2001-04-01 04:50:42 +00:00
|
|
|
/* packet_info.h
|
|
|
|
* Definitions for packet info structures and routines
|
|
|
|
*
|
2004-07-18 00:24:25 +00:00
|
|
|
* $Id$
|
2001-04-01 04:50:42 +00:00
|
|
|
*
|
2006-05-21 05:12:17 +00:00
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
2001-04-01 04:50:42 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
2002-08-28 20:41:00 +00:00
|
|
|
*
|
2001-04-01 04:50:42 +00:00
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 20:41:00 +00:00
|
|
|
*
|
2001-04-01 04:50:42 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 20:41:00 +00:00
|
|
|
*
|
2001-04-01 04:50:42 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef __PACKET_INFO_H__
|
|
|
|
#define __PACKET_INFO_H__
|
|
|
|
|
|
|
|
#include "frame_data.h"
|
|
|
|
#include "tvbuff.h"
|
2004-07-19 02:27:17 +00:00
|
|
|
#include "address.h"
|
2002-10-22 08:22:07 +00:00
|
|
|
|
2001-04-01 04:50:42 +00:00
|
|
|
#define P2P_DIR_UNKNOWN -1
|
|
|
|
#define P2P_DIR_SENT 0
|
|
|
|
#define P2P_DIR_RECV 1
|
|
|
|
|
2003-10-30 02:06:13 +00:00
|
|
|
#define PINFO_SOF_FIRST_FRAME 0x1
|
|
|
|
#define PINFO_SOF_SOFF 0x2
|
|
|
|
#define PINFO_EOF_LAST_FRAME 0x80
|
|
|
|
#define PINFO_EOF_INVALID 0x40
|
2004-09-06 15:04:27 +00:00
|
|
|
#define MAX_NUMBER_OF_PPIDS 2
|
2003-10-30 02:06:13 +00:00
|
|
|
|
2001-04-01 04:50:42 +00:00
|
|
|
typedef struct _packet_info {
|
|
|
|
const char *current_proto; /* name of protocol currently being dissected */
|
2001-12-10 00:26:21 +00:00
|
|
|
column_info *cinfo; /* Column formatting information */
|
2001-04-01 04:50:42 +00:00
|
|
|
frame_data *fd;
|
|
|
|
union wtap_pseudo_header *pseudo_header;
|
2002-06-04 07:03:57 +00:00
|
|
|
GSList *data_src; /* Frame data sources */
|
2001-04-01 04:50:42 +00:00
|
|
|
address dl_src; /* link-layer source address */
|
|
|
|
address dl_dst; /* link-layer destination address */
|
|
|
|
address net_src; /* network-layer source address */
|
|
|
|
address net_dst; /* network-layer destination address */
|
|
|
|
address src; /* source address (net if present, DL otherwise )*/
|
|
|
|
address dst; /* destination address (net if present, DL otherwise )*/
|
|
|
|
guint32 ethertype; /* Ethernet Type Code, if this is an Ethernet packet */
|
|
|
|
guint32 ipproto; /* IP protocol, if this is an IP packet */
|
|
|
|
guint32 ipxptype; /* IPX packet type, if this is an IPX packet */
|
2002-10-22 08:22:07 +00:00
|
|
|
circuit_type ctype; /* type of circuit, for protocols with a VC identifier */
|
|
|
|
guint32 circuit_id; /* circuit ID, for protocols with a VC identifier */
|
2005-07-23 11:41:25 +00:00
|
|
|
const char *noreassembly_reason; /* reason why reassembly wasn't done, if any */
|
2001-04-01 04:50:42 +00:00
|
|
|
gboolean fragmented; /* TRUE if the protocol is only a fragment */
|
Have a flag in the "packet_info" structure, which indicates whether the
stuff currently being dissected is part of a packet included in an error
packet (e.g., an ICMP Unreachable packet). Have the TCP dissector not
bother doing reassembly if the TCP segment is part of an error packet,
rather than an actual TCP transmission; other dissectors might want to
treat those packets specially as well.
Add to the "tcpinfo" structure a flag indicating whether the URG flag
was set, rather than having the zero or non-zero value of the urgent
pointer indicate that. (Yes, at least as I read RFC 793, a zero urgent
pointer value isn't useful, as it means "the stuff before this segment
is urgent", but it's certainly possible to put onto the wire a TCP
segment with URG set and a zero urgent pointer.)
