Wireshark  4.3.0
The Wireshark network protocol analyzer
erf_record.h
Go to the documentation of this file.
1 
13 #ifndef __W_ERF_RECORD_H__
14 #define __W_ERF_RECORD_H__
15 
16 /*
17  * Declarations and definitions for ERF records; for use by the ERF
18  * file reader, code to handle LINKTYPE_ERF packets in pcap and
19  * pcapng files, ERF metadata dissectors, and protocol dissectors
20  * that register for particular ERF record types.
21  */
22 
23 /* Record type defines */
24 #define ERF_TYPE_LEGACY 0
25 #define ERF_TYPE_HDLC_POS 1
26 #define ERF_TYPE_ETH 2
27 #define ERF_TYPE_ATM 3
28 #define ERF_TYPE_AAL5 4
29 #define ERF_TYPE_MC_HDLC 5
30 #define ERF_TYPE_MC_RAW 6
31 #define ERF_TYPE_MC_ATM 7
32 #define ERF_TYPE_MC_RAW_CHANNEL 8
33 #define ERF_TYPE_MC_AAL5 9
34 #define ERF_TYPE_COLOR_HDLC_POS 10
35 #define ERF_TYPE_COLOR_ETH 11
36 #define ERF_TYPE_MC_AAL2 12
37 #define ERF_TYPE_IP_COUNTER 13
38 #define ERF_TYPE_TCP_FLOW_COUNTER 14
39 #define ERF_TYPE_DSM_COLOR_HDLC_POS 15
40 #define ERF_TYPE_DSM_COLOR_ETH 16
41 #define ERF_TYPE_COLOR_MC_HDLC_POS 17
42 #define ERF_TYPE_AAL2 18
43 #define ERF_TYPE_COLOR_HASH_POS 19
44 #define ERF_TYPE_COLOR_HASH_ETH 20
45 #define ERF_TYPE_INFINIBAND 21
46 #define ERF_TYPE_IPV4 22
47 #define ERF_TYPE_IPV6 23
48 #define ERF_TYPE_RAW_LINK 24
49 #define ERF_TYPE_INFINIBAND_LINK 25
50 /* XXX - what about 26? */
51 #define ERF_TYPE_META 27
52 #define ERF_TYPE_OPA_SNC 28
53 #define ERF_TYPE_OPA_9B 29
54 
55 /* 28-31 reserved for future public ERF types */
56 
57 /* Record types reserved for local and internal use */
58 #define ERF_TYPE_INTERNAL0 32
59 #define ERF_TYPE_INTERNAL1 33
60 #define ERF_TYPE_INTERNAL2 34
61 #define ERF_TYPE_INTERNAL3 35
62 #define ERF_TYPE_INTERNAL4 36
63 #define ERF_TYPE_INTERNAL5 37
64 #define ERF_TYPE_INTERNAL6 38
65 #define ERF_TYPE_INTERNAL7 39
66 #define ERF_TYPE_INTERNAL8 40
67 #define ERF_TYPE_INTERNAL9 41
68 #define ERF_TYPE_INTERNAL10 42
69 #define ERF_TYPE_INTERNAL11 43
70 #define ERF_TYPE_INTERNAL12 44
71 #define ERF_TYPE_INTERNAL13 45
72 #define ERF_TYPE_INTERNAL14 46
73 #define ERF_TYPE_INTERNAL15 47
74 
75 /* Pad records */
76 #define ERF_TYPE_PAD 48
77 
78 #define ERF_EXT_HDR_TYPE_CLASSIFICATION 3
79 #define ERF_EXT_HDR_TYPE_INTERCEPTID 4
80 #define ERF_EXT_HDR_TYPE_RAW_LINK 5
81 #define ERF_EXT_HDR_TYPE_BFS 6
82 #define ERF_EXT_HDR_TYPE_CHANNELISED 12
83 #define ERF_EXT_HDR_TYPE_SIGNATURE 14
84 #define ERF_EXT_HDR_TYPE_PKT_ID 15
85 #define ERF_EXT_HDR_TYPE_FLOW_ID 16
86 #define ERF_EXT_HDR_TYPE_HOST_ID 17
87 #define ERF_EXT_HDR_TYPE_ANCHOR_ID 18
88 #define ERF_EXT_HDR_TYPE_ENTROPY 19
89 
90 /* Host ID and Anchor ID*/
91 #define ERF_EHDR_HOST_ID_MASK G_GUINT64_CONSTANT(0xffffffffffff)
92 #define ERF_EHDR_ANCHOR_ID_MASK G_GUINT64_CONSTANT(0xffffffffffff)
93 #define ERF_EHDR_MORE_EXTHDR_MASK G_GUINT64_CONSTANT(0x8000000000000000)
94 #define ERF_EHDR_ANCHOR_ID_DEFINITION_MASK G_GUINT64_CONSTANT(0x80000000000000)
95 
96 #define ERF_EHDR_FLOW_ID_STACK_TYPE_MASK G_GUINT64_CONSTANT(0xff00000000)
97 #define ERF_EHDR_FLOW_ID_SOURCE_ID_MASK G_GUINT64_CONSTANT(0xff000000000000)
98 
99 /* ERF Provenance metadata */
100 #define ERF_META_SECTION_MASK 0xFF00
