2 * Routines for opening CommView file format packet captures
3 * Copyright 2007, Stephen Fisher (see AUTHORS file)
5 * Wireshark - Network traffic analyzer
6 * By Gerald Combs <gerald@wireshark.org>
7 * Copyright 1998 Gerald Combs
9 * Based on csids.c and nettl.c
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version 2
14 * of the License, or (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
27 /* A brief description of this file format is available at:
28 * http://www.tamos.com/htmlhelp/commview/logformat.htm
38 #include "file_wrappers.h"
41 #include <wsutil/frequency-utils.h>
43 typedef struct commview_header {
45 guint16 source_data_len;
54 guint8 flags; /* Bit-field positions defined below */
55 guint8 signal_level_percent;
59 guint8 direction; /* Or for WiFi, high order byte of
61 gint8 signal_level_dbm;
62 gint8 noise_level; /* In dBm (WiFi only) */
65 #define COMMVIEW_HEADER_SIZE 24
67 /* Bit-field positions for various fields in the flags variable of the header */
68 #define FLAGS_MEDIUM 0x0F
69 #define FLAGS_DECRYPTED 0x10
70 #define FLAGS_BROKEN 0x20
71 #define FLAGS_COMPRESSED 0x40
72 #define FLAGS_RESERVED 0x80
74 /* Values for the band variable of the header */
78 #define BAND_11A_TURBO 0x08
79 #define BAND_SUPERG 0x10
80 #define BAND_PUBLIC_SAFETY 0x20 /* 4.99 GHz public safety */
81 #define BAND_11N_5GHZ 0x40
82 #define BAND_11N_2_4GHZ 0x80
84 /* Capture mediums as defined by the commview file format */
85 #define MEDIUM_ETHERNET 0
87 #define MEDIUM_TOKEN_RING 2
89 static gboolean commview_read(wtap *wth, int *err, gchar **err_info,
91 static gboolean commview_seek_read(wtap *wth, gint64 seek_off,
92 struct wtap_pkthdr *phdr,
93 Buffer *buf, int *err, gchar **err_info);
94 static gboolean commview_read_header(commview_header_t *cv_hdr, FILE_T fh,
95 int *err, gchar **err_info);
96 static gboolean commview_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
97 const guint8 *pd, int *err, gchar **err_info);
99 wtap_open_return_val commview_open(wtap *wth, int *err, gchar **err_info)
101 commview_header_t cv_hdr;
103 if(!commview_read_header(&cv_hdr, wth->fh, err, err_info)) {
104 if (*err != 0 && *err != WTAP_ERR_SHORT_READ)
105 return WTAP_OPEN_ERROR;
106 return WTAP_OPEN_NOT_MINE;
109 /* If any of these fields do not match what we expect, bail out. */
110 if(cv_hdr.version != 0 ||
111 cv_hdr.year < 1970 || cv_hdr.year >= 2038 ||
112 cv_hdr.month < 1 || cv_hdr.month > 12 ||
113 cv_hdr.day < 1 || cv_hdr.day > 31 ||
115 cv_hdr.minutes > 59 ||
116 cv_hdr.seconds > 60 ||
117 cv_hdr.signal_level_percent > 100 ||
118 (cv_hdr.flags & FLAGS_RESERVED) != 0 ||
119 ((cv_hdr.flags & FLAGS_MEDIUM) != MEDIUM_ETHERNET &&
120 (cv_hdr.flags & FLAGS_MEDIUM) != MEDIUM_WIFI &&
121 (cv_hdr.flags & FLAGS_MEDIUM) != MEDIUM_TOKEN_RING))
122 return WTAP_OPEN_NOT_MINE; /* Not our kind of file */
124 /* No file header. Reset the fh to 0 so we can read the first packet */
125 if (file_seek(wth->fh, 0, SEEK_SET, err) == -1)
126 return WTAP_OPEN_ERROR;
