Wireshark-dev: [Wireshark-dev] Why the name "Wiretap"?
From: robert.bullen@xxxxxxxxxx
Date: Fri, 28 Sep 2012 14:59:51 -0500
I've always found it confusing that a library
responsible for reading and writing trace files is called wiretap, since
it deals with neither the wire nor tapping. Could someone fill me in on
the history of that name?
Robert Bullen
Network Application Analysis (NAA)
1 Meridian Crossing
Richfield, MN 55423-3978
Office: 612-973-6216
Email: robert.bullen@xxxxxxxxxx
From: wireshark-dev-request@xxxxxxxxxxxxx
To: wireshark-dev@xxxxxxxxxxxxx
Date: 09/28/2012 02:01 PM
Subject: Wireshark-dev Digest, Vol 76, Issue 44
Sent by: wireshark-dev-bounces@xxxxxxxxxxxxx
Send Wireshark-dev mailing list submissions to
wireshark-dev@xxxxxxxxxxxxx
To subscribe or unsubscribe via the World Wide Web, visit
https://wireshark.org/mailman/listinfo/wireshark-dev
or, via email, send a message with subject or body 'help' to
wireshark-dev-request@xxxxxxxxxxxxx
You can reach the person managing the list at
wireshark-dev-owner@xxxxxxxxxxxxx
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Wireshark-dev digest..."
Today's Topics:
1. converting pcapng to pcap (Albert Lo)
2. Re: Do Windows compilers require WS_VAR_IMPORT in .h files
(Joerg Mayer)
3. Re: converting pcapng to pcap (Jakub Zawadzki)
4. Re: Building for Windows without zlib? (Guy Harris)
5. Re: converting pcapng to pcap (Guy Harris)
6. Re: converting pcapng to pcap (albert)
7. Re: [Wireshark-commits] rev 45191: /trunk/
/trunk/epan/dissectors/: packet-btsap.c /trunk/: CMakeLists.txt
(Guy Harris)
----------------------------------------------------------------------
Message: 1
Date: Fri, 28 Sep 2012 17:39:01 +0000
From: Albert Lo <ALo@xxxxxxxxxxxxxx>
To: "wireshark-dev@xxxxxxxxxxxxx" <wireshark-dev@xxxxxxxxxxxxx>
Subject: [Wireshark-dev] converting pcapng to pcap
Message-ID:
<E5E4E6B17F036444A5A4D70F62B8739922CB2290@xxxxxxxxxxxxxxxxxxxx>
Content-Type: text/plain; charset="us-ascii"
I would like to know where I can find the source files for editcap.
What libpcap API's are being called to convert .pcapng to .pcap with the following cmd?
>editcap -F libpcap -T ether file.pcapng file.pcap
Thx.
Cheers,
Albert
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.wireshark.org/lists/wireshark-dev/attachments/20120928/f628a007/attachment.html>
------------------------------
Message: 2
Date: Fri, 28 Sep 2012 19:40:29 +0200
From: Joerg Mayer <jmayer@xxxxxxxxx>
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-dev] Do Windows compilers require
WS_VAR_IMPORT in .h files
Message-ID: <20120928174029.GD8105@xxxxxxxxxxxxxx>
Content-Type: text/plain; charset="utf-8"
Hello Pascal,
On Fri, Sep 28, 2012 at 05:25:41PM +0200, Pascal Quantin wrote:
> 2012/9/28 Joerg Mayer <jmayer@xxxxxxxxx>
> > I'm working on building wireshark with gcc with -fvisibility=hidden. This
> > will mostly mimic the behaviour already on Windows. The gcc attribute
> > to change the visibility causes errors when used in .h files (well, in
> > declarations without a the object).
> > I have replaced WS_VAR_IMPORT with extern in .h files. Can someone on
> > Windows
> > please test whether this still works?
>
> it fails with the following errors (MSVC2010EE 32 bits):
Can you please apply the attached patch on top of the previous one to check
whether this fixed the compile problem in packet-dcom.c?
If it does, I will rework the whole patch in the same manner.
Thanks for testing!
