2002-09-06 23:14:04 +00:00
|
|
|
/* cfile.h
|
|
|
|
* capture_file definition & GUI-independent manipulation
|
|
|
|
*
|
2004-07-18 00:24:25 +00:00
|
|
|
* $Id$
|
2002-09-06 23:14:04 +00:00
|
|
|
*
|
2006-05-21 05:12:17 +00:00
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
2002-09-06 23:14:04 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef __CFILE_H__
|
|
|
|
#define __CFILE_H__
|
|
|
|
|
2011-04-27 02:54:44 +00:00
|
|
|
#include "frame_data_sequence.h"
|
|
|
|
|
2011-12-29 00:08:47 +00:00
|
|
|
#ifdef __cplusplus
|
|
|
|
extern "C" {
|
|
|
|
#endif /* __cplusplus */
|
|
|
|
|
2002-09-06 23:14:04 +00:00
|
|
|
/* Current state of file. */
|
|
|
|
typedef enum {
|
2009-02-15 21:55:03 +00:00
|
|
|
FILE_CLOSED, /* No file open */
|
|
|
|
FILE_READ_IN_PROGRESS, /* Reading a file we've opened */
|
|
|
|
FILE_READ_ABORTED, /* Read aborted by user */
|
|
|
|
FILE_READ_DONE /* Read completed */
|
2002-09-06 23:14:04 +00:00
|
|
|
} file_state;
|
|
|
|
|
Get rid of the EBCDIC stuff in the find dialog - it's not supported yet,
so we shouldn't torment the users by offering it.
Check the string type and convert it to an internal representation in
the GUI code; have the search code deal only with the internal
representation.
Save the case-sensitivity flag, and the indication of where string
searches look, along with other search parameters.
Upper-casify the string, for case-insensitive searches, in the GUI code;
don't save the upper-casified string, so it doesn't SHOUT at you when
you next pop up a "find" dialog.
Convert the hex value string to raw binary data in the GUI code, rather
than doing so in the search code. Check that it's a valid string.
Connect the signals to the radio buttons after the pointers have been
attached to various GUI items - the signal handlers expect some of those
pointers to be attached, and aren't happy if they're not.
Have "find_packet()" contain a framework for searching, but not contain
the matching code; instead, pass it a pointer to a matching routine and
an opaque pointer to be passed to the matching routine. Have all the
routines that do different types of searching have their own matching
routines, and use the common "find_packet()" code, rather than
duplicating that code.
Search for the Info column by column type, not by name (the user can
change the name).
When matching on the protocol tree, don't format the entire protocol
tree into a big buffer - just have a routine that matches the text
representation of a protocol tree item against a string, and, if it
finds a match, sets a "we found a match flag" and returns; have that
routine not bother doing any more work if that flag is set.
(Unfortunately, you can't abort "g_node_children_foreach()" in the
middle of a traversal.)
Free the generated display filter code after a find-by-display-filter
finishes.
svn path=/trunk/; revision=8306
2003-08-29 04:03:46 +00:00
|
|
|
/* Character set for text search. */
|
|
|
|
typedef enum {
|
2009-02-15 21:55:03 +00:00
|
|
|
SCS_ASCII_AND_UNICODE,
|
|
|
|
SCS_ASCII,
|
|
|
|
SCS_UNICODE
|
|
|
|
/* add EBCDIC when it's implemented */
|
Get rid of the EBCDIC stuff in the find dialog - it's not supported yet,
so we shouldn't torment the users by offering it.
Check the string type and convert it to an internal representation in
the GUI code; have the search code deal only with the internal
representation.
Save the case-sensitivity flag, and the indication of where string
searches look, along with other search parameters.
Upper-casify the string, for case-insensitive searches, in the GUI code;
don't save the upper-casified string, so it doesn't SHOUT at you when
you next pop up a "find" dialog.
Convert the hex value string to raw binary data in the GUI code, rather
than doing so in the search code. Check that it's a valid string.
Connect the signals to the radio buttons after the pointers have been
attached to various GUI items - the signal handlers expect some of those
pointers to be attached, and aren't happy if they're not.
Have "find_packet()" contain a framework for searching, but not contain
the matching code; instead, pass it a pointer to a matching routine and
an opaque pointer to be passed to the matching routine. Have all the
routines that do different types of searching have their own matching
routines, and use the common "find_packet()" code, rather than
duplicating that code.
Search for the Info column by column type, not by name (the user can
change the name).
When matching on the protocol tree, don't format the entire protocol
tree into a big buffer - just have a routine that matches the text
representation of a protocol tree item against a string, and, if it
finds a match, sets a "we found a match flag" and returns; have that
routine not bother doing any more work if that flag is set.
(Unfortunately, you can't abort "g_node_children_foreach()" in the
middle of a traversal.)
