Fix for bug #491: Unexpected frame.time_delta behavior
This patch ... fixes bug 491. It does this by changing the
behaviour of the frame.time_delta field so it reflects the delta
time between captured packets (tshark already did this). To keep
the delta time between displayed packets, the field
frame.time_delta_displayed is created.
svn path=/trunk/; revision=21154
by myself:
Corrected patch; epan/column.c and epan/column_utils.c were not included. This
one has now been properly tested against a clean checkout of today's code.
- New menu option available under view\time display format
- New sub-option (e) to -t switch for both wireshark and tshark
- Extended recent settings code to handle new value
- Did NOT add new explicit epoch time column
svn path=/trunk/; revision=20040
This patch consists also the last issues. Additionally it solves:
- For the SSCOP frames the AAL5 decoding was not performed due to an earlier patch. This caused that no SSCOP message was properly decoded.
- As the detection between a LANE frame and a SSCOP frame is rather hard a switch within the atm dissector is included which enforce SSCOP dissecting over a LANE frame. At the moment I do not see a better solution for that.
svn path=/trunk/; revision=20013
start introducing conversations to the usb dissector so that we can start tracking requests/responses
which we need to in order to dissect for example the data returned by a device to a GET DESCRIPTORS call
svn path=/trunk/; revision=19539
instead of calling the tcp analysis (and prepend colingo) eitehr after the subdissector returned normally or if an exception caused by a subdissector was rised.
this as a sideffect caused tcp analysis data to be overwritten if the subdissector caused any output to the info column. (and made tcp analysis suboptimal)
this change adds a new function col_prepend_fence_fstr() that will prepend
the info column with the string and also, if there was no fence already defined, create a fence and set it after the prepended col info text.
This way, even if the subdissectors generate and rewrite col info, the tcp analysis data will still be displayed on the info column.
svn path=/trunk/; revision=16116
- automatic adjustment depending on file format
- manual adjustment through menu items
save the setting in the recent file
svn path=/trunk/; revision=15534
I've done more than a day to change the timestamp resolution from microseconds to nanoseconds. As I really don't want to loose those changes, I'm going to check in the changes I've done so far. Hopefully someone else will give me a helping hand with the things left ...
What's done: I've changed the timestamp resolution from usec to nsec in almost any place in the sources. I've changed parts of the implementation in nstime.s/.h and a lot of places elsewhere.
As I don't understand the editcap source (well, I'm maybe just too tired right now), hopefully someone else might be able to fix this soon.
Doing all those changes, we get native nanosecond timestamp resolution in Ethereal. After fixing all the remaining issues, I'll take a look how to display this in a convenient way...
As I've also changed the wiretap timestamp resolution from usec to nsec we might want to change the wiretap version number...
svn path=/trunk/; revision=15520
-use g_snprintf instead of sprintf and snprintf
-use g_strdup_printf where appropriate
-remove #include "snprintf.h" (as only g_snprintf should be used)
-replace some more alloc/realloc/calloc/free with their glib pendants
svn path=/trunk/; revision=15264
This is extremely useful, to keep track of the corresponding request/response packets of a DCE/RPC call (which can be quite a lot packets if fragmentation is used).
svn path=/trunk/; revision=14826
changed the behaviour of get_addr_name:
- resolve to a name if the address supports it
- call address_to_str if it does not, but the address is valid
- return "NONE" if it is AT_NONE
svn path=/trunk/; revision=13463
array of "const char *" rather than to an array of "char *", and make
the second argument of "col_set_str()" a "const char *" - there's no
guarantee that "col_data" points to something you're allowed to modify.
svn path=/trunk/; revision=12875
to resolve it to a name.
Fix up some const-pointer-to-non-const-pointer, and
function-pointer-to-void-*, conversions.
