| Wireshark 4.7.3 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
observer.h
Go to the documentation of this file.
1
8
9/***************************************************************************
10 * *
11 * SPDX-License-Identifier: GPL-2.0-or-later *
12 * *
13 ***************************************************************************/
14
15#ifndef __NETWORK_INSTRUMENTS_H__
16#define __NETWORK_INSTRUMENTS_H__
17
18#include "wtap.h"
19
30 wtap_open_return_val observer_open(wtap *wth, int *err, char **err_info);
31
40 typedef struct capture_file_header
41{
42 char observer_version[31];
43 uint8_t offset_to_first_packet_high_byte;
44 uint16_t offset_to_first_packet;
45 char probe_instance;
46 uint8_t number_of_information_elements;
47} capture_file_header;
48
50#define CAPTURE_FILE_HEADER_FROM_LE_IN_PLACE(_capture_file_header) \
51 _capture_file_header.offset_to_first_packet = GUINT16_FROM_LE((_capture_file_header).offset_to_first_packet)
52
54#define CAPTURE_FILE_HEADER_TO_LE_IN_PLACE(_capture_file_header) \
55 _capture_file_header.offset_to_first_packet = GUINT16_TO_LE((_capture_file_header).offset_to_first_packet)
56
60 typedef struct tlv_header
61{
62 uint16_t type;
63 uint16_t length;
64} tlv_header;
65
67#define TLV_HEADER_FROM_LE_IN_PLACE(_tlv_header) \
68 (_tlv_header).type = GUINT16_FROM_LE((_tlv_header).type); \
69 (_tlv_header).length = GUINT16_FROM_LE((_tlv_header).length)
70
72#define TLV_HEADER_TO_LE_IN_PLACE(_tlv_header) \
73 (_tlv_header).type = GUINT16_TO_LE((_tlv_header).type); \
74 (_tlv_header).length = GUINT16_TO_LE((_tlv_header).length)
75
76/*
77 * TLV type values.
78 *
79 * Do TLVs without the 0x0100 bit set show up in packets, and
80 * do TLVs with that set show up in the file header, or are
81 * there two separate types of TLV?
82 *
83 * ALIAS_LIST contains an ASCII string (null-terminated, but
84 * we can't trust that, of course) that is the pathname of
85 * a file containing the alias list. Not much use to us.
86 *
87 * COMMENT contains an ASCII string (null-terminated, but
88 * we can't trust that, of course); in all the captures
89 * I've seen, it appears to be a note about the file added
90 * by Observer, not by a user. It appears to end with 0x0a
91 * 0x2e, i.e. '\n' '.'.
92 *
93 * REMOTE_PROBE contains, in all the captures I've seen, an
94 * ASCII string (null-terminated, but we cna't trust that,
95 * of course) of the form "Remote Probe [hex string]". THe
96 * hex string has 8 characters, i.e. 4 octets.
97 *
98 * The Observer document indicates that the types of expert information
99 * packets are:
100 *
101 * Network Load (markers used by Expert Time Interval and What If
102 * analysis modes)
103 *
104 * Start/Stop Packet Capture marker frames (with time stamps when
105 * captures start and stop)
106 *
107 * Wireless Channel Change (markers showing what channel was being
108 * currently listened to)
109 *
110 * That information appears to be contained in TLVs.
111 */
112#define INFORMATION_TYPE_ALIAS_LIST 0x0001
113#define INFORMATION_TYPE_COMMENT 0x0002 /* ASCII text */
114#define INFORMATION_TYPE_TIME_INFO 0x0004
115#define INFORMATION_TYPE_REMOTE_PROBE 0x0005
116#define INFORMATION_TYPE_NETWORK_LOAD 0x0100
117#define INFORMATION_TYPE_WIRELESS 0x0101
118#define INFORMATION_TYPE_CAPTURE_START_STOP 0x0104
119
120/*
121 * See in Fibre Channel captures; not seen elsewhere.
122 *
123 * It has 4 bytes of data in all captures I've seen.
