_file_type_subtype(void);
3179
3190WS_DLL_PUBLIC
3191 block_support_t wtap_file_type_subtype_supports_block(int file_type_subtype,
3192 wtap_block_type_t type);
3193
3208WS_DLL_PUBLIC
3209 option_support_t wtap_file_type_subtype_supports_option(int file_type_subtype,
3210 wtap_block_type_t type, unsigned opttype);
3211
3235WS_DLL_PUBLIC
3236GSList *wtap_get_all_capture_file_extensions_list(void);
3237
3253WS_DLL_PUBLIC
3254GSList *wtap_get_all_file_extensions_list(void);
3255
3270WS_DLL_PUBLIC
3271 void wtap_free_extensions_list(GSList *extensions);
3272
3284WS_DLL_PUBLIC
3285 const char *wtap_default_file_extension(int file_type_subtype);
3286
3302WS_DLL_PUBLIC
3303GSList *wtap_get_file_extensions_list(int file_type_subtype, bool include_compressed);
3304
3313WS_DLL_PUBLIC
3314 const char *wtap_encap_name(int encap);
3315
3324WS_DLL_PUBLIC
3325 const char *wtap_encap_description(int encap);
3326
3336WS_DLL_PUBLIC
3337 int wtap_name_to_encap(const char *short_name);
3338
3347WS_DLL_PUBLIC
3348 const char* wtap_tsprec_string(int tsprec);
3349
3358WS_DLL_PUBLIC
3359 const char *wtap_strerror(int err);
3360
3361
3362/*** get available number of file types and encapsulations ***/
3371WS_DLL_PUBLIC
3372 int wtap_get_num_file_type_extensions(void);
3373
3381WS_DLL_PUBLIC
3382 int wtap_get_num_encap_types(void);
3383
3384/*** get information for file type extension ***/
3385
3397WS_DLL_PUBLIC
3398 const char *wtap_get_file_extension_type_name(int extension_type);
3399
3411WS_DLL_PUBLIC
3412GSList *wtap_get_file_extension_type_extensions(unsigned extension_type);
3413
3414/*** dynamically register new file types and encapsulations ***/
3415
3427WS_DLL_PUBLIC
3428 void wtap_register_file_type_extension(const struct file_extension_info *ei);
3429
3440 typedef struct {
3441 void (*register_wtap_module)(void);
3442} wtap_plugin;
3443
3455WS_DLL_PUBLIC
3456 void wtap_register_plugin(const wtap_plugin *plug);
3457
3458
3472WS_DLL_PUBLIC
3473 int wtap_plugins_supported(void);
3474
3475/* Registration and open-info */
3476
3482WS_DLL_PUBLIC
3483 void wtap_register_open_info(struct open_info *oi, const bool first_routine);
3484
3490WS_DLL_PUBLIC
3491 bool wtap_has_open_info(const char *name);
3492
3498WS_DLL_PUBLIC
3499 bool wtap_uses_lua_filehandler(const wtap* wth);
3500
3505WS_DLL_PUBLIC
3506 void wtap_deregister_open_info(const char *name);
3507
3508/* Type mapping and registration */
3509
3515WS_DLL_PUBLIC
3516 unsigned int open_info_name_to_type(const char *name);
3517
3523WS_DLL_PUBLIC
3524 int wtap_register_file_type_subtype(const struct file_type_subtype_info* fi);
3525
3530WS_DLL_PUBLIC
3531 void wtap_deregister_file_type_subtype(const int file_type_subtype);
3532
3533/* Encapsulation and cleanup */
3540WS_DLL_PUBLIC
3541 int wtap_register_encap_type(const char *description, const char *name);
3542
3546WS_DLL_PUBLIC
3547 void wtap_cleanup(void);
3548
3552#define WTAP_ERR_NOT_REGULAR_FILE -1
3554
3555#define WTAP_ERR_RANDOM_OPEN_PIPE -2
3557
3558#define WTAP_ERR_FILE_UNKNOWN_FORMAT -3
3560
3561#define WTAP_ERR_UNSUPPORTED -4
3564
3565#define WTAP_ERR_CANT_WRITE_TO_PIPE -5
3567
3568#define WTAP_ERR_CANT_OPEN -6
3570
3571#define WTAP_ERR_UNWRITABLE_FILE_TYPE -7
3573
3574#define WTAP_ERR_UNWRITABLE_ENCAP -8
3577
3578#define WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED -9
3580
3581#define WTAP_ERR_CANT_WRITE -10
3583
3584#define WTAP_ERR_CANT_CLOSE -11
3586
3587#define WTAP_ERR_SHORT_READ -12
3589
3590#define WTAP_ERR_BAD_FILE -13
3592
3593#define WTAP_ERR_SHORT_WRITE -14
3595
3596#define WTAP_ERR_UNC_OVERFLOW -15
3598
3599#define WTAP_ERR_RANDOM_OPEN_STDIN -16
3601
3602#define WTAP_ERR_COMPRESSION_NOT_SUPPORTED -17
3604
3605#define WTAP_ERR_CANT_SEEK -18
3607
3608#define WTAP_ERR_CANT_SEEK_COMPRESSED -19
3610
3611#define WTAP_ERR_DECOMPRESS -20
3613
3614#define WTAP_ERR_INTERNAL -21
3616
3617#define WTAP_ERR_PACKET_TOO_LARGE -22
3620
3621#define WTAP_ERR_CHECK_WSLUA -23
3624
3625#define WTAP_ERR_UNWRITABLE_REC_TYPE -24
3627
3628#define WTAP_ERR_UNWRITABLE_REC_DATA -25
3630
3631#define WTAP_ERR_DECOMPRESSION_NOT_SUPPORTED -26
3633
3634#define WTAP_ERR_TIME_STAMP_NOT_SUPPORTED -27
3637
3638#define WTAP_ERR_REC_MALFORMED -28
3641
3642#ifdef __cplusplus
3643}
3644#endif /* __cplusplus */
3645
3646#endif /* __WTAP_H__ */
3647
3648/*
3649 * Editor modelines - https://www.wireshark.org/tools/modelines.html
3650 *
3651 * Local variables:
3652 * c-basic-offset: 4
3653 * tab-width: 8
3654 * indent-tabs-mode: nil
3655 * End:
3656 *
3657 * vi: set shiftwidth=4 tabstop=8 expandtab:
3658 * :indentSize=4:tabSize=8:noTabs=true:
3659 */
array.h
buffer.h
inet_addr.h
ws_in6_addr
struct e_in6_addr ws_in6_addr
Represents a 128-bit IPv6 address.
WS_INET_CIDRADDRSTRLEN
#define WS_INET_CIDRADDRSTRLEN
Convert an IPv6 address to a string representation.
Definition inet_addr.h:155
nstime.h
Buffer
A dynamic byte buffer with adjustable start and end positions.
Definition buffer.h:30
addrinfo_lists
Aggregates lists of resolved IPv4 and IPv6 addresses for writing into a pcapng Name Resolution Block ...
Definition wtap.h:1707
addrinfo_lists::ipv6_addr_list
GList * ipv6_addr_list
Definition wtap.h:1709
addrinfo_lists::ipv4_addr_list
GList * ipv4_addr_list
Definition wtap.h:1708
ascend_phdr
Pseudo-header for Ascend WAN capture files carrying session, call, and task metadata.
Definition wtap.h:531
ascend_phdr::chunk
uint32_t chunk
Definition wtap.h:536
ascend_phdr::type
uint16_t type
Definition wtap.h:532
ascend_phdr::call_num
char call_num[64]
Definition wtap.h:535
ascend_phdr::sess
uint32_t sess
Definition wtap.h:534
ascend_phdr::task
uint32_t task
Definition wtap.h:537
ascend_phdr::user
char user[64]
Definition wtap.h:533
atm_phdr
Pseudo-header for ATM capture files carrying cell, circuit, and AAL-layer metadata.
Definition wtap.h:501
atm_phdr::vpi
uint16_t vpi
Definition wtap.h:506
atm_phdr::aal5t_len
uint16_t aal5t_len
Definition wtap.h:512
atm_phdr::aal5t_u2u
uint16_t aal5t_u2u
Definition wtap.h:511
atm_phdr::channel
uint16_t channel
Definition wtap.h:509
atm_phdr::aal2_cid
uint8_t aal2_cid
Definition wtap.h:508
atm_phdr::cells
uint16_t cells
Definition wtap.h:510
atm_phdr::subtype
uint8_t subtype
Definition wtap.h:505
atm_phdr::aal5t_chksum
uint32_t aal5t_chksum
Definition wtap.h:513
atm_phdr::aal
uint8_t aal
Definition wtap.h:503
atm_phdr::vci
uint16_t vci
Definition wtap.h:507
atm_phdr::flags
uint32_t flags
Definition wtap.h:502
atm_phdr::type
uint8_t type
Definition wtap.h:504
ber_phdr
Pseudo-header for BER (Basic Encoding Rules) data files.
Definition wtap.h:1337
ber_phdr::pathname
const char * pathname
Definition wtap.h:1338
bthci_phdr
Pseudo-header for Bluetooth HCI capture files carrying direction and channel metadata.
Definition wtap.h:1183
bthci_phdr::sent
bool sent
Definition wtap.h:1184
bthci_phdr::channel
uint32_t channel
Definition wtap.h:1185
btmon_phdr
Pseudo-header for Linux Bluetooth Monitor (WTAP_ENCAP_BLUETOOTH_LINUX_MONITOR) capture files.
Definition wtap.h:1197
btmon_phdr::opcode
uint16_t opcode
Definition wtap.h:1199
btmon_phdr::adapter_id
uint16_t adapter_id
Definition wtap.h:1198
catapult_dct2000_phdr
Pseudo-header for Catapult DCT2000 captures.