Don't dissect the TCP header by grabbing the entire header with
"tvb_memcpy()" and then pulling stuff out of it - extract stuff with
individual tvbuff calls, and put stuff into the protocol tree and the
Info column as we extract it, so that we can dissect a partial header.
This lets us, for example, get the source and destination ports from the
TCP header of the part of a TCP segment included in a minimum-length
ICMPv4 error packet.
svn path=/trunk/; revision=3986
2001-10-01 08:29:37 +00:00
|
|
|
gboolean in_error_pkt; /* TRUE if we're inside an {ICMP,CLNP,...} error packet */
|
2001-04-01 04:50:42 +00:00
|
|
|
port_type ptype; /* type of the following two port numbers */
|
|
|
|
guint32 srcport; /* source port */
|
|
|
|
guint32 destport; /* destination port */
|
2008-03-10 17:33:53 +00:00
|
|
|
guint32 match_port; /* matched port for calling subdissector from table */
|
|
|
|
const char *match_string; /* matched string for calling subdissector from table */
|
2001-11-29 09:05:25 +00:00
|
|
|
guint16 can_desegment; /* >0 if this segment could be desegmented.
|
2003-12-29 22:44:50 +00:00
|
|
|
A dissector that can offer this API (e.g.
|
|
|
|
TCP) sets can_desegment=2, then
|
|
|
|
can_desegment is decremented by 1 each time
|
|
|
|
we pass to the next subdissector. Thus only
|
|
|
|
the dissector immediately above the
|
|
|
|
protocol which sets the flag can use it*/
|
|
|
|
guint16 saved_can_desegment; /* Value of can_desegment before current
|
|
|
|
dissector was called. Supplied so that
|
|
|
|
dissectors for proxy protocols such as
|
|
|
|
SOCKS can restore it, allowing the
|
|
|
|
dissectors that they call to use the
|
|
|
|
TCP dissector's desegmentation (SOCKS
|
|
|
|
just retransmits TCP segments once it's
|
|
|
|
finished setting things up, so the TCP
|
|
|
|
desegmentor can desegment its payload). */
|
2003-04-23 10:20:29 +00:00
|
|
|
int desegment_offset; /* offset to stuff needing desegmentation */
|
2006-09-10 14:03:08 +00:00
|
|
|
#define DESEGMENT_ONE_MORE_SEGMENT 0x0fffffff
|
|
|
|
#define DESEGMENT_UNTIL_FIN 0x0ffffffe
|
|
|
|
guint32 desegment_len; /* requested desegmentation additional length
|
|
|
|
or
|
|
|
|
DESEGMENT_ONE_MORE_SEGMENT:
|
|
|
|
Desegment one more full segment
|
2006-11-07 13:19:31 +00:00
|
|
|
(warning! only partially implemented)
|
2006-09-10 14:03:08 +00:00
|
|
|
DESEGMENT_UNTIL_FIN:
|
|
|
|
Desgment all data for this tcp session
|
|
|
|
until the FIN segment.
|
|
|
|
*/
|
2003-04-23 10:20:29 +00:00
|
|
|
guint16 want_pdu_tracking; /* >0 if the subdissector has specified
|
|
|
|
a value in 'bytes_until_next_pdu'.
|
|
|
|
When a dissector detects that the next PDU
|
2005-01-19 04:49:29 +00:00
|
|
|
will start beyond the start of the next
|
|
|
|
segment, it can set this value to 2
|
|
|
|
and 'bytes_until_next_pdu' to the number of
|
|
|
|
bytes beyond the next segment where the
|
2003-04-23 10:20:29 +00:00
|
|
|
next PDU starts.
|
|
|
|
|
2005-01-19 04:49:29 +00:00
|
|
|
If the protocol dissector below this
|
2003-04-23 10:20:29 +00:00
|
|
|
one is capable of PDU tracking it can
|
|
|
|
use this hint to detect PDUs that starts
|
|
|
|
unaligned to the segment boundaries.
|
|
|
|
The TCP dissector is using this hint from
|
|
|
|
(some) protocols to detect when a new PDU
|
|
|
|
starts in the middle of a tcp segment.