124 */
125/* 0x0106 */
126
130 typedef struct tlv_time_info {
131 uint32_t time_format;
132} tlv_time_info;
133
134#define TIME_INFO_LOCAL 0
135#define TIME_INFO_GMT 1
136
138#define TLV_TIME_INFO_FROM_LE_IN_PLACE(_tlv_time_info) \
139 (_tlv_time_info).time_format = GUINT32_FROM_LE((_tlv_time_info).time_format)
140
142#define TLV_TIME_INFO_TO_LE_IN_PLACE(_tlv_time_info) \
143 (_tlv_time_info).time_format = GUINT32_TO_LE((_tlv_time_info).time_format)
144
145
153 typedef struct tlv_network_load
154{
155 uint32_t utilization;
156 uint32_t unknown1;
157 uint32_t unknown2;
158 uint32_t packets_per_second;
159 uint32_t unknown3;
160 uint32_t bytes_per_second;
161 uint32_t unknown4;
162} tlv_network_load;
163
165#define TLV_NETWORK_LOAD_FROM_LE_IN_PLACE(_tlv_network_load) \
166 (_tlv_network_load).utilization = GUINT32_FROM_LE((_tlv_network_load).utilization); \
167 (_tlv_network_load).unknown1 = GUINT32_FROM_LE((_tlv_network_load).unknown1); \
168 (_tlv_network_load).unknown2 = GUINT32_FROM_LE((_tlv_network_load).unknown2); \
169 (_tlv_network_load).packets_per_second = GUINT32_FROM_LE((_tlv_network_load).packets_per_second); \
170 (_tlv_network_load).unknown3 = GUINT32_FROM_LE((_tlv_network_load).unknown3); \
171 (_tlv_network_load).bytes_per_second = GUINT32_FROM_LE((_tlv_network_load).bytes_per_second); \
172 (_tlv_network_load).unknown4 = GUINT32_FROM_LE((_tlv_network_load).unknown4)
173
175#define TLV_NETWORK_LOAD_TO_LE_IN_PLACE(_tlv_network_load) \
176 (_tlv_network_load).utilization = GUINT32_TO_LE((_tlv_network_load).utilization); \
177 (_tlv_network_load).unknown1 = GUINT32_TO_LE((_tlv_network_load).unknown1); \
178 (_tlv_network_load).unknown2 = GUINT32_TO_LE((_tlv_network_load).unknown2); \
179 (_tlv_network_load).packets_per_second = GUINT32_TO_LE((_tlv_network_load).packets_per_second); \
180 (_tlv_network_load).unknown3 = GUINT32_TO_LE((_tlv_network_load).unknown3); \
181 (_tlv_network_load).bytes_per_second = GUINT32_TO_LE((_tlv_network_load).bytes_per_second); \
182 (_tlv_network_load).unknown4 = GUINT32_TO_LE((_tlv_network_load).unknown4)
183
184
193 typedef struct tlv_wireless_info {
194 uint8_t quality;
195 uint8_t signalStrength;
196 uint8_t rate;
197 uint8_t frequency;
198 uint8_t qualityPercent;
199 uint8_t strengthPercent;
200 uint8_t conditions;
201 uint8_t reserved;
202} tlv_wireless_info;
203
204#define WIRELESS_WEP_SUCCESS 0x80
205
209 typedef struct tlv_capture_start_stop
210{
211 uint32_t start_stop;
212} tlv_capture_start_stop;
213
214#define START_STOP_TYPE_STOP 0
215#define START_STOP_TYPE_START 1
216
220 typedef struct packet_entry_header
221{
222 uint32_t packet_magic;
223 uint32_t network_speed;
224 uint16_t captured_size;
225 uint16_t network_size;
226 uint16_t offset_to_frame;
227 uint16_t offset_to_next_packet;
228 uint8_t network_type;
229 uint8_t flags;
230 uint8_t number_of_information_elements;
231 uint8_t packet_type;
232 uint16_t errors;
233 uint16_t reserved;
234 uint64_t packet_number;
235 uint64_t original_packet_number;
236 uint64_t nano_seconds_since_2000;
