6 * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version 2
11 * of the License, or (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
29 #include "file_wrappers.h"
33 /* See RFC 1761 for a description of the "snoop" file format. */
35 /* Magic number in "snoop" files. */
36 static const char snoop_magic[] = {
37 's', 'n', 'o', 'o', 'p', '\0', '\0', '\0'
40 /* "snoop" file header (minus magic number). */
42 guint32 version; /* version number (should be 2) */
43 guint32 network; /* network type */
46 /* "snoop" record header. */
48 guint32 orig_len; /* actual length of packet */
49 guint32 incl_len; /* number of octets captured in file */
50 guint32 rec_len; /* length of record */
51 guint32 cum_drops; /* cumulative number of dropped packets */
52 guint32 ts_sec; /* timestamp seconds */
53 guint32 ts_usec; /* timestamp microseconds */
57 * The link-layer header on ATM packets.
59 struct snoop_atm_hdr {
60 guint8 flags; /* destination and traffic type */
62 guint16 vci; /* VCI */
66 * Extra information stuffed into the padding in Shomiti/Finisar Surveyor
69 struct shomiti_trailer {
70 guint16 phy_rx_length; /* length on the wire, including FCS? */
71 guint16 phy_rx_status; /* status flags */
72 guint32 ts_40_ns_lsb; /* 40 ns time stamp, low-order bytes? */
73 guint32 ts_40_ns_msb; /* 40 ns time stamp, low-order bytes? */
74 gint32 frame_id; /* "FrameID"? */
78 * phy_rx_status flags.
80 #define RX_STATUS_OVERFLOW 0x8000 /* overflow error */
81 #define RX_STATUS_BAD_CRC 0x4000 /* CRC error */
82 #define RX_STATUS_DRIBBLE_NIBBLE 0x2000 /* dribble/nibble bits? */
83 #define RX_STATUS_SHORT_FRAME 0x1000 /* frame < 64 bytes */
84 #define RX_STATUS_OVERSIZE_FRAME 0x0800 /* frame > 1518 bytes */
85 #define RX_STATUS_GOOD_FRAME 0x0400 /* frame OK */
86 #define RX_STATUS_N12_BYTES_RECEIVED 0x0200 /* first 12 bytes of frame received? */
87 #define RX_STATUS_RXABORT 0x0100 /* RXABORT during reception */
88 #define RX_STATUS_FIFO_ERROR 0x0080 /* receive FIFO error */
89 #define RX_STATUS_TRIGGERED 0x0001 /* frame did trigger */
91 static gboolean snoop_read(wtap *wth, int *err, gchar **err_info,
93 static gboolean snoop_seek_read(wtap *wth, gint64 seek_off,
94 union wtap_pseudo_header *pseudo_header, guint8 *pd, int length,
95 int *err, gchar **err_info);
96 static gboolean snoop_read_atm_pseudoheader(FILE_T fh,
97 union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info);
98 static gboolean snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
99 union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info,
101 static gboolean snoop_read_rec_data(FILE_T fh, guint8 *pd, int length,
102 int *err, gchar **err_info);
103 static gboolean snoop_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
104 const union wtap_pseudo_header *pseudo_header, const guint8 *pd, int *err);
109 * http://www.opengroup.org/onlinepubs/9638599/apdxf.htm
111 * for the "dlpi.h" header file specified by The Open Group, which lists
112 * the DL_ values for various protocols; Solaris 7 uses the same values.
116 * http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml
118 * for the IETF list of snoop datalink types.
122 * http://mrpink.lerc.nasa.gov/118x/support.html
124 * had links to modified versions of "tcpdump" and "libpcap" for SUNatm
125 * DLPI support; they suggested that the 3.0 verson of SUNatm uses those
126 * values. The Wayback Machine archived that page, but not the stuff
127 * to which it linked, unfortunately.
129 * It also has a link to "convert.c", which is a program to convert files
130 * from the format written by the "atmsnoop" program that comes with the
131 * SunATM package to regular "snoop" format, claims that "SunATM 2.1 claimed
132 * to be DL_FDDI (don't ask why). SunATM 3.0 claims to be DL_IPATM, which
135 * It also says that "ATM Mac header is 12 bytes long.", and seems to imply
136 * that in an "atmsnoop" file, the header contains 2 bytes (direction and
137 * VPI?), 2 bytes of VCI, 6 bytes of something, and 2 bytes of Ethernet
138 * type; if those 6 bytes are 2 bytes of DSAP, 2 bytes of LSAP, 1 byte
139 * of LLC control, and 3 bytes of SNAP OUI, that'd mean that an ATM
140 * pseudo-header in an "atmsnoop" file is probably 1 byte of direction,
141 * 1 byte of VPI, and 2 bytes of VCI.
