head 1.1; branch 1.1.1; access; symbols perseant-exfatfs-base-20261102:1.1.1.12 netbsd-11-1-RELEASE:1.1.1.11 netbsd-10-2-RELEASE:1.1.1.10 netbsd-9-5-RELEASE:1.1.1.6 netbsd-11-0-RELEASE:1.1.1.11 netbsd-11-0-RC7:1.1.1.11 netbsd-11-0-RC6:1.1.1.11 netbsd-11-0-RC5:1.1.1.11 FILE5_48:1.1.1.12 netbsd-11-0-RC4:1.1.1.11 netbsd-11-0-RC3:1.1.1.11 netbsd-11-0-RC2:1.1.1.11 netbsd-11-0-RC1:1.1.1.11 perseant-exfatfs-base-20250801:1.1.1.11 netbsd-11:1.1.1.11.0.4 netbsd-11-base:1.1.1.11 netbsd-10-1-RELEASE:1.1.1.10 perseant-exfatfs-base-20240630:1.1.1.11 perseant-exfatfs:1.1.1.11.0.2 perseant-exfatfs-base:1.1.1.11 netbsd-8-3-RELEASE:1.1.1.4 netbsd-9-4-RELEASE:1.1.1.6 netbsd-10-0-RELEASE:1.1.1.10 netbsd-10-0-RC6:1.1.1.10 netbsd-10-0-RC5:1.1.1.10 netbsd-10-0-RC4:1.1.1.10 netbsd-10-0-RC3:1.1.1.10 netbsd-10-0-RC2:1.1.1.10 netbsd-10-0-RC1:1.1.1.10 FILE5_45:1.1.1.11 netbsd-10:1.1.1.10.0.2 netbsd-10-base:1.1.1.10 FILE5_43:1.1.1.10 netbsd-9-3-RELEASE:1.1.1.6 cjep_sun2x-base1:1.1.1.9 cjep_sun2x:1.1.1.9.0.4 cjep_sun2x-base:1.1.1.9 cjep_staticlib_x-base1:1.1.1.9 netbsd-9-2-RELEASE:1.1.1.6 cjep_staticlib_x:1.1.1.9.0.2 cjep_staticlib_x-base:1.1.1.9 FILE5_40:1.1.1.9 netbsd-9-1-RELEASE:1.1.1.6 FILE5_39:1.1.1.8 phil-wifi-20200421:1.1.1.7 phil-wifi-20200411:1.1.1.7 is-mlppp:1.1.1.7.0.2 is-mlppp-base:1.1.1.7 phil-wifi-20200406:1.1.1.7 netbsd-8-2-RELEASE:1.1.1.4 netbsd-9-0-RELEASE:1.1.1.6 netbsd-9-0-RC2:1.1.1.6 FILE5_38:1.1.1.7 netbsd-9-0-RC1:1.1.1.6 phil-wifi-20191119:1.1.1.6 netbsd-9:1.1.1.6.0.2 netbsd-9-base:1.1.1.6 phil-wifi-20190609:1.1.1.6 netbsd-8-1-RELEASE:1.1.1.4 FILE5_37:1.1.1.6 netbsd-8-1-RC1:1.1.1.4 pgoyette-compat-merge-20190127:1.1.1.4.30.1 pgoyette-compat-20190127:1.1.1.5 pgoyette-compat-20190118:1.1.1.5 pgoyette-compat-1226:1.1.1.5 pgoyette-compat-1126:1.1.1.5 pgoyette-compat-1020:1.1.1.5 FILE5_35:1.1.1.5 pgoyette-compat-0930:1.1.1.4 pgoyette-compat-0906:1.1.1.4 netbsd-7-2-RELEASE:1.1.1.4 pgoyette-compat-0728:1.1.1.4 netbsd-8-0-RELEASE:1.1.1.4 phil-wifi:1.1.1.4.0.32 phil-wifi-base:1.1.1.4 pgoyette-compat-0625:1.1.1.4 netbsd-8-0-RC2:1.1.1.4 pgoyette-compat-0521:1.1.1.4 pgoyette-compat-0502:1.1.1.4 pgoyette-compat-0422:1.1.1.4 netbsd-8-0-RC1:1.1.1.4 FILE5_33:1.1.1.4 pgoyette-compat-0415:1.1.1.4 pgoyette-compat-0407:1.1.1.4 pgoyette-compat-0330:1.1.1.4 pgoyette-compat-0322:1.1.1.4 pgoyette-compat-0315:1.1.1.4 netbsd-7-1-2-RELEASE:1.1.1.4 pgoyette-compat:1.1.1.4.0.30 pgoyette-compat-base:1.1.1.4 netbsd-7-1-1-RELEASE:1.1.1.4 matt-nb8-mediatek:1.1.1.4.0.28 matt-nb8-mediatek-base:1.1.1.4 FILE5_32:1.1.1.4 perseant-stdc-iso10646:1.1.1.4.0.26 perseant-stdc-iso10646-base:1.1.1.4 netbsd-8:1.1.1.4.0.24 netbsd-8-base:1.1.1.4 FILE5_31:1.1.1.4 prg-localcount2-base3:1.1.1.4 prg-localcount2-base2:1.1.1.4 prg-localcount2-base1:1.1.1.4 prg-localcount2:1.1.1.4.0.22 prg-localcount2-base:1.1.1.4 pgoyette-localcount-20170426:1.1.1.4 bouyer-socketcan-base1:1.1.1.4 pgoyette-localcount-20170320:1.1.1.4 netbsd-7-1:1.1.1.4.0.20 netbsd-7-1-RELEASE:1.1.1.4 netbsd-7-1-RC2:1.1.1.4 FILE5_30:1.1.1.4 netbsd-7-nhusb-base-20170116:1.1.1.4 bouyer-socketcan:1.1.1.4.0.18 bouyer-socketcan-base:1.1.1.4 pgoyette-localcount-20170107:1.1.1.4 netbsd-7-1-RC1:1.1.1.4 pgoyette-localcount-20161104:1.1.1.4 netbsd-7-0-2-RELEASE:1.1.1.4 localcount-20160914:1.1.1.4 netbsd-7-nhusb:1.1.1.4.0.16 netbsd-7-nhusb-base:1.1.1.4 pgoyette-localcount-20160806:1.1.1.4 pgoyette-localcount-20160726:1.1.1.4 pgoyette-localcount:1.1.1.4.0.14 pgoyette-localcount-base:1.1.1.4 netbsd-7-0-1-RELEASE:1.1.1.4 netbsd-7-0:1.1.1.4.0.12 netbsd-7-0-RELEASE:1.1.1.4 netbsd-7-0-RC3:1.1.1.4 netbsd-7-0-RC2:1.1.1.4 netbsd-7-0-RC1:1.1.1.4 FILE5_22:1.1.1.4 FILE5_20:1.1.1.4 netbsd-6-0-6-RELEASE:1.1.1.3 netbsd-6-1-5-RELEASE:1.1.1.3 netbsd-7:1.1.1.4.0.10 netbsd-7-base:1.1.1.4 FILE5_19:1.1.1.4 yamt-pagecache-base9:1.1.1.4 yamt-pagecache-tag8:1.1.1.3 netbsd-6-1-4-RELEASE:1.1.1.3 netbsd-6-0-5-RELEASE:1.1.1.3 tls-earlyentropy:1.1.1.4.0.8 tls-earlyentropy-base:1.1.1.4 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.1.1.4 riastradh-drm2-base3:1.1.1.4 netbsd-6-1-3-RELEASE:1.1.1.3 netbsd-6-0-4-RELEASE:1.1.1.3 FILE5_16:1.1.1.4 netbsd-6-1-2-RELEASE:1.1.1.3 netbsd-6-0-3-RELEASE:1.1.1.3 netbsd-6-1-1-RELEASE:1.1.1.3 riastradh-drm2-base2:1.1.1.4 riastradh-drm2-base1:1.1.1.4 riastradh-drm2:1.1.1.4.0.6 riastradh-drm2-base:1.1.1.4 netbsd-6-1:1.1.1.3.0.14 netbsd-6-0-2-RELEASE:1.1.1.3 netbsd-6-1-RELEASE:1.1.1.3 khorben-n900:1.1.1.4.0.4 netbsd-6-1-RC4:1.1.1.3 netbsd-6-1-RC3:1.1.1.3 agc-symver:1.1.1.4.0.2 agc-symver-base:1.1.1.4 FILE5_14:1.1.1.4 netbsd-6-1-RC2:1.1.1.3 netbsd-6-1-RC1:1.1.1.3 yamt-pagecache-base8:1.1.1.3 FILE_5_12:1.1.1.3 netbsd-6-0-1-RELEASE:1.1.1.3 yamt-pagecache-base7:1.1.1.3 matt-nb6-plus-nbase:1.1.1.3 yamt-pagecache-base6:1.1.1.3 netbsd-6-0:1.1.1.3.0.10 netbsd-6-0-RELEASE:1.1.1.3 netbsd-6-0-RC2:1.1.1.3 tls-maxphys:1.1.1.3.0.8 tls-maxphys-base:1.1.1.4 matt-nb6-plus:1.1.1.3.0.6 matt-nb6-plus-base:1.1.1.3 netbsd-6-0-RC1:1.1.1.3 yamt-pagecache-base5:1.1.1.3 yamt-pagecache-base4:1.1.1.3 FILE5_11:1.1.1.3 netbsd-6:1.1.1.3.0.4 netbsd-6-base:1.1.1.3 yamt-pagecache-base3:1.1.1.3 yamt-pagecache-base2:1.1.1.3 yamt-pagecache:1.1.1.3.0.2 yamt-pagecache-base:1.1.1.3 FILE5_09:1.1.1.3 cherry-xenmp:1.1.1.2.0.2 cherry-xenmp-base:1.1.1.2 FILE5_07:1.1.1.2 bouyer-quota2-nbase:1.1.1.1 bouyer-quota2:1.1.1.1.0.4 bouyer-quota2-base:1.1.1.1 matt-mips64-premerge-20101231:1.1.1.1 matt-premerge-20091211:1.1.1.1 jym-xensuspend-base:1.1.1.1 jym-xensuspend:1.1.1.1.0.2 jym-xensuspend-nbase:1.1.1.1 FILE5_03:1.1.1.1 CHRISTOS:1.1.1; locks; strict; comment @# @; 1.1 date 2009.05.08.16.35.09; author christos; state Exp; branches 1.1.1.1; next ; 1.1.1.1 date 2009.05.08.16.35.09; author christos; state Exp; branches 1.1.1.1.2.1; next 1.1.1.2; 1.1.1.2 date 2011.05.12.20.47.05; author christos; state Exp; branches; next 1.1.1.3; 1.1.1.3 date 2011.09.16.20.37.50; author christos; state Exp; branches 1.1.1.3.2.1 1.1.1.3.8.1; next 1.1.1.4; 1.1.1.4 date 2013.03.23.15.49.19; author christos; state Exp; branches 1.1.1.4.30.1 1.1.1.4.32.1; next 1.1.1.5; 1.1.1.5 date 2018.10.18.23.54.10; author christos; state Exp; branches; next 1.1.1.6; commitid e8WctwerBeEm4vWA; 1.1.1.6 date 2019.05.22.17.19.57; author christos; state Exp; branches; next 1.1.1.7; commitid VXeNRYYruN1MWdoB; 1.1.1.7 date 2019.12.17.02.23.53; author christos; state Exp; branches; next 1.1.1.8; commitid vqYTz60fS9PNg0PB; 1.1.1.8 date 2020.06.15.00.18.49; author christos; state Exp; branches; next 1.1.1.9; commitid HMbuXSjPojU5LfcC; 1.1.1.9 date 2021.04.09.18.58.02; author christos; state Exp; branches; next 1.1.1.10; commitid W9ddLLbSkHHinEOC; 1.1.1.10 date 2022.09.24.20.07.54; author christos; state Exp; branches; next 1.1.1.11; commitid Nf6F9kcpc0EPC9VD; 1.1.1.11 date 2023.08.18.18.36.51; author christos; state Exp; branches 1.1.1.11.2.1; next 1.1.1.12; commitid IX26ghc1E2S0AiBE; 1.1.1.12 date 2026.06.10.15.59.14; author christos; state Exp; branches; next ; commitid 3UWc0DrzTz7bHgJG; 1.1.1.1.2.1 date 2009.05.08.16.35.09; author jym; state dead; branches; next 1.1.1.1.2.2; 1.1.1.1.2.2 date 2009.05.13.18.52.00; author jym; state Exp; branches; next ; 1.1.1.3.2.1 date 2014.05.22.15.44.59; author yamt; state Exp; branches; next ; commitid tYJXbWAuFvTh7yBx; 1.1.1.3.8.1 date 2013.06.23.06.26.32; author tls; state Exp; branches; next ; commitid OnlO1cBgtQRcIHUw; 1.1.1.4.30.1 date 2018.10.20.06.58.20; author pgoyette; state Exp; branches; next ; commitid mTSoqZEZ4arHnFWA; 1.1.1.4.32.1 date 2019.06.10.21.44.46; author christos; state Exp; branches; next 1.1.1.4.32.2; commitid jtc8rnCzWiEEHGqB; 1.1.1.4.32.2 date 2020.04.08.14.04.04; author martin; state Exp; branches; next ; commitid Qli2aW9E74UFuA3C; 1.1.1.11.2.1 date 2026.11.04.22.37.44; author perseant; state Exp; branches; next ; commitid 3QTNojfCEH9lUb2H; desc @@ 1.1 log @Initial revision @ text @ #------------------------------------------------------------------------------ # sniffer: file(1) magic for packet capture files # # From: guy@@alum.mit.edu (Guy Harris) # # # Microsoft Network Monitor 1.x capture files. # 0 string RTSS NetMon capture file >5 byte x - version %d >4 byte x \b.%d >6 leshort 0 (Unknown) >6 leshort 1 (Ethernet) >6 leshort 2 (Token Ring) >6 leshort 3 (FDDI) >6 leshort 4 (ATM) # # Microsoft Network Monitor 2.x capture files. # 0 string GMBU NetMon capture file >5 byte x - version %d >4 byte x \b.%d >6 leshort 0 (Unknown) >6 leshort 1 (Ethernet) >6 leshort 2 (Token Ring) >6 leshort 3 (FDDI) >6 leshort 4 (ATM) # # Network General Sniffer capture files. # Sorry, make that "Network Associates Sniffer capture files." # Sorry, make that "Network General old DOS Sniffer capture files." # 0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file >33 byte 2 (compressed) >23 leshort x - version %d >25 leshort x \b.