aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--plugins/pcap.lua72
1 files changed, 70 insertions, 2 deletions
diff --git a/plugins/pcap.lua b/plugins/pcap.lua
index 1b8d791..ca61026 100644
--- a/plugins/pcap.lua
+++ b/plugins/pcap.lua
@@ -17,8 +17,14 @@
--
local detect = function (c)
- local magic = c:read (4)
- return magic == "\xa1\xb2\xc3\xd4" or magic == "\xd4\xc3\xb2\xa1"
+ local magic = c:u32 ()
+ return magic == 0xa1b2c3d4 or magic == 0xd4c3b2a1
+end
+
+local detect_ng = function (c)
+ local magic = c (9):u32 ()
+ return c:u32 () == 0x0a0d0d0a
+ and (magic == 0x1a2b3c4d or magic == 0x4d3c2b1a)
end
-- Specified in http://www.tcpdump.org/linktypes.html
@@ -176,3 +182,65 @@ end
hex.register { type="pcap", detect=detect, decode=decode }
+-- As described by https://github.com/pcapng/pcapng
+local decode_ng = function (c)
+ assert (c.position == 1)
+ if not detect_ng (c ()) then error ("not a PCAPNG file") end
+
+ c.endianity = "le"
+ c (9):u32 ("byte-order magic: %s", function (u32)
+ if u32 == 0x1a2b3c4d then return "little-endian" end
+
+ c.endianity = "be"
+ return "big-endian"
+ end)
+
+ local function decode_block_type (u32)
+ if u32 == 0x0a0d0d0a then return "Section Header Block" end
+ if u32 == 0x00000001 then return "Interface Description Block" end
+ if u32 == 0x00000003 then return "Simple Packet Block" end
+ if u32 == 0x00000004 then return "Name Resolution Block" end
+ if u32 == 0x00000005 then return "Interface Statistics Block" end
+ if u32 == 0x00000006 then return "Enhanced Packet Block" end
+
+ if u32 == 0x00000BAD or u32 == 0x40000BAD then
+ return "Custom Block"
+ end
+ return "unknown: %d", u32
+ end
+
+ local function decode_shb (c)
+ local magic = c:u32 ()
+ local p, vmajor, vminor = c.position, c:u16 (), c:u16 ()
+ c (p, c.position - 1):mark ("PCAPNG version: %d.%d", vmajor, vminor)
+ -- XXX: what exactly does section_len mean?
+ local section_len = c:u64 ("section length: %d")
+
+ while not c.eof do
+ -- TODO: decode the meaning of options as well
+ local type = c:u16 ("option type: %d")
+ local length = c:u16 ("option length: %d")
+
+ local p = c.position
+ c.position = c.position + length + (-length & 3)
+ c (p, c.position - 1):mark ("option value")
+ end
+ end
+
+ while not c.eof do
+ local block_start = c.position
+ local block_type = c:u32 ("PCAPNG block type: %s", decode_block_type)
+ local block_len = c:u32 ("PCAPNG block length: %d")
+
+ local data_start = c.position
+ c.position = block_start + block_len - 4
+
+ local data = c (data_start, c.position - 1)
+ -- TODO: also decode other types of blocks
+ if block_type == 0x0a0d0d0a then decode_shb (data) end
+
+ local shb_len_end = c:u32 ("PCAPNG trailing block length: %d")
+ end
+end
+
+hex.register { type="pcapng", detect=detect_ng, decode=decode_ng }