237} packet_entry_header;
238
239#define PACKET_ENTRY_HEADER_FROM_LE_IN_PLACE(_packet_entry_header) \
240 (_packet_entry_header).packet_magic = GUINT32_FROM_LE((_packet_entry_header).packet_magic); \
241 (_packet_entry_header).network_speed = GUINT32_FROM_LE((_packet_entry_header).network_speed); \
242 (_packet_entry_header).captured_size = GUINT16_FROM_LE((_packet_entry_header).captured_size); \
243 (_packet_entry_header).network_size = GUINT16_FROM_LE((_packet_entry_header).network_size); \
244 (_packet_entry_header).offset_to_frame = GUINT16_FROM_LE((_packet_entry_header).offset_to_frame); \
245 (_packet_entry_header).offset_to_next_packet = GUINT16_FROM_LE((_packet_entry_header).offset_to_next_packet); \
246 (_packet_entry_header).errors = GUINT16_FROM_LE((_packet_entry_header).errors); \
247 (_packet_entry_header).reserved = GUINT16_FROM_LE((_packet_entry_header).reserved); \
248 (_packet_entry_header).packet_number = GUINT64_FROM_LE((_packet_entry_header).packet_number); \
249 (_packet_entry_header).original_packet_number = GUINT64_FROM_LE((_packet_entry_header).original_packet_number); \
250 (_packet_entry_header).nano_seconds_since_2000 = GUINT64_FROM_LE((_packet_entry_header).nano_seconds_since_2000)
251
252#define PACKET_ENTRY_HEADER_TO_LE_IN_PLACE(_packet_entry_header) \
253 (_packet_entry_header).packet_magic = GUINT32_TO_LE((_packet_entry_header).packet_magic); \
254 (_packet_entry_header).network_speed = GUINT32_TO_LE((_packet_entry_header).network_speed); \
255 (_packet_entry_header).captured_size = GUINT16_TO_LE((_packet_entry_header).captured_size); \
256 (_packet_entry_header).network_size = GUINT16_TO_LE((_packet_entry_header).network_size); \
257 (_packet_entry_header).offset_to_frame = GUINT16_TO_LE((_packet_entry_header).offset_to_frame); \
258 (_packet_entry_header).offset_to_next_packet = GUINT16_TO_LE((_packet_entry_header).offset_to_next_packet); \
259 (_packet_entry_header).errors = GUINT16_TO_LE((_packet_entry_header).errors); \
260 (_packet_entry_header).reserved = GUINT16_TO_LE((_packet_entry_header).reserved); \
261 (_packet_entry_header).packet_number = GUINT64_TO_LE((_packet_entry_header).packet_number); \
262 (_packet_entry_header).original_packet_number = GUINT64_TO_LE((_packet_entry_header).original_packet_number); \
263 (_packet_entry_header).nano_seconds_since_2000 = GUINT64_TO_LE((_packet_entry_header).nano_seconds_since_2000)
264
265/*
266 * Network type values.
267 */
268#define OBSERVER_UNDEFINED 0xFF
269#define OBSERVER_ETHERNET 0x00
270#define OBSERVER_TOKENRING 0x01
271#define OBSERVER_FIBRE_CHANNEL 0x08
272#define OBSERVER_WIRELESS_802_11 0x09
273
274/*
275 * Packet type values.
276 */
277#define PACKET_TYPE_DATA_PACKET 0
278#define PACKET_TYPE_EXPERT_INFORMATION_PACKET 1
279
280#endif
observer_open
wtap_open_return_val observer_open(wtap *wth, int *err, char **err_info)
Opens a capture file using the observer format.
Definition observer.c:123
capture_file_header
Top-level file header for a Network Instruments Observer capture file.
