|
 |
a858a87 |
--- tcpslice-1.2a3.orig/search.c 2000-09-10 10:52:40.000000000 +0200
|
|
|
a858a87 |
+++ tcpslice-1.2a3/search.c 2006-07-28 14:56:55.000000000 +0200
|
|
|
a858a87 |
@@ -53,7 +53,7 @@
|
|
|
a858a87 |
/* Size of a packet header in bytes; easier than typing the sizeof() all
|
|
|
a858a87 |
* the time ...
|
|
|
a858a87 |
*/
|
|
|
a858a87 |
-#define PACKET_HDR_LEN (sizeof( struct pcap_pkthdr ))
|
|
|
a858a87 |
+#define PACKET_HDR_LEN (sizeof( struct pcap_sf_pkthdr ))
|
|
|
a858a87 |
|
|
|
a858a87 |
extern int snaplen;
|
|
|
a858a87 |
|
|
|
a858a87 |
@@ -111,16 +111,24 @@
|
|
|
a858a87 |
static void
|
|
|
a858a87 |
extract_header( pcap_t *p, u_char *buf, struct pcap_pkthdr *hdr )
|
|
|
a858a87 |
{
|
|
|
a858a87 |
- memcpy((char *) hdr, (char *) buf, sizeof(struct pcap_pkthdr));
|
|
|
a858a87 |
+ struct pcap_sf_pkthdr hdri;
|
|
|
a858a87 |
+
|
|
|
a858a87 |
+ memcpy((char *) &hdri, (char *) buf, sizeof(struct pcap_sf_pkthdr));
|
|
|
a858a87 |
|
|
|
a858a87 |
if ( pcap_is_swapped( p ) )
|
|
|
a858a87 |
{
|
|
|
a858a87 |
- hdr->ts.tv_sec = SWAPLONG(hdr->ts.tv_sec);
|
|
|
a858a87 |
- hdr->ts.tv_usec = SWAPLONG(hdr->ts.tv_usec);
|
|
|
a858a87 |
- hdr->len = SWAPLONG(hdr->len);
|
|
|
a858a87 |
- hdr->caplen = SWAPLONG(hdr->caplen);
|
|
|
a858a87 |
+ hdr->ts.tv_sec = SWAPLONG(hdri.ts.tv_sec);
|
|
|
a858a87 |
+ hdr->ts.tv_usec = SWAPLONG(hdri.ts.tv_usec);
|
|
|
a858a87 |
+ hdr->len = SWAPLONG(hdri.len);
|
|
|
a858a87 |
+ hdr->caplen = SWAPLONG(hdri.caplen);
|
|
|
a858a87 |
+ }
|
|
|
a858a87 |
+ else
|
|
|
a858a87 |
+ {
|
|
|
a858a87 |
+ hdr->ts.tv_sec = hdri.ts.tv_sec;
|
|
|
a858a87 |
+ hdr->ts.tv_usec = hdri.ts.tv_usec;
|
|
|
a858a87 |
+ hdr->len = hdri.len;
|
|
|
a858a87 |
+ hdr->caplen = hdri.caplen;
|
|
|
a858a87 |
}
|
|
|
a858a87 |
-
|
|
|
a858a87 |
/*
|
|
|
a858a87 |
* From bpf/libpcap/savefile.c:
|
|
|
a858a87 |
*
|
|
|
a858a87 |
--- tcpslice-1.2a3.orig/tcpslice.h 1995-11-02 00:40:53.000000000 +0100
|
|
|
a858a87 |
+++ tcpslice-1.2a3/tcpslice.h 2006-07-28 14:56:55.000000000 +0200
|
|
|
a858a87 |
@@ -20,6 +20,26 @@
|
|
|
a858a87 |
*/
|
|
|
a858a87 |
|
|
|
a858a87 |
|
|
|
a858a87 |
+#include <time.h>
|
|
|
a858a87 |
+/* #include <net/bpf.h> */
|
|
|
a858a87 |
+
|
|
|
a858a87 |
+/*
|
|
|
a858a87 |
+ * This is a timeval as stored in disk in a dumpfile.
|
|
|
a858a87 |
+ * It has to use the same types everywhere, independent of the actual
|
|
|
a858a87 |
+ * `struct timeval'
|
|
|
a858a87 |
+ */
|
|
|
a858a87 |
+
|
|
|
a858a87 |
+struct pcap_timeval {
|
|
|
a858a87 |
+ bpf_int32 tv_sec; /* seconds */
|
|
|
a858a87 |
+ bpf_int32 tv_usec; /* microseconds */
|
|
|
a858a87 |
+};
|
|
|
a858a87 |
+
|
|
|
a858a87 |
+struct pcap_sf_pkthdr {
|
|
|
a858a87 |
+ struct pcap_timeval ts; /* time stamp */
|
|
|
a858a87 |
+ bpf_u_int32 caplen; /* length of portion present */
|
|
|
a858a87 |
+ bpf_u_int32 len; /* length this packet (off wire) */
|
|
|
a858a87 |
+};
|
|
|
a858a87 |
+
|
|
|
a858a87 |
time_t gwtm2secs( struct tm *tm );
|
|
|
a858a87 |
|
|
|
a858a87 |
int sf_find_end( struct pcap *p, struct timeval *first_timestamp,
|