128 /* Set up the pointers to the handlers for this file type */
129 wth->subtype_read = commview_read;
130 wth->subtype_seek_read = commview_seek_read;
132 wth->file_type_subtype = WTAP_FILE_TYPE_SUBTYPE_COMMVIEW;
133 wth->file_encap = WTAP_ENCAP_PER_PACKET;
134 wth->file_tsprec = WTAP_TSPREC_USEC;
136 return WTAP_OPEN_MINE; /* Our kind of file */
140 commview_read_packet(FILE_T fh, struct wtap_pkthdr *phdr, Buffer *buf,
141 int *err, gchar **err_info)
143 commview_header_t cv_hdr;
147 if(!commview_read_header(&cv_hdr, fh, err, err_info))
150 * The maximum value of cv_hdr.data_len is 65535, which is less
151 * than WTAP_MAX_PACKET_SIZE will ever be, so we don't need to
155 switch(cv_hdr.flags & FLAGS_MEDIUM) {
157 case MEDIUM_ETHERNET :
158 phdr->pkt_encap = WTAP_ENCAP_ETHERNET;
159 phdr->pseudo_header.eth.fcs_len = -1; /* Unknown */
163 phdr->pkt_encap = WTAP_ENCAP_IEEE_802_11_WITH_RADIO;
164 memset(&phdr->pseudo_header.ieee_802_11, 0, sizeof(phdr->pseudo_header.ieee_802_11));
165 phdr->pseudo_header.ieee_802_11.fcs_len = -1; /* Unknown */
166 phdr->pseudo_header.ieee_802_11.decrypted = FALSE;
167 phdr->pseudo_header.ieee_802_11.datapad = FALSE;
168 phdr->pseudo_header.ieee_802_11.phy = PHDR_802_11_PHY_UNKNOWN;
169 switch (cv_hdr.band) {
172 phdr->pseudo_header.ieee_802_11.phy = PHDR_802_11_PHY_11A;
173 phdr->pseudo_header.ieee_802_11.phy_info.info_11a.has_turbo_type = TRUE;
174 phdr->pseudo_header.ieee_802_11.phy_info.info_11a.turbo_type =
175 PHDR_802_11A_TURBO_TYPE_NORMAL;
176 frequency = ieee80211_chan_to_mhz(cv_hdr.channel, FALSE);
180 phdr->pseudo_header.ieee_802_11.phy = PHDR_802_11_PHY_11B;
181 frequency = ieee80211_chan_to_mhz(cv_hdr.channel, TRUE);
185 phdr->pseudo_header.ieee_802_11.phy = PHDR_802_11_PHY_11G;
186 phdr->pseudo_header.ieee_802_11.phy_info.info_11g.has_mode = TRUE;
187 phdr->pseudo_header.ieee_802_11.phy_info.info_11g.mode =
188 PHDR_802_11G_MODE_NORMAL;
189 frequency = ieee80211_chan_to_mhz(cv_hdr.channel, TRUE);
193 phdr->pseudo_header.ieee_802_11.phy = PHDR_802_11_PHY_11A;
194 phdr->pseudo_header.ieee_802_11.phy_info.info_11a.has_turbo_type = TRUE;
195 phdr->pseudo_header.ieee_802_11.phy_info.info_11a.turbo_type =
196 PHDR_802_11A_TURBO_TYPE_TURBO;
197 frequency = ieee80211_chan_to_mhz(cv_hdr.channel, FALSE);
201 phdr->pseudo_header.ieee_802_11.phy = PHDR_802_11_PHY_11G;
202 phdr->pseudo_header.ieee_802_11.phy_info.info_11g.has_mode = TRUE;
203 phdr->pseudo_header.ieee_802_11.phy_info.info_11g.mode =
204 PHDR_802_11G_MODE_SUPER_G;
205 frequency = ieee80211_chan_to_mhz(cv_hdr.channel, TRUE);
209 phdr->pseudo_header.ieee_802_11.phy = PHDR_802_11_PHY_11N;
210 frequency = ieee80211_chan_to_mhz(cv_hdr.channel, FALSE);
213 case BAND_11N_2_4GHZ:
214 phdr->pseudo_header.ieee_802_11.phy = PHDR_802_11_PHY_11N;
215 frequency = ieee80211_chan_to_mhz(cv_hdr.channel, TRUE);
218 case BAND_PUBLIC_SAFETY:
220 * XXX - what do we do here? What are the channel
221 * numbers? How do we distinguish the several
222 * different flavors of 4.9 GHz frequencies?
