Skip to content

Commit f10c232

Browse files
mcrmcr
authored
Merge pull request #18 from wiresharkyyh/dlt_etw_doc
documentation associated with the-tcpdump-group/libpcap#978
2 parents 3dcc4f8 + e0efdff commit f10c232

File tree

1 file changed

+154
-0
lines changed

1 file changed

+154
-0
lines changed

‎linktypes/LINKTYPE_ETW.html‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
2+
<!--
3+
Created by : Luis MartinGarcia <http://www.aldabaknocking.com>
4+
Original design : "Collaboration" by Free CSS Templates <http://www.freecsstemplates.org>
5+
Original license : Creative Commons Attribution 2.5 License
6+
-->
7+
<html>
8+
9+
<!-- HEAD -->
10+
<head>
11+
<meta http-equiv="content-type" content="text/html; charset=utf-8">
12+
<title>LINKTYPE_ETW | TCPDUMP/LIBPCAP public repository</title>
13+
<meta name="keywords" content="tcpdump, libpcap, pcap, packet capture, sniffer, security, eavesdrop">
14+
<meta name="description" content="Web site of Tcpdump and Libpcap">
15+
<link href="../style.css" rel="stylesheet" type="text/css" media="screen">
16+
<link rel="canonical" href="https://www.tcpdump.org">
17+
</head>
18+
<!-- END OF HTML HEAD -->
19+
20+
<!-- BODY -->
21+
<body>
22+
23+
<!-- TOP MENU -->
24+
<div id="menu">
25+
<ul>
26+
<li><a href="../index.html">Home</a></li>
27+
<li><a href="../security.html">Security</a></li>
28+
<li><a href="../faq.html">FAQ</a></li>
29+
<li><a href="../linktypes.html">Link-Layer Header Types</a></li>
30+
<li><a href="../related.html">Related Projects</a></li>
31+
<li><a href="../license.html">Licenses</a></li>
32+
<li><a href="../old_releases.html">Old Releases</a></li>
33+
<li><a href="../mirrors.html">Mirrors</a></li>
34+
</ul>
35+
</div>
36+
<!-- END OF TOP MENU -->
37+
38+
<!-- PAGE HEADER -->
39+
<div id="splash">
40+
<br><img src="../images/logo.png" alt="">
41+
</div>
42+
<div id="logo">
43+
<hr>
44+
</div>
45+
<!-- END OF PAGE HEADER -->
46+
47+
<!-- PAGE CONTENTS -->
48+
<div id="page">
49+
50+
<!-- Start of LINKTYPE_ETW section -->
51+
<div class="post">
52+
<h2 class="title">
53+
<a name="intro">LINKTYPE_ETW</a>
54+
</h2>
55+
<div class="entry">
56+
<h3>Packet structure</h3>
57+
<pre>
58+
0 1 2 3
59+
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
60+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
61+
/ /
62+
/ EVENT_HEADER /
63+
/ /
64+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 80 bytes
65+
| ETW_BUFFER_CONTEXT |
66+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
67+
| UserDataLength |
68+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
69+
| MessageLength |
70+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
71+
| ProviderNameLength |
72+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
73+
/ UserData /
74+
/ variable length, padded to 32 bits /
75+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
76+
/ Message /
77+
/ variable length, padded to 32 bits /
78+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
79+
/ ProviderName /
80+
/ variable length, padded to 32 bits /
81+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
82+
</pre>
83+
84+
<h3>Description</h3>
85+
<p>
86+
All multi-byte numerical fields are little-endian. All primitive types in this document are from Windows and their size can be found on <a href="https://docs.microsoft.com/en-us/cpp/cpp/data-type-ranges?view=msvc-160">this MSDN page</a>.
87+
</p>
88+
<p>
89+
EVENT_HEADER is 80 bytes long data struct defined by Microsoft. It is declared on <a href="https://docs.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_header">this MSDN page</a>.
90+
</p>
91+
<p>
92+
The bit values of Flags in EVENT_HEADER are
93+
</p>
94+
<pre>
95+
#define EVENT_HEADER_FLAG_EXTENDED_INFO 0x0001
96+
#define EVENT_HEADER_FLAG_PRIVATE_SESSION 0x0002
97+
#define EVENT_HEADER_FLAG_STRING_ONLY 0x0004
98+
#define EVENT_HEADER_FLAG_TRACE_MESSAGE 0x0008
99+
#define EVENT_HEADER_FLAG_NO_CPUTIME 0x0010
100+
#define EVENT_HEADER_FLAG_32_BIT_HEADER 0x0020
101+
#define EVENT_HEADER_FLAG_64_BIT_HEADER 0x0040
102+
#define EVENT_HEADER_FLAG_CLASSIC_HEADER 0x0100
103+
</pre>
104+
<p>
105+
The bit values of EventProperty in EVENT_HEADER are
106+
</p>
107+
<pre>
108+
#define EVENT_HEADER_PROPERTY_XML 0x0001
109+
#define EVENT_HEADER_PROPERTY_FORWARDED_XML 0x0002
110+
#define EVENT_HEADER_PROPERTY_LEGACY_EVENTLOG 0x0004
111+
</pre>
112+
<p>
113+
ETW_BUFFER_CONTEXT is 4 bytes long data struct defined by Microsoft. It is declared on <a href="https://docs.microsoft.com/en-us/windows/win32/api/relogger/ns-relogger-etw_buffer_context">this MSDN page</a>.
114+
</p>
115+
<p>
116+
UserDataLength is the length of UserData, the UserDataLength doesn't include the padding bytes of UserData.
117+
<p>
118+
MessageLength is the length of Message, the MessageLength doesn't include the padding bytes of Message.
119+
</p>
120+
<p>
121+
ProviderNameLength is the length of ProviderName, the ProviderNameLength doesn't include the padding bytes of ProviderName.
122+
</p>
123+
<p>
124+
UserData is specific event data of the provider, its format is defined by the provider.
125+
</p>
126+
<p>
127+
Message is a null-terminated UTF-16 string that contains the event message string.
128+
</p>
129+
<p>
130+
Providername is a null-terminated UTF-16 string that contains the event provider name string.
131+
</p>
132+
</div>
133+
<!-- End of LINKTYPE_ETW section -->
134+
</div>
135+
</div>
136+
<!-- END OF PAGE CONTENTS -->
137+
138+
<!-- FOOTER -->
139+
<div id="footer">
140+
<p>
141+
&copy; 2010-2020 The Tcpdump Group. Designed by
142+
<a href="http://www.aldabaknocking.com/">Luis MartinGarcia</a>;
143+
based on a template by <a href="http://www.freecsstemplates.org/">
144+
Free CSS Templates</a>.
145+
<a href="https://validator.w3.org/check?uri=referer">[Valid HTML
146+
4.01]</a> <a href="https://jigsaw.w3.org/css-validator/check/referer">
147+
[Valid CSS]</a>
148+
</p>
149+
</div>
150+
<!-- END OF FOOTER -->
151+
152+
</body>
153+
<!-- END OF HTML BODY -->
154+
</html>

0 commit comments

Comments
 (0)