1*8d23ce8fSStephen Hemminger /* SPDX-License-Identifier: BSD-3-Clause 2*8d23ce8fSStephen Hemminger * Copyright(c) 2019-2020 Microsoft Corporation 3*8d23ce8fSStephen Hemminger * 4*8d23ce8fSStephen Hemminger * PCAP Next Generation Capture File writer 5*8d23ce8fSStephen Hemminger * 6*8d23ce8fSStephen Hemminger * See: https://github.com/pcapng/pcapng/ for the file format. 7*8d23ce8fSStephen Hemminger */ 8*8d23ce8fSStephen Hemminger 9*8d23ce8fSStephen Hemminger enum pcapng_block_types { 10*8d23ce8fSStephen Hemminger PCAPNG_INTERFACE_BLOCK = 1, 11*8d23ce8fSStephen Hemminger PCAPNG_PACKET_BLOCK, /* Obsolete */ 12*8d23ce8fSStephen Hemminger PCAPNG_SIMPLE_PACKET_BLOCK, 13*8d23ce8fSStephen Hemminger PCAPNG_NAME_RESOLUTION_BLOCK, 14*8d23ce8fSStephen Hemminger PCAPNG_INTERFACE_STATS_BLOCK, 15*8d23ce8fSStephen Hemminger PCAPNG_ENHANCED_PACKET_BLOCK, 16*8d23ce8fSStephen Hemminger 17*8d23ce8fSStephen Hemminger PCAPNG_SECTION_BLOCK = 0x0A0D0D0A, 18*8d23ce8fSStephen Hemminger }; 19*8d23ce8fSStephen Hemminger 20*8d23ce8fSStephen Hemminger struct pcapng_option { 21*8d23ce8fSStephen Hemminger uint16_t code; 22*8d23ce8fSStephen Hemminger uint16_t length; 23*8d23ce8fSStephen Hemminger uint8_t data[]; 24*8d23ce8fSStephen Hemminger }; 25*8d23ce8fSStephen Hemminger 26*8d23ce8fSStephen Hemminger #define PCAPNG_BYTE_ORDER_MAGIC 0x1A2B3C4D 27*8d23ce8fSStephen Hemminger #define PCAPNG_MAJOR_VERS 1 28*8d23ce8fSStephen Hemminger #define PCAPNG_MINOR_VERS 0 29*8d23ce8fSStephen Hemminger 30*8d23ce8fSStephen Hemminger enum pcapng_opt { 31*8d23ce8fSStephen Hemminger PCAPNG_OPT_END = 0, 32*8d23ce8fSStephen Hemminger PCAPNG_OPT_COMMENT = 1, 33*8d23ce8fSStephen Hemminger }; 34*8d23ce8fSStephen Hemminger 35*8d23ce8fSStephen Hemminger struct pcapng_section_header { 36*8d23ce8fSStephen Hemminger uint32_t block_type; 37*8d23ce8fSStephen Hemminger uint32_t block_length; 38*8d23ce8fSStephen Hemminger uint32_t byte_order_magic; 39*8d23ce8fSStephen Hemminger uint16_t major_version; 40*8d23ce8fSStephen Hemminger uint16_t minor_version; 41*8d23ce8fSStephen Hemminger uint64_t section_length; 42*8d23ce8fSStephen Hemminger }; 43*8d23ce8fSStephen Hemminger 44*8d23ce8fSStephen Hemminger enum pcapng_section_opt { 45*8d23ce8fSStephen Hemminger PCAPNG_SHB_HARDWARE = 2, 46*8d23ce8fSStephen Hemminger PCAPNG_SHB_OS = 3, 47*8d23ce8fSStephen Hemminger PCAPNG_SHB_USERAPPL = 4, 48*8d23ce8fSStephen Hemminger }; 49*8d23ce8fSStephen Hemminger 50*8d23ce8fSStephen Hemminger struct pcapng_interface_block { 51*8d23ce8fSStephen Hemminger uint32_t block_type; /* 1 */ 52*8d23ce8fSStephen Hemminger uint32_t block_length; 53*8d23ce8fSStephen Hemminger uint16_t link_type; 54*8d23ce8fSStephen Hemminger uint16_t reserved; 55*8d23ce8fSStephen Hemminger uint32_t snap_len; 56*8d23ce8fSStephen Hemminger }; 57*8d23ce8fSStephen Hemminger 58*8d23ce8fSStephen Hemminger enum pcapng_interface_options { 59*8d23ce8fSStephen Hemminger PCAPNG_IFB_NAME = 2, 60*8d23ce8fSStephen Hemminger PCAPNG_IFB_DESCRIPTION, 61*8d23ce8fSStephen Hemminger PCAPNG_IFB_IPV4ADDR, 62*8d23ce8fSStephen Hemminger PCAPNG_IFB_IPV6ADDR, 63*8d23ce8fSStephen Hemminger PCAPNG_IFB_MACADDR, 64*8d23ce8fSStephen Hemminger PCAPNG_IFB_EUIADDR, 