osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity
wireshark/epan/dissectors/packet-frame.c

393 lines
12 KiB
C
Raw Normal View History

Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
/* packet-frame.c
*
* Top-most dissector. Decides dissector based on Wiretap Encapsulation Type.
*
Set the svn:eol-style property on all text files to "native", so that they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-07-18 00:24:25 +00:00
* $Id$
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
*
* Ethereal - Network traffic analyzer
Clean up indentation. svn path=/trunk/; revision=4362
2001-12-08 21:03:41 +00:00
* By Gerald Combs <gerald@ethereal.com>
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
* Copyright 2000 Gerald Combs
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
*
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
*
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
*
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*/
#ifdef HAVE_CONFIG_H
# include "config.h"
#endif
#include <glib.h>
Include files from the "epan" directory and subdirectories thereof with "epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
2002-01-21 07:37:49 +00:00
#include <epan/packet.h>
#include <epan/timestamp.h>
#include <epan/tvbuff.h>
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
#include "packet-frame.h"
Move prefs.c and prefs.h into the epan subdirectory. svn path=/trunk/; revision=12115
2004-09-27 22:55:15 +00:00
#include <epan/prefs.h>
Move the tap infrastructure to the epan directory. svn path=/trunk/; revision=12128
2004-09-29 00:06:36 +00:00
#include <epan/tap.h>
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Add the ability to print packet dissections in PDML (an XML-based format) to tethereal. It could be added to Ethereal, but the GUI changes to allow the user to select PDML as a print format have not been added. Provide a python module (EtherealXML.py) to help parse PDML. Provide a sample app (msnchat) which uses tethereal and EtherealXML.py to reconstruct MSN Chat sessions from packet capture files. It produces a nice HTML report of the chat sessions. Document tethereal's PDML and EtherealXML.py usage in doc/README.xml-output Update tethereal's manpage to reflect the new [-T pdml|ps|text] option svn path=/trunk/; revision=9180
2003-12-06 06:09:13 +00:00
int proto_frame = -1;
int hf_frame_arrival_time = -1;
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
static int hf_frame_time_delta = -1;
Add the relative time to the frame tree, at the request of Manfred Young. svn path=/trunk/; revision=2762
2000-12-15 03:30:21 +00:00
static int hf_frame_time_relative = -1;
Add the ability to print packet dissections in PDML (an XML-based format) to tethereal. It could be added to Ethereal, but the GUI changes to allow the user to select PDML as a print format have not been added. Provide a python module (EtherealXML.py) to help parse PDML. Provide a sample app (msnchat) which uses tethereal and EtherealXML.py to reconstruct MSN Chat sessions from packet capture files. It produces a nice HTML report of the chat sessions. Document tethereal's PDML and EtherealXML.py usage in doc/README.xml-output Update tethereal's manpage to reflect the new [-T pdml|ps|text] option svn path=/trunk/; revision=9180
2003-12-06 06:09:13 +00:00
int hf_frame_number = -1;
int hf_frame_packet_len = -1;
int hf_frame_capture_len = -1;
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
static int hf_frame_p2p_dir = -1;
Add an option to show the File Offset of a frame. Not useful for general packet analyzing, but useful when developing wiretap code or other such low-level development. Default preference is *not* to show File Offset. svn path=/trunk/; revision=4120
2001-11-01 04:00:56 +00:00
static int hf_frame_file_off = -1;
From Didier Gautheron: add a "frame.marked" hidden field, set if the frame is marked, so that you can use Find Frame to find the next marked frame, and can filter the display to show only marked frames. Update the documentation to note that "frame.marked" is set on marked frames. svn path=/trunk/; revision=5377
2002-05-03 21:38:20 +00:00
static int hf_frame_marked = -1;
Add filterable field for REF TIME frames so it is easy to search for them svn path=/trunk/; revision=8511
2003-09-22 09:06:10 +00:00
static int hf_frame_ref_time = -1;
Add a field called "frame.protocols" which shows the protocols present in the frame. The filter "frame.protocols contains ip:icmp:ip" could be used to find any ICMP packets containing IP headers. Clean up whitespace. svn path=/trunk/; revision=13118
2005-01-19 04:49:29 +00:00
static int hf_frame_protocols = -1;
From Didier Gautheron: add a "frame.marked" hidden field, set if the frame is marked, so that you can use Find Frame to find the next marked frame, and can filter the display to show only marked frames. Update the documentation to note that "frame.marked" is set on marked frames. svn path=/trunk/; revision=5377
2002-05-03 21:38:20 +00:00
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
