observer.h File Reference

#include "wtap.h"

Go to the source code of this file.

Classes
struct	capture_file_header
	Top-level file header for a Network Instruments Observer capture file. More...
struct	tlv_header
	TLV (Type-Length-Value) header used for information elements appended to the Observer capture file header. More...
struct	tlv_time_info
	TLV payload carrying the timestamp reference timezone for an Observer capture file. More...
struct	tlv_network_load
	TLV payload carrying a network load snapshot sampled at the time of capture. More...
struct	tlv_wireless_info
	TLV payload carrying wireless signal and channel quality metrics for a captured packet. More...
struct	tlv_capture_start_stop
	TLV payload recording a capture start or stop event in the Observer capture file. More...
struct	packet_entry_header
	Per-packet record header in a Network Instruments Observer capture file. More...

Macros
#define	CAPTURE_FILE_HEADER_FROM_LE_IN_PLACE(_capture_file_header)
	Converts offset_to_first_packet in a capture_file_header from little-endian to host byte order in place.
#define	CAPTURE_FILE_HEADER_TO_LE_IN_PLACE(_capture_file_header)
	Converts offset_to_first_packet in a capture_file_header from host byte order to little-endian in place.
#define	TLV_HEADER_FROM_LE_IN_PLACE(_tlv_header)
	Converts all fields of a tlv_header from little-endian to host byte order in place.
#define	TLV_HEADER_TO_LE_IN_PLACE(_tlv_header)
	Converts all fields of a tlv_header from host byte order to little-endian in place.
#define	INFORMATION_TYPE_ALIAS_LIST   0x0001
#define	INFORMATION_TYPE_COMMENT   0x0002 /* ASCII text */
#define	INFORMATION_TYPE_TIME_INFO   0x0004
#define	INFORMATION_TYPE_REMOTE_PROBE   0x0005
#define	INFORMATION_TYPE_NETWORK_LOAD   0x0100
#define	INFORMATION_TYPE_WIRELESS   0x0101
#define	INFORMATION_TYPE_CAPTURE_START_STOP   0x0104
#define	TIME_INFO_LOCAL   0
#define	TIME_INFO_GMT   1
#define	TLV_TIME_INFO_FROM_LE_IN_PLACE(_tlv_time_info)
	Converts all fields of a tlv_time_info from little-endian to host byte order in place.
#define	TLV_TIME_INFO_TO_LE_IN_PLACE(_tlv_time_info)
	Converts all fields of a tlv_time_info from host byte order to little-endian in place.
#define	TLV_NETWORK_LOAD_FROM_LE_IN_PLACE(_tlv_network_load)
	Converts all fields of a tlv_network_load from little-endian to host byte order in place.
#define	TLV_NETWORK_LOAD_TO_LE_IN_PLACE(_tlv_network_load)
	Converts all fields of a tlv_network_load from host byte order to little-endian in place.
#define	WIRELESS_WEP_SUCCESS   0x80
#define	START_STOP_TYPE_STOP   0
#define	START_STOP_TYPE_START   1
#define	PACKET_ENTRY_HEADER_FROM_LE_IN_PLACE(_packet_entry_header)
#define	PACKET_ENTRY_HEADER_TO_LE_IN_PLACE(_packet_entry_header)
#define	OBSERVER_UNDEFINED   0xFF
#define	OBSERVER_ETHERNET   0x00
#define	OBSERVER_TOKENRING   0x01
#define	OBSERVER_FIBRE_CHANNEL   0x08
#define	OBSERVER_WIRELESS_802_11   0x09
#define	PACKET_TYPE_DATA_PACKET   0
#define	PACKET_TYPE_EXPERT_INFORMATION_PACKET   1

Typedefs
typedef struct capture_file_header	capture_file_header
	Top-level file header for a Network Instruments Observer capture file.
typedef struct tlv_header	tlv_header
	TLV (Type-Length-Value) header used for information elements appended to the Observer capture file header.
typedef struct tlv_time_info	tlv_time_info
	TLV payload carrying the timestamp reference timezone for an Observer capture file.
typedef struct tlv_network_load	tlv_network_load
	TLV payload carrying a network load snapshot sampled at the time of capture.
typedef struct tlv_wireless_info	tlv_wireless_info
	TLV payload carrying wireless signal and channel quality metrics for a captured packet.
typedef struct tlv_capture_start_stop	tlv_capture_start_stop
	TLV payload recording a capture start or stop event in the Observer capture file.
typedef struct packet_entry_header	packet_entry_header
	Per-packet record header in a Network Instruments Observer capture file.

Functions
wtap_open_return_val	observer_open (wtap *wth, int *err, char **err_info)
	Opens a capture file using the observer format.

