Wireshark 2.9.0-477-g68ec514b The Wireshark network protocol analyzer

- Main Page
- Related Pages
- Modules
- Namespaces
- Classes
- Files

- File List
- File Members

erf.h
1 /*
2 *
3 * Copyright (c) 2003 Endace Technology Ltd, Hamilton, New Zealand.
4 * All rights reserved.
5 *
6 * This software and documentation has been developed by Endace Technology Ltd.
7 * along with the DAG PCI network capture cards. For further information please
8 * visit http://www.endace.com/.
9 *
10 * SPDX-License-Identifier: BSD-3-Clause
11 */
12
13 #ifndef __W_ERF_H__
14 #define __W_ERF_H__
15
16 #include <glib.h>
17 #include <wiretap/wtap.h>
18 #include "ws_symbol_export.h"
19
20 /* Record type defines */
21 #define ERF_TYPE_LEGACY 0
22 #define ERF_TYPE_HDLC_POS 1
23 #define ERF_TYPE_ETH 2
24 #define ERF_TYPE_ATM 3
25 #define ERF_TYPE_AAL5 4
26 #define ERF_TYPE_MC_HDLC 5
27 #define ERF_TYPE_MC_RAW 6
28 #define ERF_TYPE_MC_ATM 7
29 #define ERF_TYPE_MC_RAW_CHANNEL 8
30 #define ERF_TYPE_MC_AAL5 9
31 #define ERF_TYPE_COLOR_HDLC_POS 10
32 #define ERF_TYPE_COLOR_ETH 11
33 #define ERF_TYPE_MC_AAL2 12
34 #define ERF_TYPE_IP_COUNTER 13
35 #define ERF_TYPE_TCP_FLOW_COUNTER 14
36 #define ERF_TYPE_DSM_COLOR_HDLC_POS 15
37 #define ERF_TYPE_DSM_COLOR_ETH 16
38 #define ERF_TYPE_COLOR_MC_HDLC_POS 17
39 #define ERF_TYPE_AAL2 18
40 #define ERF_TYPE_COLOR_HASH_POS 19
41 #define ERF_TYPE_COLOR_HASH_ETH 20
42 #define ERF_TYPE_INFINIBAND 21
43 #define ERF_TYPE_IPV4 22
44 #define ERF_TYPE_IPV6 23
45 #define ERF_TYPE_RAW_LINK 24
46 #define ERF_TYPE_INFINIBAND_LINK 25
47 /* XXX - what about 26? */
48 #define ERF_TYPE_META 27
49 #define ERF_TYPE_OPA_SNC 28
50 #define ERF_TYPE_OPA_9B 29
51
52 /* 28-31 reserved for future public ERF types */
53
54 /* Record types reserved for local and internal use */
55 #define ERF_TYPE_INTERNAL0 32
56 #define ERF_TYPE_INTERNAL1 33
57 #define ERF_TYPE_INTERNAL2 34
58 #define ERF_TYPE_INTERNAL3 35
59 #define ERF_TYPE_INTERNAL4 36
60 #define ERF_TYPE_INTERNAL5 37
61 #define ERF_TYPE_INTERNAL6 38
62 #define ERF_TYPE_INTERNAL7 39
63 #define ERF_TYPE_INTERNAL8 40
64 #define ERF_TYPE_INTERNAL9 41
65 #define ERF_TYPE_INTERNAL10 42
66 #define ERF_TYPE_INTERNAL11 43
67 #define ERF_TYPE_INTERNAL12 44
68 #define ERF_TYPE_INTERNAL13 45
69 #define ERF_TYPE_INTERNAL14 46
70 #define ERF_TYPE_INTERNAL15 47
71
72 /* Pad records */
73 #define ERF_TYPE_PAD 48
74
75 #define ERF_EXT_HDR_TYPE_CLASSIFICATION 3
76 #define ERF_EXT_HDR_TYPE_INTERCEPTID 4
77 #define ERF_EXT_HDR_TYPE_RAW_LINK 5
78 #define ERF_EXT_HDR_TYPE_BFS 6
79 #define ERF_EXT_HDR_TYPE_CHANNELISED 12
80 #define ERF_EXT_HDR_TYPE_SIGNATURE 14
81 #define ERF_EXT_HDR_TYPE_PKT_ID 15
82 #define ERF_EXT_HDR_TYPE_FLOW_ID 16
83 #define ERF_EXT_HDR_TYPE_HOST_ID 17
84 #define ERF_EXT_HDR_TYPE_ANCHOR_ID 18
85 #define ERF_EXT_HDR_TYPE_ENTROPY 19
86
87 /* Host ID and Anchor ID*/
88 #define ERF_EHDR_HOST_ID_MASK G_GUINT64_CONSTANT(0xffffffffffff)
89 #define ERF_EHDR_ANCHOR_ID_MASK G_GUINT64_CONSTANT(0xffffffffffff)
90 #define ERF_EHDR_MORE_EXTHDR_MASK G_GUINT64_CONSTANT(0x8000000000000000)