Fix some comments.
svn path=/trunk/; revision=12863
rather than "col_buf", so that we correctly handle a column set with
"col_set_str()" (where we set "col_data" to point to the string, and
leave "col_buf" alone).
svn path=/trunk/; revision=11818
include of <resolv.h> in any system header file gets the system
<resolv.h> (needed for builds on Tru64 with GTK+ 1.2[.x]).
svn path=/trunk/; revision=11615
they have LF at the end of the line on UN*X and CR/LF on Windows;
hopefully this means that if a CR/LF version is checked in on Windows,
the CRs will be stripped so that they show up only when checked out on
Windows, not on UN*X.
svn path=/trunk/; revision=11400
support the ISUP CIC as a circuit ID;
add a preference option to control whether to put the CIC into
the Info column or not.
svn path=/trunk/; revision=10265
menuitems under "View->Time Display Format".
renamed timestamp enum items e.g. from ABSOLUTE to TS_ABSOLUTE,
to prevent conflicting definitions with MSVC
svn path=/trunk/; revision=9729
captures, as it has to compute the width of an auto-resizing column in
every row. Just pick fixed widths for the columns (and tune the width
of the "Protocol" column so that it's not narrower than the column
title).
svn path=/trunk/; revision=9219
last columns, if any, with that format, and use that to speed up
processing of columns with a particular format and checking whether
we're displaying a column with a particular format.
svn path=/trunk/; revision=9147
One can now select a packet and mark it as a TimeReference packet using the menu.
A TimeReference packet will be indicated by having all timestamp related column entries replaced by the string *REF*
A TimeReference packet will always be displayed in the packet pane, and overrides any display filters.
When a frame is a TimeReference frame, all later frames will calculate the TimeRelativeToFirstPacket relative to the timestamp of the TimeReference frame instead of the first frame of the capture.
You can have any number of TimeReference frames you like.
svn path=/trunk/; revision=8459
Ethereal presents a column to display culmulative bytes into the capture.
A new column type is added : Culmulative Bytes.
While PacketLength column type specifies the number of bytes in the current packet,
Culmulative Bytes specifies the culmulative number of bytes from the start of the capture.
svn path=/trunk/; revision=8359
expression information if the address type is AT_NONE -
"address_to_str_buf()" panics if passed an AT_NONE address, as there's
nothing sensible one can do with them. (A null string wouldn't be
appropriate here, as a dissector might have set the address columns to a
string.)
svn path=/trunk/; revision=8269
which fills in a caller-supplied buffer.
Create "_buf()" versions of various "to_str" routines for various
address types, and create a routine to map SNA FIDs to strings, and use
them to finish up "address_to_str_buf()".
Get rid of the declaration of "sna_fid_type_4_addr_to_str()" in
"packet-sna.h", as that routine has been swallowed up in
"sna_fid_to_str()".
svn path=/trunk/; revision=8260
to "protect" what's currently in the column, so that attempts to clear
the column will only clear stuff after the fence and attempts to
overwrite the column will append stuff after the fence. This, for
example, allows a dissector to arrange that the Info column contain
information for its protocol and for protocols running atop it.
svn path=/trunk/; revision=7466
multi-byte integral quantities and blithely dereference them, lest thou
enrage those of us who work on machines that trap on unaligned
references.
svn path=/trunk/; revision=7021
- A new decoder called MDSHDR which decodes the internal header of the
Cisco MDS switch (this is different from the Boardwalk header).
- Support for some more new columns as part of FC support.
- Fixed the decoding of the Special Frame in FCIP.
- Fixed the decoding of credit management type field in FLOGI/PLOGI frame
in FC-ELS.
svn path=/trunk/; revision=6974
channel number, X.25 logical channel number).
Clean up white space and the like, and get rid of unnecessary arguments
to "col_set_port()".
svn path=/trunk/; revision=6772
item to look more-or-less like a PPP packet, just dissect it in place
and hand off to the appropriate subdissector using the PPP dissector's
handoff table (which we export, along with its value_string table for
protocol IDs, which we use to report the protocol ID symbolically).
This means there's no point in having a configurable option to control
whether to do that tweaking; make it an obsolete option.
Bring "col_get_writable()" back from the dead, and have the GTP
dissector save the current "writable" flag for columns, mark the columns
non-writable before calling the subdissector for the PPP configuration
protocol, and restore the state of the writable flag, rather than
putting the columns back after the PPP configuration protocol's
dissector is done.
