Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Etw #934

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
citronneur wants to merge 4 commits into the-tcpdump-group:master
base: master
Choose a base branch
Loading
from airbus-cert:etw
Open

Etw #934

citronneur wants to merge 4 commits into the-tcpdump-group:master from airbus-cert:etw

Conversation

Copy link

@citronneur citronneur commented May 29, 2020

Hello libpcap Team,

I would like to propose you a pull request that allow the libpcap to capture ETW on windows platform.
This pull request is part of a project named Winshark that will be presented at SSTIC, that allow Wireshark to capture and analyze ETW.

Have a nice day,

Sylvain

handle->stats_op = pcap_stats_etw;
handle->read_op = pcap_read_op_etw;
handle->snapshot = MAXIMUM_SNAPLEN;
handle->linktype = DLT_USER0;
Copy link
Member

@guyharris guyharris May 29, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't use a DLT_USER value; send an email to tcpdump-workers@lists.tcpdump.org to request that a DLT_ value be assigned for this purpose.

Copy link
Author

@citronneur citronneur May 29, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm just sending the email. Thanks for your feedback.

Copy link
Member

This should add pcap-etw.c to the EXTRA_DIST list in Makefile.in, even though it won't be used on UN*X, so that the release tarball will include it.

Copy link
Author

I've added pcap-etw.c into MANIFEST.in but it seems that the build is broken for network reason...

Copy link
Member

I've added pcap-etw.c into MANIFEST.in but it seems that the build is broken for network reason...

Neither Travis nor AppVeyor are reliable CI engines; they both sometimes need to have builds re-tried to get them to finish.

Copy link
Member

As a generic observation, please use a consistent curly braces style, currently the file alternates between Allman and K&R.

Since this is a case of a "try-fixup-fixup-fixup" sequence of commits, if anyone comes to the point of merging this request, please do that as a single squashed commit.
fxlb reacted with thumbs up emoji

@mcr mcr added this to the release-after-next milestone Aug 21, 2020
@mcr mcr added the windows label Aug 21, 2020
Copy link
Author

Thanks a lot!

Copy link
Author

Rebase commit from PR #978, squash into one commit.
Have a nice day

wiresharkyyh and others added 4 commits January 27, 2022 18:37 
Fix time and perf issue
Update: Add extended data for tracelogging capture
Fix: comment mispelling
Fix: rename pcap_snprintf to snprintf
Update: comment
@infrastation infrastation removed this from the release-after-next milestone May 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@guyharris guyharris guyharris left review comments

Assignees

No one assigned

Labels

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

AltStyle によって変換されたページ (->オリジナル) /