| Wireshark 4.7.3 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
Classes | Macros | Typedefs | Functions
observer.h File Reference
`#include "wtap.h"`

Go to the source code of this file.

## Classes
struct | capture_file_header
| Top-level file header for a Network Instruments Observer capture file. More...
struct | tlv_header
| TLV (Type-Length-Value) header used for information elements appended to the Observer capture file header. More...
struct | tlv_time_info
| TLV payload carrying the timestamp reference timezone for an Observer capture file. More...
struct | tlv_network_load
| TLV payload carrying a network load snapshot sampled at the time of capture. More...
struct | tlv_wireless_info
| TLV payload carrying wireless signal and channel quality metrics for a captured packet. More...
struct | tlv_capture_start_stop
| TLV payload recording a capture start or stop event in the Observer capture file. More...
struct | packet_entry_header
| Per-packet record header in a Network Instruments Observer capture file. More...

## Macros
#define | CAPTURE_FILE_HEADER_FROM_LE_IN_PLACE(_capture_file_header)
| Converts `offset_to_first_packet` in a capture_file_header from little-endian to host byte order in place.
#define | CAPTURE_FILE_HEADER_TO_LE_IN_PLACE(_capture_file_header)
| Converts `offset_to_first_packet` in a capture_file_header from host byte order to little-endian in place.
#define | TLV_HEADER_FROM_LE_IN_PLACE(_tlv_header)
| Converts all fields of a tlv_header from little-endian to host byte order in place.
#define | TLV_HEADER_TO_LE_IN_PLACE(_tlv_header)
| Converts all fields of a tlv_header from host byte order to little-endian in place.
#define | INFORMATION_TYPE_ALIAS_LIST 0x0001
#define | INFORMATION_TYPE_COMMENT 0x0002 /* ASCII text */
#define | INFORMATION_TYPE_TIME_INFO 0x0004
#define | INFORMATION_TYPE_REMOTE_PROBE 0x0005
#define | INFORMATION_TYPE_NETWORK_LOAD 0x0100
#define | INFORMATION_TYPE_WIRELESS 0x0101
#define | INFORMATION_TYPE_CAPTURE_START_STOP 0x0104
#define | TIME_INFO_LOCAL 0
#define | TIME_INFO_GMT 1
#define | TLV_TIME_INFO_FROM_LE_IN_PLACE(_tlv_time_info)
| Converts all fields of a tlv_time_info from little-endian to host byte order in place.
#define | TLV_TIME_INFO_TO_LE_IN_PLACE(_tlv_time_info)
| Converts all fields of a tlv_time_info from host byte order to little-endian in place.
#define | TLV_NETWORK_LOAD_FROM_LE_IN_PLACE(_tlv_network_load)
| Converts all fields of a tlv_network_load from little-endian to host byte order in place.
#define | TLV_NETWORK_LOAD_TO_LE_IN_PLACE(_tlv_network_load)
| Converts all fields of a tlv_network_load from host byte order to little-endian in place.
#define | WIRELESS_WEP_SUCCESS 0x80
#define | START_STOP_TYPE_STOP 0
#define | START_STOP_TYPE_START 1
#define | PACKET_ENTRY_HEADER_FROM_LE_IN_PLACE(_packet_entry_header)
#define | PACKET_ENTRY_HEADER_TO_LE_IN_PLACE(_packet_entry_header)
#define | OBSERVER_UNDEFINED 0xFF
#define | OBSERVER_ETHERNET 0x00
#define | OBSERVER_TOKENRING 0x01
#define | OBSERVER_FIBRE_CHANNEL 0x08
#define | OBSERVER_WIRELESS_802_11 0x09
#define | PACKET_TYPE_DATA_PACKET 0
#define | PACKET_TYPE_EXPERT_INFORMATION_PACKET 1

## Typedefs
typedef struct capture_file_header | capture_file_header
| Top-level file header for a Network Instruments Observer capture file.
typedef struct tlv_header | tlv_header
| TLV (Type-Length-Value) header used for information elements appended to the Observer capture file header.
typedef struct tlv_time_info | tlv_time_info
| TLV payload carrying the timestamp reference timezone for an Observer capture file.
typedef struct tlv_network_load | tlv_network_load
| TLV payload carrying a network load snapshot sampled at the time of capture.
typedef struct tlv_wireless_info | tlv_wireless_info
| TLV payload carrying wireless signal and channel quality metrics for a captured packet.
typedef struct tlv_capture_start_stop | tlv_capture_start_stop
| TLV payload recording a capture start or stop event in the Observer capture file.
typedef struct packet_entry_header | packet_entry_header
| Per-packet record header in a Network Instruments Observer capture file.

## Functions
wtap_open_return_val | observer_open (wtap *wth, int *err, char **err_info)
| Opens a capture file using the observer format.

