Wireshark · Ethereal-dev: [Ethereal-dev] netxray.c - patches

["Bill Meier" <wmeier@xxxxxxxxxxx>]

Based upon examination of certain captures using both windows 
sniffer and ethereal, I'm offering some patches of netxray.c with respect 
to the correct determination of 'time' for frames of a capture.


Patches:

1. I've added comments to the source providing information as to what works 
(timeunit, etc) for the capture file variants that I have.

2. I've changed the code slightly so that for the timeunit determination for 
"version 2" files, the hdr.timeunit test and default timeunit determination 
is done before the testing for special cases. (I've also fixed the 
compare againt NUM_XRAY_UNITS which was 'off-by-one').

3. I've identified 3 'special cases' for timeunit, etc determination from 
the captures I have.

The timeunit, etc needed for two of the cases apparently conflicts with that 
needed for other captures previously seen, so I've not changed the code.

For the third case (for "PPP Captured with Pod" and fhdr.timeunit = 2) 
I've changed the code to use the timeunit, etc which results in the correct 
time display for the captures that I have.

4. I've changed the calculation of microseconds (tv.usec) for each frame to 
'round' the floating point value before the value is converted to an int.

Although this is a small change, it does correct some cases wherein the windows 
sniffer shows a slightly different time for a frame than ethereal 0.10.7.


I welcome any comments on the patches I'm providing.

Bill Meier


Diff (against 0.10.7 netxray.c v12341)

340a341,354
> 		/* Do the default case first so need to do only special cases afterwards
> 		 * Doing the test first against NUM_NETXRAY_TIMEUNITS is OK 
> 		 *  given that all currently 'coded-for special cases' of 
> 		 *  hdr.timeunit are for hdr.timeuinit <= (NUM_NETXRAY_TIMEUNITS-1)
> 		 */
> 
> 		if (hdr.timeunit > (NUM_NETXRAY_TIMEUNITS-1)) {
> 			*err = WTAP_ERR_UNSUPPORTED;
> 			*err_info = g_strdup_printf("netxray: Unknown timeunit %u",
> 				hdr.timeunit);
> 			return -1;
> 		}
> 		timeunit = TpS[hdr.timeunit];
> 
341a356,357
> 		 *Special Cases
> 		 *
353a370,395
> 		 *
> 		 * XXX: In certain cases (related to capture by pod ?) it appears that the  
> 		 *	 file header timehi/timelo fields should be ignored when using the 
> 		 *	 the frame header timehi/timelo fields to determine the time of the frame.
> 		 *	.
> 		 * XXX: The following list of "special cases seen" is a start based upon 
> 		 *	 a particular set of captures examined; 
> 		 *      Additional special cases can be added as available.
> 		 *      
> 	         * Some "Special Cases" seen for network type 1
> 		 *  Notes:
> 		 *    1. Cases marked with ##..##: Apparently in conflict with previous cases
> 		 *       seen. Until the conflict is resolved, the code is as in v0.10.7 
> 		 *    2. Cases marked with >>...<<: Code handles these cases in the absence of known conflicts
> 		 *
> 		 *
> 		 *  version  hdr.xxb[20]  hdr.timeunit	 required    ignore hdr     Capture Type
> 		 *	      [CAPTYPE] 		"timeunit"  timehi/timelo?
> 		 *  =======  ===========  ============	=========   ============    ======================
> 		 *     2.2	 0		  2    ## 1193180##   No	    = "NDIS"
> 		 *
> 		 *     2.2	 2		  2    ##31250000##   YES	    = "Gigabit Pod"
> 		 *
> 		 *     2.2	 3		  2    >> 1250000<<   YES	    = "PPP captured with Pod"
> 		 *
> 		 * 
354a397
> 
361a405,406
> 				 * 
> 				 * XXX: suspicion: start_timestamp should be set to 0.0
383,388c428,433
< 		} else {
< 			if (hdr.timeunit > NUM_NETXRAY_TIMEUNITS) {
< 				*err = WTAP_ERR_UNSUPPORTED;
< 				*err_info = g_strdup_printf("netxray: Unknown timeunit %u",
< 				    hdr.timeunit);
< 				return -1;
---
> 		}
> 
> 		else if ((network_type == 1) && (hdr.xxb[20] == CAPTYPE_PPP)) {
> 			if ((hdr.timeunit == 2) && (version_minor == 2)) {  /* XXX: really all v2 subversions ?? */
> 				timeunit = 1250000.0;
> 				start_timestamp = 0.0;
390d434
< 			timeunit = TpS[hdr.timeunit];
391a436
> 
627c672
< 			*1.0e6);
---
> 					*1.0e6 + 0.5); /* add 0.5 to 'round' before truncating */
641c686
< 			*1.0e6);
---
> 					*1.0e6 + 0.5); /* add 0.5 to 'round' before truncating */