osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

Netflow: add (hidden) root filters for each vendor with supported 'pie' entries 

Change-Id: I2bdca4c092c247ab253d6ceb3770ac7ea935cdad
Reviewed-on: https://code.wireshark.org/review/6414
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
This commit is contained in:
Martin Mathieson 2015-01-08 16:08:06 +00:00
parent 8bfd306a27
commit c94192d5e6
1 changed files with 69 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

70
epan/dissectors/packet-netflow.c
View File

@ -119,7 +119,6 @@
*/
#include "config.h"
#include <epan/packet.h>
#include <epan/prefs.h>
#include <epan/ipproto.h>
@ -1653,6 +1652,7 @@ static int hf_ipfix_enterprise_private_entry = -1;
/* pie = private information element */
static int hf_pie_cace = -1;
static int hf_pie_cace_local_ipv4_address = -1;
static int hf_pie_cace_remote_ipv4_address = -1;
static int hf_pie_cace_local_ipv6_address = -1;
@ -1668,6 +1668,7 @@ static int hf_pie_cace_local_username = -1;
static int hf_pie_cace_local_cmd_len = -1;
static int hf_pie_cace_local_cmd = -1;
static int hf_pie_ntop = -1;
static int hf_pie_ntop_fragmented = -1;
static int hf_pie_ntop_fingerprint = -1;
static int hf_pie_ntop_client_nw_delay_sec = -1;
@ -1733,6 +1734,7 @@ static int hf_pie_ntop_mysql_db = -1;
static int hf_pie_ntop_mysql_query = -1;
static int hf_pie_ntop_mysql_response = -1;
static int hf_pie_plixer = -1;
static int hf_pie_plixer_client_ip_v4 = -1;
static int hf_pie_plixer_client_hostname = -1; /* string */
static int hf_pie_plixer_partner_name = -1; /* string */
@ -1753,6 +1755,7 @@ static int hf_pie_plixer_message_subject = -1; /* string */
static int hf_pie_plixer_sender_address = -1; /* string */
static int hf_pie_plixer_date_time = -1;
static int hf_pie_ixia = -1;
static int hf_pie_ixia_l7_application_id = -1;
static int hf_pie_ixia_l7_application_name = -1;
static int hf_pie_ixia_source_ip_country_code = -1;
@ -2833,6 +2836,11 @@ dissect_v9_v10_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
v9_v10_tmplt_entry_t *entries_p;
proto_tree *fwdstattree;
gboolean cace_pie_seen = FALSE,
plixer_pie_seen = FALSE,
ntop_pie_seen = FALSE,
ixia_pie_seen = FALSE;
entries_p = tmplt_p->fields_p[fields_type];
if (entries_p == NULL) {
/* I don't think we can actually hit this condition.
@ -2907,6 +2915,41 @@ dissect_v9_v10_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
}
}
/* Provide a convenient (hidden) filter for any items belonging to a known PIE,
but take care not to add > once. */
switch (pen) {
case VENDOR_CACE:
if (!cace_pie_seen) {
proto_item *pie_cace_ti = proto_tree_add_item(pdutree, hf_pie_cace, tvb, 0, 0, ENC_NA);
PROTO_ITEM_SET_HIDDEN(pie_cace_ti);
cace_pie_seen = TRUE;
}
break;
case VENDOR_PLIXER:
if (!plixer_pie_seen) {
proto_item *pie_plixer_ti = proto_tree_add_item(pdutree, hf_pie_plixer, tvb, 0, 0, ENC_NA);
PROTO_ITEM_SET_HIDDEN(pie_plixer_ti);
plixer_pie_seen = TRUE;
}
break;
case VENDOR_NTOP:
if (!ntop_pie_seen) {
proto_item *pie_ntop_ti = proto_tree_add_item(pdutree, hf_pie_ntop, tvb, 0, 0, ENC_NA);
PROTO_ITEM_SET_HIDDEN(pie_ntop_ti);
ntop_pie_seen = TRUE;
}
break;
case VENDOR_IXIA:
if (!ixia_pie_seen) {
proto_item *pie_ixia_ti = proto_tree_add_item(pdutree, hf_pie_ixia, tvb, 0, 0, ENC_NA);
PROTO_ITEM_SET_HIDDEN(pie_ixia_ti);
ixia_pie_seen = TRUE;
}
break;
default:
break;
}
ti = NULL;
switch (pen_type) {
@ -9058,6 +9101,12 @@ proto_register_netflow(void)
},
/* Private Information Elements */
/* CACE root (a hidden item to allow filtering) */
{&hf_pie_cace,
{"CACE", "cflow.pie.cace",
FT_NONE, BASE_NONE, NULL, 0x0,
NULL, HFILL}
},
/* CACE Technologies, 32622 / 0 */
{&hf_pie_cace_local_ipv4_address,
{"Local IPv4 Address", "cflow.pie.cace.localaddr4",
@ -9142,6 +9191,13 @@ proto_register_netflow(void)
FT_STRING, STR_ASCII, NULL, 0x0,
"Local Command (caceLocalProcessCommand)", HFILL}
},
/* ntop root (a hidden item to allow filtering) */
{&hf_pie_ntop,
{"Ntop", "cflow.pie.ntop",
FT_NONE, BASE_NONE, NULL, 0x0,
NULL, HFILL}
},
/* ntop, 35632 / 80 */
{&hf_pie_ntop_fragmented,
{"Fragmented", "cflow.pie.ntop.fragmented",
@ -9510,6 +9566,12 @@ proto_register_netflow(void)
NULL, HFILL}
},
/* Plixer root (a hidden item to allow filtering) */
{&hf_pie_plixer,
{"Plixer", "cflow.pie.plixer",
FT_NONE, BASE_NONE, NULL, 0x0,
NULL, HFILL}
},
/* plixer, 13745 / 100 */
{&hf_pie_plixer_client_ip_v4,
{"client_ip_v4", "cflow.pie.plixer.client.ip_v4",
@ -9619,6 +9681,12 @@ proto_register_netflow(void)
NULL, HFILL}
},
/* Ixia root (a hidden item to allow filtering) */
{&hf_pie_ixia,
{"Ixia", "cflow.pie.ixia",
FT_NONE, BASE_NONE, NULL, 0x0,
NULL, HFILL}
},
/* ixia, 3054 / 110 */
{&hf_pie_ixia_l7_application_id,
{"L7 Application ID", "cflow.pie.ixia.l7-application-id",