Adding upstream version 4.2.2.upstream/4.2.2

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 255 insertions, 0 deletions

diff --git a/wiretap/observer.h b/wiretap/observer.h
new file mode 100644
index 0000000..d203841
--- /dev/null
+++ b/wiretap/observer.h
@@ -0,0 +1,255 @@
+/** @file
+                          observer.h  -  description
+                             -------------------
+    begin                : Wed Oct 29 2003
+    copyright            : (C) 2003 by root
+    email                : scotte[AT}netinst.com
+ ***************************************************************************/
+
+/***************************************************************************
+ *                                                                         *
+ *  SPDX-License-Identifier: GPL-2.0-or-later                              *
+ *                                                                         *
+ ***************************************************************************/
+
+#ifndef __NETWORK_INSTRUMENTS_H__
+#define __NETWORK_INSTRUMENTS_H__
+
+#include <glib.h>
+#include "wtap.h"
+
+wtap_open_return_val observer_open(wtap *wth, int *err, gchar **err_info);
+
+/*
+ * In v15 the high_byte was added to allow a larger offset This was done by
+ * reducing the size of observer_version by 1 byte.  Since version strings are
+ * only 30 characters the high_byte will always be 0 in previous versions.
+ */
+typedef struct capture_file_header
+{
+    char    observer_version[31];
+    guint8  offset_to_first_packet_high_byte; /* allows to extend the offset to the first packet to 256*0x10000 = 16 MB */
+    guint16 offset_to_first_packet;
+    char    probe_instance;
+    guint8  number_of_information_elements;   /* number of TLVs in the header */
+} capture_file_header;
+
+#define CAPTURE_FILE_HEADER_FROM_LE_IN_PLACE(_capture_file_header) \
+    _capture_file_header.offset_to_first_packet = GUINT16_FROM_LE((_capture_file_header).offset_to_first_packet)
+
+#define CAPTURE_FILE_HEADER_TO_LE_IN_PLACE(_capture_file_header) \
+    _capture_file_header.offset_to_first_packet = GUINT16_TO_LE((_capture_file_header).offset_to_first_packet)
+
+typedef struct tlv_header
+{
+    guint16 type;
+    guint16 length;        /* includes the length of the TLV header */
+} tlv_header;
+
+#define TLV_HEADER_FROM_LE_IN_PLACE(_tlv_header) \
+    (_tlv_header).type   = GUINT16_FROM_LE((_tlv_header).type); \
+    (_tlv_header).length = GUINT16_FROM_LE((_tlv_header).length)
+
+#define TLV_HEADER_TO_LE_IN_PLACE(_tlv_header) \
+    (_tlv_header).type   = GUINT16_TO_LE((_tlv_header).type); \
+    (_tlv_header).length = GUINT16_TO_LE((_tlv_header).length)
+
+/*
+ * TLV type values.
+ *
+ * Do TLVs without the 0x0100 bit set show up in packets, and
+ * do TLVs with that set show up in the file header, or are
+ * there two separate types of TLV?
+ *
+ * ALIAS_LIST contains an ASCII string (null-terminated, but
+ * we can't trust that, of course) that is the pathname of
+ * a file containing the alias list.  Not much use to us.
+ *
+ * COMMENT contains an ASCII string (null-terminated, but
+ * we can't trust that, of course); in all the captures
+ * I've seen, it appears to be a note about the file added
+ * by Observer, not by a user.  It appears to end with 0x0a
+ * 0x2e, i.e. '\n' '.'.
+ *
+ * REMOTE_PROBE contains, in all the captures I've seen, an
+ * ASCII string (null-terminated, but we cna't trust that,
+ * of course) of the form "Remote Probe [hex string]".  THe
+ * hex string has 8 characters, i.e. 4 octets.
+ *
+ * The Observer document indicates that the types of expert information
+ * packets are:
+ *
+ *    Network Load (markers used by Expert Time Interval and What If
+ *    analysis modes)
+ *
+ *    Start/Stop Packet Capture marker frames (with time stamps when
+ *    captures start and stop)
+ *
+ *    Wireless Channel Change (markers showing what channel was being
+ *    currently listened to)
+ *
+ * That information appears to be contained in TLVs.
