kopia lustrzana https://github.com/F5OEO/tstools
168 wiersze
3.8 KiB
C
168 wiersze
3.8 KiB
C
/* pcap.h */
|
||
/*
|
||
* Read pcap files
|
||
*
|
||
* Documentation from <http://wiki.wireshark.org/Development/LibpcapFileFormat>
|
||
*
|
||
* ***** BEGIN LICENSE BLOCK *****
|
||
* Version: MPL 1.1
|
||
*
|
||
* The contents of this file are subject to the Mozilla Public License Version
|
||
* 1.1 (the "License"); you may not use this file except in compliance with
|
||
* the License. You may obtain a copy of the License at
|
||
* http://www.mozilla.org/MPL/
|
||
*
|
||
* Software distributed under the License is distributed on an "AS IS" basis,
|
||
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
|
||
* for the specific language governing rights and limitations under the
|
||
* License.
|
||
*
|
||
* The Original Code is the MPEG TS, PS and ES tools.
|
||
*
|
||
* The Initial Developer of the Original Code is Amino Communications Ltd.
|
||
* Portions created by the Initial Developer are Copyright (C) 2008
|
||
* the Initial Developer. All Rights Reserved.
|
||
*
|
||
* Contributor(s):
|
||
* Richard Watts, Kynesim <rrw@kynesim.co.uk>
|
||
*
|
||
* ***** END LICENSE BLOCK *****
|
||
*/
|
||
|
||
#ifndef _pcap_h
|
||
#define _pcap_h
|
||
|
||
#include <stdio.h>
|
||
#include <stdlib.h>
|
||
#include "compat.h"
|
||
|
||
//! Out of memory.
|
||
#define PCAP_ERR_OUT_OF_MEMORY (-8)
|
||
|
||
//! File read error
|
||
#define PCAP_ERR_FILE_READ (-9)
|
||
|
||
//! Invalid magic
|
||
#define PCAP_ERR_INVALID_MAGIC (-10)
|
||
|
||
#define PCAP_ERR_BAD_LENGTH (-11);
|
||
|
||
#define PCAP_ERR_BAD_INTERFACE_ID (-12);
|
||
|
||
/*! File header */
|
||
typedef struct pcap_hdr_s
|
||
{
|
||
/*! Magic number - 0xa1b2c3d4 means no swap needed,
|
||
* 0xd4c3b2a1 means we'll need to swap.
|
||
*/
|
||
uint32_t magic_number;
|
||
|
||
/*! Major version number (currently 2) */
|
||
uint16_t version_major;
|
||
|
||
/*! Minor version number (4 + ) */
|
||
uint16_t version_minor;
|
||
|
||
/*! GMT to local-time correction, in s */
|
||
int32_t thiszone;
|
||
|
||
/*! Accuracy of timestamps. In practice, always 0 */
|
||
uint32_t sigfigs;
|
||
|
||
/*! Snapshot length (typically 65535 + but might be limited) */
|
||
uint32_t snaplen;
|
||
|
||
|
||
/* These are network types - equivalent to WTAP_ENCAP_XXX in
|
||
* libpcap.c . We only care about a few ..
|
||
*/
|
||
|
||
#define PCAP_NETWORK_TYPE_NONE 0
|
||
#define PCAP_NETWORK_TYPE_ETHERNET 1
|
||
|
||
/*! Network type: Ethernet = 1 .. */
|
||
uint32_t network;
|
||
|
||
} pcap_hdr_t;
|
||
|
||
#define SIZEOF_PCAP_HDR_ON_DISC (4 + 2 + 2 + 4 + 4 + 4 + 4)
|
||
|
||
|
||
/*! Packet header */
|
||
typedef struct pcaprec_hdr_s
|
||
{
|
||
/*! Timestamp seconds */
|
||
uint32_t ts_sec;
|
||
|
||
/*! Timetamp uS */
|
||
uint32_t ts_usec;
|
||
|
||
/*! Number of octets saved after the header */
|
||
uint32_t incl_len;
|
||
|
||
/*! Original packet length */
|
||
uint32_t orig_len;
|
||
|
||
} pcaprec_hdr_t;
|
||
|
||
#define SIZEOF_PCAPREC_HDR_ON_DISC (4 + 4 + 4 + 4)
|
||
|
||
|
||
typedef struct pcapng_hdr_interface_s
|
||
{
|
||
uint16_t link_type;
|
||
uint32_t snap_len;
|
||
} pcapng_hdr_interface_t;
|
||
|
||
/*! Used to store I/O parameters for pcap I/O */
|
||
typedef struct _pcap_io_ctx
|
||
{
|
||
// pcap or pcapng?
|
||
int is_ng;
|
||
|
||
/*! Endianness of the file */
|
||
int is_be;
|
||
|
||
/*! The FILE* for this file */
|
||
FILE *file;
|
||
|
||
uint32_t if_count;
|
||
uint32_t if_size;
|
||
pcapng_hdr_interface_t * interfaces;
|
||
|
||
} PCAP_reader_t;
|
||
|
||
typedef struct _pcap_io_ctx *PCAP_reader_p;
|
||
#define SIZEOF_PCAP_READER sizeof(struct _pcap_io_ctx)
|
||
|
||
/*! Attempt to open a pcap file and read the header.
|
||
*
|
||
* \param filename IN Filename or NULL for stdin.
|
||
* \return 0 on success, non-zero on failure.
|
||
*/
|
||
int pcap_open(PCAP_reader_p *ctx_p, pcap_hdr_t *out_hdr,
|
||
const char *filename);
|
||
|
||
|
||
/*! Read the next packet from a pcap file. The returned data is
|
||
* malloc()d and must be free()d. If we fail, returned data will
|
||
* be NULL.
|
||
*
|
||
* \return 1 on success, 0 if we've reached EOF, < 0 on error.
|
||
*/
|
||
int pcap_read_next(PCAP_reader_p ctx_p, pcaprec_hdr_t *out_hdr,
|
||
uint8_t **out_data,
|
||
uint32_t *out_len);
|
||
|
||
/*! Close the pcap file */
|
||
int pcap_close(PCAP_reader_p * const ctx_p);
|
||
|
||
#endif
|
||
|
||
// Local Variables:
|
||
// tab-width: 8
|
||
// indent-tabs-mode: nil
|
||
// c-basic-offset: 2
|
||
// End:
|
||
// vim: set tabstop=8 shiftwidth=2 expandtab:
|