101 #define ERF_META_IS_SECTION(type) (type > 0 && (type & ERF_META_SECTION_MASK) == ERF_META_SECTION_MASK)
102 #define ERF_META_HOST_ID_IMPLICIT G_MAXUINT64
103 #define ERF_ANCHOR_ID_IS_DEFINITION(anchor_id) ((guint64)anchor_id & ERF_EHDR_ANCHOR_ID_DEFINITION_MASK)
104 #define ERF_EHDR_SET_MORE_EXTHDR(ext_hdr) ((guint64)ext_hdr | ERF_EHDR_MORE_EXTHDR_MASK)
105 
106 #define ERF_META_SECTION_CAPTURE 0xFF00
107 #define ERF_META_SECTION_HOST 0xFF01
108 #define ERF_META_SECTION_MODULE 0xFF02
109 #define ERF_META_SECTION_INTERFACE 0xFF03
110 #define ERF_META_SECTION_FLOW 0xFF04
111 #define ERF_META_SECTION_STATS 0xFF05
112 #define ERF_META_SECTION_INFO 0xFF06
113 #define ERF_META_SECTION_CONTEXT 0xFF07
114 #define ERF_META_SECTION_STREAM 0xFF08
115 #define ERF_META_SECTION_TRANSFORM 0xFF09
116 #define ERF_META_SECTION_DNS 0xFF0A
117 #define ERF_META_SECTION_SOURCE 0xFF0B
118 #define ERF_META_SECTION_NETWORK 0xFF0C
119 #define ERF_META_SECTION_ENDPOINT 0xFF0D
120 #define ERF_META_SECTION_INPUT 0xFF0E
121 #define ERF_META_SECTION_OUTPUT 0xFF0F
122 
123 #define ERF_META_TAG_padding 0
124 #define ERF_META_TAG_comment 1
125 #define ERF_META_TAG_gen_time 2
126 #define ERF_META_TAG_parent_section 3
127 #define ERF_META_TAG_reset 4
128 #define ERF_META_TAG_event_time 5
129 #define ERF_META_TAG_host_id 6
130 #define ERF_META_TAG_attribute 7
131 #define ERF_META_TAG_fcs_len 8
132 #define ERF_META_TAG_mask_ipv4 9
133 #define ERF_META_TAG_mask_cidr 10
134 
135 #define ERF_META_TAG_org_name 11
136 #define ERF_META_TAG_name 12
137 #define ERF_META_TAG_descr 13
138 #define ERF_META_TAG_config 14
139 #define ERF_META_TAG_datapipe 15
140 #define ERF_META_TAG_app_name 16
141 #define ERF_META_TAG_os 17
142 #define ERF_META_TAG_hostname 18
143 #define ERF_META_TAG_user 19
144 #define ERF_META_TAG_model 20
145 #define ERF_META_TAG_fw_version 21
146 #define ERF_META_TAG_serial_no 22
147 #define ERF_META_TAG_ts_offset 23
148 #define ERF_META_TAG_ts_clock_freq 24
149 #define ERF_META_TAG_tzone 25
150 #define ERF_META_TAG_tzone_name 26
151 #define ERF_META_TAG_loc_lat 27
152 #define ERF_META_TAG_loc_long 28
153 #define ERF_META_TAG_snaplen 29
154 #define ERF_META_TAG_card_num 30
155 #define ERF_META_TAG_module_num 31
156 #define ERF_META_TAG_access_num 32
157 #define ERF_META_TAG_stream_num 33
158 #define ERF_META_TAG_loc_name 34
159 #define ERF_META_TAG_parent_file 35
160 #define ERF_META_TAG_filter 36
161 #define ERF_META_TAG_flow_hash_mode 37
162 #define ERF_META_TAG_tunneling_mode 38
163 #define ERF_META_TAG_npb_format 39
164 #define ERF_META_TAG_mem 40
165 #define ERF_META_TAG_datamine_id 41
166 #define ERF_META_TAG_rotfile_id 42
167 #define ERF_META_TAG_rotfile_name 43
168 #define ERF_META_TAG_dev_name 44
169 #define ERF_META_TAG_dev_path 45
170 #define ERF_META_TAG_loc_descr 46
171 #define ERF_META_TAG_app_version 47
172 #define ERF_META_TAG_cpu_affinity 48
173 #define ERF_META_TAG_cpu 49
174 #define ERF_META_TAG_cpu_phys_cores 50
175 #define ERF_META_TAG_cpu_numa_nodes 51
176 #define ERF_META_TAG_dag_attribute 52
177 #define ERF_META_TAG_dag_version 53
178 #define ERF_META_TAG_stream_flags 54
179 #define ERF_META_TAG_entropy_threshold 55
