Commit Graph

14 Commits

Author SHA1 Message Date
Martin Kacer 42b060905e tshark JSON and Elasticsearch output
Added ouput -T for json|ek
Added -j switch fo filter EK json|ek fields.
Added -x switch to work with json|ek to insert raw fields.

Bug: 11754

Change-Id: Iad5a9092b843c074b0b774d1745fa14fca09f6b7
Reviewed-on: https://code.wireshark.org/review/15869
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-17 06:09:29 +00:00
Matthieu Coudron 68dd2c823a Display the name of the invalid field when tshark is run with -T fields
-e invalidfield

Change-Id: Iaf8733096d9e1d15510a38363397b1dcd972ff59
Reviewed-on: https://code.wireshark.org/review/10504
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-09-12 20:19:59 +00:00
Michael Mann e7fd1bfdf7 Reduce epan dependence on dissectors by having print module "cache" the protocol and field ids that it needs.
Change-Id: I4ec48067e9ca2cbe88e1cf2e6c9dc1e382379221
Reviewed-on: https://code.wireshark.org/review/7767
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-03-20 05:30:52 +00:00
Guy Harris 81ab6012fe Clean up routine names, don't pass capture_file into libwireshark.
Give all routines in epan/print.c that write a particular format a name
beginning with write_{formatname}.

If routines write columns, rather than the raw protocol tree, don't give
it a name containing proto_tree.

Get rid of empty preamble/finale routines.

For CSV, the preamble routine writes out column titles, so call it
write_csv_column_titles().

For C arrays, the body routine writes out raw hex data, so call it
write_carrays_hex_data().

capture_file isn't a structure defined by libwireshark, so don't make it
an argument passed into libwireshark.

Change-Id: I5a7e04de9382cf51a59d9d9802f815b8b3558332
Reviewed-on: https://code.wireshark.org/review/5536
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-11-29 22:44:29 +00:00
Guy Harris 741db4c751 Get rid of another global in the print code.
Pass the "output only these protocols" hash table as an argument,
instead.

Change-Id: Id8540943037e7b9bbfe377120c3f60dbe54fe0f1
Reviewed-on: https://code.wireshark.org/review/5440
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-11-22 09:07:46 +00:00
Guy Harris b19b12a85d Get rid of write_headers global variable.
Have write_psml_preamble() and write_csv_preamble() take a capture_file *
as an argument, so they can print the column titles themselves, rather
than having to defer it to the routine that prints packet data.

Change-Id: Ifd1b7a13062be8ad46846315976922a752778153
Reviewed-on: https://code.wireshark.org/review/5438
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-11-22 08:07:24 +00:00
Guy Harris 7d7fc47a2a Split the low-level print stream code into a separate file.
Put the low-level print stream code from epan/print.c into
epan/print_stream.c, leaving the higher-level stuff in print.c

Change-Id: Iae961f168ec655a29f434257b1af0937fca9f025
Reviewed-on: https://code.wireshark.org/review/5436
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-11-22 03:24:17 +00:00
Jeff Morriss 9d4af5fccd Check the validity of fields given to tshark with "-e": complain and exit if
they aren't valid.

Should help avoid confusion like that in
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10201

Bug: 10201
Change-Id: Iff7f51ae042ca1a92d1c803b6cb61aa5d81ce205
Reviewed-on: https://code.wireshark.org/review/2654
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Evan Huus <eapache@gmail.com>
2014-06-27 00:48:51 +00:00
Michael Mann e5353bf119 Use g_ alloced memory (instead of emem) when printing fields. emem shouldn't be used for GUI functions anyway.
emem was exposed because of its memory limits trying to output PDML for a very large byte field in a capture file.

When converting from proto_construct_match_selected_string to fvalue_to_string_repr remember proto_construct_match_selected_string includes fieldname + value, not just value

bug:10081
Change-Id: I4fc6ea7fd1f63cff410207c8b30562771af40ada
Reviewed-on: https://code.wireshark.org/review/1578
Reviewed-by: Evan Huus <eapache@gmail.com>
2014-05-19 01:46:55 +00:00
Evan Huus 877942c3fd Revert "Use g_ alloced memory (instead of emem) when printing fields. emem shouldn't be used for GUI functions."
It's causing a few different test failures - I've tracked down at least one of them, but the others are weirder and will require more digging.

This reverts commit 9edba650d1.

Change-Id: I897f8cf1cfbb2a189b2054e5002f59757befa47f
Reviewed-on: https://code.wireshark.org/review/1575
Reviewed-by: Evan Huus <eapache@gmail.com>
2014-05-09 15:19:59 +00:00
Michael Mann 9edba650d1 Use g_ alloced memory (instead of emem) when printing fields. emem shouldn't be used for GUI functions.
emem was exposed because of its memory limits trying to output PDML for a very large byte field in a capture file.

bug:10081
Change-Id: I6346dfdfb5f6381e16761a99291c4be7851185d9
Reviewed-on: https://code.wireshark.org/review/1566
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-05-09 04:31:10 +00:00
Alexis La Goutte 296591399f Remove all $Id$ from top of file
(Using sed : sed -i '/^ \* \$Id\$/,+1 d')

Fix manually some typo (in export_object_dicom.c and crc16-plain.c)

Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8
Reviewed-on: https://code.wireshark.org/review/497
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-04 14:27:33 +00:00
Jakub Zawadzki b75354ebe8 Avoid including <epan/epan.h> in dissectors.
svn path=/trunk/; revision=53774
2013-12-03 23:49:51 +00:00
Jeff Morriss 4dcc156cf3 Move the print modules into epan.
svn path=/trunk/; revision=50526
2013-07-12 03:50:50 +00:00