wireshark/epan/frame_data.h

130 lines
4.4 KiB
C
Raw Normal View History

/* frame_data.h
* Definitions for frame_data structures and routines
*
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
* SPDX-License-Identifier: GPL-2.0-or-later
*/
#ifndef __FRAME_DATA_H__
#define __FRAME_DATA_H__
#ifdef __cplusplus
extern "C" {
#endif /* __cplusplus */
#include <ws_diag_control.h>
#include <ws_symbol_export.h>
#include <wsutil/nstime.h>
#include <wiretap/wtap.h>
struct _packet_info;
struct epan_session;
#define PINFO_FD_VISITED(pinfo) ((pinfo)->fd->flags.visited)
/** @file
* Low-level frame data and metadata.
*/
/** @defgroup framedata Frame Data
*
* @{
*/
/** @todo XXX - some of this stuff is used only while a packet is being dissected;
should we keep that stuff in the "packet_info" structure, instead, to
save memory? */
/* Types of character encodings */
typedef enum {
PACKET_CHAR_ENC_CHAR_ASCII = 0, /* ASCII */
PACKET_CHAR_ENC_CHAR_EBCDIC = 1 /* EBCDIC */
} packet_char_enc;
/** The frame number is the ordinal number of the frame in the capture, so
it's 1-origin. In various contexts, 0 as a frame number means "frame
number unknown". */
struct _color_filter; /* Forward */
DIAG_OFF(pedantic)
typedef struct _frame_data {
GSList *pfd; /**< Per frame proto data */
guint32 num; /**< Frame number */
guint32 pkt_len; /**< Packet length */
guint32 cap_len; /**< Amount actually captured */
guint32 cum_bytes; /**< Cumulative bytes into the capture */
gint64 file_off; /**< File offset */
guint16 subnum; /**< subframe number, for protocols that require this */
gint16 tsprec; /**< Time stamp precision */
struct {
unsigned int passed_dfilter : 1; /**< 1 = display, 0 = no display */
Fix https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3315 - make Save-As/Displayed/All-Packets save not only the displayed packets but also any other packets needed (e.g., for reassembly) to fully dissect the displayed packets. This works only for the "All packets" case; choosing only the Selected packet, the Marked packets, or a range of packets would require actually storing which packets depend on which (too much memory) or going through the packet list many times (too slow). Also, this behavior is always the case: you can't save the displayed packets without their dependencies (I don't see why this would be desirable). So far this is done for SCTP and things using the reassembly routines (TCP has been tested). The Win32 dialog was modified but hasn't been tested yet. One confusing aspect of the UI is that the Displayed count in the Save-As dialog does not match the number of displayed packets. (I tried renaming the button "Displayed + Dependencies" but it looked too big.) The tooltip tries to explain this and the fact that this works only in the All-Packets case; suggestions for improvement are welcome. Implementation details: Dissectors (or the reassembly code) can list frames which were needed to build the current frame's tree. If the current frame passes the display filter then each listed frame is marked as "depended upon" (this takes up the last free frame_data flag). When performing a Save-As/Displayed/All-Packets then choose packets which passed the dfilter _or_ are depended upon. svn path=/trunk/; revision=41216
2012-02-28 03:19:49 +00:00
unsigned int dependent_of_displayed : 1; /**< 1 if a displayed frame depends on this frame */
/* Do NOT use packet_char_enc enum here: MSVC compiler does not handle an enum in a bit field properly */
unsigned int encoding : 1; /**< Character encoding (ASCII, EBCDIC...) */
unsigned int visited : 1; /**< Has this packet been visited yet? 1=Yes,0=No*/
unsigned int marked : 1; /**< 1 = marked by user, 0 = normal */
unsigned int ref_time : 1; /**< 1 = marked as a reference time frame, 0 = normal */
unsigned int ignored : 1; /**< 1 = ignore this frame, 0 = normal */
unsigned int has_ts : 1; /**< 1 = has time stamp, 0 = no time stamp */
unsigned int has_phdr_comment : 1; /** 1 = there's comment for this packet */
unsigned int has_user_comment : 1; /** 1 = user set (also deleted) comment for this packet */
unsigned int need_colorize : 1; /**< 1 = need to (re-)calculate packet color */
} flags;
const struct _color_filter *color_filter; /**< Per-packet matching color_filter_t object */
nstime_t abs_ts; /**< Absolute timestamp */
nstime_t shift_offset; /**< How much the abs_tm of the frame is shifted */
guint32 frame_ref_num; /**< Previous reference frame (0 if this is one) */
guint32 prev_dis_num; /**< Previous displayed frame (0 if first one) */
} frame_data;
DIAG_ON(pedantic)
/** compare two frame_datas */
WS_DLL_PUBLIC gint frame_data_compare(const struct epan_session *epan, const frame_data *fdata1, const frame_data *fdata2, int field);
WS_DLL_PUBLIC void frame_data_reset(frame_data *fdata);
WS_DLL_PUBLIC void frame_data_destroy(frame_data *fdata);
WS_DLL_PUBLIC void frame_data_init(frame_data *fdata, guint32 num,
const wtap_rec *rec, gint64 offset,
guint32 cum_bytes);
extern void frame_delta_abs_time(const struct epan_session *epan, const frame_data *fdata,
guint32 prev_num, nstime_t *delta);
/**
* Sets the frame data struct values before dissection.
*/
WS_DLL_PUBLIC void frame_data_set_before_dissect(frame_data *fdata,
nstime_t *elapsed_time,
const frame_data **frame_ref,
const frame_data *prev_dis);
WS_DLL_PUBLIC void frame_data_set_after_dissect(frame_data *fdata,
guint32 *cum_bytes);
/** @} */
#ifdef __cplusplus
}
#endif /* __cplusplus */
#endif /* __FRAME_DATA__ */
/*
* Editor modelines - http://www.wireshark.org/tools/modelines.html
*
* Local variables:
* c-basic-offset: 2
* tab-width: 8
* indent-tabs-mode: nil
* End:
*
* vi: set shiftwidth=2 tabstop=8 expandtab:
* :indentSize=2:tabSize=8:noTabs=true:
*/