180 #define ERF_META_TAG_smart_trunc_default 56
181 #define ERF_META_TAG_ext_hdrs_added 57
182 #define ERF_META_TAG_ext_hdrs_removed 58
183 #define ERF_META_TAG_relative_snaplen 59
184 #define ERF_META_TAG_temperature 60
185 #define ERF_META_TAG_power 61
186 #define ERF_META_TAG_vendor 62
187 #define ERF_META_TAG_cpu_threads 63
188 
189 #define ERF_META_TAG_if_num 64
190 #define ERF_META_TAG_if_vc 65
191 #define ERF_META_TAG_if_speed 66
192 #define ERF_META_TAG_if_ipv4 67
193 #define ERF_META_TAG_if_ipv6 68
194 #define ERF_META_TAG_if_mac 69
195 #define ERF_META_TAG_if_eui 70
196 #define ERF_META_TAG_if_ib_gid 71
197 #define ERF_META_TAG_if_ib_lid 72
198 #define ERF_META_TAG_if_wwn 73
199 #define ERF_META_TAG_if_fc_id 74
200 #define ERF_META_TAG_if_tx_speed 75
201 #define ERF_META_TAG_if_erf_type 76
202 #define ERF_META_TAG_if_link_type 77
203 #define ERF_META_TAG_if_sfp_type 78
204 #define ERF_META_TAG_if_rx_power 79
205 #define ERF_META_TAG_if_tx_power 80
206 #define ERF_META_TAG_if_link_status 81
207 #define ERF_META_TAG_if_phy_mode 82
208 #define ERF_META_TAG_if_port_type 83
209 #define ERF_META_TAG_if_rx_latency 84
210 #define ERF_META_TAG_tap_mode 85
211 #define ERF_META_TAG_tap_fail_mode 86
212 #define ERF_META_TAG_watchdog_expired 87
213 #define ERF_META_TAG_watchdog_interval 88
214 
215 #define ERF_META_TAG_src_ipv4 128
216 #define ERF_META_TAG_dest_ipv4 129
217 #define ERF_META_TAG_src_ipv6 130
218 #define ERF_META_TAG_dest_ipv6 131
219 #define ERF_META_TAG_src_mac 132
220 #define ERF_META_TAG_dest_mac 133
221 #define ERF_META_TAG_src_eui 134
222 #define ERF_META_TAG_dest_eui 135
223 #define ERF_META_TAG_src_ib_gid 136
224 #define ERF_META_TAG_dest_ib_gid 137
225 #define ERF_META_TAG_src_ib_lid 138
226 #define ERF_META_TAG_dest_ib_lid 139
227 #define ERF_META_TAG_src_wwn 140
228 #define ERF_META_TAG_dest_wwn 141
229 #define ERF_META_TAG_src_fc_id 142
230 #define ERF_META_TAG_dest_fc_id 143
231 #define ERF_META_TAG_src_port 144
232 #define ERF_META_TAG_dest_port 145
233 #define ERF_META_TAG_ip_proto 146
234 #define ERF_META_TAG_flow_hash 147
235 #define ERF_META_TAG_filter_match 148
236 #define ERF_META_TAG_filter_match_name 149
237 #define ERF_META_TAG_error_flags 150
238 #define ERF_META_TAG_initiator_pkts 151
239 #define ERF_META_TAG_responder_pkts 152
240 #define ERF_META_TAG_initiator_bytes 153
241 #define ERF_META_TAG_responder_bytes 154
242 #define ERF_META_TAG_initiator_min_entropy 155
243 #define ERF_META_TAG_responder_min_entropy 156
244 #define ERF_META_TAG_initiator_avg_entropy 157
245 #define ERF_META_TAG_responder_avg_entropy 158
246 #define ERF_META_TAG_initiator_max_entropy 159
247 #define ERF_META_TAG_responder_max_entropy 160
248 #define ERF_META_TAG_dpi_application 161
249 #define ERF_META_TAG_dpi_confidence 162
250 #define ERF_META_TAG_dpi_state 163
251 #define ERF_META_TAG_dpi_protocol_stack 164
252 #define ERF_META_TAG_flow_state 165
253 #define ERF_META_TAG_vlan_id 166
254 #define ERF_META_TAG_mpls_label 167
255 #define ERF_META_TAG_vlan_pcp 168
256 #define ERF_META_TAG_mpls_tc 169
257 #define ERF_META_TAG_dscp 170
258 #define ERF_META_TAG_initiator_mpls_label 171
