Wireshark 2.9.0-477-g68ec514b The Wireshark network protocol analyzer

- Main Page
- Related Pages
- Modules
- Namespaces
- Classes
- Files

- File List
- File Members

libpcap.h
1 /* libpcap.h
2 *
3 * Wiretap Library
4 * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
5 *
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
8
9 #ifndef __W_LIBPCAP_H__
10 #define __W_LIBPCAP_H__
11
12 #include <glib.h>
13 #include <wiretap/wtap.h>
14 #include "ws_symbol_export.h"
15
16 /* Magic numbers in "libpcap" files.
17
18 "libpcap" file records are written in the byte order of the host that
19 writes them, and the reader is expected to fix this up.
20
21 PCAP_MAGIC is the magic number, in host byte order; PCAP_SWAPPED_MAGIC
22 is a byte-swapped version of that.
23
24 PCAP_MODIFIED_MAGIC is for Alexey Kuznetsov's modified "libpcap"
25 format, as generated on Linux systems that have a "libpcap" with
26 his patches, at
27
28 http://ftp.sunet.se/pub/os/Linux/ip-routing/lbl-tools/
29
30 applied; PCAP_SWAPPED_MODIFIED_MAGIC is the byte-swapped version.
31
32 PCAP_IXIAMODIFIED_MAGIC is used by IXIA's lcap file format. It adds
33 a length field at the end of the file header (size of all records).
34 PCAP_SWAPPED_IXIAMODIFIED_MAGIC is the byte-swapped version.
35
36 PCAP_NSEC_MAGIC is for Ulf Lamping's modified "libpcap" format,
37 which uses the same common file format as PCAP_MAGIC, but the
38 timestamps are saved in nanosecond resolution instead of microseconds.
39 PCAP_SWAPPED_NSEC_MAGIC is a byte-swapped version of that. */
40 #define PCAP_MAGIC 0xa1b2c3d4
41 #define PCAP_SWAPPED_MAGIC 0xd4c3b2a1
42 #define PCAP_MODIFIED_MAGIC 0xa1b2cd34
43 #define PCAP_SWAPPED_MODIFIED_MAGIC 0x34cdb2a1
44 #define PCAP_IXIAHW_MAGIC 0x1c0001ac
45 #define PCAP_SWAPPED_IXIAHW_MAGIC 0xac01001c
46 #define PCAP_IXIASW_MAGIC 0x1c0001ab
47 #define PCAP_SWAPPED_IXIASW_MAGIC 0xab01001c
48 #define PCAP_NSEC_MAGIC 0xa1b23c4d
49 #define PCAP_SWAPPED_NSEC_MAGIC 0x4d3cb2a1
50
51 /* "libpcap" file header (minus magic number). */
52 struct pcap_hdr {
53 guint16 version_major; /* major version number */
54 guint16 version_minor; /* minor version number */
55 gint32 thiszone; /* GMT to local correction */
56 guint32 sigfigs; /* accuracy of timestamps */
57 guint32 snaplen; /* max length of captured packets, in octets */
58 guint32 network; /* data link type */
59 };
60
61 /* "libpcap" record header. */
62 struct pcaprec_hdr {
63 guint32 ts_sec; /* timestamp seconds */
64 guint32 ts_usec; /* timestamp microseconds (nsecs for PCAP_NSEC_MAGIC) */
65 guint32 incl_len; /* number of octets of packet saved in file */
66 guint32 orig_len; /* actual length of packet */
67 };
68
69 /* "libpcap" record header for Alexey's patched version. */
70 struct pcaprec_modified_hdr {
71 struct pcaprec_hdr hdr; /* the regular header */
72 guint32 ifindex; /* index, in *capturing* machine's list of
73 interfaces, of the interface on which this
74 packet came in. */
75 guint16 protocol; /* Ethernet packet type */
76 guint8 pkt_type; /* broadcast/multicast/etc. indication */
77 guint8 pad; /* pad to a 4-byte boundary */
78 };
79
80 /* "libpcap" record header for Alexey's patched version in its ss990915
81 incarnation; this version shows up in SuSE Linux 6.3. */
82 struct pcaprec_ss990915_hdr {
83 struct pcaprec_hdr hdr; /* the regular header */
84 guint32 ifindex; /* index, in *capturing* machine's list of
85 interfaces, of the interface on which this
86 packet came in. */
87 guint16 protocol; /* Ethernet packet type */
88 guint8 pkt_type; /* broadcast/multicast/etc. indication */
89 guint8 cpu1, cpu2; /* SMP debugging gunk? */
90 guint8 pad[3]; /* pad to a 4-byte boundary */
91 };
92
93 /* "libpcap" record header for version used on some Nokia boxes (firewalls?) */
94 struct pcaprec_nokia_hdr {
95 struct pcaprec_hdr hdr; /* the regular header */
96 guint8 stuff[4]; /* mysterious stuff */
97 };
98
99 wtap_open_return_val libpcap_open(wtap *wth, int *err, gchar **err_info);
100 gboolean libpcap_dump_open(wtap_dumper *wdh, int *err);
101 int libpcap_dump_can_write_encap(int encap);
102
103 #endif
pcaprec_ss990915_hdr
Definition: libpcap.h:82
pcap_hdr
Definition: libpcap.h:52
wtap
Definition: wtap-int.h:34
pcaprec_hdr
Definition: libpcap.h:62
pcaprec_nokia_hdr
Definition: libpcap.h:94
wtap_dumper
Definition: wtap-int.h:86
pcaprec_modified_hdr
Definition: libpcap.h:70