91 #define ERF_EHDR_ANCHOR_ID_DEFINITION_MASK G_GUINT64_CONSTANT(0x80000000000000)
92
93 #define ERF_EHDR_FLOW_ID_STACK_TYPE_MASK G_GUINT64_CONSTANT(0xff00000000)
94 #define ERF_EHDR_FLOW_ID_SOURCE_ID_MASK G_GUINT64_CONSTANT(0xff000000000000)
95
96 /* ERF Provenance metadata */
97 #define ERF_META_SECTION_MASK 0xFF00
98 #define ERF_META_IS_SECTION(type) (type > 0 && (type & ERF_META_SECTION_MASK) == ERF_META_SECTION_MASK)
99 #define ERF_META_HOST_ID_IMPLICIT G_MAXUINT64
100 #define ERF_ANCHOR_ID_IS_DEFINITION(anchor_id) ((guint64)anchor_id & ERF_EHDR_ANCHOR_ID_DEFINITION_MASK)
101 #define ERF_EHDR_SET_MORE_EXTHDR(ext_hdr) ((guint64)ext_hdr | ERF_EHDR_MORE_EXTHDR_MASK)
102
103 #define ERF_META_SECTION_CAPTURE 0xFF00
104 #define ERF_META_SECTION_HOST 0xFF01
105 #define ERF_META_SECTION_MODULE 0xFF02
106 #define ERF_META_SECTION_INTERFACE 0xFF03
107 #define ERF_META_SECTION_FLOW 0xFF04
108 #define ERF_META_SECTION_STATS 0xFF05
109 #define ERF_META_SECTION_INFO 0xFF06
110 #define ERF_META_SECTION_CONTEXT 0xFF07
111 #define ERF_META_SECTION_STREAM 0xFF08
112 #define ERF_META_SECTION_TRANSFORM 0xFF09
113 #define ERF_META_SECTION_DNS 0xFF0A
114 #define ERF_META_SECTION_SOURCE 0xFF0B
115
116 #define ERF_META_TAG_padding 0
117 #define ERF_META_TAG_comment 1
118 #define ERF_META_TAG_gen_time 2
119 #define ERF_META_TAG_parent_section 3
120 #define ERF_META_TAG_reset 4
121 #define ERF_META_TAG_event_time 5
122 #define ERF_META_TAG_host_id 6
123 #define ERF_META_TAG_fcs_len 8
124 #define ERF_META_TAG_mask_ipv4 9
125 #define ERF_META_TAG_mask_cidr 10
126
127 #define ERF_META_TAG_org_name 11
128 #define ERF_META_TAG_name 12
129 #define ERF_META_TAG_descr 13
130 #define ERF_META_TAG_config 14
131 #define ERF_META_TAG_datapipe 15
132 #define ERF_META_TAG_app_name 16
133 #define ERF_META_TAG_os 17
134 #define ERF_META_TAG_hostname 18
135 #define ERF_META_TAG_user 19
136 #define ERF_META_TAG_model 20
137 #define ERF_META_TAG_fw_version 21
138 #define ERF_META_TAG_serial_no 22
139 #define ERF_META_TAG_ts_offset 23
140 #define ERF_META_TAG_ts_clock_freq 24
141 #define ERF_META_TAG_tzone 25
142 #define ERF_META_TAG_tzone_name 26
143 #define ERF_META_TAG_loc_lat 27
144 #define ERF_META_TAG_loc_long 28
145 #define ERF_META_TAG_snaplen 29
146 #define ERF_META_TAG_card_num 30
147 #define ERF_META_TAG_module_num 31
148 #define ERF_META_TAG_access_num 32
149 #define ERF_META_TAG_stream_num 33
150 #define ERF_META_TAG_loc_name 34
151 #define ERF_META_TAG_parent_file 35
152 #define ERF_META_TAG_filter 36
153 #define ERF_META_TAG_flow_hash_mode 37
154 #define ERF_META_TAG_tunneling_mode 38
155 #define ERF_META_TAG_npb_format 39
156 #define ERF_META_TAG_mem 40
157 #define ERF_META_TAG_datamine_id 41
158 #define ERF_META_TAG_rotfile_id 42
159 #define ERF_META_TAG_rotfile_name 43
160 #define ERF_META_TAG_dev_name 44
161 #define ERF_META_TAG_dev_path 45
162 #define ERF_META_TAG_loc_descr 46
163 #define ERF_META_TAG_app_version 47
164 #define ERF_META_TAG_cpu_affinity 48
165 #define ERF_META_TAG_cpu 49
166 #define ERF_META_TAG_cpu_phys_cores 50
167 #define ERF_META_TAG_cpu_numa_nodes 51
168 #define ERF_META_TAG_dag_attribute 52