143 * The aforementioned page also has a link to some capture files from
144 * "atmsnoop"; this version of "snoop.c" appears to be able to read them.
146 * Source to an "atmdump" package, which includes a modified version of
147 * "libpcap" to handle SunATM DLPI and an ATM driver for FreeBSD, and
148 * also includes "atmdump", which is a modified "tcpdump", was available
151 * ftp://ftp.cs.ndsu.nodak.edu/pub/freebsd/atm/atm-bpf.tgz
153 * (the host name is no longer valid) and that code also indicated that
154 * DL_IPATM is used, and that an ATM packet handed up from the Sun driver
155 * for the Sun SBus ATM card on Solaris 2.5.1 has 1 byte of direction,
156 * 1 byte of VPI, 2 bytes of VCI, and then the ATM PDU, and suggests that
157 * the direction flag is 0x80 for "transmitted" (presumably meaning
158 * DTE->DCE) and presumably not 0x80 for "received" (presumably meaning
159 * DCE->DTE). That code was used as the basis for the SunATM support in
160 * later versions of libpcap and tcpdump, and it worked at the time the
161 * development was done with the SunATM code on the system on which the
162 * development was done.
164 * In fact, the "direction" byte appears to have some other stuff, perhaps
165 * a traffic type, in the lower 7 bits, with the 8th bit indicating the
166 * direction. That appears to be the case.
168 * I don't know what the encapsulation of any of the other types is, so I
169 * leave them all as WTAP_ENCAP_UNKNOWN, except for those for which Brian
170 * Ginsbach has supplied information about the way UNICOS/mp uses them.
171 * I also don't know whether "snoop" can handle any of them (it presumably
172 * can't handle ATM, otherwise Sun wouldn't have supplied "atmsnoop"; even
173 * if it can't, this may be useful reference information for anybody doing
174 * code to use DLPI to do raw packet captures on those network types.
178 * http://web.archive.org/web/20010906213807/http://www.shomiti.com/support/TNCapFileFormat.htm
180 * gave information on Shomiti's mutant flavor of snoop; Shomiti's Web site
181 * is no longer available on the Wayback Machine. For some unknown reason,
182 * they decided not to just Go With The DLPI Flow, and instead used the types
183 * unspecified in RFC 1461 for their own nefarious purposes, such as
184 * distinguishing 10MB from 100MB from 1000MB Ethernet and distinguishing
185 * 4MB from 16MB Token Ring, and distinguishing both of them from the
186 * "Shomiti" versions of same.
188 int snoop_open(wtap *wth, int *err, gchar **err_info)
191 char magic[sizeof snoop_magic];
192 struct snoop_hdr hdr;
193 struct snooprec_hdr rec_hdr;
196 static const int snoop_encap[] = {
197 WTAP_ENCAP_ETHERNET, /* IEEE 802.3 */
198 WTAP_ENCAP_UNKNOWN, /* IEEE 802.4 Token Bus */
199 WTAP_ENCAP_TOKEN_RING,
200 WTAP_ENCAP_UNKNOWN, /* IEEE 802.6 Metro Net */
202 WTAP_ENCAP_UNKNOWN, /* HDLC */
203 WTAP_ENCAP_UNKNOWN, /* Character Synchronous, e.g. bisync */
204 WTAP_ENCAP_UNKNOWN, /* IBM Channel-to-Channel */
205 WTAP_ENCAP_FDDI_BITSWAPPED,
206 WTAP_ENCAP_NULL, /* Other */
207 WTAP_ENCAP_UNKNOWN, /* Frame Relay LAPF */
208 WTAP_ENCAP_UNKNOWN, /* Multi-protocol over Frame Relay */
209 WTAP_ENCAP_UNKNOWN, /* Character Async (e.g., SLIP and PPP?) */
210 WTAP_ENCAP_UNKNOWN, /* X.25 Classical IP */
211 WTAP_ENCAP_NULL, /* software loopback */