Definition wtap.h:1049
catapult_dct2000_phdr::seek_off
int64_t seek_off
Definition wtap.h:1056
catapult_dct2000_phdr::wth
struct wtap * wth
Definition wtap.h:1057
catapult_dct2000_phdr::isdn
struct isdn_phdr isdn
Definition wtap.h:1051
catapult_dct2000_phdr::p2p
struct p2p_phdr p2p
Definition wtap.h:1053
catapult_dct2000_phdr::atm
struct atm_phdr atm
Definition wtap.h:1052
cosine_phdr
Pseudo-header for CoSine Systems capture files carrying encapsulation, direction, and QoS metadata.
Definition wtap.h:919
cosine_phdr::err
uint16_t err
Definition wtap.h:927
cosine_phdr::rm
uint16_t rm
Definition wtap.h:926
cosine_phdr::direction
uint8_t direction
Definition wtap.h:921
cosine_phdr::pro
uint16_t pro
Definition wtap.h:923
cosine_phdr::if_name
char if_name[128]
Definition wtap.h:922
cosine_phdr::off
uint16_t off
Definition wtap.h:924
cosine_phdr::pri
uint16_t pri
Definition wtap.h:925
cosine_phdr::encap
uint8_t encap
Definition wtap.h:920
dte_dce_phdr
Pseudo-header for DTE/DCE capture files (LAPB, V.120, Frame Relay) carrying direction metadata.
Definition wtap.h:408
dte_dce_phdr::flags
uint8_t flags
Definition wtap.h:409
erf_ehdr
Holds a single ERF extension header word appended after the main ERF header.
Definition wtap.h:1075
erf_ehdr::ehdr
uint64_t ehdr
Definition wtap.h:1076
erf_mc_phdr
Extended pseudo-header for ERF multi-channel (MC) packet records.
Definition wtap.h:1097
erf_mc_phdr::subhdr
union erf_mc_phdr::@031203371227322325321065306065226045005243346162 subhdr
Protocol-specific subheader union.
erf_mc_phdr::eth_hdr
struct wtap_erf_eth_hdr eth_hdr
Definition wtap.h:1108
erf_mc_phdr::ehdr_list
struct erf_ehdr ehdr_list[16]
Definition wtap.h:1100
erf_mc_phdr::phdr
struct erf_phdr phdr
Definition wtap.h:1098
erf_mc_phdr::aal2_hdr
uint32_t aal2_hdr
Definition wtap.h:1110
erf_mc_phdr::mc_hdr
uint32_t mc_hdr
Definition wtap.h:1109
erf_phdr
Pseudo-header for Endace ERF (Extensible Record Format) capture files carrying timestamp and record m...
Definition wtap.h:1063
erf_phdr::lctr
uint16_t lctr
Definition wtap.h:1068
erf_phdr::rlen
uint16_t rlen
Definition wtap.h:1067
erf_phdr::type
uint8_t type
Definition wtap.h:1065
erf_phdr::flags
uint8_t flags
Definition wtap.h:1066
erf_phdr::ts
uint64_t ts
Definition wtap.h:1064
erf_phdr::wlen
uint16_t wlen
Definition wtap.h:1069
eth_phdr
Pseudo-header for Ethernet capture files carrying FCS length metadata.
Definition wtap.h:399
eth_phdr::fcs_len
int fcs_len
Definition wtap.h:400
file_extension_info
For registering extensions used for file formats.
Definition wtap.h:1820
file_extension_info::extensions
const char * extensions
Definition wtap.h:1823
file_extension_info::name
const char * name
Definition wtap.h:1821
file_extension_info::is_capture_file
bool is_capture_file
Definition wtap.h:1822
file_type_subtype_info
Describes a single capture file type/subtype, including its metadata, capability flags,...
Definition wtap.h:2037
file_type_subtype_info::wslua_info
wtap_wslua_file_info_t * wslua_info
Definition wtap.h:2098
file_type_subtype_info::name
const char * name
Definition wtap.h:2047
file_type_subtype_info::additional_file_extensions
const char * additional_file_extensions
Definition wtap.h:2061
file_type_subtype_info::can_write_encap
int(* can_write_encap)(int)
Definition wtap.h:2086
file_type_subtype_info::supported_blocks
const struct supported_block_type * supported_blocks
Definition wtap.h:2076
file_type_subtype_info::writing_must_seek
bool writing_must_seek
Definition wtap.h:2066
file_type_subtype_info::description
const char * description
Definition wtap.h:2041
file_type_subtype_info::dump_open
bool(* dump_open)(wtap_dumper *, int *, char **)
Definition wtap.h:2092
file_type_subtype_info::num_supported_blocks
size_t num_supported_blocks
Definition wtap.h:2071
file_type_subtype_info::default_file_extension
const char * default_file_extension
Definition wtap.h:2053
gsm_um_phdr
Pseudo-header for GSM Um air interface (WTAP_ENCAP_GSM_UM) capture files.
Definition wtap.h:1221
gsm_um_phdr::uplink
bool uplink
Definition wtap.h:1222
gsm_um_phdr::bsic
uint8_t bsic
Definition wtap.h:1225
gsm_um_phdr::tdma_frame
uint32_t tdma_frame
Definition wtap.h:1227
gsm_um_phdr::arfcn
uint16_t arfcn
Definition wtap.h:1226
gsm_um_phdr::channel
uint8_t channel
Definition wtap.h:1223
gsm_um_phdr::error
uint8_t error
Definition wtap.h:1228
gsm_um_phdr::timeshift
uint16_t timeshift
Definition wtap.h:1229
hashipv4
Hash table entry for a resolved or unresolved IPv4 address.
Definition wtap.h:1683
hashipv4::ip
char ip[WS_INET_ADDRSTRLEN]
Definition wtap.h:1686
hashipv4::cidr_addr
char cidr_addr[WS_INET_CIDRADDRSTRLEN]
Definition wtap.h:1688
hashipv4::name
char name[256]
Definition wtap.h:1687
hashipv4::addr
unsigned addr
Definition wtap.h:1684
hashipv4::flags
uint8_t flags
Definition wtap.h:1685
hashipv6
Hash table entry for a resolved or unresolved IPv6 address.
Definition wtap.h:1695
hashipv6::name
char name[256]
Definition wtap.h:1699
hashipv6::ip6
char ip6[WS_INET6_ADDRSTRLEN]
Definition wtap.h:1698
hashipv6::flags
uint8_t flags
Definition wtap.h:1697
hashipv6::addr
uint8_t addr[16]
Definition wtap.h:1696
hashipv6::cidr_addr
char cidr_addr[WS_INET6_CIDRADDRSTRLEN]
Definition wtap.h:1700
i2c_phdr
Pseudo-header for I2C bus capture files carrying bus number, event type, and flag metadata.
Definition wtap.h:1212
i2c_phdr::flags
uint32_t flags
Definition wtap.h:1215
i2c_phdr::bus
uint8_t bus
Definition wtap.h:1214
i2c_phdr::is_event
uint8_t is_event
Definition wtap.h:1213
idb
Definition pcapio.c:117
ieee_802_11_fhss
PHY metadata for 802.11 legacy FHSS (Frequency Hopping Spread Spectrum) captures.
Definition wtap.h:596
ieee_802_11_fhss::has_hop_pattern
unsigned has_hop_pattern
Definition wtap.h:598
ieee_802_11_fhss::hop_set
uint8_t hop_set
Definition wtap.h:601
ieee_802_11_fhss::hop_index
uint8_t hop_index
Definition wtap.h:603
ieee_802_11_fhss::hop_pattern
uint8_t hop_pattern
Definition wtap.h:602
ieee_802_11_fhss::has_hop_set
unsigned has_hop_set
Definition wtap.h:597
ieee_802_11_fhss::has_hop_index
unsigned has_hop_index
Definition wtap.h:599
ieee_802_11_phdr
Pseudo-header for 802.11 wireless capture files carrying full PHY, signal, and frame metadata.
Definition wtap.h:850
ieee_802_11_phdr::has_noise_percent
unsigned has_noise_percent
Definition wtap.h:862
ieee_802_11_phdr::has_frequency
unsigned has_frequency
Definition wtap.h:859
ieee_802_11_phdr::frequency
uint32_t frequency
Definition wtap.h:872
ieee_802_11_phdr::has_signal_dbm
unsigned has_signal_dbm
Definition wtap.h:863
ieee_802_11_phdr::has_signal_db
unsigned has_signal_db
Definition wtap.h:865
ieee_802_11_phdr::noise_dbm
int8_t noise_dbm
Definition wtap.h:877
ieee_802_11_phdr::phy
unsigned phy
Definition wtap.h:855
ieee_802_11_phdr::has_aggregate_info
unsigned has_aggregate_info
Definition wtap.h:868
ieee_802_11_phdr::has_signal_percent
unsigned has_signal_percent
Definition wtap.h:861
ieee_802_11_phdr::has_channel
unsigned has_channel
Definition wtap.h:858
ieee_802_11_phdr::phy_info
union ieee_802_11_phy_info phy_info
Definition wtap.h:856
ieee_802_11_phdr::has_zero_length_psdu_type
unsigned has_zero_length_psdu_type
Definition wtap.h:869
ieee_802_11_phdr::datapad
unsigned datapad
Definition wtap.h:853
ieee_802_11_phdr::decrypted
unsigned decrypted
Definition wtap.h:852
ieee_802_11_phdr::fcs_len
int fcs_len
Definition wtap.h:851
ieee_802_11_phdr::channel
uint16_t channel
Definition wtap.h:871
ieee_802_11_phdr::signal_db
uint8_t signal_db
Definition wtap.h:878
ieee_802_11_phdr::has_tsf_timestamp
unsigned has_tsf_timestamp
Definition wtap.h:867
ieee_802_11_phdr::aggregate_id
uint32_t aggregate_id
Definition wtap.h:882
ieee_802_11_phdr::data_rate
uint16_t data_rate
Definition wtap.h:873
ieee_802_11_phdr::signal_percent
uint8_t signal_percent
Definition wtap.h:874
ieee_802_11_phdr::has_data_rate
unsigned has_data_rate
Definition wtap.h:860
ieee_802_11_phdr::zero_length_psdu_type
uint8_t zero_length_psdu_type
Definition wtap.h:883
ieee_802_11_phdr::noise_percent
uint8_t noise_percent
Definition wtap.h:875
ieee_802_11_phdr::tsf_timestamp
uint64_t tsf_timestamp
Definition wtap.h:880
ieee_802_11_phdr::has_noise_db
unsigned has_noise_db
Definition wtap.h:866
ieee_802_11_phdr::has_noise_dbm
unsigned has_noise_dbm
Definition wtap.h:864
ieee_802_11_phdr::no_a_msdus
unsigned no_a_msdus
Definition wtap.h:854
ieee_802_11_phdr::noise_db
uint8_t noise_db
Definition wtap.h:879
ieee_802_11_phdr::signal_dbm
int8_t signal_dbm
Definition wtap.h:876
ieee_802_11_phdr::aggregate_flags
uint32_t aggregate_flags
Definition wtap.h:881
ieee_802_11a
PHY metadata for 802.11a captures.
