The reassembled fragments tree in the Packet Details view is awesome, but it
lacks one thing: a field that exposes the reassembled data.
tcp.data already exists for exposing a single TCP segment's payload as a byte
array. It would be handy to have something similar for a single application
layer PDU when TCP segment reassembly is involved. I propose
tcp.reassembled.data, named and placed after the already existing field
tcp.reassembled.length.
My primary use case for this feature is outputting tcp.reassembled.data with
tshark for further processing with a script.
The attached patch implements this very feature. Because the reassembled
fragment tree code is general purpose, i.e. not specific to just TCP, any
dissector that relies upon it can add a similar field very cheaply. In that
vein I've also implemented ip.reassembled.data and ipv6.reassembled.data, which
expose reassembled fragment data as a single byte stream for IPv4 and IPv6,
respectively. All other protocols that use the reassembly code have been left
alone, other than inserting NULL into their initializer lists for the newly
introduced struct field reassemble.h:fragment_items.hf_reassembled_data.
svn path=/trunk/; revision=44802
Also (for a few files):
- create/use some extended value strings;
- remove unneeded #include files;
- remove unneeded variable initialization;
- re-order fcns slightly so prefs_reg_handoff...() at end, etc
svn path=/trunk/; revision=44438
Specifically: Replace FALSE|0 and TRUE|1 by ENC_BIG_ENDIAN|ENC_LITTLE_ENDIAN as
the encoding parameter for proto_tree_add_item() calls which directly reference
an item in hf[] which has a type of:
FT_BOOLEAN
FT_IPv4
FT_EUI64
FT_GUID
FT_UINT_STRING
Also: For type FT_ITv6 use ENC_NA. (This was missed in SVN #39260)
svn path=/trunk/; revision=39328
Specifically: Replace FALSE|0 and TRUE|1 by ENC_BIG_ENDIAN|ENC_LITTLE_ENDIAN as
the encoding parameter for proto_tree_add_item() calls which directly reference
an item in hf[] which has a type of:
FT_UINT8
FT_UINT16
FT_UINT24
FT_UINT32
FT_UINT64
FT_INT8
FT_INT16
FT_INT24
FT_INT32
FT_INT64
FT_FLOAT
FT_DOUBLE
svn path=/trunk/; revision=39288
FT_NONE
FT_BYTES
FT_IPV6
FT_IPXNET
FT_OID
Note: Encoding field set to ENC_NA only if the field was previously TRUE|FALSE|ENC_LITTLE_ENDIAN|ENC_BIG_ENDIAN
svn path=/trunk/; revision=39260
keys to have _uint in their names, to match the routines that handle
dissector tables with string keys. (Using _port can confuse people into
thinking they're intended solely for use with TCP/UDP/etc. ports when,
in fact, they work better for things such as Ethernet types, where the
binding of particular values to particular protocols are a lot
stronger.)
svn path=/trunk/; revision=35224
ABSOLUTE_TIME_LOCAL or ABSOLUTE_TIME_UTC, indicating whether to display
the date/time in local time or UTC. (int)ABSOLUTE_TIME_LOCAL ==
(int)BASE_NONE, so there's no source or binary compatiblity issue,
although we might want to eliminate BASE_NONE at some point and have the
BASE_ values used with integral types start at 0, so that you can't
specify BASE_NONE for an integral field.
svn path=/trunk/; revision=31319
Add the missing ndmp v4 messages, namely the:
NDMP_CONFIG_GET_EXT_LIST
NDMP_CONFIG_SET_EXT_LIST
This may serve as the 1st step into actual extensions (Snapvault etc)
dissector implementation.
svn path=/trunk/; revision=30684
1. Prevent tcpencap (ipsec-tcp) from incorrectly dissecting NDMP PDU fragments;
(Essentially: register NDMP as the dissector for the conversation);
Allows correct NDMP fragment reassembly whether or not the
TCP "Try heuristic sub-dissectors first" preference is enabled.
Fixes Bug #3755 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3755)
2. Use a registered init routine to init the fragment and reassembled tables
each time a complete capture dissection is (re)started.
Fixes a crash.
3. Don't register on TCP port 10000 since the tcpencap dissector needs to own this
port. (The NDMP dissector is a heuristic dissector).
4. Strengthen the heuristic checking slightly.
5. Other minor changes.
svn path=/trunk/; revision=29208
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
make ndmp a heuristic dissector so it will "win" over tcp esp if the
packets look like ndmp and if "preferences/tcp/heuristic dissectors
first has been
chosen"
svn path=/trunk/; revision=23006
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=552
by enforcing that header fields have names of length > 0. This should fix
the display of those fields and also make them filterable (which was the
subject of the bug). Abbreviations are (still) optional: if they are empty
then the field is not filterable.
Update README.developer with this information.
Add header field names in several dissectors where they were missing.
In packet-arp.c give "packet-storm-detected" a name (as above) but also set it
as _GENERATED.
Also remove trailing white space from all the files checked in.
svn path=/trunk/; revision=21018
there are many reasons why some protocols actually need to be able to access the pinfo structure while determining the pdu size
svn path=/trunk/; revision=19751
this fixes a regression caused by the recent scsi data in/out reassembly code which made the scsi dissector fail to dissect data in/out over ndmp correctly if scsi reassembly was enabled
svn path=/trunk/; revision=19525
and also (if reassembly is disabled) only dissect the initial (offset==0) data pdu.
dissect_scsi_payload() does not yet use this parameter.
now that we have both data offset and expected data length/bidir expected data length and also the read/write flags availabe we have what we need to reassemble data in/out pdus (modulo overflow/underflow but those are so rare we can worry about them later).
ndmp: ndmp conceptually always has a data in and a data out phase and never fragment the data into smaller pdu's os that dissector always report offset as 0.
svn path=/trunk/; revision=19511
pass conversation form the transports up to the scsi layer
add tracking of conversation specific info to scsi osd
add tracking of conversation+lun specific info to scsi osd
for scsi osd add tracking of PARTITIONS and display in which frame they were created/removed
svn path=/trunk/; revision=19505
so that the two scsi transports FCP and ISCSI can provide the expected data transfer lengths to SCSI to allow SCSI reassembly.
NDMP does not really need these hints since for NDMP (and also iscsi-lite) there is conceptually always both data in and data out phases and there is never any fragmentation.
svn path=/trunk/; revision=19493
Jeff Morriss