WildPackets' EtherHelp appears to write EtherPeek-compatible files,

except that the 0x80 bit is turned on in the file version number field.
Turn that bit off before processing that field.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9342 f5534014-38df-0310-8fa8-9805f1628bb7

diff --git a/README b/README
index 59c1dac9b3689b35f232db6e6d3eea571c94aed4..475ee36487863b0d9e01660bbadbb5f4cf85befe 100644 (file)
--- a/README
+++ b/README
@@ -1,4 +1,4 @@
-$Id: README,v 1.62 2003/10/31 08:15:14 guy Exp $
+$Id: README,v 1.63 2003/12/18 03:41:00 guy Exp $
 
 General Information
 ------- -----------
@@ -96,7 +96,7 @@ Microsoft Network Monitor
 AIX's iptrace
 Cinco Networks NetXRray
 Network Associates Windows-based Sniffer
-AG Group/WildPackets EtherPeek/TokenPeek/AiroPeek
+AG Group/WildPackets EtherPeek/TokenPeek/AiroPeek/EtherHelp
 RADCOM's WAN/LAN Analyzer
 Lucent/Ascend access products
 HP-UX's nettl

diff --git a/doc/editcap.pod b/doc/editcap.pod
index 4304972b89df74ca215511787f3996a755c4712c..5b65a6232541abb658a87a61d2dc3a14fc58f0c8 100644 (file)
--- a/doc/editcap.pod
+++ b/doc/editcap.pod
@@ -29,12 +29,13 @@ B<LANalyzer> captures, Network General/Network Associates DOS-based
 B<Sniffer> (compressed or uncompressed) captures, Microsoft B<Network
 Monitor> captures, files from AIX's B<iptrace>, Cinco Networks
 B<NetXRay> captures, captures from Network Associates Windows-based
-B<Sniffer>, AG Group/WildPackets B<EtherPeek>/B<TokenPeek>/B<AiroPeek>
-captures, captures from B<RADCOM>'s WAN/LAN analyzer, B<Lucent/Ascend>
-router debug output, files from HP-UX's B<nettl>, the dump output from
-B<Toshiba's> ISDN routers, the output from B<i4btrace> from the ISDN4BSD
-project, the output in B<IPLog> format from the Cisco Secure Intrusion
-Detection System, B<pppd logs> (pppdump format), the output from VMS's
+B<Sniffer>, AG Group/WildPackets
+B<EtherPeek>/B<TokenPeek>/B<AiroPeek>/B<EtherHelp> captures, captures
+from B<RADCOM>'s WAN/LAN analyzer, B<Lucent/Ascend> router debug output,
+files from HP-UX's B<nettl>, the dump output from B<Toshiba's> ISDN
+routers, the output from B<i4btrace> from the ISDN4BSD project, the
+output in B<IPLog> format from the Cisco Secure Intrusion Detection
+System, B<pppd logs> (pppdump format), the output from VMS's
 B<TCPIPtrace>/B<TCPtrace>/B<UCX$TRACE> utilities, the text output from
 the B<DBS Etherwatch> VMS utility, traffic capture files from Visual
 Networks' Visual UpTime, the output from B<CoSine> L2 debug, the output

diff --git a/doc/ethereal.pod b/doc/ethereal.pod
index 7af89c3979ddd137b60b25206781af676be9e034..200d723227932daba6822d5a9bd9d05c8498a855 100644 (file)
--- a/doc/ethereal.pod
+++ b/doc/ethereal.pod
@@ -47,12 +47,13 @@ Novell B<LANalyzer> captures, Network General/Network Associates
 DOS-based B<Sniffer> (compressed or uncompressed) captures, Microsoft
 B<Network Monitor> captures, files from AIX's B<iptrace>, Cinco Networks
 B<NetXRay> captures, captures from Network Associates Windows-based
-B<Sniffer>, AG Group/WildPackets B<EtherPeek>/B<TokenPeek>/B<AiroPeek>
-captures, captures from B<RADCOM>'s WAN/LAN analyzer, B<Lucent/Ascend>
-router debug output, files from HP-UX's B<nettl>, the dump output from
-B<Toshiba's> ISDN routers, the output from B<i4btrace> from the ISDN4BSD
-project, the output in B<IPLog> format from the Cisco Secure Intrusion
-Detection System, B<pppd logs> (pppdump format), the output from VMS's
+B<Sniffer>, AG Group/WildPackets
+B<EtherPeek>/B<TokenPeek>/B<AiroPeek>/B<EtherHelp> captures, captures
+from B<RADCOM>'s WAN/LAN analyzer, B<Lucent/Ascend> router debug output,
+files from HP-UX's B<nettl>, the dump output from B<Toshiba's> ISDN
+routers, the output from B<i4btrace> from the ISDN4BSD project, the
+output in B<IPLog> format from the Cisco Secure Intrusion Detection
+System, B<pppd logs> (pppdump format), the output from VMS's
 B<TCPIPtrace>/B<TCPtrace>/B<UCX$TRACE> utilities, the text output from
 the B<DBS Etherwatch> VMS utility, traffic capture files from Visual
 Networks' Visual UpTime, the output from B<CoSine> L2 debug, the output