static int proto_short = -1;
int proto_malformed = -1;
Use the "fragmented" field of the "packet_info" structure in "dissect_frame()" to indicate whether a ReportedBoundsError was due to the packet being malformed (i.e., the packet was shorter than it's supposed to be, so the dissector went past the end trying to extract fields that were supposed to be there) or due to it not being reassembled (i.e., the packet was fragmented, and we didn't reassemble it, but just treated the first fragment as the entire packet, so the dissector went past the end trying to extract fields that were partially or completely in fragments after that). Mark the latter as being unreasembled rather than malformed. Properly initialize, save, and restore that field, and properly set it, so that works. svn path=/trunk/; revision=4555
2002-01-17 06:29:20 +00:00
static int proto_unreassembled = -1;
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
static gint ett_frame = -1;
Tap api. tap is a simple api that can be used for arbitrary extensions. One example extension is rpcstat. Try -Z rpc,rtt,100003,3 as argument to tethereal when reading a capture containing NFSv3 packets. tap-rpcstat.[ch] is intended to demonstrate the api and can be used to base other extensions on. svn path=/trunk/; revision=6175
2002-09-04 09:40:29 +00:00
static int frame_tap = -1;
Added a proto_reg_handoff_frame() function and switched from using dissect_data() to using call_dissector() svn path=/trunk/; revision=4268
2001-11-26 01:23:59 +00:00
static dissector_handle_t data_handle;
From Anand V. Narwani: DOCSIS support, including support for "Ethernet" captures where the raw frame is a DOCSIS frame rather than an Ethernet frame (some Cisco cable-modem head-end gear can send out a trace of all traffic on an Ethernet, but what it sends are the raw bytes of DOCSIS frames, not Ethernet frames) Get rid of second AUTHORS entry for Devin Heitmueller, merging its item into the older entry. Clean up the order of some lists of plugin items. svn path=/trunk/; revision=5861
2002-07-12 22:52:43 +00:00
static dissector_handle_t docsis_handle;
From LEGO if Mate is pressent call it. svn path=/trunk/; revision=12615
2004-11-28 20:52:52 +00:00
static dissector_handle_t mate_handle = NULL;
Added a proto_reg_handoff_frame() function and switched from using dissect_data() to using call_dissector() svn path=/trunk/; revision=4268
2001-11-26 01:23:59 +00:00
Add an option to show the File Offset of a frame. Not useful for general packet analyzing, but useful when developing wiretap code or other such low-level development. Default preference is *not* to show File Offset. svn path=/trunk/; revision=4120
2001-11-01 04:00:56 +00:00
/* Preferences */
static gboolean show_file_off = FALSE;
From Anand V. Narwani: DOCSIS support, including support for "Ethernet" captures where the raw frame is a DOCSIS frame rather than an Ethernet frame (some Cisco cable-modem head-end gear can send out a trace of all traffic on an Ethernet, but what it sends are the raw bytes of DOCSIS frames, not Ethernet frames) Get rid of second AUTHORS entry for Devin Heitmueller, merging its item into the older entry. Clean up the order of some lists of plugin items. svn path=/trunk/; revision=5861
2002-07-12 22:52:43 +00:00
static gboolean force_docsis_encap;
Add an option to show the File Offset of a frame. Not useful for general packet analyzing, but useful when developing wiretap code or other such low-level development. Default preference is *not* to show File Offset. svn path=/trunk/; revision=4120
2001-11-01 04:00:56 +00:00
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
static const value_string p2p_dirs[] = {
{ P2P_DIR_SENT, "Sent" },
{ P2P_DIR_RECV, "Received" },
{ 0, NULL }
};
Wrap the dissect_fddi() call (with a 4th argument) with dissect_fddi_not_bitswapped() and dissect_fddi_bitswapped(), both of which use the standard 3-argument tvbuffified-dissector argument list. Add a dissector table called "wtap_encap" which is used to call dissectors from dissect_frame(). The switch() statement from this top-level dissector is removed. The link-layer dissectors register themselves with the "wtap_encap" dissector table. The dissectors are now static where possible. svn path=/trunk/; revision=2708
2000-11-29 05:16:15 +00:00
static dissector_table_t wtap_encap_dissector_table;
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
More static-ization. svn path=/trunk/; revision=5131
2002-04-08 20:30:56 +00:00
static void
Major speed improvement for filtering and dissection. It should not dump core as far as all my tests are concerned and Menu_Statistics/ProtocolHierStats work It needs more testing and there might still be cases where it will crash that will need to be fixed but I feel it will be worth it since it will decrease the time to filter very large capture files dramatically. Real significant performance boost for very large captures. (If we cant fix all the problems we can just revert this patch) svn path=/trunk/; revision=14051