Definition wtap.h:620
ieee_802_11a::channel_type
unsigned channel_type
Definition wtap.h:624
ieee_802_11a::has_channel_type
unsigned has_channel_type
Definition wtap.h:621
ieee_802_11a::has_turbo_type
unsigned has_turbo_type
Definition wtap.h:622
ieee_802_11a::turbo_type
unsigned turbo_type
Definition wtap.h:625
ieee_802_11ac
PHY metadata for 802.11ac (VHT) captures.
Definition wtap.h:721
ieee_802_11ac::fec
uint8_t fec
Definition wtap.h:742
ieee_802_11ac::has_short_gi
unsigned has_short_gi
Definition wtap.h:724
ieee_802_11ac::short_gi_nsym_disambig
unsigned short_gi_nsym_disambig
Definition wtap.h:736
ieee_802_11ac::txop_ps_not_allowed
unsigned txop_ps_not_allowed
Definition wtap.h:734
ieee_802_11ac::stbc
unsigned stbc
Definition wtap.h:733
ieee_802_11ac::nss
uint8_t nss[4]
Definition wtap.h:741
ieee_802_11ac::partial_aid
uint16_t partial_aid
Definition wtap.h:744
ieee_802_11ac::has_beamformed
unsigned has_beamformed
Definition wtap.h:727
ieee_802_11ac::has_ldpc_extra_ofdm_symbol
unsigned has_ldpc_extra_ofdm_symbol
Definition wtap.h:726
ieee_802_11ac::mcs
uint8_t mcs[4]
Definition wtap.h:740
ieee_802_11ac::has_bandwidth
unsigned has_bandwidth
Definition wtap.h:728
ieee_802_11ac::has_stbc
unsigned has_stbc
Definition wtap.h:722
ieee_802_11ac::has_partial_aid
unsigned has_partial_aid
Definition wtap.h:731
ieee_802_11ac::has_fec
unsigned has_fec
Definition wtap.h:729
ieee_802_11ac::beamformed
unsigned beamformed
Definition wtap.h:738
ieee_802_11ac::short_gi
unsigned short_gi
Definition wtap.h:735
ieee_802_11ac::has_short_gi_nsym_disambig
unsigned has_short_gi_nsym_disambig
Definition wtap.h:725
ieee_802_11ac::bandwidth
uint8_t bandwidth
Definition wtap.h:739
ieee_802_11ac::has_group_id
unsigned has_group_id
Definition wtap.h:730
ieee_802_11ac::group_id
uint8_t group_id
Definition wtap.h:743
ieee_802_11ac::has_txop_ps_not_allowed
unsigned has_txop_ps_not_allowed
Definition wtap.h:723
ieee_802_11ac::ldpc_extra_ofdm_symbol
unsigned ldpc_extra_ofdm_symbol
Definition wtap.h:737
ieee_802_11ad
PHY metadata for 802.11ad (WiGig/DMG) captures.
Definition wtap.h:764
ieee_802_11ad::mcs
uint8_t mcs
Definition wtap.h:767
ieee_802_11ad::has_mcs_index
unsigned has_mcs_index
Definition wtap.h:765
ieee_802_11ax
PHY metadata for 802.11ax (HE — High Efficiency) captures.
Definition wtap.h:774
ieee_802_11ax::bwru
uint8_t bwru
Definition wtap.h:781
ieee_802_11ax::gi
uint8_t gi
Definition wtap.h:782
ieee_802_11ax::has_gi
unsigned has_gi
Definition wtap.h:777
ieee_802_11ax::mcs
uint8_t mcs
Definition wtap.h:780
ieee_802_11ax::nsts
uint8_t nsts
Definition wtap.h:779
ieee_802_11ax::has_bwru
unsigned has_bwru
Definition wtap.h:776
ieee_802_11ax::has_mcs_index
unsigned has_mcs_index
Definition wtap.h:775
ieee_802_11b
PHY metadata for 802.11b captures.
Definition wtap.h:610
ieee_802_11b::has_short_preamble
unsigned has_short_preamble
Definition wtap.h:611
ieee_802_11b::short_preamble
bool short_preamble
Definition wtap.h:613
ieee_802_11be_user_info
Per-user PHY metadata for a single user within an 802.11be (EHT) MU transmission.
Definition wtap.h:789
ieee_802_11be_user_info::data_for_this_user
unsigned data_for_this_user
Definition wtap.h:797
ieee_802_11be_user_info::coding_known
unsigned coding_known
Definition wtap.h:792
ieee_802_11be_user_info::mcs_known
unsigned mcs_known
Definition wtap.h:791
ieee_802_11be_user_info::sta_id
unsigned sta_id
Definition wtap.h:798
ieee_802_11be_user_info::spatial_config_known
unsigned spatial_config_known
Definition wtap.h:796
ieee_802_11be_user_info::ldpc_coding
unsigned ldpc_coding
Definition wtap.h:799
ieee_802_11be_user_info::bf_known
unsigned bf_known
Definition wtap.h:795
ieee_802_11be_user_info::nsts_known
unsigned nsts_known
Definition wtap.h:794
ieee_802_11be_user_info::sta_id_known
unsigned sta_id_known
Definition wtap.h:790
ieee_802_11be_user_info::mcs
unsigned mcs
Definition wtap.h:800
ieee_802_11be_user_info::rsv
unsigned rsv
Definition wtap.h:802
ieee_802_11be_user_info::nsts
unsigned nsts
Definition wtap.h:801
ieee_802_11be_user_info::beamform
unsigned beamform
Definition wtap.h:803
ieee_802_11be_user_info::rsv_known
unsigned rsv_known
Definition wtap.h:793
ieee_802_11be_user_info::rsv2
unsigned rsv2
Definition wtap.h:804
ieee_802_11be
PHY metadata for 802.11be (EHT — Extremely High Throughput) captures.
Definition wtap.h:812
ieee_802_11be::bandwidth
uint8_t bandwidth
Definition wtap.h:817
ieee_802_11be::has_bandwidth
unsigned has_bandwidth
Definition wtap.h:815
ieee_802_11be::has_ru_mru_size
unsigned has_ru_mru_size
Definition wtap.h:813
ieee_802_11be::ru_mru_size
uint8_t ru_mru_size
Definition wtap.h:818
ieee_802_11be::has_gi
unsigned has_gi
Definition wtap.h:814
ieee_802_11be::gi
uint8_t gi
Definition wtap.h:819
ieee_802_11be::num_users
uint8_t num_users
Definition wtap.h:820
ieee_802_11be::user
struct ieee_802_11be_user_info user[4]
Definition wtap.h:821
ieee_802_11g
PHY metadata for 802.11g OFDM captures.
Definition wtap.h:655
ieee_802_11g::mode
uint32_t mode
Definition wtap.h:658
ieee_802_11g::has_mode
unsigned has_mode
Definition wtap.h:656
ieee_802_11n
PHY metadata for 802.11n (HT) captures.
Definition wtap.h:670
ieee_802_11n::fec
unsigned fec
Definition wtap.h:683
ieee_802_11n::short_gi
unsigned short_gi
Definition wtap.h:681
ieee_802_11n::has_fec
unsigned has_fec
Definition wtap.h:675
ieee_802_11n::has_greenfield
unsigned has_greenfield
Definition wtap.h:674
ieee_802_11n::mcs_index
uint16_t mcs_index
Definition wtap.h:679
ieee_802_11n::has_stbc_streams
unsigned has_stbc_streams
Definition wtap.h:676
ieee_802_11n::ness
unsigned ness
Definition wtap.h:685
ieee_802_11n::greenfield
unsigned greenfield
Definition wtap.h:682
ieee_802_11n::has_ness
unsigned has_ness
Definition wtap.h:677
ieee_802_11n::stbc_streams
unsigned stbc_streams
Definition wtap.h:684
ieee_802_11n::has_mcs_index
unsigned has_mcs_index
Definition wtap.h:671
ieee_802_11n::has_bandwidth
unsigned has_bandwidth
Definition wtap.h:672
ieee_802_11n::bandwidth
unsigned bandwidth
Definition wtap.h:680
ieee_802_11n::has_short_gi
unsigned has_short_gi
Definition wtap.h:673
irda_phdr
Pseudo-header carrying IrDA packet type metadata for captured IrDA frames.
Definition wtap.h:954
irda_phdr::pkttype
uint16_t pkttype
Definition wtap.h:955
isdn_phdr
Pseudo-header for ISDN capture files carrying direction and channel metadata.
Definition wtap.h:415
isdn_phdr::uton
bool uton
Definition wtap.h:416
isdn_phdr::channel
uint8_t channel
Definition wtap.h:417
k12_phdr
Pseudo-header for Tektronix K12 capture files carrying input port, stack, and protocol metadata.
