1 /* Combine multiple dump files, either by appending or by merging by timestamp
5 * Written by Scott Renfro <scott@renfro.org> based on
6 * editcap by Richard Sharpe and Guy Harris
23 #ifdef HAVE_SYS_TIME_H
32 * Scan through the arguments and open the input files
35 merge_open_in_files(int in_file_count, char *const *in_file_names,
36 merge_in_file_t **in_files, int *err, gchar **err_info,
40 size_t files_size = in_file_count * sizeof(merge_in_file_t);
41 merge_in_file_t *files;
44 files = (merge_in_file_t *)g_malloc(files_size);
47 for (i = 0; i < in_file_count; i++) {
48 files[i].filename = in_file_names[i];
49 files[i].wth = wtap_open_offline(in_file_names[i], err, err_info, FALSE);
50 files[i].data_offset = 0;
51 files[i].state = PACKET_NOT_PRESENT;
52 files[i].packet_num = 0;
54 /* Close the files we've already opened. */
55 for (j = 0; j < i; j++)
56 wtap_close(files[j].wth);
60 size = wtap_file_size(files[i].wth, err);
62 for (j = 0; j <= i; j++)
63 wtap_close(files[j].wth);
73 * Scan through and close each input file
76 merge_close_in_files(int count, merge_in_file_t in_files[])
79 for (i = 0; i < count; i++) {
80 wtap_close(in_files[i].wth);
85 * Select an output frame type based on the input files
86 * From Guy: If all files have the same frame type, then use that.
87 * Otherwise select WTAP_ENCAP_PER_PACKET. If the selected
88 * output file type doesn't support per packet frame types,
89 * then the wtap_dump_open call will fail with a reasonable
93 merge_select_frame_type(int count, merge_in_file_t files[])
96 int selected_frame_type;
98 selected_frame_type = wtap_file_encap(files[0].wth);
100 for (i = 1; i < count; i++) {
101 int this_frame_type = wtap_file_encap(files[i].wth);
102 if (selected_frame_type != this_frame_type) {
103 selected_frame_type = WTAP_ENCAP_PER_PACKET;
108 return selected_frame_type;
112 * Scan through input files and find maximum snapshot length
115 merge_max_snapshot_length(int count, merge_in_file_t in_files[])
118 int max_snapshot = 0;
121 for (i = 0; i < count; i++) {
122 snapshot_length = wtap_snapshot_length(in_files[i].wth);
123 if (snapshot_length == 0) {
124 /* Snapshot length of input file not known. */
125 snapshot_length = WTAP_MAX_PACKET_SIZE;
127 if (snapshot_length > max_snapshot)
128 max_snapshot = snapshot_length;
134 * returns TRUE if first argument is earlier than second
137 is_earlier(struct wtap_nstime *l, struct wtap_nstime *r) {
138 if (l->secs > r->secs) { /* left is later */
140 } else if (l->secs < r->secs) { /* left is earlier */
142 } else if (l->nsecs > r->nsecs) { /* tv_sec equal, l.usec later */
145 /* either one < two or one == two
146 * either way, return one
152 * Read the next packet, in chronological order, from the set of files
155 * On success, set *err to 0 and return a pointer to the merge_in_file_t
156 * for the file from which the packet was read.
158 * On a read error, set *err to the error and return a pointer to the
159 * merge_in_file_t for the file on which we got an error.
161 * On an EOF (meaning all the files are at EOF), set *err to 0 and return
165 merge_read_packet(int in_file_count, merge_in_file_t in_files[],
166 int *err, gchar **err_info)
170 struct wtap_nstime tv = { sizeof(time_t) > sizeof(int) ? LONG_MAX : INT_MAX, INT_MAX };
171 struct wtap_pkthdr *phdr;
174 * Make sure we have a packet available from each file, if there are any
175 * packets left in the file in question, and search for the packet
176 * with the earliest time stamp.
178 for (i = 0; i < in_file_count; i++) {
179 if (in_files[i].state == PACKET_NOT_PRESENT) {
181 * No packet available, and we haven't seen an error or EOF yet,
182 * so try to read the next packet.
184 if (!wtap_read(in_files[i].wth, err, err_info, &in_files[i].data_offset)) {
186 in_files[i].state = GOT_ERROR;
189 in_files[i].state = AT_EOF;
191 in_files[i].state = PACKET_PRESENT;
194 if (in_files[i].state == PACKET_PRESENT) {
195 phdr = wtap_phdr(in_files[i].wth);
196 if (is_earlier(&phdr->ts, &tv)) {
204 /* All the streams are at EOF. Return an EOF indication. */
209 /* We'll need to read another packet from this file. */
210 in_files[ei].state = PACKET_NOT_PRESENT;
212 /* Count this packet. */
213 in_files[ei].packet_num++;
215 /* Return the ordinal of the file from which the packet was read. */
216 return &in_files[ei];
220 * Read the next packet, in file sequence order, from the set of files
223 * On success, set *err to 0 and return a pointer to the merge_in_file_t
224 * for the file from which the packet was read.
226 * On a read error, set *err to the error and return a pointer to the
227 * merge_in_file_t for the file on which we got an error.
229 * On an EOF (meaning all the files are at EOF), set *err to 0 and return
233 merge_append_read_packet(int in_file_count, merge_in_file_t in_files[],
234 int *err, gchar **err_info)
239 * Find the first file not at EOF, and read the next packet from it.
241 for (i = 0; i < in_file_count; i++) {
242 if (in_files[i].state == AT_EOF)
243 continue; /* This file is already at EOF */
244 if (wtap_read(in_files[i].wth, err, err_info, &in_files[i].data_offset))
245 break; /* We have a packet */
247 /* Read error - quit immediately. */
248 in_files[i].state = GOT_ERROR;
251 /* EOF - flag this file as being at EOF, and try the next one. */
252 in_files[i].state = AT_EOF;
254 if (i == in_file_count) {
255 /* All the streams are at EOF. Return an EOF indication. */
260 /* Return the ordinal of the file from which the packet was read. */