Detailed Description

observer.h - description

begin : Wed Oct 29 2003 copyright : (C) 2003 by root email : scotte[AT}netinst.com

Macro Definition Documentation

CAPTURE_FILE_HEADER_FROM_LE_IN_PLACE

#define CAPTURE_FILE_HEADER_FROM_LE_IN_PLACE

(

_capture_file_header

)

Value:

    _capture_file_header.offset_to_first_packet = GUINT16_FROM_LE((_capture_file_header).offset_to_first_packet)

Converts offset_to_first_packet in a capture_file_header from little-endian to host byte order in place.

CAPTURE_FILE_HEADER_TO_LE_IN_PLACE

#define CAPTURE_FILE_HEADER_TO_LE_IN_PLACE

(

_capture_file_header

)

Value:

    _capture_file_header.offset_to_first_packet = GUINT16_TO_LE((_capture_file_header).offset_to_first_packet)

Converts offset_to_first_packet in a capture_file_header from host byte order to little-endian in place.

PACKET_ENTRY_HEADER_FROM_LE_IN_PLACE

#define PACKET_ENTRY_HEADER_FROM_LE_IN_PLACE

(

_packet_entry_header

)

Value:

    (_packet_entry_header).packet_magic            = GUINT32_FROM_LE((_packet_entry_header).packet_magic); \
    (_packet_entry_header).network_speed           = GUINT32_FROM_LE((_packet_entry_header).network_speed); \
    (_packet_entry_header).captured_size           = GUINT16_FROM_LE((_packet_entry_header).captured_size); \
    (_packet_entry_header).network_size            = GUINT16_FROM_LE((_packet_entry_header).network_size); \
    (_packet_entry_header).offset_to_frame         = GUINT16_FROM_LE((_packet_entry_header).offset_to_frame); \
    (_packet_entry_header).offset_to_next_packet   = GUINT16_FROM_LE((_packet_entry_header).offset_to_next_packet); \
    (_packet_entry_header).errors                  = GUINT16_FROM_LE((_packet_entry_header).errors); \
    (_packet_entry_header).reserved                = GUINT16_FROM_LE((_packet_entry_header).reserved); \
    (_packet_entry_header).packet_number           = GUINT64_FROM_LE((_packet_entry_header).packet_number); \
    (_packet_entry_header).original_packet_number  = GUINT64_FROM_LE((_packet_entry_header).original_packet_number); \
    (_packet_entry_header).nano_seconds_since_2000 = GUINT64_FROM_LE((_packet_entry_header).nano_seconds_since_2000)

PACKET_ENTRY_HEADER_TO_LE_IN_PLACE

#define PACKET_ENTRY_HEADER_TO_LE_IN_PLACE

(

_packet_entry_header

)

Value:

    (_packet_entry_header).packet_magic            = GUINT32_TO_LE((_packet_entry_header).packet_magic); \
    (_packet_entry_header).network_speed           = GUINT32_TO_LE((_packet_entry_header).network_speed); \
    (_packet_entry_header).captured_size           = GUINT16_TO_LE((_packet_entry_header).captured_size); \
    (_packet_entry_header).network_size            = GUINT16_TO_LE((_packet_entry_header).network_size); \
    (_packet_entry_header).offset_to_frame         = GUINT16_TO_LE((_packet_entry_header).offset_to_frame); \
    (_packet_entry_header).offset_to_next_packet   = GUINT16_TO_LE((_packet_entry_header).offset_to_next_packet); \
    (_packet_entry_header).errors                  = GUINT16_TO_LE((_packet_entry_header).errors); \
    (_packet_entry_header).reserved                = GUINT16_TO_LE((_packet_entry_header).reserved); \
    (_packet_entry_header).packet_number           = GUINT64_TO_LE((_packet_entry_header).packet_number); \
    (_packet_entry_header).original_packet_number  = GUINT64_TO_LE((_packet_entry_header).original_packet_number); \
    (_packet_entry_header).nano_seconds_since_2000 = GUINT64_TO_LE((_packet_entry_header).nano_seconds_since_2000)

START_STOP_TYPE_START

#define START_STOP_TYPE_START   1

Capture start event.

START_STOP_TYPE_STOP

#define START_STOP_TYPE_STOP   0

Capture stop event.

TIME_INFO_GMT

#define TIME_INFO_GMT   1

Timestamps in the capture file are in GMT.

TIME_INFO_LOCAL

#define TIME_INFO_LOCAL   0

Timestamps in the capture file are in local time.

TLV_HEADER_FROM_LE_IN_PLACE

#define TLV_HEADER_FROM_LE_IN_PLACE

(

_tlv_header

)

Value:

    (_tlv_header).type   = GUINT16_FROM_LE((_tlv_header).type); \
    (_tlv_header).length = GUINT16_FROM_LE((_tlv_header).length)

Converts all fields of a tlv_header from little-endian to host byte order in place.

TLV_HEADER_TO_LE_IN_PLACE

#define TLV_HEADER_TO_LE_IN_PLACE

(

_tlv_header

)

Value:

    (_tlv_header).type   = GUINT16_TO_LE((_tlv_header).type); \
    (_tlv_header).length = GUINT16_TO_LE((_tlv_header).length)

Converts all fields of a tlv_header from host byte order to little-endian in place.