Ciao
J?rg
--
Joerg Mayer <jmayer@xxxxxxxxx>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dcom-dot-c.patch
Type: text/x-diff
Size: 805 bytes
Desc: not available
URL: <http://www.wireshark.org/lists/wireshark-dev/attachments/20120928/a37f0f59/attachment.patch>
------------------------------
Message: 3
Date: Fri, 28 Sep 2012 19:54:09 +0200
From: Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx>
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-dev] converting pcapng to pcap
Message-ID: <20120928175409.GE1989@xxxxxxxxxxxx>
Content-Type: text/plain; charset=us-ascii
Hi,
On Fri, Sep 28, 2012 at 05:39:01PM +0000, Albert Lo wrote:
> What libpcap API's are being called to convert .pcapng to .pcap with the following cmd?
We use our own library (wiretap) to read and write capture files.
------------------------------
Message: 4
Date: Fri, 28 Sep 2012 11:05:22 -0700
From: Guy Harris <guy@xxxxxxxxxxxx>
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-dev] Building for Windows without zlib?
Message-ID: <6A5D75F4-6762-4A3F-B456-006B284110F1@xxxxxxxxxxxx>
Content-Type: text/plain; charset=us-ascii
On Sep 28, 2012, at 7:47 AM, robert.bullen@xxxxxxxxxx wrote:
> I build Wireshark for Windows without zlib. It works faster, but I think that is more the result of consuming less memory than an actual speed increase.
At least with the new compressed-file code as of 1.6, it shouldn't consume more memory (other than for zlib itself, which shouldn't be invoked for uncompressed files except when the file is opened, and maybe for a few data structure members) for an uncompressed file. If it's doing that, file a bug.
> In addition, it allows files larger than 2 GB to be read (at least that used to be a reason; not sure if it is still valid).
That should be fixed in the Wiretap library as of 1.6 - the new code for reading files doesn't use the zlib I/O routines, and uses routines that should support 64-bit file offsets if the underlying OS does (which includes 64-bit platforms and, I think, most if not all recent versions of various UN*Xes, and NT versions of Windows).
However, a file larger than 2GB might has enough packets that the frame_data structures might fill up a 32-bit address space, and there's a bug, fixed only recently, where, at least on Windows, we were imposing 32-bit limits on 64-bit address spaces.
------------------------------
Message: 5
Date: Fri, 28 Sep 2012 11:11:14 -0700
From: Guy Harris <guy@xxxxxxxxxxxx>
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-dev] converting pcapng to pcap
Message-ID: <1AD03A96-D583-434D-840C-DF3A0A067F66@xxxxxxxxxxxx>
Content-Type: text/plain; charset=us-ascii
On Sep 28, 2012, at 10:39 AM, Albert Lo <ALo@xxxxxxxxxxxxxx> wrote:
> I would like to know where I can find the source files for editcap.
> What libpcap API's are being called to convert .pcapng to .pcap with the following cmd?
>
> >editcap -F libpcap -T ether file.pcapng file.pcap
As Jakub noted, we don't use libpcap to read or write capture files.
However, if you convert pcap-ng to pcap with the command
tcpdump -r file.pcapng -w file.pcap
on a system with libpcap 1.1.0 or later, the APIs used are
pcap_open_offline(), to open the input file;
pcap_loop(), to read the packets;
pcap_close(), to close the input file;
pcap_dump_open(), to open the output file;
pcap_dump(), to write to the output file;
pcap_dump_close(), to close the output file.
That will, of course, only work if the file can actually be converted to pcap without damaging it, i.e. if all the interfaces in the pcap-ng file have the same link-layer type. If they don't, the file cannot be represented in a pcap file in any form that will actually give the write answer if you try to read it (so "-T ether" isn't going to fix that problem with editcap).
------------------------------
Message: 6
Date: Fri, 28 Sep 2012 18:43:29 +0000 (UTC)
From: albert <alo@xxxxxxxxxxxxxx>
To: wireshark-dev@xxxxxxxxxxxxx
Subject: Re: [Wireshark-dev] converting pcapng to pcap
Message-ID: <loom.20120928T203756-894@xxxxxxxxxxxxxx>
Content-Type: text/plain; charset=us-ascii
Guy Harris <guy@...> writes:
>
>
> However, if you convert pcap-ng to pcap with the command
>
> tcpdump -r file.pcapng -w file.pcap
>
> on a system with libpcap 1.1.0 or later, the APIs used are
>
> pcap_open_offline(), to open the input file;
>
> pcap_loop(), to read the packets;
>
> pcap_close(), to close the input file;
>
> pcap_dump_open(), to open the output file;
>
> pcap_dump(), to write to the output file;
>
> pcap_dump_close(), to close the output file.