|
|
|
|
|
2005-01-19 04:49:29 +00:00
|
|
|
There is intelligence in the glue between
|
2003-04-23 10:20:29 +00:00
|
|
|
dissector layers to make sure that this
|
|
|
|
request is only passed down to the protocol
|
|
|
|
immediately below the current one and not
|
|
|
|
any further.
|
|
|
|
*/
|
|
|
|
guint32 bytes_until_next_pdu;
|
|
|
|
|
2005-01-19 04:49:29 +00:00
|
|
|
|
2008-03-10 17:33:53 +00:00
|
|
|
int iplen; /* total length of IP packet */
|
|
|
|
int iphdrlen; /* length of IP header */
|
2005-06-03 06:35:44 +00:00
|
|
|
int p2p_dir; /* Packet was captured as an
|
|
|
|
outbound (P2P_DIR_SENT)
|
|
|
|
inbound (P2P_DIR_RECV)
|
|
|
|
unknown (P2P_DIR_UNKNOWN) */
|
2002-12-08 02:32:36 +00:00
|
|
|
guint16 oxid; /* next 2 fields reqd to identify fibre */
|
|
|
|
guint16 rxid; /* channel conversations */
|
|
|
|
guint8 r_ctl; /* R_CTL field in Fibre Channel Protocol */
|
2003-10-30 02:06:13 +00:00
|
|
|
guint8 sof_eof; /* FC's SOF/EOF encoding passed to FC decoder
|
|
|
|
* Bit 7 set if Last frame in sequence
|
|
|
|
* Bit 6 set if invalid frame content
|
|
|
|
* Bit 2 set if SOFf
|
|
|
|
* Bit 1 set if first frame in sequence
|
|
|
|
*/
|
2003-01-22 06:26:36 +00:00
|
|
|
guint16 src_idx; /* Source port index (Cisco MDS-specific) */
|
|
|
|
guint16 dst_idx; /* Dest port index (Cisco MDS-specific) */
|
|
|
|
guint16 vsan; /* Fibre channel/Cisco MDS-specific */
|
2005-03-08 09:43:36 +00:00
|
|
|
|
|
|
|
/* Extra data for DCERPC handling and tracking of context ids */
|
2004-09-04 11:35:26 +00:00
|
|
|
guint16 dcectxid; /* Context ID (DCERPC-specific) */
|
2005-02-25 23:44:44 +00:00
|
|
|
int dcetransporttype; /* Transport type
|
2004-09-04 11:35:26 +00:00
|
|
|
* Value -1 means "not a DCERPC packet"
|
|
|
|
*/
|
2005-02-25 10:30:21 +00:00
|
|
|
guint16 dcetransportsalt; /* fid: if transporttype==DCE_CN_TRANSPORT_SMBPIPE */
|
2005-03-08 09:43:36 +00:00
|
|
|
|
|
|
|
/* Extra data for handling of decryption of GSSAPI wrapped tvbuffs.
|
2005-03-16 21:59:25 +00:00
|
|
|
Caller sets decrypt_gssapi_tvb if this service is requested.
|
2005-03-08 09:43:36 +00:00
|
|
|
If gssapi_encrypted_tvb is NULL, then the rest of the tvb data following
|
2005-03-16 21:59:25 +00:00
|
|
|
the gssapi blob itself is decrypted othervise the gssapi_encrypted_tvb
|
2005-03-08 09:43:36 +00:00
|
|
|
tvb will be decrypted (DCERPC has the data before the gssapi blob)
|
2005-03-16 21:59:25 +00:00
|
|
|
If, on return, gssapi_data_encrypted is FALSE, the wrapped tvbuff
|
|
|
|
was signed (i.e., an encrypted signature was present, to check
|
|
|
|
whether the data was modified by a man in the middle) but not sealed
|
|
|
|
(i.e., the data itself wasn't encrypted).
