1 /* SPDX-License-Identifier: BSD-3-Clause 2 * Copyright(c) 2019-2020 Microsoft Corporation 3 * 4 * PCAP Next Generation Capture File writer 5 * 6 * See: https://github.com/pcapng/pcapng/ for the file format. 7 */ 8 9 enum pcapng_block_types { 10 PCAPNG_INTERFACE_BLOCK = 1, 11 PCAPNG_PACKET_BLOCK, /* Obsolete */ 12 PCAPNG_SIMPLE_PACKET_BLOCK, 13 PCAPNG_NAME_RESOLUTION_BLOCK, 14 PCAPNG_INTERFACE_STATS_BLOCK, 15 PCAPNG_ENHANCED_PACKET_BLOCK, 16 17 PCAPNG_SECTION_BLOCK = 0x0A0D0D0A, 18 }; 19 20 struct pcapng_option { 21 uint16_t code; 22 uint16_t length; 23 uint8_t data[]; 24 }; 25 26 #define PCAPNG_BYTE_ORDER_MAGIC 0x1A2B3C4D 27 #define PCAPNG_MAJOR_VERS 1 28 #define PCAPNG_MINOR_VERS 0 29 30 enum pcapng_opt { 31 PCAPNG_OPT_END = 0, 32 PCAPNG_OPT_COMMENT = 1, 33 }; 34 35 struct pcapng_section_header { 36 uint32_t block_type; 37 uint32_t block_length; 38 uint32_t byte_order_magic; 39 uint16_t major_version; 40 uint16_t minor_version; 41 uint64_t section_length; 42 }; 43 44 enum pcapng_section_opt { 45 PCAPNG_SHB_HARDWARE = 2, 46 PCAPNG_SHB_OS = 3, 47 PCAPNG_SHB_USERAPPL = 4, 48 }; 49 50 struct pcapng_interface_block { 51 uint32_t block_type; /* 1 */ 52 uint32_t block_length; 53 uint16_t link_type; 54 uint16_t reserved; 55 uint32_t snap_len; 56 }; 57 58 enum pcapng_interface_options { 59 PCAPNG_IFB_NAME = 2, 60 PCAPNG_IFB_DESCRIPTION, 61 PCAPNG_IFB_IPV4ADDR, 62 PCAPNG_IFB_IPV6ADDR, 63 PCAPNG_IFB_MACADDR, 64 PCAPNG_IFB_EUIADDR, 65 PCAPNG_IFB_SPEED, 66 PCAPNG_IFB_TSRESOL, 67 PCAPNG_IFB_TZONE, 68 PCAPNG_IFB_FILTER, 69 PCAPNG_IFB_OS, 70 PCAPNG_IFB_FCSLEN, 71 PCAPNG_IFB_TSOFFSET, 72 PCAPNG_IFB_HARDWARE, 73 }; 74 75 struct pcapng_enhance_packet_block { 76 uint32_t block_type; /* 6 */ 77 uint32_t block_length; 78 uint32_t interface_id; 79 uint32_t timestamp_hi; 80 uint32_t timestamp_lo; 81 uint32_t capture_length; 82 uint32_t original_length; 83 }; 84 85 /* Flags values */ 86 #define PCAPNG_IFB_INBOUND 0b01 87 #define PCAPNG_IFB_OUTBOUND 0b10 88 89 enum pcapng_epb_options { 90 PCAPNG_EPB_FLAGS = 2, 91 PCAPNG_EPB_HASH, 92 PCAPNG_EPB_DROPCOUNT, 93 PCAPNG_EPB_PACKETID, 94 PCAPNG_EPB_QUEUE, 95 PCAPNG_EPB_VERDICT, 96 }; 97 98 enum pcapng_epb_hash { 99 PCAPNG_HASH_2COMP = 0, 100 PCAPNG_HASH_XOR, 101 PCAPNG_HASH_CRC32, 102 PCAPNG_HASH_MD5, 103 PCAPNG_HASH_SHA1, 104 PCAPNG_HASH_TOEPLITZ, 105 }; 106 107 struct pcapng_simple_packet { 108 uint32_t block_type; /* 3 */ 109 uint32_t block_length; 110 uint32_t packet_length; 111 }; 112 113 struct pcapng_statistics { 114 uint32_t block_type; /* 5 */ 115 uint32_t block_length; 116 uint32_t interface_id; 117 uint32_t timestamp_hi; 118 uint32_t timestamp_lo; 119 }; 120 121 enum pcapng_isb_options { 122 PCAPNG_ISB_STARTTIME = 2, 123 PCAPNG_ISB_ENDTIME, 124 PCAPNG_ISB_IFRECV, 125 PCAPNG_ISB_IFDROP, 126 PCAPNG_ISB_FILTERACCEPT, 127 PCAPNG_ISB_OSDROP, 128 PCAPNG_ISB_USRDELIV, 129 }; 130