231 if (frequency != 0) {
232 phdr->pseudo_header.ieee_802_11.has_frequency = TRUE;
233 phdr->pseudo_header.ieee_802_11.frequency = frequency;
235 phdr->pseudo_header.ieee_802_11.has_channel = TRUE;
236 phdr->pseudo_header.ieee_802_11.channel = cv_hdr.channel;
238 phdr->pseudo_header.ieee_802_11.has_data_rate = TRUE;
239 phdr->pseudo_header.ieee_802_11.data_rate =
240 cv_hdr.rate | (cv_hdr.direction << 8);
242 phdr->pseudo_header.ieee_802_11.has_signal_percent = TRUE;
243 phdr->pseudo_header.ieee_802_11.signal_percent = cv_hdr.signal_level_percent;
246 * XXX - these are positive in captures I've seen; does
247 * that mean that they are the negative of the actual
248 * dBm value? (80 dBm is a bit more power than most
249 * countries' regulatory agencies are likely to allow
250 * any individual to have in their home. :-))
252 * XXX - sometimes these are 0; assume that means that no
255 if (cv_hdr.signal_level_dbm != 0) {
256 phdr->pseudo_header.ieee_802_11.signal_dbm = -cv_hdr.signal_level_dbm;
257 phdr->pseudo_header.ieee_802_11.has_signal_dbm = TRUE;
259 if (cv_hdr.noise_level != 0) {
260 phdr->pseudo_header.ieee_802_11.noise_dbm = -cv_hdr.noise_level;
261 phdr->pseudo_header.ieee_802_11.has_noise_dbm = TRUE;
265 case MEDIUM_TOKEN_RING :
266 phdr->pkt_encap = WTAP_ENCAP_TOKEN_RING;
270 *err = WTAP_ERR_BAD_FILE;
271 *err_info = g_strdup_printf("commview: unsupported encap: %u",
272 cv_hdr.flags & FLAGS_MEDIUM);
276 tm.tm_year = cv_hdr.year - 1900;
277 tm.tm_mon = cv_hdr.month - 1;
278 tm.tm_mday = cv_hdr.day;
279 tm.tm_hour = cv_hdr.hours;
280 tm.tm_min = cv_hdr.minutes;
281 tm.tm_sec = cv_hdr.seconds;
284 phdr->rec_type = REC_TYPE_PACKET;
285 phdr->presence_flags = WTAP_HAS_TS;
287 phdr->len = cv_hdr.data_len;
288 phdr->caplen = cv_hdr.data_len;
290 phdr->ts.secs = mktime(&tm);
291 phdr->ts.nsecs = cv_hdr.usecs * 1000;
293 return wtap_read_packet_bytes(fh, buf, phdr->caplen, err, err_info);
297 commview_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
299 *data_offset = file_tell(wth->fh);
301 return commview_read_packet(wth->fh, &wth->phdr, wth->frame_buffer, err,
306 commview_seek_read(wtap *wth, gint64 seek_off, struct wtap_pkthdr *phdr,
307 Buffer *buf, int *err, gchar **err_info)
309 if(file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
312 return commview_read_packet(wth->random_fh, phdr, buf, err, err_info);
316 commview_read_header(commview_header_t *cv_hdr, FILE_T fh, int *err,
319 if (!wtap_read_bytes_or_eof(fh, &cv_hdr->data_len, 2, err, err_info))
321 if (!wtap_read_bytes(fh, &cv_hdr->source_data_len, 2, err, err_info))
323 if (!wtap_read_bytes(fh, &cv_hdr->version, 1, err, err_info))
325 if (!wtap_read_bytes(fh, &cv_hdr->year, 2, err, err_info))
327 if (!wtap_read_bytes(fh, &cv_hdr->month, 1, err, err_info))
329 if (!wtap_read_bytes(fh, &cv_hdr->day, 1, err, err_info))
331 if (!wtap_read_bytes(fh, &cv_hdr->hours, 1, err, err_info))
333 if (!wtap_read_bytes(fh, &cv_hdr->minutes, 1, err, err_info))
335 if (!wtap_read_bytes(fh, &cv_hdr->seconds, 1, err, err_info))
337 if (!wtap_read_bytes(fh, &cv_hdr->usecs, 4, err, err_info))
339 if (!wtap_read_bytes(fh, &cv_hdr->flags, 1, err, err_info))
341 if (!wtap_read_bytes(fh, &cv_hdr->signal_level_percent, 1, err, err_info))
343 if (!wtap_read_bytes(fh, &cv_hdr->rate, 1, err, err_info))
345 if (!wtap_read_bytes(fh, &cv_hdr->band, 1, err, err_info))
347 if (!wtap_read_bytes(fh, &cv_hdr->channel, 1, err, err_info))