>
Thank you for the prompt response.
If you could tolerate a couple more newbie questions.....
I'm assuming that the meat of the .pcapng to .pcap conversion is done in the
pcap_handler callback for pcap_offline_read(). Is this correct ?
If so, how/where does the callback function for pcap_offline_read() get pre-
assigned?
Much appreciated for your time in this matter.
Cheers,
Albert
------------------------------
Message: 7
Date: Fri, 28 Sep 2012 11:52:45 -0700
From: Guy Harris <guy@xxxxxxxxxxxx>
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-dev] [Wireshark-commits] rev 45191: /trunk/
/trunk/epan/dissectors/: packet-btsap.c /trunk/: CMakeLists.txt
Message-ID: <96273A0C-2E67-4ECF-BC64-F93DF83AC871@xxxxxxxxxxxx>
Content-Type: text/plain; charset=us-ascii
On Sep 28, 2012, at 7:29 AM, Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> wrote:
> I had been assuming that we needed to continue to define HAVE_CONFIG_H
> for backwards compatibility (e.g., for custom dissectors).
I'm not entirely sure what the point of HAVE_CONFIG_H is. Is it to allow code to be "portable" between an autoconfig environment that uses config.h and other build tool environments (including autoconfig-based environments) that use -D's in the compile commands? The autoconf documentation doesn't really give an indication of the purpose of HAVE_CONFIG_H or an indication of what the "best practice" is.
------------------------------
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-dev
End of Wireshark-dev Digest, Vol 76, Issue 44
*********************************************
Robert Bullen
Network Application Analysis (NAA)
1 Meridian Crossing
Richfield, MN 55423-3978
Office: 612-973-6216
Email: robert.bullen@xxxxxxxxxx
From: wireshark-dev-request@xxxxxxxxxxxxx
To: wireshark-dev@xxxxxxxxxxxxx
Date: 09/28/2012 02:01 PM
Subject: Wireshark-dev Digest, Vol 76, Issue 44
Sent by: wireshark-dev-bounces@xxxxxxxxxxxxx
Send Wireshark-dev mailing list submissions to
wireshark-dev@xxxxxxxxxxxxx
To subscribe or unsubscribe via the World Wide Web, visit
https://wireshark.org/mailman/listinfo/wireshark-dev
or, via email, send a message with subject or body 'help' to
wireshark-dev-request@xxxxxxxxxxxxx
You can reach the person managing the list at
wireshark-dev-owner@xxxxxxxxxxxxx
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Wireshark-dev digest..."
Today's Topics:
1. converting pcapng to pcap (Albert Lo)
2. Re: Do Windows compilers require WS_VAR_IMPORT in .h files
(Joerg Mayer)
3. Re: converting pcapng to pcap (Jakub Zawadzki)
4. Re: Building for Windows without zlib? (Guy Harris)
5. Re: converting pcapng to pcap (Guy Harris)
6. Re: converting pcapng to pcap (albert)
7. Re: [Wireshark-commits] rev 45191: /trunk/
/trunk/epan/dissectors/: packet-btsap.c /trunk/: CMakeLists.txt
(Guy Harris)
----------------------------------------------------------------------
Message: 1
Date: Fri, 28 Sep 2012 17:39:01 +0000
From: Albert Lo <ALo@xxxxxxxxxxxxxx>
To: "wireshark-dev@xxxxxxxxxxxxx" <wireshark-dev@xxxxxxxxxxxxx>
Subject: [Wireshark-dev] converting pcapng to pcap
Message-ID:
<E5E4E6B17F036444A5A4D70F62B8739922CB2290@xxxxxxxxxxxxxxxxxxxx>
Content-Type: text/plain; charset="us-ascii"
I would like to know where I can find the source files for editcap.
What libpcap API's are being called to convert .pcapng to .pcap with the following cmd?
>editcap -F libpcap -T ether file.pcapng file.pcap
Thx.