Free the generated display filter code after a find-by-display-filter
finishes.
svn path=/trunk/; revision=8306
2003-08-29 04:03:46 +00:00
|
|
|
} search_charset_t;
|
|
|
|
|
Instead of using a Boolean for the search direction, use an enum, so
that you can tell from examination whether the search is forward or
backward.
Make the cf_find_packet routines take the direction as an explicit
argument, rather than, in the cases where you don't want to permanently
set the direction, saving the direction in the capture_file structure,
changing it, doing the search, and restoring the saved direction. Give
more information in the Doxygen comments for those routines.
Add a cf_find_packet_dfilter_string() routine, which takes a filter
string rather than a compiled filter as an argument. Replace
find_previous_next_frame_with_filter() with it.
Have cf_read_frame_r() and cf_read_frame() pop up the error dialog if
the read fails, rather than leaving that up to its caller. That lets us
eliminate cf_read_error_message(), by swallowing its code into
cf_read_frame_r(). Add Doxygen comments for cf_read_frame_r() and
cf_read_frame().
Don't have find_packet() read the packet before calling the callback
routine; leave that up to the callback routine.
Add cf_find_packet_marked(), to find the next or previous marked packet,
and cf_find_packet_time_reference(), to find the next or previous time
reference packet. Those routines do *not* need to read the packet data
to see if it matches; that lets them run much faster.
Clean up indentation.
svn path=/trunk/; revision=33791
2010-08-13 07:39:46 +00:00
|
|
|
typedef enum {
|
|
|
|
SD_FORWARD,
|
|
|
|
SD_BACKWARD
|
|
|
|
} search_direction;
|
|
|
|
|
Store the frame_data structures in a tree, rather than a linked list.
This lets us get rid of the per-frame_data-structure prev and next
pointers, saving memory (at least according to Activity Monitor's report
of the virtual address space size on my Snow Leopard machine, it's a
noticeable saving), and lets us look up frame_data structures by frame
number in O(log2(number of frames)) time rather than O(number of frames)
time. It seems to take more CPU time when reading in the file, but
seems to go from "finished reading in all the packets" to "displaying
the packets" faster and seems to free up the frame_data structures
faster when closing the file.
It *is* doing more copying, currently, as we now don't allocate the
frame_data structure until after the packet has passed the read filter,
so that might account for the additional CPU time.
(Oh, and, for what it's worth, on an LP64 platform, a frame_data
structure is exactly 128 bytes long. However, there's more stuff to
remove, so the power-of-2 size is not guaranteed to remain, and it's not
a power-of-2 size on an ILP32 platform.)
It also means we don't need GLib 2.10 or later for the two-pass mode in
TShark.
It also means some code in the TCP dissector that was checking
pinfo->fd->next to see if it's NULL, in order to see if this is the last
packet in the file, no longer works, but that wasn't guaranteed to work
anyway:
we might be doing a one-pass read through the capture in TShark;
we might be dissecting the frame while we're reading in the
packets for the first time in Wireshark;
we might be doing a live capture in Wireshark;
in which case packets might be prematurely considered "the last packet".
#if 0 the no-longer-working tests, pending figuring out a better way of
doing it.
svn path=/trunk/; revision=36849
2011-04-25 19:01:05 +00:00
|
|
|
/*
|
|
|
|
* We store the frame_data structures in a radix tree, with 1024
|
|
|
|
* elements per level. The leaf nodes are arrays of 1024 frame_data
|
|
|
|
* structures; the nodes above them are arrays of 1024 pointers to
|
|
|
|
* the nodes below them. The capture_file structure has a pointer
|
|
|
|
* to the root node.
|
|
|
|
*
|
|
|
|
* As frame numbers are 32 bits, and as 1024 is 2^10, that gives us
|
|
|
|
* up to 4 levels of tree.