diff --git a/doc/mergecap.pod b/doc/mergecap.pod
index e28a42a2840cbf54af4a947f90f4cbd824469487..c7d104256e41c13ea389d4d4554ee3e2fcae9370 100644 (file)
--- a/doc/mergecap.pod
+++ b/doc/mergecap.pod
@@ -26,9 +26,9 @@ captures, Network General/Network Associates DOS-based B<Sniffer>
 (compressed or uncompressed) captures, Microsoft B<Network Monitor>
 captures, files from AIX's B<iptrace>, Cinco Networks B<NetXRay>
 captures, captures from Network Associates Windows-based B<Sniffer>, AG
-Group/WildPackets B<EtherPeek>/B<TokenPeek>/B<AiroPeek> captures,
-captures from B<RADCOM>'s WAN/LAN analyzer, B<Lucent/Ascend> router
-debug output, files from HP-UX's B<nettl>, the dump output from
+Group/WildPackets B<EtherPeek>/B<TokenPeek>/B<AiroPeek>/B<EtherHelp>
+captures, captures from B<RADCOM>'s WAN/LAN analyzer, B<Lucent/Ascend>
+router debug output, files from HP-UX's B<nettl>, the dump output from
 B<Toshiba's> ISDN routers, the output from B<i4btrace> from the ISDN4BSD
 project, the output in B<IPLog> format from the Cisco Secure Intrusion
 Detection System, B<pppd logs> (pppdump format), the output from VMS's
@@ -42,7 +42,7 @@ need to tell B<Mergecap> what type of file you are reading; it will
 determine the file type by itself.  B<Mergecap> is also capable of
 reading any of these file formats if they are compressed using gzip. 
 B<Mergecap> recognizes this directly from the file; the '.gz' extension
-is not required for this purpose. 
+is not required for this purpose.
 
 By default, it writes the capture file in B<libpcap> format, and writes
 all of the packets in both input capture files to the output file.  The

diff --git a/doc/tethereal.pod b/doc/tethereal.pod
index 370836961a81f779d09cb39428130060e4f48633..db9735182381483edf5618adaade6e24a3e0f11e 100644 (file)
--- a/doc/tethereal.pod
+++ b/doc/tethereal.pod
@@ -50,8 +50,8 @@ General/Network Associates DOS-based B<Sniffer> (compressed or
 uncompressed) captures, Microsoft B<Network Monitor> captures, files
 from AIX's B<iptrace>, Cinco Networks B<NetXRay> captures, captures from
 Network Associates Windows-based B<Sniffer>, AG Group/WildPackets
-B<EtherPeek>/B<TokenPeek>/B<AiroPeek> captures, captures from
-B<RADCOM>'s WAN/LAN analyzer, B<Lucent/Ascend> router debug output,
+B<EtherPeek>/B<TokenPeek>/B<AiroPeek>/B<EtherHelp> captures, captures
+from B<RADCOM>'s WAN/LAN analyzer, B<Lucent/Ascend> router debug output,
 files from HP-UX's B<nettl>, the dump output from B<Toshiba's> ISDN
 routers, the output from B<i4btrace> from the ISDN4BSD project, the
 output in B<IPLog> format from the Cisco Secure Intrusion Detection

diff --git a/wiretap/etherpeek.c b/wiretap/etherpeek.c
index 13591ab5230bf66d8e0ee06629e03045b6756bce..53bd8f66f402ccbb267423c8f5fd2c37e4923b59 100644 (file)
--- a/wiretap/etherpeek.c
+++ b/wiretap/etherpeek.c
@@ -2,7 +2,7 @@
  * Routines for opening EtherPeek (and TokenPeek?) files
  * Copyright (c) 2001, Daniel Thompson <d.thompson@gmx.net>
  *
- * $Id: etherpeek.c,v 1.24 2003/10/01 07:11:46 guy Exp $
+ * $Id: etherpeek.c,v 1.25 2003/12/18 03:43:40 guy Exp $
  *
  * Wiretap Library
  * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
@@ -163,6 +163,20 @@ int etherpeek_open(wtap *wth, int *err)
                &ep_hdr.master, sizeof(ep_hdr.master), wth->fh, err);
        wth->data_offset += sizeof(ep_hdr.master);
 
+       /*
+        * It appears that EtherHelp (a free application from WildPackets
+        * that did blind capture, saving to a file, so that you could
+        * give the resulting file to somebody with EtherPeek) saved
+        * captures in EtherPeek format except that it ORed the 0x80
+        * bit on in the version number.
+        *
+        * We therefore strip off the 0x80 bit in the version number.
+        * Perhaps there's some reason to care whether the capture
+        * came from EtherHelp; if we discover one, we should check
+        * that bit.
+        */
+       ep_hdr.master.version &= ~0x80;
+
        /* switch on the file version */
        switch (ep_hdr.master.version) {