Cheers,
Albert
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.wireshark.org/lists/wireshark-dev/attachments/20120928/f628a007/attachment.html>
------------------------------
Message: 2
Date: Fri, 28 Sep 2012 19:40:29 +0200
From: Joerg Mayer <jmayer@xxxxxxxxx>
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-dev] Do Windows compilers require
WS_VAR_IMPORT in .h files
Message-ID: <20120928174029.GD8105@xxxxxxxxxxxxxx>
Content-Type: text/plain; charset="utf-8"
Hello Pascal,
On Fri, Sep 28, 2012 at 05:25:41PM +0200, Pascal Quantin wrote:
> 2012/9/28 Joerg Mayer <jmayer@xxxxxxxxx>
> > I'm working on building wireshark with gcc with -fvisibility=hidden. This
> > will mostly mimic the behaviour already on Windows. The gcc attribute
> > to change the visibility causes errors when used in .h files (well, in
> > declarations without a the object).
> > I have replaced WS_VAR_IMPORT with extern in .h files. Can someone on
> > Windows
> > please test whether this still works?
>
> it fails with the following errors (MSVC2010EE 32 bits):
Can you please apply the attached patch on top of the previous one to check
whether this fixed the compile problem in packet-dcom.c?
If it does, I will rework the whole patch in the same manner.
Thanks for testing!
Ciao
J?rg
--
Joerg Mayer <jmayer@xxxxxxxxx>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dcom-dot-c.patch
Type: text/x-diff
Size: 805 bytes
Desc: not available
URL: <http://www.wireshark.org/lists/wireshark-dev/attachments/20120928/a37f0f59/attachment.patch>
------------------------------
Message: 3
Date: Fri, 28 Sep 2012 19:54:09 +0200
From: Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx>
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-dev] converting pcapng to pcap
Message-ID: <20120928175409.GE1989@xxxxxxxxxxxx>
Content-Type: text/plain; charset=us-ascii
Hi,
On Fri, Sep 28, 2012 at 05:39:01PM +0000, Albert Lo wrote:
> What libpcap API's are being called to convert .pcapng to .pcap with the following cmd?
We use our own library (wiretap) to read and write capture files.
------------------------------
Message: 4
Date: Fri, 28 Sep 2012 11:05:22 -0700
From: Guy Harris <guy@xxxxxxxxxxxx>
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-dev] Building for Windows without zlib?
Message-ID: <6A5D75F4-6762-4A3F-B456-006B284110F1@xxxxxxxxxxxx>
Content-Type: text/plain; charset=us-ascii
On Sep 28, 2012, at 7:47 AM, robert.bullen@xxxxxxxxxx wrote:
> I build Wireshark for Windows without zlib. It works faster, but I think that is more the result of consuming less memory than an actual speed increase.
At least with the new compressed-file code as of 1.6, it shouldn't consume more memory (other than for zlib itself, which shouldn't be invoked for uncompressed files except when the file is opened, and maybe for a few data structure members) for an uncompressed file. If it's doing that, file a bug.
> In addition, it allows files larger than 2 GB to be read (at least that used to be a reason; not sure if it is still valid).
That should be fixed in the Wiretap library as of 1.6 - the new code for reading files doesn't use the zlib I/O routines, and uses routines that should support 64-bit file offsets if the underlying OS does (which includes 64-bit platforms and, I think, most if not all recent versions of various UN*Xes, and NT versions of Windows).
However, a file larger than 2GB might has enough packets that the frame_data structures might fill up a 32-bit address space, and there's a bug, fixed only recently, where, at least on Windows, we were imposing 32-bit limits on 64-bit address spaces.
------------------------------
Message: 5
Date: Fri, 28 Sep 2012 11:11:14 -0700
From: Guy Harris <guy@xxxxxxxxxxxx>
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-dev] converting pcapng to pcap
Message-ID: <1AD03A96-D583-434D-840C-DF3A0A067F66@xxxxxxxxxxxx>
Content-Type: text/plain; charset=us-ascii
On Sep 28, 2012, at 10:39 AM, Albert Lo <ALo@xxxxxxxxxxxxxx> wrote:
> I would like to know where I can find the source files for editcap.
> What libpcap API's are being called to convert .pcapng to .pcap with the following cmd?
>
> >editcap -F libpcap -T ether file.pcapng file.pcap
As Jakub noted, we don't use libpcap to read or write capture files.
