1/*
2 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
--- 16 unchanged lines hidden (view full) ---
25 * Used to save the received packet headers, after filtering, to
26 * a file, and then read them later.
27 * The first record in the file contains saved values for the machine
28 * dependent values so we can print the dump file on any architecture.
29 */
30
31#ifndef lint
32static const char rcsid[] _U_ =
33 "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.126.2.30 2007/08/14 20:57:49 guy Exp $ (LBL)";
34#endif
35
36#ifdef HAVE_CONFIG_H
37#include "config.h"
38#endif
39
40#include <errno.h>
41#include <memory.h>
--- 383 unchanged lines hidden (view full) ---
425 * like interface index, interface name
426 * before standard Ethernet, PPP, Frelay & C-HDLC Frames
427 */
428#define LINKTYPE_JUNIPER_ETHER 178
429#define LINKTYPE_JUNIPER_PPP 179
430#define LINKTYPE_JUNIPER_FRELAY 180
431#define LINKTYPE_JUNIPER_CHDLC 181
432
433/*
434 * Multi Link Frame Relay (FRF.16)
435 */
436#define LINKTYPE_MFR 182
437
438/*
439 * Juniper-private data link type, as per request from
440 * Hannes Gredler <hannes@juniper.net>.
441 * The DLT_ is used for internal communication with a
442 * voice Adapter Card (PIC)
443 */
444#define LINKTYPE_JUNIPER_VP 183
445
446/*
447 * Arinc 429 frames.
448 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
449 * Every frame contains a 32bit A429 label.
450 * More documentation on Arinc 429 can be found at
451 * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
452 */
453#define LINKTYPE_A429 184
454
455/*
456 * Arinc 653 Interpartition Communication messages.
457 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
458 * Please refer to the A653-1 standard for more information.
459 */
460#define LINKTYPE_A653_ICM 185
461
462/*
463 * USB packets, beginning with a USB setup header; requested by
464 * Paolo Abeni <paolo.abeni@email.it>.
465 */
466#define LINKTYPE_USB 186
467
468/*
469 * Bluetooth HCI UART transport layer (part H:4); requested by
470 * Paolo Abeni.
471 */
472#define LINKTYPE_BLUETOOTH_HCI_H4 187
473
474/*
475 * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
476 * <cruz_petagay@bah.com>.
477 */
478#define LINKTYPE_IEEE802_16_MAC_CPS 188
479
480/*
481 * USB packets, beginning with a Linux USB header; requested by
482 * Paolo Abeni <paolo.abeni@email.it>.
483 */
484#define LINKTYPE_USB_LINUX 189
485
486/*
487 * Controller Area Network (CAN) v. 2.0B packets.
488 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
489 * Used to dump CAN packets coming from a CAN Vector board.
490 * More documentation on the CAN v2.0B frames can be found at
491 * http://www.can-cia.org/downloads/?269
492 */
493#define LINKTYPE_CAN20B 190
494
495/*
496 * IEEE 802.15.4, with address fields padded, as is done by Linux
497 * drivers; requested by Juergen Schimmer.
498 */
499#define LINKTYPE_IEEE802_15_4_LINUX 191
500
501/*
502 * Per Packet Information encapsulated packets.
503 * LINKTYPE_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
504 */
505#define LINKTYPE_PPI 192
506
507/*
508 * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
509 * requested by Charles Clancy.
510 */
511#define LINKTYPE_IEEE802_16_MAC_CPS_RADIO 193
512
513/*
514 * Juniper-private data link type, as per request from
515 * Hannes Gredler <hannes@juniper.net>.
516 * The DLT_ is used for internal communication with a
517 * integrated service module (ISM).
518 */
519#define LINKTYPE_JUNIPER_ISM 194
520
521/*
522 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
523 * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
524 */
525#define LINKTYPE_IEEE802_15_4 195
526
527/*
528 * Various link-layer types, with a pseudo-header, for SITA
529 * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
530 */
531#define LINKTYPE_SITA 196
532
533/*
534 * Various link-layer types, with a pseudo-header, for Endace DAG cards;
535 * encapsulates Endace ERF records. Requested by Stephen Donnelly
536 * <stephen@endace.com>.
537 */
538#define LINKTYPE_ERF 197
539
540/*
541 * Special header prepended to Ethernet packets when capturing from a
542 * u10 Networks board. Requested by Phil Mulholland
543 * <phil@u10networks.com>.
