Source file conan_sniffer.ml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
let tree = Conan.Tree.Unsafe.node
[(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(Conan.Tree.Unsafe.name
~offset:(Conan.Offset.Absolute (Conan.Offset.Value 0L))
"5view-le"),
Conan.Tree.Unsafe.node
[(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(let ty = Conan.Ty.numeric ~unsigned:true ~endian:`LE
Conan.Integer.int32 (Conan.Arithmetic.Add
0l) in
Conan.Tree.Unsafe.rule
~offset:(Conan.Offset.Absolute
(Conan.Offset.Value 0L))
ty (Conan.Test.always_true)
(`Space "5View capture file")),
Conan.Tree.Unsafe.node
[(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(Conan.Tree.Unsafe.mime "application/x-5view"),
Conan.Tree.Unsafe.node [])])]);
(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(let ty = Conan.Ty.search ~compact_whitespaces:false
~optional_blank:false
~lower_case_insensitive:false
~upper_case_insensitive:false `Text ~trim:false
5L ~pattern:"TR\000d\000" in
Conan.Tree.Unsafe.rule
~offset:(Conan.Offset.Absolute (Conan.Offset.Value 0L))
ty
(Conan.Test.string
(Conan.Comparison.equal_to "TR\000d\000"))
(`Space "HP/UX nettl capture file")),
Conan.Tree.Unsafe.node
[(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(Conan.Tree.Unsafe.mime "application/x-nettl"),
Conan.Tree.Unsafe.node [])]);
(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(let ty = Conan.Ty.search ~compact_whitespaces:false
~optional_blank:false
~lower_case_insensitive:false
~upper_case_insensitive:false `Text ~trim:false
12L
~pattern:"\000\000\000\001\000\000\000\000\000\007\208\000" in
Conan.Tree.Unsafe.rule
~offset:(Conan.Offset.Absolute (Conan.Offset.Value 0L))
ty
(Conan.Test.string
(Conan.Comparison.equal_to
"\000\000\000\001\000\000\000\000\000\007\208\000"))
(`Space "HP/UX 9.x nettl capture file")),
Conan.Tree.Unsafe.node
[(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(Conan.Tree.Unsafe.mime "application/x-nettl"),
Conan.Tree.Unsafe.node [])]);
(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(Conan.Tree.Unsafe.name
~offset:(Conan.Offset.Absolute (Conan.Offset.Value 0L))
"novell-lanalyzer"),
Conan.Tree.Unsafe.node
[(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(let ty = Conan.Ty.numeric ~unsigned:false ~endian:`LE
Conan.Integer.short (Conan.Arithmetic.Add 0) in
Conan.Tree.Unsafe.rule
~offset:(Conan.Offset.Absolute
(Conan.Offset.Value 0L))
ty (Conan.Test.always_true)
(`Space "Novell LANalyzer capture file")),
Conan.Tree.Unsafe.node
[(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(Conan.Tree.Unsafe.mime "application/x-lanalyzer"),
Conan.Tree.Unsafe.node [])])]);
(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(let ty = Conan.Ty.numeric ~unsigned:true ~endian:`LE
Conan.Integer.int32 (Conan.Arithmetic.Add 0l) in
Conan.Tree.Unsafe.rule
~offset:(Conan.Offset.Absolute (Conan.Offset.Value 0L))
ty
(Conan.Test.numeric Conan.Integer.int32
(Conan.Comparison.equal_to (-1582154675l)))
(`Space "pcap capture file, nanosecond ts (little-endian)")),
Conan.Tree.Unsafe.node
[(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(Conan.Tree.Unsafe.mime "application/vnd.tcpdump.pcap"),
Conan.Tree.Unsafe.leaf)]);
(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(let ty = Conan.Ty.numeric ~unsigned:true ~endian:`BE
Conan.Integer.int32 (Conan.Arithmetic.Add 0l) in
Conan.Tree.Unsafe.rule
~offset:(Conan.Offset.Absolute (Conan.Offset.Value 0L))
ty
(Conan.Test.numeric Conan.Integer.int32
(Conan.Comparison.equal_to (-1582154675l)))
(`Space "pcap capture file, nanosecond ts (big-endian)")),
Conan.Tree.Unsafe.node
[(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(Conan.Tree.Unsafe.mime "application/vnd.tcpdump.pcap"),
Conan.Tree.Unsafe.leaf)]);
(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(let ty = Conan.Ty.numeric ~unsigned:true ~endian:`LE
Conan.Integer.int32 (Conan.Arithmetic.Add 0l) in
Conan.Tree.Unsafe.rule
~offset:(Conan.Offset.Absolute (Conan.Offset.Value 0L))
ty
(Conan.Test.numeric Conan.Integer.int32
(Conan.Comparison.equal_to (-1582119980l)))
(`Space "pcap capture file, microsecond ts (little-endian)")),
Conan.Tree.Unsafe.node
[(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(Conan.Tree.Unsafe.mime "application/vnd.tcpdump.pcap"),
Conan.Tree.Unsafe.leaf)]);
(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(let ty = Conan.Ty.numeric ~unsigned:true ~endian:`BE
Conan.Integer.int32 (Conan.Arithmetic.Add 0l) in
Conan.Tree.Unsafe.rule
~offset:(Conan.Offset.Absolute (Conan.Offset.Value 0L))
ty
(Conan.Test.numeric Conan.Integer.int32
(Conan.Comparison.equal_to (-1582119980l)))
(`Space "pcap capture file, microseconds ts (big-endian)")),
Conan.Tree.Unsafe.node
[(Conan.Tree.Unsafe.elt ?filename:(None) ?line:(None)
(Conan.Tree.Unsafe.mime "application/vnd.tcpdump.pcap"),
Conan.Tree.Unsafe.leaf)])]