From 7775a0bec5cfde8fc704cd3715c45633ddf352c6 Mon Sep 17 00:00:00 2001 From: Ronnie Sahlberg Date: Mon, 4 Nov 2002 12:11:01 +0000 Subject: [PATCH] New tap extension to tethereal: ProtoColInfo Using this command line option you canb now place any arbitrary display-filter fields on the COL_INFO line. Assume you want NFS dissector in tethereal to put ALL filehandle hashes (nfs.fh.hash) on COL_INFO. No worries, just add -z proto,colinfo,nfs.fh.hash,nfs.fh.hash as a parameter to tethereal. Never again do you need to hack tethereal and recompile just because you want some extra info on the COL_INFO line. svn path=/trunk/; revision=6560 --- Makefile.am | 3 +- Makefile.nmake | 3 +- doc/tethereal.pod.template | 31 ++++++++- tap-protocolinfo.c | 127 +++++++++++++++++++++++++++++++++++++ 4 files changed, 161 insertions(+), 3 deletions(-) create mode 100644 tap-protocolinfo.c diff --git a/Makefile.am b/Makefile.am index 4ff390021e..1d9e4f9fad 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1,7 +1,7 @@ # Makefile.am # Automake file for Ethereal # -# $Id: Makefile.am,v 1.517 2002/11/03 17:38:30 oabad Exp $ +# $Id: Makefile.am,v 1.518 2002/11/04 12:10:59 sahlberg Exp $ # # Ethereal - Network traffic analyzer # By Gerald Combs @@ -765,6 +765,7 @@ ethereal_static_LDFLAGS = -Wl,-static TETHEREAL_TAP_SRC = \ tap-dcerpcstat.c \ tap-iostat.c \ + tap-protocolinfo.c \ tap-protohierstat.c \ tap-rpcstat.c \ tap-rpcprogs.c diff --git a/Makefile.nmake b/Makefile.nmake index 838a65963f..fcb416791c 100644 --- a/Makefile.nmake +++ b/Makefile.nmake @@ -1,7 +1,7 @@ ## Makefile for building ethereal.exe with Microsoft C and nmake ## Use: $(MAKE) /$(MAKEFLAGS) -f makefile.nmake # -# $Id: Makefile.nmake,v 1.252 2002/11/02 22:23:16 sahlberg Exp $ +# $Id: Makefile.nmake,v 1.253 2002/11/04 12:10:59 sahlberg Exp $ include config.nmake include @@ -326,6 +326,7 @@ DISSECTOR_OBJECTS = $(DISSECTOR_SRC:.c=.obj) TETHEREAL_TAP_SRC = \ tap-dcerpcstat.c \ tap-iostat.c \ + tap-protocolinfo.c \ tap-protohierstat.c \ tap-rpcstat.c \ tap-rpcprogs.c diff --git a/doc/tethereal.pod.template b/doc/tethereal.pod.template index e9a170c3bd..8ebdfcf4a4 100644 --- a/doc/tethereal.pod.template +++ b/doc/tethereal.pod.template @@ -345,7 +345,36 @@ all filters and presented with one column of statistics for each filter. This option can be used multiple times on the command line. - + +B<-z> proto,colinfo,I,I + +Append all I values for the packet to the COL_INFO information line. +This feature can be used to append arbitrary fields to the COL_INFO line +in addition to the normal content of the COL_INFO line. +I is the display-filter name of a field which value should be placed +on the COL_INFO line. +I is a filter string that controls for which packets the field value +will be presented on COL_INFO line. I will only be presented on the +COL_INFO line for the packets which match I. + +NOTE: In order for I to be able to extract the I value from +the packet, I MUST be part of the I string. If not, I +will not be able to extract its value. + +For a simple example to add the "nfs.fh.hash" field to COL_INFO for all +packets containing the "nfs.fh.hash" field, use + +B<-z proto,colinfo,nfs.fh.hash,nfs.fh.hash> + + +To put "nfs.fh.hash" on COL_INFO but only for packets coming from host 1.2.3.4 +use : + +B<-z "proto,colinfo,nfs.fh.hash && ip.src==1.2.3.4,nfs.fh.hash"> + +This option can be used multiple times on the command line. + + B<-z> rpc,rtt,I,I[,I] Collect call/reply RTT data for I/I. Data collected diff --git a/tap-protocolinfo.c b/tap-protocolinfo.c new file mode 100644 index 0000000000..c750466b89 --- /dev/null +++ b/tap-protocolinfo.c @@ -0,0 +1,127 @@ +/* tap-protocolinfo.c + * protohierstat 2002 Ronnie Sahlberg + * + * $Id: tap-protocolinfo.c,v 1.1 2002/11/04 12:10:59 sahlberg Exp $ + * + * Ethereal - Network traffic analyzer + * By Gerald Combs + * Copyright 1998 Gerald Combs + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + */ + +/* This module provides Protocol Column Info tap for tethereal */ + +#ifdef HAVE_CONFIG_H +# include "config.h" +#endif + +#include + +#ifdef HAVE_SYS_TYPES_H +# include +#endif + +#include +#include "epan/epan_dissect.h" +#include "epan/column-utils.h" +#include "epan/proto.h" +#include "tap.h" +#include "register.h" + +typedef struct _pci_t { + char *filter; + int hf_index; +} pci_t; + + +static int +protocolinfo_packet(void *prs, packet_info *pinfo, epan_dissect_t *edt, void *dummy _U_) +{ + pci_t *rs=prs; + GPtrArray *gp; + guint i; + char *str; + + gp=proto_get_finfo_ptr_array(edt->tree, rs->hf_index); + if(!gp){ + return 0; + } + + for(i=0;ilen;i++){ + str=proto_alloc_dfilter_string(gp->pdata[i], NULL); + col_append_fstr(pinfo->cinfo, COL_INFO, " %s",str); + g_free(str); + } + return 0; +} + + + +static void +protocolinfo_init(char *optarg) +{ + pci_t *rs; + char *field=NULL; + char *filter=NULL; + header_field_info *hfi; + + if(!strncmp("proto,colinfo,",optarg,14)){ + filter=optarg+14; + field=strchr(filter,','); + if(field){ + field+=1; /* skip the ',' */ + } + } + if(!field){ + fprintf(stderr, "tethereal: invalid \"-z proto,colinfo,,\" argument\n"); + exit(1); + } + + hfi=proto_registrar_get_byname(field); + if(!hfi){ + fprintf(stderr, "tethereal: Field \"%s\" does not exist.\n", field); + exit(1); + } + + rs=g_malloc(sizeof(pci_t)); + rs->hf_index=hfi->id; + if((field-filter)>1){ + rs->filter=g_malloc(field-filter); + strncpy(rs->filter,filter,(field-filter)-1); + rs->filter[(field-filter)-1]=0; + } else { + rs->filter=NULL; + } + + if(register_tap_listener("frame", rs, rs->filter, NULL, protocolinfo_packet, NULL)){ + /* error, we failed to attach to the tap. clean up */ + if(rs->filter){ + g_free(rs->filter); + } + g_free(rs); + + fprintf(stderr,"tethereal: protocolinfo_init() failed to attach to tap.\n"); + exit(1); + } +} + + +void +register_tap_listener_protocolinfo(void) +{ + register_ethereal_tap("proto,colinfo,", protocolinfo_init, NULL, NULL); +} +