pf file format

[sysadmin]

Where can I find the file format for pf files?

[fathernitwit]

//constants used in the packet file header
#define PACKET_FILE_MAGIC 0x93a7b6f7

#pragma pack(1)
struct PacketFileHeader {
	uint32 packet_file_magic;
	uint32 packet_file_stamp;
};

struct PacketFileSection {
	uint16 opcode;
	uint32 len;
};
#pragma pack()

class PacketFileReader {
public:
	PacketFileReader();
	~PacketFileReader();
	
	bool OpenFile(const char *name);
	void CloseFile();
	
	bool ReadPacket(uint16 &eq_op, uint32 &packlen, unsigned char *packet);
	
	time_t GetStamp() { return(time_t(packet_file_stamp)); }
	
protected:
	
	uint32 packet_file_stamp;
	
	//gzFile in;
	FILE *in;	
};

PacketFileReader::PacketFileReader() {
	in = NULL;
	packet_file_stamp = 0;
}

PacketFileReader::~PacketFileReader() {
	CloseFile();
}
	
bool PacketFileReader::OpenFile(const char *name) {
	CloseFile();
	
	printf("Opening packet file: %s\n", name);
	
	in = fopen(name, "rb");
	if(in == NULL) {
		fprintf(stderr, "Error opening packet file '%s': %s\n", name, strerror(errno));
		return(false);
	}
	
	PacketFileHeader head;
	
	if(fread(&head, sizeof(head), 1, in) != 1) {
		fprintf(stderr, "Error writting header to packet file: %s\n", strerror(errno));
		fclose(in);
		return(false);
	}
	
	if(head.packet_file_magic != PACKET_FILE_MAGIC) {
		fclose(in);
		if(head.packet_file_magic == (PACKET_FILE_MAGIC+1)) {
			fprintf(stderr, "Error: this is a build file, not a packet file, its allready processed!\n");
		} else {
			fprintf(stderr, "Error: this is not a packet file!\n");
		}
		return(false);
	}
	
	uint32 now = time(NULL);
	if(head.packet_file_stamp > now) {
		fprintf(stderr, "Error: invalid timestamp in file. Your clock or the collector's is wrong.");
		fclose(in);
		return(false);
	}
	
	packet_file_stamp = head.packet_file_stamp;
	
	return(true);
}

void PacketFileReader::CloseFile() {
	if(in != NULL) {
		fclose(in);
		in = NULL;
		printf("Closed packet file.\n");
	}
}

bool PacketFileReader::ReadPacket(uint16 &eq_op, uint32 &packlen, unsigned char *packet) {
	if(in == NULL)
		return(false);
	if(feof(in))
		return(false);
	
	PacketFileSection s;
	
	if(fread(&s, sizeof(s), 1, in) != 1) {
		if(!feof(in))
			fprintf(stderr, "Error reading section header: %s\n", strerror(errno));
		return(false);
	}
	
	eq_op = s.opcode;
	
	if(packlen < s.len) {
		fprintf(stderr, "Packet buffer is too small! %d < %d, skipping\n", packlen, s.len);
		fseek(in, s.len, SEEK_CUR);
		return(false);
	}
	
	if(fread(packet, 1, s.len, in) != s.len) {
		if(feof(in))
			fprintf(stderr, "Error: EOF encountered when expecting packet data.\n");
		else
			fprintf(stderr, "Error reading packet body: %s\n", strerror(errno));
		return(false);
	}
	
	packlen = s.len;
	
	return(true);
}

[sysadmin]

Thanks on posting this info!