212 WTAP_ENCAP_UNKNOWN, /* not defined in "dlpi.h" */
213 WTAP_ENCAP_IP_OVER_FC, /* Fibre Channel */
214 WTAP_ENCAP_UNKNOWN, /* ATM */
215 WTAP_ENCAP_ATM_PDUS, /* ATM Classical IP */
216 WTAP_ENCAP_UNKNOWN, /* X.25 LAPB */
217 WTAP_ENCAP_UNKNOWN, /* ISDN */
218 WTAP_ENCAP_UNKNOWN, /* HIPPI */
219 WTAP_ENCAP_UNKNOWN, /* 100VG-AnyLAN Ethernet */
220 WTAP_ENCAP_UNKNOWN, /* 100VG-AnyLAN Token Ring */
221 WTAP_ENCAP_UNKNOWN, /* "ISO 8802/3 and Ethernet" */
222 WTAP_ENCAP_UNKNOWN, /* 100BaseT (but that's just Ethernet) */
223 WTAP_ENCAP_IP_OVER_IB, /* Infiniband */
225 #define NUM_SNOOP_ENCAPS (sizeof snoop_encap / sizeof snoop_encap[0])
226 #define SNOOP_PRIVATE_BIT 0x80000000
227 static const int snoop_private_encap[] = {
228 WTAP_ENCAP_UNKNOWN, /* Not Used */
229 WTAP_ENCAP_UNKNOWN, /* IPv4 Tunnel Link */
230 WTAP_ENCAP_UNKNOWN, /* IPv6 Tunnel Link */
231 WTAP_ENCAP_UNKNOWN, /* Virtual network interface */
232 WTAP_ENCAP_UNKNOWN, /* IEEE 802.11 */
233 WTAP_ENCAP_IPNET, /* ipnet(7D) link */
234 WTAP_ENCAP_UNKNOWN, /* IPMP stub interface */
235 WTAP_ENCAP_UNKNOWN, /* 6to4 Tunnel Link */
237 #define NUM_SNOOP_PRIVATE_ENCAPS (sizeof snoop_private_encap / sizeof snoop_private_encap[0])
238 static const int shomiti_encap[] = {
239 WTAP_ENCAP_ETHERNET, /* IEEE 802.3 */
240 WTAP_ENCAP_UNKNOWN, /* IEEE 802.4 Token Bus */
241 WTAP_ENCAP_TOKEN_RING,
242 WTAP_ENCAP_UNKNOWN, /* IEEE 802.6 Metro Net */
244 WTAP_ENCAP_UNKNOWN, /* HDLC */
245 WTAP_ENCAP_UNKNOWN, /* Character Synchronous, e.g. bisync */
246 WTAP_ENCAP_UNKNOWN, /* IBM Channel-to-Channel */
247 WTAP_ENCAP_FDDI_BITSWAPPED,
248 WTAP_ENCAP_UNKNOWN, /* Other */
249 WTAP_ENCAP_ETHERNET, /* Fast Ethernet */
250 WTAP_ENCAP_TOKEN_RING, /* 4MB 802.5 token ring */
251 WTAP_ENCAP_ETHERNET, /* Gigabit Ethernet */
252 WTAP_ENCAP_TOKEN_RING, /* "IEEE 802.5 Shomiti" */
253 WTAP_ENCAP_TOKEN_RING, /* "4MB IEEE 802.5 Shomiti" */
254 WTAP_ENCAP_UNKNOWN, /* Other */
255 WTAP_ENCAP_UNKNOWN, /* Other */
256 WTAP_ENCAP_UNKNOWN, /* Other */
257 WTAP_ENCAP_IEEE_802_11_WITH_RADIO, /* IEEE 802.11 with Radio Header */
258 WTAP_ENCAP_ETHERNET, /* 10 Gigabit Ethernet */
260 #define NUM_SHOMITI_ENCAPS (sizeof shomiti_encap / sizeof shomiti_encap[0])
263 /* Read in the string that should be at the start of a "snoop" file */
264 errno = WTAP_ERR_CANT_READ;
265 bytes_read = file_read(magic, sizeof magic, wth->fh);
266 if (bytes_read != sizeof magic) {
267 *err = file_error(wth->fh, err_info);
272 wth->data_offset += sizeof magic;
274 if (memcmp(magic, snoop_magic, sizeof snoop_magic) != 0) {
278 /* Read the rest of the header. */
279 errno = WTAP_ERR_CANT_READ;
280 bytes_read = file_read(&hdr, sizeof hdr, wth->fh);
281 if (bytes_read != sizeof hdr) {
282 *err = file_error(wth->fh, err_info);
287 wth->data_offset += sizeof hdr;
290 * Make sure it's a version we support.
292 hdr.version = g_ntohl(hdr.version);
293 switch (hdr.version) {
295 case 2: /* Solaris 2.x and later snoop, and Shomiti
296 Surveyor prior to 3.0, or 3.0 and later
298 case 3: /* Surveyor 3.0 and later, with Shomiti CMM2 hardware */
299 case 4: /* Surveyor 3.0 and later, with Shomiti GAM hardware */
300 case 5: /* Surveyor 3.0 and later, with Shomiti THG hardware */
304 *err = WTAP_ERR_UNSUPPORTED;
305 *err_info = g_strdup_printf("snoop: version %u unsupported", hdr.version);
310 * Oh, this is lovely.