%d >32 byte 0 (Token Ring) >32 byte 1 (Ethernet) >32 byte 2 (ARCNET) >32 byte 3 (StarLAN) >32 byte 4 (PC Network broadband) >32 byte 5 (LocalTalk) >32 byte 6 (Znet) >32 byte 7 (Internetwork Analyzer) >32 byte 9 (FDDI) >32 byte 10 (ATM) # # Cinco Networks NetXRay capture files. # Sorry, make that "Network General Sniffer Basic capture files." # Sorry, make that "Network Associates Sniffer Basic capture files." # Sorry, make that "Network Associates Sniffer Basic, and Windows # Sniffer Pro", capture files." # Sorry, make that "Network General Sniffer capture files." # 0 string XCP\0 NetXRay capture file >4 string >\0 - version %s >44 leshort 0 (Ethernet) >44 leshort 1 (Token Ring) >44 leshort 2 (FDDI) >44 leshort 3 (WAN) >44 leshort 8 (ATM) >44 leshort 9 (802.11) # # "libpcap" capture files. # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is # the main program that uses that format, but there are other programs # that use "libpcap", or that use the same capture file format.) # 0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) >4 beshort x - version %d >6 beshort x \b.%d >20 belong 0 (No link-layer encapsulation >20 belong 1 (Ethernet >20 belong 2 (3Mb Ethernet >20 belong 3 (AX.25 >20 belong 4 (ProNET >20 belong 5 (CHAOS >20 belong 6 (Token Ring >20 belong 7 (BSD ARCNET >20 belong 8 (SLIP >20 belong 9 (PPP >20 belong 10 (FDDI >20 belong 11 (RFC 1483 ATM >20 belong 12 (raw IP >20 belong 13 (BSD/OS SLIP >20 belong 14 (BSD/OS PPP >20 belong 19 (Linux ATM Classical IP >20 belong 50 (PPP or Cisco HDLC >20 belong 51 (PPP-over-Ethernet >20 belong 99 (Symantec Enterprise Firewall >20 belong 100 (RFC 1483 ATM >20 belong 101 (raw IP >20 belong 102 (BSD/OS SLIP >20 belong 103 (BSD/OS PPP >20 belong 104 (BSD/OS Cisco HDLC >20 belong 105 (802.11 >20 belong 106 (Linux Classical IP over ATM >20 belong 107 (Frame Relay >20 belong 108 (OpenBSD loopback >20 belong 109 (OpenBSD IPsec encrypted >20 belong 112 (Cisco HDLC >20 belong 113 (Linux "cooked" >20 belong 114 (LocalTalk >20 belong 117 (OpenBSD PFLOG >20 belong 119 (802.11 with Prism header >20 belong 122 (RFC 2625 IP over Fibre Channel >20 belong 123 (SunATM >20 belong 127 (802.11 with radiotap header >20 belong 129 (Linux ARCNET >20 belong 138 (Apple IP over IEEE 1394 >20 belong 140 (MTP2 >20 belong 141 (MTP3 >20 belong 143 (DOCSIS >20 belong 144 (IrDA >20 belong 147 (Private use 0 >20 belong 148 (Private use 1 >20 belong 149 (Private use 2 >20 belong 150 (Private use 3 >20 belong 151 (Private use 4 >20 belong 152 (Private use 5 >20 belong 153 (Private use 6 >20 belong 154 (Private use 7 >20 belong 155 (Private use 8 >20 belong 156 (Private use 9 >20 belong 157 (Private use 10 >20 belong 158 (Private use 11 >20 belong 159 (Private use 12 >20 belong 160 (Private use 13 >20 belong 161 (Private use 14 >20 belong 162 (Private use 15 >20 belong 163 (802.11 with AVS header >16 belong x \b, capture length %d) 0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) >4 leshort x - version %d >6 leshort x \b.%d >20 lelong 0 (No link-layer encapsulation >20 lelong 1 (Ethernet >20 lelong 2 (3Mb Ethernet >20 lelong 3 (AX.25 >20 lelong 4 (ProNET >20 lelong 5 (CHAOS >20 lelong 6 (Token Ring >20 lelong 7 (ARCNET >20 lelong 8 (SLIP >20 lelong 9 (PPP >20 lelong 10 (FDDI >20 lelong 11 (RFC 1483 ATM >20 lelong 12 (raw IP >20 lelong 13 (BSD/OS SLIP >20 lelong 14 (BSD/OS PPP >20 lelong 19 (Linux ATM Classical IP >20 lelong 50 (PPP or Cisco HDLC >20 lelong 51 (PPP-over-Ethernet >20 lelong 99 (Symantec Enterprise Firewall >20 lelong 100 (RFC 1483 ATM >20 lelong 101 (raw IP >20 lelong 102 (BSD/OS SLIP >20 lelong 103 (BSD/OS PPP >20 lelong 104 (BSD/OS Cisco HDLC >20 lelong 105 (802.11 >20 lelong 106 (Linux Classical IP over ATM >20 lelong 107 (Frame Relay >20 lelong 108 (OpenBSD loopback >20 lelong 109 (OpenBSD IPsec encrypted >20 lelong 112 (Cisco HDLC >20 lelong 113 (Linux "cooked" >20 lelong 114 (LocalTalk >20 lelong 117 (OpenBSD PFLOG >20 lelong 119 (802.11 with Prism header >20 lelong 122 (RFC 2625 IP over Fibre Channel >20 lelong 123 (SunATM >20 lelong 127 (802.11 with radiotap header >20 lelong 129 (Linux ARCNET >20 lelong 138 (Apple IP over IEEE 1394 >20 lelong 140 (MTP2 >20 lelong 141 (MTP3 >20 lelong 143 (DOCSIS >20 lelong 144 (IrDA >20 lelong 147 (Private use 0 >20 lelong 148 (Private use 1 >20 lelong 149 (Private use 2 >20 lelong 150 (Private use 3 >20 lelong 151 (Private use 4 >20 lelong 152 (Private use 5 >20 lelong 153 (Private use 6 >20 lelong 154 (Private use 7 >20 lelong 155 (Private use 8 >20 lelong 156 (Private use 9 >20 lelong 157 (Private use 10 >20 lelong 158 (Private use 11 >20 lelong 159 (Private use 12 >20 lelong 160 (Private use 13 >20 lelong 161 (Private use 14 >20 lelong 162 (Private use 15 >20 lelong 163 (802.11 with AVS header >16 lelong x \b, capture length %d) # # "libpcap"-with-Alexey-Kuznetsov's-patches capture files. # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is # the main program that uses that format, but there are other programs # that use "libpcap", or that use the same capture file format.) # 0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian) >4 beshort x - version %d >6 beshort x \b.%d >20 belong 0 (No link-layer encapsulation >20 belong 1 (Ethernet >20 belong 2 (3Mb Ethernet >20 belong 3 (AX.25 >20 belong 4 (ProNET >20 belong 5 (CHAOS >20 belong 6 (Token Ring >20 belong 7 (ARCNET >20 belong 8 (SLIP >20 belong 9 (PPP >20 belong 10 (FDDI >20 belong 11 (RFC 1483 ATM >20 belong 12 (raw IP >20 belong 13 (BSD/OS SLIP >20 belong 14 (BSD/OS PPP >16 belong x \b, capture length %d) 0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian) >4 leshort x - version %d >6 leshort x \b.%d >20 lelong 0 (No link-layer encapsulation >20 lelong 1 (Ethernet >20 lelong 2 (3Mb Ethernet >20 lelong 3 (AX.25 >20 lelong 4 (ProNET >20 lelong 5 (CHAOS >20 lelong 6 (Token Ring >20 lelong 7 (ARCNET >20 lelong 8 (SLIP >20 lelong 9 (PPP >20 lelong 10 (FDDI >20 lelong 11 (RFC 1483 ATM >20 lelong 12 (raw IP >20 lelong 13 (BSD/OS SLIP >20 lelong 14 (BSD/OS PPP >16 lelong x \b, capture length %d) # # AIX "iptrace" capture files. # 0 string iptrace\ 1.0 "iptrace" capture file 0 string iptrace\ 2.0 "iptrace" capture file # # Novell LANalyzer capture files. # 0 leshort 0x1001 LANalyzer capture file 0 leshort 0x1007 LANalyzer capture file # # HP-UX "nettl" capture files. # 0 string \x54\x52\x00\x64\x00 "nettl" capture file # # RADCOM WAN/LAN Analyzer capture files. # 0 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file # # NetStumbler log files. Not really packets, per se, but about as # close as you can get. These are log files from NetStumbler, a # Windows program, that scans for 802.11b networks. # 0 string NetS NetStumbler log file >8 lelong x \b, %d stations found # # EtherPeek/AiroPeek "version 9" capture files. # 0 string \177ver EtherPeek/AiroPeek capture file # # Visual Networks traffic capture files. # 0 string \x05VNF Visual Networks traffic capture file # # Network Instruments Observer capture files. # 0 string ObserverPktBuffe Network Instruments Observer capture file # # Files from Accellent Group's 5View products. # 0 string \xaa\xaa\xaa\xaa 5View capture file @ 1.1.1.1 log @from ftp.astron.com @ text @@ 1.1.1.2 log @from ftp.astron.com. - many security related fixes - no MAXPATHLEN limits - fixed missing text specification on ascii magic - new ``pascal'' style string formats - whitespace comparison fix - more magic @ text @a2 1 # $File: sniffer,v 1.14 2009/09/19 16:28:12 christos Exp $ @ 1.1.1.3 log @from ftp.astron.com: - elf seeking fixes - improvements in cdf parsing - waitpid only for our child - magic fixes and additions @ text @d3 1 a3 1 # $File: sniffer,v 1.18 2011/08/08 08:49:27 christos Exp $ a76 1 !:mime application/vnd.tcpdump.pcap a140 1 !:mime application/vnd.tcpdump.pcap a250 15 # "pcap-ng" capture files. # http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html # Pcap-ng files can contain multiple sections. Printing the endianness, # snaplen, or other information from the first SHB may be misleading. # 0 ubelong 0x0a0d0d0a >8 ubelong 0x1a2b3c4d pcap-ng capture file >>12 beshort x - version %d >>14 beshort x \b.%d 0 ulelong 0x0a0d0d0a >8 ulelong 0x1a2b3c4d pcap-ng capture file >>12 leshort x - version %d >>14 leshort x \b.