Changeset 4a207b8

Timestamp:

03/23/07 16:41:03 (14 years ago)

Author:

Perry Lorier <perry@…>

Branches:

4.0.1-hotfixes, cachetimestamps, develop, dpdk-ndag, etsilive, getfragoff, help, libtrace4, master, ndag_format, pfring, rc-4.0.1, rc-4.0.2, rc-4.0.3, rc-4.0.4, ringdecrementfix, ringperformance, ringtimestampfixes

Children:

dbdc23f

Parents:

83f2cbf

Message:

Endace POS traces are in fact PPP traces. Deal with this correctly, even when
converting between trace formats

Location:

lib

Files:

• format_erf.c (modified) (1 diff)
• format_legacy.c (modified) (1 diff)
• libtrace.h.in (modified) (3 diffs)
• linktypes.c (modified) (5 diffs)
• protocols.c (modified) (2 diffs)

lib/format_erf.c

@@ -512 +512 @@
         dag_record_t *erfptr = 0;
         erfptr = (dag_record_t *)packet->header;
-        return erf_type_to_libtrace(erfptr->type);
+        if (erfptr->type != TYPE_LEGACY)
+                return erf_type_to_libtrace(erfptr->type);
+        else {
+                /* Sigh, lets start wildly guessing */
+                if (((char*)packet->payload)[4]==0x45)
+                        return TRACE_TYPE_PPP;
+                return ~0;
+        }
 }
 

lib/format_legacy.c

@@ -151 +151 @@
 
 static libtrace_linktype_t legacypos_get_link_type(const libtrace_packet_t *packet UNUSED) {
-        return TRACE_TYPE_POS;
+        return TRACE_TYPE_PPP;
 }
 

lib/libtrace.h.in

@@ -210 +210 @@
         TRACE_DLT_NULL = 0,
         TRACE_DLT_EN10MB = 1,
+        TRACE_DLT_PPP = 9,
         TRACE_DLT_ATM_RFC1483 = 11,
         TRACE_DLT_RAW = 101,
@@ -236 +237 @@
        TRACE_TYPE_DUCK = 14,         /**< Pseudo link layer for DUCK packets */
        TRACE_TYPE_80211_RADIO = 15,  /**< Radiotap + 802.11 */
-       TRACE_TYPE_LLCSNAP = 16       /**< Raw LLC/SNAP */
+       TRACE_TYPE_LLCSNAP = 16,      /**< Raw LLC/SNAP */
+       TRACE_TYPE_PPP = 17           /**< PPP frames */
         
 } libtrace_linktype_t;
@@ -562 +564 @@
 } PACKED libtrace_atm_nni_capture_cell_t;
 
-/** POS header */
-typedef struct libtrace_pos
+/** PPP header */
+typedef struct libtrace_pps
 {
- uint16_t header;
- uint16_t ether_type;           /**< Ether Type */
-} PACKED libtrace_pos_t;
+ uint8_t addres;                /**< PPP Address (0xFF - All stations) */
+ uint8_t header;                /**< PPP Control (0x03 - Unnumbered info) */
+ uint16_t protocol;             /**< PPP Protocol (htons(0x0021) - IPv4 */
+} PACKED libtrace_ppp_t;
 