312 * I suppose Shomiti could give a bunch of lawyerly noise about
313 * how "well, RFC 1761 said they were unassigned, and that's
314 * the standard, not the DLPI header file, so it's perfectly OK
315 * for us to use them, blah blah blah", but it's still irritating
316 * as hell that they used the unassigned-in-RFC-1761 values for
317 * their own purposes - especially given that Sun also used
318 * one of them in atmsnoop.
320 * We can't determine whether it's a Shomiti capture based on
321 * the version number, as, according to their documentation on
322 * their capture file format, Shomiti uses a version number of 2
323 * if the data "was captured using an NDIS card", which presumably
324 * means "captured with an ordinary boring network card via NDIS"
325 * as opposed to "captured with our whizzo special capture
328 * The only way I can see to determine that is to check how much
329 * padding there is in the first packet - if there's enough
330 * padding for a Shomiti trailer, it's probably a Shomiti
331 * capture, and otherwise, it's probably from Snoop.
335 * Start out assuming it's not a Shomiti capture.
339 /* Read first record header. */
340 errno = WTAP_ERR_CANT_READ;
341 bytes_read = file_read(&rec_hdr, sizeof rec_hdr, wth->fh);
342 if (bytes_read != sizeof rec_hdr) {
343 *err = file_error(wth->fh, err_info);
344 if (*err == 0 && bytes_read != 0)
345 *err = WTAP_ERR_SHORT_READ;
354 * The file ends after the record header, which means this
355 * is a capture with no packets.
357 * We assume it's a snoop file; the actual type of file is
358 * irrelevant, as there are no records in it, and thus no
359 * extra information if it's a Shomiti capture, and no
360 * link-layer headers whose type we have to know, and no
361 * Ethernet frames that might have an FCS.
365 * Compute the number of bytes of padding in the
366 * record. If it's at least the size of a Shomiti
367 * trailer record, we assume this is a Shomiti
368 * capture. (Some atmsnoop captures appear
369 * to have 4 bytes of padding, and at least one
370 * snoop capture appears to have 6 bytes of padding;
371 * the Shomiti header is larger than either of those.)
373 if (g_ntohl(rec_hdr.rec_len) >
374 (sizeof rec_hdr + g_ntohl(rec_hdr.incl_len))) {
376 * Well, we have padding; how much?
378 padbytes = g_ntohl(rec_hdr.rec_len) -
379 ((guint)sizeof rec_hdr + g_ntohl(rec_hdr.incl_len));
382 * Is it at least the size of a Shomiti trailer?
385 (padbytes >= sizeof (struct shomiti_trailer));
390 * Seek back to the beginning of the first record.
392 if (file_seek(wth->fh, wth->data_offset, SEEK_SET, err) == -1)
395 hdr.network = g_ntohl(hdr.network);
397 if (hdr.network >= NUM_SHOMITI_ENCAPS
398 || shomiti_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
399 *err = WTAP_ERR_UNSUPPORTED_ENCAP;
400 *err_info = g_strdup_printf("snoop: Shomiti network type %u unknown or unsupported",
404 file_encap = shomiti_encap[hdr.network];
406 /* This is a Shomiti file */
407 wth->file_type = WTAP_FILE_SHOMITI;
408 } else if (hdr.network & SNOOP_PRIVATE_BIT) {
409 if ((hdr.network^SNOOP_PRIVATE_BIT) >= NUM_SNOOP_PRIVATE_ENCAPS
410 || snoop_private_encap[hdr.network^SNOOP_PRIVATE_BIT] == WTAP_ENCAP_UNKNOWN) {
411 *err = WTAP_ERR_UNSUPPORTED_ENCAP;
412 *err_info = g_strdup_printf("snoop: private network type %u unknown or unsupported",
416 file_encap = snoop_private_encap[hdr.network^SNOOP_PRIVATE_BIT];
418 /* This is a snoop file */
419 wth->file_type = WTAP_FILE_SNOOP;
421 if (hdr.network >= NUM_SNOOP_ENCAPS
422 || snoop_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
423 *err = WTAP_ERR_UNSUPPORTED_ENCAP;
424 *err_info = g_strdup_printf("snoop: network type %u unknown or unsupported",
428 file_encap = snoop_encap[hdr.network];
430 /* This is a snoop file */
431 wth->file_type = WTAP_FILE_SNOOP;
435 * We don't currently use the extra information in Shomiti
436 * records, so we use the same routines to read snoop and
439 wth->subtype_read = snoop_read;
440 wth->subtype_seek_read = snoop_seek_read;
441 wth->file_encap = file_encap;
442 wth->snapshot_length = 0; /* not available in header */
443 wth->tsprecision = WTAP_FILE_TSPREC_USEC;
456 } shomiti_wireless_header;
459 /* Read the next packet */
460 static gboolean snoop_read(wtap *wth, int *err, gchar **err_info,
467 struct snooprec_hdr hdr;
473 /* Read record header. */
474 errno = WTAP_ERR_CANT_READ;
475 bytes_read = file_read(&hdr, sizeof hdr, wth->fh);
476 if (bytes_read != sizeof hdr) {
477 *err = file_error(wth->fh, err_info);
478 if (*err == 0 && bytes_read != 0)
479 *err = WTAP_ERR_SHORT_READ;
482 wth->data_offset += sizeof hdr;
484 rec_size = g_ntohl(hdr.rec_len);
485 orig_size = g_ntohl(hdr.orig_len);
486 packet_size = g_ntohl(hdr.incl_len);
487 if (orig_size > WTAP_MAX_PACKET_SIZE) {
489 * Probably a corrupt capture file; don't blow up trying
490 * to allocate space for an immensely-large packet.