259 #define ERF_META_TAG_responder_mpls_label 172
260 #define ERF_META_TAG_initiator_mpls_tc 173
261 #define ERF_META_TAG_responder_mpls_tc 174
262 #define ERF_META_TAG_initiator_ipv4 175
263 #define ERF_META_TAG_responder_ipv4 176
264 #define ERF_META_TAG_initiator_ipv6 177
265 #define ERF_META_TAG_responder_ipv6 178
266 #define ERF_META_TAG_initiator_mac 179
267 #define ERF_META_TAG_responder_mac 180
268 #define ERF_META_TAG_initiator_port 181
269 #define ERF_META_TAG_responder_port 182
270 #define ERF_META_TAG_initiator_retx 183
271 #define ERF_META_TAG_responder_retx 184
272 #define ERF_META_TAG_initiator_zwin 185
273 #define ERF_META_TAG_responder_zwin 186
274 #define ERF_META_TAG_initiator_tcp_flags 187
275 #define ERF_META_TAG_responder_tcp_flags 188
276 #define ERF_META_TAG_tcp_irtt 189
277 
278 #define ERF_META_TAG_start_time 193
279 #define ERF_META_TAG_end_time 194
280 #define ERF_META_TAG_stat_if_drop 195
281 #define ERF_META_TAG_stat_frames 196
282 #define ERF_META_TAG_stat_bytes 197
283 #define ERF_META_TAG_stat_cap 198
284 #define ERF_META_TAG_stat_cap_bytes 199
285 #define ERF_META_TAG_stat_os_drop 200
286 #define ERF_META_TAG_stat_ds_lctr 201
287 #define ERF_META_TAG_stat_filter_match 202
288 #define ERF_META_TAG_stat_filter_drop 203
289 #define ERF_META_TAG_stat_too_short 204
290 #define ERF_META_TAG_stat_too_long 205
291 #define ERF_META_TAG_stat_rx_error 206
292 #define ERF_META_TAG_stat_fcs_error 207
293 #define ERF_META_TAG_stat_aborted 208
294 #define ERF_META_TAG_stat_proto_error 209
295 #define ERF_META_TAG_stat_b1_error 210
296 #define ERF_META_TAG_stat_b2_error 211
297 #define ERF_META_TAG_stat_b3_error 212
298 #define ERF_META_TAG_stat_rei_error 213
299 #define ERF_META_TAG_stat_drop 214
300 #define ERF_META_TAG_stat_buf_drop 215
301 #define ERF_META_TAG_stream_drop 216
302 #define ERF_META_TAG_stream_buf_drop 217
303 #define ERF_META_TAG_pkt_drop 218
304 #define ERF_META_TAG_record_drop 219
305 #define ERF_META_TAG_bandwidth 220
306 #define ERF_META_TAG_duration 221
307 #define ERF_META_TAG_top_index 222
308 #define ERF_META_TAG_concurrent_flows 223
309 #define ERF_META_TAG_active_flows 224
310 #define ERF_META_TAG_created_flows 225
311 #define ERF_META_TAG_deleted_flows 226
312 #define ERF_META_TAG_active_endpoints 227
313 #define ERF_META_TAG_tx_pkts 228
314 #define ERF_META_TAG_tx_bytes 229
315 #define ERF_META_TAG_rx_bandwidth 230
316 #define ERF_META_TAG_tx_bandwidth 231
317 #define ERF_META_TAG_records 232
318 #define ERF_META_TAG_record_bytes 233
319 #define ERF_META_TAG_pkt_drop_bytes 234
320 #define ERF_META_TAG_record_drop_bytes 235
321 #define ERF_META_TAG_drop_bandwidth 236
322 #define ERF_META_TAG_retx_pkts 237
323 #define ERF_META_TAG_zwin_pkts 238
324 
325 #define ERF_META_TAG_ns_host_ipv4 256
326 #define ERF_META_TAG_ns_host_ipv6 257
327 #define ERF_META_TAG_ns_host_mac 258
328 #define ERF_META_TAG_ns_host_eui 259
329 #define ERF_META_TAG_ns_host_ib_gid 260
330 #define ERF_META_TAG_ns_host_ib_lid 261
331 #define ERF_META_TAG_ns_host_wwn 262
332 #define ERF_META_TAG_ns_host_fc_id 263
333 #define ERF_META_TAG_ns_dns_ipv4 264
334 #define ERF_META_TAG_ns_dns_ipv6 265