+ */
+#define INFORMATION_TYPE_ALIAS_LIST         0x0001
+#define INFORMATION_TYPE_COMMENT            0x0002 /* ASCII text */
+#define INFORMATION_TYPE_TIME_INFO          0x0004
+#define INFORMATION_TYPE_REMOTE_PROBE       0x0005
+#define INFORMATION_TYPE_NETWORK_LOAD       0x0100
+#define INFORMATION_TYPE_WIRELESS           0x0101
+#define INFORMATION_TYPE_CAPTURE_START_STOP 0x0104
+
+/*
+ * See in Fibre Channel captures; not seen elsewhere.
+ *
+ * It has 4 bytes of data in all captures I've seen.
+ */
+/*                                          0x0106 */
+
+typedef struct tlv_time_info {
+    guint16 type;
+    guint16 length;
+    guint32 time_format;
+} tlv_time_info;
+
+/*
+ * TIME_INFO time_format values.
+ */
+#define TIME_INFO_LOCAL 0
+#define TIME_INFO_GMT   1
+
+#define TLV_TIME_INFO_FROM_LE_IN_PLACE(_tlv_time_info) \
+    (_tlv_time_info).time_format = GUINT32_FROM_LE((_tlv_time_info).time_format)
+
+#define TLV_TIME_INFO_TO_LE_IN_PLACE(_tlv_time_info) \
+    (_tlv_time_info).time_format = GUINT32_TO_LE((_tlv_time_info).time_format)
+
+/*
+ * Might some of these be broadecast and multicast packet counts, or
+ * error counts, or both?
+ */
+typedef struct tlv_network_load
+{
+    guint32 utilization;        /* network utilization, in .1% units */
+    guint32 unknown1;           /* zero in all captures I've seen */
+    guint32 unknown2;           /* zero in all captures I've seen */
+    guint32 packets_per_second;
+    guint32 unknown3;           /* zero in all captures I've seen */
+    guint32 bytes_per_second;
+    guint32 unknown4;           /* zero in all captures I've seen */
+} tlv_network_load;
+
+#define TLV_NETWORK_LOAD_FROM_LE_IN_PLACE(_tlv_network_load) \
+    (_tlv_network_load).utilization = GUINT32_FROM_LE((_tlv_network_load).utilization); \
+    (_tlv_network_load).unknown1 = GUINT32_FROM_LE((_tlv_network_load).unknown1); \
+    (_tlv_network_load).unknown2 = GUINT32_FROM_LE((_tlv_network_load).unknown2); \
+    (_tlv_network_load).packets_per_second = GUINT32_FROM_LE((_tlv_network_load).packets_per_second); \
+    (_tlv_network_load).unknown3 = GUINT32_FROM_LE((_tlv_network_load).unknown3); \
+    (_tlv_network_load).bytes_per_second = GUINT32_FROM_LE((_tlv_network_load).bytes_per_second); \
+    (_tlv_network_load).unknown4 = GUINT32_FROM_LE((_tlv_network_load).unknown4) \
+
+#define TLV_NETWORK_LOAD_TO_LE_IN_PLACE(_tlv_network_load) \
+    (_tlv_network_load).utilization = GUINT32_TO_LE((_tlv_network_load).utilization); \
+    (_tlv_network_load).unknown1 = GUINT32_TO_LE((_tlv_network_load).unknown1); \
+    (_tlv_network_load).unknown2 = GUINT32_TO_LE((_tlv_network_load).unknown2); \
+    (_tlv_network_load).packets_per_second = GUINT32_TO_LE((_tlv_network_load).packets_per_second); \
+    (_tlv_network_load).unknown3 = GUINT32_TO_LE((_tlv_network_load).unknown3); \
+    (_tlv_network_load).bytes_per_second = GUINT32_TO_LE((_tlv_network_load).bytes_per_second); \
+    (_tlv_network_load).unknown4 = GUINT32_TO_LE((_tlv_network_load).unknown4) \
+
+/*
+ * quality is presumably some measure of signal quality; in
+ * the captures I've seen, it has values of 15, 20-27, 50-54,
+ * 208, and 213.
+ *
+ * conditions has values of 0x00, 0x02, and 0x90.
+ *
+ * reserved is either 0x00 or 0x80; the 0x80 values
+ * are for TLVs where conditions is 0x90.