492 *err = WTAP_ERR_BAD_FILE;
493 *err_info = g_strdup_printf("snoop: File has %u-byte original length, bigger than maximum of %u",
494 orig_size, WTAP_MAX_PACKET_SIZE);
497 if (packet_size > WTAP_MAX_PACKET_SIZE) {
499 * Probably a corrupt capture file; don't blow up trying
500 * to allocate space for an immensely-large packet.
502 *err = WTAP_ERR_BAD_FILE;
503 *err_info = g_strdup_printf("snoop: File has %u-byte packet, bigger than maximum of %u",
504 packet_size, WTAP_MAX_PACKET_SIZE);
507 if (packet_size > rec_size) {
509 * Probably a corrupt capture file.
511 *err = WTAP_ERR_BAD_FILE;
512 *err_info = g_strdup_printf("snoop: File has %u-byte packet, bigger than record size %u",
513 packet_size, rec_size);
517 *data_offset = wth->data_offset;
520 * If this is an ATM packet, the first four bytes are the
521 * direction of the packet (transmit/receive), the VPI, and
522 * the VCI; read them and generate the pseudo-header from
525 switch (wth->file_encap) {
527 case WTAP_ENCAP_ATM_PDUS:
528 if (packet_size < sizeof (struct snoop_atm_hdr)) {
530 * Uh-oh, the packet isn't big enough to even
531 * have a pseudo-header.
533 *err = WTAP_ERR_BAD_FILE;
534 *err_info = g_strdup_printf("snoop: atmsnoop file has a %u-byte packet, too small to have even an ATM pseudo-header",
538 if (!snoop_read_atm_pseudoheader(wth->fh, &wth->pseudo_header,
540 return FALSE; /* Read error */
543 * Don't count the pseudo-header as part of the packet.
545 rec_size -= (guint32)sizeof (struct snoop_atm_hdr);
546 orig_size -= (guint32)sizeof (struct snoop_atm_hdr);
547 packet_size -= (guint32)sizeof (struct snoop_atm_hdr);
548 wth->data_offset += sizeof (struct snoop_atm_hdr);
551 case WTAP_ENCAP_ETHERNET:
553 * If this is a snoop file, we assume there's no FCS in
554 * this frame; if this is a Shomit file, we assume there
555 * is. (XXX - or should we treat it a "maybe"?)
557 if (wth->file_type == WTAP_FILE_SHOMITI)
558 wth->pseudo_header.eth.fcs_len = 4;
560 wth->pseudo_header.eth.fcs_len = 0;
563 case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
564 if (packet_size < sizeof (shomiti_wireless_header)) {
566 * Uh-oh, the packet isn't big enough to even
567 * have a pseudo-header.
569 *err = WTAP_ERR_BAD_FILE;
570 *err_info = g_strdup_printf("snoop: Shomiti wireless file has a %u-byte packet, too small to have even a wireless pseudo-header",
574 if (!snoop_read_shomiti_wireless_pseudoheader(wth->fh,
575 &wth->pseudo_header, err, err_info, &header_size))
576 return FALSE; /* Read error */
579 * Don't count the pseudo-header as part of the packet.
