?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
TODO epan/dissectors/asn1/kerberos/packet-kerberos-template.c new GSS flags
[wireshark-sm.git] / wiretap / netxray.c
blob086bd4cfd0161feee0e533179c0d3a62b0c38f0c
1 /* netxray.c
2 *
3 * Wiretap Library
4 * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
5 *
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
8
9 #include "config.h"
10 #include "netxray.h"
11
12 #include <string.h>
13 #include "wtap-int.h"
14 #include "file_wrappers.h"
15 #include "atm.h"
16
17 /* Capture file header, *including* magic number, is padded to 128 bytes. */
18 #define CAPTUREFILE_HEADER_SIZE 128
19
20 /* Magic number size, in both 1.x and later files. */
21 #define MAGIC_SIZE 4
22
23 /* Magic number in NetXRay 1.x files. */
24 static const char old_netxray_magic[MAGIC_SIZE] = {
25 'V', 'L', '\0', '\0'
26 };
27
28 /* Magic number in NetXRay 2.0 and later, and Windows Sniffer, files. */
29 static const char netxray_magic[MAGIC_SIZE] = {
30 'X', 'C', 'P', '\0'
31 };
32
33 /* NetXRay file header (minus magic number). */
34 /* */
35 /* As field usages are identified, please revise as needed */
36 /* Please do *not* use netxray_hdr xxx... names in the code */
37 /* (Placeholder names for all 'unknown' fields are */
38 /* of form xxx_x<hex_hdr_offset> */
39 /* where <hex_hdr_offset> *includes* the magic number) */
40
41 struct netxray_hdr {
42 char version[8]; /* version number */
43 uint32_t start_time; /* UNIX [UTC] time when capture started */
44
45 uint32_t nframes; /* number of packets */
46 uint32_t xxx_x14; /* unknown [some kind of file offset] */
47 uint32_t start_offset; /* offset of first packet in capture */
48 uint32_t end_offset; /* offset after last packet in capture */
49
50 uint32_t xxx_x20; /* unknown [some kind of file offset] */
51 uint32_t xxx_x24; /* unknown [unused ?] */
52 uint32_t xxx_x28; /* unknown [some kind of file offset] */
53 uint8_t network; /* datalink type */
54 uint8_t network_plus; /* [See code] */
55 uint8_t xxx_x2E[2]; /* unknown */
56
57 uint8_t timeunit; /* encodes length of a tick */
58 uint8_t xxx_x31[3]; /* XXX - upper 3 bytes of timeunit ? */
59 uint32_t timelo; /* lower 32 bits of capture start time stamp */
60 uint32_t timehi; /* upper 32 bits of capture start time stamp */
61 uint32_t linespeed; /* speed of network, in bits/second */
62
63 uint8_t xxx_x40[12]; /* unknown [other stuff] */
64 uint8_t realtick[4]; /* (ticks/sec for Ethernet/Ndis/Timeunit=2 ?) */
65 /* (realtick[1], realtick[2] also currently */
66 /* used as flag for 'FCS presence') */
67
68 uint8_t xxx_x50[4]; /* unknown [other stuff] */
69 uint8_t captype; /* capture type */
70 uint8_t xxx_x55[3]; /* unknown [other stuff] */
71 uint8_t xxx_x58[4]; /* unknown [other stuff] */
72 uint8_t wan_hdlc_subsub_captype; /* WAN HDLC subsub_captype */
73 uint8_t xxx_x5D[3]; /* unknown [other stuff] */
74
75 uint8_t xxx_x60[16]; /* unknown [other stuff] */
76
77 uint8_t xxx_x70[14]; /* unknown [other stuff] */
78 int16_t timezone_hrs; /* timezone hours [at least for version 2.2..]; */
79 /* positive values = west of UTC: */
80 /* negative values = east of UTC: */
81 /* e.g. +5 is American Eastern */
82 /* [Does not appear to be adjusted for DST ] */
83 };
84
85 /*
86 * Capture type, in hdr.captype.
87 *
88 * Values other than 0 are dependent on the network type.
89 * For Ethernet captures, it indicates the type of capture pod.
90 * For WAN captures (all of which are done with a pod), it indicates
91 * the link-layer type.
92 */
93 #define CAPTYPE_NDIS 0 /* Capture on network interface using NDIS */
94
95 /*
96 * Ethernet capture types.
97 */
98 #define ETH_CAPTYPE_GIGPOD 2 /* gigabit Ethernet captured with pod */
99 #define ETH_CAPTYPE_OTHERPOD 3 /* non-gigabit Ethernet captured with pod */
100 #define ETH_CAPTYPE_OTHERPOD2 5 /* gigabit Ethernet via pod ?? */
101 /* Captype 5 seen in capture from Distributed Sniffer with: */
102 /* Version 4.50.211 software */
103 /* SysKonnect SK-9843 Gigabit Ethernet Server Adapter */
104 #define ETH_CAPTYPE_GIGPOD2 6 /* gigabit Ethernet, captured with blade on S6040-model Sniffer */
105
106 /*
107 * WAN capture types.
108 */
109 #define WAN_CAPTYPE_BROUTER 1 /* Bridge/router captured with pod */
110 #define WAN_CAPTYPE_PPP 3 /* PPP captured with pod */
111 #define WAN_CAPTYPE_FRELAY 4 /* Frame Relay captured with pod */
112 #define WAN_CAPTYPE_BROUTER2 5 /* Bridge/router captured with pod */
113 #define WAN_CAPTYPE_HDLC 6 /* HDLC (X.25, ISDN) captured with pod */
114 #define WAN_CAPTYPE_SDLC 7 /* SDLC captured with pod */
115 #define WAN_CAPTYPE_HDLC2 8 /* HDLC captured with pod */
116 #define WAN_CAPTYPE_BROUTER3 9 /* Bridge/router captured with pod */
117 #define WAN_CAPTYPE_SMDS 10 /* SMDS DXI */
118 #define WAN_CAPTYPE_BROUTER4 11 /* Bridge/router captured with pod */
119 #define WAN_CAPTYPE_BROUTER5 12 /* Bridge/router captured with pod */
120 #define WAN_CAPTYPE_CHDLC 19 /* Cisco router (CHDLC) captured with pod */
121
122 #define CAPTYPE_ATM 15 /* ATM captured with pod */
123
124 /*
125 * # of ticks that equal 1 second, in version 002.xxx files other
126 * than Ethernet captures with a captype other than CAPTYPE_NDIS;
127 * the index into this array is hdr.timeunit.
128 *
129 * DO NOT SEND IN PATCHES THAT CHANGE ANY OF THE NON-ZERO VALUES IN
130 * ANY OF THE TpS TABLES. THOSE VALUES ARE CORRECT FOR AT LEAST ONE
131 * CAPTURE, SO CHANGING THEM WILL BREAK AT LEAST SOME CAPTURES. WE
132 * WILL NOT CHECK IN PATCHES THAT CHANGE THESE VALUES.
133 *
134 * Instead, if a value in a TpS table is wrong, check whether captype
135 * has a non-zero value; if so, perhaps we need a new TpS table for the
136 * corresponding network type and captype, or perhaps the 'realtick'
137 * field contains the correct ticks-per-second value.
138 *
139 * TpS...[] entries of 0.0 mean that no capture file for the
140 * corresponding captype/timeunit values has yet been seen, or that
141 * we're using the 'realtick' value.
142 *
143 * XXX - 05/29/07: For Ethernet captype = 0 (NDIS) and timeunit = 2:
144 * Perusal of a number of Sniffer captures
145 * (including those from Wireshark bug reports
146 * and those from the Wireshark 'menagerie')
147 * suggests that 'realtick' for this case
148 * contains the correct ticks/second to be used.
149 * So: we'll use realtick for Ethernet captype=0 and timeunit=2.
150 * (It might be that realtick should be used for Ethernet captype = 0
151 * and timeunit = 1 but I've not yet enough captures to be sure).
152 * Based upon the captures reviewed to date, realtick cannot be used for
153 * any of the other Ethernet captype/timeunit combinations for which there
154 * are non-zero values in the TpS tables.
155 *
156 * In at least one capture where "realtick" doesn't correspond
157 * to the value from the appropriate TpS table, the per-packet header's
158 * "xxx" field is all zero, so it's not as if a 2.x header includes
159 * a "compatibility" time stamp corresponding to the value from the
160 * TpS table and a "real" time stamp corresponding to "realtick".
161 *
162 * XXX - the item corresponding to timeunit = 2 is 1193180.0, presumably
163 * because somebody found it gave the right answer for some captures, but
164 * 3 times that, i.e. 3579540.0, appears to give the right answer for some
165 * other captures.
166 *
167 * Some captures have realtick of 1193182, some have 3579545, and some
168 * have 1193000. Most of those, in one set of captures somebody has,
169 * are wrong. (Did that mean "wrong for some capture files, but not
170 * for the files in which they occurred", or "wrong for the files in
171 * which they occurred? If it's "wrong for some capture files, but
172 * not for the files in which they occurred", perhaps those were Ethernet
173 * captures with a captype of 0 and timeunit = 2, so that we now use
174 * realtick, and perhaps that fixes the problems.)
175 *
176 * XXX - in at least one ATM capture, hdr.realtick is 1193180.0
177 * and hdr.timeunit is 0. Does that capture have a captype of
178 * CAPTYPE_ATM? If so, what should the table for ATM captures with
179 * that captype be?
180 */
181 static const double TpS[] = { 1e6, 1193000.0, 1193182.0 };
182 #define NUM_NETXRAY_TIMEUNITS array_length(TpS)
183
184 /*
185 * Table of time units for Ethernet captures with captype ETH_CAPTYPE_GIGPOD.
186 * 0.0 means "unknown".
187 *
188 * It appears that, at least for Ethernet captures, if captype is
189 * ETH_CAPTYPE_GIGPOD, that indicates that it's a gigabit Ethernet
190 * capture, possibly from a special whizzo gigabit pod, and also
191 * indicates that the time stamps have some higher resolution than
192 * in other captures, possibly thanks to a high-resolution timer
193 * on the pod.
194 *
195 * It also appears that the time units might differ for gigabit pod
196 * captures between version 002.001 and 002.002. For 002.001,
197 * the values below are correct; for 002.002, it's claimed that
198 * the right value for TpS_gigpod[2] is 1250000.0, but at least one
199 * 002.002 gigabit pod capture has 31250000.0 as the right value.
200 * XXX: Note that the TpS_otherpod[2] value is 1250000.0; It seems
201 * reasonable to suspect that the original claim might actually
202 * have been for a capture with a captype of 'otherpod'.
203 * (Based upon captures reviewed realtick does not contain the
204 * correct TpS values for the 'gigpod' captype).
205 */
206 static const double TpS_gigpod[] = { 1e9, 0.0, 31250000.0 };
207 #define NUM_NETXRAY_TIMEUNITS_GIGPOD array_length(TpS_gigpod)
208
209 /*
210 * Table of time units for Ethernet captures with captype ETH_CAPTYPE_OTHERPOD.
211 * (Based upon captures reviewed realtick does not contain the
212 * correct TpS values for the 'otherpod' captype).
213 */
214 static const double TpS_otherpod[] = { 1e6, 0.0, 1250000.0 };
215 #define NUM_NETXRAY_TIMEUNITS_OTHERPOD array_length(TpS_otherpod)
216
217 /*
218 * Table of time units for Ethernet captures with captype ETH_CAPTYPE_OTHERPOD2.
219 * (Based upon captures reviewed realtick does not contain the
220 * correct TpS values for the 'otherpod2' captype).
221 */
222 static const double TpS_otherpod2[] = { 1e6, 0.0, 0.0 };
223 #define NUM_NETXRAY_TIMEUNITS_OTHERPOD2 array_length(TpS_otherpod2)
224
225 /*
226 * Table of time units for Ethernet captures with captype ETH_CAPTYPE_GIGPOD2.