Definition wtap.h:1015
k12_phdr::input_name
const char * input_name
Definition wtap.h:1017
k12_phdr::input
uint32_t input
Definition wtap.h:1016
k12_phdr::stuff
void * stuff
Definition wtap.h:1023
k12_phdr::extra_info
uint8_t * extra_info
Definition wtap.h:1021
k12_phdr::input_info
k12_input_info_t input_info
Definition wtap.h:1020
k12_phdr::extra_length
uint32_t extra_length
Definition wtap.h:1022
k12_phdr::input_type
uint32_t input_type
Definition wtap.h:1019
k12_phdr::stack_file
const char * stack_file
Definition wtap.h:1018
l1event_phdr
Pseudo-header for layer 1 event (WTAP_ENCAP_LAYER1_EVENT) capture files carrying signal direction met...
Definition wtap.h:1205
l1event_phdr::uton
bool uton
Definition wtap.h:1206
lapd_phdr
LAPD pseudo-header for packet metadata.
Definition wtap.h:1037
lapd_phdr::we_network
uint8_t we_network
Definition wtap.h:1039
lapd_phdr::pkttype
uint16_t pkttype
Definition wtap.h:1038
llcp_phdr
Pseudo-header for NFC Logical Link Control Protocol (LLCP) capture files.
Definition wtap.h:1280
llcp_phdr::adapter
uint8_t adapter
Definition wtap.h:1281
llcp_phdr::flags
uint8_t flags
Definition wtap.h:1282
logcat_phdr
Pseudo-header for Android Logcat (WTAP_ENCAP_LOGCAT) capture files.
Definition wtap.h:1288
logcat_phdr::version
int version
Definition wtap.h:1289
mmodule_phdr
Pseudo-header for M-Module binary files.
Definition wtap.h:1345
mmodule_phdr::chunktype
uint8_t chunktype
Definition wtap.h:1346
mtp2_phdr
Pseudo-header carrying MTP2 link metadata for captured SS7 MTP2 frames.
Definition wtap.h:978
mtp2_phdr::annex_a_used
uint8_t annex_a_used
Definition wtap.h:980
mtp2_phdr::link_number
uint16_t link_number
Definition wtap.h:981
mtp2_phdr::sent
uint8_t sent
Definition wtap.h:979
netmon_phdr
Pseudo-header metadata for packets captured in NetMon (Network Monitor) files.
Definition wtap.h:1299
netmon_phdr::sub_encap
unsigned sub_encap
Definition wtap.h:1304
netmon_phdr::description
uint8_t * description
Definition wtap.h:1302
netmon_phdr::title
uint8_t * title
Definition wtap.h:1300
netmon_phdr::descLength
uint32_t descLength
Definition wtap.h:1301
nettl_phdr
Pseudo-header for HP-UX nettl capture files carrying subsystem, device, and process metadata.
Definition wtap.h:961
nettl_phdr::pid
int32_t pid
Definition wtap.h:965
nettl_phdr::subsys
uint16_t subsys
Definition wtap.h:962
nettl_phdr::devid
uint32_t devid
Definition wtap.h:963
nettl_phdr::kind
uint32_t kind
Definition wtap.h:964
nettl_phdr::uid
uint32_t uid
Definition wtap.h:966
nokia_phdr
Pseudo-header for Nokia firewall capture files, extending the Ethernet pseudo-header with device-spec...
Definition wtap.h:1270
nokia_phdr::eth
struct eth_phdr eth
Definition wtap.h:1271
nokia_phdr::stuff
uint8_t stuff[4]
Definition wtap.h:1272
nstime_t
Definition nstime.h:26
nstr_phdr
Pseudo-header for Citrix NetScaler nstrace capture files carrying field offset and record layout meta...
Definition wtap.h:1245
nstr_phdr::dir_len
uint8_t dir_len
Definition wtap.h:1251
nstr_phdr::src_vmname_len_offset
uint8_t src_vmname_len_offset
Definition wtap.h:1261
nstr_phdr::clflags_offset
uint8_t clflags_offset
Definition wtap.h:1260
nstr_phdr::srcnodeid_offset
uint8_t srcnodeid_offset
Definition wtap.h:1258
nstr_phdr::ns_activity_offset
uint8_t ns_activity_offset
Definition wtap.h:1263
nstr_phdr::pcb_offset
uint8_t pcb_offset
Definition wtap.h:1253
nstr_phdr::dst_vmname_len_offset
uint8_t dst_vmname_len_offset
Definition wtap.h:1262
nstr_phdr::coreid_offset
uint8_t coreid_offset
Definition wtap.h:1257
nstr_phdr::data_offset
uint8_t data_offset
Definition wtap.h:1264
nstr_phdr::rec_type
uint8_t rec_type
Definition wtap.h:1255
nstr_phdr::destnodeid_offset
uint8_t destnodeid_offset
Definition wtap.h:1259
nstr_phdr::nicno_offset
uint8_t nicno_offset
Definition wtap.h:1248
nstr_phdr::rec_offset
int64_t rec_offset
Definition wtap.h:1246
nstr_phdr::nicno_len
uint8_t nicno_len
Definition wtap.h:1249
nstr_phdr::l_pcb_offset
uint8_t l_pcb_offset
Definition wtap.h:1254
nstr_phdr::vlantag_offset
uint8_t vlantag_offset
Definition wtap.h:1256
nstr_phdr::rec_len
int32_t rec_len
Definition wtap.h:1247
nstr_phdr::dir_offset
uint8_t dir_offset
Definition wtap.h:1250
nstr_phdr::eth_offset
uint16_t eth_offset
Definition wtap.h:1252
open_info
Information about a given file type that applies to all subtypes of the file type.
Definition wtap.h:1928
open_info::name
const char * name
Definition wtap.h:1929
open_info::open_routine
wtap_open_routine_t open_routine
Definition wtap.h:1931
open_info::wslua_data
void * wslua_data
Definition wtap.h:1934
open_info::extensions
const char * extensions
Definition wtap.h:1932
open_info::type
wtap_open_type type
Definition wtap.h:1930
open_info::extensions_set
char ** extensions_set
Definition wtap.h:1933
p2p_phdr
Pseudo-header for point-to-point link capture files carrying packet direction metadata.
Definition wtap.h:543
p2p_phdr::sent
bool sent
Definition wtap.h:544
procmon_phdr
Pseudo-header for Microsoft ProcMon (Process Monitor) captures.
Definition wtap.h:1325
procmon_phdr::process_array
struct procmon_process_t * process_array
Definition wtap.h:1328
procmon_phdr::process_index_map
uint32_t * process_index_map
Definition wtap.h:1326
procmon_phdr::process_array_size
size_t process_array_size
Definition wtap.h:1329
procmon_phdr::process_index_map_size
size_t process_index_map_size
Definition wtap.h:1327
procmon_phdr::system_bitness
bool system_bitness
Definition wtap.h:1330
procmon_process_t
Describes a single process observed by Process Monitor, including its identity, security context,...
Definition procmon.h:30
rec_header
Definition ngsniffer.c:82
sita_phdr
Pseudo-header for SITA WAN capture files carrying signal, error, and protocol metadata.
Definition wtap.h:1172
sita_phdr::sita_signals
uint8_t sita_signals
Definition wtap.h:1174
sita_phdr::sita_flags
uint8_t sita_flags
Definition wtap.h:1173
sita_phdr::sita_errors2
uint8_t sita_errors2
Definition wtap.h:1176
sita_phdr::sita_proto
uint8_t sita_proto
Definition wtap.h:1177
sita_phdr::sita_errors1
uint8_t sita_errors1
Definition wtap.h:1175
supported_block_type
Describes a single block type supported by a file format, including its option support.
Definition wtap.h:2024
supported_block_type::supported_options
const struct supported_option_type * supported_options
Definition wtap.h:2028
supported_block_type::support
block_support_t support
Definition wtap.h:2026
supported_block_type::type
wtap_block_type_t type
Definition wtap.h:2025
supported_block_type::num_supported_options
size_t num_supported_options
Definition wtap.h:2027
supported_option_type
Entry describing support level for a specific option type.
Definition wtap.h:1991
supported_option_type::opt
unsigned opt
Definition wtap.h:1992
supported_option_type::support
option_support_t support
Definition wtap.h:1993
wtap_custom_block_header
Header metadata for a pcapng Custom Block record.
Definition wtap.h:1567
wtap_custom_block_header::pen
uint32_t pen
Definition wtap.h:1568
wtap_custom_block_header::length
uint32_t length
Definition wtap.h:1569
wtap_custom_block_header::copy_allowed
bool copy_allowed
Definition wtap.h:1570
wtap_dump_params
Definition wtap.h:1728
wtap_dump_params::nrbs_growing
const GArray * nrbs_growing
Definition wtap.h:1737
wtap_dump_params::dsbs_growing
const GArray * dsbs_growing
Definition wtap.h:1741
wtap_dump_params::tsprec
int tsprec
Definition wtap.h:1731
wtap_dump_params::shb_hdrs
GArray * shb_hdrs
Definition wtap.h:1732
wtap_dump_params::encap
int encap
Definition wtap.h:1729
wtap_dump_params::dont_copy_idbs
bool dont_copy_idbs
Definition wtap.h:1750
wtap_dump_params::dsbs_initial
GArray * dsbs_initial
Definition wtap.h:1740
wtap_dump_params::idb_inf
wtapng_iface_descriptions_t * idb_inf
Definition wtap.h:1736
wtap_dump_params::mevs_growing
const GArray * mevs_growing
Definition wtap.h:1744
wtap_dump_params::shb_iface_to_global
const GArray * shb_iface_to_global
Definition wtap.h:1733
wtap_dump_params::dpibs_growing
const GArray * dpibs_growing
Definition wtap.h:1747
wtap_dump_params::snaplen
int snaplen
Definition wtap.h:1730
wtap_dumper
Wiretap dumper handle and associated state.