581 rec_size -= header_size;
582 orig_size -= header_size;
583 packet_size -= header_size;
584 wth->data_offset += header_size;
588 buffer_assure_space(wth->frame_buffer, packet_size);
589 if (!snoop_read_rec_data(wth->fh, buffer_start_ptr(wth->frame_buffer),
590 packet_size, err, err_info))
591 return FALSE; /* Read error */
592 wth->data_offset += packet_size;
594 wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
595 wth->phdr.ts.secs = g_ntohl(hdr.ts_sec);
596 wth->phdr.ts.nsecs = g_ntohl(hdr.ts_usec) * 1000;
597 wth->phdr.caplen = packet_size;
598 wth->phdr.len = orig_size;
601 * If this is ATM LANE traffic, try to guess what type of LANE
602 * traffic it is based on the packet contents.
604 if (wth->file_encap == WTAP_ENCAP_ATM_PDUS &&
605 wth->pseudo_header.atm.type == TRAF_LANE) {
606 atm_guess_lane_type(buffer_start_ptr(wth->frame_buffer),
607 wth->phdr.caplen, &wth->pseudo_header);
611 * Skip over the padding (don't "fseek()", as the standard
612 * I/O library on some platforms discards buffered data if
613 * you do that, which means it does a lot more reads).
614 * There's probably not much padding (it's probably padded only
615 * to a 4-byte boundary), so we probably need only do one read.
617 if (rec_size < (sizeof hdr + packet_size)) {
619 * What, *negative* padding? Bogus.
621 *err = WTAP_ERR_BAD_FILE;
622 *err_info = g_strdup_printf("snoop: File has %u-byte record with packet size of %u",
623 rec_size, packet_size);
626 padbytes = rec_size - ((guint)sizeof hdr + packet_size);
627 while (padbytes != 0) {
628 bytes_to_read = padbytes;
629 if ((unsigned)bytes_to_read > sizeof padbuf)
630 bytes_to_read = sizeof padbuf;
631 errno = WTAP_ERR_CANT_READ;
632 bytes_read = file_read(padbuf, bytes_to_read, wth->fh);
633 if (bytes_read != bytes_to_read) {
634 *err = file_error(wth->fh, err_info);
636 *err = WTAP_ERR_SHORT_READ;
639 wth->data_offset += bytes_read;
640 padbytes -= bytes_read;
647 snoop_seek_read(wtap *wth, gint64 seek_off,
648 union wtap_pseudo_header *pseudo_header, guint8 *pd, int length,
649 int *err, gchar **err_info)
651 if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
654 switch (wth->file_encap) {
656 case WTAP_ENCAP_ATM_PDUS:
657 if (!snoop_read_atm_pseudoheader(wth->random_fh, pseudo_header,
664 case WTAP_ENCAP_ETHERNET:
666 * If this is a snoop file, we assume there's no FCS in
667 * this frame; if this is a Shomit file, we assume there
668 * is. (XXX - or should we treat it a "maybe"?)
670 if (wth->file_type == WTAP_FILE_SHOMITI)
671 pseudo_header->eth.fcs_len = 4;
673 pseudo_header->eth.fcs_len = 0;
676 case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
677 if (!snoop_read_shomiti_wireless_pseudoheader(wth->random_fh,
678 pseudo_header, err, err_info, NULL)) {
686 * Read the packet data.
688 if (!snoop_read_rec_data(wth->random_fh, pd, length, err, err_info))
689 return FALSE; /* failed */
692 * If this is ATM LANE traffic, try to guess what type of LANE
693 * traffic it is based on the packet contents.