%d # @ 1.1.1.3.2.1 log @sync with head. for a reference, the tree before this commit was tagged as yamt-pagecache-tag8. this commit was splitted into small chunks to avoid a limitation of cvs. ("Protocol error: too many arguments") @ text @d3 1 a3 1 # $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $ a19 1 >6 leshort >4 (type %d) a31 6 >6 leshort 5 (IP-over-IEEE 1394) >6 leshort 6 (802.11) >6 leshort 7 (Raw IP) >6 leshort 8 (Raw IP) >6 leshort 9 (Raw IP) >6 leshort >9 (type %d) a59 1 # Sorry, make that "NetScout Sniffer capture files." d76 2 a77 1 0 name pcap-be a118 1 >20 belong 139 (MTP2 with pseudo-header a120 1 >20 belong 142 (SCCP a139 39 >20 belong 165 (BACnet MS/TP >20 belong 166 (PPPD >20 belong 169 (GPRS LLC >20 belong 177 (Linux LAPD >20 belong 187 (Bluetooth HCI H4 >20 belong 189 (Linux USB >20 belong 192 (PPI >20 belong 195 (802.15.4 >20 belong 196 (SITA >20 belong 197 (Endace ERF >20 belong 201 (Bluetooth HCI H4 with pseudo-header >20 belong 202 (AX.25 with KISS header >20 belong 203 (LAPD >20 belong 204 (PPP with direction pseudo-header >20 belong 205 (Cisco HDLC with direction pseudo-header >20 belong 206 (Frame Relay with direction pseudo-header >20 belong 209 (Linux IPMB >20 belong 215 (802.15.4 with non-ASK PHY header >20 belong 220 (Memory-mapped Linux USB >20 belong 224 (Fibre Channel FC-2 >20 belong 225 (Fibre Channel FC-2 with frame delimiters >20 belong 226 (Solaris IPNET >20 belong 227 (SocketCAN >20 belong 228 (Raw IPv4 >20 belong 229 (Raw IPv6 >20 belong 230 (802.15.4 without FCS >20 belong 231 (D-Bus messages >20 belong 235 (DVB-CI >20 belong 236 (MUX27010 >20 belong 237 (STANAG 5066 D_PDUs >20 belong 239 (Linux netlink NFLOG messages >20 belong 240 (Hilscher netAnalyzer >20 belong 241 (Hilscher netAnalyzer with delimiters >20 belong 242 (IP-over-Infiniband >20 belong 243 (MPEG-2 Transport Stream packets >20 belong 244 (ng4t ng40 >20 belong 245 (NFC LLCP >20 belong 247 (Infiniband >20 belong 248 (SCTP a140 4 0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) !:mime application/vnd.tcpdump.pcap >0 use pcap-be d143 63 a205 1 >0 use \^pcap-be d214 18 a231 1 >0 use pcap-be d233 18 a250 1 >0 use \^pcap-be d298 1 a298 1 # *Peek tagged capture files. d300 1 a300 1 0 string \177ver EtherPeek/AiroPeek/OmniPeek capture file @ 1.1.1.3.8.1 log @resync from head @ text @d3 1 a3 1 # $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $ a19 1 >6 leshort >4 (type %d) a31 6 >6 leshort 5 (IP-over-IEEE 1394) >6 leshort 6 (802.11) >6 leshort 7 (Raw IP) >6 leshort 8 (Raw IP) >6 leshort 9 (Raw IP) >6 leshort >9 (type %d) a59 1 # Sorry, make that "NetScout Sniffer capture files." d76 2 a77 1 0 name pcap-be a118 1 >20 belong 139 (MTP2 with pseudo-header a120 1 >20 belong 142 (SCCP a139 39 >20 belong 165 (BACnet MS/TP >20 belong 166 (PPPD >20 belong 169 (GPRS LLC >20 belong 177 (Linux LAPD >20 belong 187 (Bluetooth HCI H4 >20 belong 189 (Linux USB >20 belong 192 (PPI >20 belong 195 (802.15.4 >20 belong 196 (SITA >20 belong 197 (Endace ERF >20 belong 201 (Bluetooth HCI H4 with pseudo-header >20 belong 202 (AX.25 with KISS header >20 belong 203 (LAPD >20 belong 204 (PPP with direction pseudo-header >20 belong 205 (Cisco HDLC with direction pseudo-header >20 belong 206 (Frame Relay with direction pseudo-header >20 belong 209 (Linux IPMB >20 belong 215 (802.15.4 with non-ASK PHY header >20 belong 220 (Memory-mapped Linux USB >20 belong 224 (Fibre Channel FC-2 >20 belong 225 (Fibre Channel FC-2 with frame delimiters >20 belong 226 (Solaris IPNET >20 belong 227 (SocketCAN >20 belong 228 (Raw IPv4 >20 belong 229 (Raw IPv6 >20 belong 230 (802.15.4 without FCS >20 belong 231 (D-Bus messages >20 belong 235 (DVB-CI >20 belong 236 (MUX27010 >20 belong 237 (STANAG 5066 D_PDUs >20 belong 239 (Linux netlink NFLOG messages >20 belong 240 (Hilscher netAnalyzer >20 belong 241 (Hilscher netAnalyzer with delimiters >20 belong 242 (IP-over-Infiniband >20 belong 243 (MPEG-2 Transport Stream packets >20 belong 244 (ng4t ng40 >20 belong 245 (NFC LLCP >20 belong 247 (Infiniband >20 belong 248 (SCTP a140 4 0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) !:mime application/vnd.tcpdump.pcap >0 use pcap-be d143 63 a205 1 >0 use \^pcap-be d214 18 a231 1 >0 use pcap-be d233 18 a250 1 >0 use \^pcap-be d298 1 a298 1 # *Peek tagged capture files. d300 1 a300 1 0 string \177ver EtherPeek/AiroPeek/OmniPeek capture file @ 1.1.1.4 log @import file-5.14 changes are "name" + "use" keyword features, bug fixes @ text @d3 1 a3 1 # $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $ a19 1 >6 leshort >4 (type %d) a31 6 >6 leshort 5 (IP-over-IEEE 1394) >6 leshort 6 (802.11) >6 leshort 7 (Raw IP) >6 leshort 8 (Raw IP) >6 leshort 9 (Raw IP) >6 leshort >9 (type %d) a59 1 # Sorry, make that "NetScout Sniffer capture files." d76 2 a77 1 0 name pcap-be a118 1 >20 belong 139 (MTP2 with pseudo-header a120 1 >20 belong 142 (SCCP a139 39 >20 belong 165 (BACnet MS/TP >20 belong 166 (PPPD >20 belong 169 (GPRS LLC >20 belong 177 (Linux LAPD >20 belong 187 (Bluetooth HCI H4 >20 belong 189 (Linux USB >20 belong 192 (PPI >20 belong 195 (802.15.4 >20 belong 196 (SITA >20 belong 197 (Endace ERF >20 belong 201 (Bluetooth HCI H4 with pseudo-header >20 belong 202 (AX.25 with KISS header >20 belong 203 (LAPD >20 belong 204 (PPP with direction pseudo-header >20 belong 205 (Cisco HDLC with direction pseudo-header >20 belong 206 (Frame Relay with direction pseudo-header >20 belong 209 (Linux IPMB >20 belong 215 (802.15.4 with non-ASK PHY header >20 belong 220 (Memory-mapped Linux USB >20 belong 224 (Fibre Channel FC-2 >20 belong 225 (Fibre Channel FC-2 with frame delimiters >20 belong 226 (Solaris IPNET >20 belong 227 (SocketCAN >20 belong 228 (Raw IPv4 >20 belong 229 (Raw IPv6 >20 belong 230 (802.15.4 without FCS >20 belong 231 (D-Bus messages >20 belong 235 (DVB-CI >20 belong 236 (MUX27010 >20 belong 237 (STANAG 5066 D_PDUs >20 belong 239 (Linux netlink NFLOG messages >20 belong 240 (Hilscher netAnalyzer >20 belong 241 (Hilscher netAnalyzer with delimiters >20 belong 242 (IP-over-Infiniband >20 belong 243 (MPEG-2 Transport Stream packets >20 belong 244 (ng4t ng40 >20 belong 245 (NFC LLCP >20 belong 247 (Infiniband >20 belong 248 (SCTP a140 4 0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) !:mime application/vnd.tcpdump.pcap >0 use pcap-be d143 63 a205 1 >0 use \^pcap-be d214 18 a231 1 >0 use pcap-be d233 18 a250 1 >0 use \^pcap-be d298 1 a298 1 # *Peek tagged capture files. d300 1 a300 1 0 string \177ver EtherPeek/AiroPeek/OmniPeek capture file @ 1.1.1.4.32.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: sniffer,v 1.25 2019/05/05 17:03:41 christos Exp $ d45 1 a45 1 0 string TRSNIFF\040data\040\040\040\040\032 Sniffer capture file a79 1 # https://www.tcpdump.org/manpages/pcap-savefile.5.html a86 2 # clear that continuation level match >20 clear x d117 1 a117 1 >20 belong 113 (Linux cooked v1 a124 8 >20 belong 130 (Juniper Multi-Link PPP >20 belong 131 (Juniper Multi-Link Frame Relay >20 belong 132 (Juniper Encryption Services PIC >20 belong 133 (Juniper GGSN PIC >20 belong 134 (Juniper FRF.16 Frame Relay >20 belong 135 (Juniper ATM2 PIC >20 belong 136 (Juniper Advanced Services PIC >20 belong 137 (Juniper ATM1 PIC d126 4 a129 4 >20 belong 139 (SS7 MTP2 with pseudo-header >20 belong 140 (SS7 MTP2 >20 belong 141 (SS7 MTP3 >20 belong 142 (SS7 SCCP d131 1 a131 1 >20 belong 144 (Linux IrDA a148 1 >20 belong 164 (Juniper Passive Monitor PIC a150 2 >20 belong 167 (Juniper PPPoE >20 belong 168 (Juniper PPPoE/ATM a151 5 >20 belong 170 (GPF-T >20 belong 171 (GPF-F >20 belong 174 (Juniper PIC Peer >20 belong 175 (Ethernet with Endace ERF header >20 belong 176 (Packet-over-SONET with Endace ERF header a152 9 >20 belong 178 (Juniper Ethernet >20 belong 179 (Juniper PPP >20 belong 180 (Juniper Frame Relay >20 belong 181 (Juniper C-HDLC >20 belong 182 (FRF.16 Frame Relay >20 belong 183 (Juniper Voice PIC >20 belong 184 (Arinc 429 >20 belong 185 (Arinc 653 Interpartition Communication >20 belong 186 (USB with FreeBSD header a153 1 >20 belong 188 (802.16 MAC Common Part Sublayer a154 2 >20 belong 190 (Controller Area Network (CAN) v. 2.0B >20 belong 191 (802.15.4 with Linux padding d156 1 a156 3 >20 belong 193 (802.16 MAC Common Part Sublayer plus radiotap header >20 belong 194 (Juniper Integrated Service Module >20 belong 195 (802.15.4 with FCS a158 3 >20 belong 198 (Ethernet with u10 Networks pseudo-header >20 belong 199 (IPMB >20 belong 200 (Juniper Secure Tunnel a166 2 >20 belong 216 (Linux evdev events >20 belong 219 (MPLS with label as link-layer header a167 3 >20 belong 221 (DECT >20 belong 222 (AOS Space Data Link protocol >20 belong 223 (Wireless HART a175 3 >20 belong 232 (Juniper Virtual Server >20 belong 233 (Juniper SRX E2E >20 belong 234 (Juniper Fibre Channel d179 1 a179 2 >20 belong 238 (Juniper ATM CEMIC >20 belong 239 (Linux netfilter log messages d186 1 a186 2 >20 belong 246 (Packet filter state syncing >20 belong 247 (InfiniBand d188 1 a188 35 >20 belong 249 (USB with USBPcap header >20 belong 250 (Schweitzer Engineering Laboratories RTAC packets >20 belong 251 (Bluetooth