However, if you convert pcap-ng to pcap with the command
tcpdump -r file.pcapng -w file.pcap
on a system with libpcap 1.1.0 or later, the APIs used are
pcap_open_offline(), to open the input file;
pcap_loop(), to read the packets;
pcap_close(), to close the input file;
pcap_dump_open(), to open the output file;
pcap_dump(), to write to the output file;
pcap_dump_close(), to close the output file.
That will, of course, only work if the file can actually be converted to pcap without damaging it, i.e. if all the interfaces in the pcap-ng file have the same link-layer type. If they don't, the file cannot be represented in a pcap file in any form that will actually give the write answer if you try to read it (so "-T ether" isn't going to fix that problem with editcap).
------------------------------
Message: 6
Date: Fri, 28 Sep 2012 18:43:29 +0000 (UTC)
From: albert <alo@xxxxxxxxxxxxxx>
To: wireshark-dev@xxxxxxxxxxxxx
Subject: Re: [Wireshark-dev] converting pcapng to pcap
Message-ID: <loom.20120928T203756-894@xxxxxxxxxxxxxx>
Content-Type: text/plain; charset=us-ascii
Guy Harris <guy@...> writes:
>
>
> However, if you convert pcap-ng to pcap with the command
>
> tcpdump -r file.pcapng -w file.pcap
>
> on a system with libpcap 1.1.0 or later, the APIs used are
>
> pcap_open_offline(), to open the input file;
>
> pcap_loop(), to read the packets;
>
> pcap_close(), to close the input file;
>
> pcap_dump_open(), to open the output file;
>
> pcap_dump(), to write to the output file;
>
> pcap_dump_close(), to close the output file.
>
Thank you for the prompt response.
If you could tolerate a couple more newbie questions.....
I'm assuming that the meat of the .pcapng to .pcap conversion is done in the
pcap_handler callback for pcap_offline_read(). Is this correct ?
If so, how/where does the callback function for pcap_offline_read() get pre-
assigned?
Much appreciated for your time in this matter.
Cheers,
Albert
------------------------------
Message: 7
Date: Fri, 28 Sep 2012 11:52:45 -0700
From: Guy Harris <guy@xxxxxxxxxxxx>
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-dev] [Wireshark-commits] rev 45191: /trunk/
/trunk/epan/dissectors/: packet-btsap.c /trunk/: CMakeLists.txt
Message-ID: <96273A0C-2E67-4ECF-BC64-F93DF83AC871@xxxxxxxxxxxx>
Content-Type: text/plain; charset=us-ascii
On Sep 28, 2012, at 7:29 AM, Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> wrote:
> I had been assuming that we needed to continue to define HAVE_CONFIG_H
> for backwards compatibility (e.g., for custom dissectors).
I'm not entirely sure what the point of HAVE_CONFIG_H is. Is it to allow code to be "portable" between an autoconfig environment that uses config.h and other build tool environments (including autoconfig-based environments) that use -D's in the compile commands? The autoconf documentation doesn't really give an indication of the purpose of HAVE_CONFIG_H or an indication of what the "best practice" is.
------------------------------
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-dev
End of Wireshark-dev Digest, Vol 76, Issue 44
*********************************************
U.S. BANCORP made the following annotations
---------------------------------------------------------------------
Electronic Privacy Notice. This e-mail, and any attachments, contains information that is, or may be, covered by electronic communications privacy laws, and is also confidential and proprietary in nature. If you are not the intended recipient, please be advised that you are legally prohibited from retaining, using, copying, distributing, or otherwise disclosing this information in any manner. Instead, please reply to the sender that you have received this communication in error, and then immediately delete it. Thank you in advance for your cooperation.
---------------------------------------------------------------------
- Follow-Ups:
- Re: [Wireshark-dev] Why the name "Wiretap"?
- From: Gilbert Ramirez
- Re: [Wireshark-dev] Why the name "Wiretap"?
- Prev by Date: Re: [Wireshark-dev] converting pcapng to pcap
- Next by Date: Re: [Wireshark-dev] Do Windows compilers require WS_VAR_IMPORT in .h files
- Previous by thread: Re: [Wireshark-dev] converting pcapng to pcap
- Next by thread: Re: [Wireshark-dev] Why the name "Wiretap"?
- Index(es):