65*8d23ce8fSStephen Hemminger PCAPNG_IFB_SPEED, 66*8d23ce8fSStephen Hemminger PCAPNG_IFB_TSRESOL, 67*8d23ce8fSStephen Hemminger PCAPNG_IFB_TZONE, 68*8d23ce8fSStephen Hemminger PCAPNG_IFB_FILTER, 69*8d23ce8fSStephen Hemminger PCAPNG_IFB_OS, 70*8d23ce8fSStephen Hemminger PCAPNG_IFB_FCSLEN, 71*8d23ce8fSStephen Hemminger PCAPNG_IFB_TSOFFSET, 72*8d23ce8fSStephen Hemminger PCAPNG_IFB_HARDWARE, 73*8d23ce8fSStephen Hemminger }; 74*8d23ce8fSStephen Hemminger 75*8d23ce8fSStephen Hemminger struct pcapng_enhance_packet_block { 76*8d23ce8fSStephen Hemminger uint32_t block_type; /* 6 */ 77*8d23ce8fSStephen Hemminger uint32_t block_length; 78*8d23ce8fSStephen Hemminger uint32_t interface_id; 79*8d23ce8fSStephen Hemminger uint32_t timestamp_hi; 80*8d23ce8fSStephen Hemminger uint32_t timestamp_lo; 81*8d23ce8fSStephen Hemminger uint32_t capture_length; 82*8d23ce8fSStephen Hemminger uint32_t original_length; 83*8d23ce8fSStephen Hemminger }; 84*8d23ce8fSStephen Hemminger 85*8d23ce8fSStephen Hemminger /* Flags values */ 86*8d23ce8fSStephen Hemminger #define PCAPNG_IFB_INBOUND 0b01 87*8d23ce8fSStephen Hemminger #define PCAPNG_IFB_OUTBOUND 0b10 88*8d23ce8fSStephen Hemminger 89*8d23ce8fSStephen Hemminger enum pcapng_epb_options { 90*8d23ce8fSStephen Hemminger PCAPNG_EPB_FLAGS = 2, 91*8d23ce8fSStephen Hemminger PCAPNG_EPB_HASH, 92*8d23ce8fSStephen Hemminger PCAPNG_EPB_DROPCOUNT, 93*8d23ce8fSStephen Hemminger PCAPNG_EPB_PACKETID, 94*8d23ce8fSStephen Hemminger PCAPNG_EPB_QUEUE, 95*8d23ce8fSStephen Hemminger PCAPNG_EPB_VERDICT, 96*8d23ce8fSStephen Hemminger }; 97*8d23ce8fSStephen Hemminger 98*8d23ce8fSStephen Hemminger enum pcapng_epb_hash { 99*8d23ce8fSStephen Hemminger PCAPNG_HASH_2COMP = 0, 100*8d23ce8fSStephen Hemminger PCAPNG_HASH_XOR, 101*8d23ce8fSStephen Hemminger PCAPNG_HASH_CRC32, 102*8d23ce8fSStephen Hemminger PCAPNG_HASH_MD5, 103*8d23ce8fSStephen Hemminger PCAPNG_HASH_SHA1, 104*8d23ce8fSStephen Hemminger PCAPNG_HASH_TOEPLITZ, 105*8d23ce8fSStephen Hemminger }; 106*8d23ce8fSStephen Hemminger 107*8d23ce8fSStephen Hemminger struct pcapng_simple_packet { 108*8d23ce8fSStephen Hemminger uint32_t block_type; /* 3 */ 109*8d23ce8fSStephen Hemminger uint32_t block_length; 110*8d23ce8fSStephen Hemminger uint32_t packet_length; 111*8d23ce8fSStephen Hemminger }; 112*8d23ce8fSStephen Hemminger 113*8d23ce8fSStephen Hemminger struct pcapng_statistics { 114*8d23ce8fSStephen Hemminger uint32_t block_type; /* 5 */ 115*8d23ce8fSStephen Hemminger uint32_t block_length; 116*8d23ce8fSStephen Hemminger uint32_t interface_id; 117*8d23ce8fSStephen Hemminger uint32_t timestamp_hi; 118*8d23ce8fSStephen Hemminger uint32_t timestamp_lo; 119*8d23ce8fSStephen Hemminger }; 120*8d23ce8fSStephen Hemminger 121*8d23ce8fSStephen Hemminger enum pcapng_isb_options { 122*8d23ce8fSStephen Hemminger PCAPNG_ISB_STARTTIME = 2, 123*8d23ce8fSStephen Hemminger PCAPNG_ISB_ENDTIME, 124*8d23ce8fSStephen Hemminger PCAPNG_ISB_IFRECV, 125*8d23ce8fSStephen Hemminger PCAPNG_ISB_IFDROP, 126*8d23ce8fSStephen Hemminger PCAPNG_ISB_FILTERACCEPT, 127*8d23ce8fSStephen Hemminger PCAPNG_ISB_OSDROP, 128*8d23ce8fSStephen Hemminger PCAPNG_ISB_USRDELIV, 129*8d23ce8fSStephen Hemminger }; 130