Fix some more typos in comments.
Don't register the IP dissector in the "ppp.protocol" table in the GTP
dissector's handoff registration routine - it's already being done in
the IP dissector's handoff routine.
Fix the name for CHAP to match what RFC 1994 calls it (if the name
changed, it should be changed in all places, but, at least according to
this message, a while ago, from Bob Sutterfield, "since the RFC defines
the protocol, the RFC defines the name":
http://mail-index.netbsd.org/netbsd-help/1996/05/16/0011.html
and the RFC defines the name as "PPP Challenge Handshake Authentication
Protocol (CHAP)").
svn path=/trunk/; revision=6617
generating a filter expression to match the address, so it's parsed
correctly (as a hex number rather than a string) if there are
non-decimal digits (A through F).
svn path=/trunk/; revision=6481
"pinfo->srcport", and "pinfo->destport" appropriately in the IPX
dissector. Add support for PT_IPX port types in display columns.
Have an "spx.socket" dissector table, similar to the "ipx.socket"
dissector table, and have the SPX dissector use that, with the IPX
socket numbers from "pinfo->srcport" and "pinfo->destport", so that
dissectors for protocols that run atop SPX can register with particular
socket numbers. (Think of it as similar to what would have been the
case had the IP header had 16-bit source and destination port numbers,
and had TCP and UDP used those port numbers rather than having port
numbers in their headers.) Also, have the SPX dissector dissect
subprotocols regardless of whether we're building a protocol tree or not.
Use the dissector handle for the IPX message dissector for both IPX
socket numbers; there's no need to create separate handles for both
registrations.
Have NDPS register as a subdissector of the SPX dissector, using
"spx.socket", and get rid of the duplicate SPX dissection in the NDPS
dissector.
Make the NDPS dissector set the columns regardless of whether a protocol
tree is being built, and clean up the dissector (fixing some bugs).
Get rid of unneeded includes in "packet-ndps.c".
svn path=/trunk/; revision=6424
equivalents for the epan/ directory but leave winsock2.h in inet_pton.c
and inet_ntop.c for now (can't estimate the consequences).
svn path=/trunk/; revision=5928
Add Zone Information Protocol support.
Rename "ddp.dst.socket" and "ddp.src.socket" to "ddp.dst_socket"
and "ddp.src_socket", as the socket number is no longer
considered part of the DDP address.
svn path=/trunk/; revision=5800
Support for generating filter expressions based on packet list
column values
Support for adding filter expressions generated from column or
protocol tree field values to the current expression rather
than replacing the current expression
svn path=/trunk/; revision=4522
structure to the "packet_info" structure; only stuff that's permanently
stored with each frame should be in the "frame_data" structure, and the
"column_info" structure is not guaranteed to hold the column values for
that frame at all times - it was only in the "frame_data" structure so
that it could be passed to dissectors, and, as all dissectors are now
passed a pointer to a "packet_info" structure, it could just as well be
put in the "packet_info" structure.
That saves memory, by shrinking the "frame_data" structure (there's one
of those per frame), and also lets us clean up the code a bit.
svn path=/trunk/; revision=4370
access their own "pinfo". A packet_info is stored in epan_dissect_t,
which is created for the dissection of a single packet.
GUI functions which need to access the packet_info of the currently
selected packet used to use "pi"; now they use cfile.edt->pi. cfile's
"edt" member is the epan_dissect_t of the currently-selected packet.
The functionality of blank_packetinfo() was moved into
dissect_packet(), as that's the only place that called blank_packetinfo(),
after a spurious call to blank_packetinfo() was removed from
packet_list_select_cb().
svn path=/trunk/; revision=4246
"value_string.c", as they include "epan/to_str.h", and that uses "struct
timeval" in some function prototypes.
In "to_str.c", include <sys/types.h> before including <netinet/in.h>; on
at least some platforms, definitions in <netinet/in.h> require types
defined in <sys/types.h>.
In "to_str.c", include <sys/socket.h>, so that AF_INET6 is defined.
svn path=/trunk/; revision=3238
Ulf Lamping