695 if (wth->file_encap == WTAP_ENCAP_ATM_PDUS &&
696 pseudo_header->atm.type == TRAF_LANE)
697 atm_guess_lane_type(pd, length, pseudo_header);
702 snoop_read_atm_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header,
703 int *err, gchar **err_info)
705 struct snoop_atm_hdr atm_phdr;
710 errno = WTAP_ERR_CANT_READ;
711 bytes_read = file_read(&atm_phdr, sizeof (struct snoop_atm_hdr), fh);
712 if (bytes_read != sizeof (struct snoop_atm_hdr)) {
713 *err = file_error(fh, err_info);
715 *err = WTAP_ERR_SHORT_READ;
720 vci = pntohs(&atm_phdr.vci);
723 * The lower 4 bits of the first byte of the header indicate
724 * the type of traffic, as per the "atmioctl.h" header in
727 switch (atm_phdr.flags & 0x0F) {
729 case 0x01: /* LANE */
730 pseudo_header->atm.aal = AAL_5;
731 pseudo_header->atm.type = TRAF_LANE;
734 case 0x02: /* RFC 1483 LLC multiplexed traffic */
735 pseudo_header->atm.aal = AAL_5;
736 pseudo_header->atm.type = TRAF_LLCMX;
739 case 0x05: /* ILMI */
740 pseudo_header->atm.aal = AAL_5;
741 pseudo_header->atm.type = TRAF_ILMI;
744 case 0x06: /* Signalling AAL */
745 pseudo_header->atm.aal = AAL_SIGNALLING;
746 pseudo_header->atm.type = TRAF_UNKNOWN;
749 case 0x03: /* MARS (RFC 2022) */
750 pseudo_header->atm.aal = AAL_5;
751 pseudo_header->atm.type = TRAF_UNKNOWN;
754 case 0x04: /* IFMP (Ipsilon Flow Management Protocol; see RFC 1954) */
755 pseudo_header->atm.aal = AAL_5;
756 pseudo_header->atm.type = TRAF_UNKNOWN; /* XXX - TRAF_IPSILON? */
761 * Assume it's AAL5, unless it's VPI 0 and VCI 5, in which
762 * case assume it's AAL_SIGNALLING; we know nothing more
765 * XXX - is this necessary? Or are we guaranteed that
766 * all signalling traffic has a type of 0x06?
768 * XXX - is this guaranteed to be AAL5? Or, if the type is
769 * 0x00 ("raw"), might it be non-AAL5 traffic?
771 if (vpi == 0 && vci == 5)
772 pseudo_header->atm.aal = AAL_SIGNALLING;
774 pseudo_header->atm.aal = AAL_5;
775 pseudo_header->atm.type = TRAF_UNKNOWN;
778 pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;
780 pseudo_header->atm.vpi = vpi;
781 pseudo_header->atm.vci = vci;
782 pseudo_header->atm.channel = (atm_phdr.flags & 0x80) ? 0 : 1;
784 /* We don't have this information */
785 pseudo_header->atm.flags = 0;
786 pseudo_header->atm.cells = 0;
787 pseudo_header->atm.aal5t_u2u = 0;
788 pseudo_header->atm.aal5t_len = 0;
789 pseudo_header->atm.aal5t_chksum = 0;
795 snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
796 union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info,
799 shomiti_wireless_header whdr;
803 errno = WTAP_ERR_CANT_READ;
804 bytes_read = file_read(&whdr, sizeof (shomiti_wireless_header), fh);
805 if (bytes_read != sizeof (shomiti_wireless_header)) {
806 *err = file_error(fh, err_info);
808 *err = WTAP_ERR_SHORT_READ;
812 /* the 4th byte of the pad is actually a header length,
813 * we've already read 8 bytes of it, and it must never
816 * XXX - presumably that means that the header length
817 * doesn't include the length field, as we've read
820 * XXX - what's in the other 3 bytes of the padding? Is it a
821 * 4-byte length field?
822 * XXX - is there anything in the rest of the header of interest?
823 * XXX - are there any files where the header is shorter than
824 * 4 bytes of length plus 8 bytes of information?
826 if (whdr.pad[3] < 8) {
827 *err = WTAP_ERR_BAD_FILE;
828 *err_info = g_strdup_printf("snoop: Header length in Surveyor record is %u, less than minimum of 8",
832 /* Skip the header. */
833 rsize = ((int) whdr.pad[3]) - 8;
834 if (file_seek(fh, rsize, SEEK_CUR, err) == -1)
837 pseudo_header->ieee_802_11.fcs_len = 4;
838 pseudo_header->ieee_802_11.channel = whdr.channel;
839 pseudo_header->ieee_802_11.data_rate = whdr.rate;
840 pseudo_header->ieee_802_11.signal_level = whdr.signal;
842 /* add back the header and don't forget the pad as well */