Low Energy air interface >20 belong 252 (Wireshark Upper PDU export >20 belong 253 (Linux netlink >20 belong 254 (Bluetooth Linux Monitor >20 belong 255 (Bluetooth Basic Rate/Enhanced Data Rate baseband packets >20 belong 256 (Bluetooth Low Energy air interface with pseudo-header >20 belong 257 (PROFIBUS data link layer >20 belong 258 (Apple DLT_PKTAP >20 belong 259 (Ethernet with 802.3 Clause 65 EPON preamble >20 belong 260 (IPMI trace packets >20 belong 261 (Z-Wave RF profile R1 and R2 packets >20 belong 262 (Z-Wave RF profile R3 packets >20 belong 263 (WattStopper Digital Lighting Mngmt/Legrand Nitoo Open Proto >20 belong 264 (ISO 14443 messages >20 belong 265 (IEC 62106 Radio Data System groups >20 belong 266 (USB with Darwin header >20 belong 267 (OpenBSD DLT_OPENFLOW >20 belong 268 (IBM SDLC frames >20 belong 269 (TI LLN sniffer frames >20 belong 271 (Linux vsock >20 belong 272 (Nordic Semiconductor Bluetooth LE sniffer frames >20 belong 273 (Excentis XRA-31 DOCSIS 3.1 RF sniffer frames >20 belong 274 (802.3br mPackets >20 belong 275 (DisplayPort AUX channel monitoring data >20 belong 276 (Linux cooked v2 >20 belong 278 (OpenVizsla USB >20 belong 279 (Elektrobit High Speed Capture and Replay (EBHSCR) >20 belong 281 (Broadcom tag >20 belong 282 (Broadcom tag (prepended) # print default match >20 default x >>20 belong x (linktype#%u >16 belong x \b, capture length %u) d190 1 a190 2 # packets time stamps in seconds and microseconds. 0 ubelong 0xa1b2c3d4 pcap capture file, microseconds ts (big-endian) d193 1 a193 9 0 ulelong 0xa1b2c3d4 pcap capture file, microsecond ts (little-endian) !:mime application/vnd.tcpdump.pcap >0 use \^pcap-be # packets time stamps in seconds and nanoseconds. 0 ubelong 0xa1b23c4d pcap capture file, nanosecond ts (big-endian) !:mime application/vnd.tcpdump.pcap >0 use pcap-be 0 ulelong 0xa1b23c4d pcap capture file, nanosecond ts (little-endian) d199 3 d203 1 a203 1 0 ubelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (big-endian) d205 1 a205 1 0 ulelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (little-endian) d209 3 a211 3 # "pcapng" capture files. # https://github.com/pcapng/pcapng # Pcapng files can contain multiple sections. Printing the endianness, d215 1 a215 1 >8 ubelong 0x1a2b3c4d pcapng capture file d219 1 a219 1 >8 ulelong 0x1a2b3c4d pcapng capture file d226 2 a227 2 0 string iptrace\0401.0 AIX iptrace capture file 0 string iptrace\0402.0 AIX iptrace capture file d232 2 a233 2 0 leshort 0x1001 Novell LANalyzer capture file 0 leshort 0x1007 Novell LANalyzer capture file d238 1 a238 1 0 string \x54\x52\x00\x64\x00 HP/UX nettl capture file @ 1.1.1.4.32.2 log @Merge changes from current as of 20200406 @ text @d3 1 a3 1 # $File: sniffer,v 1.27 2019/12/08 18:22:24 christos Exp $ d102 1 a102 1 >20 belong 12 (Raw IP d110 1 a110 1 >20 belong 101 (Raw IP a264 2 >20 belong 284 (Marvell DSA >20 belong 285 (Marvell EDSA @ 1.1.1.4.30.1 log @Sync with head @ text @d3 1 a3 1 # $File: sniffer,v 1.20 2018/10/18 16:49:19 christos Exp $ d45 1 a45 1 0 string TRSNIFF\040data\040\040\040\040\032 Sniffer capture file a79 1 # https://www.tcpdump.org/manpages/pcap-savefile.5.html d190 1 a190 2 # packets time stamps in seconds and microseconds. 0 ubelong 0xa1b2c3d4 pcap capture file, microseconds ts (big-endian) d193 1 a193 9 0 ulelong 0xa1b2c3d4 pcap capture file, microsecond ts (little-endian) !:mime application/vnd.tcpdump.pcap >0 use \^pcap-be # packets time stamps in seconds and nanoseconds. 0 ubelong 0xa1b23c4d pcap capture file, nanosecond ts (big-endian) !:mime application/vnd.tcpdump.pcap >0 use pcap-be 0 ulelong 0xa1b23c4d pcap capture file, nanosecond ts (little-endian) d199 3 d203 1 a203 1 0 ubelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (big-endian) d205 1 a205 1 0 ulelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (little-endian) d226 2 a227 2 0 string iptrace\0401.0 AIX iptrace capture file 0 string iptrace\0402.0 AIX iptrace capture file d232 2 a233 2 0 leshort 0x1001 Novell LANalyzer capture file 0 leshort 0x1007 Novell LANalyzer capture file d238 1 a238 1 0 string \x54\x52\x00\x64\x00 HP/UX nettl capture file @ 1.1.1.5 log @2018-10-18 19:32 Christos Zoulas * release 5.35 2018-09-10 20:38 Christos Zoulas * Add FreeBSD ELF core file support (John Baldwin) 2018-08-20 18:40 Christos Zoulas * PR/30: Allow all parameter values to be set (don't treat 0 specially) * handle default annotations on the softmagic match instead at the end. 2018-07-25 10:17 Christos Zoulas * PR/23: Recognize JSON files 2018-07-25 10:17 Christos Zoulas * PR/18: file --mime-encoding should not print mime-type 2018-07-25 8:50 Christos Zoulas * release 5.34 2018-06-22 16:38 Christos Zoulas * Add Quad indirect offsets 2018-05-24 14:10 Christos Zoulas * Enable parsing of ELF dynamic sections to handle PIE better @ text @d3 1 a3 1 # $File: sniffer,v 1.20 2018/10/18 16:49:19 christos Exp $ d45 1 a45 1 0 string TRSNIFF\040data\040\040\040\040\032 Sniffer capture file a79 1 # https://www.tcpdump.org/manpages/pcap-savefile.5.html d190 1 a190 2 # packets time stamps in seconds and microseconds. 0 ubelong 0xa1b2c3d4 pcap capture file, microseconds ts (big-endian) d193 1 a193 9 0 ulelong 0xa1b2c3d4 pcap capture file, microsecond ts (little-endian) !:mime application/vnd.tcpdump.pcap >0 use \^pcap-be # packets time stamps in seconds and nanoseconds. 0 ubelong 0xa1b23c4d pcap capture file, nanosecond ts (big-endian) !:mime application/vnd.tcpdump.pcap >0 use pcap-be 0 ulelong 0xa1b23c4d pcap capture file, nanosecond ts (little-endian) d199 3 d203 1 a203 1 0 ubelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (big-endian) d205 1 a205 1 0 ulelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (little-endian) d226 2 a227 2 0 string iptrace\0401.0 AIX iptrace capture file 0 string iptrace\0402.0 AIX iptrace capture file d232 2 a233 2 0 leshort 0x1001 Novell LANalyzer capture file 0 leshort 0x1007 Novell LANalyzer capture file d238 1 a238 1 0 string \x54\x52\x00\x64\x00 HP/UX nettl capture file @ 1.1.1.6 log @2019-05-14 22:26 Christos Zoulas * release 5.37 2019-05-09 22:27 Christos Zoulas * Make sure that continuation separators are printed with -k within softmagic 2019-05-06 22:27 Christos Zoulas * Change SIGPIPE saving and restoring during compression to use sigaction(2) instead of signal(3) and cache it. (Denys Vlasenko) * Cache stat(2) calls more to reduce number of calls (Denys Vlasenko) 2019-05-06 17:25 Christos Zoulas * PR/77: Handle --mime-type and -k correctly. 2019-05-03 15:26 Christos Zoulas * Switch decompression code to use vfork() because tools like rpmdiff and rpmbuild call libmagic with large process footprints (Denys Vlasenko) 2019-04-07 14:05 Christos Zoulas * PR/75: --enable-zlib, did not work. 2019-02-27 11:54 Christos Zoulas * Improve regex efficiency (Michael Schroeder) by: 1. Prefixing regex searches with regular search for keywords where possible 2. Using memmem(3) where available @ text @d3 1 a3 1 # $File: sniffer,v 1.25 2019/05/05 17:03:41 christos Exp $ a87 2 # clear that continuation level match >20 clear x d118 1 a118 1 >20 belong 113 (Linux cooked v1 a125 8 >20 belong 130 (Juniper Multi-Link PPP >20 belong 131 (Juniper Multi-Link Frame Relay >20 belong 132 (Juniper Encryption Services PIC >20 belong 133 (Juniper GGSN PIC >20 belong 134 (Juniper FRF.16 Frame Relay >20 belong 135 (Juniper ATM2 PIC >20 belong 136 (Juniper Advanced Services PIC >20 belong 137 (Juniper ATM1 PIC d127 4 a130 4 >20 belong 139 (SS7 MTP2 with pseudo-header >20 belong 140 (SS7 MTP2 >20 belong 141 (SS7 MTP3 >20 belong 142 (SS7 SCCP d132 1 a132 1 >20 belong 144 (Linux IrDA a149 1 >20 belong 164 (Juniper Passive Monitor PIC a151 2 >20 belong 167 (Juniper PPPoE >20 belong 168 (Juniper PPPoE/ATM a152 5 >20 belong 170 (GPF-T >20 belong 171 (GPF-F >20 belong 174 (Juniper PIC Peer >20 belong 175 (Ethernet with Endace ERF header >20 belong 176 (Packet-over-SONET with Endace ERF header a153 9 >20 belong 178 (Juniper Ethernet >20 belong 179 (Juniper PPP >20 belong 180 (Juniper Frame Relay >20 belong 181 (Juniper C-HDLC >20 belong 182 (FRF.16 Frame Relay >20 belong 183 (Juniper Voice PIC >20 belong 184 (Arinc 429 >20 belong 185 (Arinc 653 Interpartition Communication >20 belong 186 (USB with FreeBSD header a154 1 >20 belong 188 (802.16 MAC Common Part Sublayer a155 2 >20 belong 190 (Controller Area Network (CAN) v. 2.0B >20 belong 191 (802.15.4 with Linux padding d157 1 a157 3 >20 belong 193 (802.16 MAC Common Part Sublayer plus radiotap header >20 belong 194 (Juniper Integrated Service Module >20 belong 195 (802.15.4 with FCS a159 3 >20 belong 198 (Ethernet with u10 Networks pseudo-header >20 belong 199 (IPMB >20 belong 200 (Juniper Secure