From Deon van der Westhuysen
- Bug fix: object leak in stats_tree after a tap reset (for example apply statistics preferences with a stats_tree window open)
- Bug fix: correct sample code in README.stats_tree
- Add: slash in plug-in name now creates submenu as docs describe (was a bug?)
- Add: menu separator before the stat_tree registered plug-ins
- Add: stats_tree can now calculate averages for nodes; automatically calculated for range nodes. Add section in README.stats_tree describing averages.
- Add: stats_tree can now calculate burst rate of each node (like rate but with a shorter, sliding time window)
- Add: sorting for stats_tree plug-ins. Can sort on node name, count, average, min, max values and burst rate.
- Add: preferences for stats_tree system (default sort column, burst calc params)
- Add: stats_tree window copy to clipboard and export and plain text, csv and XML.
- Added sample of new functionality in $srcdir/plugins/stats_tree/pinfo_stats_tree.c
- Moved all stats_tree sample plug-ins to "IP Statistics" submenu.
svn path=/trunk/; revision=53657
I'm not sold on the name or module the proto_data functions live in, but I believe the function arguments are solid and gives us the most flexibility for the future. And search/replace of a function name is easy enough to do.
The big driving force for getting this in sooner rather than later is the saved memory on ethernet packets (and IP packets soon), that used to have file_scope() proto data when all it needed was packet_scope() data (technically packet_info->pool scoped), strictly for Decode As.
All dissectors that use p_add_proto_data() only for Decode As functionality have been converted to using packet_scope(). All other dissectors were converted to using file_scope() which was the original scope for "proto" data.
svn path=/trunk/; revision=53520
no val_to_string_repr method, we don't need to check whether it has such
a method, and thus don't need to include epan/ftypes/ftypes-int.h.
svn path=/trunk/; revision=53293
Now that "bytes consumed" can be determined, should tcp_dissect_pdus() take advantage of that?
Should tcp_dissect_pdus return length (bytes consumed)? There are many dissectors that just call tcp_dissect_pdus() then return tvb_length(tvb). Seems like that could all be rolled into one.
svn path=/trunk/; revision=53198
All "generated" source was manually modified (with the power of search/replace), but I believe the "source input" files have been adjusted (checked into revs 53098 and 53099) to reflect the necessary changes (with possible whitespace formatting differences).
The Microsoft compiler doesn't flag "unused function parameters", so I apologize in advance if I may have missed a few. The "dcerpc_info* di" parameter is used in almost every function.
svn path=/trunk/; revision=53100
If it's used by a third-party plugin, please submit a patch that passes the ETHERCAT_MBOX_HEADER structure through the data parameter of the "new" style dissector function.
svn path=/trunk/; revision=53094
- when the text parameter is constant col_add_str() and col_set_str() are equivalent but col_set_str() is faster.
- same for replace col_append_fstr and col_append_str
- remove col_clear() when it's redundant:
+ before a col_set/col_add if the dissector can't throw an exception.
- replace col_append() after a col_clear() with faster col_add... or col_set
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9344
svn path=/trunk/; revision=52948
convert all existing UAT update callbacks to use glib memory instead of
ephemeral memory for that string.
UAT code paths are entirely distinct from packet dissection, so using ephemeral
memory was the wrong choice, because there was no guarantees about when it would
be freed.
The move away from emem still needs to be propogated deeper into the UAT code
itself at some point.
Net effect: remove another bunch of emem calls from dissectors, where replacing
with wmem would have caused assertions.
svn path=/trunk/; revision=52854
Not sure which memory allocation should be used here (using wmem caused crash), but this revision can at least be easily backported to 1.10 where the bug was reported.
Also allow a single number to be used in the stats range since it's considered a valid "range" by the UAT.
svn path=/trunk/; revision=52679
2. Converted several add_protocol_subtree calls to add_tlv_subtree to get true filterability. Many of the add_protocol_subtree are effectively being (ab)used as proto_tree_add_text with different highlighting.
3. Convert tvb_new_subset into tvb_new_subset_length.
Still looks like some of the remaining "protocols" need more specific filters, and should just be regular FT_BYTES fields.
svn path=/trunk/; revision=52235
I want to follow up with some massive cleanup (remove PITEM_FINFO calls), but this with r52208 should be good enough to backport to 1.8 and 1.10 to fix bug 5349. Cleanup shouldn't need to be backported.
svn path=/trunk/; revision=52209
of the if (tree) tests in dissect_mac_header_generic_decoder(), as some
of the stuff done inside there should be done even if we're not building
a protocol tree, e.g. CRC stuff and calling subdissectors.
Get rid of a gratuitous pair of curly braces, and fix the indentation of
one line, while we're at it.
svn path=/trunk/; revision=52208
they're not being used, the compiler can be made to warn about that.
In this case, Broadcast_Control_Pointer_IE() was used because of a
missing case in a switch statement; put that case in.
svn path=/trunk/; revision=52204
1. Remove message type field from all MAC Management "sub"dissectors and place it in Mac Management subdissector itself. This may cause backwards-compatibility issues (malformed packets) with third-party subdissectors of the MAC Management dissector, but it didn't make sense to have so many filters for a single enumerated value, especially when the various "protocol" filters covers many of them.
2. Removed some if(tree) checks as column info and calling other dissectors are sometimes executed underneath. Some of this is in preparation for addressing bug 5349.
3. Make all dissector functions (and a few others) static, and use register_dissector() when necessary.
4. Convert generic decoder CRC errors into expert info, rather than have it be a "protocol" filter (it just looks funny that way)
In general, these dissectors seem "over-protocolized". I understand the need for all of the dissectors, but I don't know if they all need "protocol" status.
svn path=/trunk/; revision=52203
Chris Maynard