843 if(header_size != NULL)
844 *header_size = rsize + 8 + 4;
850 snoop_read_rec_data(FILE_T fh, guint8 *pd, int length, int *err,
855 errno = WTAP_ERR_CANT_READ;
856 bytes_read = file_read(pd, length, fh);
858 if (bytes_read != length) {
859 *err = file_error(fh, err_info);
861 *err = WTAP_ERR_SHORT_READ;
867 static const int wtap_encap[] = {
868 -1, /* WTAP_ENCAP_UNKNOWN -> unsupported */
869 0x04, /* WTAP_ENCAP_ETHERNET -> DL_ETHER */
870 0x02, /* WTAP_ENCAP_TOKEN_RING -> DL_TPR */
871 -1, /* WTAP_ENCAP_SLIP -> unsupported */
872 -1, /* WTAP_ENCAP_PPP -> unsupported */
873 0x08, /* WTAP_ENCAP_FDDI -> DL_FDDI */
874 0x08, /* WTAP_ENCAP_FDDI_BITSWAPPED -> DL_FDDI */
875 -1, /* WTAP_ENCAP_RAW_IP -> unsupported */
876 -1, /* WTAP_ENCAP_ARCNET -> unsupported */
877 -1, /* WTAP_ENCAP_ARCNET_LINUX -> unsupported */
878 -1, /* WTAP_ENCAP_ATM_RFC1483 -> unsupported */
879 -1, /* WTAP_ENCAP_LINUX_ATM_CLIP -> unsupported */
880 -1, /* WTAP_ENCAP_LAPB -> unsupported*/
881 0x12, /* WTAP_ENCAP_ATM_PDUS -> DL_IPATM */
883 #define NUM_WTAP_ENCAPS (sizeof wtap_encap / sizeof wtap_encap[0])
885 /* Returns 0 if we could write the specified encapsulation type,
886 an error indication otherwise. */
887 int snoop_dump_can_write_encap(int encap)
889 /* Per-packet encapsulations aren't supported. */
890 if (encap == WTAP_ENCAP_PER_PACKET)
891 return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
893 if (encap < 0 || (unsigned)encap >= NUM_WTAP_ENCAPS || wtap_encap[encap] == -1)
894 return WTAP_ERR_UNSUPPORTED_ENCAP;
899 /* Returns TRUE on success, FALSE on failure; sets "*err" to an error code on
901 gboolean snoop_dump_open(wtap_dumper *wdh, int *err)
903 struct snoop_hdr file_hdr;
905 /* This is a snoop file */
906 wdh->subtype_write = snoop_dump;
907 wdh->subtype_close = NULL;
909 /* Write the file header. */
910 if (!wtap_dump_file_write(wdh, &snoop_magic, sizeof snoop_magic, err))
913 /* current "snoop" format is 2 */
914 file_hdr.version = g_htonl(2);
915 file_hdr.network = g_htonl(wtap_encap[wdh->encap]);
916 if (!wtap_dump_file_write(wdh, &file_hdr, sizeof file_hdr, err))
922 /* Write a record for a packet to a dump file.
923 Returns TRUE on success, FALSE on failure. */
924 static gboolean snoop_dump(wtap_dumper *wdh,
925 const struct wtap_pkthdr *phdr,
926 const union wtap_pseudo_header *pseudo_header _U_,
927 const guint8 *pd, int *err)
929 struct snooprec_hdr rec_hdr;
932 static char zeroes[4];
933 struct snoop_atm_hdr atm_hdr;
936 if (wdh->encap == WTAP_ENCAP_ATM_PDUS)
937 atm_hdrsize = sizeof (struct snoop_atm_hdr);
941 /* Record length = header length plus data length... */
942 reclen = (int)sizeof rec_hdr + phdr->caplen + atm_hdrsize;
944 /* ... plus enough bytes to pad it to a 4-byte boundary. */
945 padlen = ((reclen + 3) & ~3) - reclen;
948 rec_hdr.orig_len = g_htonl(phdr->len + atm_hdrsize);
949 rec_hdr.incl_len = g_htonl(phdr->caplen + atm_hdrsize);
950 rec_hdr.rec_len = g_htonl(reclen);
951 rec_hdr.cum_drops = 0;
952 rec_hdr.ts_sec = g_htonl(phdr->ts.secs);
953 rec_hdr.ts_usec = g_htonl(phdr->ts.nsecs / 1000);
954 if (!wtap_dump_file_write(wdh, &rec_hdr, sizeof rec_hdr, err))
957 if (wdh->encap == WTAP_ENCAP_ATM_PDUS) {
959 * Write the ATM header.
962 (pseudo_header->atm.channel == 0) ? 0x80 : 0x00;
963 switch (pseudo_header->atm.aal) {
967 atm_hdr.flags |= 0x06;
971 switch (pseudo_header->atm.type) {
975 atm_hdr.flags |= 0x01;
979 /* RFC 1483 LLC multiplexed traffic */
980 atm_hdr.flags |= 0x02;
985 atm_hdr.flags |= 0x05;
990 atm_hdr.vpi = (guint8) pseudo_header->atm.vpi;
991 atm_hdr.vci = g_htons(pseudo_header->atm.vci);
992 if (!wtap_dump_file_write(wdh, &atm_hdr, sizeof atm_hdr, err))
996 if (!wtap_dump_file_write(wdh, pd, phdr->caplen, err))
999 /* Now write the padding. */
1000 if (!wtap_dump_file_write(wdh, zeroes, padlen, err))