Tunnel a167 2 >20 belong 216 (Linux evdev events >20 belong 219 (MPLS with label as link-layer header a168 3 >20 belong 221 (DECT >20 belong 222 (AOS Space Data Link protocol >20 belong 223 (Wireless HART a176 3 >20 belong 232 (Juniper Virtual Server >20 belong 233 (Juniper SRX E2E >20 belong 234 (Juniper Fibre Channel d180 1 a180 2 >20 belong 238 (Juniper ATM CEMIC >20 belong 239 (Linux netfilter log messages d187 1 a187 2 >20 belong 246 (Packet filter state syncing >20 belong 247 (InfiniBand d189 1 a189 35 >20 belong 249 (USB with USBPcap header >20 belong 250 (Schweitzer Engineering Laboratories RTAC packets >20 belong 251 (Bluetooth Low Energy air interface >20 belong 252 (Wireshark Upper PDU export >20 belong 253 (Linux netlink >20 belong 254 (Bluetooth Linux Monitor >20 belong 255 (Bluetooth Basic Rate/Enhanced Data Rate baseband packets >20 belong 256 (Bluetooth Low Energy air interface with pseudo-header >20 belong 257 (PROFIBUS data link layer >20 belong 258 (Apple DLT_PKTAP >20 belong 259 (Ethernet with 802.3 Clause 65 EPON preamble >20 belong 260 (IPMI trace packets >20 belong 261 (Z-Wave RF profile R1 and R2 packets >20 belong 262 (Z-Wave RF profile R3 packets >20 belong 263 (WattStopper Digital Lighting Mngmt/Legrand Nitoo Open Proto >20 belong 264 (ISO 14443 messages >20 belong 265 (IEC 62106 Radio Data System groups >20 belong 266 (USB with Darwin header >20 belong 267 (OpenBSD DLT_OPENFLOW >20 belong 268 (IBM SDLC frames >20 belong 269 (TI LLN sniffer frames >20 belong 271 (Linux vsock >20 belong 272 (Nordic Semiconductor Bluetooth LE sniffer frames >20 belong 273 (Excentis XRA-31 DOCSIS 3.1 RF sniffer frames >20 belong 274 (802.3br mPackets >20 belong 275 (DisplayPort AUX channel monitoring data >20 belong 276 (Linux cooked v2 >20 belong 278 (OpenVizsla USB >20 belong 279 (Elektrobit High Speed Capture and Replay (EBHSCR) >20 belong 281 (Broadcom tag >20 belong 282 (Broadcom tag (prepended) # print default match >20 default x >>20 belong x (linktype#%u >16 belong x \b, capture length %u) d216 3 a218 3 # "pcapng" capture files. # https://github.com/pcapng/pcapng # Pcapng files can contain multiple sections. Printing the endianness, d222 1 a222 1 >8 ubelong 0x1a2b3c4d pcapng capture file d226 1 a226 1 >8 ulelong 0x1a2b3c4d pcapng capture file @ 1.1.1.7 log @Import 5.38: - Always accept -S (no sandbox) even if we don't support sandboxing - More syscalls elided for sandboxiing - For ELF dynamic means having an interpreter not just PT_DYNAMIC - Check for large ELF session header offset - When saving and restoring a locale, keep the locale name in our own storage. - Add a flag to disable CSV file detection. - Don't pass NULL/0 to memset to appease sanitizers. - Avoid spurious prints when looks for extensions or apple strings in fsmagic. - Add builtin decompressors for xz and and bzip. - Add a limit for the number of CDF elements. - More checks for overflow in CDF. @ text @d3 1 a3 1 # $File: sniffer,v 1.27 2019/12/08 18:22:24 christos Exp $ d102 1 a102 1 >20 belong 12 (Raw IP d110 1 a110 1 >20 belong 101 (Raw IP a264 2 >20 belong 284 (Marvell DSA >20 belong 285 (Marvell EDSA @ 1.1.1.8 log @Import 5.39: * Remove unused subtype_mime (Steve Grubb) * Remove unused check in okstat (Steve Grubb) * Fix mime-type in elf binaries by making sure $x is set * Fix indirect negative offsets broken by OFFNEGATIVE * Fix GUID equality check * PR/165: Handle empty array and strings in JSON * PR/162: Add --exclude-quiet * Fix memory leak in ascmagic (Steve Grubb) * Fix string comparison length with ignore whitespace * Fix mingwin 64 compilation * PR/159: whitelist getpid needed for file_pipe2file() * Indicate negative offsets with a flag OFFNEGATIVE so that -0 works. * Introduce "offset" magic type that can be used to detect the file size, and bail on short files. * document DER better in the magic man page. * fix memory leaks (SonarQube) * rewrite confusing loops (SonarQube) * fix bogus test (SonarQube) * pass a sized buffer to file_fmttime() (SonarQube) * Don't allow * in printf formats, or the code itself (Christoph Biedl) * Introduce a printf output size checker to avoid DoS attacks * Avoid memory leak on error (oss-fuzz) * Check length of string on DER before derefercing and add new types * Add missing DER string (oss-fuzz) * Add missing DER types, and debugging * PR/140: Avoid abort with hand-crafted magic file (gockelhahn) * PR/139: Avoid DoS in printf with hand-crafted magic file (gockelhahn) * PR/138: Avoid crash with hand-crafted magic file (gockelhahn) * PR/136: Fix static build by adding a libmagic.pc (Fabrice Fontaine) * add guid support native support via the "guid" type. @ text @d3 1 a3 1 # $File: sniffer,v 1.28 2020/03/13 16:47:29 christos Exp $ d90 177 a266 177 >20 belong&0x03FFFFFF 0 (No link-layer encapsulation >20 belong&0x03FFFFFF 1 (Ethernet >20 belong&0x03FFFFFF 2 (3Mb Ethernet >20 belong&0x03FFFFFF 3 (AX.25 >20 belong&0x03FFFFFF 4 (ProNET >20 belong&0x03FFFFFF 5 (CHAOS >20 belong&0x03FFFFFF 6 (Token Ring >20 belong&0x03FFFFFF 7 (BSD ARCNET >20 belong&0x03FFFFFF 8 (SLIP >20 belong&0x03FFFFFF 9 (PPP >20 belong&0x03FFFFFF 10 (FDDI >20 belong&0x03FFFFFF 11 (RFC 1483 ATM >20 belong&0x03FFFFFF 12 (Raw IP >20 belong&0x03FFFFFF 13 (BSD/OS SLIP >20 belong&0x03FFFFFF 14 (BSD/OS PPP >20 belong&0x03FFFFFF 19 (Linux ATM Classical IP >20 belong&0x03FFFFFF 50 (PPP or Cisco HDLC >20 belong&0x03FFFFFF 51 (PPP-over-Ethernet >20 belong&0x03FFFFFF 99 (Symantec Enterprise Firewall >20 belong&0x03FFFFFF 100 (RFC 1483 ATM >20 belong&0x03FFFFFF 101 (Raw IP >20 belong&0x03FFFFFF 102 (BSD/OS SLIP >20 belong&0x03FFFFFF 103 (BSD/OS PPP >20 belong&0x03FFFFFF 104 (BSD/OS Cisco HDLC >20 belong&0x03FFFFFF 105 (802.11 >20 belong&0x03FFFFFF 106 (Linux Classical IP over ATM >20 belong&0x03FFFFFF 107 (Frame Relay >20 belong&0x03FFFFFF 108 (OpenBSD loopback >20 belong&0x03FFFFFF 109 (OpenBSD IPsec encrypted >20 belong&0x03FFFFFF 112 (Cisco HDLC >20 belong&0x03FFFFFF 113 (Linux cooked v1 >20 belong&0x03FFFFFF 114 (LocalTalk >20 belong&0x03FFFFFF 117 (OpenBSD PFLOG >20 belong&0x03FFFFFF 119 (802.11 with Prism header >20 belong&0x03FFFFFF 122 (RFC 2625 IP over Fibre Channel >20 belong&0x03FFFFFF 123 (SunATM >20 belong&0x03FFFFFF 127 (802.11 with radiotap header >20 belong&0x03FFFFFF 129 (Linux ARCNET >20 belong&0x03FFFFFF 130 (Juniper Multi-Link PPP >20 belong&0x03FFFFFF 131 (Juniper Multi-Link Frame Relay >20 belong&0x03FFFFFF 132 (Juniper Encryption Services PIC >20 belong&0x03FFFFFF 133 (Juniper GGSN PIC >20 belong&0x03FFFFFF 134 (Juniper FRF.16 Frame Relay >20 belong&0x03FFFFFF 135 (Juniper ATM2 PIC >20 belong&0x03FFFFFF 136 (Juniper Advanced Services PIC >20 belong&0x03FFFFFF 137 (Juniper ATM1 PIC >20 belong&0x03FFFFFF 138 (Apple IP over IEEE 1394 >20 belong&0x03FFFFFF 139 (SS7 MTP2 with pseudo-header >20 belong&0x03FFFFFF 140 (SS7 MTP2 >20 belong&0x03FFFFFF 141 (SS7 MTP3 >20 belong&0x03FFFFFF 142 (SS7 SCCP >20 belong&0x03FFFFFF 143 (DOCSIS >20 belong&0x03FFFFFF 144 (Linux IrDA >20 belong&0x03FFFFFF 147 (Private use 0 >20 belong&0x03FFFFFF 148 (Private use 1 >20 belong&0x03FFFFFF 149 (Private use 2 >20 belong&0x03FFFFFF 150 (Private use 3 >20 belong&0x03FFFFFF 151 (Private use 4 >20 belong&0x03FFFFFF 152 (Private use 5 >20 belong&0x03FFFFFF 153 (Private use 6 >20 belong&0x03FFFFFF 154 (Private use 7 >20 belong&0x03FFFFFF 155 (Private use 8 >20 belong&0x03FFFFFF 156 (Private use 9 >20 belong&0x03FFFFFF 157 (Private use 10 >20 belong&0x03FFFFFF 158 (Private use 11 >20 belong&0x03FFFFFF 159 (Private use 12 >20 belong&0x03FFFFFF 160 (Private use 13 >20 belong&0x03FFFFFF 161 (Private use 14 >20 belong&0x03FFFFFF 162 (Private use 15 >20 belong&0x03FFFFFF 163 (802.11 with AVS header >20 belong&0x03FFFFFF 164 (Juniper Passive Monitor PIC >20 belong&0x03FFFFFF 165 (BACnet MS/TP >20 belong&0x03FFFFFF 166 (PPPD >20 belong&0x03FFFFFF 167 (Juniper PPPoE >20 belong&0x03FFFFFF 168 (Juniper PPPoE/ATM >20 belong&0x03FFFFFF 169 (GPRS LLC >20 belong&0x03FFFFFF 170 (GPF-T >20 belong&0x03FFFFFF 171 (GPF-F >20 belong&0x03FFFFFF 174 (Juniper PIC Peer >20 belong&0x03FFFFFF 175 (Ethernet with Endace ERF header >20 belong&0x03FFFFFF 176 (Packet-over-SONET with Endace ERF header >20 belong&0x03FFFFFF 177 (Linux LAPD >20 belong&0x03FFFFFF 178 (Juniper Ethernet >20 belong&0x03FFFFFF 179 (Juniper PPP >20 belong&0x03FFFFFF 180 (Juniper Frame Relay >20 belong&0x03FFFFFF 181 (Juniper C-HDLC >20 belong&0x03FFFFFF 182 (FRF.16 Frame Relay >20 belong&0x03FFFFFF 183 (Juniper Voice PIC >20 belong&0x03FFFFFF 184 (Arinc 429 >20 belong&0x03FFFFFF 185 (Arinc 653 Interpartition Communication >20 belong&0x03FFFFFF 186 (USB with FreeBSD header >20 belong&0x03FFFFFF 187 (Bluetooth HCI H4 >20 belong&0x03FFFFFF 