169 #define ERF_META_TAG_dag_version 53
170 #define ERF_META_TAG_stream_flags 54
171 #define ERF_META_TAG_entropy_threshold 55
172 #define ERF_META_TAG_smart_trunc_default 56
173 #define ERF_META_TAG_ext_hdrs_added 57
174 #define ERF_META_TAG_ext_hdrs_removed 58
175 #define ERF_META_TAG_relative_snaplen 59
176
177 #define ERF_META_TAG_if_num 64
178 #define ERF_META_TAG_if_vc 65
179 #define ERF_META_TAG_if_speed 66
180 #define ERF_META_TAG_if_ipv4 67
181 #define ERF_META_TAG_if_ipv6 68
182 #define ERF_META_TAG_if_mac 69
183 #define ERF_META_TAG_if_eui 70
184 #define ERF_META_TAG_if_ib_gid 71
185 #define ERF_META_TAG_if_ib_lid 72
186 #define ERF_META_TAG_if_wwn 73
187 #define ERF_META_TAG_if_fc_id 74
188 #define ERF_META_TAG_if_tx_speed 75
189 #define ERF_META_TAG_if_erf_type 76
190 #define ERF_META_TAG_if_link_type 77
191 #define ERF_META_TAG_if_sfp_type 78
192 #define ERF_META_TAG_if_rx_power 79
193 #define ERF_META_TAG_if_tx_power 80
194 #define ERF_META_TAG_if_link_status 81
195 #define ERF_META_TAG_if_phy_mode 82
196 #define ERF_META_TAG_if_port_type 83
197 #define ERF_META_TAG_if_rx_latency 84
198 #define ERF_META_TAG_tap_mode 85
199 #define ERF_META_TAG_tap_fail_mode 86
200 #define ERF_META_TAG_watchdog_expired 87
201 #define ERF_META_TAG_watchdog_interval 88
202
203 #define ERF_META_TAG_src_ipv4 128
204 #define ERF_META_TAG_dest_ipv4 129
205 #define ERF_META_TAG_src_ipv6 130
206 #define ERF_META_TAG_dest_ipv6 131
207 #define ERF_META_TAG_src_mac 132
208 #define ERF_META_TAG_dest_mac 133
209 #define ERF_META_TAG_src_eui 134
210 #define ERF_META_TAG_dest_eui 135
211 #define ERF_META_TAG_src_ib_gid 136
212 #define ERF_META_TAG_dest_ib_gid 137
213 #define ERF_META_TAG_src_ib_lid 138
214 #define ERF_META_TAG_dest_ib_lid 139
215 #define ERF_META_TAG_src_wwn 140
216 #define ERF_META_TAG_dest_wwn 141
217 #define ERF_META_TAG_src_fc_id 142
218 #define ERF_META_TAG_dest_fc_id 143
219 #define ERF_META_TAG_src_port 144
220 #define ERF_META_TAG_dest_port 145
221 #define ERF_META_TAG_ip_proto 146
222 #define ERF_META_TAG_flow_hash 147
223 #define ERF_META_TAG_filter_match 148
224 #define ERF_META_TAG_filter_match_name 149
225 #define ERF_META_TAG_error_flags 150
226 #define ERF_META_TAG_initiator_pkts 151
227 #define ERF_META_TAG_responder_pkts 152
228 #define ERF_META_TAG_initiator_bytes 153
229 #define ERF_META_TAG_responder_bytes 154
230 #define ERF_META_TAG_initiator_min_entropy 155
231 #define ERF_META_TAG_responder_min_entropy 156
232 #define ERF_META_TAG_initiator_avg_entropy 157
233 #define ERF_META_TAG_responder_avg_entropy 158
234 #define ERF_META_TAG_initiator_max_entropy 159
235 #define ERF_META_TAG_responder_max_entropy 160
236 #define ERF_META_TAG_dpi_application 161
237 #define ERF_META_TAG_dpi_confidence 162
238 #define ERF_META_TAG_dpi_state 163
239 #define ERF_META_TAG_dpi_protocol_stack 164
240 #define ERF_META_TAG_flow_state 165
241
242 #define ERF_META_TAG_start_time 193
243 #define ERF_META_TAG_end_time 194
244 #define ERF_META_TAG_stat_if_drop 195
245 #define ERF_META_TAG_stat_frames 196
246 #define ERF_META_TAG_stat_bytes 197