544 */
545#define LINKTYPE_RAIF1 198
546
547/*
548 * IPMB packet for IPMI, beginning with the I2C slave address, followed
549 * by the netFn and LUN, etc.. Requested by Chanthy Toeung
550 * <chanthy.toeung@ca.kontron.com>.
551 */
552#define LINKTYPE_IPMB 199
553
554
555static struct linktype_map {
556 int dlt;
557 int linktype;
558} map[] = {
559 /*
560 * These DLT_* codes have LINKTYPE_* codes with values identical
561 * to the values of the corresponding DLT_* code.
562 */
--- 189 unchanged lines hidden (view full) ---
752 { DLT_LINUX_LAPD, LINKTYPE_LINUX_LAPD },
753
754 /* Juniper meta-information before Ether, PPP, Frame Relay, C-HDLC Frames */
755 { DLT_JUNIPER_ETHER, LINKTYPE_JUNIPER_ETHER },
756 { DLT_JUNIPER_PPP, LINKTYPE_JUNIPER_PPP },
757 { DLT_JUNIPER_FRELAY, LINKTYPE_JUNIPER_FRELAY },
758 { DLT_JUNIPER_CHDLC, LINKTYPE_JUNIPER_CHDLC },
759
760 /* Multi Link Frame Relay (FRF.16) */
761 { DLT_MFR, LINKTYPE_MFR },
762
763 /* Juniper Voice PIC */
764 { DLT_JUNIPER_VP, LINKTYPE_JUNIPER_VP },
765
766 /* Controller Area Network (CAN) v2.0B */
767 { DLT_A429, LINKTYPE_A429 },
768
769 /* Arinc 653 Interpartition Communication messages */
770 { DLT_A653_ICM, LINKTYPE_A653_ICM },
771
772 /* USB */
773 { DLT_USB, LINKTYPE_USB },
774
775 /* Bluetooth HCI UART transport layer */
776 { DLT_BLUETOOTH_HCI_H4, LINKTYPE_BLUETOOTH_HCI_H4 },
777
778 /* IEEE 802.16 MAC Common Part Sublayer */
779 { DLT_IEEE802_16_MAC_CPS, LINKTYPE_IEEE802_16_MAC_CPS },
780
781 /* USB with Linux header */
782 { DLT_USB_LINUX, LINKTYPE_USB_LINUX },
783
784 /* Controller Area Network (CAN) v2.0B */
785 { DLT_CAN20B, LINKTYPE_CAN20B },
786
787 /* IEEE 802.15.4 with address fields padded */
788 { DLT_IEEE802_15_4_LINUX, LINKTYPE_IEEE802_15_4_LINUX },
789
790 /* Per Packet Information encapsulated packets */
791 { DLT_PPI, LINKTYPE_PPI },
792
793 /* IEEE 802.16 MAC Common Part Sublayer plus radiotap header */
794 { DLT_IEEE802_16_MAC_CPS_RADIO, LINKTYPE_IEEE802_16_MAC_CPS_RADIO },
795
796 /* Juniper Voice ISM */
797 { DLT_JUNIPER_ISM, LINKTYPE_JUNIPER_ISM },
798
799 /* IEEE 802.15.4 exactly as it appears in the spec */
800 { DLT_IEEE802_15_4, LINKTYPE_IEEE802_15_4 },
801
802 /* Various link-layer types for SITA */
803 { DLT_SITA, LINKTYPE_SITA },
804
805 /* Various link-layer types for Endace */
806 { DLT_ERF, LINKTYPE_ERF },
807
808 /* Special header for u10 Networks boards */
809 { DLT_RAIF1, LINKTYPE_RAIF1 },
810
811 /* IPMB */
812 { DLT_IPMB, LINKTYPE_IPMB },
813
814 { -1, -1 }
815};
816
817static int
818dlt_to_linktype(int dlt)
819{
820 int i;
821
--- 218 unchanged lines hidden (view full) ---
1040 p->sf.hdrsize = sizeof(struct pcap_sf_pkthdr);
1041 if (hdr.version_major < PCAP_VERSION_MAJOR) {
1042 snprintf(errbuf, PCAP_ERRBUF_SIZE, "archaic file format");
1043 goto bad;
1044 }
1045 p->tzoff = hdr.thiszone;
1046 p->snapshot = hdr.snaplen;
1047 p->linktype = linktype_to_dlt(hdr.linktype);
1048 if (magic == KUZNETZOV_TCPDUMP_MAGIC && p->linktype == DLT_EN10MB) {
1049 /*
1050 * This capture might have been done in raw mode or cooked
1051 * mode.