188 (802.16 MAC Common Part Sublayer >20 belong&0x03FFFFFF 189 (Linux USB >20 belong&0x03FFFFFF 190 (Controller Area Network (CAN) v. 2.0B >20 belong&0x03FFFFFF 191 (802.15.4 with Linux padding >20 belong&0x03FFFFFF 192 (PPI >20 belong&0x03FFFFFF 193 (802.16 MAC Common Part Sublayer plus radiotap header >20 belong&0x03FFFFFF 194 (Juniper Integrated Service Module >20 belong&0x03FFFFFF 195 (802.15.4 with FCS >20 belong&0x03FFFFFF 196 (SITA >20 belong&0x03FFFFFF 197 (Endace ERF >20 belong&0x03FFFFFF 198 (Ethernet with u10 Networks pseudo-header >20 belong&0x03FFFFFF 199 (IPMB >20 belong&0x03FFFFFF 200 (Juniper Secure Tunnel >20 belong&0x03FFFFFF 201 (Bluetooth HCI H4 with pseudo-header >20 belong&0x03FFFFFF 202 (AX.25 with KISS header >20 belong&0x03FFFFFF 203 (LAPD >20 belong&0x03FFFFFF 204 (PPP with direction pseudo-header >20 belong&0x03FFFFFF 205 (Cisco HDLC with direction pseudo-header >20 belong&0x03FFFFFF 206 (Frame Relay with direction pseudo-header >20 belong&0x03FFFFFF 209 (Linux IPMB >20 belong&0x03FFFFFF 215 (802.15.4 with non-ASK PHY header >20 belong&0x03FFFFFF 216 (Linux evdev events >20 belong&0x03FFFFFF 219 (MPLS with label as link-layer header >20 belong&0x03FFFFFF 220 (Memory-mapped Linux USB >20 belong&0x03FFFFFF 221 (DECT >20 belong&0x03FFFFFF 222 (AOS Space Data Link protocol >20 belong&0x03FFFFFF 223 (Wireless HART >20 belong&0x03FFFFFF 224 (Fibre Channel FC-2 >20 belong&0x03FFFFFF 225 (Fibre Channel FC-2 with frame delimiters >20 belong&0x03FFFFFF 226 (Solaris IPNET >20 belong&0x03FFFFFF 227 (SocketCAN >20 belong&0x03FFFFFF 228 (Raw IPv4 >20 belong&0x03FFFFFF 229 (Raw IPv6 >20 belong&0x03FFFFFF 230 (802.15.4 without FCS >20 belong&0x03FFFFFF 231 (D-Bus messages >20 belong&0x03FFFFFF 232 (Juniper Virtual Server >20 belong&0x03FFFFFF 233 (Juniper SRX E2E >20 belong&0x03FFFFFF 234 (Juniper Fibre Channel >20 belong&0x03FFFFFF 235 (DVB-CI >20 belong&0x03FFFFFF 236 (MUX27010 >20 belong&0x03FFFFFF 237 (STANAG 5066 D_PDUs >20 belong&0x03FFFFFF 238 (Juniper ATM CEMIC >20 belong&0x03FFFFFF 239 (Linux netfilter log messages >20 belong&0x03FFFFFF 240 (Hilscher netAnalyzer >20 belong&0x03FFFFFF 241 (Hilscher netAnalyzer with delimiters >20 belong&0x03FFFFFF 242 (IP-over-Infiniband >20 belong&0x03FFFFFF 243 (MPEG-2 Transport Stream packets >20 belong&0x03FFFFFF 244 (ng4t ng40 >20 belong&0x03FFFFFF 245 (NFC LLCP >20 belong&0x03FFFFFF 246 (Packet filter state syncing >20 belong&0x03FFFFFF 247 (InfiniBand >20 belong&0x03FFFFFF 248 (SCTP >20 belong&0x03FFFFFF 249 (USB with USBPcap header >20 belong&0x03FFFFFF 250 (Schweitzer Engineering Laboratories RTAC packets >20 belong&0x03FFFFFF 251 (Bluetooth Low Energy air interface >20 belong&0x03FFFFFF 252 (Wireshark Upper PDU export >20 belong&0x03FFFFFF 253 (Linux netlink >20 belong&0x03FFFFFF 254 (Bluetooth Linux Monitor >20 belong&0x03FFFFFF 255 (Bluetooth Basic Rate/Enhanced Data Rate baseband packets >20 belong&0x03FFFFFF 256 (Bluetooth Low Energy air interface with pseudo-header >20 belong&0x03FFFFFF 257 (PROFIBUS data link layer >20 belong&0x03FFFFFF 258 (Apple DLT_PKTAP >20 belong&0x03FFFFFF 259 (Ethernet with 802.3 Clause 65 EPON preamble >20 belong&0x03FFFFFF 260 (IPMI trace packets >20 belong&0x03FFFFFF 261 (Z-Wave RF profile R1 and R2 packets >20 belong&0x03FFFFFF 262 (Z-Wave RF profile R3 packets >20 belong&0x03FFFFFF 263 (WattStopper Digital Lighting Mngmt/Legrand Nitoo Open Proto >20 belong&0x03FFFFFF 264 (ISO 14443 messages >20 belong&0x03FFFFFF 265 (IEC 62106 Radio Data System groups >20 belong&0x03FFFFFF 266 (USB with Darwin header >20 belong&0x03FFFFFF 267 (OpenBSD DLT_OPENFLOW >20 belong&0x03FFFFFF 268 (IBM SDLC frames >20 belong&0x03FFFFFF 269 (TI LLN sniffer frames >20 belong&0x03FFFFFF 271 (Linux vsock >20 belong&0x03FFFFFF 272 (Nordic Semiconductor Bluetooth LE sniffer frames >20 belong&0x03FFFFFF 273 (Excentis XRA-31 DOCSIS 3.1 RF sniffer frames >20 belong&0x03FFFFFF 274 (802.3br mPackets >20 belong&0x03FFFFFF 275 (DisplayPort AUX channel monitoring data >20 belong&0x03FFFFFF 276 (Linux cooked v2 >20 belong&0x03FFFFFF 278 (OpenVizsla USB >20 belong&0x03FFFFFF 279 (Elektrobit High Speed Capture and Replay (EBHSCR) >20 belong&0x03FFFFFF 281 (Broadcom tag >20 belong&0x03FFFFFF 282 (Broadcom tag (prepended) >20 belong&0x03FFFFFF 284 (Marvell DSA >20 belong&0x03FFFFFF 285 (Marvell EDSA @ 1.1.1.9 log @2021-03-30 20:21 Christos Zoulas * release 5.40 2021-02-05 16:31 Christos Zoulas * PR/234: Add limit to the number of bytes to scan for encoding * PR/230: Fix /T (trim flag) for regex 2021-02-01 12:31 Christos Zoulas * PR/77: Trim trailing separator. 2020-12-17 15:44 Christos Zoulas * PR/211: Convert system read errors from corrupt ELF files into human readable error messages 2020-12-08 16:24 Christos Zoulas * fix multithreaded decompression file descriptor issue by using close-on-exec (Denys Vlasenko) 2020-06-27 11:58 Christos Zoulas * Exclude surrogate pairs from utf-8 detection (Michael Liu) 2020-06-25 12:53 Christos Zoulas * Include # to the list of ignored format chars (Werner Fink) @ text @d3 1 a3 1 # $File: sniffer,v 1.29 2021/03/13 18:51:51 christos Exp $ a266 5 >20 belong&0x03FFFFFF 286 (ELEE lawful intercept >20 belong&0x03FFFFFF 287 (Z-Wave serial >20 belong&0x03FFFFFF 288 (USB 2.0 >20 belong&0x03FFFFFF 289 (ATSC ALP >20 belong&0x03FFFFFF 290 (Event Tracing for Windows @ 1.1.1.10 log @Import file-5.43+; last was file-5.40 2022-09-20 17:12 Christos Zoulas * fixed various clustefuzz issues 2022-09-19 15:54 Christos Zoulas * Fix error detection for decompression code (Vincent Mihalkovic) 2022-09-15 13:50 Christos Zoulas * Add MAGIC_NO_COMPRESS_FORK and use it to produce a more meaningful error message if we are sandboxing. 2022-09-15 10:45 Christos Zoulas * Add built-in lzip decompression support (Michal Gorny) 2022-09-14 10:35 Christos Zoulas * Add built-in zstd decompression support (Martin Rodriguez Reboredo) 2022-09-13 14:55 Christos Zoulas * release 5.43 2022-09-10 9:17 Christos Zoulas * Add octal indirect magic (Michal Gorny) 2022-08-17 11:43 Christos Zoulas * PR/374: avoid infinite loop in non-wide code (piru) * PR/373: Obey MAGIC_CONTINUE with multiple magic files (vismarli) 2022-07-26 11:10 Christos Zoulas * Fix bug with large flist (Florian Weimer) 2022-07-07 13:21 Christos Zoulas * PR/364: Detect non-nul-terminated core filenames from QEMU (mam-ableton) 2022-07-04 15:45 Christos Zoulas * PR/359: Add support for http://ndjson.org/ (darose) * PR/362: Fix wide printing (ro-ee) * PR/358: Fix width for -f - (jpalus) * PR/356: Fix JSON constant parsing (davewhite) 2022-06-10 9:40 Christos Zoulas * release 5.42 2022-05-31 14:50 Christos Zoulas * PR/348: add missing cases to prevent file from aborting on random magic files. 2022-05-27 21:05 Christos Zoulas * PR/351: octalify filenames when not raw before printing. 2022-04-18 17:51 Christos Zoulas * fix regex cacheing bug (Dirk Mueller) * merge file_regcomp and file_regerror() to simplify the code and reduce memory requirements for storing regexes (Dirk Mueller) 2022-03-19 12:56 Christos Zoulas * cache regex (Dirk Mueller) * detect filesystem full by flushing output (Dirk Mueller) 2021-11-19 12:36 Christos Zoulas * implement running decompressor programs using posix_spawnp(2) instead of vfork(2) 2021-10-24 11:51 Christos Zoulas * Add support for msdos dates and times 2021-10-20 9:55 Christos Zoulas * use the system byte swapping functions if available (Werner Fink) 2021-10-18 11:57 Christos Zoulas * release 5.41 2021-09-23 03:51 Christos Zoulas * Avinash Sonawane: Fix tzname detection 2021-09-03 09:17 Christos Zoulas * Fix relationship tests with "search" magic, don't short circuit logic 2021-07-13 01:06 Christos Zoulas * Fix memory leak in compile mode 2021-07-01 03:51 Christos Zoulas * PR/272: kiefermat: Only set returnval = 1 when we printed something (in all cases print or !print). This simplifies the logic and fixes the issue in the PR with -k and --mime-type there was no continuation printed before the default case. 2021-06-30 13:07 Christos Zoulas * PR/270: Don't translate unprintable characters in %s magic formats when -r * PR/269: Avoid undefined behavior with clang (adding offset to NULL) 2021-05-09 18:38 Christos Zoulas * Add a new flag (f) that requires that the match is a full word, not a partial word match. * Add varint types (unused) 2021-04-19 17:17 Christos Zoulas * PR/256: mutableVoid: If the file is less than 3 bytes, use the file length to determine type * PR/259: aleksandr.v.novichkov: mime printing through indirect magic is not taken into account, use match directly so that it does. 2021-04-04 17:02 Christos Zoulas * count the total bytes found not the total byte positions in order to determine encoding (Anatol Belski) @ text @d3 1 a3 1 # $File: sniffer,v 1.32 2022/07/30 16:46:56 christos Exp $ a264 1 >20 belong&0x03FFFFFF 283 (802.15.4 with TAP a271 5 >20 belong&0x03FFFFFF 291 (Hilscher netANALYZER NG pseudo-footer >20 belong&0x03FFFFFF 292 (ZBOSS NCP protocol with pseudo-header >20 belong&0x03FFFFFF 293 (Low-Speed USB 2.0/1.1/1.0 >20 belong&0x03FFFFFF 294 (Full-Speed USB 2.0/1.1/1.0 >20 belong&0x03FFFFFF 295 (High-Speed USB 2.0 d364 1 a364 48 # URL: http://www.infovista.com # Reference: http://mark0.net/download/triddefs_xml.7z # defs/0/5vw.trid.xml # https://2.na.dl.wireshark.org/src/wireshark-3.6.2.tar.xz # wireshark-3.6.2/wiretap/5views.c # Update: Joerg Jenderek # Note: called "5View capture" by TrID and # "Wireshark capture file" on Windows or # "Packet Capture (Accellent/InfoVista 5view)" by shared MIME-info database # verified/falsified by `wireshark *.5vw` 0 string \xaa\xaa\xaa\xaa # skip misidentified boot/x86_64/loader/kroete.dat on Suse LEAP DVD # by check for valid record version >8 ulelong =0x00010000 >>0 use 5view-le 0 name 5view-le # t_5VW_Info_Header.Signature = CST_5VW_INFO_HEADER_KEY = 0xAAAAAAAAU >0 ulelong x 5View capture file # https://reposcope.com/mimetype/application/x-5view !:mime application/x-5view !:ext 5vw # size of header in bytes (included signature and reserved fields); probably always 20h >4 ulelong !0x00000020 \b, header size %#x # version of header record; apparently always CST_5VW_INFO_RECORD_VERSION=0x00010000U >8 ulelong !0x00010000 \b, record version %#x # DataSize; total size of data without header like: 18h >12 ulelong x \b, record size %#x # filetype; type of the capture file like: 18001000h >16 ulelong x \b, file type %#8.8x # Reserved[3]; reserved for future use; apparently zero >20 quad !0 \b, Reserved %#llx # look for record header key CST_5VW_RECORDS_HEADER_KEY of structure t_5VW_TimeStamped_Header >0x20 search/0xB8/b \xEE\xEE\x33\x33 \b; record # HeaderSize; actual size of this header in bytes like: 32 24h >>&0 uleshort x size %#x # HeaderType; exact type of this header; probably always 0x4000 >>&2 uleshort !0x4000 \b, header type %#x # RecType; type of record like: 80000000h >>&4 ulelong x \b, record type %#x # RecSubType; subtype of record like: 0 >>&8 ulelong !0 \b, subtype %#x # RecSize; Size of one record like: 5Ch >>&12 ulelong x \b, RecSize %#x # RecNb; Number of records like: 1 >>&16 ulelong >1 \b, %#x records # Timestamp Utc #>>&20 ulelong x \b, RAW TIME %#8.8x >>&20 date x \b, Time-stamp %s @ 1.1.1.11 log @Update to file-5.45 (Last was file-5.44) 2023-07-27 15:45 Christos Zoulas * release 5.45 2023-07-17 11:53 Christos Zoulas * PR/465: psrok1: Avoid muslc asctime_r crash 2023-05-21 13:05 Christos Zoulas * add SIMH tape format support 2023-02-09 12:50 Christos Zoulas * bump the max size of the elf section notes to be read to 128K and make it configurable 2023-01-08 1:08 Christos Zoulas * PR/415: Fix decompression with program returning empty 2022-12-26 1:47 Christos Zoulas * PR/408: fix -p with seccomp * PR/412: fix MinGW compilation @ text @d3 1 a3 1 # $File: sniffer,v 1.34 2022/12/14 18:27:36 christos Exp $ d330 3 a332 36 # URL: http://www.blacksheepnetworks.com/security/info/nw/lan/trace.txt # Reference: https://github.com/wireshark/wireshark/blob/master/wiretap/lanalyzer.c # Update: Joerg Jenderek # # regular trace header record (RT_HeaderRegular) 0 leshort 0x1001 # GRR: line above is too generic because it matches Commodore Plus/4 BASIC V3.5 # and VIC-20 BASIC V2 program # skip many Commodore Basic program (Microzodiac.prg Minefield.prg Vic-tac-toe.prg breakvic_joy.prg) # with invalid second record type 0 instead of "Trace receive channel name record" >(2.s+4) leshort =0x1006h >>0 use novell-lanalyzer # cyclic trace header record (RT_HeaderCyclic) 0 leshort 0x1007 >0 use novell-lanalyzer 0 name novell-lanalyzer >0 leshort x Novell LANalyzer capture file # https://reposcope.com/mimetype/application/x-lanalyzer !:mime application/x-lanalyzer # maybe also TR2 .. TR9 TRA .. TRZ !:ext tr1 # version like: 1.5 >4 ubyte x \b, version %u # minor version; one byte identifying the trace file minor version number >5 ubyte x \b.%u # Trace header record type like: 1001~regular or 1007~cyclic >0 leshort !0x1001 \b, record type %4.4x # record_length[2] is the length of the data part of 1st reorcd (without "type" and "length" fields) like: 4Ch >2 leshort x \b, record length %#x # second record type like: 1006h~Trace receive channel name record >(2.s+4) leshort !0x1006h \b, 2nd record type %#4.4x >(2.s+6) leshort x \b, 2nd record length %#x # each channel name is a null-terminated, eight-byte ASCII string like: Channel1 >(2.s+8) string x \b, names %.9s # 2nd channel name like: Channel2 >(2.s+17) string x %.9s ... d336 1 a336 9 # URL: https://nixdoc.net/man-pages/HP-UX/man1m/nettl.1m.html # Reference: https://github.com/wireshark/wireshark/blob/master/wiretap/nettl.c # Update: Joerg Jenderek # Note: Wireshark fills "meta information header fields" with "dummy" values # nettl_magic_hpux9[12]; for HP-UX 9.x not tested 0 string \x00\x00\x00\x01\x00\x00\x00\x00\x00\x07\xD0\x00 HP/UX 9.x nettl capture file !:mime application/x-nettl !:ext trc0/trc1 # nettl_magic_hpux10[12]; for HP-UX 10.x and 11.x a337 24 # https://reposcope.com/mimetype/application/x-nettl !:mime application/x-nettl # maybe also TRC000 TRC001 TRC002 ... !:ext trc0/trc1 # file_name[56]; maybe also like /tmp/raw.tr.TRC000 >12 string !/tmp/wireshark.TRC000 >>12 string x "%-.56s" # tz[20]; like UTC >68 string !UTC \b, tz >>68 string x %-.20s # host_name[9]; >88 string >\0 \b, host %-.9s # os_vers[9]; like B.11.11 >97 string !B.11.11 \b, os >>97 string x %-.9s # os_v; like 55h >>106 ubyte x (%#x) # xxa[8]; like 0 >107 ubequad !0 \b, xxa=%#16.16llx # model[11] like: 9000/800 >115 string !9000/800 \b, model >>115 string x %-.11s # unknown; probably just padding to 128 bytes like: 0406h >126 ubeshort !0x0406h \b, at 126 %#4.4x @ 1.1.1.11.2.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: sniffer,v 1.39 2025/07/02 17:35:12 christos Exp $ d81 2 a82 2 # (We call them "libpcap capture file(s)", as "libpcap" is # the first library that uses that format, but there are other programs d201 1 a201 1 >20 belong&0x03FFFFFF 209 (Linux I2C d243 1 a243 1 >20 belong&0x03FFFFFF 258 (Apple PKTAP d252 1 a252 1 >20 belong&0x03FFFFFF 267 (OpenBSD OpenFlow a314 1 !:mime application/x-pcapng a318 1 !:mime application/x-pcapng a321 1 @ 1.1.1.12 log @Import file-5.48 (previous was file-5.45) 2026-05-07 11:32 Christos Zoulas * release 5.48 2026-05-11 15:55 Christos Zoulas * add landlock support (valoq) 2026-04-19 15:55 Christos Zoulas * add BE/LE GUID 2026-04-17 11:05 Christos Zoulas * multiple fixes to prevent integer overflow in 32 bits (kerwin) 2026-04-15 12:40 Christos Zoulas * PR/745: streamout: Don't flush when trying to set negative offsets on pipes, just continue, fixes 'cat file.zip | file -' * PR/753: vmihalko: Fix race is magic_getpath() 2026-03-11 15:14 Christos Zoulas * PR/728: Anton Monroe: Reinstate regex/c 2026-02-26 11:32 Christos Zoulas * release 5.47 2026-02-04 09:54 Christos Zoulas * Better multi-compound document identification by following the order of the directories entries. (Thomas Ledoux) 2026-01-19 14:00 Christos Zoulas * if stat fails, don't attempt to restore times (Steven Grubb) 2025-05-28 15:20 Christos Zoulas * PR/622: Odd_Bloke: Handle negative offsets in file_buffer(), when fd is not available. 2025-05-28 12:50 Christos Zoulas * PR/655: jsummers: Obey str_flags in strings like we do for search and regex * PR/659: Pitzl: Apply MAGIC_CONTINUE to annotations; i.e. print only the first, unless -k is specified. 2024-12-19 14:44 Christos Zoulas * PR/592: allow + in format strings * PR/592: signed operations should be done in signed context 2024-12-05 13:50 Christos Zoulas * PR/578: jsummers: Don't crash on cygwin when tm_mon == -1 * PR/579: net147: Fix stack overrun. 2024-11-27 14:44 Christos Zoulas * release 5.46 * Add OFFPOSITIVE 2024-11-25 13:56 Christos Zoulas * avoid leaking symbols in libmagic 2024-11-10 13:56 Christos Zoulas * PR/562: jsummers: Search/regex offsets are absolute to the beginning of the file, so adjust them by subtracting the offset that the "use" starts so that we don't double-count it. 2024-11-09 19:30 Christos Zoulas * PR/543: matshch: bump nbuf so we can get the flags into the buffer. 