2005-04-11 08:43:51 +00:00
dissect_frame(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
{
Major speed improvement for filtering and dissection. It should not dump core as far as all my tests are concerned and Menu_Statistics/ProtocolHierStats work It needs more testing and there might still be cases where it will crash that will need to be fixed but I feel it will be worth it since it will decrease the time to filter very large capture files dramatically. Real significant performance boost for very large captures. (If we cant fix all the problems we can just revert this patch) svn path=/trunk/; revision=14051
2005-04-11 08:43:51 +00:00
proto_tree *fh_tree=NULL;
Squelch some compiler warnings. svn path=/trunk/; revision=13133
2005-01-20 07:58:23 +00:00
proto_item *volatile ti = NULL;
Make the resolution for time values be nanoseconds rather than microseconds. Fix some "signed vs. unsigned" comparison warnings. svn path=/trunk/; revision=3934
2001-09-14 07:10:13 +00:00
nstime_t ts;
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
int cap_len, pkt_len;
Major speed improvement for filtering and dissection. It should not dump core as far as all my tests are concerned and Menu_Statistics/ProtocolHierStats work It needs more testing and there might still be cases where it will crash that will need to be fixed but I feel it will be worth it since it will decrease the time to filter very large capture files dramatically. Real significant performance boost for very large captures. (If we cant fix all the problems we can just revert this patch) svn path=/trunk/; revision=14051
2005-04-11 08:43:51 +00:00
proto_tree *tree;
tree=parent_tree;
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
pinfo->current_proto = "Frame";
"pinfo->pseudo_header" might be null, even for link-layer types such as WTAP_ENCAP_CHDLC; check whether it's null before using it. Use FROM_DCE rather than 0x80 to check the "this is DCE->DTE" bit in "x25.flags". svn path=/trunk/; revision=5148
2002-04-13 00:02:55 +00:00
if (pinfo->pseudo_header != NULL) {
switch (pinfo->fd->lnk_t) {
Add support for Wellfleet HDLC. It now can see inside the packets and handles the capture I was sent as a bunch of TCP segments containing LPD stuff. svn path=/trunk/; revision=6810
2002-12-20 07:56:07 +00:00
case WTAP_ENCAP_WFLEET_HDLC:
Add a new WTAP_ENCAP_CHDLC_WITH_PHDR type, to distinguish Cisco HDLC captures with packet direction information from captures without it. Use them appropriately. svn path=/trunk/; revision=8780
2003-10-25 07:17:28 +00:00
case WTAP_ENCAP_CHDLC_WITH_PHDR:
"pinfo->pseudo_header" might be null, even for link-layer types such as WTAP_ENCAP_CHDLC; check whether it's null before using it. Use FROM_DCE rather than 0x80 to check the "this is DCE->DTE" bit in "x25.flags". svn path=/trunk/; revision=5148
2002-04-13 00:02:55 +00:00
case WTAP_ENCAP_PPP_WITH_PHDR:
Handle packet direction information for SDLC Sniffer captures. Add a bunch of capture types discovered by stuffing them into Windows Sniffer captures and seeing what a Sniffer thought they were. Add support for writing at least some of them. svn path=/trunk/; revision=7265
2003-03-03 23:29:59 +00:00
case WTAP_ENCAP_SDLC:
"pinfo->pseudo_header" might be null, even for link-layer types such as WTAP_ENCAP_CHDLC; check whether it's null before using it. Use FROM_DCE rather than 0x80 to check the "this is DCE->DTE" bit in "x25.flags". svn path=/trunk/; revision=5148
2002-04-13 00:02:55 +00:00
pinfo->p2p_dir = pinfo->pseudo_header->p2p.sent ?
P2P_DIR_SENT : P2P_DIR_RECV;
break;
case WTAP_ENCAP_LAPB:
Add WTAP_ENCAP_FRELAY_WITH_PHDR for use with Frame Relay capture files that have direction information. Support writing WTAP_ENCAP_FRELAY_WITH_PHDR and WTAP_ENCAP_PPP_WITH_PHDR captures out in libpcap format - we throw away the direction information, but so it goes. When reading/writing Windows Sniffer format, read and write the direction flag. svn path=/trunk/; revision=7052
2003-01-31 01:02:14 +00:00
case WTAP_ENCAP_FRELAY_WITH_PHDR:
"pinfo->pseudo_header" might be null, even for link-layer types such as WTAP_ENCAP_CHDLC; check whether it's null before using it. Use FROM_DCE rather than 0x80 to check the "this is DCE->DTE" bit in "x25.flags". svn path=/trunk/; revision=5148
2002-04-13 00:02:55 +00:00
pinfo->p2p_dir =
(pinfo->pseudo_header->x25.flags & FROM_DCE) ?
P2P_DIR_RECV : P2P_DIR_SENT;
break;
Discard the WTAP_ENCAP_LAPD encapsulation type in favor of a WTAP_ENCAP_ISDN encapsulation type, which includes a pseudo-header giving the direction (user-to-network or network-to-user) and the channel number. Add a new circuit type, using the ISDN channel number as the circuit ID. Add an ISDN dissector to put the direction and channel number into the protocol tree and to call the appropriate dissector for the payload based on the channel (LAPD for the D channel; V.120, PPP, or data for B channels, based on some heuristics). svn path=/trunk/; revision=6521
2002-10-31 07:12:42 +00:00
case WTAP_ENCAP_ISDN:
pinfo->p2p_dir = pinfo->pseudo_header->isdn.uton ?