|
2005-03-08 09:43:36 +00:00
|
|
|
*/
|
2005-03-10 08:52:59 +00:00
|
|
|
#define DECRYPT_GSSAPI_NORMAL 1
|
|
|
|
#define DECRYPT_GSSAPI_DCE 2
|
|
|
|
guint16 decrypt_gssapi_tvb;
|
2005-03-08 09:43:36 +00:00
|
|
|
tvbuff_t *gssapi_wrap_tvb;
|
|
|
|
tvbuff_t *gssapi_encrypted_tvb;
|
|
|
|
tvbuff_t *gssapi_decrypted_tvb;
|
2005-03-16 21:59:25 +00:00
|
|
|
gboolean gssapi_data_encrypted;
|
2005-03-08 09:43:36 +00:00
|
|
|
|
2004-09-06 15:04:27 +00:00
|
|
|
guint32 ppid[MAX_NUMBER_OF_PPIDS]; /* The first NUMBER_OF_PPIDS PPIDS which are present
|
|
|
|
* in the SCTP packet
|
|
|
|
*/
|
2001-11-03 00:58:52 +00:00
|
|
|
void *private_data; /* pointer to data passed from one dissector to another */
|
2005-01-19 04:49:29 +00:00
|
|
|
GString *layer_names; /* layers of each protocol */
|
2005-05-02 14:07:33 +00:00
|
|
|
guint16 link_number;
|
From Stephen Donnelly of Endace:
The code for reading ERF files has not been significantly
updated since 2004. This patch brings it up to date with a
number of changes.
1) Increase number of decodable ERF types from 7 to 12. This
covers newer DAG card models and firmware updates.
2) Fix timestamp conversion. Was calculating only microsecond
precision, now displaying with nanosecond resolution. Hardware
precision is 7.5 to 30 ns depending on model.
3) Allow the user to specify HDLC encapsulation as 'chdlc',
'ppp_serial', 'frelay' or 'mtp2'. This is needed because the
ERF HDLC capture formats do not include information on what
protocol is used at the next level. This is currently done via
an environment variable 'ERF_HDLC_ENCAP' and is analagous to the
existing 'ERF_ATM_ENCAP' variable.
If the user does not specify an HDLC encapsulation it tries to
guess, and falls back to MTP2 for backwards compatibility with
Florent's existing behaviour.
I know environment variables are ugly, suggestions are welcome.
4) When reading HDLC captures as MTP2, use
WTAP_ENCAP_MTP2_WITH_PHDR rather than WTAP_ENCAP_MTP2. This
allows us to put the 'Multi-Channel ERF' record 'channel
number' field into the MTP2 pseudo header > 'link_number'
field. This is then displayed in Frame information, and can
be filtered on. (Would be nice if it could be made a display
column?)
Because the ERF record does not specify whether Annex A is used
or not, we pass MTP2_ANNEX_A_USED_UNKNOWN and allow the existing
user preference to decide.
Move the MTP2_ANNEX_A_ definitions into Wiretap, make the annex_a_used
field a guint8, and change MTP2_ANNEX_A_USED_UNKNOWN to 2 so it fits in
a guint8. (This means that if you can save an ERF MTP2 file as a
libpcap file, the pseudo-header will have MTP2_ANNEX_A_USED_UNKNOWN in
it.)
svn path=/trunk/; revision=22067
2007-06-08 17:06:13 +00:00
|
|
|
guint8 annex_a_used;
|
2006-06-29 19:46:51 +00:00
|
|
|
guint16 profinet_type; /* the type of PROFINET packet (0: not a PROFINET packet) */
|
2007-08-03 19:29:34 +00:00
|
|
|
void *profinet_conv; /* the PROFINET conversation data (NULL: not a PROFINET packet) */
|
2006-10-17 14:13:49 +00:00
|
|
|
void *usb_conv_info;
|
2006-10-22 00:21:40 +00:00
|
|
|
void *tcp_tree; /* proto_tree for the tcp layer */
|
2007-02-21 20:21:11 +00:00
|
|
|
|
2007-03-09 13:13:44 +00:00
|
|
|
const char *dcerpc_procedure_name; /* Used by PIDL to store the name of the current dcerpc procedure */
|
2007-02-21 20:21:11 +00:00
|
|
|
|
2007-03-21 00:48:46 +00:00
|
|
|
struct _sccp_msg_info_t* sccp_info;
|
2007-08-08 22:53:14 +00:00
|
|
|
guint16 clnp_srcref; /* clnp/cotp source reference (can't use srcport, this would confuse tpkt) */
|
|
|
|
guint16 clnp_dstref; /* clnp/cotp destination reference (can't use dstport, this would confuse tpkt) */
|
2001-04-01 04:50:42 +00:00
|
|
|
} packet_info;
|
|
|
|
|
|
|
|
#endif /* __PACKET_INFO_H__ */
|