227 * (Based upon captures reviewed realtick does not contain the
228 * correct TpS values for the 'gigpod2' captype).
229 */
230 static const double TpS_gigpod2[] = { 1e9, 0.0, 20000000.0 };
231 #define NUM_NETXRAY_TIMEUNITS_GIGPOD2 array_length(TpS_gigpod2)
232
233 /* Version number strings. */
234 static const char vers_1_0[] = {
235 '0', '0', '1', '.', '0', '0', '0', '\0'
236 };
237
238 static const char vers_1_1[] = {
239 '0', '0', '1', '.', '1', '0', '0', '\0'
240 };
241
242 static const char vers_2_000[] = {
243 '0', '0', '2', '.', '0', '0', '0', '\0'
244 };
245
246 static const char vers_2_001[] = {
247 '0', '0', '2', '.', '0', '0', '1', '\0'
248 };
249
250 static const char vers_2_002[] = {
251 '0', '0', '2', '.', '0', '0', '2', '\0'
252 };
253
254 static const char vers_2_003[] = {
255 '0', '0', '2', '.', '0', '0', '3', '\0'
256 };
257
258 /* Old NetXRay data record format - followed by frame data. */
259 struct old_netxrayrec_hdr {
260 uint32_t timelo; /* lower 32 bits of time stamp */
261 uint32_t timehi; /* upper 32 bits of time stamp */
262 uint16_t len; /* packet length */
263 uint8_t xxx[6]; /* unknown */
264 };
265
266 /* NetXRay format version 1.x data record format - followed by frame data. */
267 struct netxrayrec_1_x_hdr {
268 uint32_t timelo; /* lower 32 bits of time stamp */
269 uint32_t timehi; /* upper 32 bits of time stamp */
270 uint16_t orig_len; /* packet length */
271 uint16_t incl_len; /* capture length */
272 uint8_t xxx[16]; /* unknown */
273 };
274
275 /*
276 * NetXRay format version 2.x data record format - followed by frame data.
277 *
278 * The xxx fields appear to be:
279 *
280 * xxx[0]: ATM traffic type and subtype in the low 3 bits of
281 * each nibble, and flags(?) in the upper bit of each nibble.
282 * Always 0 for 802.11?
283 *
284 * xxx[1]: Always 0 for 802.11?
285 *
286 * xxx[2], xxx[3]: for Ethernet, 802.11, ISDN LAPD, LAPB,
287 * Frame Relay, if both are 0xff, there are 4 bytes of stuff
288 * at the end of the packet data, which might be an FCS or
289 * which might be junk to discard.
290 *
291 * xxx[4-7]: Always 0 for 802.11?
292 *
293 * xxx[8], xxx[9]: 2 bytes of a flag word? If treated as
294 * a 2-byte little-endian flag word:
295 *
296 * 0x0001: Error of some sort, including bad CRC, although
297 * in one ISDN capture it's set in some B2 channel
298 * packets of unknown content (as opposed to the B1
299 * traffic in the capture, which is PPP)
300 * 0x0002: Seen in 802.11 - short preamble? Bad CRC?
301 * 0x0004: Some particular type of error?
302 * 0x0008: For (Gigabit?) Ethernet (with special probe?),
303 * 4 bytes at end are junk rather than CRC?
304 * 0x0100: CRC error on ATM? Protected and Not decrypted
305 * for 802.11? Bad CRC? Short preamble?
306 * 0x0200: Something for ATM? Something else for 802.11?
307 * 0x0400: raw ATM cell
308 * 0x0800: OAM cell?
309 * 0x2000: port on which the packet was captured?
310 *
311 * The Sniffer Portable 4.8 User's Guide lists a set of packet status
312 * flags including:
313 *
314 * packet is marked;
315 * packet was captured from Port A on the pod or adapter card;
316 * packet was captured from Port B on the pod or adapter card;
317 * packet has a symptom or diagnosis associated with it;
318 * packet is an event filter trigger;
319 * CRC error packet with normal packet size;
320 * CRC error packet with oversize error;
321 * packet size < 64 bytes (including CRC) but with valid CRC;
322 * packet size < 64 bytes (including CRC) with CRC error;
323 * packet size > 1518 bytes (including CRC) but with valid CRC;
324 * packet damaged by a collision;
325 * packet length not a multiple of 8 bits;
326 * address conflict in the ring on Token Ring;
327 * packet is not copied (received) by the destination host on
328 * Token Ring;
329 * AAL5 length error;
330 * AAL5 maximum segments error;
331 * ATM timeout error;
332 * ATM buffer error;
333 * ATM unknown error;
334 * and a ton of AAL2 errors.
335 *
336 * Not all those bits necessarily correspond to flag bits in the file,
337 * but some might.
338 *
339 * In one ATM capture, the 0x2000 bit was set for all frames; in another,
340 * it's unset for all frames. This, plus the ATMbook having two ports,
341 * suggests that it *might* be a "port A vs. port B" flag.
342 *
343 * The 0x0001 bit appears to be set for CRC errors on Ethernet and 802.11.
344 * It also appears to be set on ATM for AAL5 PDUs that appear to be
345 * completely reassembled and that have a CRC error and for frames that
346 * appear to be part of a full AAL5 PDU. In at least two files with
347 * frames of the former type, the 0x0100 and 0x0200 flags are set;
348 * in at least one file with frames of the latter type, neither of
349 * those flags are set.
350 *
351 * The field appears to be somewhat random in some captures,
352 * however.
353 *
354 * xxx[10]: for 802.11, always 0?
355 *
356 * xxx[11]: for 802.11, 0x05 if the packet is WEP-encrypted(?).
357 *
358 * xxx[12]: for 802.11, channel number.
359 *
360 * xxx[13]: for 802.11, data rate, in 500 Kb/s units.
361 *
362 * xxx[14]: for 802.11, signal strength.
363 *
364 * xxx[15]: for 802.11, noise level; 0xFF means none reported,
365 * 0x7F means 100%.
366 *
367 * xxx[16-19]: for 802.11, PHY header, at least for {HR/}DSSS,
368 * in at least one capture.
369 * In another capture, xxx[16] appears to be the
370 * data rate in 500 Kb/s units
371 * Chip-dependent stuff?
372 *
373 * xxx[20-25]: for 802.11, MAC address of sending machine(?).
374 *
375 * xxx[26]: for 802.11, one of 0x00, 0x01, 0x03, or 0x0b?
376 *
377 * xxx[27]: for 802.11, one of 0x00 or 0x30?
378 */
379 struct netxrayrec_2_x_hdr {
380 uint32_t timelo; /* lower 32 bits of time stamp */
381 uint32_t timehi; /* upper 32 bits of time stamp */
382 uint16_t orig_len; /* packet length */
383 uint16_t incl_len; /* capture length */
384 uint8_t xxx[28]; /* various data */
385 };
386
387 /*
388 * Union of the data record headers.
389 */
390 union netxrayrec_hdr {
391 struct old_netxrayrec_hdr old_hdr;
392 struct netxrayrec_1_x_hdr hdr_1_x;
393 struct netxrayrec_2_x_hdr hdr_2_x;
394 };
395
396 typedef struct {
397 time_t start_time;
398 double ticks_per_sec;
399 double start_timestamp;
400 bool wrapped;
401 uint32_t nframes;
402 int64_t start_offset;
403 int64_t end_offset;
404 int version_major;
405 bool fcs_valid; /* if packets have valid FCS at the end */
406 unsigned isdn_type; /* 1 = E1 PRI, 2 = T1 PRI, 3 = BRI */
407 } netxray_t;
408
409 static bool netxray_read(wtap *wth, wtap_rec *rec, Buffer *buf,
410 int *err, char **err_info, int64_t *data_offset);
411 static bool netxray_seek_read(wtap *wth, int64_t seek_off,
412 wtap_rec *rec, Buffer *buf, int *err, char **err_info);
413 static int netxray_process_rec_header(wtap *wth, FILE_T fh,
414 wtap_rec *rec, int *err, char **err_info);
415 static void netxray_guess_atm_type(wtap *wth, wtap_rec *rec,
416 Buffer *buf);
417 static bool netxray_dump_1_1(wtap_dumper *wdh,
418 const wtap_rec *rec,
419 const uint8_t *pd, int *err, char **err_info);
420 static bool netxray_dump_finish_1_1(wtap_dumper *wdh, int *err,
421 char **err_info);
422 static bool netxray_dump_2_0(wtap_dumper *wdh,
423 const wtap_rec *rec,
424 const uint8_t *pd, int *err, char **err_info);
425 static bool netxray_dump_finish_2_0(wtap_dumper *wdh, int *err,
426 char **err_info);
427
428 static int netxray_old_file_type_subtype = -1;
429 static int netxray_1_0_file_type_subtype = -1;
430 static int netxray_1_1_file_type_subtype = -1;
431 static int netxray_2_00x_file_type_subtype = -1;
432
433 void register_netxray(void);
434
435 wtap_open_return_val
436 netxray_open(wtap *wth, int *err, char **err_info)
437 {
438 char magic[MAGIC_SIZE];
439 bool is_old;
440 struct netxray_hdr hdr;
441 unsigned network_type;
442 double ticks_per_sec;
443 int version_major, version_minor;
444 int file_type;
445 double start_timestamp;
446 static const int netxray_encap[] = {
447 WTAP_ENCAP_UNKNOWN,
448 WTAP_ENCAP_ETHERNET,
449 WTAP_ENCAP_TOKEN_RING,
450 WTAP_ENCAP_FDDI_BITSWAPPED,
451 /*
452 * XXX - some PPP captures may look like Ethernet,
453 * perhaps because they're using NDIS to capture on the
454 * same machine and it provides simulated-Ethernet
455 * packets, but captures taken with various serial
456 * pods use the same network type value but aren't
457 * shaped like Ethernet. We handle that below.
458 */
459 WTAP_ENCAP_ETHERNET, /* WAN(PPP), but shaped like Ethernet */
460 WTAP_ENCAP_UNKNOWN, /* LocalTalk */
461 WTAP_ENCAP_UNKNOWN, /* "DIX" - should not occur */
462 WTAP_ENCAP_UNKNOWN, /* ARCNET raw */
463 WTAP_ENCAP_UNKNOWN, /* ARCNET 878.2 */
464 WTAP_ENCAP_ATM_PDUS_UNTRUNCATED,/* ATM */
465 WTAP_ENCAP_IEEE_802_11_WITH_RADIO,
466 /* Wireless WAN with radio information */
467 WTAP_ENCAP_UNKNOWN /* IrDA */
468 };
469 #define NUM_NETXRAY_ENCAPS array_length(netxray_encap)
470 int file_encap;
471 unsigned isdn_type = 0;
472 netxray_t *netxray;
473
474 /* Read in the string that should be at the start of a NetXRay
475 * file */
476 if (!wtap_read_bytes(wth->fh, magic, MAGIC_SIZE, err, err_info)) {
477 if (*err != WTAP_ERR_SHORT_READ)
478 return WTAP_OPEN_ERROR;
479 return WTAP_OPEN_NOT_MINE;
480 }
481
482 if (memcmp(magic, netxray_magic, MAGIC_SIZE) == 0) {
483 is_old = false;
484 } else if (memcmp(magic, old_netxray_magic, MAGIC_SIZE) == 0) {
485 is_old = true;
486 } else {
487 return WTAP_OPEN_NOT_MINE;
488 }
489
490 /* Read the rest of the header. */
491 if (!wtap_read_bytes(wth->fh, &hdr, sizeof hdr, err, err_info))
492 return WTAP_OPEN_ERROR;
493
494 if (is_old) {
495 version_major = 0;
496 version_minor = 0;
497 file_type = netxray_old_file_type_subtype;
498 } else {
499 /* It appears that version 1.1 files (as produced by Windows
500 * Sniffer Pro 2.0.01) have the time stamp in microseconds,
501 * rather than the milliseconds version 1.0 files appear to
502 * have.