2024-11-02 14:34 Christos Zoulas * Add Android elf notes (enh) 2023-12-29 12:55 Christos Zoulas * Add limit for number of magic warnings allowed 2023-07-29 12:55 Christos Zoulas * check regex bounds (found by clusterfuzz) @ text @d3 1 a3 1 # $File: sniffer,v 1.39 2025/07/02 17:35:12 christos Exp $ d81 2 a82 2 # (We call them "libpcap capture file(s)", as "libpcap" is # the first library that uses that format, but there are other programs d201 1 a201 1 >20 belong&0x03FFFFFF 209 (Linux I2C d243 1 a243 1 >20 belong&0x03FFFFFF 258 (Apple PKTAP d252 1 a252 1 >20 belong&0x03FFFFFF 267 (OpenBSD OpenFlow a314 1 !:mime application/x-pcapng a318 1 !:mime application/x-pcapng a321 1 @ 1.1.1.1.2.1 log @file sniffer was added on branch jym-xensuspend on 2009-05-13 18:52:00 +0000 @ text @d1 297 @ 1.1.1.1.2.2 log @Sync with HEAD. Second commit. See http://mail-index.netbsd.org/source-changes/2009/05/13/msg221222.html @ text @a0 297 #------------------------------------------------------------------------------ # sniffer: file(1) magic for packet capture files # # From: guy@@alum.mit.edu (Guy Harris) # # # Microsoft Network Monitor 1.x capture files. # 0 string RTSS NetMon capture file >5 byte x - version %d >4 byte x \b.%d >6 leshort 0 (Unknown) >6 leshort 1 (Ethernet) >6 leshort 2 (Token Ring) >6 leshort 3 (FDDI) >6 leshort 4 (ATM) # # Microsoft Network Monitor 2.x capture files. # 0 string GMBU NetMon capture file >5 byte x - version %d >4 byte x \b.%d >6 leshort 0 (Unknown) >6 leshort 1 (Ethernet) >6 leshort 2 (Token Ring) >6 leshort 3 (FDDI) >6 leshort 4 (ATM) # # Network General Sniffer capture files. # Sorry, make that "Network Associates Sniffer capture files." # Sorry, make that "Network General old DOS Sniffer capture files." # 0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file >33 byte 2 (compressed) >23 leshort x - version %d >25 leshort x \b.%d >32 byte 0 (Token Ring) >32 byte 1 (Ethernet) >32 byte 2 (ARCNET) >32 byte 3 (StarLAN) >32 byte 4 (PC Network broadband) >32 byte 5 (LocalTalk) >32 byte 6 (Znet) >32 byte 7 (Internetwork Analyzer) >32 byte 9 (FDDI) >32 byte 10 (ATM) # # Cinco Networks NetXRay capture files. # Sorry, make that "Network General Sniffer Basic capture files." # Sorry, make that "Network Associates Sniffer Basic capture files." # Sorry, make that "Network Associates Sniffer Basic, and Windows # Sniffer Pro", capture files." # Sorry, make that "Network General Sniffer capture files." # 0 string XCP\0 NetXRay capture file >4 string >\0 - version %s >44 leshort 0 (Ethernet) >44 leshort 1 (Token Ring) >44 leshort 2 (FDDI) >44 leshort 3 (WAN) >44 leshort 8 (ATM) >44 leshort 9 (802.11) # # "libpcap" capture files. # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is # the main program that uses that format, but there are other programs # that use "libpcap", or that use the same capture file format.) # 0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) >4 beshort x - version %d >6 beshort x \b.%d >20 belong 0 (No link-layer encapsulation >20 belong 1 (Ethernet >20 belong 2 (3Mb Ethernet >20 belong 3 (AX.25 >20 belong 4 (ProNET >20 belong 5 (CHAOS >20 belong 6 (Token Ring >20 belong 7 (BSD ARCNET >20 belong 8 (SLIP >20 belong 9 (PPP >20 belong 10 (FDDI >20 belong 11 (RFC 1483 ATM >20 belong 12 (raw IP >20 belong 13 (BSD/OS SLIP >20 belong 14 (BSD/OS PPP >20 belong 19 (Linux ATM Classical IP >20 belong 50 (PPP or Cisco HDLC >20 belong 51 (PPP-over-Ethernet >20 belong 99 (Symantec Enterprise Firewall >20 belong 100 (RFC 1483 ATM >20 belong 101 (raw IP >20 belong 102 (BSD/OS SLIP >20 belong 103 (BSD/OS PPP >20 belong 104 (BSD/OS Cisco HDLC >20 belong 105 (802.11 >20 belong 106 (Linux Classical IP over ATM >20 belong 107 (Frame Relay >20 belong 108 (OpenBSD loopback >20 belong 109 (OpenBSD IPsec encrypted >20 belong 112 (Cisco HDLC >20 belong 113 (Linux "cooked" >20 belong 114 (LocalTalk >20 belong 117 (OpenBSD PFLOG >20 belong 119 (802.11 with Prism header >20 belong 122 (RFC 2625 IP over Fibre Channel >20 belong 123 (SunATM >20 belong 127 (802.11 with radiotap header >20 belong 129 (Linux ARCNET >20 belong 138 (Apple IP over IEEE 1394 >20 belong 140 (MTP2 >20 belong 141 (MTP3 >20 belong 143 (DOCSIS >20 belong 144 (IrDA >20 belong 147 (Private use 0 >20 belong 148 (Private use 1 >20 belong 149 (Private use 2 >20 belong 150 (Private use 3 >20 belong 151 (Private use 4 >20 belong 152 (Private use 5 >20 belong 153 (Private use 6 >20 belong 154 (Private use 7 >20 belong 155 (Private use 8 >20 belong 156 (Private use 9 >20 belong 157 (Private use 10 >20 belong 158 (Private use 11 >20 belong 159 (Private use 12 >20 belong 160 (Private use 13 >20 belong 161 (Private use 14 >20 belong 162 (Private use 15 >20 belong 163 (802.11 with AVS header >16 belong x \b, capture length %d) 0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) >4 leshort x - version %d >6 leshort x \b.%d >20 lelong 0 (No link-layer encapsulation >20 lelong 1 (Ethernet >20 lelong 2 (3Mb Ethernet >20 lelong 3 (AX.25 >20 lelong 4 (ProNET >20 lelong 5 (CHAOS >20 lelong 6 (Token Ring >20 lelong 7 (ARCNET >20 lelong 8 (SLIP >20 lelong 9 (PPP >20 lelong 10 (FDDI >20 lelong 11 (RFC 1483 ATM >20 lelong 12 (raw IP >20 lelong 13 (BSD/OS SLIP >20 lelong 14 (BSD/OS PPP >20 lelong 19 (Linux ATM Classical IP >20 lelong 50 (PPP or Cisco HDLC >20 lelong 51 (PPP-over-Ethernet >20 lelong 99 (Symantec Enterprise Firewall >20 lelong 100 (RFC 1483 ATM >20 lelong 101 (raw IP >20 lelong 102 (BSD/OS SLIP >20 lelong 103 (BSD/OS PPP >20 lelong 104 (BSD/OS Cisco HDLC >20 lelong 105 (802.11 >20 lelong 106 (Linux Classical IP over ATM >20 lelong 107 (Frame Relay >20 lelong 108 (OpenBSD loopback >20 lelong 109 (OpenBSD IPsec encrypted >20 lelong 112 (Cisco HDLC >20 lelong 113 (Linux "cooked" >20 lelong 114 (LocalTalk >20 lelong 117 (OpenBSD PFLOG >20 lelong 119 (802.11 with Prism header >20 lelong 122 (RFC 2625 IP over Fibre Channel >20 lelong 123 (SunATM >20 lelong 127 (802.11 with radiotap header >20 lelong 129 (Linux ARCNET >20 lelong 138 (Apple IP over IEEE 1394 >20 lelong 140 (MTP2 >20 lelong 141 (MTP3 >20 lelong 143 (DOCSIS >20 lelong 144 (IrDA >20 lelong 147 (Private use 0 >20 lelong 148 (Private use 1 >20 lelong 149 (Private use 2 >20 lelong 150 (Private use 3 >20 lelong 151 (Private use 4 >20 lelong 152 (Private use 5 >20 lelong 153 (Private use 6 >20 lelong 154 (Private use 7 >20 lelong 155 (Private use 8 >20 lelong 156 (Private use 9 >20 lelong 157 (Private use 10 >20 lelong 158 (Private use 11 >20 lelong 159 (Private use 12 >20 lelong 160 (Private use 13 >20 lelong 161 (Private use 14 >20 lelong 162 (Private use 15 >20 lelong 163 (802.11 with AVS header >16 lelong x \b, capture length %d) # # "libpcap"-with-Alexey-Kuznetsov's-patches capture files. # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is # the main program that uses that format, but there are other programs # that use "libpcap", or that use the same capture file format.) # 0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian) >4 beshort x - version %d >6 beshort x \b.%d >20 belong 0 (No link-layer encapsulation >20 belong 1 (Ethernet >20 belong 2 (3Mb Ethernet >20 belong 3 (AX.25 >20 belong 4 (ProNET >20 belong 5 (CHAOS >20 belong 6 (Token Ring >20 belong 7 (ARCNET >20 belong 8 (SLIP >20 belong 9 (PPP >20 belong 10 (FDDI >20 belong 11 (RFC 1483 ATM >20 belong 12 (raw IP >20 belong 13 (BSD/OS SLIP >20 belong 14 (BSD/OS PPP >16 belong x \b, capture length %d) 0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian) >4 leshort x - version %d >6 leshort x \b.%d >20 lelong 0 (No link-layer encapsulation >20 lelong 1 (Ethernet >20 lelong 2 (3Mb Ethernet >20 lelong 3 (AX.25 >20 lelong 4 (ProNET >20 lelong 5 (CHAOS >20 lelong 6 (Token Ring >20 lelong 7 (ARCNET >20 lelong 8 (SLIP >20 lelong 9 (PPP >20 lelong 10 (FDDI >20 lelong 11 (RFC 1483 ATM >20 lelong 12 (raw IP >20 lelong 13 (BSD/OS SLIP >20 lelong 14 (BSD/OS PPP >16 lelong x \b, capture length %d) # # AIX "iptrace" capture files. # 0 string iptrace\ 1.0 "iptrace" capture file 0 string iptrace\ 2.0 "iptrace" capture file # # Novell LANalyzer capture files. # 0 leshort 0x1001 LANalyzer capture file 0 leshort 0x1007 LANalyzer capture file # # HP-UX "nettl" capture files. # 0 string \x54\x52\x00\x64\x00 "nettl" capture file # # RADCOM WAN/LAN Analyzer capture files. # 0 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file # # NetStumbler log files. Not really packets, per se, but about as # close as you can get. These are log files from NetStumbler, a # Windows program, that scans for 802.11b networks. # 0 string NetS NetStumbler log file >8 lelong x \b, %d stations found # # EtherPeek/AiroPeek "version 9" capture files. # 0 string \177ver EtherPeek/AiroPeek capture file # # Visual Networks traffic capture files. # 0 string \x05VNF Visual Networks traffic capture file # # Network Instruments Observer capture files. # 0 string ObserverPktBuffe Network Instruments Observer capture file # # Files from Accellent Group's 5View products. # 0 string \xaa\xaa\xaa\xaa 5View capture file @