|
|
|
|
*/
|
|
|
|
#define LOG2_NODES_PER_LEVEL 10
|
|
|
|
#define NODES_PER_LEVEL (1<<LOG2_NODES_PER_LEVEL)
|
|
|
|
|
2002-09-06 23:14:04 +00:00
|
|
|
typedef struct _capture_file {
|
2009-02-15 21:55:03 +00:00
|
|
|
file_state state; /* Current state of capture file */
|
|
|
|
gchar *filename; /* Name of capture file */
|
2010-04-01 21:55:01 +00:00
|
|
|
gchar *source; /* Temp file source, e.g. "Pipe from elsewhere" */
|
2009-02-15 21:55:03 +00:00
|
|
|
gboolean is_tempfile; /* Is capture file a temporary file? */
|
2012-05-20 08:56:06 +00:00
|
|
|
gboolean unsaved_changes; /* Does the capture file have changes that have not been saved? */
|
2009-02-15 21:55:03 +00:00
|
|
|
gint64 f_datalen; /* Size of capture file data (uncompressed) */
|
|
|
|
guint16 cd_t; /* File type of capture file */
|
2012-05-24 05:05:29 +00:00
|
|
|
gboolean iscompressed; /* TRUE if the file is compressed */
|
2012-06-15 23:54:05 +00:00
|
|
|
int lnk_t; /* File link-layer type; could be WTAP_ENCAP_PER_PACKET */
|
|
|
|
GArray *linktypes; /* Array of packet link-layer types */
|
2011-04-25 05:33:07 +00:00
|
|
|
guint32 count; /* Total number of frames */
|
|
|
|
guint32 displayed_count; /* Number of displayed frames */
|
|
|
|
guint32 marked_count; /* Number of marked frames */
|
|
|
|
guint32 ignored_count; /* Number of ignored frames */
|
|
|
|
guint32 ref_time_count; /* Number of time referenced frames */
|
2009-02-15 21:55:03 +00:00
|
|
|
gboolean drops_known; /* TRUE if we know how many packets were dropped */
|
|
|
|
guint32 drops; /* Dropped packets */
|
|
|
|
nstime_t elapsed_time; /* Elapsed time */
|
|
|
|
gboolean has_snap; /* TRUE if maximum capture packet length is known */
|
|
|
|
int snap; /* Maximum captured packet length */
|
|
|
|
wtap *wth; /* Wiretap session */
|
|
|
|
dfilter_t *rfcode; /* Compiled read (display) filter program */
|
|
|
|
gchar *dfilter; /* Display filter string */
|
|
|
|
gboolean redissecting; /* TRUE if currently redissecting (cf_redissect_packets) */
|
2005-08-25 21:29:54 +00:00
|
|
|
/* search */
|
2011-01-31 12:19:15 +00:00
|
|
|
gchar *sfilter; /* Filter, hex value, or string being searched */
|
|
|
|
gboolean hex; /* TRUE if "Hex value" search was last selected */
|
|
|
|
gboolean string; /* TRUE if "String" search was last selected */
|
|
|
|
gboolean summary_data; /* TRUE if "String" search in "Packet list" (Info column) was last selected */
|
|
|
|
gboolean decode_data; /* TRUE if "String" search in "Packet details" was last selected */
|
|
|
|
gboolean packet_data; /* TRUE if "String" search in "Packet data" was last selected */
|
|
|
|
guint32 search_pos; /* Byte position of last byte found in a hex search */
|
2009-02-15 21:55:03 +00:00
|
|
|
gboolean case_type; /* TRUE if case-insensitive text search */
|
2011-01-31 12:19:15 +00:00
|
|
|
search_charset_t scs_type; /* Character set for text search */
|
|
|
|
search_direction dir; /* Direction in which to do searches */
|
2011-01-19 18:21:21 +00:00
|
|
|
gboolean search_in_progress; /* TRUE if user just clicked OK in the Find dialog or hit <control>N/B */
|
2005-08-25 21:29:54 +00:00
|
|
|
/* packet data */
|
2009-02-15 21:55:03 +00:00
|
|
|
union wtap_pseudo_header pseudo_header; /* Packet pseudo_header */
|
2002-09-06 23:14:04 +00:00
|
|
|
guint8 pd[WTAP_MAX_PACKET_SIZE]; /* Packet data */
|
Store the frame_data structures in a tree, rather than a linked list.
This lets us get rid of the per-frame_data-structure prev and next
pointers, saving memory (at least according to Activity Monitor's report
of the virtual address space size on my Snow Leopard machine, it's a
noticeable saving), and lets us look up frame_data structures by frame
number in O(log2(number of frames)) time rather than O(number of frames)
time. It seems to take more CPU time when reading in the file, but
seems to go from "finished reading in all the packets" to "displaying
the packets" faster and seems to free up the frame_data structures
faster when closing the file.
It *is* doing more copying, currently, as we now don't allocate the
frame_data structure until after the packet has passed the read filter,
so that might account for the additional CPU time.
(Oh, and, for what it's worth, on an LP64 platform, a frame_data
structure is exactly 128 bytes long. However, there's more stuff to
remove, so the power-of-2 size is not guaranteed to remain, and it's not
a power-of-2 size on an ILP32 platform.)
It also means we don't need GLib 2.10 or later for the two-pass mode in
TShark.
It also means some code in the TCP dissector that was checking
pinfo->fd->next to see if it's NULL, in order to see if this is the last
packet in the file, no longer works, but that wasn't guaranteed to work
anyway:
we might be doing a one-pass read through the capture in TShark;
we might be dissecting the frame while we're reading in the
packets for the first time in Wireshark;
we might be doing a live capture in Wireshark;
in which case packets might be prematurely considered "the last packet".