## Detailed Description

## observer.h - description

begin : Wed Oct 29 2003 copyright : (C) 2003 by root email : scotte[AT}netinst.com

## Macro Definition Documentation

## ◆ CAPTURE_FILE_HEADER_FROM_LE_IN_PLACE

#define CAPTURE_FILE_HEADER_FROM_LE_IN_PLACE | ( |  | _capture_file_header | ) |

Value:
_capture_file_header.offset_to_first_packet = GUINT16_FROM_LE((_capture_file_header).offset_to_first_packet)

Converts `offset_to_first_packet` in a capture_file_header from little-endian to host byte order in place.

## ◆ CAPTURE_FILE_HEADER_TO_LE_IN_PLACE

#define CAPTURE_FILE_HEADER_TO_LE_IN_PLACE | ( |  | _capture_file_header | ) |

Value:
_capture_file_header.offset_to_first_packet = GUINT16_TO_LE((_capture_file_header).offset_to_first_packet)

Converts `offset_to_first_packet` in a capture_file_header from host byte order to little-endian in place.

## ◆ PACKET_ENTRY_HEADER_FROM_LE_IN_PLACE

#define PACKET_ENTRY_HEADER_FROM_LE_IN_PLACE | ( |  | _packet_entry_header | ) |

Value:
(_packet_entry_header).packet_magic = GUINT32_FROM_LE((_packet_entry_header).packet_magic); \
(_packet_entry_header).network_speed = GUINT32_FROM_LE((_packet_entry_header).network_speed); \
(_packet_entry_header).captured_size = GUINT16_FROM_LE((_packet_entry_header).captured_size); \
(_packet_entry_header).network_size = GUINT16_FROM_LE((_packet_entry_header).network_size); \
(_packet_entry_header).offset_to_frame = GUINT16_FROM_LE((_packet_entry_header).offset_to_frame); \
(_packet_entry_header).offset_to_next_packet = GUINT16_FROM_LE((_packet_entry_header).offset_to_next_packet); \
(_packet_entry_header).errors = GUINT16_FROM_LE((_packet_entry_header).errors); \
(_packet_entry_header).reserved = GUINT16_FROM_LE((_packet_entry_header).reserved); \
(_packet_entry_header).packet_number = GUINT64_FROM_LE((_packet_entry_header).packet_number); \
(_packet_entry_header).original_packet_number = GUINT64_FROM_LE((_packet_entry_header).original_packet_number); \
(_packet_entry_header).nano_seconds_since_2000 = GUINT64_FROM_LE((_packet_entry_header).nano_seconds_since_2000)

## ◆ PACKET_ENTRY_HEADER_TO_LE_IN_PLACE

#define PACKET_ENTRY_HEADER_TO_LE_IN_PLACE | ( |  | _packet_entry_header | ) |

Value:
(_packet_entry_header).packet_magic = GUINT32_TO_LE((_packet_entry_header).packet_magic); \
(_packet_entry_header).network_speed = GUINT32_TO_LE((_packet_entry_header).network_speed); \
(_packet_entry_header).captured_size = GUINT16_TO_LE((_packet_entry_header).captured_size); \
(_packet_entry_header).network_size = GUINT16_TO_LE((_packet_entry_header).network_size); \
(_packet_entry_header).offset_to_frame = GUINT16_TO_LE((_packet_entry_header).offset_to_frame); \
(_packet_entry_header).offset_to_next_packet = GUINT16_TO_LE((_packet_entry_header).offset_to_next_packet); \
(_packet_entry_header).errors = GUINT16_TO_LE((_packet_entry_header).errors); \
(_packet_entry_header).reserved = GUINT16_TO_LE((_packet_entry_header).reserved); \
(_packet_entry_header).packet_number = GUINT64_TO_LE((_packet_entry_header).packet_number); \
(_packet_entry_header).original_packet_number = GUINT64_TO_LE((_packet_entry_header).original_packet_number); \
(_packet_entry_header).nano_seconds_since_2000 = GUINT64_TO_LE((_packet_entry_header).nano_seconds_since_2000)

## ◆ START_STOP_TYPE_START

#define START_STOP_TYPE_START 1

Capture start event.

## ◆ START_STOP_TYPE_STOP

#define START_STOP_TYPE_STOP 0

Capture stop event.

## ◆ TIME_INFO_GMT

#define TIME_INFO_GMT 1

Timestamps in the capture file are in GMT.

## ◆ TIME_INFO_LOCAL

#define TIME_INFO_LOCAL 0

Timestamps in the capture file are in local time.

## ◆ TLV_HEADER_FROM_LE_IN_PLACE

#define TLV_HEADER_FROM_LE_IN_PLACE | ( |  | _tlv_header | ) |

Value:
(_tlv_header).type = GUINT16_FROM_LE((_tlv_header).type); \
(_tlv_header).length = GUINT16_FROM_LE((_tlv_header).length)

Converts all fields of a tlv_header from little-endian to host byte order in place.

## ◆ TLV_HEADER_TO_LE_IN_PLACE

#define TLV_HEADER_TO_LE_IN_PLACE | ( |  | _tlv_header | ) |

Value:
(_tlv_header).type = GUINT16_TO_LE((_tlv_header).type); \
(_tlv_header).length = GUINT16_TO_LE((_tlv_header).length)

Converts all fields of a tlv_header from host byte order to little-endian in place.