TLV_NETWORK_LOAD_FROM_LE_IN_PLACE

#define TLV_NETWORK_LOAD_FROM_LE_IN_PLACE

(

_tlv_network_load

)

Value:

    (_tlv_network_load).utilization        = GUINT32_FROM_LE((_tlv_network_load).utilization); \
    (_tlv_network_load).unknown1           = GUINT32_FROM_LE((_tlv_network_load).unknown1); \
    (_tlv_network_load).unknown2           = GUINT32_FROM_LE((_tlv_network_load).unknown2); \
    (_tlv_network_load).packets_per_second = GUINT32_FROM_LE((_tlv_network_load).packets_per_second); \
    (_tlv_network_load).unknown3           = GUINT32_FROM_LE((_tlv_network_load).unknown3); \
    (_tlv_network_load).bytes_per_second   = GUINT32_FROM_LE((_tlv_network_load).bytes_per_second); \
    (_tlv_network_load).unknown4           = GUINT32_FROM_LE((_tlv_network_load).unknown4)

Converts all fields of a tlv_network_load from little-endian to host byte order in place.

TLV_NETWORK_LOAD_TO_LE_IN_PLACE

#define TLV_NETWORK_LOAD_TO_LE_IN_PLACE

(

_tlv_network_load

)

Value:

    (_tlv_network_load).utilization        = GUINT32_TO_LE((_tlv_network_load).utilization); \
    (_tlv_network_load).unknown1           = GUINT32_TO_LE((_tlv_network_load).unknown1); \
    (_tlv_network_load).unknown2           = GUINT32_TO_LE((_tlv_network_load).unknown2); \
    (_tlv_network_load).packets_per_second = GUINT32_TO_LE((_tlv_network_load).packets_per_second); \
    (_tlv_network_load).unknown3           = GUINT32_TO_LE((_tlv_network_load).unknown3); \
    (_tlv_network_load).bytes_per_second   = GUINT32_TO_LE((_tlv_network_load).bytes_per_second); \
    (_tlv_network_load).unknown4           = GUINT32_TO_LE((_tlv_network_load).unknown4)

Converts all fields of a tlv_network_load from host byte order to little-endian in place.

TLV_TIME_INFO_FROM_LE_IN_PLACE

#define TLV_TIME_INFO_FROM_LE_IN_PLACE

(

_tlv_time_info

)

Value:

    (_tlv_time_info).time_format = GUINT32_FROM_LE((_tlv_time_info).time_format)

Converts all fields of a tlv_time_info from little-endian to host byte order in place.

TLV_TIME_INFO_TO_LE_IN_PLACE

#define TLV_TIME_INFO_TO_LE_IN_PLACE

(

_tlv_time_info

)

Value:

    (_tlv_time_info).time_format = GUINT32_TO_LE((_tlv_time_info).time_format)

Converts all fields of a tlv_time_info from host byte order to little-endian in place.

WIRELESS_WEP_SUCCESS

#define WIRELESS_WEP_SUCCESS   0x80

WEP decryption of this packet succeeded.

Typedef Documentation

capture_file_header

typedef struct capture_file_header capture_file_header

Top-level file header for a Network Instruments Observer capture file.

As of v15, observer_version was shortened by one byte to introduce offset_to_first_packet_high_byte, extending the addressable range for the first-packet offset to 16 MB. Files predating v15 will always have offset_to_first_packet_high_byte set to 0.

tlv_network_load

typedef struct tlv_network_load tlv_network_load

TLV payload carrying a network load snapshot sampled at the time of capture.

The purpose of unknown1, unknown2, unknown3, and unknown4 is undetermined; they may represent broadcast counts, multicast counts, or error counters. All have been observed as zero in known captures.

tlv_wireless_info

typedef struct tlv_wireless_info tlv_wireless_info

TLV payload carrying wireless signal and channel quality metrics for a captured packet.

quality takes observed values of 15, 20–27, 50–54, 208, and 213. conditions takes observed values of 0x00, 0x02, and 0x90. reserved takes observed values of 0x00 or 0x80; the 0x80 value co-occurs with conditions = 0x90.

Function Documentation

observer_open()

wtap_open_return_val observer_open	(	wtap *	wth,
		int *	err,
		char **	err_info )

Opens a capture file using the observer format.

This function attempts to open and read the header of a capture file in the observer format.

Parameters

wth	Pointer to the wtap structure that will hold the file information.
err	Pointer to an integer where any error code will be stored if an error occurs.
err_info	Pointer to a char pointer where any error message will be stored if an error occurs.

Returns

A value indicating whether the file was successfully opened or not.

< Timestamps in the capture file are in local time.

< Precision: 1 nanosecond (9 fractional digits).