247 #define ERF_META_TAG_stat_cap 198
248 #define ERF_META_TAG_stat_cap_bytes 199
249 #define ERF_META_TAG_stat_os_drop 200
250 #define ERF_META_TAG_stat_ds_lctr 201
251 #define ERF_META_TAG_stat_filter_match 202
252 #define ERF_META_TAG_stat_filter_drop 203
253 #define ERF_META_TAG_stat_too_short 204
254 #define ERF_META_TAG_stat_too_long 205
255 #define ERF_META_TAG_stat_rx_error 206
256 #define ERF_META_TAG_stat_fcs_error 207
257 #define ERF_META_TAG_stat_aborted 208
258 #define ERF_META_TAG_stat_proto_error 209
259 #define ERF_META_TAG_stat_b1_error 210
260 #define ERF_META_TAG_stat_b2_error 211
261 #define ERF_META_TAG_stat_b3_error 212
262 #define ERF_META_TAG_stat_rei_error 213
263 #define ERF_META_TAG_stat_drop 214
264 #define ERF_META_TAG_stat_buf_drop 215
265 #define ERF_META_TAG_stream_drop 216
266 #define ERF_META_TAG_stream_buf_drop 217
267
268 #define ERF_META_TAG_ns_host_ipv4 256
269 #define ERF_META_TAG_ns_host_ipv6 257
270 #define ERF_META_TAG_ns_host_mac 258
271 #define ERF_META_TAG_ns_host_eui 259
272 #define ERF_META_TAG_ns_host_ib_gid 260
273 #define ERF_META_TAG_ns_host_ib_lid 261
274 #define ERF_META_TAG_ns_host_wwn 262
275 #define ERF_META_TAG_ns_host_fc_id 263
276 #define ERF_META_TAG_ns_dns_ipv4 264
277 #define ERF_META_TAG_ns_dns_ipv6 265
278
279 #define ERF_META_TAG_exthdr 321
280 #define ERF_META_TAG_pcap_ng_block 322
281 #define ERF_META_TAG_asn1 323
282
283 #define ERF_META_TAG_clk_source 384
284 #define ERF_META_TAG_clk_state 385
285 #define ERF_META_TAG_clk_threshold 386
286 #define ERF_META_TAG_clk_correction 387
287 #define ERF_META_TAG_clk_failures 388
288 #define ERF_META_TAG_clk_resyncs 389
289 #define ERF_META_TAG_clk_phase_error 390
290 #define ERF_META_TAG_clk_input_pulses 391
291 #define ERF_META_TAG_clk_rejected_pulses 392
292 #define ERF_META_TAG_clk_phc_index 393
293 #define ERF_META_TAG_clk_phc_offset 394
294 #define ERF_META_TAG_clk_timebase 395
295 #define ERF_META_TAG_clk_descr 396
296 #define ERF_META_TAG_clk_out_source 397
297 #define ERF_META_TAG_clk_link_mode 398
298 #define ERF_META_TAG_ptp_domain_num 399
299 #define ERF_META_TAG_ptp_steps_removed 400
300 #define ERF_META_TAG_ptp_offset_from_master 401
301 #define ERF_META_TAG_ptp_mean_path_delay 402
302 #define ERF_META_TAG_ptp_parent_identity 403
303 #define ERF_META_TAG_ptp_parent_port_num 404
304 #define ERF_META_TAG_ptp_gm_identity 405
305 #define ERF_META_TAG_ptp_gm_clock_quality 406
306 #define ERF_META_TAG_ptp_current_utc_offset 407
307 #define ERF_META_TAG_ptp_time_properties 408
308 #define ERF_META_TAG_ptp_time_source 409
309 #define ERF_META_TAG_ptp_clock_identity 410
310 #define ERF_META_TAG_ptp_port_num 411
311 #define ERF_META_TAG_ptp_port_state 412
312 #define ERF_META_TAG_ptp_delay_mechanism 413
313 #define ERF_META_TAG_clk_port_proto 414
314
315 #define ERF_POPULATE_SUCCESS 1
316 #define ERF_POPULATE_ALREADY_POPULATED 0
317 #define ERF_POPULATE_FAILED -1
318
319 #define ERF_MAX_INTERFACES 4
320
321 /*
322 * The timestamp is 64bit unsigned fixed point little-endian value with
323 * 32 bits for second and 32 bits for fraction.