+ */
+typedef struct tlv_wireless_info {
+    guint8 quality;
+    guint8 signalStrength;
+    guint8 rate;
+    guint8 frequency;
+    guint8 qualityPercent;
+    guint8 strengthPercent;
+    guint8 conditions;
+    guint8 reserved;
+} tlv_wireless_info;
+
+/*
+ * Wireless conditions
+ */
+#define WIRELESS_WEP_SUCCESS		0x80
+/*                                      0x10 */
+/*                                      0x02 */
+
+typedef struct tlv_capture_start_stop
+{
+    guint32 start_stop;
+} tlv_capture_start_stop;
+
+#define START_STOP_TYPE_STOP   0
+#define START_STOP_TYPE_START  1
+
+typedef struct packet_entry_header
+{
+    guint32 packet_magic;
+    guint32 network_speed;
+    guint16 captured_size;
+    guint16 network_size;
+    guint16 offset_to_frame;
+    guint16 offset_to_next_packet;
+    guint8 network_type;
+    guint8 flags;
+    guint8 number_of_information_elements;    /* number of TLVs in the header */
+    guint8 packet_type;
+    guint16 errors;
+    guint16 reserved;
+    guint64 packet_number;
+    guint64 original_packet_number;
+    guint64 nano_seconds_since_2000;
+} packet_entry_header;
+
+#define PACKET_ENTRY_HEADER_FROM_LE_IN_PLACE(_packet_entry_header) \
+    (_packet_entry_header).packet_magic            = GUINT32_FROM_LE((_packet_entry_header).packet_magic); \
+    (_packet_entry_header).network_speed           = GUINT32_FROM_LE((_packet_entry_header).network_speed); \
+    (_packet_entry_header).captured_size           = GUINT16_FROM_LE((_packet_entry_header).captured_size); \
+    (_packet_entry_header).network_size            = GUINT16_FROM_LE((_packet_entry_header).network_size); \
+    (_packet_entry_header).offset_to_frame         = GUINT16_FROM_LE((_packet_entry_header).offset_to_frame); \
+    (_packet_entry_header).offset_to_next_packet   = GUINT16_FROM_LE((_packet_entry_header).offset_to_next_packet); \
+    (_packet_entry_header).errors                  = GUINT16_FROM_LE((_packet_entry_header).errors); \
+    (_packet_entry_header).reserved                = GUINT16_FROM_LE((_packet_entry_header).reserved); \
+    (_packet_entry_header).packet_number           = GUINT64_FROM_LE((_packet_entry_header).packet_number); \
+    (_packet_entry_header).original_packet_number  = GUINT64_FROM_LE((_packet_entry_header).original_packet_number); \
+    (_packet_entry_header).nano_seconds_since_2000 = GUINT64_FROM_LE((_packet_entry_header).nano_seconds_since_2000)
+
+#define PACKET_ENTRY_HEADER_TO_LE_IN_PLACE(_packet_entry_header) \
+    (_packet_entry_header).packet_magic            = GUINT32_TO_LE((_packet_entry_header).packet_magic); \
+    (_packet_entry_header).network_speed           = GUINT32_TO_LE((_packet_entry_header).network_speed); \
+    (_packet_entry_header).captured_size           = GUINT16_TO_LE((_packet_entry_header).captured_size); \
+    (_packet_entry_header).network_size            = GUINT16_TO_LE((_packet_entry_header).network_size); \
+    (_packet_entry_header).offset_to_frame         = GUINT16_TO_LE((_packet_entry_header).offset_to_frame); \
+    (_packet_entry_header).offset_to_next_packet   = GUINT16_TO_LE((_packet_entry_header).offset_to_next_packet); \
+    (_packet_entry_header).errors                  = GUINT16_TO_LE((_packet_entry_header).errors); \
+    (_packet_entry_header).reserved                = GUINT16_TO_LE((_packet_entry_header).reserved); \
+    (_packet_entry_header).packet_number           = GUINT64_TO_LE((_packet_entry_header).packet_number); \
+    (_packet_entry_header).original_packet_number  = GUINT64_TO_LE((_packet_entry_header).original_packet_number); \
+    (_packet_entry_header).nano_seconds_since_2000 = GUINT64_TO_LE((_packet_entry_header).nano_seconds_since_2000)
+
+/*
+ * Network type values.
+ */
+#define OBSERVER_UNDEFINED       0xFF
+#define OBSERVER_ETHERNET        0x00
+#define OBSERVER_TOKENRING       0x01
+#define OBSERVER_FIBRE_CHANNEL   0x08
+#define OBSERVER_WIRELESS_802_11 0x09
+
+/*
+ * Packet type values.
+ */
+#define PACKET_TYPE_DATA_PACKET               0
+#define PACKET_TYPE_EXPERT_INFORMATION_PACKET 1
+
+#endif