349 if (!wtap_read_bytes(fh, &cv_hdr->direction, 1, err, err_info))
351 if (!wtap_read_bytes(fh, &cv_hdr->signal_level_dbm, 1, err, err_info))
353 if (!wtap_read_bytes(fh, &cv_hdr->noise_level, 1, err, err_info))
356 /* Convert multi-byte values from little endian to host endian format */
357 cv_hdr->data_len = GUINT16_FROM_LE(cv_hdr->data_len);
358 cv_hdr->source_data_len = GUINT16_FROM_LE(cv_hdr->source_data_len);
359 cv_hdr->year = GUINT16_FROM_LE(cv_hdr->year);
360 cv_hdr->usecs = GUINT32_FROM_LE(cv_hdr->usecs);
365 /* Returns 0 if we can write out the specified encapsulation type
366 * into a CommView format file. */
367 int commview_dump_can_write_encap(int encap)
371 case WTAP_ENCAP_ETHERNET :
372 case WTAP_ENCAP_IEEE_802_11 :
373 case WTAP_ENCAP_IEEE_802_11_WITH_RADIO :
374 case WTAP_ENCAP_TOKEN_RING :
375 case WTAP_ENCAP_PER_PACKET :
379 return WTAP_ERR_UNWRITABLE_ENCAP;
383 /* Returns TRUE on success, FALSE on failure;
384 sets "*err" to an error code on failure */
385 gboolean commview_dump_open(wtap_dumper *wdh, int *err _U_)
387 wdh->subtype_write = commview_dump;
389 /* There is no file header to write out */
390 wdh->bytes_dumped = 0;
395 /* Write a record for a packet to a dump file.
396 * Returns TRUE on success, FALSE on failure. */
397 static gboolean commview_dump(wtap_dumper *wdh,
398 const struct wtap_pkthdr *phdr,
399 const guint8 *pd, int *err, gchar **err_info _U_)
401 commview_header_t cv_hdr;
404 /* We can only write packet records. */
405 if (phdr->rec_type != REC_TYPE_PACKET) {
406 *err = WTAP_ERR_UNWRITABLE_REC_TYPE;
410 /* Don't write out anything bigger than we can read.
411 * (The length field in packet headers is 16 bits, which
412 * imposes a hard limit.) */
413 if (phdr->caplen > 65535) {
414 *err = WTAP_ERR_PACKET_TOO_LARGE;
418 memset(&cv_hdr, 0, sizeof(cv_hdr));
420 cv_hdr.data_len = GUINT16_TO_LE((guint16)phdr->caplen);
421 cv_hdr.source_data_len = GUINT16_TO_LE((guint16)phdr->caplen);
424 tm = localtime(&phdr->ts.secs);
425 cv_hdr.year = tm->tm_year + 1900;
426 cv_hdr.month = tm->tm_mon + 1;
427 cv_hdr.day = tm->tm_mday;
428 cv_hdr.hours = tm->tm_hour;
429 cv_hdr.minutes = tm->tm_min;
430 cv_hdr.seconds = tm->tm_sec;
431 cv_hdr.usecs = GUINT32_TO_LE(phdr->ts.nsecs / 1000);
433 switch(phdr->pkt_encap) {
435 case WTAP_ENCAP_ETHERNET :
436 cv_hdr.flags |= MEDIUM_ETHERNET;
439 case WTAP_ENCAP_IEEE_802_11 :
440 cv_hdr.flags |= MEDIUM_WIFI;
443 case WTAP_ENCAP_IEEE_802_11_WITH_RADIO :
444 cv_hdr.flags |= MEDIUM_WIFI;
446 switch (phdr->pseudo_header.ieee_802_11.phy) {
448 case PHDR_802_11_PHY_11A:
450 * If we don't know whether it's turbo, say it's
453 if (!phdr->pseudo_header.ieee_802_11.phy_info.info_11a.has_turbo_type ||
454 phdr->pseudo_header.ieee_802_11.phy_info.info_11a.turbo_type == PHDR_802_11A_TURBO_TYPE_NORMAL)
455 cv_hdr.band = BAND_11A;
457 cv_hdr.band = BAND_11A_TURBO;
460 case PHDR_802_11_PHY_11B:
461 cv_hdr.band = BAND_11B;
464 case PHDR_802_11_PHY_11G:
466 * If we don't know whether it's Super G, say it's
469 if (!phdr->pseudo_header.ieee_802_11.phy_info.info_11g.has_mode)
470 cv_hdr.band = BAND_11G;
472 switch (phdr->pseudo_header.ieee_802_11.phy_info.info_11g.mode) {
474 case PHDR_802_11G_MODE_NORMAL:
475 cv_hdr.band = BAND_11G;
478 case PHDR_802_11G_MODE_SUPER_G:
479 cv_hdr.band = BAND_SUPERG;
483 cv_hdr.band = BAND_11G;
489 case PHDR_802_11_PHY_11N:
491 * Pick the band based on the frequency.