Definition observer.h:41
capture_file_header::observer_version
char observer_version[31]
Definition observer.h:42
capture_file_header::number_of_information_elements
uint8_t number_of_information_elements
Definition observer.h:46
capture_file_header::offset_to_first_packet
uint16_t offset_to_first_packet
Definition observer.h:44
capture_file_header::offset_to_first_packet_high_byte
uint8_t offset_to_first_packet_high_byte
Definition observer.h:43
capture_file_header::probe_instance
char probe_instance
Definition observer.h:45
packet_entry_header
Per-packet record header in a Network Instruments Observer capture file.
Definition observer.h:221
packet_entry_header::network_type
uint8_t network_type
Definition observer.h:228
packet_entry_header::original_packet_number
uint64_t original_packet_number
Definition observer.h:235
packet_entry_header::reserved
uint16_t reserved
Definition observer.h:233
packet_entry_header::packet_magic
uint32_t packet_magic
Definition observer.h:222
packet_entry_header::packet_type
uint8_t packet_type
Definition observer.h:231
packet_entry_header::offset_to_frame
uint16_t offset_to_frame
Definition observer.h:226
packet_entry_header::network_size
uint16_t network_size
Definition observer.h:225
packet_entry_header::network_speed
uint32_t network_speed
Definition observer.h:223
packet_entry_header::number_of_information_elements
uint8_t number_of_information_elements
Definition observer.h:230
packet_entry_header::nano_seconds_since_2000
uint64_t nano_seconds_since_2000
Definition observer.h:236
packet_entry_header::flags
uint8_t flags
Definition observer.h:229
packet_entry_header::offset_to_next_packet
uint16_t offset_to_next_packet
Definition observer.h:227
packet_entry_header::errors
uint16_t errors
Definition observer.h:232
packet_entry_header::packet_number
uint64_t packet_number
Definition observer.h:234
packet_entry_header::captured_size
uint16_t captured_size
Definition observer.h:224
tlv_capture_start_stop
TLV payload recording a capture start or stop event in the Observer capture file.
Definition observer.h:210
tlv_capture_start_stop::start_stop
uint32_t start_stop
Definition observer.h:211
tlv_header
TLV (Type-Length-Value) header used for information elements appended to the Observer capture file he...
Definition observer.h:61
tlv_header::type
uint16_t type
Definition observer.h:62
tlv_header::length
uint16_t length
Definition observer.h:63
tlv_network_load
TLV payload carrying a network load snapshot sampled at the time of capture.
Definition observer.h:154
tlv_network_load::unknown2
uint32_t unknown2
Definition observer.h:157
tlv_network_load::unknown4
uint32_t unknown4
Definition observer.h:161
tlv_network_load::packets_per_second
uint32_t packets_per_second
Definition observer.h:158
tlv_network_load::unknown3
uint32_t unknown3
Definition observer.h:159
tlv_network_load::bytes_per_second
uint32_t bytes_per_second
Definition observer.h:160
tlv_network_load::unknown1
uint32_t unknown1
Definition observer.h:156
tlv_network_load::utilization
uint32_t utilization
Definition observer.h:155
tlv_time_info
TLV payload carrying the timestamp reference timezone for an Observer capture file.
Definition observer.h:130
tlv_time_info::time_format
uint32_t time_format
Definition observer.h:131
tlv_wireless_info
TLV payload carrying wireless signal and channel quality metrics for a captured packet.
Definition observer.h:193
tlv_wireless_info::rate
uint8_t rate
Definition observer.h:196
tlv_wireless_info::frequency
uint8_t frequency
Definition observer.h:197
tlv_wireless_info::conditions
uint8_t conditions
Definition observer.h:200
tlv_wireless_info::quality
uint8_t quality
Definition observer.h:194
tlv_wireless_info::strengthPercent
uint8_t strengthPercent
Definition observer.h:199
tlv_wireless_info::qualityPercent
uint8_t qualityPercent
Definition observer.h:198
tlv_wireless_info::reserved
uint8_t reserved
Definition observer.h:201
tlv_wireless_info::signalStrength
uint8_t signalStrength
Definition observer.h:195
wtap
Definition wtap_module.h:58
wtap.h
wtap_open_return_val
wtap_open_return_val
For registering file types that we can open.
Definition wtap.h:1852