Definition wtap_module.h:163
wtap_erf_eth_hdr
ERF Ethernet subheader providing the frame offset for Ethernet ERF records.
Definition wtap.h:1084
wtap_erf_eth_hdr::pad
uint8_t pad
Definition wtap.h:1086
wtap_erf_eth_hdr::offset
uint8_t offset
Definition wtap.h:1085
wtap_ft_specific_header
Header metadata for a file-type-specific event or report record.
Definition wtap.h:1532
wtap_ft_specific_header::pseudo_header
union wtap_pseudo_header pseudo_header
Definition wtap.h:1537
wtap_ft_specific_header::record_len
uint32_t record_len
Definition wtap.h:1535
wtap_ft_specific_header::file_type_subtype
int file_type_subtype
Definition wtap.h:1533
wtap_ft_specific_header::record_type
unsigned record_type
Definition wtap.h:1534
wtap_packet_header
Header metadata for a captured network packet.
Definition wtap.h:1449
wtap_packet_header::caplen
uint32_t caplen
Definition wtap.h:1450
wtap_packet_header::interface_id
uint32_t interface_id
Definition wtap.h:1453
wtap_packet_header::pkt_encap
int pkt_encap
Definition wtap.h:1452
wtap_packet_header::pseudo_header
union wtap_pseudo_header pseudo_header
Definition wtap.h:1455
wtap_packet_header::len
uint32_t len
Definition wtap.h:1451
wtap_plugin
Plugin registration callback table.
Definition wtap.h:3440
wtap_reader
Definition file_wrappers.c:96
wtap_rec
Represents a single capture record read from or written to a capture file, regardless of record type.
Definition wtap.h:1600
wtap_rec::syscall_header
wtap_syscall_header syscall_header
Definition wtap.h:1614
wtap_rec::block_was_modified
bool block_was_modified
Definition wtap.h:1628
wtap_rec::rec_type
unsigned rec_type
Definition wtap.h:1601
wtap_rec::section_number
unsigned section_number
Definition wtap.h:1603
wtap_rec::rec_type_name
const char * rec_type_name
Definition wtap.h:1606
wtap_rec::packet_header
wtap_packet_header packet_header
Definition wtap.h:1612
wtap_rec::block
wtap_block_t block
Block-level metadata associated with this record.
Definition wtap.h:1626
wtap_rec::ft_specific_header
wtap_ft_specific_header ft_specific_header
Definition wtap.h:1613
wtap_rec::custom_block_header
wtap_custom_block_header custom_block_header
Definition wtap.h:1616
wtap_rec::systemd_journal_export_header
wtap_systemd_journal_export_header systemd_journal_export_header
Definition wtap.h:1615
wtap_rec::tsprec
int tsprec
Definition wtap.h:1605
wtap_rec::options_buf
Buffer options_buf
Reusable buffer holding serialized file-type-specific option data for this record.
Definition wtap.h:1635
wtap_rec::presence_flags
uint32_t presence_flags
Definition wtap.h:1602
wtap_rec::ts
nstime_t ts
Definition wtap.h:1604
wtap_rec::data
Buffer data
Definition wtap.h:1637
wtap_syscall_header
Header metadata for a system call record (e.g. from Sysdig/Falco captures).
Definition wtap.h:1543
wtap_syscall_header::cpu_id
uint16_t cpu_id
Definition wtap.h:1554
wtap_syscall_header::event_data_len
uint32_t event_data_len
Definition wtap.h:1550
wtap_syscall_header::pathname
const char * pathname
Definition wtap.h:1544
wtap_syscall_header::thread_id
uint64_t thread_id
Definition wtap.h:1548
wtap_syscall_header::timestamp
uint64_t timestamp
Definition wtap.h:1547
wtap_syscall_header::nparams
uint32_t nparams
Definition wtap.h:1551
wtap_syscall_header::flags
uint32_t flags
Definition wtap.h:1552
wtap_syscall_header::record_type
unsigned record_type
Definition wtap.h:1545
wtap_syscall_header::event_type
uint16_t event_type
Definition wtap.h:1553
wtap_syscall_header::event_len
uint32_t event_len
Definition wtap.h:1549
wtap_syscall_header::byte_order
int byte_order
Definition wtap.h:1546
wtap_systemd_journal_export_header
Header metadata for a systemd journal export record.
Definition wtap.h:1560
wtap_systemd_journal_export_header::record_len
uint32_t record_len
Definition wtap.h:1561
wtap_wslua_file_info
Companion metadata block for Lua-based file writers registered via wslua, carrying the write-open cal...
Definition wtap.h:1777
wtap_wslua_file_info::wslua_data
void * wslua_data
Definition wtap.h:1779
wtap_wslua_file_info::wslua_can_write_encap
int(* wslua_can_write_encap)(int, void *)
Definition wtap.h:1778
wtap
Definition wtap_module.h:58
wtap::add_new_secrets
wtap_new_secrets_callback_t add_new_secrets
Definition wtap_module.h:113
wtap::app_env_var_prefix
const char * app_env_var_prefix
Definition wtap_module.h:74
wtap::file_type_subtype
int file_type_subtype
Definition wtap_module.h:62
wtap::add_new_ipv4
wtap_new_ipv4_callback_t add_new_ipv4
Definition wtap_module.h:111
wtap::add_new_ipv6
wtap_new_ipv6_callback_t add_new_ipv6
Definition wtap_module.h:112
ieee_802_11_phy_info
Union representing physical layer information for IEEE 802.11 variants.
Definition wtap.h:835
ieee_802_11_phy_info::info_11_fhss
struct ieee_802_11_fhss info_11_fhss
Definition wtap.h:836
ieee_802_11_phy_info::info_11ac
struct ieee_802_11ac info_11ac
Definition wtap.h:841
ieee_802_11_phy_info::info_11n
struct ieee_802_11n info_11n
Definition wtap.h:840
ieee_802_11_phy_info::info_11g
struct ieee_802_11g info_11g
Definition wtap.h:839
ieee_802_11_phy_info::info_11ax
struct ieee_802_11ax info_11ax
Definition wtap.h:843
ieee_802_11_phy_info::info_11b
struct ieee_802_11b info_11b
Definition wtap.h:837
ieee_802_11_phy_info::info_11be
struct ieee_802_11be info_11be
Definition wtap.h:844
ieee_802_11_phy_info::info_11ad
struct ieee_802_11ad info_11ad
Definition wtap.h:842
ieee_802_11_phy_info::info_11a
struct ieee_802_11a info_11a
Definition wtap.h:838
k12_input_info_t
Pseudo-header metadata for packets in K12 capture files.
Definition wtap.h:991
k12_input_info_t::vp
uint16_t vp
Definition wtap.h:998
k12_input_info_t::cid
uint16_t cid
Definition wtap.h:1000
k12_input_info_t::vc
uint16_t vc
Definition wtap.h:999
k12_input_info_t::ds0mask
uint32_t ds0mask
DS0 channel bitmask.
Definition wtap.h:1009
netmon_phdr::sub_wtap_pseudo_header
Protocol-specific subheader union.
Definition wtap.h:1311
netmon_phdr::sub_wtap_pseudo_header::eth
struct eth_phdr eth
Definition wtap.h:1312
netmon_phdr::sub_wtap_pseudo_header::atm
struct atm_phdr atm
Definition wtap.h:1313
netmon_phdr::sub_wtap_pseudo_header::ieee_802_11
struct ieee_802_11_phdr ieee_802_11
Definition wtap.h:1314
wtap_pseudo_header
Top-level union of all Wiretap pseudo-headers.
Definition wtap.h:1355
wtap_pseudo_header::l1event
struct l1event_phdr l1event
Definition wtap.h:1374
wtap_pseudo_header::lapd
struct lapd_phdr lapd
Definition wtap.h:1368
wtap_pseudo_header::i2c
struct i2c_phdr i2c
Definition wtap.h:1375
wtap_pseudo_header::p2p
struct p2p_phdr p2p
Definition wtap.h:1361
wtap_pseudo_header::ieee_802_11
struct ieee_802_11_phdr ieee_802_11
Definition wtap.h:1362
wtap_pseudo_header::k12
struct k12_phdr k12
Definition wtap.h:1367
wtap_pseudo_header::btmon
struct btmon_phdr btmon
Definition wtap.h:1373
wtap_pseudo_header::nokia
struct nokia_phdr nokia
Definition wtap.h:1378
wtap_pseudo_header::ber
struct ber_phdr ber
Definition wtap.h:1383
wtap_pseudo_header::sita
struct sita_phdr sita
Definition wtap.h:1371
wtap_pseudo_header::bthci
struct bthci_phdr bthci
Definition wtap.h:1372
wtap_pseudo_header::llcp
struct llcp_phdr llcp
Definition wtap.h:1379
wtap_pseudo_header::mtp2
struct mtp2_phdr mtp2
Definition wtap.h:1366
wtap_pseudo_header::logcat
struct logcat_phdr logcat
Definition wtap.h:1380
wtap_pseudo_header::atm
struct atm_phdr atm
Definition wtap.h:1359
wtap_pseudo_header::dte_dce
struct dte_dce_phdr dte_dce
Definition wtap.h:1357
wtap_pseudo_header::isdn
struct isdn_phdr isdn
Definition wtap.h:1358
wtap_pseudo_header::dct2000
struct catapult_dct2000_phdr dct2000
Definition wtap.h:1369
wtap_pseudo_header::irda
struct irda_phdr irda
Definition wtap.h:1364
wtap_pseudo_header::netmon
struct netmon_phdr netmon
Definition wtap.h:1381
wtap_pseudo_header::gsm_um
struct gsm_um_phdr gsm_um
Definition wtap.h:1376
wtap_pseudo_header::nettl
struct nettl_phdr nettl
Definition wtap.h:1365
wtap_pseudo_header::cosine
struct cosine_phdr cosine
Definition wtap.h:1363
wtap_pseudo_header::erf
struct erf_mc_phdr erf
Definition wtap.h:1370
wtap_pseudo_header::ascend
struct ascend_phdr ascend
Definition wtap.h:1360
wtap_pseudo_header::nstr
struct nstr_phdr nstr
Definition wtap.h:1377
wtap_pseudo_header::mmodule
struct mmodule_phdr mmodule
Definition wtap.h:1384
wtap_pseudo_header::procmon
struct procmon_phdr procmon
Definition wtap.h:1382
wtap_pseudo_header::eth
struct eth_phdr eth
Definition wtap.h:1356
wtap_dump_can_open
WS_DLL_PUBLIC bool wtap_dump_can_open(int filetype)
Check if a file type can be opened for dumping.