P2P_DIR_SENT : P2P_DIR_RECV;
break;
"pinfo->pseudo_header" might be null, even for link-layer types such as WTAP_ENCAP_CHDLC; check whether it's null before using it. Use FROM_DCE rather than 0x80 to check the "this is DCE->DTE" bit in "x25.flags". svn path=/trunk/; revision=5148
2002-04-13 00:02:55 +00:00
}
Cisco HDLC and frame relay direction reporting, from Tom Nisbet. svn path=/trunk/; revision=4447
2001-12-24 17:06:53 +00:00
}
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
From Anand V. Narwani: DOCSIS support, including support for "Ethernet" captures where the raw frame is a DOCSIS frame rather than an Ethernet frame (some Cisco cable-modem head-end gear can send out a trace of all traffic on an Ethernet, but what it sends are the raw bytes of DOCSIS frames, not Ethernet frames) Get rid of second AUTHORS entry for Devin Heitmueller, merging its item into the older entry. Clean up the order of some lists of plugin items. svn path=/trunk/; revision=5861
2002-07-12 22:52:43 +00:00
if ((force_docsis_encap) && (docsis_handle)) {
Put in a comment noting that forcibly setting "pinfo->fd->lnk_t" means you can't turn the "Treat all frames as DOCSIS frames" option off. svn path=/trunk/; revision=5958
2002-08-06 08:13:42 +00:00
/*
* XXX - setting it here makes it impossible to
* turn the "Treat all frames as DOCSIS frames"
* option off.
*
* The TCP Graph code currently uses "fd->lnk_t";
* it should eventually just get the information
* it needs from a full-blown dissection, so that
* can handle any link-layer type.
*/
From Anand V. Narwani: DOCSIS support, including support for "Ethernet" captures where the raw frame is a DOCSIS frame rather than an Ethernet frame (some Cisco cable-modem head-end gear can send out a trace of all traffic on an Ethernet, but what it sends are the raw bytes of DOCSIS frames, not Ethernet frames) Get rid of second AUTHORS entry for Devin Heitmueller, merging its item into the older entry. Clean up the order of some lists of plugin items. svn path=/trunk/; revision=5861
2002-07-12 22:52:43 +00:00
pinfo->fd->lnk_t = WTAP_ENCAP_DOCSIS;
}
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
/* Put in frame header information. */
if (tree) {
cap_len = tvb_length(tvb);
pkt_len = tvb_reported_length(tvb);
Replace a bunch of "tvb_length()" and "tvb_length_remaining()" calls in arguments to "proto_tree_add_text()", and to "proto_tree_add_XXX()" calls that add FT_NONE or FT_PROTO items to the protocol tree, with -1. Replace some calls to "tvb_length()" or "tvb_length_remaining()" with calls to "tvb_reported_length()" and "tvb_reported_length_remaining()", as those give the actual length of the data in the packet, not just the data that happened to be captured. svn path=/trunk/; revision=4605
2002-01-24 09:20:54 +00:00
ti = proto_tree_add_protocol_format(tree, proto_frame, tvb, 0, -1,
From Ulf Lamping: Put "bytes" after the byte counts for the frame sizes in the top-level item for the "Frame" protocol, to make it clearer what they refer to. Put the source and destination MAC addresses into the top-level item for Ethernet. svn path=/trunk/; revision=6090
2002-08-26 19:09:02 +00:00
"Frame %u (%u bytes on wire, %u bytes captured)", pinfo->fd->num, pkt_len, cap_len);
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
fh_tree = proto_item_add_subtree(ti, ett_frame);
Major speed improvement for filtering and dissection. It should not dump core as far as all my tests are concerned and Menu_Statistics/ProtocolHierStats work It needs more testing and there might still be cases where it will crash that will need to be fixed but I feel it will be worth it since it will decrease the time to filter very large capture files dramatically. Real significant performance boost for very large captures. (If we cant fix all the problems we can just revert this patch) svn path=/trunk/; revision=14051
2005-04-11 08:43:51 +00:00
}
/* if IP is not referenced from any filters we dont need to worry about
generating any tree items. We must do this after we created the actual
protocol above so that proto hier stat still works though.