1052 *
1053 * If it was done in cooked mode, p->snapshot was passed
1054 * to recvfrom() as the buffer size, meaning that the
1055 * most packet data that would be copied would be
1056 * p->snapshot. However, a faked Ethernet header would
1057 * then have been added to it, so the most data that would
1058 * be in a packet in the file would be p->snapshot + 14.
1059 *
1060 * We can't easily tell whether the capture was done in
1061 * raw mode or cooked mode, so we'll assume it was
1062 * cooked mode, and add 14 to the snapshot length. That
1063 * means that, for a raw capture, the snapshot length will
1064 * be misleading if you use it to figure out why a capture
1065 * doesn't have all the packet data, but there's not much
1066 * we can do to avoid that.
1067 */
1068 p->snapshot += 14;
1069 }
1070 p->sf.rfile = fp;
1071#ifndef WIN32
1072 p->bufsize = hdr.snaplen;
1073#else
1074 /* Allocate the space for pcap_pkthdr as well. It will be used by pcap_read_ex */
1075 p->bufsize = hdr.snaplen+sizeof(struct pcap_pkthdr);
1076#endif
1077
--- 291 unchanged lines hidden (view full) ---
1369
1370 f = (FILE *)user;
1371 sf_hdr.ts.tv_sec = h->ts.tv_sec;
1372 sf_hdr.ts.tv_usec = h->ts.tv_usec;
1373 sf_hdr.caplen = h->caplen;
1374 sf_hdr.len = h->len;
1375 /* XXX we should check the return status */
1376 (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
1377 (void)fwrite(sp, h->caplen, 1, f);
1378}
1379
1380static pcap_dumper_t *
1381pcap_setup_dump(pcap_t *p, int linktype, FILE *f, const char *fname)
1382{
1383
1384#if defined(WIN32) || defined(MSDOS)
1385 /*
--- 108 unchanged lines hidden ---
2 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
--- 16 unchanged lines hidden (view full) ---
25 * Used to save the received packet headers, after filtering, to
26 * a file, and then read them later.
27 * The first record in the file contains saved values for the machine
28 * dependent values so we can print the dump file on any architecture.
29 */
30
31#ifndef lint
32static const char rcsid[] _U_ =
33 "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.126.2.30 2007/08/14 20:57:49 guy Exp $ (LBL)";
34#endif
35
36#ifdef HAVE_CONFIG_H
37#include "config.h"
38#endif
39
40#include <errno.h>
41#include <memory.h>
--- 383 unchanged lines hidden (view full) ---
425 * like interface index, interface name
426 * before standard Ethernet, PPP, Frelay & C-HDLC Frames
427 */
428#define LINKTYPE_JUNIPER_ETHER 178
429#define LINKTYPE_JUNIPER_PPP 179
430#define LINKTYPE_JUNIPER_FRELAY 180
431#define LINKTYPE_JUNIPER_CHDLC 181
432
433/*
434 * Multi Link Frame Relay (FRF.16)
435 */
436#define LINKTYPE_MFR 182
437
438/*
439 * Juniper-private data link type, as per request from
440 * Hannes Gredler <hannes@juniper.net>.
441 * The DLT_ is used for internal communication with a
442 * voice Adapter Card (PIC)
443 */
444#define LINKTYPE_JUNIPER_VP 183
445
446/*
447 * Arinc 429 frames.
448 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
449 * Every frame contains a 32bit A429 label.
450 * More documentation on Arinc 429 can be found at
451 * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
452 */
453#define LINKTYPE_A429 184
454
455/*
456 * Arinc 653 Interpartition Communication messages.
457 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
458 * Please refer to the A653-1 standard for more information.
459 */
460#define LINKTYPE_A653_ICM 185
461
462/*
463 * USB packets, beginning with a USB setup header; requested by
464 * Paolo Abeni <paolo.abeni@email.it>.
465 */
466#define LINKTYPE_USB 186
467
468/*
469 * Bluetooth HCI UART transport layer (part H:4); requested by
470 * Paolo Abeni.
