Wireshark · Ethereal-dev: Re: [Ethereal-dev] Patch: Add wiretap support for Endace ERF files (updated)

[Jesper Peterson <jesper@xxxxxxxxxx>]

Guy Harris wrote:
> On Tuesday, August 26, 2003, at 2:36 PM, Jesper Peterson wrote:
> > RFC1483. We are more concerened with the payload than the header.
> What if the payload is, for example, LANE, rather than RFC 1483?

Geez, you won't the ATM encapsulation issue die will you :) I was reluctant to 
 turn an experiment into the default behaviour, however it seems to work, so 
here is a patch to make PDUS the default.

It also incorporates an updated fix for compilers that don't support ULL 
constants. The expression in question was already guint64 so the constants 
don't need to be.

--
Jesper Peterson, Senior Software Developer
http://www.endace.com, +64 7 839 0540

Index: wiretap/erf.c
===================================================================
RCS file: /cvsroot/ethereal/wiretap/erf.c,v
retrieving revision 1.1
diff -u -r1.1 erf.c
--- wiretap/erf.c	26 Aug 2003 07:10:38 -0000	1.1
+++ wiretap/erf.c	26 Aug 2003 22:20:50 -0000
@@ -75,7 +75,7 @@
 	guint32 i, n;
 	char *s;
 	guint32 records_for_erf_check = RECORDS_FOR_ERF_CHECK;
-	guint32 atm_encap = WTAP_ENCAP_ATM_RFC1483;
+	guint32 atm_encap = WTAP_ENCAP_ATM_PDUS;
 	gboolean is_rawatm = FALSE;
 	gboolean is_ppp = FALSE;
 	int common_type = 0;
@@ -90,6 +90,9 @@
 		if (!strcmp(s, "sunraw")) {
 			atm_encap = WTAP_ENCAP_ATM_PDUS;
 			is_rawatm = TRUE;
+		} else
+		if (!strcmp(s, "rfc1483")) {
+			atm_encap = WTAP_ENCAP_ATM_RFC1483;
 		}
 	}
 
@@ -302,8 +305,8 @@
 		guint64 ts = pletohll(&erf_header->ts);
 
 		phdr->ts.tv_sec = ts >> 32;
-		ts = ((ts &  0xffffffffULL) * 1000 * 1000);
-		ts += (ts & 0x80000000ULL) << 1; /* rounding */
+		ts = ((ts & 0xffffffff) * 1000 * 1000);
+		ts += (ts & 0x80000000) << 1; /* rounding */
 		phdr->ts.tv_usec = ts >> 32;		
 		if (phdr->ts.tv_usec >= 1000000) {
 			phdr->ts.tv_usec -= 1000000;