503 *
504 * It also appears that version 2.00x files have per-packet
505 * headers with some extra fields. */
506 if (memcmp(hdr.version, vers_1_0, sizeof vers_1_0) == 0) {
507 version_major = 1;
508 version_minor = 0;
509 file_type = netxray_1_0_file_type_subtype;
510 } else if (memcmp(hdr.version, vers_1_1, sizeof vers_1_1) == 0) {
511 version_major = 1;
512 version_minor = 1;
513 file_type = netxray_1_1_file_type_subtype;
514 } else if (memcmp(hdr.version, vers_2_000, sizeof vers_2_000) == 0) {
515 version_major = 2;
516 version_minor = 0;
517 file_type = netxray_2_00x_file_type_subtype;
518 } else if (memcmp(hdr.version, vers_2_001, sizeof vers_2_001) == 0) {
519 version_major = 2;
520 version_minor = 1;
521 file_type = netxray_2_00x_file_type_subtype;
522 } else if (memcmp(hdr.version, vers_2_002, sizeof vers_2_002) == 0) {
523 version_major = 2;
524 version_minor = 2;
525 file_type = netxray_2_00x_file_type_subtype;
526 } else if (memcmp(hdr.version, vers_2_003, sizeof vers_2_003) == 0) {
527 version_major = 2;
528 version_minor = 3;
529 file_type = netxray_2_00x_file_type_subtype;
530 } else {
531 *err = WTAP_ERR_UNSUPPORTED;
532 *err_info = ws_strdup_printf("netxray: version \"%.8s\" unsupported", hdr.version);
533 return WTAP_OPEN_ERROR;
534 }
535 }
536
537 switch (hdr.network_plus) {
538
539 case 0:
540 /*
541 * The byte after hdr.network is usually 0, in which case
542 * the hdr.network byte is an NDIS network type value - 1.
543 */
544 network_type = hdr.network + 1;
545 break;
546
547 case 2:
548 /*
549 * However, in some Ethernet captures, it's 2, and the
550 * hdr.network byte is 1 rather than 0. We assume
551 * that if there's a byte after hdr.network with the value
552 * 2, the hdr.network byte is an NDIS network type, rather
553 * than an NDIS network type - 1.
554 */
555 network_type = hdr.network;
556 break;
557
558 default:
559 *err = WTAP_ERR_UNSUPPORTED;
560 *err_info = ws_strdup_printf("netxray: the byte after the network type has the value %u, which I don't understand",
561 hdr.network_plus);
562 return WTAP_OPEN_ERROR;
563 }
564
565 if (network_type >= NUM_NETXRAY_ENCAPS
566 || netxray_encap[network_type] == WTAP_ENCAP_UNKNOWN) {
567 *err = WTAP_ERR_UNSUPPORTED;
568 *err_info = ws_strdup_printf("netxray: network type %u (%u) unknown or unsupported",
569 network_type, hdr.network_plus);
570 return WTAP_OPEN_ERROR;
571 }
572
573 /*
574 * Figure out the time stamp units and start time stamp.
575 */
576 start_timestamp = (double)pletoh32(&hdr.timelo)
577 + (double)pletoh32(&hdr.timehi)*4294967296.0;
578 if (is_old) {
579 ticks_per_sec = 1000.0;
580 wth->file_tsprec = WTAP_TSPREC_MSEC;
581 } else if (version_major == 1) {
582 switch (version_minor) {
583
584 case 0:
585 ticks_per_sec = 1000.0;
586 wth->file_tsprec = WTAP_TSPREC_MSEC;
587 break;
588
589 case 1:
590 /*
591 * In version 1.1 files (as produced by Windows
592 * Sniffer Pro 2.0.01), the time stamp is in
593 * microseconds, rather than the milliseconds
594 * time stamps in NetXRay and older versions
595 * of Windows Sniffer.
596 */
597 ticks_per_sec = 1000000.0;
598 wth->file_tsprec = WTAP_TSPREC_USEC;
599 break;
600
601 default:
602 /* "Can't happen" - we rejected that above */
603 *err = WTAP_ERR_INTERNAL;
604 *err_info = ws_strdup_printf("netxray: version %d.%d somehow didn't get rejected",
605 version_major, version_minor);
606 return WTAP_OPEN_ERROR;
607 }
608 } else if (version_major == 2) {
609 /*
610 * Get the time stamp units from the appropriate TpS
611 * table or from the file header.
612 */
613 switch (network_type) {
614
615 case 1:
616 /*
617 * Ethernet - the table to use depends on whether
618 * this is an NDIS or pod capture.
619 */
620 switch (hdr.captype) {
621
622 case CAPTYPE_NDIS:
623 if (hdr.timeunit >= NUM_NETXRAY_TIMEUNITS) {
624 *err = WTAP_ERR_UNSUPPORTED;
625 *err_info = ws_strdup_printf(
626 "netxray: Unknown timeunit %u for Ethernet/CAPTYPE_NDIS version %.8s capture",
627 hdr.timeunit, hdr.version);
628 return WTAP_OPEN_ERROR;
629 }
630 /*
631 XXX: 05/29/07: Use 'realtick' instead of TpS table if timeunit=2;
632 Using 'realtick' in this case results
633 in the correct 'ticks per second' for all the captures that
634 I have of this type (including captures from a number of Wireshark
635 bug reports).
636 */
637 if (hdr.timeunit == 2) {
638 ticks_per_sec = pletoh32(hdr.realtick);
639 }
640 else {
641 ticks_per_sec = TpS[hdr.timeunit];
642 }
643 break;
644
645 case ETH_CAPTYPE_GIGPOD:
646 if (hdr.timeunit >= NUM_NETXRAY_TIMEUNITS_GIGPOD
647 || TpS_gigpod[hdr.timeunit] == 0.0) {
648 *err = WTAP_ERR_UNSUPPORTED;
649 *err_info = ws_strdup_printf(
650 "netxray: Unknown timeunit %u for Ethernet/ETH_CAPTYPE_GIGPOD version %.8s capture",
651 hdr.timeunit, hdr.version);
652 return WTAP_OPEN_ERROR;
653 }
654 ticks_per_sec = TpS_gigpod[hdr.timeunit];
655
656 /*
657 * At least for 002.002 and 002.003
658 * captures, the start time stamp is 0,
659 * not the value in the file.
660 */
661 if (version_minor == 2 || version_minor == 3)
662 start_timestamp = 0.0;
663 break;
664
665 case ETH_CAPTYPE_OTHERPOD:
666 if (hdr.timeunit >= NUM_NETXRAY_TIMEUNITS_OTHERPOD
667 || TpS_otherpod[hdr.timeunit] == 0.0) {
668 *err = WTAP_ERR_UNSUPPORTED;
669 *err_info = ws_strdup_printf(
670 "netxray: Unknown timeunit %u for Ethernet/ETH_CAPTYPE_OTHERPOD version %.8s capture",
671 hdr.timeunit, hdr.version);
672 return WTAP_OPEN_ERROR;
673 }
674 ticks_per_sec = TpS_otherpod[hdr.timeunit];
675
676 /*
677 * At least for 002.002 and 002.003
678 * captures, the start time stamp is 0,
679 * not the value in the file.
680 */
681 if (version_minor == 2 || version_minor == 3)
682 start_timestamp = 0.0;
683 break;
684
685 case ETH_CAPTYPE_OTHERPOD2:
686 if (hdr.timeunit >= NUM_NETXRAY_TIMEUNITS_OTHERPOD2
687 || TpS_otherpod2[hdr.timeunit] == 0.0) {
688 *err = WTAP_ERR_UNSUPPORTED;
689 *err_info = ws_strdup_printf(
690 "netxray: Unknown timeunit %u for Ethernet/ETH_CAPTYPE_OTHERPOD2 version %.8s capture",
691 hdr.timeunit, hdr.version);
692 return WTAP_OPEN_ERROR;
693 }
694 ticks_per_sec = TpS_otherpod2[hdr.timeunit];
695 /*
696 * XXX: start time stamp in the one capture file examined of this type was 0;
697 * We'll assume the start time handling is the same as for other pods.
698 *
699 * At least for 002.002 and 002.003
700 * captures, the start time stamp is 0,
701 * not the value in the file.
702 */
703 if (version_minor == 2 || version_minor == 3)
704 start_timestamp = 0.0;
705 break;
706
707 case ETH_CAPTYPE_GIGPOD2:
708 if (hdr.timeunit >= NUM_NETXRAY_TIMEUNITS_GIGPOD2
709 || TpS_gigpod2[hdr.timeunit] == 0.0) {
710 *err = WTAP_ERR_UNSUPPORTED;
711 *err_info = ws_strdup_printf(
712 "netxray: Unknown timeunit %u for Ethernet/ETH_CAPTYPE_GIGPOD2 version %.8s capture",
713 hdr.timeunit, hdr.version);
714 return WTAP_OPEN_ERROR;
715 }
716 ticks_per_sec = TpS_gigpod2[hdr.timeunit];
717 /*
718 * XXX: start time stamp in the one capture file examined of this type was 0;
719 * We'll assume the start time handling is the same as for other pods.
720 *
721 * At least for 002.002 and 002.003
722 * captures, the start time stamp is 0,
723 * not the value in the file.
724 */
725 if (version_minor == 2 || version_minor == 3)
726 start_timestamp = 0.0;
727 break;
728
729 default:
730 *err = WTAP_ERR_UNSUPPORTED;
731 *err_info = ws_strdup_printf(
732 "netxray: Unknown capture type %u for Ethernet version %.8s capture",
733 hdr.captype, hdr.version);
734 return WTAP_OPEN_ERROR;
735 }
736 break;
737
738 default:
739 if (hdr.timeunit >= NUM_NETXRAY_TIMEUNITS) {
740 *err = WTAP_ERR_UNSUPPORTED;
741 *err_info = ws_strdup_printf(
742 "netxray: Unknown timeunit %u for %u/%u version %.8s capture",
743 hdr.timeunit, network_type, hdr.captype,
744 hdr.version);
745 return WTAP_OPEN_ERROR;
746 }
747 ticks_per_sec = TpS[hdr.timeunit];
748 break;
749 }
750
751 /*
752 * If the number of ticks per second is greater than
753 * 1 million, make the precision be nanoseconds rather
754 * than microseconds.
755 *
756 * XXX - do values only slightly greater than one million
757 * correspond to a resolution sufficiently better than
758 * 1 microsecond to display more digits of precision?
759 * XXX - Seems reasonable to use nanosecs only if TPS >= 10M
760 */
761 if (ticks_per_sec >= 1e7)
762 wth->file_tsprec = WTAP_TSPREC_NSEC;
763 else
764 wth->file_tsprec = WTAP_TSPREC_USEC;
765 } else {
766 /* "Can't happen" - we rejected that above */
767 *err = WTAP_ERR_INTERNAL;
768 *err_info = ws_strdup_printf("netxray: version %d.%d somehow didn't get rejected",
769 version_major, version_minor);
770 return WTAP_OPEN_ERROR;
771 }
772 start_timestamp = start_timestamp/ticks_per_sec;
773
774 if (network_type == 4) {
775 /*
776 * In version 0 and 1, we assume, for now, that all
777 * WAN captures have frames that look like Ethernet
778 * frames (as a result, presumably, of having passed
779 * through NDISWAN).
780 *
781 * In version 2, it looks as if there's stuff in the
782 * file header to specify what particular type of WAN
783 * capture we have.
784 */
785 if (version_major == 2) {
786 switch (hdr.captype) {
787
788 case WAN_CAPTYPE_PPP:
789 /*
790 * PPP.
791 */
792 file_encap = WTAP_ENCAP_PPP_WITH_PHDR;
793 break;
794
795 case WAN_CAPTYPE_FRELAY:
796 /*
797 * Frame Relay.
798 *
799 * XXX - in at least one capture, this
800 * is Cisco HDLC, not Frame Relay, but
801 * in another capture, it's Frame Relay.
802 *
803 * [Bytes in each capture:
804 * Cisco HDLC: hdr.xxx_x60[06:10]: 0x02 0x00 0x01 0x00 0x06
805 * Frame Relay: hdr.xxx_x60[06:10] 0x00 0x00 0x00 0x00 0x00
806
807 * Cisco HDLC: hdr.xxx_x60[14:15]: 0xff 0xff
808 * Frame Relay: hdr.xxx_x60[14:15]: 0x00 0x00
809 * ]
810 */
811 file_encap = WTAP_ENCAP_FRELAY_WITH_PHDR;
812 break;
813
814 case WAN_CAPTYPE_HDLC:
815 case WAN_CAPTYPE_HDLC2:
816 /*
817 * Various HDLC flavors?
818 */
819 switch (hdr.wan_hdlc_subsub_captype) {
820
821 case 0: /* LAPB/X.25 */
822 /*
823 * XXX - at least one capture of
824 * this type appears to be PPP.
825 */
826 file_encap = WTAP_ENCAP_LAPB;
827 break;
828
829 case 1: /* E1 PRI */
830 case 2: /* T1 PRI */
831 case 3: /* BRI */
832 file_encap = WTAP_ENCAP_ISDN;
833 isdn_type = hdr.wan_hdlc_subsub_captype;
834 break;
835
836 default:
837 *err = WTAP_ERR_UNSUPPORTED;
838 *err_info = ws_strdup_printf("netxray: WAN HDLC capture subsubtype 0x%02x unknown or unsupported",
839 hdr.wan_hdlc_subsub_captype);
840 return WTAP_OPEN_ERROR;
841 }
842 break;
843
844 case WAN_CAPTYPE_SDLC:
845 /*
846 * SDLC.
847 */
848 file_encap = WTAP_ENCAP_SDLC;
849 break;
850
851 case WAN_CAPTYPE_CHDLC:
852 /*
853 * Cisco router (CHDLC) captured with pod
854 */
855 file_encap = WTAP_ENCAP_CHDLC_WITH_PHDR;
856 break;
857
858 default:
859 *err = WTAP_ERR_UNSUPPORTED;
860 *err_info = ws_strdup_printf("netxray: WAN capture subtype 0x%02x unknown or unsupported",
861 hdr.captype);
862 return WTAP_OPEN_ERROR;
863 }
864 } else
865 file_encap = WTAP_ENCAP_ETHERNET;
866 } else
867 file_encap = netxray_encap[network_type];
868
869 /* This is a netxray file */
870 wth->file_type_subtype = file_type;
871 netxray = g_new(netxray_t, 1);
872 wth->priv = (void *)netxray;
873 wth->subtype_read = netxray_read;
874 wth->subtype_seek_read = netxray_seek_read;
875 wth->file_encap = file_encap;
876 wth->snapshot_length = 0; /* not available in header */
877 netxray->start_time = pletoh32(&hdr.start_time);
878 netxray->ticks_per_sec = ticks_per_sec;
879 netxray->start_timestamp = start_timestamp;
880 netxray->version_major = version_major;
881
882 /*
883 * If frames have an extra 4 bytes of stuff at the end, is
884 * it an FCS, or just junk?
885 */
886 netxray->fcs_valid = false;
887 switch (file_encap) {
888
889 case WTAP_ENCAP_ETHERNET:
890 case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
891 case WTAP_ENCAP_ISDN:
892 case WTAP_ENCAP_LAPB:
893 /*
894 * It appears that, in at least some version 2 Ethernet
895 * captures, for frames that have 0xff in hdr_2_x.xxx[2]
896 * and hdr_2_x.xxx[3] in the per-packet header:
897 *
898 * if, in the file header, hdr.realtick[1] is 0x34
899 * and hdr.realtick[2] is 0x12, the frames have an
900 * FCS at the end;
901 *
902 * otherwise, they have 4 bytes of junk at the end.
903 *
904 * Yes, it's strange that you have to check the *middle*
905 * of the time stamp field; you can't check for any
906 * particular value of the time stamp field.
907 *
908 * For now, we assume that to be true for 802.11 captures
909 * as well; it appears to be the case for at least one
910 * such capture - the file doesn't have 0x34 and 0x12,
911 * and the 4 bytes at the end of the frames with 0xff
912 * are junk, not an FCS.
913 *
914 * For ISDN captures, it appears, at least in some
915 * captures, to be similar, although I haven't yet
916 * checked whether it's a valid FCS.
917 *
918 * XXX - should we do this for all encapsulation types?
919 *
920 * XXX - is there some other field that *really* indicates
921 * whether we have an FCS or not? The check of the time
922 * stamp is bizarre, as we're checking the middle.
923 * Perhaps hdr.realtick[0] is 0x00, in which case time
924 * stamp units in the range 1192960 through 1193215
925 * correspond to captures with an FCS, but that's still
926 * a bit bizarre.
927 *
928 * Note that there are captures with a network type of 0
929 * (Ethernet) and capture type of 0 (NDIS) that do, and
930 * that don't, have 0x34 0x12 in them, and at least one
931 * of the NDIS captures with 0x34 0x12 in it has FCSes,
932 * so it's not as if no NDIS captures have an FCS.
933 *
934 * There are also captures with a network type of 4 (WAN),
935 * capture type of 6 (HDLC), and subtype of 2 (T1 PRI) that
936 * do, and that don't, have 0x34 0x12, so there are at least
937 * some captures taken with a WAN pod that might lack an FCS.
938 * (We haven't yet tried dissecting the 4 bytes at the
939 * end of packets with hdr_2_x.xxx[2] and hdr_2_x.xxx[3]
940 * equal to 0xff as an FCS.)
941 *
942 * All captures I've seen that have 0x34 and 0x12 *and*
943 * have at least one frame with an FCS have a value of
944 * 0x01 in xxx_x40[4]. No captures I've seen with a network
945 * type of 0 (Ethernet) missing 0x34 0x12 have 0x01 there,
946 * however. However, there's at least one capture
947 * without 0x34 and 0x12, with a network type of 0,
948 * and with 0x01 in xxx_x40[4], *without* FCSes in the
949 * frames - the 4 bytes at the end are all zero - so it's
950 * not as simple as "xxx_x40[4] = 0x01 means the 4 bytes at
951 * the end are FCSes". Also, there's also at least one
952 * 802.11 capture with an xxx_x40[4] value of 0x01 with junk
953 * rather than an FCS at the end of the frame, so xxx_x40[4]
954 * isn't an obvious flag to determine whether the
955 * capture has FCSes.
956 *
957 * There don't seem to be any other values in any of the
958 * xxx_x5..., xxx_x6...., xxx_x7.... fields
959 * that obviously correspond to frames having an FCS.
960 *
961 * 05/29/07: Examination of numerous sniffer captures suggests
962 * that the apparent correlation of certain realtick
963 * bytes to 'FCS presence' may actually be
964 * a 'false positive'.
965 * ToDo: Review analysis and update code.
966 * It might be that the ticks-per-second value
967 * is hardware-dependent, and that hardware with
968 * a particular realtick value puts an FCS there
969 * and other hardware doesn't.
970 */
971 if (version_major == 2) {
972 if (hdr.realtick[1] == 0x34 && hdr.realtick[2] == 0x12)
973 netxray->fcs_valid = true;
974 }
975 break;
976 }
977
978 /*
979 * Remember the ISDN type, as we need it to interpret the
980 * channel number in ISDN captures.
981 */
982 netxray->isdn_type = isdn_type;
983
984 /* Remember the offset after the last packet in the capture (which
985 * isn't necessarily the last packet in the file), as it appears
986 * there's sometimes crud after it.
987 * XXX: Remember 'start_offset' to help testing for 'short file' at EOF
988 */
989 netxray->wrapped = false;
990 netxray->nframes = pletoh32(&hdr.nframes);
991 netxray->start_offset = pletoh32(&hdr.start_offset);
992 netxray->end_offset = pletoh32(&hdr.end_offset);
993
994 /* Seek to the beginning of the data records. */
995 if (file_seek(wth->fh, netxray->start_offset, SEEK_SET, err) == -1) {
996 return WTAP_OPEN_ERROR;
997 }
998
999 /*
1000 * Add an IDB; we don't know how many interfaces were
1001 * involved, so we just say one interface, about which
1002 * we only know the link-layer type, snapshot length,
1003 * and time stamp resolution.
1004 */
1005 wtap_add_generated_idb(wth);
1006
1007 return WTAP_OPEN_MINE;
1008 }
1009
1010 /* Read the next packet */
1011 static bool
1012 netxray_read(wtap *wth, wtap_rec *rec, Buffer *buf, int *err,
1013 char **err_info, int64_t *data_offset)
1014 {
1015 netxray_t *netxray = (netxray_t *)wth->priv;
1016 int padding;
1017
1018 reread:
1019 /*
1020 * Return the offset of the record header, so we can reread it
1021 * if we go back to this frame.
1022 */
1023 *data_offset = file_tell(wth->fh);
1024
1025 /* Have we reached the end of the packet data? */
1026 if (*data_offset == netxray->end_offset) {
1027 /* Yes. */
1028 *err = 0; /* it's just an EOF, not an error */
1029 return false;
1030 }
1031
1032 /* Read and process record header. */
1033 padding = netxray_process_rec_header(wth, wth->fh, rec, err, err_info);
1034 if (padding < 0) {
1035 /*
1036 * Error or EOF.
1037 */
1038 if (*err != 0) {
1039 /*
1040 * Error of some sort; give up.
1041 */
1042 return false;
1043 }
1044
1045 /* We're at EOF. Wrap?
1046 * XXX: Need to handle 'short file' cases
1047 * (Distributed Sniffer seems to have a
1048 * certain small propensity to generate 'short' files
1049 * i.e. [many] bytes are missing from the end of the file)
1050 * case 1: start_offset < end_offset
1051 * wrap will read already read packets again;
1052 * so: error with "short file"
1053 * case 2: start_offset > end_offset ("circular" file)
1054 * wrap will mean there's a gap (missing packets).
1055 * However, I don't see a good way to identify this
1056 * case so we'll just have to allow the wrap.
1057 * (Maybe there can be an error message after all
1058 * packets are read since there'll be less packets than
1059 * specified in the file header).
1060 * Note that these cases occur *only* if a 'short' eof occurs exactly
1061 * at the expected beginning of a frame header record; If there is a
1062 * partial frame header (or partial frame data) record, then the
1063 * netxray_read... functions will detect the short record.
1064 */
1065 if (netxray->start_offset < netxray->end_offset) {
1066 *err = WTAP_ERR_SHORT_READ;
1067 return false;
1068 }
1069
1070 if (!netxray->wrapped) {
1071 /* Yes. Remember that we did. */
1072 netxray->wrapped = true;
1073 if (file_seek(wth->fh, CAPTUREFILE_HEADER_SIZE,
1074 SEEK_SET, err) == -1)
1075 return false;
1076 goto reread;
1077 }
1078
1079 /* We've already wrapped - don't wrap again. */
1080 return false;
1081 }
1082
1083 /*
1084 * Read the packet data.
1085 */
1086 if (!wtap_read_packet_bytes(wth->fh, buf,
1087 rec->rec_header.packet_header.caplen, err, err_info))
1088 return false;
1089
1090 /*
1091 * If there's extra stuff at the end of the record, skip it.
1092 */
1093 if (!wtap_read_bytes(wth->fh, NULL, padding, err, err_info))
1094 return false;
1095
1096 /*
1097 * If it's an ATM packet, and we don't have enough information
1098 * from the packet header to determine its type or subtype,
1099 * attempt to guess them from the packet data.
1100 */
1101 netxray_guess_atm_type(wth, rec, buf);
1102 return true;
1103 }
1104
1105 static bool
1106 netxray_seek_read(wtap *wth, int64_t seek_off,
1107 wtap_rec *rec, Buffer *buf,
1108 int *err, char **err_info)
1109 {
1110 if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
1111 return false;
1112
1113 if (netxray_process_rec_header(wth, wth->random_fh, rec, err,
1114 err_info) == -1) {
1115 if (*err == 0) {
1116 /*
1117 * EOF - we report that as a short read, as
1118 * we've read this once and know that it
1119 * should be there.
1120 */
1121 *err = WTAP_ERR_SHORT_READ;
1122 }
1123 return false;
1124 }
1125
1126 /*
1127 * Read the packet data.
1128 */
1129 if (!wtap_read_packet_bytes(wth->random_fh, buf, rec->rec_header.packet_header.caplen, err,
1130 err_info))
1131 return false;
1132
1133 /*
1134 * If it's an ATM packet, and we don't have enough information
1135 * from the packet header to determine its type or subtype,
1136 * attempt to guess them from the packet data.
1137 */
1138 netxray_guess_atm_type(wth, rec, buf);
1139 return true;
1140 }
1141
1142 static int
1143 netxray_process_rec_header(wtap *wth, FILE_T fh, wtap_rec *rec,
1144 int *err, char **err_info)
1145 {
1146 netxray_t *netxray = (netxray_t *)wth->priv;
1147 union netxrayrec_hdr hdr;
1148 int hdr_size = 0;
1149 double t;
1150 int packet_size;
1151 int padding = 0;
1152
1153 /* Read record header. */
1154 switch (netxray->version_major) {
1155
1156 case 0:
1157 hdr_size = sizeof (struct old_netxrayrec_hdr);
1158 break;
1159
1160 case 1:
1161 hdr_size = sizeof (struct netxrayrec_1_x_hdr);
1162 break;
1163
1164 case 2:
1165 hdr_size = sizeof (struct netxrayrec_2_x_hdr);
1166 break;
1167 }
1168 if (!wtap_read_bytes_or_eof(fh, (void *)&hdr, hdr_size, err, err_info)) {
1169 /*
1170 * If *err is 0, we're at EOF. *err being 0 and a return
1171 * value of -1 tells our caller we're at EOF.
1172 *
1173 * Otherwise, we got an error, and *err *not* being 0
1174 * and a return value tells our caller we have an error.
1175 */
1176 return -1;
1177 }
1178
1179 /*
1180 * If this is Ethernet, 802.11, ISDN, X.25, or ATM, set the
1181 * pseudo-header.
1182 */
1183 switch (netxray->version_major) {
1184
1185 case 1:
1186 switch (wth->file_encap) {
1187
1188 case WTAP_ENCAP_ETHERNET:
1189 /*
1190 * XXX - if hdr_1_x.xxx[15] is 1
1191 * the frame appears not to have any extra
1192 * stuff at the end, but if it's 0,
1193 * there appears to be 4 bytes of stuff
1194 * at the end, but it's not an FCS.
1195 *
1196 * Or is that just the low-order bit?
1197 *
1198 * For now, we just say "no FCS".
1199 */
1200 rec->rec_header.packet_header.pseudo_header.eth.fcs_len = 0;
1201 break;
1202 }
1203 break;
1204
1205 case 2:
1206 switch (wth->file_encap) {
1207
1208 case WTAP_ENCAP_ETHERNET:
1209 /*
1210 * It appears, at least with version 2 captures,
1211 * that we have 4 bytes of stuff (which might be
1212 * a valid FCS or might be junk) at the end of
1213 * the packet if hdr_2_x.xxx[2] and
1214 * hdr_2_x.xxx[3] are 0xff, and we don't if
1215 * they don't.
1216 *
1217 * It also appears that if the low-order bit of
1218 * hdr_2_x.xxx[8] is set, the packet has a
1219 * bad FCS.
1220 */
1221 if (hdr.hdr_2_x.xxx[2] == 0xff &&
1222 hdr.hdr_2_x.xxx[3] == 0xff) {
1223 /*
1224 * We have 4 bytes of stuff at the
1225 * end of the frame - FCS, or junk?
1226 */
1227 if (netxray->fcs_valid) {
1228 /*
1229 * FCS.
1230 */
1231 rec->rec_header.packet_header.pseudo_header.eth.fcs_len = 4;
1232 } else {
1233 /*
1234 * Junk.
1235 */
1236 padding = 4;
1237 }
1238 } else
1239 rec->rec_header.packet_header.pseudo_header.eth.fcs_len = 0;
1240 break;
1241
1242 case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
1243 /*
1244 * It appears, in one 802.11 capture, that
1245 * we have 4 bytes of junk at the ends of
1246 * frames in which hdr_2_x.xxx[2] and
1247 * hdr_2_x.xxx[3] are 0xff; I haven't
1248 * seen any frames where it's an FCS, but,
1249 * for now, we still check the fcs_valid
1250 * flag - I also haven't seen any capture
1251 * where we'd set it based on the realtick
1252 * value.
1253 *
1254 * It also appears that if the low-order bit of
1255 * hdr_2_x.xxx[8] is set, the packet has a
1256 * bad FCS. According to Ken Mann, the 0x4 bit
1257 * is sometimes also set for errors.
1258 *
1259 * Ken also says that xxx[11] is 0x5 when the
1260 * packet is WEP-encrypted.
1261 */
1262 memset(&rec->rec_header.packet_header.pseudo_header.ieee_802_11, 0, sizeof(rec->rec_header.packet_header.pseudo_header.ieee_802_11));
1263 if (hdr.hdr_2_x.xxx[2] == 0xff &&
1264 hdr.hdr_2_x.xxx[3] == 0xff) {
1265 /*
1266 * We have 4 bytes of stuff at the
1267 * end of the frame - FCS, or junk?
1268 */
1269 if (netxray->fcs_valid) {
1270 /*
1271 * FCS.
1272 */
1273 rec->rec_header.packet_header.pseudo_header.ieee_802_11.fcs_len = 4;
1274 } else {
1275 /*
1276 * Junk.
1277 */
1278 padding = 4;
1279 }
1280 } else
1281 rec->rec_header.packet_header.pseudo_header.ieee_802_11.fcs_len = 0;
1282
1283 rec->rec_header.packet_header.pseudo_header.ieee_802_11.decrypted = false;
1284 rec->rec_header.packet_header.pseudo_header.ieee_802_11.datapad = false;
1285 rec->rec_header.packet_header.pseudo_header.ieee_802_11.phy = PHDR_802_11_PHY_UNKNOWN;
1286
1287 /*
1288 * XXX - any other information, such as PHY
1289 * type, frequency, 11n/11ac information,
1290 * etc.?
1291 */
1292 rec->rec_header.packet_header.pseudo_header.ieee_802_11.has_channel = true;
1293 rec->rec_header.packet_header.pseudo_header.ieee_802_11.channel =
1294 hdr.hdr_2_x.xxx[12];
1295
1296 rec->rec_header.packet_header.pseudo_header.ieee_802_11.has_data_rate = true;
1297 rec->rec_header.packet_header.pseudo_header.ieee_802_11.data_rate =
1298 hdr.hdr_2_x.xxx[13];
1299
1300 rec->rec_header.packet_header.pseudo_header.ieee_802_11.has_signal_percent = true;
1301 rec->rec_header.packet_header.pseudo_header.ieee_802_11.signal_percent =
1302 hdr.hdr_2_x.xxx[14];
1303
1304 /*
1305 * According to Ken Mann, at least in the captures
1306 * he's seen, xxx[15] is the noise level, which
1307 * is either 0xFF meaning "none reported" or a value
1308 * from 0x00 to 0x7F for 0 to 100%.
1309 */
1310 if (hdr.hdr_2_x.xxx[15] != 0xFF) {
1311 rec->rec_header.packet_header.pseudo_header.ieee_802_11.has_noise_percent = true;
1312 rec->rec_header.packet_header.pseudo_header.ieee_802_11.noise_percent =
1313 hdr.hdr_2_x.xxx[15]*100/127;
1314 }
1315 break;
1316
1317 case WTAP_ENCAP_ISDN:
1318 /*
1319 * ISDN.
1320 *
1321 * The bottommost bit of byte 12 of hdr_2_x.xxx
1322 * is the direction flag.
1323 *
1324 * The bottom 5 bits of byte 13 of hdr_2_x.xxx
1325 * are the channel number, but some mapping is
1326 * required for PRI. (Is it really just the time
1327 * slot?)
1328 */
1329 rec->rec_header.packet_header.pseudo_header.isdn.uton =
1330 (hdr.hdr_2_x.xxx[12] & 0x01);
1331 rec->rec_header.packet_header.pseudo_header.isdn.channel =
1332 hdr.hdr_2_x.xxx[13] & 0x1F;
1333 switch (netxray->isdn_type) {
1334
1335 case 1:
1336 /*
1337 * E1 PRI. Channel numbers 0 and 16
1338 * are the D channel; channel numbers 1
1339 * through 15 are B1 through B15; channel
1340 * numbers 17 through 31 are B16 through
1341 * B31.
1342 */
1343 if (rec->rec_header.packet_header.pseudo_header.isdn.channel == 16)
1344 rec->rec_header.packet_header.pseudo_header.isdn.channel = 0;
1345 else if (rec->rec_header.packet_header.pseudo_header.isdn.channel > 16)
1346 rec->rec_header.packet_header.pseudo_header.isdn.channel -= 1;
1347 break;
1348
1349 case 2:
1350 /*
1351 * T1 PRI. Channel numbers 0 and 24
1352 * are the D channel; channel numbers 1
1353 * through 23 are B1 through B23.
1354 */
1355 if (rec->rec_header.packet_header.pseudo_header.isdn.channel == 24)
1356 rec->rec_header.packet_header.pseudo_header.isdn.channel = 0;
1357 else if (rec->rec_header.packet_header.pseudo_header.isdn.channel > 24)
1358 rec->rec_header.packet_header.pseudo_header.isdn.channel -= 1;
1359 break;
1360 }
1361
1362 /*
1363 * It appears, at least with version 2 captures,
1364 * that we have 4 bytes of stuff (which might be
1365 * a valid FCS or might be junk) at the end of
1366 * the packet if hdr_2_x.xxx[2] and
1367 * hdr_2_x.xxx[3] are 0xff, and we don't if
1368 * they don't.
1369 *
1370 * XXX - does the low-order bit of hdr_2_x.xxx[8]
1371 * indicate a bad FCS, as is the case with
1372 * Ethernet?
1373 */
1374 if (hdr.hdr_2_x.xxx[2] == 0xff &&
1375 hdr.hdr_2_x.xxx[3] == 0xff) {
1376 /*
1377 * FCS, or junk, at the end.
1378 * XXX - is it an FCS if "fcs_valid" is
1379 * true?
1380 */
1381 padding = 4;
1382 }
1383 break;
1384
1385 case WTAP_ENCAP_LAPB:
1386 case WTAP_ENCAP_FRELAY_WITH_PHDR:
1387 /*
1388 * LAPB/X.25 and Frame Relay.
1389 *
1390 * The bottommost bit of byte 12 of hdr_2_x.xxx
1391 * is the direction flag. (Probably true for other
1392 * HDLC encapsulations as well.)
1393 */
1394 rec->rec_header.packet_header.pseudo_header.dte_dce.flags =
1395 (hdr.hdr_2_x.xxx[12] & 0x01) ? 0x00 : FROM_DCE;
1396
1397 /*
1398 * It appears, at least with version 2 captures,
1399 * that we have 4 bytes of stuff (which might be
1400 * a valid FCS or might be junk) at the end of
1401 * the packet if hdr_2_x.xxx[2] and
1402 * hdr_2_x.xxx[3] are 0xff, and we don't if
1403 * they don't.
1404 *
1405 * XXX - does the low-order bit of hdr_2_x.xxx[8]
1406 * indicate a bad FCS, as is the case with
1407 * Ethernet?
1408 */
1409 if (hdr.hdr_2_x.xxx[2] == 0xff &&
1410 hdr.hdr_2_x.xxx[3] == 0xff) {
1411 /*
1412 * FCS, or junk, at the end.
1413 * XXX - is it an FCS if "fcs_valid" is
1414 * true?
1415 */
1416 padding = 4;
1417 }
1418 break;
1419
1420 case WTAP_ENCAP_PPP_WITH_PHDR:
1421 case WTAP_ENCAP_SDLC:
1422 case WTAP_ENCAP_CHDLC_WITH_PHDR:
1423 rec->rec_header.packet_header.pseudo_header.p2p.sent =
1424 (hdr.hdr_2_x.xxx[12] & 0x01) ? true : false;
1425 break;
1426
1427 case WTAP_ENCAP_ATM_PDUS_UNTRUNCATED:
1428 /*
1429 * XXX - the low-order bit of hdr_2_x.xxx[8]
1430 * seems to indicate some sort of error. In
1431 * at least one capture, a number of packets
1432 * have that flag set, and they appear either
1433 * to be the beginning part of an incompletely
1434 * reassembled AAL5 PDU, with either checksum
1435 * errors at higher levels (possibly due to
1436 * the packet being reported as shorter than
1437 * it actually is, and checksumming failing
1438 * because it doesn't include all the data)
1439 * or "Malformed frame" errors from being
1440 * too short, or appear to be later parts
1441 * of an incompletely reassembled AAL5 PDU
1442 * with the last one in a sequence of errors
1443 * having what looks like an AAL5 trailer,
1444 * with a length and checksum.
1445 *
1446 * Does it just mean "reassembly failed",
1447 * as appears to be the case in those
1448 * packets, or does it mean "CRC error"
1449 * at the AAL5 layer (which would be the
1450 * case if you were treating an incompletely
1451 * reassembled PDU as a completely reassembled
1452 * PDU, although you'd also expect a length
1453 * error in that case), or does it mean
1454 * "generic error", with some other flag
1455 * or flags indicating what particular
1456 * error occurred? The documentation
1457 * for Sniffer Pro 4.7 indicates a bunch
1458 * of different error types, both in general
1459 * and for ATM in particular.
1460 *
1461 * No obvious bits in hdr_2_x.xxx appear
1462 * to be additional flags of that sort.
1463 *
1464 * XXX - in that capture, I see several
1465 * reassembly errors in a row; should those
1466 * packets be reassembled in the ATM dissector?
1467 * What happens if a reassembly fails because
1468 * a cell is bad?
1469 */
1470 rec->rec_header.packet_header.pseudo_header.atm.flags = 0;
1471 if (hdr.hdr_2_x.xxx[8] & 0x01)
1472 rec->rec_header.packet_header.pseudo_header.atm.flags |= ATM_REASSEMBLY_ERROR;
1473 /*
1474 * XXX - is 0x08 an "OAM cell" flag?
1475 * Are the 0x01 and 0x02 bits error indications?
1476 * Some packets in one capture that have the
1477 * 0x01 bit set in hdr_2_x.xxx[8] and that
1478 * appear to have been reassembled completely
1479 * but have a bad CRC have 0x03 in hdr_2_x.xxx[9]
1480 * (and don't have the 0x20 bit set).
1481 *
1482 * In the capture with incomplete reassemblies,
1483 * all packets have the 0x20 bit set. In at
1484 * least some of the captures with complete
1485 * reassemblies with CRC errors, no packets
1486 * have the 0x20 bit set.
1487 *
1488 * Are hdr_2_x.xxx[8] and hdr_2_x.xxx[9] a 16-bit
1489 * flag field?
1490 */
1491 if (hdr.hdr_2_x.xxx[9] & 0x04)
1492 rec->rec_header.packet_header.pseudo_header.atm.flags |= ATM_RAW_CELL;
1493 rec->rec_header.packet_header.pseudo_header.atm.vpi = hdr.hdr_2_x.xxx[11];
1494 rec->rec_header.packet_header.pseudo_header.atm.vci = pletoh16(&hdr.hdr_2_x.xxx[12]);
1495 rec->rec_header.packet_header.pseudo_header.atm.channel =
1496 (hdr.hdr_2_x.xxx[15] & 0x10)? 1 : 0;
1497 rec->rec_header.packet_header.pseudo_header.atm.cells = 0;
1498
1499 /*
1500 * XXX - the uppermost bit of hdr_2_xxx[0]
1501 * looks as if it might be a flag of some sort.
1502 * The remaining 3 bits appear to be an AAL
1503 * type - 5 is, surprise surprise, AAL5.
1504 */
1505 switch (hdr.hdr_2_x.xxx[0] & 0x70) {
1506
1507 case 0x00: /* Unknown */
1508 rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_UNKNOWN;
1509 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_UNKNOWN;
1510 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1511 break;
1512
1513 case 0x10: /* XXX - AAL1? */
1514 rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_UNKNOWN;
1515 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_UNKNOWN;
1516 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1517 break;
1518
1519 case 0x20: /* XXX - AAL2? */
1520 rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_UNKNOWN;
1521 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_UNKNOWN;
1522 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1523 break;
1524
1525 case 0x40: /* XXX - AAL3/4? */
1526 rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_UNKNOWN;
1527 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_UNKNOWN;
1528 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1529 break;
1530
1531 case 0x30: /* XXX - AAL5 cells seen with this */
1532 case 0x50: /* AAL5 (including signalling) */
1533 case 0x60: /* XXX - AAL5 cells seen with this */
1534 case 0x70: /* XXX - AAL5 cells seen with this */
1535 rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_5;
1536 /*
1537 * XXX - is the 0x08 bit of hdr_2_x.xxx[0]
1538 * a flag? I've not yet seen a case where
1539 * it matters.
1540 */
1541 switch (hdr.hdr_2_x.xxx[0] & 0x07) {
1542
1543 case 0x01:
1544 case 0x02: /* Signalling traffic */
1545 rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_SIGNALLING;
1546 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_UNKNOWN;
1547 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1548 break;
1549
1550 case 0x03: /* ILMI */
1551 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_ILMI;
1552 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1553 break;
1554
1555 case 0x00:
1556 case 0x04:
1557 case 0x05:
1558 /*
1559 * I've seen a frame with type
1560 * 0x30 and subtype 0x08 that
1561 * was LANE 802.3, a frame
1562 * with type 0x30 and subtype
1563 * 0x04 that was LANE 802.3,
1564 * and another frame with type
1565 * 0x30 and subtype 0x08 that
1566 * was junk with a string in
1567 * it that had also appeared
1568 * in some CDP and LE Control
1569 * frames, and that was preceded
1570 * by a malformed LE Control
1571 * frame - was that a reassembly
1572 * failure?
1573 *
1574 * I've seen frames with type
1575 * 0x50 and subtype 0x0c, some
1576 * of which were LE Control
1577 * frames, and at least one
1578 * of which was neither an LE
1579 * Control frame nor a LANE
1580 * 802.3 frame, and contained
1581 * the string "ForeThought_6.2.1
1582 * Alpha" - does that imply
1583 * FORE's own encapsulation,
1584 * or was this a reassembly failure?
1585 * The latter frame was preceded
1586 * by a malformed LE Control
1587 * frame.
1588 *
1589 * I've seen a couple of frames
1590 * with type 0x60 and subtype 0x00,
1591 * one of which was LANE 802.3 and
1592 * one of which was LE Control.
1593 * I've seen one frame with type
1594 * 0x60 and subtype 0x0c, which
1595 * was LANE 802.3.
1596 *
1597 * I've seen a couple of frames
1598 * with type 0x70 and subtype 0x00,
1599 * both of which were LANE 802.3.
1600 */
1601 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_LANE;
1602 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1603 break;
1604
1605 case 0x06: /* XXX - not seen yet */
1606 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_UNKNOWN;
1607 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1608 break;
1609
1610 case 0x07: /* LLC multiplexed */
1611 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_LLCMX; /* XXX */
1612 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN; /* XXX */
1613 break;
1614 }
1615 break;
1616 }
1617 break;
1618 }
1619 break;
1620 }
1621
1622 rec->rec_type = REC_TYPE_PACKET;
1623 rec->block = wtap_block_create(WTAP_BLOCK_PACKET);
1624 if (netxray->version_major == 0) {
1625 rec->presence_flags = WTAP_HAS_TS;
1626 t = (double)pletoh32(&hdr.old_hdr.timelo)
1627 + (double)pletoh32(&hdr.old_hdr.timehi)*4294967296.0;
1628 t /= netxray->ticks_per_sec;
1629 t -= netxray->start_timestamp;
1630 rec->ts.secs = netxray->start_time + (long)t;
1631 rec->ts.nsecs = (int)((t-(double)(unsigned long)(t))
1632 *1.0e9);
1633 /*
1634 * We subtract the padding from the packet size, so our caller
1635 * doesn't see it.
1636 */
1637 packet_size = pletoh16(&hdr.old_hdr.len);
1638 rec->rec_header.packet_header.caplen = packet_size - padding;
1639 rec->rec_header.packet_header.len = rec->rec_header.packet_header.caplen;
1640 } else {
1641 rec->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
1642 t = (double)pletoh32(&hdr.hdr_1_x.timelo)
1643 + (double)pletoh32(&hdr.hdr_1_x.timehi)*4294967296.0;
1644 t /= netxray->ticks_per_sec;
1645 t -= netxray->start_timestamp;
1646 rec->ts.secs = netxray->start_time + (time_t)t;
1647 rec->ts.nsecs = (int)((t-(double)(unsigned long)(t))
1648 *1.0e9);
1649 /*
1650 * We subtract the padding from the packet size, so our caller
1651 * doesn't see it.
1652 */
1653 packet_size = pletoh16(&hdr.hdr_1_x.incl_len);
1654 rec->rec_header.packet_header.caplen = packet_size - padding;
1655 rec->rec_header.packet_header.len = pletoh16(&hdr.hdr_1_x.orig_len) - padding;
1656 }
1657
1658 return padding;
1659 }
1660
1661 static void
1662 netxray_guess_atm_type(wtap *wth, wtap_rec *rec, Buffer *buf)
1663 {
1664 const uint8_t *pd;
1665
1666 if (wth->file_encap == WTAP_ENCAP_ATM_PDUS_UNTRUNCATED &&
1667 !(rec->rec_header.packet_header.pseudo_header.atm.flags & ATM_REASSEMBLY_ERROR)) {
1668 if (rec->rec_header.packet_header.pseudo_header.atm.aal == AAL_UNKNOWN) {
1669 /*
1670 * Try to guess the type and subtype based
1671 * on the VPI/VCI and packet contents.
1672 */
1673 pd = ws_buffer_start_ptr(buf);
1674 atm_guess_traffic_type(rec, pd);
1675 } else if (rec->rec_header.packet_header.pseudo_header.atm.aal == AAL_5 &&
1676 rec->rec_header.packet_header.pseudo_header.atm.type == TRAF_LANE) {
1677 /*
1678 * Try to guess the subtype based on the
1679 * packet contents.
1680 */
1681 pd = ws_buffer_start_ptr(buf);
1682 atm_guess_lane_type(rec, pd);
1683 }
1684 }
1685 }
1686
1687 typedef struct {
1688 bool first_frame;
1689 uint32_t start_secs;
1690 uint32_t nframes;
1691 } netxray_dump_t;
1692
1693 static const struct {
1694 int wtap_encap_value;
1695 int ndis_value;
1696 } wtap_encap_1_1[] = {
1697 { WTAP_ENCAP_ETHERNET, 0 }, /* -> NDIS Ethernet */
1698 { WTAP_ENCAP_TOKEN_RING, 1 }, /* -> NDIS Token Ring */
1699 { WTAP_ENCAP_FDDI, 2 }, /* -> NDIS FDDI */
1700 { WTAP_ENCAP_FDDI_BITSWAPPED, 2 }, /* -> NDIS FDDI */
1701 };
1702 #define NUM_WTAP_ENCAPS_1_1 array_length(wtap_encap_1_1)
1703
1704 static int
1705 wtap_encap_to_netxray_1_1_encap(int encap)
1706 {
1707 unsigned int i;
1708
1709 for (i = 0; i < NUM_WTAP_ENCAPS_1_1; i++) {
1710 if (encap == wtap_encap_1_1[i].wtap_encap_value)
1711 return wtap_encap_1_1[i].ndis_value;
1712 }
1713
1714 return -1;
1715 }
1716
1717 /* Returns 0 if we could write the specified encapsulation type,
1718 an error indication otherwise. */
1719 static int
1720 netxray_dump_can_write_encap_1_1(int encap)
1721 {
1722 /* Per-packet encapsulations aren't supported. */
1723 if (encap == WTAP_ENCAP_PER_PACKET)
1724 return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
1725
1726 if (wtap_encap_to_netxray_1_1_encap(encap) == -1)
1727 return WTAP_ERR_UNWRITABLE_ENCAP;
1728
1729 return 0;
1730 }
1731
1732 /* Returns true on success, false on failure; sets "*err" to an error code on
1733 failure */
1734 static bool
1735 netxray_dump_open_1_1(wtap_dumper *wdh, int *err, char **err_info _U_)
1736 {
1737 netxray_dump_t *netxray;
1738
1739 wdh->subtype_write = netxray_dump_1_1;
1740 wdh->subtype_finish = netxray_dump_finish_1_1;
1741
1742 /* We can't fill in all the fields in the file header, as we
1743 haven't yet written any packets. As we'll have to rewrite
1744 the header when we've written out all the packets, we just
1745 skip over the header for now. */
1746 if (wtap_dump_file_seek(wdh, CAPTUREFILE_HEADER_SIZE, SEEK_SET, err) == -1)
1747 return false;
1748 wdh->bytes_dumped += CAPTUREFILE_HEADER_SIZE;
1749
1750 netxray = g_new(netxray_dump_t, 1);
1751 wdh->priv = (void *)netxray;
1752 netxray->first_frame = true;
1753 netxray->start_secs = 0;
1754 netxray->nframes = 0;
1755
1756 return true;
1757 }
1758
1759 /* Write a record for a packet to a dump file.
1760 Returns true on success, false on failure. */
1761 static bool
1762 netxray_dump_1_1(wtap_dumper *wdh,
1763 const wtap_rec *rec,
1764 const uint8_t *pd, int *err, char **err_info _U_)
1765 {
1766 netxray_dump_t *netxray = (netxray_dump_t *)wdh->priv;
1767 uint64_t timestamp;
1768 uint32_t t32;
1769 struct netxrayrec_1_x_hdr rec_hdr;
1770
1771 /* We can only write packet records. */
1772 if (rec->rec_type != REC_TYPE_PACKET) {
1773 *err = WTAP_ERR_UNWRITABLE_REC_TYPE;
1774 return false;
1775 }
1776
1777 /*
1778 * Make sure this packet doesn't have a link-layer type that
1779 * differs from the one for the file.
1780 */
1781 if (wdh->file_encap != rec->rec_header.packet_header.pkt_encap) {
1782 *err = WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
1783 return false;
1784 }
1785
1786 /* The captured length field is 16 bits, so there's a hard
1787 limit of 65535. */
1788 if (rec->rec_header.packet_header.caplen > 65535) {
1789 *err = WTAP_ERR_PACKET_TOO_LARGE;
1790 return false;
1791 }
1792
1793 /* NetXRay/Windows Sniffer files have a capture start date/time
1794 in the header, in a UNIX-style format, with one-second resolution,
1795 and a start time stamp with microsecond resolution that's just
1796 an arbitrary time stamp relative to some unknown time (boot
1797 time?), and have times relative to the start time stamp in
1798 the packet headers; pick the seconds value of the time stamp
1799 of the first packet as the UNIX-style start date/time, and make
1800 the high-resolution start time stamp 0, with the time stamp of
1801 packets being the delta between the stamp of the packet and
1802 the stamp of the first packet with the microseconds part 0. */
1803 if (netxray->first_frame) {
1804 netxray->first_frame = false;
1805 /*
1806 * XXX - NetXRay ran on Windows, where MSVC's localtime()
1807 * can't handle time_t < 0, so *maybe* it makes sense
1808 * to allow time stamps up to 2^32-1 "seconds since the
1809 * Epoch", but maybe the start time in those files is
1810 * signed, in which case we should check against
1811 * INT32_MIN and INT32_MAX and make start_secs a
1812 * int32_t.
1813 */
1814 if (rec->ts.secs < 0 || rec->ts.secs > WTAP_NSTIME_32BIT_SECS_MAX) {
1815 *err = WTAP_ERR_TIME_STAMP_NOT_SUPPORTED;
1816 return false;
1817 }
1818 netxray->start_secs = (uint32_t)rec->ts.secs;
1819 }
1820
1821 /* build the header for each packet */
1822 memset(&rec_hdr, '\0', sizeof(rec_hdr));
1823 timestamp = ((uint64_t)rec->ts.secs - (uint64_t)netxray->start_secs)*1000000
1824 + ((uint64_t)rec->ts.nsecs)/1000;
1825 t32 = (uint32_t)(timestamp%INT64_C(4294967296));
1826 rec_hdr.timelo = GUINT32_TO_LE(t32);
1827 t32 = (uint32_t)(timestamp/INT64_C(4294967296));
1828 rec_hdr.timehi = GUINT32_TO_LE(t32);
1829 rec_hdr.orig_len = GUINT16_TO_LE(rec->rec_header.packet_header.len);
1830 rec_hdr.incl_len = GUINT16_TO_LE(rec->rec_header.packet_header.caplen);
1831
1832 if (!wtap_dump_file_write(wdh, &rec_hdr, sizeof(rec_hdr), err))
1833 return false;
1834
1835 /* write the packet data */
1836 if (!wtap_dump_file_write(wdh, pd, rec->rec_header.packet_header.caplen, err))
1837 return false;
1838
1839 netxray->nframes++;
1840
1841 return true;
1842 }
1843
1844 /* Finish writing to a dump file.
1845 Returns true on success, false on failure. */
1846 static bool
1847 netxray_dump_finish_1_1(wtap_dumper *wdh, int *err, char **err_info _U_)
1848 {
1849 char hdr_buf[CAPTUREFILE_HEADER_SIZE - sizeof(netxray_magic)];
1850 netxray_dump_t *netxray = (netxray_dump_t *)wdh->priv;
1851 int64_t filelen;
1852 struct netxray_hdr file_hdr;
1853
1854 if (-1 == (filelen = wtap_dump_file_tell(wdh, err)))
1855 return false;
1856
1857 /* Go back to beginning */
1858 if (wtap_dump_file_seek(wdh, 0, SEEK_SET, err) == -1)
1859 return false;
1860
1861 /* Rewrite the file header. */
1862 if (!wtap_dump_file_write(wdh, netxray_magic, sizeof netxray_magic, err))
1863 return false;
1864
1865 /* "sniffer" version ? */
1866 memset(&file_hdr, '\0', sizeof file_hdr);
1867 memcpy(file_hdr.version, vers_1_1, sizeof vers_1_1);
1868 file_hdr.start_time = GUINT32_TO_LE(netxray->start_secs);
1869 file_hdr.nframes = GUINT32_TO_LE(netxray->nframes);
1870 file_hdr.start_offset = GUINT32_TO_LE(CAPTUREFILE_HEADER_SIZE);
1871 /* XXX - large files? */
1872 file_hdr.end_offset = GUINT32_TO_LE((uint32_t)filelen);
1873 file_hdr.network = wtap_encap_to_netxray_1_1_encap(wdh->file_encap);
1874 file_hdr.timelo = GUINT32_TO_LE(0);
1875 file_hdr.timehi = GUINT32_TO_LE(0);
1876
1877 memset(hdr_buf, '\0', sizeof hdr_buf);
1878 memcpy(hdr_buf, &file_hdr, sizeof(file_hdr));
1879 if (!wtap_dump_file_write(wdh, hdr_buf, sizeof hdr_buf, err))
1880 return false;
1881
1882 /* Don't double-count the size of the file header */
1883 wdh->bytes_dumped = filelen;
1884 return true;
1885 }
1886
1887 static const struct {
1888 int wtap_encap_value;
1889 int ndis_value;
1890 } wtap_encap_2_0[] = {
1891 { WTAP_ENCAP_ETHERNET, 0 }, /* -> NDIS Ethernet */
1892 { WTAP_ENCAP_TOKEN_RING, 1 }, /* -> NDIS Token Ring */
1893 { WTAP_ENCAP_FDDI, 2 }, /* -> NDIS FDDI */
1894 { WTAP_ENCAP_FDDI_BITSWAPPED, 2 }, /* -> NDIS FDDI */
1895 { WTAP_ENCAP_PPP_WITH_PHDR, 3 }, /* -> NDIS WAN */
1896 { WTAP_ENCAP_FRELAY_WITH_PHDR, 3 }, /* -> NDIS WAN */
1897 { WTAP_ENCAP_LAPB, 3 }, /* -> NDIS WAN */
1898 { WTAP_ENCAP_SDLC, 3 }, /* -> NDIS WAN */
1899 };
1900 #define NUM_WTAP_ENCAPS_2_0 array_length(wtap_encap_2_0)
1901
1902 static int
1903 wtap_encap_to_netxray_2_0_encap(int encap)
1904 {
1905 unsigned int i;
1906
1907 for (i = 0; i < NUM_WTAP_ENCAPS_2_0; i++) {
1908 if (encap == wtap_encap_2_0[i].wtap_encap_value)
1909 return wtap_encap_2_0[i].ndis_value;
1910 }
1911
1912 return -1;
1913 }
1914
1915 /* Returns 0 if we could write the specified encapsulation type,
1916 an error indication otherwise. */
1917 static int
1918 netxray_dump_can_write_encap_2_0(int encap)
1919 {
1920 /* Per-packet encapsulations aren't supported. */
1921 if (encap == WTAP_ENCAP_PER_PACKET)
1922 return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
1923
1924 if (wtap_encap_to_netxray_2_0_encap(encap) == -1)
1925 return WTAP_ERR_UNWRITABLE_ENCAP;
1926
1927 return 0;
1928 }
1929
1930 /* Returns true on success, false on failure; sets "*err" to an error code on
1931 failure */
1932 static bool
1933 netxray_dump_open_2_0(wtap_dumper *wdh, int *err, char **err_info _U_)
1934 {
1935 netxray_dump_t *netxray;
1936
1937 wdh->subtype_write = netxray_dump_2_0;
1938 wdh->subtype_finish = netxray_dump_finish_2_0;
1939
1940 /* We can't fill in all the fields in the file header, as we
1941 haven't yet written any packets. As we'll have to rewrite
1942 the header when we've written out all the packets, we just
1943 skip over the header for now. */
1944 if (wtap_dump_file_seek(wdh, CAPTUREFILE_HEADER_SIZE, SEEK_SET, err) == -1)
1945 return false;
1946 wdh->bytes_dumped += CAPTUREFILE_HEADER_SIZE;
1947
1948 netxray = g_new(netxray_dump_t, 1);
1949 wdh->priv = (void *)netxray;
1950 netxray->first_frame = true;
1951 netxray->start_secs = 0;
1952 netxray->nframes = 0;
1953
1954 return true;
1955 }
1956
1957 /* Write a record for a packet to a dump file.