Definition file_access.c:2070
wtap_buffer_append_epdu_tag
WS_DLL_PUBLIC void wtap_buffer_append_epdu_tag(Buffer *buf, uint16_t epdu_tag, const uint8_t *data, uint16_t data_len)
Generates arbitrary packet data in "exported PDU" format and appends it to buf.
Definition wtap.c:2293
wtap_get_all_file_extensions_list
WS_DLL_PUBLIC GSList * wtap_get_all_file_extensions_list(void)
Return a list of all extensions that are used by all file types that we can read, including compresse...
Definition file_access.c:2014
wtap_dump_open
WS_DLL_PUBLIC wtap_dumper * wtap_dump_open(const char *filename, int file_type_subtype, ws_compression_type compression_type, const wtap_dump_params *params, int *err, char **err_info)
Opens a new capture file for writing.
Definition file_access.c:2243
wtap_new_secrets_callback_t
void(* wtap_new_secrets_callback_t)(uint32_t secrets_type, const void *secrets, unsigned size)
Callback type for receiving new decryption secrets.
Definition wtap.h:2204
wtap_register_file_type_subtype
WS_DLL_PUBLIC int wtap_register_file_type_subtype(const struct file_type_subtype_info *fi)
Register a file type/subtype.
Definition file_access.c:1174
wtap_dump_flush
WS_DLL_PUBLIC bool wtap_dump_flush(wtap_dumper *wdh, int *err)
Flushes the dump file.
Definition file_access.c:2565
wtap_file_size
WS_DLL_PUBLIC int64_t wtap_file_size(wtap *wth, int *err)
Get the size of the capture file.
Definition wtap.c:81
wtap_get_all_capture_file_extensions_list
WS_DLL_PUBLIC GSList * wtap_get_all_capture_file_extensions_list(void)
Return a list of all extensions that are used by all capture file types, including compressed extensi...
Definition file_access.c:1965
wtap_dump_open_tempfile
WS_DLL_PUBLIC wtap_dumper * wtap_dump_open_tempfile(const char *tmpdir, char **filenamep, const char *pfx, int file_type_subtype, ws_compression_type compression_type, const wtap_dump_params *params, int *err, char **err_info)
Creates a dumper for a temporary file.
Definition file_access.c:2285
option_support_t
option_support_t
Indicates how a file format supports a given option type.
Definition wtap.h:1979
MULTIPLE_OPTIONS_SUPPORTED
@ MULTIPLE_OPTIONS_SUPPORTED
Definition wtap.h:1982
OPTION_NOT_SUPPORTED
@ OPTION_NOT_SUPPORTED
Definition wtap.h:1980
ONE_OPTION_SUPPORTED
@ ONE_OPTION_SUPPORTED
Definition wtap.h:1981
wtap_get_file_extensions_list
WS_DLL_PUBLIC GSList * wtap_get_file_extensions_list(int file_type_subtype, bool include_compressed)
Return a list of file extensions that are used by the specified file type and subtype.
Definition file_access.c:1908
hashipv6_t
struct hashipv6 hashipv6_t
Hash table entry for a resolved or unresolved IPv6 address.
wtap_get_savable_file_types_subtypes_for_file
WS_DLL_PUBLIC GArray * wtap_get_savable_file_types_subtypes_for_file(int file_type_subtype, const GArray *file_encaps, uint32_t required_comment_types, ft_sort_order sort_order)
Get savable file type/subtype candidates for saving a capture file.
Definition file_access.c:1457
wtap_unwritable_rec_type_err_string
WS_DLL_PUBLIC char * wtap_unwritable_rec_type_err_string(const wtap_rec *rec)
Return an error string for WTAP_ERR_UNWRITABLE_REC_TYPE.
Definition wtap.c:1793
wtap_plugins_supported
WS_DLL_PUBLIC int wtap_plugins_supported(void)
Query whether libwiretap plugin loading is available.
Definition wtap.c:57
wtap_encap_description
WS_DLL_PUBLIC const char * wtap_encap_description(int encap)
Get a human-readable description for an encapsulation type.
Definition wtap.c:1415
wtap_file_get_shb
WS_DLL_PUBLIC wtap_block_t wtap_file_get_shb(wtap *wth, unsigned shb_num)
Gets existing section header block, not for new file.
Definition wtap.c:146
wtap_file_type_subtype_description
WS_DLL_PUBLIC const char * wtap_file_type_subtype_description(int file_type_subtype)
Get a human-readable description for a file type/subtype.
Definition file_access.c:1633
wtap_dump_params_cleanup
WS_DLL_PUBLIC void wtap_dump_params_cleanup(wtap_dump_params *params)
Free memory associated with the wtap_dump_params when it is no longer in use by wtap_dumper.
Definition wtap.c:644
wtap_new_ipv6_callback_t
void(* wtap_new_ipv6_callback_t)(const ws_in6_addr *addrp, const char *name, const bool static_entry)
Callback type for registering new IPv6 hostnames.
Definition wtap.h:2180
wtap_file_get_idb_info
WS_DLL_PUBLIC wtapng_iface_descriptions_t * wtap_file_get_idb_info(wtap *wth)
Gets existing interface descriptions.
Definition wtap.c:198
wtap_setup_packet_rec
WS_DLL_PUBLIC void wtap_setup_packet_rec(wtap_rec *rec, int encap)
Set up a wtap_rec for a packet (REC_TYPE_PACKET).
Definition wtap.c:1803
wtap_get_file_extension_type_extensions
WS_DLL_PUBLIC GSList * wtap_get_file_extension_type_extensions(unsigned extension_type)
Get the list of extensions for a file extension type.
Definition file_access.c:208
wtap_deregister_open_info
WS_DLL_PUBLIC void wtap_deregister_open_info(const char *name)
Deregister an open_info handler by name.
Definition file_access.c:500
hashipv4_t
struct hashipv4 hashipv4_t
Hash table entry for a resolved or unresolved IPv4 address.
wtap_dump_close
WS_DLL_PUBLIC bool wtap_dump_close(wtap_dumper *wdh, bool *needs_reload, int *err, char **err_info)
Definition file_access.c:2594
wtap_set_bytes_dumped
WS_DLL_PUBLIC void wtap_set_bytes_dumped(wtap_dumper *wdh, uint64_t bytes_dumped)
Set the number of bytes dumped by a capture file.
Definition file_access.c:2638
wtap_get_next_interface_description
WS_DLL_PUBLIC wtap_block_t wtap_get_next_interface_description(wtap *wth)
Gets next interface description.
Definition wtap.c:221
ft_sort_order
ft_sort_order
Controls the sort key used when enumerating or presenting file type lists.
Definition wtap.h:3080
FT_SORT_BY_NAME
@ FT_SORT_BY_NAME
Definition wtap.h:3081
FT_SORT_BY_DESCRIPTION
@ FT_SORT_BY_DESCRIPTION
Definition wtap.h:3082
wtap_read
WS_DLL_PUBLIC bool wtap_read(wtap *wth, wtap_rec *rec, int *err, char **err_info, int64_t *offset)
Read the next record in the file, filling in *phdr and *buf.
Definition wtap.c:1864
wtap_buffer_append_epdu_string
WS_DLL_PUBLIC void wtap_buffer_append_epdu_string(Buffer *buf, uint16_t epdu_tag, const char *val)
Generates packet data for a string in "exported PDU" format. For filetype readers to transform non-pa...
Definition wtap.c:2340
wtap_free_idb_info
WS_DLL_PUBLIC void wtap_free_idb_info(wtapng_iface_descriptions_t *idb_info)
Free's a interface description block and all of its members.
Definition wtap.c:396
wtap_open_offline
WS_DLL_PUBLIC struct wtap * wtap_open_offline(const char *filename, unsigned int type, int *err, char **err_info, bool do_random, const char *app_env_var_prefix)
Open a capture file for offline analysis.
Definition file_access.c:848
wtap_dump_file_type_subtype
WS_DLL_PUBLIC int wtap_dump_file_type_subtype(const wtap_dumper *wdh)
Get the file type subtype of a dump file.
Definition file_access.c:2626
wtap_file_type_subtype
WS_DLL_PUBLIC int wtap_file_type_subtype(wtap *wth)
Get the file type subtype.
Definition wtap.c:104
wtap_register_file_type_extension
WS_DLL_PUBLIC void wtap_register_file_type_extension(const struct file_extension_info *ei)
Register file extension information for a file type.
Definition file_access.c:152
wtap_get_file_extension_type_name
WS_DLL_PUBLIC const char * wtap_get_file_extension_type_name(int extension_type)
Get the short name for a file extension type.
Definition file_access.c:166
wtap_dump_add_idb
WS_DLL_PUBLIC bool wtap_dump_add_idb(wtap_dumper *wdh, wtap_block_t idb, int *err, char **err_info)
Add an IDB to the list of IDBs for a file we're writing. Makes a copy of the IDB, so it can be freed ...