#if 0 the no-longer-working tests, pending figuring out a better way of
doing it.
svn path=/trunk/; revision=36849
2011-04-25 19:01:05 +00:00
|
|
|
/* frames */
|
2011-04-27 02:54:44 +00:00
|
|
|
frame_data_sequence *frames; /* Sequence of frames, if we're keeping that information */
|
Store the frame_data structures in a tree, rather than a linked list.
This lets us get rid of the per-frame_data-structure prev and next
pointers, saving memory (at least according to Activity Monitor's report
of the virtual address space size on my Snow Leopard machine, it's a
noticeable saving), and lets us look up frame_data structures by frame
number in O(log2(number of frames)) time rather than O(number of frames)
time. It seems to take more CPU time when reading in the file, but
seems to go from "finished reading in all the packets" to "displaying
the packets" faster and seems to free up the frame_data structures
faster when closing the file.
It *is* doing more copying, currently, as we now don't allocate the
frame_data structure until after the packet has passed the read filter,
so that might account for the additional CPU time.
(Oh, and, for what it's worth, on an LP64 platform, a frame_data
structure is exactly 128 bytes long. However, there's more stuff to
remove, so the power-of-2 size is not guaranteed to remain, and it's not
a power-of-2 size on an ILP32 platform.)
It also means we don't need GLib 2.10 or later for the two-pass mode in
TShark.
It also means some code in the TCP dissector that was checking
pinfo->fd->next to see if it's NULL, in order to see if this is the last
packet in the file, no longer works, but that wasn't guaranteed to work
anyway:
we might be doing a one-pass read through the capture in TShark;
we might be dissecting the frame while we're reading in the
packets for the first time in Wireshark;
we might be doing a live capture in Wireshark;
in which case packets might be prematurely considered "the last packet".
#if 0 the no-longer-working tests, pending figuring out a better way of
doing it.
svn path=/trunk/; revision=36849
2011-04-25 19:01:05 +00:00
|
|
|
guint32 first_displayed; /* Frame number of first frame displayed */
|
|
|
|
guint32 last_displayed; /* Frame number of last frame displayed */
|
2009-02-15 21:55:03 +00:00
|
|
|
column_info cinfo; /* Column formatting information */
|
|
|
|
frame_data *current_frame; /* Frame data for current frame */
|
|
|
|
gint current_row; /* Row number for current frame */
|
|
|
|
epan_dissect_t *edt; /* Protocol dissection for currently selected packet */
|
2003-09-24 00:47:37 +00:00
|
|
|
field_info *finfo_selected; /* Field info for currently selected field */
|
2011-05-12 19:47:49 +00:00
|
|
|
#ifdef WANT_PACKET_EDITOR
|
|
|
|
GTree *edited_frames; /* BST with modified frames */
|
|
|
|
#endif
|
2002-09-06 23:14:04 +00:00
|
|
|
} capture_file;
|
|
|
|
|
Store the frame_data structures in a tree, rather than a linked list.
This lets us get rid of the per-frame_data-structure prev and next
pointers, saving memory (at least according to Activity Monitor's report
of the virtual address space size on my Snow Leopard machine, it's a
noticeable saving), and lets us look up frame_data structures by frame
number in O(log2(number of frames)) time rather than O(number of frames)
time. It seems to take more CPU time when reading in the file, but
seems to go from "finished reading in all the packets" to "displaying
the packets" faster and seems to free up the frame_data structures
faster when closing the file.
It *is* doing more copying, currently, as we now don't allocate the
frame_data structure until after the packet has passed the read filter,
so that might account for the additional CPU time.
(Oh, and, for what it's worth, on an LP64 platform, a frame_data
structure is exactly 128 bytes long. However, there's more stuff to
remove, so the power-of-2 size is not guaranteed to remain, and it's not
a power-of-2 size on an ILP32 platform.)
It also means we don't need GLib 2.10 or later for the two-pass mode in
TShark.
It also means some code in the TCP dissector that was checking
pinfo->fd->next to see if it's NULL, in order to see if this is the last
packet in the file, no longer works, but that wasn't guaranteed to work
anyway:
we might be doing a one-pass read through the capture in TShark;
we might be dissecting the frame while we're reading in the
packets for the first time in Wireshark;
we might be doing a live capture in Wireshark;
in which case packets might be prematurely considered "the last packet".
#if 0 the no-longer-working tests, pending figuring out a better way of
doing it.
svn path=/trunk/; revision=36849
2011-04-25 19:01:05 +00:00
|
|
|
extern void cap_file_init(capture_file *cf);
|
2002-09-06 23:14:04 +00:00
|
|
|
|
2011-12-29 00:08:47 +00:00
|
|
|
#ifdef __cplusplus
|
|
|
|
}
|
|
|
|
#endif /* __cplusplus */
|
|
|
|
|
2002-09-06 23:14:04 +00:00
|
|
|
#endif /* cfile.h */
|