335 
336 #define ERF_META_TAG_exthdr 321
337 #define ERF_META_TAG_pcap_ng_block 322
338 #define ERF_META_TAG_asn1 323
339 #define ERF_META_TAG_section_ref 324
340 
341 #define ERF_META_TAG_clk_source 384
342 #define ERF_META_TAG_clk_state 385
343 #define ERF_META_TAG_clk_threshold 386
344 #define ERF_META_TAG_clk_correction 387
345 #define ERF_META_TAG_clk_failures 388
346 #define ERF_META_TAG_clk_resyncs 389
347 #define ERF_META_TAG_clk_phase_error 390
348 #define ERF_META_TAG_clk_input_pulses 391
349 #define ERF_META_TAG_clk_rejected_pulses 392
350 #define ERF_META_TAG_clk_phc_index 393
351 #define ERF_META_TAG_clk_phc_offset 394
352 #define ERF_META_TAG_clk_timebase 395
353 #define ERF_META_TAG_clk_descr 396
354 #define ERF_META_TAG_clk_out_source 397
355 #define ERF_META_TAG_clk_link_mode 398
356 #define ERF_META_TAG_ptp_domain_num 399
357 #define ERF_META_TAG_ptp_steps_removed 400
358 #define ERF_META_TAG_ptp_offset_from_master 401
359 #define ERF_META_TAG_ptp_mean_path_delay 402
360 #define ERF_META_TAG_ptp_parent_identity 403
361 #define ERF_META_TAG_ptp_parent_port_num 404
362 #define ERF_META_TAG_ptp_gm_identity 405
363 #define ERF_META_TAG_ptp_gm_clock_quality 406
364 #define ERF_META_TAG_ptp_current_utc_offset 407
365 #define ERF_META_TAG_ptp_time_properties 408
366 #define ERF_META_TAG_ptp_time_source 409
367 #define ERF_META_TAG_ptp_clock_identity 410
368 #define ERF_META_TAG_ptp_port_num 411
369 #define ERF_META_TAG_ptp_port_state 412
370 #define ERF_META_TAG_ptp_delay_mechanism 413
371 #define ERF_META_TAG_clk_port_proto 414
372 #define ERF_META_TAG_ntp_status 415
373 #define ERF_META_TAG_ntp_stratum 416
374 #define ERF_META_TAG_ntp_rootdelay 417
375 #define ERF_META_TAG_ntp_rootdisp 418
376 #define ERF_META_TAG_ntp_offset 419
377 #define ERF_META_TAG_ntp_frequency 420
378 #define ERF_META_TAG_ntp_sys_jitter 421
379 #define ERF_META_TAG_ntp_peer_remote 422
380 #define ERF_META_TAG_ntp_peer_refid 423
381 
382  /*
383  * The timestamp is 64bit unsigned fixed point little-endian value with
384  * 32 bits for second and 32 bits for fraction.
385  */
386 typedef guint64 erf_timestamp_t;
387 
388 typedef struct erf_record {
389  erf_timestamp_t ts;
390  guint8 type;
391  guint8 flags;
392  guint16 rlen;
393  guint16 lctr;
394  guint16 wlen;
395 } erf_header_t;
396 
397 typedef struct erf_mc_hdr {
398  guint32 mc;
400 
401 typedef struct erf_aal2_hdr {
402  guint32 aal2;
404 
405 typedef struct erf_eth_hdr {
406  guint8 offset;
407  guint8 pad;
409 
410 union erf_subhdr {
411  struct erf_mc_hdr mc_hdr;
412  struct erf_aal2_hdr aal2_hdr;
413  struct erf_eth_hdr eth_hdr;
414 };
415 
416 #endif /* __W_ERF_RECORD_H__ */
417 
418 /*
419  * Editor modelines - https://www.wireshark.org/tools/modelines.html
420  *
421  * Local variables:
422  * c-basic-offset: 8
423  * tab-width: 8
424  * indent-tabs-mode: t
425  * End:
426  *
427  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
428  * :indentSize=8:tabSize=8:noTabs=false:
429  */
Definition: packet-eth.h:13
Definition: erf_record.h:401
Definition: erf_record.h:405
Definition: erf_record.h:397
Definition: erf_record.h:388
Definition: erf_record.h:410