## ◆ TLV_NETWORK_LOAD_FROM_LE_IN_PLACE

#define TLV_NETWORK_LOAD_FROM_LE_IN_PLACE | ( |  | _tlv_network_load | ) |

Value:
(_tlv_network_load).utilization = GUINT32_FROM_LE((_tlv_network_load).utilization); \
(_tlv_network_load).unknown1 = GUINT32_FROM_LE((_tlv_network_load).unknown1); \
(_tlv_network_load).unknown2 = GUINT32_FROM_LE((_tlv_network_load).unknown2); \
(_tlv_network_load).packets_per_second = GUINT32_FROM_LE((_tlv_network_load).packets_per_second); \
(_tlv_network_load).unknown3 = GUINT32_FROM_LE((_tlv_network_load).unknown3); \
(_tlv_network_load).bytes_per_second = GUINT32_FROM_LE((_tlv_network_load).bytes_per_second); \
(_tlv_network_load).unknown4 = GUINT32_FROM_LE((_tlv_network_load).unknown4)

Converts all fields of a tlv_network_load from little-endian to host byte order in place.

## ◆ TLV_NETWORK_LOAD_TO_LE_IN_PLACE

#define TLV_NETWORK_LOAD_TO_LE_IN_PLACE | ( |  | _tlv_network_load | ) |

Value:
(_tlv_network_load).utilization = GUINT32_TO_LE((_tlv_network_load).utilization); \
(_tlv_network_load).unknown1 = GUINT32_TO_LE((_tlv_network_load).unknown1); \
(_tlv_network_load).unknown2 = GUINT32_TO_LE((_tlv_network_load).unknown2); \
(_tlv_network_load).packets_per_second = GUINT32_TO_LE((_tlv_network_load).packets_per_second); \
(_tlv_network_load).unknown3 = GUINT32_TO_LE((_tlv_network_load).unknown3); \
(_tlv_network_load).bytes_per_second = GUINT32_TO_LE((_tlv_network_load).bytes_per_second); \
(_tlv_network_load).unknown4 = GUINT32_TO_LE((_tlv_network_load).unknown4)

Converts all fields of a tlv_network_load from host byte order to little-endian in place.

## ◆ TLV_TIME_INFO_FROM_LE_IN_PLACE

#define TLV_TIME_INFO_FROM_LE_IN_PLACE | ( |  | _tlv_time_info | ) |

Value:
(_tlv_time_info).time_format = GUINT32_FROM_LE((_tlv_time_info).time_format)

Converts all fields of a tlv_time_info from little-endian to host byte order in place.

## ◆ TLV_TIME_INFO_TO_LE_IN_PLACE

#define TLV_TIME_INFO_TO_LE_IN_PLACE | ( |  | _tlv_time_info | ) |

Value:
(_tlv_time_info).time_format = GUINT32_TO_LE((_tlv_time_info).time_format)

Converts all fields of a tlv_time_info from host byte order to little-endian in place.

## ◆ WIRELESS_WEP_SUCCESS

#define WIRELESS_WEP_SUCCESS 0x80

WEP decryption of this packet succeeded.

## Typedef Documentation

## ◆ capture_file_header

typedef struct capture_file_header capture_file_header

Top-level file header for a Network Instruments Observer capture file.

As of v15, `observer_version` was shortened by one byte to introduce `offset_to_first_packet_high_byte`, extending the addressable range for the first-packet offset to 16 MB. Files predating v15 will always have `offset_to_first_packet_high_byte` set to 0.

## ◆ tlv_network_load

typedef struct tlv_network_load tlv_network_load

TLV payload carrying a network load snapshot sampled at the time of capture.

The purpose of `unknown1`, `unknown2`, `unknown3`, and `unknown4` is undetermined; they may represent broadcast counts, multicast counts, or error counters. All have been observed as zero in known captures.

## ◆ tlv_wireless_info

typedef struct tlv_wireless_info tlv_wireless_info

TLV payload carrying wireless signal and channel quality metrics for a captured packet.

`quality` takes observed values of 15, 20–27, 50–54, 208, and 213. `conditions` takes observed values of 0x00, 0x02, and 0x90. `reserved` takes observed values of 0x00 or 0x80; the 0x80 value co-occurs with `conditions` = 0x90.

## Function Documentation

## ◆ observer_open()

wtap_open_return_val observer_open | ( | wtap * | wth,
|  | int * | err,
|  | char ** | err_info )

Opens a capture file using the observer format.

This function attempts to open and read the header of a capture file in the observer format.

Parameters

  wth | Pointer to the wtap structure that will hold the file information.
  err | Pointer to an integer where any error code will be stored if an error occurs.
  err_info | Pointer to a char pointer where any error message will be stored if an error occurs.

Returns
  A value indicating whether the file was successfully opened or not.

< Timestamps in the capture file are in local time.

< Precision: 1 nanosecond (9 fractional digits).