 /** 802.11 header */

lib/linktypes.c

@@ -42 +42 @@
                 case TRACE_DLT_IEEE802_11_RADIO: return TRACE_TYPE_80211_RADIO;
                 case TRACE_DLT_ATM_RFC1483: return TRACE_TYPE_LLCSNAP;
+                case TRACE_DLT_PPP: return TRACE_TYPE_PPP;
                 /* Unhandled */
                 case TRACE_DLT_NULL:    /* Raw IP frame with a BSD specific
@@ -67 +68 @@
                 case TRACE_TYPE_80211_RADIO: return TRACE_DLT_IEEE802_11_RADIO;
                 case TRACE_TYPE_LLCSNAP: return TRACE_DLT_ATM_RFC1483;
+                case TRACE_TYPE_PPP:    return TRACE_DLT_PPP;
                 /* Below here are unsupported conversions */
                 /* Dispite hints to the contrary, there is no DLT
@@ -80 +82 @@
                 /* Used for test traces within WAND */
                 case TRACE_TYPE_80211_PRISM:    
+                /* Probably == PPP */
+                case TRACE_TYPE_POS:
                 /* TODO: We haven't researched these yet */
-                case TRACE_TYPE_POS:
+                case TRACE_TYPE_AAL5:
                 case TRACE_TYPE_HDLC_POS:
-                case TRACE_TYPE_AAL5:
                         break;
         }
@@ -125 +128 @@
                 case TRACE_TYPE_80211_PRISM:
                 case TRACE_TYPE_80211:
-                case TRACE_TYPE_POS:
                 case TRACE_TYPE_PFLOG:
                 case TRACE_TYPE_NONE:
                 case TRACE_TYPE_LINUX_SLL:
+                case TRACE_TYPE_PPP:
+                case TRACE_TYPE_POS:
                         break;
         }
@@ -241 +245 @@
         static libtrace_t *trace = NULL;
         switch(trace_get_link_type(packet)) {
-                case TRACE_TYPE_POS:
-                        remaining=trace_get_capture_length(packet);
-                        packet->payload=trace_get_payload_from_pos(
-                                packet->payload,NULL,&remaining);
-
-                        tmp=(char*)malloc(
-                                trace_get_capture_length(packet)
-                                +sizeof(libtrace_pcapfile_pkt_hdr_t)
-                                );
-
-                        tv=trace_get_timeval(packet);
-                        ((libtrace_pcapfile_pkt_hdr_t*)tmp)->ts_sec=tv.tv_sec;
-                        ((libtrace_pcapfile_pkt_hdr_t*)tmp)->ts_usec=tv.tv_usec;
-                        ((libtrace_pcapfile_pkt_hdr_t*)tmp)->wirelen
-                                = trace_get_wire_length(packet)-(trace_get_capture_length(packet)-remaining);
-                        ((libtrace_pcapfile_pkt_hdr_t*)tmp)->caplen
-                                = remaining;
-
-                        memcpy(tmp+sizeof(libtrace_pcapfile_pkt_hdr_t),
-                                        packet->payload,
-                                        (size_t)remaining);
-                        if (packet->buf_control == TRACE_CTRL_EXTERNAL) {
-                                packet->buf_control=TRACE_CTRL_PACKET;
-                        }
-                        else {
-                                free(packet->buffer);
-                        }
-                        packet->buffer=tmp;
-                        packet->header=tmp;
-                        packet->payload=tmp+sizeof(libtrace_pcapfile_pkt_hdr_t);
-                        packet->type=pcap_dlt_to_rt(TRACE_DLT_RAW);
-                        
-                        if (trace == NULL) {
-                                trace = trace_create_dead("pcap:-");
-                        }
-
-                        packet->trace=trace;
-
-                        return true;
                 case TRACE_TYPE_ATM:
                         remaining=trace_get_capture_length(packet);

lib/protocols.c

@@ -206 +206 @@
 }
 
-void *trace_get_payload_from_pos(void *link, 
+void *trace_get_payload_from_ppp(void *link, 
                 uint16_t *type, uint32_t *remaining)
 {
         /* 64 byte capture. */
-        libtrace_pos_t *pos = (libtrace_pos_t*)link;
-
-        if (remaining) {
-                if (*remaining < sizeof(libtrace_pos_t))
-                        return NULL;
-                *remaining-=sizeof(libtrace_pos_t);
-        }
-
-        /* This is documented by endace to be an ethertype.  The ethertype
-         * however is always ntohs(0x0021), which endace in their own tools
-         * ignore and assume IP, so...
-         */
-        /*if (type) *type = ntohs(pos->ether_type); */
-        if (type) *type = ntohs(0x0800);
-
-        return (void*)((char *)pos+sizeof(*pos));
+        libtrace_ppp_t *ppp = (libtrace_ppp_t*)link;
+
+        if (remaining) {
+                if (*remaining < sizeof(libtrace_ppp_t))
+                        return NULL;
+                *remaining-=sizeof(libtrace_ppp_t);
+        }
+
+        if (type) {
+                switch(ppp->protocol) {
+                        case 0x0021: *type = ntohs(0x0800);
+                }
+        }
+
+        return (void*)((char *)ppp+sizeof(*ppp));
 }
 
@@ -313 +312 @@
                 case TRACE_TYPE_PFLOG:
                         return trace_get_payload_from_pflog(link,type,remaining);
-                case TRACE_TYPE_POS:
-                        return trace_get_payload_from_pos(link,type,remaining);
+                case TRACE_TYPE_PPP:
+                        return trace_get_payload_from_ppp(link,type,remaining);
                 case TRACE_TYPE_ATM:
                         l=trace_get_payload_from_atm(link,NULL,remaining);