471 */
472#define LINKTYPE_BLUETOOTH_HCI_H4 187
473
474/*
475 * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
476 * <cruz_petagay@bah.com>.
477 */
478#define LINKTYPE_IEEE802_16_MAC_CPS 188
479
480/*
481 * USB packets, beginning with a Linux USB header; requested by
482 * Paolo Abeni <paolo.abeni@email.it>.
483 */
484#define LINKTYPE_USB_LINUX 189
485
486/*
487 * Controller Area Network (CAN) v. 2.0B packets.
488 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
489 * Used to dump CAN packets coming from a CAN Vector board.
490 * More documentation on the CAN v2.0B frames can be found at
491 * http://www.can-cia.org/downloads/?269
492 */
493#define LINKTYPE_CAN20B 190
494
495/*
496 * IEEE 802.15.4, with address fields padded, as is done by Linux
497 * drivers; requested by Juergen Schimmer.
498 */
499#define LINKTYPE_IEEE802_15_4_LINUX 191
500
501/*
502 * Per Packet Information encapsulated packets.
503 * LINKTYPE_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
504 */
505#define LINKTYPE_PPI 192
506
507/*
508 * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
509 * requested by Charles Clancy.
510 */
511#define LINKTYPE_IEEE802_16_MAC_CPS_RADIO 193
512
513/*
514 * Juniper-private data link type, as per request from
515 * Hannes Gredler <hannes@juniper.net>.
516 * The DLT_ is used for internal communication with a
517 * integrated service module (ISM).
518 */
519#define LINKTYPE_JUNIPER_ISM 194
520
521/*
522 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
523 * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
524 */
525#define LINKTYPE_IEEE802_15_4 195
526
527/*
528 * Various link-layer types, with a pseudo-header, for SITA
529 * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
530 */
531#define LINKTYPE_SITA 196
532
533/*
534 * Various link-layer types, with a pseudo-header, for Endace DAG cards;
535 * encapsulates Endace ERF records. Requested by Stephen Donnelly
536 * <stephen@endace.com>.
537 */
538#define LINKTYPE_ERF 197
539
540/*
541 * Special header prepended to Ethernet packets when capturing from a
542 * u10 Networks board. Requested by Phil Mulholland
543 * <phil@u10networks.com>.
544 */
545#define LINKTYPE_RAIF1 198
546
547/*
548 * IPMB packet for IPMI, beginning with the I2C slave address, followed
549 * by the netFn and LUN, etc.. Requested by Chanthy Toeung
550 * <chanthy.toeung@ca.kontron.com>.
551 */
552#define LINKTYPE_IPMB 199
553
554
555static struct linktype_map {
556 int dlt;
557 int linktype;
558} map[] = {
559 /*
560 * These DLT_* codes have LINKTYPE_* codes with values identical
561 * to the values of the corresponding DLT_* code.
562 */
--- 189 unchanged lines hidden (view full) ---
752 { DLT_LINUX_LAPD, LINKTYPE_LINUX_LAPD },
753
754 /* Juniper meta-information before Ether, PPP, Frame Relay, C-HDLC Frames */
755 { DLT_JUNIPER_ETHER, LINKTYPE_JUNIPER_ETHER },
756 { DLT_JUNIPER_PPP, LINKTYPE_JUNIPER_PPP },
757 { DLT_JUNIPER_FRELAY, LINKTYPE_JUNIPER_FRELAY },
758 { DLT_JUNIPER_CHDLC, LINKTYPE_JUNIPER_CHDLC },
759
760 /* Multi Link Frame Relay (FRF.16) */
761 { DLT_MFR, LINKTYPE_MFR },
762
763 /* Juniper Voice PIC */
764 { DLT_JUNIPER_VP, LINKTYPE_JUNIPER_VP },
765
766 /* Controller Area Network (CAN) v2.0B */
767 { DLT_A429, LINKTYPE_A429 },
768
769 /* Arinc 653 Interpartition Communication messages */
770 { DLT_A653_ICM, LINKTYPE_A653_ICM },
771
772 /* USB */
773 { DLT_USB, LINKTYPE_USB },
774