*/
if(!proto_field_is_referenced(tree, proto_frame)){
tree=NULL;
fh_tree = NULL;
}
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Major speed improvement for filtering and dissection. It should not dump core as far as all my tests are concerned and Menu_Statistics/ProtocolHierStats work It needs more testing and there might still be cases where it will crash that will need to be fixed but I feel it will be worth it since it will decrease the time to filter very large capture files dramatically. Real significant performance boost for very large captures. (If we cant fix all the problems we can just revert this patch) svn path=/trunk/; revision=14051
2005-04-11 08:43:51 +00:00
if (fh_tree) {
From Didier Gautheron: put "frame.marked" into the "Frame" subtree, not into the top-level tree. svn path=/trunk/; revision=5393
2002-05-04 20:57:18 +00:00
proto_tree_add_boolean_hidden(fh_tree, hf_frame_marked, tvb, 0, 0,pinfo->fd->flags.marked);
Add filterable field for REF TIME frames so it is easy to search for them svn path=/trunk/; revision=8511
2003-09-22 09:06:10 +00:00
if(pinfo->fd->flags.ref_time){
proto_tree_add_item(fh_tree, hf_frame_ref_time, tvb, 0, 0, FALSE);
}
Make the resolution for time values be nanoseconds rather than microseconds. Fix some "signed vs. unsigned" comparison warnings. svn path=/trunk/; revision=3934
2001-09-14 07:10:13 +00:00
ts.secs = pinfo->fd->abs_secs;
ts.nsecs = pinfo->fd->abs_usecs*1000;
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
proto_tree_add_time(fh_tree, hf_frame_arrival_time, tvb,
Make the resolution for time values be nanoseconds rather than microseconds. Fix some "signed vs. unsigned" comparison warnings. svn path=/trunk/; revision=3934
2001-09-14 07:10:13 +00:00
0, 0, &ts);
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Make the resolution for time values be nanoseconds rather than microseconds. Fix some "signed vs. unsigned" comparison warnings. svn path=/trunk/; revision=3934
2001-09-14 07:10:13 +00:00
ts.secs = pinfo->fd->del_secs;
ts.nsecs = pinfo->fd->del_usecs*1000;
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
proto_tree_add_time(fh_tree, hf_frame_time_delta, tvb,
Make the resolution for time values be nanoseconds rather than microseconds. Fix some "signed vs. unsigned" comparison warnings. svn path=/trunk/; revision=3934
2001-09-14 07:10:13 +00:00
0, 0, &ts);
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Make the resolution for time values be nanoseconds rather than microseconds. Fix some "signed vs. unsigned" comparison warnings. svn path=/trunk/; revision=3934
2001-09-14 07:10:13 +00:00
ts.secs = pinfo->fd->rel_secs;
ts.nsecs = pinfo->fd->rel_usecs*1000;
Add the relative time to the frame tree, at the request of Manfred Young. svn path=/trunk/; revision=2762
2000-12-15 03:30:21 +00:00
proto_tree_add_time(fh_tree, hf_frame_time_relative, tvb,
Make the resolution for time values be nanoseconds rather than microseconds. Fix some "signed vs. unsigned" comparison warnings. svn path=/trunk/; revision=3934
2001-09-14 07:10:13 +00:00
0, 0, &ts);
Add the relative time to the frame tree, at the request of Manfred Young. svn path=/trunk/; revision=2762
2000-12-15 03:30:21 +00:00
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
proto_tree_add_uint(fh_tree, hf_frame_number, tvb,
0, 0, pinfo->fd->num);
proto_tree_add_uint_format(fh_tree, hf_frame_packet_len, tvb,
0, 0, pkt_len, "Packet Length: %d byte%s", pkt_len,
plurality(pkt_len, "", "s"));
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
proto_tree_add_uint_format(fh_tree, hf_frame_capture_len, tvb,
0, 0, cap_len, "Capture Length: %d byte%s", cap_len,
plurality(cap_len, "", "s"));
Add a field called "frame.protocols" which shows the protocols present in the frame. The filter "frame.protocols contains ip:icmp:ip" could be used to find any ICMP packets containing IP headers. Clean up whitespace. svn path=/trunk/; revision=13118
2005-01-19 04:49:29 +00:00
ti = proto_tree_add_string(fh_tree, hf_frame_protocols, tvb,
0, 0, "");
pinfo->layer_names = g_string_new("");
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
/* Check for existences of P2P pseudo header */
if (pinfo->p2p_dir != P2P_DIR_UNKNOWN) {
proto_tree_add_uint(fh_tree, hf_frame_p2p_dir, tvb,
0, 0, pinfo->p2p_dir);
}
Add an option to show the File Offset of a frame. Not useful for general packet analyzing, but useful when developing wiretap code or other such low-level development. Default preference is *not* to show File Offset. svn path=/trunk/; revision=4120
2001-11-01 04:00:56 +00:00
Clean up indentation. svn path=/trunk/; revision=4362
2001-12-08 21:03:41 +00:00
if (show_file_off) {
proto_tree_add_int_format(fh_tree, hf_frame_file_off, tvb,
0, 0, pinfo->fd->file_off,
"File Offset: %ld (0x%lx)",
pinfo->fd->file_off, pinfo->fd->file_off);
}
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
}
TRY {