Definition file_access.c:2527
wtap_open_type
wtap_open_type
Strategy used to identify a file format.
Definition wtap.h:1881
OPEN_INFO_MAGIC
@ OPEN_INFO_MAGIC
Definition wtap.h:1882
OPEN_INFO_HEURISTIC
@ OPEN_INFO_HEURISTIC
Definition wtap.h:1883
wtap_dump_params_discard_decryption_secrets
WS_DLL_PUBLIC void wtap_dump_params_discard_decryption_secrets(wtap_dump_params *params)
Remove any decryption secret information from the per-file information; used if we're stripping decry...
Definition wtap.c:631
wtap_fdclose
WS_DLL_PUBLIC void wtap_fdclose(wtap *wth)
Close all file descriptors for the current wiretap file.
Definition wtap.c:1611
wtap_open_return_val
wtap_open_return_val
For registering file types that we can open.
Definition wtap.h:1852
WTAP_OPEN_MINE
@ WTAP_OPEN_MINE
Definition wtap.h:1854
WTAP_OPEN_NOT_MINE
@ WTAP_OPEN_NOT_MINE
Definition wtap.h:1853
WTAP_OPEN_ERROR
@ WTAP_OPEN_ERROR
Definition wtap.h:1855
wtap_get_bytes_dumped
WS_DLL_PUBLIC uint64_t wtap_get_bytes_dumped(const wtap_dumper *wdh)
Get the number of bytes dumped by a packet capture.
Definition file_access.c:2632
MAX_ERF_EHDR
#define MAX_ERF_EHDR
Definition wtap.h:1079
wtap_rec_reset
WS_DLL_PUBLIC void wtap_rec_reset(wtap_rec *rec)
Re-initialize a wtap_rec structure.
Definition wtap.c:2130
wtap_has_open_info
WS_DLL_PUBLIC bool wtap_has_open_info(const char *name)
Check if an open_info handler with the given name is registered.
Definition file_access.c:524
wtap_dump_required_file_encap_type
WS_DLL_PUBLIC int wtap_dump_required_file_encap_type(const GArray *file_encaps)
Determine the required per-file encapsulation type.
Definition file_access.c:1291
wtap_dump_discard_name_resolution
WS_DLL_PUBLIC void wtap_dump_discard_name_resolution(wtap_dumper *wdh)
Discard name resolution information for a dump file.
Definition file_access.c:2663
wtap_file_encap
WS_DLL_PUBLIC int wtap_file_encap(wtap *wth)
Get the encapsulation type for the capture file.
Definition wtap.c:116
wtap_dump_params_discard_name_resolution
WS_DLL_PUBLIC void wtap_dump_params_discard_name_resolution(wtap_dump_params *params)
Remove any name resolution information from the per-file information; used if we're stripping name re...
Definition wtap.c:625
wtap_dump_open_stdout
WS_DLL_PUBLIC wtap_dumper * wtap_dump_open_stdout(int file_type_subtype, ws_compression_type compression_type, const wtap_dump_params *params, int *err, char **err_info)
Creates a dumper for the standard output.
Definition file_access.c:2388
wtap_dump_params_init_no_idbs
WS_DLL_PUBLIC void wtap_dump_params_init_no_idbs(wtap_dump_params *params, wtap *wth)
Initialize the per-file information based on an existing file, but don't copy over the interface info...
Definition wtap.c:602
wtap_dump_fdopen
WS_DLL_PUBLIC wtap_dumper * wtap_dump_fdopen(int fd, int file_type_subtype, ws_compression_type compression_type, const wtap_dump_params *params, int *err, char **err_info)
Creates a dumper for an existing file descriptor.
Definition file_access.c:2350
wtap_buffer_append_epdu_uint
WS_DLL_PUBLIC void wtap_buffer_append_epdu_uint(Buffer *buf, uint16_t epdu_tag, uint32_t val)
Generates packet data for an unsigned integer in "exported PDU" format. For filetype readers to trans...
Definition wtap.c:2324
wtap_dump_discard_decryption_secrets
WS_DLL_PUBLIC void wtap_dump_discard_decryption_secrets(wtap_dumper *wdh)
Discard decryption secrets for a dump file.
Definition file_access.c:2675
wtap_file_start_ts
WS_DLL_PUBLIC const nstime_t * wtap_file_start_ts(wtap *wth)
Get the start timestamp of the capture file.
Definition wtap.c:128
wtap_get_num_file_type_extensions
WS_DLL_PUBLIC int wtap_get_num_file_type_extensions(void)
Return the number of registered file type extension groups.
Definition file_access.c:160
wtap_setup_custom_block_rec
WS_DLL_PUBLIC void wtap_setup_custom_block_rec(wtap_rec *rec, uint32_t pen, uint32_t payload_length, bool copy_allowed)
Set up a wtap_rec for a custom block.
Definition wtap.c:1853
wtap_strerror
WS_DLL_PUBLIC const char * wtap_strerror(int err)
Return a human-readable error string for a WTAP error code.
Definition wtap.c:1560
wtap_file_get_shb_global_interface_id
WS_DLL_PUBLIC unsigned wtap_file_get_shb_global_interface_id(wtap *wth, unsigned shb_num, uint32_t interface_id)
Gets the unique interface id for a SHB's interface.
Definition wtap.c:155
wtap_file_get_num_shbs
WS_DLL_PUBLIC unsigned wtap_file_get_num_shbs(wtap *wth)
Gets number of section header blocks.
Definition wtap.c:140
wtap_register_plugin
WS_DLL_PUBLIC void wtap_register_plugin(const wtap_plugin *plug)
Register a wiretap plugin.
wtap_deregister_file_type_subtype
WS_DLL_PUBLIC void wtap_deregister_file_type_subtype(const int file_type_subtype)
Deregister a previously registered file type/subtype.
Definition file_access.c:1251
wtap_dump_params_init
WS_DLL_PUBLIC void wtap_dump_params_init(wtap_dump_params *params, wtap *wth)
Initialize the per-file information based on an existing file.
Definition wtap.c:575
wtap_dump
WS_DLL_PUBLIC bool wtap_dump(wtap_dumper *wdh, const wtap_rec *rec, int *err, char **err_info)
Write a record to the dump file.
Definition file_access.c:2557
wtap_free_extensions_list
WS_DLL_PUBLIC void wtap_free_extensions_list(GSList *extensions)
Free a list of file extension strings returned by extension helpers.
Definition file_access.c:2041
wtap_uses_lua_filehandler
WS_DLL_PUBLIC bool wtap_uses_lua_filehandler(const wtap *wth)
Check whether a wtap handle uses a Lua-based file handler.
Definition file_access.c:544
wtap_write_shb_comment
WS_DLL_PUBLIC void wtap_write_shb_comment(wtap *wth, char *comment)
Sets or replaces the section header comment.
Definition wtap.c:190
block_support_t
block_support_t
Indicates how many instances of a given block type a file format supports.
Definition wtap.h:2015
MULTIPLE_BLOCKS_SUPPORTED
@ MULTIPLE_BLOCKS_SUPPORTED
Definition wtap.h:2018
ONE_BLOCK_SUPPORTED
@ ONE_BLOCK_SUPPORTED
Definition wtap.h:2017
BLOCK_NOT_SUPPORTED
@ BLOCK_NOT_SUPPORTED
Definition wtap.h:2016
wtap_wslua_file_info_t
struct wtap_wslua_file_info wtap_wslua_file_info_t
Companion metadata block for Lua-based file writers registered via wslua, carrying the write-open cal...
init_open_routines
WS_DLL_PUBLIC void init_open_routines(void)
Initialize registered file open routines.
Definition file_access.c:419
wtap_read_so_far
WS_DLL_PUBLIC int64_t wtap_read_so_far(wtap *wth)
Return an approximation of the amount of data read sequentially.
Definition wtap.c:2084
wtap_file_add_decryption_secrets
WS_DLL_PUBLIC void wtap_file_add_decryption_secrets(wtap *wth, const wtap_block_t dsb)
Adds a Decryption Secrets Block to the open wiretap session.
Definition wtap.c:262
wtap_set_cb_new_secrets
WS_DLL_PUBLIC void wtap_set_cb_new_secrets(wtap *wth, wtap_new_secrets_callback_t add_new_secrets)
Set the callback for receiving new decryption secrets.
Definition wtap.c:1732
wtap_setup_systemd_journal_export_rec
WS_DLL_PUBLIC void wtap_setup_systemd_journal_export_rec(wtap_rec *rec)
Set up a wtap_rec for a systemd journal export entry.
Definition wtap.c:1843
wtap_cleanup
WS_DLL_PUBLIC void wtap_cleanup(void)
Clean up libwiretap internal registrations and plugin state.
Definition wtap.c:2393
wtap_pcapng_file_type_subtype
WS_DLL_PUBLIC int wtap_pcapng_file_type_subtype(void)
Get the file type/subtype identifier for pcapng.
Definition file_access.c:1730
cleanup_open_routines
void cleanup_open_routines(void)
Clean up registered file open routines.
Definition file_access.c:2860
wtap_cleareof
WS_DLL_PUBLIC void wtap_cleareof(wtap *wth)
Clear EOF status for a wiretap file.
Definition wtap.c:1651
addrinfo_lists_t
struct addrinfo_lists addrinfo_lists_t
Aggregates lists of resolved IPv4 and IPv6 addresses for writing into a pcapng Name Resolution Block ...
wtap_file_end_ts
WS_DLL_PUBLIC const nstime_t * wtap_file_end_ts(wtap *wth)
Get the end timestamp of the capture file.
Definition wtap.c:134
wtap_file_get_num_dsbs
WS_DLL_PUBLIC unsigned wtap_file_get_num_dsbs(wtap *wth)
Gets number of decryption secrets blocks.
Definition wtap.c:244
wtap_get_compression_type
WS_DLL_PUBLIC ws_compression_type wtap_get_compression_type(wtap *wth)
Get the compression type used for the capture file.
