1 /* Combine multiple dump files, either by appending or by merging by timestamp
5 * Written by Scott Renfro <scott@renfro.org> based on
6 * editcap by Richard Sharpe and Guy Harris
23 #ifdef HAVE_SYS_TIME_H
32 * Scan through the arguments and open the input files
35 merge_open_in_files(int in_file_count, char *const *in_file_names,
36 merge_in_file_t **in_files, int *err, gchar **err_info,
40 size_t files_size = in_file_count * sizeof(merge_in_file_t);
41 merge_in_file_t *files;
44 files = (merge_in_file_t *)g_malloc(files_size);
47 for (i = 0; i < in_file_count; i++) {
48 files[i].filename = in_file_names[i];
49 files[i].wth = wtap_open_offline(in_file_names[i], err, err_info, FALSE);
50 files[i].data_offset = 0;
51 files[i].state = PACKET_NOT_PRESENT;
53 /* Close the files we've already opened. */
54 for (j = 0; j < i; j++)
55 wtap_close(files[j].wth);
59 size = wtap_file_size(files[i].wth, err);
61 for (j = 0; j <= i; j++)
62 wtap_close(files[j].wth);
72 * Scan through and close each input file
75 merge_close_in_files(int count, merge_in_file_t in_files[])
78 for (i = 0; i < count; i++) {
79 wtap_close(in_files[i].wth);
84 * Select an output frame type based on the input files
85 * From Guy: If all files have the same frame type, then use that.
86 * Otherwise select WTAP_ENCAP_PER_PACKET. If the selected
87 * output file type doesn't support per packet frame types,
88 * then the wtap_dump_open call will fail with a reasonable
92 merge_select_frame_type(int count, merge_in_file_t files[])
95 int selected_frame_type;
97 selected_frame_type = wtap_file_encap(files[0].wth);
99 for (i = 1; i < count; i++) {
100 int this_frame_type = wtap_file_encap(files[i].wth);
101 if (selected_frame_type != this_frame_type) {
102 selected_frame_type = WTAP_ENCAP_PER_PACKET;
107 return selected_frame_type;
111 * Scan through input files and find maximum snapshot length
114 merge_max_snapshot_length(int count, merge_in_file_t in_files[])
117 int max_snapshot = 0;
120 for (i = 0; i < count; i++) {
121 snapshot_length = wtap_snapshot_length(in_files[i].wth);
122 if (snapshot_length == 0) {
123 /* Snapshot length of input file not known. */
124 snapshot_length = WTAP_MAX_PACKET_SIZE;
126 if (snapshot_length > max_snapshot)
127 max_snapshot = snapshot_length;
133 * returns TRUE if first argument is earlier than second
136 is_earlier(struct wtap_nstime *l, struct wtap_nstime *r) {
137 if (l->secs > r->secs) { /* left is later */
139 } else if (l->secs < r->secs) { /* left is earlier */
141 } else if (l->nsecs > r->nsecs) { /* tv_sec equal, l.usec later */
144 /* either one < two or one == two
145 * either way, return one
151 * Read the next packet, in chronological order, from the set of files
155 merge_read_packet(int in_file_count, merge_in_file_t in_files[], int *err,
160 struct wtap_nstime tv = { sizeof(time_t) > sizeof(int) ? LONG_MAX : INT_MAX, INT_MAX };
161 struct wtap_pkthdr *phdr;
164 * Make sure we have a packet available from each file, if there are any
165 * packets left in the file in question, and search for the packet
166 * with the earliest time stamp.
168 for (i = 0; i < in_file_count; i++) {
169 if (in_files[i].state == PACKET_NOT_PRESENT) {
171 * No packet available, and we haven't seen an error or EOF yet,
172 * so try to read the next packet.
174 if (!wtap_read(in_files[i].wth, err, err_info, &in_files[i].data_offset)) {
176 in_files[i].state = GOT_ERROR;
179 in_files[i].state = AT_EOF;
181 in_files[i].state = PACKET_PRESENT;
184 if (in_files[i].state == PACKET_PRESENT) {
185 phdr = wtap_phdr(in_files[i].wth);
186 if (is_earlier(&phdr->ts, &tv)) {
194 /* All the streams are at EOF. Return an EOF indication. */
199 /* We'll need to read another packet from this file. */
200 in_files[ei].state = PACKET_NOT_PRESENT;
202 /* Return a pointer to the wtap structure for the file with that frame. */
203 return in_files[ei].wth;
207 * Read the next packet, in file sequence order, from the set of files
211 merge_append_read_packet(int in_file_count, merge_in_file_t in_files[],
212 int *err, gchar **err_info)
217 * Find the first file not at EOF, and read the next packet from it.
219 for (i = 0; i < in_file_count; i++) {
220 if (in_files[i].state == AT_EOF)
221 continue; /* This file is already at EOF */
222 if (wtap_read(in_files[i].wth, err, err_info, &in_files[i].data_offset))
223 break; /* We have a packet */
225 /* Read error - quit immediately. */
226 in_files[i].state = GOT_ERROR;
229 /* EOF - flag this file as being at EOF, and try the next one. */
230 in_files[i].state = AT_EOF;
232 if (i == in_file_count) {
233 /* All the streams are at EOF. Return an EOF indication. */
238 /* Return a pointer to the wtap structure for the file with that frame. */
239 return in_files[i].wth;