Wrap the dissect_fddi() call (with a 4th argument) with dissect_fddi_not_bitswapped() and dissect_fddi_bitswapped(), both of which use the standard 3-argument tvbuffified-dissector argument list. Add a dissector table called "wtap_encap" which is used to call dissectors from dissect_frame(). The switch() statement from this top-level dissector is removed. The link-layer dissectors register themselves with the "wtap_encap" dissector table. The dissectors are now static where possible. svn path=/trunk/; revision=2708
2000-11-29 05:16:15 +00:00
if (!dissector_try_port(wtap_encap_dissector_table, pinfo->fd->lnk_t,
Major speed improvement for filtering and dissection. It should not dump core as far as all my tests are concerned and Menu_Statistics/ProtocolHierStats work It needs more testing and there might still be cases where it will crash that will need to be fixed but I feel it will be worth it since it will decrease the time to filter very large capture files dramatically. Real significant performance boost for very large captures. (If we cant fix all the problems we can just revert this patch) svn path=/trunk/; revision=14051
2005-04-11 08:43:51 +00:00
tvb, pinfo, parent_tree)) {
Wrap the dissect_fddi() call (with a 4th argument) with dissect_fddi_not_bitswapped() and dissect_fddi_bitswapped(), both of which use the standard 3-argument tvbuffified-dissector argument list. Add a dissector table called "wtap_encap" which is used to call dissectors from dissect_frame(). The switch() statement from this top-level dissector is removed. The link-layer dissectors register themselves with the "wtap_encap" dissector table. The dissectors are now static where possible. svn path=/trunk/; revision=2708
2000-11-29 05:16:15 +00:00
Move the pointer to the "column_info" structure in the "frame_data" structure to the "packet_info" structure; only stuff that's permanently stored with each frame should be in the "frame_data" structure, and the "column_info" structure is not guaranteed to hold the column values for that frame at all times - it was only in the "frame_data" structure so that it could be passed to dissectors, and, as all dissectors are now passed a pointer to a "packet_info" structure, it could just as well be put in the "packet_info" structure. That saves memory, by shrinking the "frame_data" structure (there's one of those per frame), and also lets us clean up the code a bit. svn path=/trunk/; revision=4370
2001-12-10 00:26:21 +00:00
if (check_col(pinfo->cinfo, COL_PROTOCOL))
col_set_str(pinfo->cinfo, COL_PROTOCOL, "UNKNOWN");
if (check_col(pinfo->cinfo, COL_INFO))
col_add_fstr(pinfo->cinfo, COL_INFO, "WTAP_ENCAP = %u",
pinfo->fd->lnk_t);
Major speed improvement for filtering and dissection. It should not dump core as far as all my tests are concerned and Menu_Statistics/ProtocolHierStats work It needs more testing and there might still be cases where it will crash that will need to be fixed but I feel it will be worth it since it will decrease the time to filter very large capture files dramatically. Real significant performance boost for very large captures. (If we cant fix all the problems we can just revert this patch) svn path=/trunk/; revision=14051
2005-04-11 08:43:51 +00:00
call_dissector(data_handle,tvb, pinfo, parent_tree);
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
}
}
Add a "show_exception()" routine that takes an exception code as an argument, and puts the appropriate exception indication into the tree. In "dissect_frame()", do a CATCH_ALL for exceptions, and pass the exception code to "show_exception()". svn path=/trunk/; revision=8758
2003-10-23 05:01:39 +00:00
CATCH_ALL {
Major speed improvement for filtering and dissection. It should not dump core as far as all my tests are concerned and Menu_Statistics/ProtocolHierStats work It needs more testing and there might still be cases where it will crash that will need to be fixed but I feel it will be worth it since it will decrease the time to filter very large capture files dramatically. Real significant performance boost for very large captures. (If we cant fix all the problems we can just revert this patch) svn path=/trunk/; revision=14051
2005-04-11 08:43:51 +00:00
show_exception(tvb, pinfo, parent_tree, EXCEPT_CODE, GET_MESSAGE);
Add a "show_exception()" routine that takes an exception code as an argument, and puts the appropriate exception indication into the tree. In "dissect_frame()", do a CATCH_ALL for exceptions, and pass the exception code to "show_exception()". svn path=/trunk/; revision=8758
2003-10-23 05:01:39 +00:00
}
ENDTRY;
Add a field called "frame.protocols" which shows the protocols present in the frame. The filter "frame.protocols contains ip:icmp:ip" could be used to find any ICMP packets containing IP headers. Clean up whitespace. svn path=/trunk/; revision=13118
2005-01-19 04:49:29 +00:00
if (tree) {
proto_item_append_string(ti, pinfo->layer_names->str);
g_string_free(pinfo->layer_names, TRUE);
pinfo->layer_names = NULL;
}
Add a "show_exception()" routine that takes an exception code as an argument, and puts the appropriate exception indication into the tree. In "dissect_frame()", do a CATCH_ALL for exceptions, and pass the exception code to "show_exception()". svn path=/trunk/; revision=8758
2003-10-23 05:01:39 +00:00
