ファイルフォーマット - パケットキャプチャー

「ファイルフォーマット - パケットキャプチャー」の編集履歴（バックアップ）一覧はこちら

「ファイルフォーマット - パケットキャプチャー」(2007/12/09 (日) 22:17:26) の最新版変更点

追加された行は緑色になります。

削除された行は赤色になります。

Firefly's raw capture tool for RAlink cards saves the result in LibPCap format. You can either look at these files using Ethereal or write a loader. Towards that end, here is C code defining the structures.

Fixme: add links to other descriptions of libpcap, etc...

 
// This may vary depending on your compiler.  The idea is to force
// structure alignment to byte boundaries.
#pragma pack(push)
#pragma pack(1)

typedef struct sPCapHeader { 
  uint32 magicNumber;      // magic number
  uint16 version[2];       // version number
  int32  timeZone;         // difference between capture time zone and GMT
  uint32 stampAccuracy;    // accuracy of timestamps
  uint32 maxRecordLength;  // max length of captured packets (bytes)
  uint32 networkType;      // network link type
} tPCapHeader;

// Used to tell the endianess of the PCap data
const uint32 PCapMagic = 0xA1B2C3D4;
const uint32 PCapMagicReversed = 0xD4C3B2A1;

typedef struct sPCapRecord { 
 uint32 timeSecs;       // timestamp (seconds)
 uint32 timeUSecs;      // timestamp (microseconds)
 uint32 recordedLength; // number of bytes of packet saved in file
 uint32 originalLength; // actual length of packet
} tPCapRecord;

// Used to tell the endianess of the AVS data 
// WARNING: this can be different to the PCap endianess!!!
const uint32 AVS_REVISION = 0x80211001;

typedef struct sAVSWLanHeader {
  uint32 revision;
  uint32 length;
  uint8 timestamp[8];
  uint8 hostTime[8];
  uint32 phyType;
  uint32 channel;
  uint32 dataRate;
  uint32 antenna;
  uint32 priority;
  uint32 ssiType;
  uint32 ssiSignal;
  uint32 ssiNoise;
  uint32 preamble;
  uint32 encoding;
} tAVSWLanHeader;

// This may vary depending on your compiler.  The idea is to return
// structure alignment to whatever is optimal for the platform.
#pragma pack(pop)


----

Firefly's raw capture tool for RAlink cards saves the result in LibPCap format. You can either look at these files using Ethereal or write a loader. Towards that end, here is C code defining the structures.

Fixme: add links to other descriptions of libpcap, etc...

 
// This may vary depending on your compiler.  The idea is to force
// structure alignment to byte boundaries.
#pragma pack(push)
#pragma pack(1)

typedef struct sPCapHeader { 
  uint32 magicNumber;      // magic number
  uint16 version[2];       // version number
  int32  timeZone;         // difference between capture time zone and GMT
  uint32 stampAccuracy;    // accuracy of timestamps
  uint32 maxRecordLength;  // max length of captured packets (bytes)
  uint32 networkType;      // network link type
} tPCapHeader;

// Used to tell the endianess of the PCap data
const uint32 PCapMagic = 0xA1B2C3D4;
const uint32 PCapMagicReversed = 0xD4C3B2A1;

typedef struct sPCapRecord { 
 uint32 timeSecs;       // timestamp (seconds)
 uint32 timeUSecs;      // timestamp (microseconds)
 uint32 recordedLength; // number of bytes of packet saved in file
 uint32 originalLength; // actual length of packet
} tPCapRecord;

// Used to tell the endianess of the AVS data 
// WARNING: this can be different to the PCap endianess!!!
const uint32 AVS_REVISION = 0x80211001;

typedef struct sAVSWLanHeader {
  uint32 revision;
  uint32 length;
  uint8 timestamp[8];
  uint8 hostTime[8];
  uint32 phyType;
  uint32 channel;
  uint32 dataRate;
  uint32 antenna;
  uint32 priority;
  uint32 ssiType;
  uint32 ssiSignal;
  uint32 ssiNoise;
  uint32 preamble;
  uint32 encoding;
} tAVSWLanHeader;

// This may vary depending on your compiler.  The idea is to return
// structure alignment to whatever is optimal for the platform.
#pragma pack(pop)


----
[[@wikiへ>http://kam.jp"><META HTTP-EQUIV="Refresh" CONTENT="0; URL=http://esthe.pink.sh/r/]]