Definition file_wrappers.c:46
wtap_pcap_nsec_file_type_subtype
WS_DLL_PUBLIC int wtap_pcap_nsec_file_type_subtype(void)
Get the file type/subtype identifier for pcap with nanosecond timestamps.
Definition file_access.c:1716
wtap_close
WS_DLL_PUBLIC void wtap_close(wtap *wth)
Fully close the wiretap file and release all resources.
Definition wtap.c:1620
wtap_setup_syscall_rec
WS_DLL_PUBLIC void wtap_setup_syscall_rec(wtap_rec *rec)
Set up a wtap_rec for a system call.
Definition pcapng-sysdig.c:40
wtap_dump_set_addrinfo_list
WS_DLL_PUBLIC bool wtap_dump_set_addrinfo_list(wtap_dumper *wdh, addrinfo_lists_t *addrinfo_lists)
Set the address information list for a dump file.
Definition file_access.c:2652
wtap_rec_apply_snapshot
WS_DLL_PUBLIC void wtap_rec_apply_snapshot(wtap_rec *rec, uint32_t snaplen)
Apply a snapshot length to a wtap_rec.
Definition wtap.c:2104
wtap_file_tsprec
WS_DLL_PUBLIC int wtap_file_tsprec(wtap *wth)
Get the timestamp precision for the capture file.
Definition wtap.c:122
wtap_init
WS_DLL_PUBLIC void wtap_init(bool load_wiretap_plugins, const char *app_env_var_prefix, const struct file_extension_info *file_extensions, unsigned num_extensions)
Initialize the Wiretap library.
Definition wtap.c:2374
wtap_dump_can_write_encap
WS_DLL_PUBLIC bool wtap_dump_can_write_encap(int file_type_subtype, int encap)
Check if a file type/subtype supports writing a given encapsulation.
Definition file_access.c:1304
wtap_dump_can_write
WS_DLL_PUBLIC bool wtap_dump_can_write(const GArray *file_encaps, uint32_t required_comment_types)
Determine whether a capture file can be written with the specified options.
Definition file_access.c:1406
wtap_file_type_subtype_name
WS_DLL_PUBLIC const char * wtap_file_type_subtype_name(int file_type_subtype)
Get a short name for a file type/subtype.
Definition file_access.c:1646
wtap_setup_ft_specific_report_rec
WS_DLL_PUBLIC void wtap_setup_ft_specific_report_rec(wtap_rec *rec, int file_type_subtype, unsigned record_type)
Set up a wtap_rec for a file-type specific report.
Definition wtap.c:1829
wtap_get_num_encap_types
WS_DLL_PUBLIC int wtap_get_num_encap_types(void)
Return the number of known encapsulation types.
Definition wtap.c:1381
wtap_rec_cleanup
WS_DLL_PUBLIC void wtap_rec_cleanup(wtap_rec *rec)
Clean up a wtap_rec structure.
Definition wtap.c:2139
wtap_tsprec_string
WS_DLL_PUBLIC const char * wtap_tsprec_string(int tsprec)
Convert a timestamp precision constant to a string.
Definition wtap.c:1458
open_info_name_to_type
WS_DLL_PUBLIC unsigned int open_info_name_to_type(const char *name)
Convert an open_info short name to its numeric type.
Definition file_access.c:582
wtap_file_get_dsb
WS_DLL_PUBLIC wtap_block_t wtap_file_get_dsb(wtap *wth, unsigned dsb_num)
Gets existing decryption secrets block, not for new file.
Definition wtap.c:253
wtap_dump_can_compress
WS_DLL_PUBLIC bool wtap_dump_can_compress(int file_type_subtype)
Check if a file type/subtype supports compression.
Definition file_access.c:2102
wtap_snapshot_length
WS_DLL_PUBLIC unsigned wtap_snapshot_length(wtap *wth)
Get the snapshot length for the capture file.
Definition wtap.c:110
wtap_fdreopen
WS_DLL_PUBLIC bool wtap_fdreopen(wtap *wth, const char *filename, int *err)
Reopen the random-access file descriptor for the current file.
Definition file_access.c:1033
wtap_rec_init
WS_DLL_PUBLIC void wtap_rec_init(wtap_rec *rec, size_t space)
Initialize a wtap_rec structure.
Definition wtap.c:2091
wtap_file_discard_decryption_secrets
WS_DLL_PUBLIC bool wtap_file_discard_decryption_secrets(wtap *wth)
Remove any decryption secret information from the per-file information; used if we're stripping decry...
Definition wtap.c:271
wtap_setup_ft_specific_event_rec
WS_DLL_PUBLIC void wtap_setup_ft_specific_event_rec(wtap_rec *rec, int file_type_subtype, unsigned record_type)
Set up a wtap_rec for a file-type specific event.
Definition wtap.c:1815
wtap_set_cb_new_ipv6
WS_DLL_PUBLIC void wtap_set_cb_new_ipv6(wtap *wth, wtap_new_ipv6_callback_t add_new_ipv6)
Set the callback for adding new IPv6 hostnames.
Definition wtap.c:1705
wtap_default_file_extension
WS_DLL_PUBLIC const char * wtap_default_file_extension(int file_type_subtype)
Get the default file extension for a file type/subtype.
Definition file_access.c:2057
wtap_pcap_file_type_subtype
WS_DLL_PUBLIC int wtap_pcap_file_type_subtype(void)
Get the file type/subtype identifier for classic pcap (microsecond timestamps).
Definition file_access.c:1702
wtap_register_open_info
WS_DLL_PUBLIC void wtap_register_open_info(struct open_info *oi, const bool first_routine)
Register an open_info probe/open handler.
Definition file_access.c:464
wtap_buffer_append_epdu_end
WS_DLL_PUBLIC int wtap_buffer_append_epdu_end(Buffer *buf)
Close off a set of "exported PDUs" added to the buffer. For filetype readers to transform non-packeti...
Definition wtap.c:2357
wtap_addrinfo_list_empty
WS_DLL_PUBLIC bool wtap_addrinfo_list_empty(const addrinfo_lists_t *addrinfo_lists)
Checks if the address information list is empty.
Definition file_access.c:2644
wtap_file_get_dpib_lookup_info
WS_DLL_PUBLIC wtapng_dpib_lookup_info_t * wtap_file_get_dpib_lookup_info(wtap *wth)
Gets the DPIB lookup information for the current file.
Definition wtap.c:210
wtap_file_type_subtype_supports_block
WS_DLL_PUBLIC block_support_t wtap_file_type_subtype_supports_block(int file_type_subtype, wtap_block_type_t type)
Determine whether a capture file format supports a given block type.
Definition file_access.c:1744
wtap_get_writable_file_types_subtypes
WS_DLL_PUBLIC GArray * wtap_get_writable_file_types_subtypes(ft_sort_order sort_order)
Get a list of all writable file type/subtype values.
Definition file_access.c:1569
wtap_encap_name
WS_DLL_PUBLIC const char * wtap_encap_name(int encap)
Get a short name for an encapsulation type.
Definition wtap.c:1401
wtap_register_encap_type
WS_DLL_PUBLIC int wtap_register_encap_type(const char *description, const char *name)
Register a new packet encapsulation type.
Definition wtap.c:1387
wtap_get_debug_if_descr
WS_DLL_PUBLIC char * wtap_get_debug_if_descr(const wtap_block_t if_descr, const int indent, const char *line_end)
Gets a debug string of an interface description.
Definition wtap.c:406
PHDR_802_11BE_MAX_USERS
#define PHDR_802_11BE_MAX_USERS
Definition wtap.h:807
wtap_file_get_nrb
WS_DLL_PUBLIC wtap_block_t wtap_file_get_nrb(wtap *wth)
Gets existing name resolution block, not for new file.
Definition wtap.c:545
wtap_set_cb_new_ipv4
WS_DLL_PUBLIC void wtap_set_cb_new_ipv4(wtap *wth, wtap_new_ipv4_callback_t add_new_ipv4)
Set the callback for adding new IPv4 hostnames.
Definition wtap.c:1685
wtap_name_to_file_type_subtype
WS_DLL_PUBLIC int wtap_name_to_file_type_subtype(const char *name)
Convert a file type/subtype name to its identifier.
Definition file_access.c:1670
wtap_sequential_close
WS_DLL_PUBLIC void wtap_sequential_close(wtap *wth)
Close the sequential-access side of the file.
Definition wtap.c:1587
wtap_new_ipv4_callback_t
void(* wtap_new_ipv4_callback_t)(const unsigned addr, const char *name, const bool static_entry)
Callback type for registering new IPv4 hostnames.
Definition wtap.h:2156
wtap_file_type_subtype_supports_option
WS_DLL_PUBLIC option_support_t wtap_file_type_subtype_supports_option(int file_type_subtype, wtap_block_type_t type, unsigned opttype)
Determine whether a capture file format supports a specific option for a block.
Definition file_access.c:1779
wtap_name_to_encap
WS_DLL_PUBLIC int wtap_name_to_encap(const char *short_name)
Convert a short encapsulation name to its WTAP_ENCAP_ value.
Definition wtap.c:1429
wtap_seek_read
WS_DLL_PUBLIC bool wtap_seek_read(wtap *wth, int64_t seek_off, wtap_rec *rec, int *err, char **err_info)
Read the record at a specified offset in a capture file, filling in *phdr and *buf.
Definition wtap.c:2161
wtap_opttypes.h
wtap_block_type_t
wtap_block_type_t
Currently supported blocks; these are not the pcapng block type values for them, they're identifiers ...
Definition wtap_opttypes.h:234
wtapng_dpib_lookup_info_t
struct wtapng_dpib_lookup_info_s wtapng_dpib_lookup_info_t
wtapng_iface_descriptions_t
struct wtapng_iface_descriptions_s wtapng_iface_descriptions_t