1 /* Combine multiple dump files, either by appending or by merging by timestamp
3 * Written by Scott Renfro <scott@renfro.org> based on
4 * editcap by Richard Sharpe and Guy Harris
6 * Copyright 2013, Scott Renfro <scott[AT]renfro.org>
10 * Wireshark - Network traffic analyzer
11 * By Gerald Combs <gerald@wireshark.org>
12 * Copyright 1998 Gerald Combs
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License along
25 * with this program; if not, write to the Free Software Foundation, Inc.,
26 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
40 #ifdef HAVE_SYS_TIME_H
49 * Scan through the arguments and open the input files
52 merge_open_in_files(int in_file_count, char *const *in_file_names,
53 merge_in_file_t **in_files, int *err, gchar **err_info,
57 size_t files_size = in_file_count * sizeof(merge_in_file_t);
58 merge_in_file_t *files;
61 files = (merge_in_file_t *)g_malloc(files_size);
64 for (i = 0; i < in_file_count; i++) {
65 files[i].filename = in_file_names[i];
66 files[i].wth = wtap_open_offline(in_file_names[i], err, err_info, FALSE);
67 files[i].data_offset = 0;
68 files[i].state = PACKET_NOT_PRESENT;
69 files[i].packet_num = 0;
71 /* Close the files we've already opened. */
72 for (j = 0; j < i; j++)
73 wtap_close(files[j].wth);
77 size = wtap_file_size(files[i].wth, err);
79 for (j = 0; j <= i; j++)
80 wtap_close(files[j].wth);
90 * Scan through and close each input file
93 merge_close_in_files(int count, merge_in_file_t in_files[])
96 for (i = 0; i < count; i++) {
97 wtap_close(in_files[i].wth);
102 * Select an output frame type based on the input files
103 * From Guy: If all files have the same frame type, then use that.
104 * Otherwise select WTAP_ENCAP_PER_PACKET. If the selected
105 * output file type doesn't support per packet frame types,
106 * then the wtap_dump_open call will fail with a reasonable
110 merge_select_frame_type(int count, merge_in_file_t files[])
113 int selected_frame_type;
115 selected_frame_type = wtap_file_encap(files[0].wth);
117 for (i = 1; i < count; i++) {
118 int this_frame_type = wtap_file_encap(files[i].wth);
119 if (selected_frame_type != this_frame_type) {
120 selected_frame_type = WTAP_ENCAP_PER_PACKET;
125 return selected_frame_type;
129 * Scan through input files and find maximum snapshot length
132 merge_max_snapshot_length(int count, merge_in_file_t in_files[])
135 int max_snapshot = 0;
138 for (i = 0; i < count; i++) {
139 snapshot_length = wtap_snapshot_length(in_files[i].wth);
140 if (snapshot_length == 0) {
141 /* Snapshot length of input file not known. */
142 snapshot_length = WTAP_MAX_PACKET_SIZE;
144 if (snapshot_length > max_snapshot)
145 max_snapshot = snapshot_length;
151 * returns TRUE if first argument is earlier than second
154 is_earlier(struct wtap_nstime *l, struct wtap_nstime *r) {
155 if (l->secs > r->secs) { /* left is later */
157 } else if (l->secs < r->secs) { /* left is earlier */
159 } else if (l->nsecs > r->nsecs) { /* tv_sec equal, l.usec later */
162 /* either one < two or one == two
163 * either way, return one
169 * Read the next packet, in chronological order, from the set of files
172 * On success, set *err to 0 and return a pointer to the merge_in_file_t
173 * for the file from which the packet was read.
175 * On a read error, set *err to the error and return a pointer to the
176 * merge_in_file_t for the file on which we got an error.
178 * On an EOF (meaning all the files are at EOF), set *err to 0 and return
182 merge_read_packet(int in_file_count, merge_in_file_t in_files[],
183 int *err, gchar **err_info)
187 struct wtap_nstime tv = { sizeof(time_t) > sizeof(int) ? LONG_MAX : INT_MAX, INT_MAX };
188 struct wtap_pkthdr *phdr;
191 * Make sure we have a packet available from each file, if there are any
192 * packets left in the file in question, and search for the packet
193 * with the earliest time stamp.
195 for (i = 0; i < in_file_count; i++) {
196 if (in_files[i].state == PACKET_NOT_PRESENT) {
198 * No packet available, and we haven't seen an error or EOF yet,
199 * so try to read the next packet.
201 if (!wtap_read(in_files[i].wth, err, err_info, &in_files[i].data_offset)) {
203 in_files[i].state = GOT_ERROR;
206 in_files[i].state = AT_EOF;
208 in_files[i].state = PACKET_PRESENT;
211 if (in_files[i].state == PACKET_PRESENT) {
212 phdr = wtap_phdr(in_files[i].wth);
213 if (is_earlier(&phdr->ts, &tv)) {
221 /* All the streams are at EOF. Return an EOF indication. */
226 /* We'll need to read another packet from this file. */
227 in_files[ei].state = PACKET_NOT_PRESENT;
229 /* Count this packet. */
230 in_files[ei].packet_num++;
233 * Return a pointer to the merge_in_file_t of the file from which the
237 return &in_files[ei];
241 * Read the next packet, in file sequence order, from the set of files
244 * On success, set *err to 0 and return a pointer to the merge_in_file_t
245 * for the file from which the packet was read.
247 * On a read error, set *err to the error and return a pointer to the
248 * merge_in_file_t for the file on which we got an error.
250 * On an EOF (meaning all the files are at EOF), set *err to 0 and return
254 merge_append_read_packet(int in_file_count, merge_in_file_t in_files[],
255 int *err, gchar **err_info)
260 * Find the first file not at EOF, and read the next packet from it.
262 for (i = 0; i < in_file_count; i++) {
263 if (in_files[i].state == AT_EOF)
264 continue; /* This file is already at EOF */
265 if (wtap_read(in_files[i].wth, err, err_info, &in_files[i].data_offset))
266 break; /* We have a packet */
268 /* Read error - quit immediately. */
269 in_files[i].state = GOT_ERROR;
272 /* EOF - flag this file as being at EOF, and try the next one. */
273 in_files[i].state = AT_EOF;
275 if (i == in_file_count) {
276 /* All the streams are at EOF. Return an EOF indication. */
282 * Return a pointer to the merge_in_file_t of the file from which the