324 */
325 typedef guint64 erf_timestamp_t;
326
327 typedef struct erf_record {
328 erf_timestamp_t ts;
329 guint8 type;
330 guint8 flags;
331 guint16 rlen;
332 guint16 lctr;
333 guint16 wlen;
334 } erf_header_t;
335
336 typedef struct erf_mc_hdr {
337 guint32 mc;
338 } erf_mc_header_t;
339
340 typedef struct erf_aal2_hdr {
341 guint32 aal2;
342 } erf_aal2_header_t;
343
344 typedef struct erf_eth_hdr {
345 guint8 offset;
346 guint8 pad;
347 } erf_eth_header_t;
348
349 union erf_subhdr {
350 struct erf_mc_hdr mc_hdr;
351 struct erf_aal2_hdr aal2_hdr;
352 struct erf_eth_hdr eth_hdr;
353 };
354
355 typedef struct {
356 GHashTable* if_map;
357 GHashTable* anchor_map;
358 guint64 implicit_host_id;
359 guint64 capture_gentime;
360 guint64 host_gentime;
361 } erf_t;
362
363 #define MIN_RECORDS_FOR_ERF_CHECK 3
364 #define RECORDS_FOR_ERF_CHECK 20
365 #define FCS_BITS 32
366 /*Configurable through ERF_HOST_ID environment variable */
367 #define ERF_WS_DEFAULT_HOST_ID 0
368
369 wtap_open_return_val erf_open(wtap *wth, int *err, gchar **err_info);
370 int erf_dump_can_write_encap(int encap);
371 int erf_dump_open(wtap_dumper *wdh, int *err);
372
373 erf_t* erf_priv_create(void);
374 erf_t* erf_priv_free(erf_t* erf_priv);
375
376 int erf_populate_interfaces(wtap *wth);
377 int erf_populate_interface(erf_t* erf_priv, wtap *wth, union wtap_pseudo_header *pseudo_header, guint64 host_id, guint8 source_id, guint8 if_num);
378 int erf_populate_interface_from_header(erf_t* erf_priv, wtap *wth, union wtap_pseudo_header *pseudo_header);
379 int erf_get_source_from_header(union wtap_pseudo_header *pseudo_header, guint64 *host_id, guint8 *source_id);
380
381 #endif /* __W_ERF_H__ */
382
383 /*
384 * Editor modelines - http://www.wireshark.org/tools/modelines.html
385 *
386 * Local variables:
387 * c-basic-offset: 8
388 * tab-width: 8
389 * indent-tabs-mode: t
390 * End:
391 *
392 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
393 * :indentSize=8:tabSize=8:noTabs=false:
394 */
wtap
Definition: wtap-int.h:34
wtap_pseudo_header
Definition: wtap.h:1157
erf_subhdr
Definition: erf.h:349
erf_t
Definition: erf.h:355
erf_eth_hdr
Definition: erf.h:344
erf_mc_hdr
Definition: erf.h:336
erf_aal2_hdr
Definition: erf.h:340
wtap_dumper
Definition: wtap-int.h:86
erf_record
Definition: erf.h:327