493 if (phdr->pseudo_header.ieee_802_11.has_frequency) {
494 if (phdr->pseudo_header.ieee_802_11.frequency > 2484) {
496 cv_hdr.band = BAND_11N_5GHZ;
499 cv_hdr.band = BAND_11N_2_4GHZ;
502 /* Band is unknown. */
509 * It's not documented how they handle 11ac,
510 * and they don't support the older PHYs.
516 phdr->pseudo_header.ieee_802_11.has_channel ?
517 phdr->pseudo_header.ieee_802_11.channel :
520 phdr->pseudo_header.ieee_802_11.has_data_rate ?
521 (guint8)(phdr->pseudo_header.ieee_802_11.data_rate & 0xFF) :
524 phdr->pseudo_header.ieee_802_11.has_data_rate ?
525 (guint8)((phdr->pseudo_header.ieee_802_11.data_rate >> 8) & 0xFF) :
527 cv_hdr.signal_level_percent =
528 phdr->pseudo_header.ieee_802_11.has_signal_percent ?
529 phdr->pseudo_header.ieee_802_11.signal_percent :
531 cv_hdr.signal_level_dbm =
532 phdr->pseudo_header.ieee_802_11.has_signal_dbm ?
533 -phdr->pseudo_header.ieee_802_11.signal_dbm :
536 phdr->pseudo_header.ieee_802_11.has_noise_dbm ?
537 -phdr->pseudo_header.ieee_802_11.noise_dbm :
541 case WTAP_ENCAP_TOKEN_RING :
542 cv_hdr.flags |= MEDIUM_TOKEN_RING;
546 *err = WTAP_ERR_UNWRITABLE_ENCAP;
550 if (!wtap_dump_file_write(wdh, &cv_hdr.data_len, 2, err))
552 if (!wtap_dump_file_write(wdh, &cv_hdr.source_data_len, 2, err))
554 if (!wtap_dump_file_write(wdh, &cv_hdr.version, 1, err))
556 if (!wtap_dump_file_write(wdh, &cv_hdr.year, 2, err))
558 if (!wtap_dump_file_write(wdh, &cv_hdr.month, 1, err))
560 if (!wtap_dump_file_write(wdh, &cv_hdr.day, 1, err))
562 if (!wtap_dump_file_write(wdh, &cv_hdr.hours, 1, err))
564 if (!wtap_dump_file_write(wdh, &cv_hdr.minutes, 1, err))
566 if (!wtap_dump_file_write(wdh, &cv_hdr.seconds, 1, err))
568 if (!wtap_dump_file_write(wdh, &cv_hdr.usecs, 4, err))
570 if (!wtap_dump_file_write(wdh, &cv_hdr.flags, 1, err))
572 if (!wtap_dump_file_write(wdh, &cv_hdr.signal_level_percent, 1, err))
574 if (!wtap_dump_file_write(wdh, &cv_hdr.rate, 1, err))
576 if (!wtap_dump_file_write(wdh, &cv_hdr.band, 1, err))
578 if (!wtap_dump_file_write(wdh, &cv_hdr.channel, 1, err))
580 if (!wtap_dump_file_write(wdh, &cv_hdr.direction, 1, err))
582 if (!wtap_dump_file_write(wdh, &cv_hdr.signal_level_dbm, 2, err))
584 if (!wtap_dump_file_write(wdh, &cv_hdr.noise_level, 2, err))
586 wdh->bytes_dumped += COMMVIEW_HEADER_SIZE;
588 if (!wtap_dump_file_write(wdh, pd, phdr->caplen, err))
590 wdh->bytes_dumped += phdr->caplen;
596 * Editor modelines - http://www.wireshark.org/tools/modelines.html
601 * indent-tabs-mode: t
604 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
605 * :indentSize=8:tabSize=8:noTabs=false: