]> The Tcpdump Group git mirrors - libpcap/blob - savefile.c
projects / libpcap / blob
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
When using pcap_create_common() in pcap_fopen_offline(), leave
[libpcap] / savefile.c
1 /*
2 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * savefile.c - supports offline use of tcpdump
22 * Extraction/creation by Jeffrey Mogul, DECWRL
23 * Modified by Steve McCanne, LBL.
24 *
25 * Used to save the received packet headers, after filtering, to
26 * a file, and then read them later.
27 * The first record in the file contains saved values for the machine
28 * dependent values so we can print the dump file on any architecture.
29 */
30
31 #ifndef lint
32 static const char rcsid[] _U_ =
33 "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.183 2008-12-23 20:13:29 guy Exp $ (LBL)";
34 #endif
35
36 #ifdef HAVE_CONFIG_H
37 #include "config.h"
38 #endif
39
40 #ifdef WIN32
41 #include <pcap-stdinc.h>
42 #else /* WIN32 */
43 #if HAVE_INTTYPES_H
44 #include <inttypes.h>
45 #elif HAVE_STDINT_H
46 #include <stdint.h>
47 #endif
48 #ifdef HAVE_SYS_BITYPES_H
49 #include <sys/bitypes.h>
50 #endif
51 #include <sys/types.h>
52 #endif /* WIN32 */
53
54 #include <errno.h>
55 #include <memory.h>
56 #include <stdio.h>
57 #include <stdlib.h>
58 #include <string.h>
59
60 #include "pcap-int.h"
61 #include "pcap/usb.h"
62
63 #ifdef HAVE_OS_PROTO_H
64 #include "os-proto.h"
65 #endif
66
67 /*
68 * Standard libpcap format.
69 */
70 #define TCPDUMP_MAGIC 0xa1b2c3d4
71
72 /*
73 * Alexey Kuznetzov's modified libpcap format.
74 */
75 #define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34
76
77 /*
78 * Reserved for Francisco Mesquita <francisco.mesquita@radiomovel.pt>
79 * for another modified format.
80 */
81 #define FMESQUITA_TCPDUMP_MAGIC 0xa1b234cd
82
83 /*
84 * Navtel Communcations' format, with nanosecond timestamps,
85 * as per a request from Dumas Hwang <dumas.hwang@navtelcom.com>.
86 */
87 #define NAVTEL_TCPDUMP_MAGIC 0xa12b3c4d
88
89 /*
90 * Normal libpcap format, except for seconds/nanoseconds timestamps,
91 * as per a request by Ulf Lamping <ulf.lamping@web.de>
92 */
93 #define NSEC_TCPDUMP_MAGIC 0xa1b23c4d
94
95 /*
96 * We use the "receiver-makes-right" approach to byte order,
97 * because time is at a premium when we are writing the file.
98 * In other words, the pcap_file_header and pcap_pkthdr,
99 * records are written in host byte order.
100 * Note that the bytes of packet data are written out in the order in
101 * which they were received, so multi-byte fields in packets are not
102 * written in host byte order, they're written in whatever order the
103 * sending machine put them in.
104 *
105 * ntoh[ls] aren't sufficient because we might need to swap on a big-endian
106 * machine (if the file was written in little-end order).
107 */
108 #define SWAPLONG(y) \
109 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
110 #define SWAPSHORT(y) \
111 ( (((y)&0xff)<<8) | ((u_short)((y)&0xff00)>>8) )
112
113 #define SFERR_TRUNC 1
114 #define SFERR_BADVERSION 2
115 #define SFERR_BADF 3
116 #define SFERR_EOF 4 /* not really an error, just a status */
117
118 /*
119 * Setting O_BINARY on DOS/Windows is a bit tricky
120 */
121 #if defined(WIN32)
122 #define SET_BINMODE(f) _setmode(_fileno(f), _O_BINARY)
123 #elif defined(MSDOS)
124 #if defined(__HIGHC__)
125 #define SET_BINMODE(f) setmode(f, O_BINARY)
126 #else
127 #define SET_BINMODE(f) setmode(fileno(f), O_BINARY)
128 #endif
129 #endif
130
131 /*
132 * We don't write DLT_* values to the capture file header, because
133 * they're not the same on all platforms.
134 *
135 * Unfortunately, the various flavors of BSD have not always used the same
136 * numerical values for the same data types, and various patches to
137 * libpcap for non-BSD OSes have added their own DLT_* codes for link
138 * layer encapsulation types seen on those OSes, and those codes have had,
139 * in some cases, values that were also used, on other platforms, for other
140 * link layer encapsulation types.
141 *
142 * This means that capture files of a type whose numerical DLT_* code
143 * means different things on different BSDs, or with different versions
144 * of libpcap, can't always be read on systems other than those like
145 * the one running on the machine on which the capture was made.
146 *
147 * Instead, we define here a set of LINKTYPE_* codes, and map DLT_* codes
148 * to LINKTYPE_* codes when writing a savefile header, and map LINKTYPE_*
149 * codes to DLT_* codes when reading a savefile header.
150 *
151 * For those DLT_* codes that have, as far as we know, the same values on
152 * all platforms (DLT_NULL through DLT_FDDI), we define LINKTYPE_xxx as
153 * DLT_xxx; that way, captures of those types can still be read by
154 * versions of libpcap that map LINKTYPE_* values to DLT_* values, and
155 * captures of those types written by versions of libpcap that map DLT_
156 * values to LINKTYPE_ values can still be read by older versions
157 * of libpcap.
158 *
159 * The other LINKTYPE_* codes are given values starting at 100, in the
160 * hopes that no DLT_* code will be given one of those values.
161 *
162 * In order to ensure that a given LINKTYPE_* code's value will refer to
163 * the same encapsulation type on all platforms, you should not allocate
164 * a new LINKTYPE_* value without consulting
165 * "tcpdump-workers@lists.tcpdump.org". The tcpdump developers will
166 * allocate a value for you, and will not subsequently allocate it to
167 * anybody else; that value will be added to the "pcap.h" in the
168 * tcpdump.org CVS repository, so that a future libpcap release will
169 * include it.
170 *
171 * You should, if possible, also contribute patches to libpcap and tcpdump
172 * to handle the new encapsulation type, so that they can also be checked
173 * into the tcpdump.org CVS repository and so that they will appear in
174 * future libpcap and tcpdump releases.
175 *
176 * Do *NOT* assume that any values after the largest value in this file
177 * are available; you might not have the most up-to-date version of this
178 * file, and new values after that one might have been assigned. Also,
179 * do *NOT* use any values below 100 - those might already have been
180 * taken by one (or more!) organizations.
181 */
182 #define LINKTYPE_NULL DLT_NULL
183 #define LINKTYPE_ETHERNET DLT_EN10MB /* also for 100Mb and up */
184 #define LINKTYPE_EXP_ETHERNET DLT_EN3MB /* 3Mb experimental Ethernet */
185 #define LINKTYPE_AX25 DLT_AX25
186 #define LINKTYPE_PRONET DLT_PRONET
187 #define LINKTYPE_CHAOS DLT_CHAOS
188 #define LINKTYPE_TOKEN_RING DLT_IEEE802 /* DLT_IEEE802 is used for Token Ring */
189 #define LINKTYPE_ARCNET DLT_ARCNET /* BSD-style headers */
190 #define LINKTYPE_SLIP DLT_SLIP
191 #define LINKTYPE_PPP DLT_PPP
192 #define LINKTYPE_FDDI DLT_FDDI
193
194 /*
195 * LINKTYPE_PPP is for use when there might, or might not, be an RFC 1662
196 * PPP in HDLC-like framing header (with 0xff 0x03 before the PPP protocol
197 * field) at the beginning of the packet.
198 *
199 * This is for use when there is always such a header; the address field
200 * might be 0xff, for regular PPP, or it might be an address field for Cisco
201 * point-to-point with HDLC framing as per section 4.3.1 of RFC 1547 ("Cisco
202 * HDLC"). This is, for example, what you get with NetBSD's DLT_PPP_SERIAL.
203 *
204 * We give it the same value as NetBSD's DLT_PPP_SERIAL, in the hopes that
205 * nobody else will choose a DLT_ value of 50, and so that DLT_PPP_SERIAL
206 * captures will be written out with a link type that NetBSD's tcpdump
207 * can read.
208 */
209 #define LINKTYPE_PPP_HDLC 50 /* PPP in HDLC-like framing */
210
211 #define LINKTYPE_PPP_ETHER 51 /* NetBSD PPP-over-Ethernet */
212
213 #define LINKTYPE_SYMANTEC_FIREWALL 99 /* Symantec Enterprise Firewall */
214
215 #define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */
216 #define LINKTYPE_RAW 101 /* raw IP */
217 #define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */
218 #define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */
219 #define LINKTYPE_C_HDLC 104 /* Cisco HDLC */
220 #define LINKTYPE_IEEE802_11 105 /* IEEE 802.11 (wireless) */
221 #define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */
222 #define LINKTYPE_FRELAY 107 /* Frame Relay */
223 #define LINKTYPE_LOOP 108 /* OpenBSD loopback */
224 #define LINKTYPE_ENC 109 /* OpenBSD IPSEC enc */
225
226 /*
227 * These three types are reserved for future use.
228 */
229 #define LINKTYPE_LANE8023 110 /* ATM LANE + 802.3 */
230 #define LINKTYPE_HIPPI 111 /* NetBSD HIPPI */
231 #define LINKTYPE_HDLC 112 /* NetBSD HDLC framing */
232
233 #define LINKTYPE_LINUX_SLL 113 /* Linux cooked socket capture */
234 #define LINKTYPE_LTALK 114 /* Apple LocalTalk hardware */
235 #define LINKTYPE_ECONET 115 /* Acorn Econet */
236
237 /*
238 * Reserved for use with OpenBSD ipfilter.
239 */
240 #define LINKTYPE_IPFILTER 116
241
242 #define LINKTYPE_PFLOG 117 /* OpenBSD DLT_PFLOG */
243 #define LINKTYPE_CISCO_IOS 118 /* For Cisco-internal use */
244 #define LINKTYPE_PRISM_HEADER 119 /* 802.11+Prism II monitor mode */
245 #define LINKTYPE_AIRONET_HEADER 120 /* FreeBSD Aironet driver stuff */
246
247 /*
248 * Reserved for Siemens HiPath HDLC.
249 */
250 #define LINKTYPE_HHDLC 121
251
252 #define LINKTYPE_IP_OVER_FC 122 /* RFC 2625 IP-over-Fibre Channel */
253 #define LINKTYPE_SUNATM 123 /* Solaris+SunATM */
254
255 /*
256 * Reserved as per request from Kent Dahlgren <kent@praesum.com>
257 * for private use.
258 */
259 #define LINKTYPE_RIO 124 /* RapidIO */
260 #define LINKTYPE_PCI_EXP 125 /* PCI Express */
261 #define LINKTYPE_AURORA 126 /* Xilinx Aurora link layer */
262
263 #define LINKTYPE_IEEE802_11_RADIO 127 /* 802.11 plus BSD radio header */
264
265 /*
266 * Reserved for the TZSP encapsulation, as per request from
267 * Chris Waters <chris.waters@networkchemistry.com>
268 * TZSP is a generic encapsulation for any other link type,
269 * which includes a means to include meta-information
270 * with the packet, e.g. signal strength and channel
271 * for 802.11 packets.
272 */
273 #define LINKTYPE_TZSP 128 /* Tazmen Sniffer Protocol */
274
275 #define LINKTYPE_ARCNET_LINUX 129 /* Linux-style headers */
276
277 /*
278 * Juniper-private data link types, as per request from
279 * Hannes Gredler <hannes@juniper.net>. The corresponding
280 * DLT_s are used for passing on chassis-internal
281 * metainformation such as QOS profiles, etc..
282 */
283 #define LINKTYPE_JUNIPER_MLPPP 130
284 #define LINKTYPE_JUNIPER_MLFR 131
285 #define LINKTYPE_JUNIPER_ES 132
286 #define LINKTYPE_JUNIPER_GGSN 133
287 #define LINKTYPE_JUNIPER_MFR 134
288 #define LINKTYPE_JUNIPER_ATM2 135
289 #define LINKTYPE_JUNIPER_SERVICES 136
290 #define LINKTYPE_JUNIPER_ATM1 137
291
292 #define LINKTYPE_APPLE_IP_OVER_IEEE1394 138 /* Apple IP-over-IEEE 1394 cooked header */
293
294 #define LINKTYPE_MTP2_WITH_PHDR 139
295 #define LINKTYPE_MTP2 140
296 #define LINKTYPE_MTP3 141
297 #define LINKTYPE_SCCP 142
298
299 #define LINKTYPE_DOCSIS 143 /* DOCSIS MAC frames */
300
301 #define LINKTYPE_LINUX_IRDA 144 /* Linux-IrDA */
302
303 /*
304 * Reserved for IBM SP switch and IBM Next Federation switch.
305 */
306 #define LINKTYPE_IBM_SP 145
307 #define LINKTYPE_IBM_SN 146
308
309 /*
310 * Reserved for private use. If you have some link-layer header type
311 * that you want to use within your organization, with the capture files
312 * using that link-layer header type not ever be sent outside your
313 * organization, you can use these values.
314 *
315 * No libpcap release will use these for any purpose, nor will any
316 * tcpdump release use them, either.
317 *
318 * Do *NOT* use these in capture files that you expect anybody not using
319 * your private versions of capture-file-reading tools to read; in
320 * particular, do *NOT* use them in products, otherwise you may find that
321 * people won't be able to use tcpdump, or snort, or Ethereal, or... to
322 * read capture files from your firewall/intrusion detection/traffic
323 * monitoring/etc. appliance, or whatever product uses that LINKTYPE_ value,
324 * and you may also find that the developers of those applications will
325 * not accept patches to let them read those files.
326 *
327 * Also, do not use them if somebody might send you a capture using them
328 * for *their* private type and tools using them for *your* private type
329 * would have to read them.
330 *
331 * Instead, in those cases, ask "tcpdump-workers@lists.tcpdump.org" for a
332 * new DLT_ and LINKTYPE_ value, as per the comment in pcap/bpf.h, and use
333 * the type you're given.
334 */
335 #define LINKTYPE_USER0 147
336 #define LINKTYPE_USER1 148
337 #define LINKTYPE_USER2 149
338 #define LINKTYPE_USER3 150
339 #define LINKTYPE_USER4 151
340 #define LINKTYPE_USER5 152
341 #define LINKTYPE_USER6 153
342 #define LINKTYPE_USER7 154
343 #define LINKTYPE_USER8 155
344 #define LINKTYPE_USER9 156
345 #define LINKTYPE_USER10 157
346 #define LINKTYPE_USER11 158
347 #define LINKTYPE_USER12 159
348 #define LINKTYPE_USER13 160
349 #define LINKTYPE_USER14 161
350 #define LINKTYPE_USER15 162
351
352 /*
353 * For future use with 802.11 captures - defined by AbsoluteValue
354 * Systems to store a number of bits of link-layer information
355 * including radio information:
356 *
357 * http://www.shaftnet.org/~pizza/software/capturefrm.txt
358 *
359 * but could and arguably should also be used by non-AVS Linux
360 * 802.11 drivers; that may happen in the future.
361 */
362 #define LINKTYPE_IEEE802_11_RADIO_AVS 163 /* 802.11 plus AVS radio header */
363
364 /*
365 * Juniper-private data link type, as per request from
366 * Hannes Gredler <hannes@juniper.net>. The corresponding
367 * DLT_s are used for passing on chassis-internal
368 * metainformation such as QOS profiles, etc..
369 */
370 #define LINKTYPE_JUNIPER_MONITOR 164
371
372 /*
373 * Reserved for BACnet MS/TP.
374 */
375 #define LINKTYPE_BACNET_MS_TP 165
376
377 /*
378 * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>.
379 *
380 * This is used in some OSes to allow a kernel socket filter to distinguish
381 * between incoming and outgoing packets, on a socket intended to
382 * supply pppd with outgoing packets so it can do dial-on-demand and
383 * hangup-on-lack-of-demand; incoming packets are filtered out so they
384 * don't cause pppd to hold the connection up (you don't want random
385 * input packets such as port scans, packets from old lost connections,
386 * etc. to force the connection to stay up).
387 *
388 * The first byte of the PPP header (0xff03) is modified to accomodate
389 * the direction - 0x00 = IN, 0x01 = OUT.
390 */
391 #define LINKTYPE_PPP_PPPD 166
392
393 /*
394 * Juniper-private data link type, as per request from
395 * Hannes Gredler <hannes@juniper.net>. The DLT_s are used
396 * for passing on chassis-internal metainformation such as
397 * QOS profiles, cookies, etc..
398 */
399 #define LINKTYPE_JUNIPER_PPPOE 167
400 #define LINKTYPE_JUNIPER_PPPOE_ATM 168
401
402 #define LINKTYPE_GPRS_LLC 169 /* GPRS LLC */
403 #define LINKTYPE_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */
404 #define LINKTYPE_GPF_F 171 /* GPF-T (ITU-T G.7041/Y.1303) */
405
406 /*
407 * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line
408 * monitoring equipment.
409 */
410 #define LINKTYPE_GCOM_T1E1 172
411 #define LINKTYPE_GCOM_SERIAL 173
412
413 /*
414 * Juniper-private data link type, as per request from
415 * Hannes Gredler <hannes@juniper.net>. The DLT_ is used
416 * for internal communication to Physical Interface Cards (PIC)
417 */
418 #define LINKTYPE_JUNIPER_PIC_PEER 174
419
420 /*
421 * Link types requested by Gregor Maier <gregor@endace.com> of Endace
422 * Measurement Systems. They add an ERF header (see
423 * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
424 * the link-layer header.
425 */
426 #define LINKTYPE_ERF_ETH 175 /* Ethernet */
427 #define LINKTYPE_ERF_POS 176 /* Packet-over-SONET */
428
429 /*
430 * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD
431 * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header
432 * includes additional information before the LAPD header, so it's
433 * not necessarily a generic LAPD header.
434 */
435 #define LINKTYPE_LINUX_LAPD 177
436
437 /*
438 * Juniper-private data link type, as per request from
439 * Hannes Gredler <hannes@juniper.net>.
440 * The Link Types are used for prepending meta-information
441 * like interface index, interface name
442 * before standard Ethernet, PPP, Frelay & C-HDLC Frames
443 */
444 #define LINKTYPE_JUNIPER_ETHER 178
445 #define LINKTYPE_JUNIPER_PPP 179
446 #define LINKTYPE_JUNIPER_FRELAY 180
447 #define LINKTYPE_JUNIPER_CHDLC 181
448
449 /*
450 * Multi Link Frame Relay (FRF.16)
451 */
452 #define LINKTYPE_MFR 182
453
454 /*
455 * Juniper-private data link type, as per request from
456 * Hannes Gredler <hannes@juniper.net>.
457 * The DLT_ is used for internal communication with a
458 * voice Adapter Card (PIC)
459 */
460 #define LINKTYPE_JUNIPER_VP 183
461
462 /*
463 * Arinc 429 frames.
464 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
465 * Every frame contains a 32bit A429 label.
466 * More documentation on Arinc 429 can be found at
467 * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
468 */
469 #define LINKTYPE_A429 184
470
471 /*
472 * Arinc 653 Interpartition Communication messages.
473 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
474 * Please refer to the A653-1 standard for more information.
475 */
476 #define LINKTYPE_A653_ICM 185
477
478 /*
479 * USB packets, beginning with a USB setup header; requested by
480 * Paolo Abeni <paolo.abeni@email.it>.
481 */
482 #define LINKTYPE_USB 186
483
484 /*
485 * Bluetooth HCI UART transport layer (part H:4); requested by
486 * Paolo Abeni.
487 */
488 #define LINKTYPE_BLUETOOTH_HCI_H4 187
489
490 /*
491 * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
492 * <cruz_petagay@bah.com>.
493 */
494 #define LINKTYPE_IEEE802_16_MAC_CPS 188
495
496 /*
497 * USB packets, beginning with a Linux USB header; requested by
498 * Paolo Abeni <paolo.abeni@email.it>.
499 */
500 #define LINKTYPE_USB_LINUX 189
501
502 /*
503 * Controller Area Network (CAN) v. 2.0B packets.
504 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
505 * Used to dump CAN packets coming from a CAN Vector board.
506 * More documentation on the CAN v2.0B frames can be found at
507 * http://www.can-cia.org/downloads/?269
508 */
509 #define LINKTYPE_CAN20B 190
510
511 /*
512 * IEEE 802.15.4, with address fields padded, as is done by Linux
513 * drivers; requested by Juergen Schimmer.
514 */
515 #define LINKTYPE_IEEE802_15_4_LINUX 191
516
517 /*
518 * Per Packet Information encapsulated packets.
519 * LINKTYPE_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
520 */
521 #define LINKTYPE_PPI 192
522
523 /*
524 * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
525 * requested by Charles Clancy.
526 */
527 #define LINKTYPE_IEEE802_16_MAC_CPS_RADIO 193
528
529 /*
530 * Juniper-private data link type, as per request from
531 * Hannes Gredler <hannes@juniper.net>.
532 * The DLT_ is used for internal communication with a
533 * integrated service module (ISM).
534 */
535 #define LINKTYPE_JUNIPER_ISM 194
536
537 /*
538 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
539 * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
540 */
541 #define LINKTYPE_IEEE802_15_4 195
542
543 /*
544 * Various link-layer types, with a pseudo-header, for SITA
545 * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
546 */
547 #define LINKTYPE_SITA 196
548
549 /*
550 * Various link-layer types, with a pseudo-header, for Endace DAG cards;
551 * encapsulates Endace ERF records. Requested by Stephen Donnelly
552 * <stephen@endace.com>.
553 */
554 #define LINKTYPE_ERF 197
555
556 /*
557 * Special header prepended to Ethernet packets when capturing from a
558 * u10 Networks board. Requested by Phil Mulholland
559 * <phil@u10networks.com>.
560 */
561 #define LINKTYPE_RAIF1 198
562
563 /*
564 * IPMB packet for IPMI, beginning with the I2C slave address, followed
565 * by the netFn and LUN, etc.. Requested by Chanthy Toeung
566 * <chanthy.toeung@ca.kontron.com>.
567 */
568 #define LINKTYPE_IPMB 199
569
570 /*
571 * Juniper-private data link type, as per request from
572 * Hannes Gredler <hannes@juniper.net>.
573 * The DLT_ is used for capturing data on a secure tunnel interface.
574 */
575 #define LINKTYPE_JUNIPER_ST 200
576
577 /*
578 * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
579 * that includes direction information; requested by Paolo Abeni.
580 */
581 #define LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR 201
582
583 /*
584 * AX.25 packet with a 1-byte KISS header; see
585 *
586 * http://www.ax25.net/kiss.htm
587 *
588 * as per Richard Stearn <richard@rns-stearn.demon.co.uk>.
589 */
590 #define LINKTYPE_AX25_KISS 202
591
592 /*
593 * LAPD packets from an ISDN channel, starting with the address field,
594 * with no pseudo-header.
595 * Requested by Varuna De Silva <varunax@gmail.com>.
596 */
597 #define LINKTYPE_LAPD 203
598
599 /*
600 * Variants of various link-layer headers, with a one-byte direction
601 * pseudo-header prepended - zero means "received by this host",
602 * non-zero (any non-zero value) means "sent by this host" - as per
603 * Will Barker <w.barker@zen.co.uk>.
604 */
605 #define LINKTYPE_PPP_WITH_DIR 204 /* PPP */
606 #define LINKTYPE_C_HDLC_WITH_DIR 205 /* Cisco HDLC */
607 #define LINKTYPE_FRELAY_WITH_DIR 206 /* Frame Relay */
608 #define LINKTYPE_LAPB_WITH_DIR 207 /* LAPB */
609
610 /*
611 * 208 is reserved for an as-yet-unspecified proprietary link-layer
612 * type, as requested by Will Barker.
613 */
614
615 /*
616 * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
617 * <avn@pigeonpoint.com>.
618 */
619 #define LINKTYPE_IPMB_LINUX 209
620
621 /*
622 * FlexRay automotive bus - http://www.flexray.com/ - as requested
623 * by Hannes Kaelber <hannes.kaelber@x2e.de>.
624 */
625 #define LINKTYPE_FLEXRAY 210
626
627 /*
628 * Media Oriented Systems Transport (MOST) bus for multimedia
629 * transport - http://www.mostcooperation.com/ - as requested
630 * by Hannes Kaelber <hannes.kaelber@x2e.de>.
631 */
632 #define LINKTYPE_MOST 211
633
634 /*
635 * Local Interconnect Network (LIN) bus for vehicle networks -
636 * http://www.lin-subbus.org/ - as requested by Hannes Kaelber
637 * <hannes.kaelber@x2e.de>.
638 */
639 #define LINKTYPE_LIN 212
640
641 /*
642 * X2E-private data link type used for serial line capture,
643 * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
644 */
645 #define LINKTYPE_X2E_SERIAL 213
646
647 /*
648 * X2E-private data link type used for the Xoraya data logger
649 * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
650 */
651 #define LINKTYPE_X2E_XORAYA 214
652
653 /*
654 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
655 * nothing), but with the PHY-level data for non-ASK PHYs (4 octets
656 * of 0 as preamble, one octet of SFD, one octet of frame length+
657 * reserved bit, and then the MAC-layer data, starting with the
658 * frame control field).
659 *
660 * Requested by Max Filippov <jcmvbkbc@gmail.com>.
661 */
662 #define LINKTYPE_IEEE802_15_4_NONASK_PHY 215
663
664 /*
665 * David Gibson <david@gibson.dropbear.id.au> requested this for
666 * captures from the Linux kernel /dev/input/eventN devices. This
667 * is used to communicate keystrokes and mouse movements from the
668 * Linux kernel to display systems, such as Xorg.
669 */
670 #define LINKTYPE_LINUX_EVDEV 216
671
672 /*
673 * GSM Um and Abis interfaces, preceded by a "gsmtap" header.
674 *
675 * Requested by Harald Welte <laforge@gnumonks.org>.
676 */
677 #define LINKTYPE_GSMTAP_UM 217
678 #define LINKTYPE_GSMTAP_ABIS 218
679
680 /*
681 * MPLS, with an MPLS label as the link-layer header.
682 * Requested by Michele Marchetto <michele@openbsd.org> on behalf
683 * of OpenBSD.
684 */
685 #define LINKTYPE_MPLS 219
686
687 /*
688 * USB packets, beginning with a Linux USB header, with the USB header
689 * padded to 64 bytes; required for memory-mapped access.
690 */
691 #define LINKTYPE_USB_LINUX_MMAPPED 220
692
693 /*
694 * DECT packets, with a pseudo-header; requested by
695 * Matthias Wenzel <tcpdump@mazzoo.de>.
696 */
697 #define LINKTYPE_DECT 221
698
699 /*
700 * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov>
701 * Date: Mon, 11 May 2009 11:18:30 -0500
702 *
703 * DLT_AOS. We need it for AOS Space Data Link Protocol.
704 * I have already written dissectors for but need an OK from
705 * legal before I can submit a patch.
706 *
707 */
708 #define LINKTYPE_AOS 222
709
710 /*
711 * Wireless HART (Highway Addressable Remote Transducer)
712 * From the HART Communication Foundation
713 * IES/PAS 62591
714 *
715 * Requested by Sam Roberts <vieuxtech@gmail.com>.
716 */
717 #define LINKTYPE_WIHART 223
718
719 /*
720 * Fibre Channel FC-2 frames, beginning with a Frame_Header.
721 * Requested by Kahou Lei <kahou82@gmail.com>.
722 */
723 #define LINKTYPE_FC_2 224
724
725 /*
726 * Fibre Channel FC-2 frames, beginning with an encoding of the
727 * SOF, and ending with an encoding of the EOF.
728 *
729 * The encodings represent the frame delimiters as 4-byte sequences
730 * representing the corresponding ordered sets, with K28.5
731 * represented as 0xBC, and the D symbols as the corresponding
732 * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2,
733 * is represented as 0xBC 0xB5 0x55 0x55.
734 *
735 * Requested by Kahou Lei <kahou82@gmail.com>.
736 */
737 #define LINKTYPE_FC_2_WITH_FRAME_DELIMS 225
738
739 /*
740 * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>.
741 *
742 * The pseudo-header starts with a one-byte version number; for version 2,
743 * the pseudo-header is:
744 *
745 * struct dl_ipnetinfo {
746 * u_int8_t dli_version;
747 * u_int8_t dli_family;
748 * u_int16_t dli_htype;
749 * u_int32_t dli_pktlen;
750 * u_int32_t dli_ifindex;
751 * u_int32_t dli_grifindex;
752 * u_int32_t dli_zsrc;
753 * u_int32_t dli_zdst;
754 * };
755 *
756 * dli_version is 2 for the current version of the pseudo-header.
757 *
758 * dli_family is a Solaris address family value, so it's 2 for IPv4
759 * and 26 for IPv6.
760 *
761 * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing
762 * packets, and 2 for packets arriving from another zone on the same
763 * machine.
764 *
765 * dli_pktlen is the length of the packet data following the pseudo-header
766 * (so the captured length minus dli_pktlen is the length of the
767 * pseudo-header, assuming the entire pseudo-header was captured).
768 *
769 * dli_ifindex is the interface index of the interface on which the
770 * packet arrived.
771 *
772 * dli_grifindex is the group interface index number (for IPMP interfaces).
773 *
774 * dli_zsrc is the zone identifier for the source of the packet.
775 *
776 * dli_zdst is the zone identifier for the destination of the packet.
777 *
778 * A zone number of 0 is the global zone; a zone number of 0xffffffff
779 * means that the packet arrived from another host on the network, not
780 * from another zone on the same machine.
781 *
782 * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates
783 * which of those it is.
784 */
785 #define LINKTYPE_IPNET 226
786
787
788 static struct linktype_map {
789 int dlt;
790 int linktype;
791 } map[] = {
792 /*
793 * These DLT_* codes have LINKTYPE_* codes with values identical
794 * to the values of the corresponding DLT_* code.
795 */
796 { DLT_NULL, LINKTYPE_NULL },
797 { DLT_EN10MB, LINKTYPE_ETHERNET },
798 { DLT_EN3MB, LINKTYPE_EXP_ETHERNET },
799 { DLT_AX25, LINKTYPE_AX25 },
800 { DLT_PRONET, LINKTYPE_PRONET },
801 { DLT_CHAOS, LINKTYPE_CHAOS },
802 { DLT_IEEE802, LINKTYPE_TOKEN_RING },
803 { DLT_ARCNET, LINKTYPE_ARCNET },
804 { DLT_SLIP, LINKTYPE_SLIP },
805 { DLT_PPP, LINKTYPE_PPP },
806 { DLT_FDDI, LINKTYPE_FDDI },
807
808 /*
809 * These DLT_* codes have different values on different
810 * platforms; we map them to LINKTYPE_* codes that
811 * have values that should never be equal to any DLT_*
812 * code.
813 */
814 #ifdef DLT_FR
815 /* BSD/OS Frame Relay */
816 { DLT_FR, LINKTYPE_FRELAY },
817 #endif
818
819 { DLT_SYMANTEC_FIREWALL, LINKTYPE_SYMANTEC_FIREWALL },
820 { DLT_ATM_RFC1483, LINKTYPE_ATM_RFC1483 },
821 { DLT_RAW, LINKTYPE_RAW },
822 { DLT_SLIP_BSDOS, LINKTYPE_SLIP_BSDOS },
823 { DLT_PPP_BSDOS, LINKTYPE_PPP_BSDOS },
824
825 /* BSD/OS Cisco HDLC */
826 { DLT_C_HDLC, LINKTYPE_C_HDLC },
827
828 /*
829 * These DLT_* codes are not on all platforms, but, so far,
830 * there don't appear to be any platforms that define
831 * other codes with those values; we map them to
832 * different LINKTYPE_* values anyway, just in case.
833 */
834
835 /* Linux ATM Classical IP */
836 { DLT_ATM_CLIP, LINKTYPE_ATM_CLIP },
837
838 /* NetBSD sync/async serial PPP (or Cisco HDLC) */
839 { DLT_PPP_SERIAL, LINKTYPE_PPP_HDLC },
840
841 /* NetBSD PPP over Ethernet */
842 { DLT_PPP_ETHER, LINKTYPE_PPP_ETHER },
843
844 /* IEEE 802.11 wireless */
845 { DLT_IEEE802_11, LINKTYPE_IEEE802_11 },
846
847 /* Frame Relay */
848 { DLT_FRELAY, LINKTYPE_FRELAY },
849
850 /* OpenBSD loopback */
851 { DLT_LOOP, LINKTYPE_LOOP },
852
853 /* OpenBSD IPSEC enc */
854 { DLT_ENC, LINKTYPE_ENC },
855
856 /* Linux cooked socket capture */
857 { DLT_LINUX_SLL, LINKTYPE_LINUX_SLL },
858
859 /* Apple LocalTalk hardware */
860 { DLT_LTALK, LINKTYPE_LTALK },
861
862 /* Acorn Econet */
863 { DLT_ECONET, LINKTYPE_ECONET },
864
865 /* OpenBSD DLT_PFLOG */
866 { DLT_PFLOG, LINKTYPE_PFLOG },
867
868 /* For Cisco-internal use */
869 { DLT_CISCO_IOS, LINKTYPE_CISCO_IOS },
870
871 /* Prism II monitor-mode header plus 802.11 header */
872 { DLT_PRISM_HEADER, LINKTYPE_PRISM_HEADER },
873
874 /* FreeBSD Aironet driver stuff */
875 { DLT_AIRONET_HEADER, LINKTYPE_AIRONET_HEADER },
876
877 /* Siemens HiPath HDLC */
878 { DLT_HHDLC, LINKTYPE_HHDLC },
879
880 /* RFC 2625 IP-over-Fibre Channel */
881 { DLT_IP_OVER_FC, LINKTYPE_IP_OVER_FC },
882
883 /* Solaris+SunATM */
884 { DLT_SUNATM, LINKTYPE_SUNATM },
885
886 /* RapidIO */
887 { DLT_RIO, LINKTYPE_RIO },
888
889 /* PCI Express */
890 { DLT_PCI_EXP, LINKTYPE_PCI_EXP },
891
892 /* Xilinx Aurora link layer */
893 { DLT_AURORA, LINKTYPE_AURORA },
894
895 /* 802.11 plus BSD radio header */
896 { DLT_IEEE802_11_RADIO, LINKTYPE_IEEE802_11_RADIO },
897
898 /* Tazmen Sniffer Protocol */
899 { DLT_TZSP, LINKTYPE_TZSP },
900
901 /* Arcnet with Linux-style link-layer headers */
902 { DLT_ARCNET_LINUX, LINKTYPE_ARCNET_LINUX },
903
904 /* Juniper-internal chassis encapsulation */
905 { DLT_JUNIPER_MLPPP, LINKTYPE_JUNIPER_MLPPP },
906 { DLT_JUNIPER_MLFR, LINKTYPE_JUNIPER_MLFR },
907 { DLT_JUNIPER_ES, LINKTYPE_JUNIPER_ES },
908 { DLT_JUNIPER_GGSN, LINKTYPE_JUNIPER_GGSN },
909 { DLT_JUNIPER_MFR, LINKTYPE_JUNIPER_MFR },
910 { DLT_JUNIPER_ATM2, LINKTYPE_JUNIPER_ATM2 },
911 { DLT_JUNIPER_SERVICES, LINKTYPE_JUNIPER_SERVICES },
912 { DLT_JUNIPER_ATM1, LINKTYPE_JUNIPER_ATM1 },
913
914 /* Apple IP-over-IEEE 1394 cooked header */
915 { DLT_APPLE_IP_OVER_IEEE1394, LINKTYPE_APPLE_IP_OVER_IEEE1394 },
916
917 /* SS7 */
918 { DLT_MTP2_WITH_PHDR, LINKTYPE_MTP2_WITH_PHDR },
919 { DLT_MTP2, LINKTYPE_MTP2 },
920 { DLT_MTP3, LINKTYPE_MTP3 },
921 { DLT_SCCP, LINKTYPE_SCCP },
922
923 /* DOCSIS MAC frames */
924 { DLT_DOCSIS, LINKTYPE_DOCSIS },
925
926 /* IrDA IrLAP packets + Linux-cooked header */
927 { DLT_LINUX_IRDA, LINKTYPE_LINUX_IRDA },
928
929 /* IBM SP and Next Federation switches */
930 { DLT_IBM_SP, LINKTYPE_IBM_SP },
931 { DLT_IBM_SN, LINKTYPE_IBM_SN },
932
933 /* 802.11 plus AVS radio header */
934 { DLT_IEEE802_11_RADIO_AVS, LINKTYPE_IEEE802_11_RADIO_AVS },
935
936 /*
937 * Any platform that defines additional DLT_* codes should:
938 *
939 * request a LINKTYPE_* code and value from tcpdump.org,
940 * as per the above;
941 *
942 * add, in their version of libpcap, an entry to map
943 * those DLT_* codes to the corresponding LINKTYPE_*
944 * code;
945 *
946 * redefine, in their "net/bpf.h", any DLT_* values
947 * that collide with the values used by their additional
948 * DLT_* codes, to remove those collisions (but without
949 * making them collide with any of the LINKTYPE_*
950 * values equal to 50 or above; they should also avoid
951 * defining DLT_* values that collide with those
952 * LINKTYPE_* values, either).
953 */
954
955 /* Juniper-internal chassis encapsulation */
956 { DLT_JUNIPER_MONITOR, LINKTYPE_JUNIPER_MONITOR },
957
958 /* BACnet MS/TP */
959 { DLT_BACNET_MS_TP, LINKTYPE_BACNET_MS_TP },
960
961 /* PPP for pppd, with direction flag in the PPP header */
962 { DLT_PPP_PPPD, LINKTYPE_PPP_PPPD},
963
964 /* Juniper-internal chassis encapsulation */
965 { DLT_JUNIPER_PPPOE, LINKTYPE_JUNIPER_PPPOE },
966 { DLT_JUNIPER_PPPOE_ATM,LINKTYPE_JUNIPER_PPPOE_ATM },
967
968 /* GPRS LLC */
969 { DLT_GPRS_LLC, LINKTYPE_GPRS_LLC },
970
971 /* Transparent Generic Framing Procedure (ITU-T G.7041/Y.1303) */
972 { DLT_GPF_T, LINKTYPE_GPF_T },
973
974 /* Framed Generic Framing Procedure (ITU-T G.7041/Y.1303) */
975 { DLT_GPF_F, LINKTYPE_GPF_F },
976
977 { DLT_GCOM_T1E1, LINKTYPE_GCOM_T1E1 },
978 { DLT_GCOM_SERIAL, LINKTYPE_GCOM_SERIAL },
979
980 /* Juniper-internal chassis encapsulation */
981 { DLT_JUNIPER_PIC_PEER, LINKTYPE_JUNIPER_PIC_PEER },
982
983 /* Endace types */
984 { DLT_ERF_ETH, LINKTYPE_ERF_ETH },
985 { DLT_ERF_POS, LINKTYPE_ERF_POS },
986
987 /* viSDN LAPD */
988 { DLT_LINUX_LAPD, LINKTYPE_LINUX_LAPD },
989
990 /* Juniper meta-information before Ether, PPP, Frame Relay, C-HDLC Frames */
991 { DLT_JUNIPER_ETHER, LINKTYPE_JUNIPER_ETHER },
992 { DLT_JUNIPER_PPP, LINKTYPE_JUNIPER_PPP },
993 { DLT_JUNIPER_FRELAY, LINKTYPE_JUNIPER_FRELAY },
994 { DLT_JUNIPER_CHDLC, LINKTYPE_JUNIPER_CHDLC },
995
996 /* Multi Link Frame Relay (FRF.16) */
997 { DLT_MFR, LINKTYPE_MFR },
998
999 /* Juniper Voice PIC */
1000 { DLT_JUNIPER_VP, LINKTYPE_JUNIPER_VP },
1001
1002 /* Controller Area Network (CAN) v2.0B */
1003 { DLT_A429, LINKTYPE_A429 },
1004
1005 /* Arinc 653 Interpartition Communication messages */
1006 { DLT_A653_ICM, LINKTYPE_A653_ICM },
1007
1008 /* USB */
1009 { DLT_USB, LINKTYPE_USB },
1010
1011 /* Bluetooth HCI UART transport layer */
1012 { DLT_BLUETOOTH_HCI_H4, LINKTYPE_BLUETOOTH_HCI_H4 },
1013
1014 /* IEEE 802.16 MAC Common Part Sublayer */
1015 { DLT_IEEE802_16_MAC_CPS, LINKTYPE_IEEE802_16_MAC_CPS },
1016
1017 /* USB with Linux header */
1018 { DLT_USB_LINUX, LINKTYPE_USB_LINUX },
1019
1020 /* Controller Area Network (CAN) v2.0B */
1021 { DLT_CAN20B, LINKTYPE_CAN20B },
1022
1023 /* IEEE 802.15.4 with address fields padded */
1024 { DLT_IEEE802_15_4_LINUX, LINKTYPE_IEEE802_15_4_LINUX },
1025
1026 /* Per Packet Information encapsulated packets */
1027 { DLT_PPI, LINKTYPE_PPI },
1028
1029 /* IEEE 802.16 MAC Common Part Sublayer plus radiotap header */
1030 { DLT_IEEE802_16_MAC_CPS_RADIO, LINKTYPE_IEEE802_16_MAC_CPS_RADIO },
1031
1032 /* Juniper Voice ISM */
1033 { DLT_JUNIPER_ISM, LINKTYPE_JUNIPER_ISM },
1034
1035 /* IEEE 802.15.4 exactly as it appears in the spec */
1036 { DLT_IEEE802_15_4, LINKTYPE_IEEE802_15_4 },
1037
1038 /* Various link-layer types for SITA */
1039 { DLT_SITA, LINKTYPE_SITA },
1040
1041 /* Various link-layer types for Endace */
1042 { DLT_ERF, LINKTYPE_ERF },
1043
1044 /* Special header for u10 Networks boards */
1045 { DLT_RAIF1, LINKTYPE_RAIF1 },
1046
1047 /* IPMB */
1048 { DLT_IPMB, LINKTYPE_IPMB },
1049
1050 /* Juniper Secure Tunnel */
1051 { DLT_JUNIPER_ST, LINKTYPE_JUNIPER_ST },
1052
1053 /* Bluetooth HCI UART transport layer, with pseudo-header */
1054 { DLT_BLUETOOTH_HCI_H4_WITH_PHDR, LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR },
1055
1056 /* AX.25 with KISS header */
1057 { DLT_AX25_KISS, LINKTYPE_AX25_KISS },
1058
1059 /* Raw LAPD, with no pseudo-header */
1060 { DLT_LAPD, LINKTYPE_LAPD },
1061
1062 /* PPP with one-byte pseudo-header giving direction */
1063 { DLT_PPP_WITH_DIR, LINKTYPE_PPP_WITH_DIR },
1064
1065 /* Cisco HDLC with one-byte pseudo-header giving direction */
1066 { DLT_C_HDLC_WITH_DIR, LINKTYPE_C_HDLC_WITH_DIR },
1067
1068 /* Frame Relay with one-byte pseudo-header giving direction */
1069 { DLT_FRELAY_WITH_DIR, LINKTYPE_FRELAY_WITH_DIR },
1070
1071 /* LAPB with one-byte pseudo-header giving direction */
1072 { DLT_LAPB_WITH_DIR, LINKTYPE_LAPB_WITH_DIR },
1073
1074 /* IPMB with Linux pseudo-header */
1075 { DLT_IPMB_LINUX, LINKTYPE_IPMB_LINUX },
1076
1077 /* FlexRay */
1078 { DLT_FLEXRAY, LINKTYPE_FLEXRAY },
1079
1080 /* MOST */
1081 { DLT_MOST, LINKTYPE_MOST },
1082
1083 /* LIN */
1084 { DLT_LIN, LINKTYPE_LIN },
1085
1086 /* X2E-private serial line capture */
1087 { DLT_X2E_SERIAL, LINKTYPE_X2E_SERIAL },
1088
1089 /* X2E-private for Xoraya data logger family */
1090 { DLT_X2E_XORAYA, LINKTYPE_X2E_XORAYA },
1091
1092 /* IEEE 802.15.4 with PHY data for non-ASK PHYs */
1093 { DLT_IEEE802_15_4_NONASK_PHY, LINKTYPE_IEEE802_15_4_NONASK_PHY },
1094
1095 /* Input device events from Linux /dev/input/eventN devices */
1096 { DLT_LINUX_EVDEV, LINKTYPE_LINUX_EVDEV },
1097
1098 /* GSM types */
1099 { DLT_GSMTAP_UM, LINKTYPE_GSMTAP_UM },
1100 { DLT_GSMTAP_ABIS, LINKTYPE_GSMTAP_ABIS },
1101
1102 /* MPLS, with an MPLS label as the link-layer header */
1103 { DLT_MPLS, LINKTYPE_MPLS },
1104
1105 /* USB with padded Linux header */
1106 { DLT_USB_LINUX_MMAPPED, LINKTYPE_USB_LINUX_MMAPPED },
1107
1108 /* DECT packets with a pseudo-header */
1109 { DLT_DECT, LINKTYPE_DECT },
1110
1111 /* AOS Space Data Link Protocol */
1112 { DLT_AOS, LINKTYPE_AOS },
1113
1114 /* Wireless HART */
1115 { DLT_WIHART, LINKTYPE_WIHART },
1116
1117 /* Fibre Channel FC-2 frames without SOF or EOF */
1118 { DLT_FC_2, LINKTYPE_FC_2 },
1119
1120 /* Fibre Channel FC-2 frames with SOF and EOF */
1121 { DLT_FC_2_WITH_FRAME_DELIMS, LINKTYPE_FC_2_WITH_FRAME_DELIMS },
1122
1123 /* Solaris IPNET */
1124 { DLT_IPNET, LINKTYPE_IPNET },
1125
1126 { -1, -1 }
1127 };
1128
1129 /*
1130 * Mechanism for storing information about a capture in the upper
1131 * 6 bits of a linktype value in a capture file.
1132 *
1133 * LT_LINKTYPE_EXT(x) extracts the additional information.
1134 *
1135 * The rest of the bits are for a value describing the link-layer
1136 * value. LT_LINKTYPE(x) extracts that value.
1137 */
1138 #define LT_LINKTYPE(x) ((x) & 0x03FFFFFF)
1139 #define LT_LINKTYPE_EXT(x) ((x) & 0xFC000000)
1140
1141 static int
1142 dlt_to_linktype(int dlt)
1143 {
1144 int i;
1145
1146 for (i = 0; map[i].dlt != -1; i++) {
1147 if (map[i].dlt == dlt)
1148 return (map[i].linktype);
1149 }
1150
1151 /*
1152 * If we don't have a mapping for this DLT_ code, return an
1153 * error; that means that the table above needs to have an
1154 * entry added.
1155 */
1156 return (-1);
1157 }
1158
1159 static int
1160 linktype_to_dlt(int linktype)
1161 {
1162 int i;
1163
1164 for (i = 0; map[i].linktype != -1; i++) {
1165 if (map[i].linktype == linktype)
1166 return (map[i].dlt);
1167 }
1168
1169 /*
1170 * If we don't have an entry for this link type, return
1171 * the link type value; it may be a DLT_ value from an
1172 * older version of libpcap.
1173 */
1174 return linktype;
1175 }
1176
1177 static int
1178 sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen)
1179 {
1180 struct pcap_file_header hdr;
1181
1182 hdr.magic = TCPDUMP_MAGIC;
1183 hdr.version_major = PCAP_VERSION_MAJOR;
1184 hdr.version_minor = PCAP_VERSION_MINOR;
1185
1186 hdr.thiszone = thiszone;
1187 hdr.snaplen = snaplen;
1188 hdr.sigfigs = 0;
1189 hdr.linktype = linktype;
1190
1191 if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
1192 return (-1);
1193
1194 return (0);
1195 }
1196
1197 static void
1198 swap_hdr(struct pcap_file_header *hp)
1199 {
1200 hp->version_major = SWAPSHORT(hp->version_major);
1201 hp->version_minor = SWAPSHORT(hp->version_minor);
1202 hp->thiszone = SWAPLONG(hp->thiszone);
1203 hp->sigfigs = SWAPLONG(hp->sigfigs);
1204 hp->snaplen = SWAPLONG(hp->snaplen);
1205 hp->linktype = SWAPLONG(hp->linktype);
1206 }
1207
1208 static int
1209 sf_getnonblock(pcap_t *p, char *errbuf)
1210 {
1211 /*
1212 * This is a savefile, not a live capture file, so never say
1213 * it's in non-blocking mode.
1214 */
1215 return (0);
1216 }
1217
1218 static int
1219 sf_setnonblock(pcap_t *p, int nonblock, char *errbuf)
1220 {
1221 /*
1222 * This is a savefile, not a live capture file, so ignore
1223 * requests to put it in non-blocking mode.
1224 */
1225 return (0);
1226 }
1227
1228 static int
1229 sf_stats(pcap_t *p, struct pcap_stat *ps)
1230 {
1231 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1232 "Statistics aren't available from savefiles");
1233 return (-1);
1234 }
1235
1236 #ifdef WIN32
1237 static int
1238 sf_setbuff(pcap_t *p, int dim)
1239 {
1240 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1241 "The kernel buffer size cannot be set while reading from a file");
1242 return (-1);
1243 }
1244
1245 static int
1246 sf_setmode(pcap_t *p, int mode)
1247 {
1248 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1249 "impossible to set mode while reading from a file");
1250 return (-1);
1251 }
1252
1253 static int
1254 sf_setmintocopy(pcap_t *p, int size)
1255 {
1256 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1257 "The mintocopy parameter cannot be set while reading from a file");
1258 return (-1);
1259 }
1260 #endif
1261
1262 static int
1263 sf_inject(pcap_t *p, const void *buf _U_, size_t size _U_)
1264 {
1265 strlcpy(p->errbuf, "Sending packets isn't supported on savefiles",
1266 PCAP_ERRBUF_SIZE);
1267 return (-1);
1268 }
1269
1270 /*
1271 * Set direction flag: Which packets do we accept on a forwarding
1272 * single device? IN, OUT or both?
1273 */
1274 static int
1275 sf_setdirection(pcap_t *p, pcap_direction_t d)
1276 {
1277 snprintf(p->errbuf, sizeof(p->errbuf),
1278 "Setting direction is not supported on savefiles");
1279 return (-1);
1280 }
1281
1282 static void
1283 sf_cleanup(pcap_t *p)
1284 {
1285 if (p->sf.rfile != stdin)
1286 (void)fclose(p->sf.rfile);
1287 if (p->sf.base != NULL)
1288 free(p->sf.base);
1289 }
1290
1291 pcap_t *
1292 pcap_open_offline(const char *fname, char *errbuf)
1293 {
1294 FILE *fp;
1295 pcap_t *p;
1296
1297 if (fname[0] == '-' && fname[1] == '\0')
1298 {
1299 fp = stdin;
1300 #if defined(WIN32) || defined(MSDOS)
1301 /*
1302 * We're reading from the standard input, so put it in binary
1303 * mode, as savefiles are binary files.
1304 */
1305 SET_BINMODE(fp);
1306 #endif
1307 }
1308 else {
1309 #if !defined(WIN32) && !defined(MSDOS)
1310 fp = fopen(fname, "r");
1311 #else
1312 fp = fopen(fname, "rb");
1313 #endif
1314 if (fp == NULL) {
1315 snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", fname,
1316 pcap_strerror(errno));
1317 return (NULL);
1318 }
1319 }
1320 p = pcap_fopen_offline(fp, errbuf);
1321 if (p == NULL) {
1322 if (fp != stdin)
1323 fclose(fp);
1324 }
1325 return (p);
1326 }
1327
1328 #ifdef WIN32
1329 pcap_t* pcap_hopen_offline(intptr_t osfd, char *errbuf)
1330 {
1331 int fd;
1332 FILE *file;
1333
1334 fd = _open_osfhandle(osfd, _O_RDONLY);
1335 if ( fd < 0 )
1336 {
1337 snprintf(errbuf, PCAP_ERRBUF_SIZE, pcap_strerror(errno));
1338 return NULL;
1339 }
1340
1341 file = _fdopen(fd, "rb");
1342 if ( file == NULL )
1343 {
1344 snprintf(errbuf, PCAP_ERRBUF_SIZE, pcap_strerror(errno));
1345 return NULL;
1346 }
1347
1348 return pcap_fopen_offline(file, errbuf);
1349 }
1350 #endif
1351
1352 #ifdef WIN32
1353 static
1354 #endif
1355 pcap_t *
1356 pcap_fopen_offline(FILE *fp, char *errbuf)
1357 {
1358 register pcap_t *p;
1359 struct pcap_file_header hdr;
1360 size_t amt_read;
1361 bpf_u_int32 magic;
1362 int linklen;
1363
1364 p = pcap_create_common(NULL, errbuf);
1365 if (p == NULL)
1366 return (NULL);
1367
1368 amt_read = fread((char *)&hdr, 1, sizeof(hdr), fp);
1369 if (amt_read != sizeof(hdr)) {
1370 if (ferror(fp)) {
1371 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1372 "error reading dump file: %s",
1373 pcap_strerror(errno));
1374 } else {
1375 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1376 "truncated dump file; tried to read %lu file header bytes, only got %lu",
1377 (unsigned long)sizeof(hdr),
1378 (unsigned long)amt_read);
1379 }
1380 goto bad;
1381 }
1382 magic = hdr.magic;
1383 if (magic != TCPDUMP_MAGIC && magic != KUZNETZOV_TCPDUMP_MAGIC) {
1384 magic = SWAPLONG(magic);
1385 if (magic != TCPDUMP_MAGIC && magic != KUZNETZOV_TCPDUMP_MAGIC) {
1386 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1387 "bad dump file format");
1388 goto bad;
1389 }
1390 p->sf.swapped = 1;
1391 swap_hdr(&hdr);
1392 }
1393 if (magic == KUZNETZOV_TCPDUMP_MAGIC) {
1394 /*
1395 * XXX - the patch that's in some versions of libpcap
1396 * changes the packet header but not the magic number,
1397 * and some other versions with this magic number have
1398 * some extra debugging information in the packet header;
1399 * we'd have to use some hacks^H^H^H^H^Hheuristics to
1400 * detect those variants.
1401 *
1402 * Ethereal does that, but it does so by trying to read
1403 * the first two packets of the file with each of the
1404 * record header formats. That currently means it seeks
1405 * backwards and retries the reads, which doesn't work
1406 * on pipes. We want to be able to read from a pipe, so
1407 * that strategy won't work; we'd have to buffer some
1408 * data ourselves and read from that buffer in order to
1409 * make that work.
1410 */
1411 p->sf.hdrsize = sizeof(struct pcap_sf_patched_pkthdr);
1412 } else
1413 p->sf.hdrsize = sizeof(struct pcap_sf_pkthdr);
1414 if (hdr.version_major < PCAP_VERSION_MAJOR) {
1415 snprintf(errbuf, PCAP_ERRBUF_SIZE, "archaic file format");
1416 goto bad;
1417 }
1418 p->tzoff = hdr.thiszone;
1419 p->snapshot = hdr.snaplen;
1420 p->linktype = linktype_to_dlt(LT_LINKTYPE(hdr.linktype));
1421 p->linktype_ext = LT_LINKTYPE_EXT(hdr.linktype);
1422 if (magic == KUZNETZOV_TCPDUMP_MAGIC && p->linktype == DLT_EN10MB) {
1423 /*
1424 * This capture might have been done in raw mode or cooked
1425 * mode.
1426 *
1427 * If it was done in cooked mode, p->snapshot was passed
1428 * to recvfrom() as the buffer size, meaning that the
1429 * most packet data that would be copied would be
1430 * p->snapshot. However, a faked Ethernet header would
1431 * then have been added to it, so the most data that would
1432 * be in a packet in the file would be p->snapshot + 14.
1433 *
1434 * We can't easily tell whether the capture was done in
1435 * raw mode or cooked mode, so we'll assume it was
1436 * cooked mode, and add 14 to the snapshot length. That
1437 * means that, for a raw capture, the snapshot length will
1438 * be misleading if you use it to figure out why a capture
1439 * doesn't have all the packet data, but there's not much
1440 * we can do to avoid that.
1441 */
1442 p->snapshot += 14;
1443 }
1444 p->sf.rfile = fp;
1445 #ifndef WIN32
1446 p->bufsize = hdr.snaplen;
1447 #else
1448 /* Allocate the space for pcap_pkthdr as well. It will be used by pcap_read_ex */
1449 p->bufsize = hdr.snaplen+sizeof(struct pcap_pkthdr);
1450 #endif
1451
1452 /* Align link header as required for proper data alignment */
1453 /* XXX should handle all types */
1454 switch (p->linktype) {
1455
1456 case DLT_EN10MB:
1457 linklen = 14;
1458 break;
1459
1460 case DLT_FDDI:
1461 linklen = 13 + 8; /* fddi_header + llc */
1462 break;
1463
1464 case DLT_NULL:
1465 default:
1466 linklen = 0;
1467 break;
1468 }
1469
1470 if (p->bufsize < 0)
1471 p->bufsize = BPF_MAXBUFSIZE;
1472 p->sf.base = (u_char *)malloc(p->bufsize + BPF_ALIGNMENT);
1473 if (p->sf.base == NULL) {
1474 strlcpy(errbuf, "out of swap", PCAP_ERRBUF_SIZE);
1475 goto bad;
1476 }
1477 p->buffer = p->sf.base + BPF_ALIGNMENT - (linklen % BPF_ALIGNMENT);
1478 p->sf.version_major = hdr.version_major;
1479 p->sf.version_minor = hdr.version_minor;
1480 #ifdef PCAP_FDDIPAD
1481 /* Padding only needed for live capture fcode */
1482 p->fddipad = 0;
1483 #endif
1484
1485 /*
1486 * We interchanged the caplen and len fields at version 2.3,
1487 * in order to match the bpf header layout. But unfortunately
1488 * some files were written with version 2.3 in their headers
1489 * but without the interchanged fields.
1490 *
1491 * In addition, DG/UX tcpdump writes out files with a version
1492 * number of 543.0, and with the caplen and len fields in the
1493 * pre-2.3 order.
1494 */
1495 switch (hdr.version_major) {
1496
1497 case 2:
1498 if (hdr.version_minor < 3)
1499 p->sf.lengths_swapped = SWAPPED;
1500 else if (hdr.version_minor == 3)
1501 p->sf.lengths_swapped = MAYBE_SWAPPED;
1502 else
1503 p->sf.lengths_swapped = NOT_SWAPPED;
1504 break;
1505
1506 case 543:
1507 p->sf.lengths_swapped = SWAPPED;
1508 break;
1509
1510 default:
1511 p->sf.lengths_swapped = NOT_SWAPPED;
1512 break;
1513 }
1514
1515 #if !defined(WIN32) && !defined(MSDOS)
1516 /*
1517 * You can do "select()" and "poll()" on plain files on most
1518 * platforms, and should be able to do so on pipes.
1519 *
1520 * You can't do "select()" on anything other than sockets in
1521 * Windows, so, on Win32 systems, we don't have "selectable_fd".
1522 */
1523 p->selectable_fd = fileno(fp);
1524 #endif
1525
1526 p->read_op = pcap_offline_read;
1527 p->inject_op = sf_inject;
1528 p->setfilter_op = install_bpf_program;
1529 p->setdirection_op = sf_setdirection;
1530 p->set_datalink_op = NULL; /* we don't support munging link-layer headers */
1531 p->getnonblock_op = sf_getnonblock;
1532 p->setnonblock_op = sf_setnonblock;
1533 p->stats_op = sf_stats;
1534 #ifdef WIN32
1535 p->setbuff_op = sf_setbuff;
1536 p->setmode_op = sf_setmode;
1537 p->setmintocopy_op = sf_setmintocopy;
1538 #endif
1539 p->cleanup_op = sf_cleanup;
1540 p->activated = 1;
1541
1542 return (p);
1543 bad:
1544 free(p);
1545 return (NULL);
1546 }
1547
1548 /*
1549 * Read sf_readfile and return the next packet. Return the header in hdr
1550 * and the contents in buf. Return 0 on success, SFERR_EOF if there were
1551 * no more packets, and SFERR_TRUNC if a partial packet was encountered.
1552 */
1553 static int
1554 sf_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char *buf, u_int buflen)
1555 {
1556 struct pcap_sf_patched_pkthdr sf_hdr;
1557 FILE *fp = p->sf.rfile;
1558 size_t amt_read;
1559 bpf_u_int32 t;
1560
1561 /*
1562 * Read the packet header; the structure we use as a buffer
1563 * is the longer structure for files generated by the patched
1564 * libpcap, but if the file has the magic number for an
1565 * unpatched libpcap we only read as many bytes as the regular
1566 * header has.
1567 */
1568 amt_read = fread(&sf_hdr, 1, p->sf.hdrsize, fp);
1569 if (amt_read != p->sf.hdrsize) {
1570 if (ferror(fp)) {
1571 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1572 "error reading dump file: %s",
1573 pcap_strerror(errno));
1574 return (-1);
1575 } else {
1576 if (amt_read != 0) {
1577 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1578 "truncated dump file; tried to read %lu header bytes, only got %lu",
1579 (unsigned long)p->sf.hdrsize,
1580 (unsigned long)amt_read);
1581 return (-1);
1582 }
1583 /* EOF */
1584 return (1);
1585 }
1586 }
1587
1588 if (p->sf.swapped) {
1589 /* these were written in opposite byte order */
1590 hdr->caplen = SWAPLONG(sf_hdr.caplen);
1591 hdr->len = SWAPLONG(sf_hdr.len);
1592 hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec);
1593 hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec);
1594 } else {
1595 hdr->caplen = sf_hdr.caplen;
1596 hdr->len = sf_hdr.len;
1597 hdr->ts.tv_sec = sf_hdr.ts.tv_sec;
1598 hdr->ts.tv_usec = sf_hdr.ts.tv_usec;
1599 }
1600 /* Swap the caplen and len fields, if necessary. */
1601 switch (p->sf.lengths_swapped) {
1602
1603 case NOT_SWAPPED:
1604 break;
1605
1606 case MAYBE_SWAPPED:
1607 if (hdr->caplen <= hdr->len) {
1608 /*
1609 * The captured length is <= the actual length,
1610 * so presumably they weren't swapped.
1611 */
1612 break;
1613 }
1614 /* FALLTHROUGH */
1615
1616 case SWAPPED:
1617 t = hdr->caplen;
1618 hdr->caplen = hdr->len;
1619 hdr->len = t;
1620 break;
1621 }
1622
1623 if (hdr->caplen > buflen) {
1624 /*
1625 * This can happen due to Solaris 2.3 systems tripping
1626 * over the BUFMOD problem and not setting the snapshot
1627 * correctly in the savefile header. If the caplen isn't
1628 * grossly wrong, try to salvage.
