https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4221
Summary: Media Types for NM3.x NetmonFilter and NetworkInfoEx
Product: Wireshark
Version: 1.2.0
Platform: All
OS/Version: Windows 7
Status: NEW
Severity: Major
Priority: Medium
Component: Wireshark
AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
ReportedBy: paullo@xxxxxxxxxxxxx
Build Information:
Version 1.2.0 (SVN Rev 28753)
Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled with GTK+ 2.14.7, with GLib 2.18.4, with WinPcap (version unknown),
with libz 1.2.3, without POSIX capabilities, without libpcre, without SMI,
without c-ares, without ADNS, with Lua 5.1, without GnuTLS, without Gcrypt,
without Kerberos, without GeoIP, with PortAudio V19-devel (built Jun 15 2009),
without AirPcap.
NOTE: this build doesn't support the "matches" operator for Wireshark filter
syntax.
Running on Windows Vista, build 7600, without WinPcap.
Built using Microsoft Visual C++ 9.0 build 30729
Wireshark is Open Source Software released under the GNU General Public
License.
Check the man page and http://www.wireshark.org for more information.
--
Network Monitor 3 has added two media types for storing information about the
applied filter and Network Information.
1. Filter Frame Format
Media Type = 0xFFFF is the NetworkFilter media type. It has a format that is
described by this NPL (which is the language of NM parsers). All fields are
Big Endian, except where prefixed by [DataFieldByteOrder = LittleEndian]. Look
at frame 1 of the attached trace for an example.
Protocol NetmonFilter = "Updated " + FilterType.ToString + ": " + Filter
{
UINT16 Version;
UINT32 FilterType = this==1 ? "Capture Filter" : "Display Filter";
UINT32 AppMajorVersion;
UINT32 AppMinorVersion;
[DataFieldByteOrder = LittleEndian]
UnicodeString ApplicationName;
[DataFieldByteOrder = LittleEndian]
UnicodeString Filter;
}
UnicodeString is NULL terminated.
2. NetworkInfoEx Frame Format
Media Type = 0xFFFB for NetworkInfoEx. The following NPL describes it's
format. All fields are Big Endian, except where prefixed by
[DataFieldByteOrder = LittleEndian]. Look at frame 2 of the attached trace for
an example.
Protocol NetworkInfo = FormatString("Network info for %s, Network Adapter Count
= %d",ComputerName,AdapterCount)
{
UINT16 AdapterCount;
[DataFieldByteOrder = LittleEndian]
UnicodeString ComputerName;
[MaxLoopCount=AdapterCount, Property.NetworkAdapterInfo = "NetworkInfo"]
while[true] {
NetMonNetworkAdapter NetworkAdapter;
}
}
For each adapter, there is a NetMonNetworkAdapter structure which is defined as
follows.
Struct NetMonNetworkAdapter = FormatString("%s,
%s",Property.NetworkInfoFriendlyName,Property.NetworkInfoHardwareAddr)
{
[DataFieldByteOrder = LittleEndian]
UnicodeString FriendlyName;
[DataFieldByteOrder = LittleEndian]
UnicodeString Description;
switch(Property.NetworkAdapterInfo)
{
case "NetworkInfo":
[DataFieldByteOrder = LittleEndian]
UnicodeString LayerName;
}
[DataFieldByteOrder = LittleEndian]
UnicodeString MiniportGuid;
UINT32 MediaType;
UINT32 Mtu;
UINT64 LinkSpeed = LinkSpeedTable(this);
MacAddress HardwareAddress;
UINT16 Ipv4AddressCount;
UINT16 Ipv6AddressCount;
UINT16 GatewayAddressCount;
UINT16 DhcpServerAddressCount;
UINT16 DnsIpv4AddressCount;
UINT16 DnsIpv6AddressCount;
Ipv4Address Ipv4Address[Ipv4AddressCount];
Ipv4Address SubnetMask[Ipv4AddressCount];
Ipv6Address Ipv6Address[Ipv6AddressCount];
Ipv4Address GatewayAddress[GatewayAddressCount];
Ipv4Address DhcpServerAddress[DhcpServerAddressCount];
Ipv4Address DnsIpv4Address[DnsIpv4AddressCount];
Ipv6Address DnsIpv6Address[DnsIpv6AddressCount];
}
MacAddress is 6 bytes.
IPv4 is 4 bytes.
IPv6 is 16 bytes
[value] represent an array of values.
LinkSpeedTable is defined as follows:
Table LinkSpeedTable(Value)
{
switch
{
case Value >= 1000 * 1000 * 1024: FormatString("%d Gbps", Value / (1000 *
1000 * 1000));
case Value >= 1000 * 1000: FormatString("%d Mbps", Value / (1000 * 1000));
case Value >= 1000: FormatString("%d Kbps", Value / 1000);
default: FormatString("%d bps", Value);
}
}
Hopefully this is straight forward enough to define the format of these frames.
If not I can certainly add more details as required.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