1958 Returns true on success, false on failure. */
1959 static bool
1960 netxray_dump_2_0(wtap_dumper *wdh,
1961 const wtap_rec *rec,
1962 const uint8_t *pd, int *err, char **err_info _U_)
1963 {
1964 const union wtap_pseudo_header *pseudo_header = &rec->rec_header.packet_header.pseudo_header;
1965 netxray_dump_t *netxray = (netxray_dump_t *)wdh->priv;
1966 uint64_t timestamp;
1967 uint32_t t32;
1968 struct netxrayrec_2_x_hdr rec_hdr;
1969
1970 /* We can only write packet records. */
1971 if (rec->rec_type != REC_TYPE_PACKET) {
1972 *err = WTAP_ERR_UNWRITABLE_REC_TYPE;
1973 return false;
1974 }
1975
1976 /*
1977 * Make sure this packet doesn't have a link-layer type that
1978 * differs from the one for the file.
1979 */
1980 if (wdh->file_encap != rec->rec_header.packet_header.pkt_encap) {
1981 *err = WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
1982 return false;
1983 }
1984
1985 /* Don't write anything we're not willing to read. */
1986 if (rec->rec_header.packet_header.caplen > WTAP_MAX_PACKET_SIZE_STANDARD) {
1987 *err = WTAP_ERR_PACKET_TOO_LARGE;
1988 return false;
1989 }
1990
1991 /* NetXRay/Windows Sniffer files have a capture start date/time
1992 in the header, in a UNIX-style format, with one-second resolution,
1993 and a start time stamp with microsecond resolution that's just
1994 an arbitrary time stamp relative to some unknown time (boot
1995 time?), and have times relative to the start time stamp in
1996 the packet headers; pick the seconds value of the time stamp
1997 of the first packet as the UNIX-style start date/time, and make
1998 the high-resolution start time stamp 0, with the time stamp of
1999 packets being the delta between the stamp of the packet and
2000 the stamp of the first packet with the microseconds part 0. */
2001 if (netxray->first_frame) {
2002 netxray->first_frame = false;
2003 /*
2004 * XXX - NetXRay ran on Windows, where MSVC's localtime()
2005 * can't handle time_t < 0, so *maybe* it makes sense
2006 * to allow time stamps up to 2^32-1 "seconds since the
2007 * Epoch", but maybe the start time in those files is
2008 * signed, in which case we should check against
2009 * INT32_MIN and INT32_MAX and make start_secs a
2010 * int32_t.
2011 */
2012 if (rec->ts.secs < 0 || rec->ts.secs > WTAP_NSTIME_32BIT_SECS_MAX) {
2013 *err = WTAP_ERR_TIME_STAMP_NOT_SUPPORTED;
2014 return false;
2015 }
2016 netxray->start_secs = (uint32_t)rec->ts.secs;
2017 }
2018
2019 /* build the header for each packet */
2020 memset(&rec_hdr, '\0', sizeof(rec_hdr));
2021 timestamp = ((uint64_t)rec->ts.secs - (uint64_t)netxray->start_secs)*1000000
2022 + ((uint64_t)rec->ts.nsecs)/1000;
2023 t32 = (uint32_t)(timestamp%INT64_C(4294967296));
2024 rec_hdr.timelo = GUINT32_TO_LE(t32);
2025 t32 = (uint32_t)(timestamp/INT64_C(4294967296));
2026 rec_hdr.timehi = GUINT32_TO_LE(t32);
2027 rec_hdr.orig_len = GUINT16_TO_LE(rec->rec_header.packet_header.len);
2028 rec_hdr.incl_len = GUINT16_TO_LE(rec->rec_header.packet_header.caplen);
2029
2030 switch (rec->rec_header.packet_header.pkt_encap) {
2031
2032 case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
2033 rec_hdr.xxx[12] =
2034 pseudo_header->ieee_802_11.has_channel ?
2035 pseudo_header->ieee_802_11.channel :
2036 0;
2037 rec_hdr.xxx[13] =
2038 pseudo_header->ieee_802_11.has_data_rate ?
2039 (uint8_t)pseudo_header->ieee_802_11.data_rate :
2040 0;
2041 rec_hdr.xxx[14] =
2042 pseudo_header->ieee_802_11.has_signal_percent ?
2043 pseudo_header->ieee_802_11.signal_percent :
2044 0;
2045 rec_hdr.xxx[15] =
2046 pseudo_header->ieee_802_11.has_noise_percent ?
2047 pseudo_header->ieee_802_11.noise_percent*127/100 :
2048 0xFF;
2049 break;
2050
2051 case WTAP_ENCAP_PPP_WITH_PHDR:
2052 case WTAP_ENCAP_SDLC:
2053 rec_hdr.xxx[12] |= pseudo_header->p2p.sent ? 0x01 : 0x00;
2054 break;
2055
2056 case WTAP_ENCAP_FRELAY_WITH_PHDR:
2057 rec_hdr.xxx[12] |= (pseudo_header->dte_dce.flags & FROM_DCE) ? 0x00 : 0x01;
2058 break;
2059 }
2060
2061 if (!wtap_dump_file_write(wdh, &rec_hdr, sizeof(rec_hdr), err))
2062 return false;
2063
2064 /* write the packet data */
2065 if (!wtap_dump_file_write(wdh, pd, rec->rec_header.packet_header.caplen, err))
2066 return false;
2067
2068 netxray->nframes++;
2069
2070 return true;
2071 }
2072
2073 /* Finish writing to a dump file.
2074 Returns true on success, false on failure. */
2075 static bool
2076 netxray_dump_finish_2_0(wtap_dumper *wdh, int *err, char **err_info _U_)
2077 {
2078 char hdr_buf[CAPTUREFILE_HEADER_SIZE - sizeof(netxray_magic)];
2079 netxray_dump_t *netxray = (netxray_dump_t *)wdh->priv;
2080 int64_t filelen;
2081 struct netxray_hdr file_hdr;
2082
2083 if (-1 == (filelen = wtap_dump_file_tell(wdh, err)))
2084 return false;
2085
2086 /* Go back to beginning */
2087 if (wtap_dump_file_seek(wdh, 0, SEEK_SET, err) == -1)
2088 return false;
2089
2090 /* Rewrite the file header. */
2091 if (!wtap_dump_file_write(wdh, netxray_magic, sizeof netxray_magic, err))
2092 return false;
2093
2094 /* "sniffer" version ? */
2095 memset(&file_hdr, '\0', sizeof file_hdr);
2096 memcpy(file_hdr.version, vers_2_001, sizeof vers_2_001);
2097 file_hdr.start_time = GUINT32_TO_LE(netxray->start_secs);
2098 file_hdr.nframes = GUINT32_TO_LE(netxray->nframes);
2099 file_hdr.start_offset = GUINT32_TO_LE(CAPTUREFILE_HEADER_SIZE);
2100 /* XXX - large files? */
2101 file_hdr.end_offset = GUINT32_TO_LE((uint32_t)filelen);
2102 file_hdr.network = wtap_encap_to_netxray_2_0_encap(wdh->file_encap);
2103 file_hdr.timelo = GUINT32_TO_LE(0);
2104 file_hdr.timehi = GUINT32_TO_LE(0);
2105 switch (wdh->file_encap) {
2106
2107 case WTAP_ENCAP_PPP_WITH_PHDR:
2108 file_hdr.captype = WAN_CAPTYPE_PPP;
2109 break;
2110
2111 case WTAP_ENCAP_FRELAY_WITH_PHDR:
2112 file_hdr.captype = WAN_CAPTYPE_FRELAY;
2113 break;
2114
2115 case WTAP_ENCAP_LAPB:
2116 file_hdr.captype = WAN_CAPTYPE_HDLC;
2117 file_hdr.wan_hdlc_subsub_captype = 0;
2118 break;
2119
2120 case WTAP_ENCAP_SDLC:
2121 file_hdr.captype = WAN_CAPTYPE_SDLC;
2122 break;
2123
2124 default:
2125 file_hdr.captype = CAPTYPE_NDIS;
2126 break;
2127 }
2128
2129 memset(hdr_buf, '\0', sizeof hdr_buf);
2130 memcpy(hdr_buf, &file_hdr, sizeof(file_hdr));
2131 if (!wtap_dump_file_write(wdh, hdr_buf, sizeof hdr_buf, err))
2132 return false;
2133
2134 /* Don't double-count the size of the file header */
2135 wdh->bytes_dumped = filelen;
2136 return true;
2137 }
2138
2139 static const struct supported_block_type netxray_old_blocks_supported[] = {
2140 /*
2141 * We support packet blocks, with no comments or other options.
2142 */
2143 { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
2144 };
2145
2146 static const struct file_type_subtype_info netxray_old_info = {
2147 "Cinco Networks NetXRay 1.x", "netxray1", "cap", NULL,
2148 true, BLOCKS_SUPPORTED(netxray_old_blocks_supported),
2149 NULL, NULL, NULL
2150 };
2151
2152 static const struct supported_block_type netxray_1_0_blocks_supported[] = {
2153 /*
2154 * We support packet blocks, with no comments or other options.
2155 */
2156 { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
2157 };
2158
2159 static const struct file_type_subtype_info netxray_1_0_info = {
2160 "Cinco Networks NetXRay 2.0 or later", "netxray2", "cap", NULL,
2161 true, BLOCKS_SUPPORTED(netxray_1_0_blocks_supported),
2162 NULL, NULL, NULL
2163 };
2164
2165 static const struct supported_block_type netxray_1_1_blocks_supported[] = {
2166 /*
2167 * We support packet blocks, with no comments or other options.
2168 */
2169 { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
2170 };
2171
2172 static const struct file_type_subtype_info netxray_1_1_info = {
2173 "NetXray, Sniffer (Windows) 1.1", "ngwsniffer_1_1", "cap", NULL,
2174 true, BLOCKS_SUPPORTED(netxray_1_1_blocks_supported),
2175 netxray_dump_can_write_encap_1_1, netxray_dump_open_1_1, NULL
2176 };
2177
2178 static const struct supported_block_type netxray_2_00x_blocks_supported[] = {
2179 /*
2180 * We support packet blocks, with no comments or other options.
2181 */
2182 { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
2183 };
2184
2185 static const struct file_type_subtype_info netxray_2_00x_info = {
2186 "Sniffer (Windows) 2.00x", "ngwsniffer_2_0", "cap", "caz",
2187 true, BLOCKS_SUPPORTED(netxray_2_00x_blocks_supported),
2188 netxray_dump_can_write_encap_2_0, netxray_dump_open_2_0, NULL
2189 };
2190
2191 void register_netxray(void)
2192 {
2193 netxray_old_file_type_subtype = wtap_register_file_type_subtype(&netxray_old_info);
2194 netxray_1_0_file_type_subtype = wtap_register_file_type_subtype(&netxray_1_0_info);
2195 netxray_1_1_file_type_subtype = wtap_register_file_type_subtype(&netxray_1_1_info);
2196 netxray_2_00x_file_type_subtype = wtap_register_file_type_subtype(&netxray_2_00x_info);
2197
2198 /*
2199 * Register names for backwards compatibility with the
2200 * wtap_filetypes table in Lua.
2201 */
2202 wtap_register_backwards_compatibility_lua_name("NETXRAY_OLD",
2203 netxray_old_file_type_subtype);
2204 wtap_register_backwards_compatibility_lua_name("NETXRAY_1_0",
2205 netxray_1_0_file_type_subtype);
2206 wtap_register_backwards_compatibility_lua_name("NETXRAY_1_1",
2207 netxray_1_1_file_type_subtype);
2208 wtap_register_backwards_compatibility_lua_name("NETXRAY_2_00x",
2209 netxray_2_00x_file_type_subtype);
2210 }
2211
2212 /*
2213 * Editor modelines - https://www.wireshark.org/tools/modelines.html
2214 *
2215 * Local variables:
2216 * c-basic-offset: 8
2217 * tab-width: 8
2218 * indent-tabs-mode: t
2219 * End:
2220 *
2221 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
2222 * :indentSize=8:tabSize=8:noTabs=false:
2223 */
Metzes wireshark repo