1629 */
1630 static u_char *tp = NULL;
1631 static size_t tsize = 0;
1632
1633 if (hdr->caplen > 65535) {
1634 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1635 "bogus savefile header");
1636 return (-1);
1637 }
1638
1639 if (tsize < hdr->caplen) {
1640 tsize = ((hdr->caplen + 1023) / 1024) * 1024;
1641 if (tp != NULL)
1642 free((u_char *)tp);
1643 tp = (u_char *)malloc(tsize);
1644 if (tp == NULL) {
1645 tsize = 0;
1646 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1647 "BUFMOD hack malloc");
1648 return (-1);
1649 }
1650 }
1651 amt_read = fread((char *)tp, 1, hdr->caplen, fp);
1652 if (amt_read != hdr->caplen) {
1653 if (ferror(fp)) {
1654 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1655 "error reading dump file: %s",
1656 pcap_strerror(errno));
1657 } else {
1658 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1659 "truncated dump file; tried to read %u captured bytes, only got %lu",
1660 hdr->caplen, (unsigned long)amt_read);
1661 }
1662 return (-1);
1663 }
1664 /*
1665 * We can only keep up to buflen bytes. Since caplen > buflen
1666 * is exactly how we got here, we know we can only keep the
1667 * first buflen bytes and must drop the remainder. Adjust
1668 * caplen accordingly, so we don't get confused later as
1669 * to how many bytes we have to play with.
1670 */
1671 hdr->caplen = buflen;
1672 memcpy((char *)buf, (char *)tp, buflen);
1673
1674 } else {
1675 /* read the packet itself */
1676 amt_read = fread((char *)buf, 1, hdr->caplen, fp);
1677 if (amt_read != hdr->caplen) {
1678 if (ferror(fp)) {
1679 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1680 "error reading dump file: %s",
1681 pcap_strerror(errno));
1682 } else {
1683 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1684 "truncated dump file; tried to read %u captured bytes, only got %lu",
1685 hdr->caplen, (unsigned long)amt_read);
1686 }
1687 return (-1);
1688 }
1689 }
1690
1691 /*
1692 * The DLT_USB_LINUX and DLT_USB_LINUX_MMAPPED headers are in host
1693 * byte order when capturing (it's supplied directly from a
1694 * memory-mapped buffer shared by the kernel).
1695 *
1696 * When reading a DLT_USB_LINUX or DLT_USB_LINUX_MMAPPED capture file,
1697 * we need to convert it from the capturing host's byte order to
1698 * the reading host's byte order.
1699 */
1700 if (p->sf.swapped &&
1701 (p->linktype == DLT_USB_LINUX || p->linktype == DLT_USB_LINUX_MMAPPED)) {
1702 pcap_usb_header* uhdr = (pcap_usb_header*) buf;
1703 /*
1704 * The URB id is a totally opaque value; do we really need to
1705 * convert it to the reading host's byte order???
1706 */
1707 if (hdr->caplen < 8)
1708 return 0;
1709 uhdr->id = SWAPLL(uhdr->id);
1710 if (hdr->caplen < 14)
1711 return 0;
1712 uhdr->bus_id = SWAPSHORT(uhdr->bus_id);
1713 if (hdr->caplen < 24)
1714 return 0;
1715 uhdr->ts_sec = SWAPLL(uhdr->ts_sec);
1716 if (hdr->caplen < 28)
1717 return 0;
1718 uhdr->ts_usec = SWAPLONG(uhdr->ts_usec);
1719 if (hdr->caplen < 32)
1720 return 0;
1721 uhdr->status = SWAPLONG(uhdr->status);
1722 if (hdr->caplen < 36)
1723 return 0;
1724 uhdr->urb_len = SWAPLONG(uhdr->urb_len);
1725 if (hdr->caplen < 40)
1726 return 0;
1727 uhdr->data_len = SWAPLONG(uhdr->data_len);
1728 }
1729 return (0);
1730 }
1731
1732 /*
1733 * Print out packets stored in the file initialized by sf_read_init().
1734 * If cnt > 0, return after 'cnt' packets, otherwise continue until eof.
1735 */
1736 int
1737 pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
1738 {
1739 struct bpf_insn *fcode;
1740 int status = 0;
1741 int n = 0;
1742
1743 while (status == 0) {
1744 struct pcap_pkthdr h;
1745
1746 /*
1747 * Has "pcap_breakloop()" been called?
1748 * If so, return immediately - if we haven't read any
1749 * packets, clear the flag and return -2 to indicate
1750 * that we were told to break out of the loop, otherwise
1751 * leave the flag set, so that the *next* call will break
1752 * out of the loop without having read any packets, and
1753 * return the number of packets we've processed so far.
1754 */
1755 if (p->break_loop) {
1756 if (n == 0) {
1757 p->break_loop = 0;
1758 return (-2);
1759 } else
1760 return (n);
1761 }
1762
1763 status = sf_next_packet(p, &h, p->buffer, p->bufsize);
1764 if (status) {
1765 if (status == 1)
1766 return (0);
1767 return (status);
1768 }
1769
1770 if ((fcode = p->fcode.bf_insns) == NULL ||
1771 bpf_filter(fcode, p->buffer, h.len, h.caplen)) {
1772 (*callback)(user, &h, p->buffer);
1773 if (++n >= cnt && cnt > 0)
1774 break;
1775 }
1776 }
1777 /*XXX this breaks semantics tcpslice expects */
1778 return (n);
1779 }
1780
1781 /*
1782 * Output a packet to the initialized dump file.
1783 */
1784 void
1785 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
1786 {
1787 register FILE *f;
1788 struct pcap_sf_pkthdr sf_hdr;
1789
1790 f = (FILE *)user;
1791 sf_hdr.ts.tv_sec = h->ts.tv_sec;
1792 sf_hdr.ts.tv_usec = h->ts.tv_usec;
1793 sf_hdr.caplen = h->caplen;
1794 sf_hdr.len = h->len;
1795 /* XXX we should check the return status */
1796 (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
1797 (void)fwrite(sp, h->caplen, 1, f);
1798 }
1799
1800 static pcap_dumper_t *
1801 pcap_setup_dump(pcap_t *p, int linktype, FILE *f, const char *fname)
1802 {
1803
1804 #if defined(WIN32) || defined(MSDOS)
1805 /*
1806 * If we're writing to the standard output, put it in binary
1807 * mode, as savefiles are binary files.
1808 *
1809 * Otherwise, we turn off buffering.
1810 * XXX - why? And why not on the standard output?
1811 */
1812 if (f == stdout)
1813 SET_BINMODE(f);
1814 else
1815 setbuf(f, NULL);
1816 #endif
1817 if (sf_write_header(f, linktype, p->tzoff, p->snapshot) == -1) {
1818 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Can't write to %s: %s",
1819 fname, pcap_strerror(errno));
1820 if (f != stdout)
1821 (void)fclose(f);
1822 return (NULL);
1823 }
1824 return ((pcap_dumper_t *)f);
1825 }
1826
1827 /*
1828 * Initialize so that sf_write() will output to the file named 'fname'.
1829 */
1830 pcap_dumper_t *
1831 pcap_dump_open(pcap_t *p, const char *fname)
1832 {
1833 FILE *f;
1834 int linktype;
1835
1836 /*
1837 * If this pcap_t hasn't been activated, it doesn't have a
1838 * link-layer type, so we can't use it.
1839 */
1840 if (!p->activated) {
1841 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1842 "%s: not-yet-activated pcap_t passed to pcap_dump_open",
1843 fname);
1844 return (NULL);
1845 }
1846 linktype = dlt_to_linktype(p->linktype);
1847 if (linktype == -1) {
1848 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1849 "%s: link-layer type %d isn't supported in savefiles",
1850 fname, p->linktype);
1851 return (NULL);
1852 }
1853 linktype |= p->linktype_ext;
1854
1855 if (fname[0] == '-' && fname[1] == '\0') {
1856 f = stdout;
1857 fname = "standard output";
1858 } else {
1859 #if !defined(WIN32) && !defined(MSDOS)
1860 f = fopen(fname, "w");
1861 #else
1862 f = fopen(fname, "wb");
1863 #endif
1864 if (f == NULL) {
1865 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
1866 fname, pcap_strerror(errno));
1867 return (NULL);
1868 }
1869 }
1870 return (pcap_setup_dump(p, linktype, f, fname));
1871 }
1872
1873 /*
1874 * Initialize so that sf_write() will output to the given stream.
1875 */
1876 pcap_dumper_t *
1877 pcap_dump_fopen(pcap_t *p, FILE *f)
1878 {
1879 int linktype;
1880
1881 linktype = dlt_to_linktype(p->linktype);
1882 if (linktype == -1) {
1883 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1884 "stream: link-layer type %d isn't supported in savefiles",
1885 p->linktype);
1886 return (NULL);
1887 }
1888 linktype |= p->linktype_ext;
1889
1890 return (pcap_setup_dump(p, linktype, f, "stream"));
1891 }
1892
1893 FILE *
1894 pcap_dump_file(pcap_dumper_t *p)
1895 {
1896 return ((FILE *)p);
1897 }
1898
1899 long
1900 pcap_dump_ftell(pcap_dumper_t *p)
1901 {
1902 return (ftell((FILE *)p));
1903 }
1904
1905 int
1906 pcap_dump_flush(pcap_dumper_t *p)
1907 {
1908
1909 if (fflush((FILE *)p) == EOF)
1910 return (-1);
1911 else
1912 return (0);
1913 }
1914
1915 void
1916 pcap_dump_close(pcap_dumper_t *p)
1917 {
1918
1919 #ifdef notyet
1920 if (ferror((FILE *)p))
1921 return-an-error;
1922 /* XXX should check return from fclose() too */
1923 #endif
1924 (void)fclose((FILE *)p);
1925 }
[mirror] the LIBpcap interface to various kernel packet capture mechanism