775 /* Bluetooth HCI UART transport layer */
776 { DLT_BLUETOOTH_HCI_H4, LINKTYPE_BLUETOOTH_HCI_H4 },
777
778 /* IEEE 802.16 MAC Common Part Sublayer */
779 { DLT_IEEE802_16_MAC_CPS, LINKTYPE_IEEE802_16_MAC_CPS },
780
781 /* USB with Linux header */
782 { DLT_USB_LINUX, LINKTYPE_USB_LINUX },
783
784 /* Controller Area Network (CAN) v2.0B */
785 { DLT_CAN20B, LINKTYPE_CAN20B },
786
787 /* IEEE 802.15.4 with address fields padded */
788 { DLT_IEEE802_15_4_LINUX, LINKTYPE_IEEE802_15_4_LINUX },
789
790 /* Per Packet Information encapsulated packets */
791 { DLT_PPI, LINKTYPE_PPI },
792
793 /* IEEE 802.16 MAC Common Part Sublayer plus radiotap header */
794 { DLT_IEEE802_16_MAC_CPS_RADIO, LINKTYPE_IEEE802_16_MAC_CPS_RADIO },
795
796 /* Juniper Voice ISM */
797 { DLT_JUNIPER_ISM, LINKTYPE_JUNIPER_ISM },
798
799 /* IEEE 802.15.4 exactly as it appears in the spec */
800 { DLT_IEEE802_15_4, LINKTYPE_IEEE802_15_4 },
801
802 /* Various link-layer types for SITA */
803 { DLT_SITA, LINKTYPE_SITA },
804
805 /* Various link-layer types for Endace */
806 { DLT_ERF, LINKTYPE_ERF },
807
808 /* Special header for u10 Networks boards */
809 { DLT_RAIF1, LINKTYPE_RAIF1 },
810
811 /* IPMB */
812 { DLT_IPMB, LINKTYPE_IPMB },
813
814 { -1, -1 }
815};
816
817static int
818dlt_to_linktype(int dlt)
819{
820 int i;
821
--- 218 unchanged lines hidden (view full) ---
1040 p->sf.hdrsize = sizeof(struct pcap_sf_pkthdr);
1041 if (hdr.version_major < PCAP_VERSION_MAJOR) {
1042 snprintf(errbuf, PCAP_ERRBUF_SIZE, "archaic file format");
1043 goto bad;
1044 }
1045 p->tzoff = hdr.thiszone;
1046 p->snapshot = hdr.snaplen;
1047 p->linktype = linktype_to_dlt(hdr.linktype);
1048 if (magic == KUZNETZOV_TCPDUMP_MAGIC && p->linktype == DLT_EN10MB) {
1049 /*
1050 * This capture might have been done in raw mode or cooked
1051 * mode.
1052 *
1053 * If it was done in cooked mode, p->snapshot was passed
1054 * to recvfrom() as the buffer size, meaning that the
1055 * most packet data that would be copied would be
1056 * p->snapshot. However, a faked Ethernet header would
1057 * then have been added to it, so the most data that would
1058 * be in a packet in the file would be p->snapshot + 14.
1059 *
1060 * We can't easily tell whether the capture was done in
1061 * raw mode or cooked mode, so we'll assume it was
1062 * cooked mode, and add 14 to the snapshot length. That
1063 * means that, for a raw capture, the snapshot length will
1064 * be misleading if you use it to figure out why a capture
1065 * doesn't have all the packet data, but there's not much
1066 * we can do to avoid that.
1067 */
1068 p->snapshot += 14;
1069 }
1070 p->sf.rfile = fp;
1071#ifndef WIN32
1072 p->bufsize = hdr.snaplen;
1073#else
1074 /* Allocate the space for pcap_pkthdr as well. It will be used by pcap_read_ex */
1075 p->bufsize = hdr.snaplen+sizeof(struct pcap_pkthdr);
1076#endif
1077
--- 291 unchanged lines hidden (view full) ---
1369
1370 f = (FILE *)user;
1371 sf_hdr.ts.tv_sec = h->ts.tv_sec;
1372 sf_hdr.ts.tv_usec = h->ts.tv_usec;
1373 sf_hdr.caplen = h->caplen;
1374 sf_hdr.len = h->len;
1375 /* XXX we should check the return status */
1376 (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
1377 (void)fwrite(sp, h->caplen, 1, f);
1378}
1379
1380static pcap_dumper_t *
1381pcap_setup_dump(pcap_t *p, int linktype, FILE *f, const char *fname)
1382{
1383
1384#if defined(WIN32) || defined(MSDOS)
1385 /*
--- 108 unchanged lines hidden ---