tap_queue_packet(frame_tap, pinfo, NULL);
Add a field called "frame.protocols" which shows the protocols present in the frame. The filter "frame.protocols contains ip:icmp:ip" could be used to find any ICMP packets containing IP headers. Clean up whitespace. svn path=/trunk/; revision=13118
2005-01-19 04:49:29 +00:00
Major speed improvement for filtering and dissection. It should not dump core as far as all my tests are concerned and Menu_Statistics/ProtocolHierStats work It needs more testing and there might still be cases where it will crash that will need to be fixed but I feel it will be worth it since it will decrease the time to filter very large capture files dramatically. Real significant performance boost for very large captures. (If we cant fix all the problems we can just revert this patch) svn path=/trunk/; revision=14051
2005-04-11 08:43:51 +00:00
if (mate_handle) call_dissector(mate_handle,tvb, pinfo, parent_tree);
From LEGO if Mate is pressent call it. svn path=/trunk/; revision=12615
2004-11-28 20:52:52 +00:00
Add a "show_exception()" routine that takes an exception code as an argument, and puts the appropriate exception indication into the tree. In "dissect_frame()", do a CATCH_ALL for exceptions, and pass the exception code to "show_exception()". svn path=/trunk/; revision=8758
2003-10-23 05:01:39 +00:00
}
void
show_exception(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
throw the new FieldError exception, if a dissector tries to add a field with invalid parameters add a message parameter to the show_exception function svn path=/trunk/; revision=13074
2005-01-16 16:06:15 +00:00
unsigned long exception, const char *exception_message)
Add a "show_exception()" routine that takes an exception code as an argument, and puts the appropriate exception indication into the tree. In "dissect_frame()", do a CATCH_ALL for exceptions, and pass the exception code to "show_exception()". svn path=/trunk/; revision=8758
2003-10-23 05:01:39 +00:00
{
switch (exception) {
case BoundsError:
Move the pointer to the "column_info" structure in the "frame_data" structure to the "packet_info" structure; only stuff that's permanently stored with each frame should be in the "frame_data" structure, and the "column_info" structure is not guaranteed to hold the column values for that frame at all times - it was only in the "frame_data" structure so that it could be passed to dissectors, and, as all dissectors are now passed a pointer to a "packet_info" structure, it could just as well be put in the "packet_info" structure. That saves memory, by shrinking the "frame_data" structure (there's one of those per frame), and also lets us clean up the code a bit. svn path=/trunk/; revision=4370
2001-12-10 00:26:21 +00:00
if (check_col(pinfo->cinfo, COL_INFO))
col_append_str(pinfo->cinfo, COL_INFO, "[Short Frame]");
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0,
Add support for reassembling RPC-over-TCP fragments, and do that in both RPC and NDMP. Show the RPC-over-TCP fragment header as a tree with bitfields below it. Add a routine to show a reported bounds error as an "Unreassembled Packet" or a "Malformed Packet" depending on whether "pinfo->fragmented" is set, and have NBNS and RPC use that. Add "ett_ndmp_file_stats" to the list of ett_ values to be initialized (it wasn't in that list, and wasn't getting initialized). When freeing up various hash tables and memory chunks in the RPC dissector, zero out the pointers to them, just to make sure we don't try to free them again. Always destroy the TCP segment key and address memory chunks in "tcp_desegment_init()", regardless of whether TCP desegmentation is enabled - we don't *allocate* them if TCP desegmentation isn't enabled, but we should free them even if it's not enabled. Also, when we free them, set the pointers to them to null, so we don't double-free them. Supply to subdissectors called from the TCP dissector the sequence number of the first byte handed to the sub dissector. svn path=/trunk/; revision=4753
2002-02-18 23:51:55 +00:00
"[Short Frame: %s]", pinfo->current_proto);
Add a "show_exception()" routine that takes an exception code as an argument, and puts the appropriate exception indication into the tree. In "dissect_frame()", do a CATCH_ALL for exceptions, and pass the exception code to "show_exception()". svn path=/trunk/; revision=8758
2003-10-23 05:01:39 +00:00
break;
case ReportedBoundsError:
Add support for reassembling RPC-over-TCP fragments, and do that in both RPC and NDMP. Show the RPC-over-TCP fragment header as a tree with bitfields below it. Add a routine to show a reported bounds error as an "Unreassembled Packet" or a "Malformed Packet" depending on whether "pinfo->fragmented" is set, and have NBNS and RPC use that. Add "ett_ndmp_file_stats" to the list of ett_ values to be initialized (it wasn't in that list, and wasn't getting initialized). When freeing up various hash tables and memory chunks in the RPC dissector, zero out the pointers to them, just to make sure we don't try to free them again. Always destroy the TCP segment key and address memory chunks in "tcp_desegment_init()", regardless of whether TCP desegmentation is enabled - we don't *allocate* them if TCP desegmentation isn't enabled, but we should free them even if it's not enabled. Also, when we free them, set the pointers to them to null, so we don't double-free them. Supply to subdissectors called from the TCP dissector the sequence number of the first byte handed to the sub dissector. svn path=/trunk/; revision=4753
