osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

README.tapping: Some minor updates

pespin/osmux-wip
Martin Mathieson 2021-12-18 14:47:57 +00:00 committed by Wireshark GitLab Utility
parent 62a747bae3
commit 4901eefaa5
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
doc/README.tapping
View File

@ -1,7 +1,7 @@
The TAP system in Wireshark is a powerful and flexible mechanism to get event
driven notification on packets matching certain protocols and/or filters.
In order to use the tapping system, very little knowledge of Wireshark
internals are required.
internals is required.
As examples on how to use the tap system see the implementation of
tap-rpcprogs.c (tshark version)
@ -30,7 +30,7 @@ If not, then you have to add a tap but don't worry, this is extremely easy to
do and is done in four easy steps;
(see packet-rpc.c and search for tap for an example)
1, We need tap.h so just add '#include "tap.h"' (preceded by packet.h) to
1, We need tap.h so just add '#include <epan/tap.h>' (preceded by packet.h) to
the includes.
2, We need a tap handler so just add 'static int <protocol>_tap = -1;'
@ -43,7 +43,7 @@ have returned, just add 'tap_queue_packet(<protocol>_tap, pinfo, <pointer>);'
<pointer> is used if the tap has any special additional data to provide to the
tap listeners. What this points to is dependent on the protocol that is tapped,
or if there are no useful extra data to provide just specify NULL. For
or if there is no useful extra data to provide, just specify NULL. For
packet-rpc.c what we specify there is the persistent structure 'rpc_call' which
contains lots of useful information from the rpc layer that a listener might
need.
@ -84,7 +84,7 @@ pointer to distinguish between different instances of a tap.
Just make sure that it is unique by letting it be the pointer to a struct
holding all state variables. If you want to allow multiple concurrent
instances, just put ALL state variables inside a struct allocated by
g_malloc() and use that pointer.
g_new() and use that pointer.
(tap-rpcstat.c use this technique to allow multiple simultaneous instances)
*fstring
@ -123,6 +123,11 @@ is a set of flags for the tap listener. The flags that can be set are:
set if your tap listener "packet" routine requires the column
strings to be constructed.
TL_REQUIRES_ERROR_PACKET
set if your tap listener should be updated even when pinfo->flags.in_error_pkt is set
e.g. if it is inside an ICMP unreachable packet
If no flags are needed, use TL_REQUIRES_NOTHING.
void (*reset)(void *tapdata)
@ -133,7 +138,7 @@ in the *tapdata instance.
tap_packet_status (*packet)(void *tapdata, packet_info *pinfo, epan_dissect_t *edt, const void *data)
This callback is used whenever a new packet has arrived at the tap and that
it has passed the filter (if there were a filter).
it has passed the filter (if there was a filter).
The *data structure type is specific to each tap.
This function returns a tap_packet_status enum and it should return
TAP_PACKET_REDRAW, if the data in the packet caused state to be updated