2002-02-18 23:51:55 +00:00
show_reported_bounds_error(tvb, pinfo, tree);
Add a "show_exception()" routine that takes an exception code as an argument, and puts the appropriate exception indication into the tree. In "dissect_frame()", do a CATCH_ALL for exceptions, and pass the exception code to "show_exception()". svn path=/trunk/; revision=8758
2003-10-23 05:01:39 +00:00
break;
Rename the FieldError exception to DissectorError. Add a DISSECTOR_ASSERT() macro, which is the usual type of assertion macro, but throws a DissectorError exception with a message giving the flien and line number and the failed test as a string. Use that macro in "alloc_field_info()". Report that exception in the Info column and the protocol tree, as well as logging the exception failure with g_warning(). svn path=/trunk/; revision=13078
2005-01-16 23:30:55 +00:00
case DissectorError:
throw the new FieldError exception, if a dissector tries to add a field with invalid parameters add a message parameter to the show_exception function svn path=/trunk/; revision=13074
2005-01-16 16:06:15 +00:00
if (check_col(pinfo->cinfo, COL_INFO))
Rename the FieldError exception to DissectorError. Add a DISSECTOR_ASSERT() macro, which is the usual type of assertion macro, but throws a DissectorError exception with a message giving the flien and line number and the failed test as a string. Use that macro in "alloc_field_info()". Report that exception in the Info column and the protocol tree, as well as logging the exception failure with g_warning(). svn path=/trunk/; revision=13078
2005-01-16 23:30:55 +00:00
col_append_fstr(pinfo->cinfo, COL_INFO,
"[Dissector bug, protocol %s: %s]",
pinfo->current_proto, exception_message);
throw the new FieldError exception, if a dissector tries to add a field with invalid parameters add a message parameter to the show_exception function svn path=/trunk/; revision=13074
2005-01-16 16:06:15 +00:00
proto_tree_add_protocol_format(tree, proto_malformed, tvb, 0, 0,
Rename the FieldError exception to DissectorError. Add a DISSECTOR_ASSERT() macro, which is the usual type of assertion macro, but throws a DissectorError exception with a message giving the flien and line number and the failed test as a string. Use that macro in "alloc_field_info()". Report that exception in the Info column and the protocol tree, as well as logging the exception failure with g_warning(). svn path=/trunk/; revision=13078
2005-01-16 23:30:55 +00:00
"[Dissector bug, protocol %s: %s]",
pinfo->current_proto, exception_message);
g_warning("Dissector bug, protocol %s, in packet %u: %s",
pinfo->current_proto, pinfo->fd->num, exception_message);
g_free((void *)exception_message);
break;
default:
/* XXX - we want to know, if an unknown exception passed until here, don't we? */
g_assert_not_reached();
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
}
}
Add support for reassembling RPC-over-TCP fragments, and do that in both RPC and NDMP. Show the RPC-over-TCP fragment header as a tree with bitfields below it. Add a routine to show a reported bounds error as an "Unreassembled Packet" or a "Malformed Packet" depending on whether "pinfo->fragmented" is set, and have NBNS and RPC use that. Add "ett_ndmp_file_stats" to the list of ett_ values to be initialized (it wasn't in that list, and wasn't getting initialized). When freeing up various hash tables and memory chunks in the RPC dissector, zero out the pointers to them, just to make sure we don't try to free them again. Always destroy the TCP segment key and address memory chunks in "tcp_desegment_init()", regardless of whether TCP desegmentation is enabled - we don't *allocate* them if TCP desegmentation isn't enabled, but we should free them even if it's not enabled. Also, when we free them, set the pointers to them to null, so we don't double-free them. Supply to subdissectors called from the TCP dissector the sequence number of the first byte handed to the sub dissector. svn path=/trunk/; revision=4753
2002-02-18 23:51:55 +00:00
void
show_reported_bounds_error(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
if (pinfo->fragmented) {
/*
* We were dissecting an unreassembled fragmented
* packet when the exception was thrown, so the
* problem isn't that the dissector expected
* something but it wasn't in the packet, the
* problem is that the dissector expected something
* but it wasn't in the fragment we dissected.
*/
if (check_col(pinfo->cinfo, COL_INFO))
From Didier Gautheron: provide a mechanism to indicate why reassembly wasn't done, and, for TCP, use that mechanism if reassembly isn't done is an incorrect TCP checksum. svn path=/trunk/; revision=7212
2003-02-27 03:56:48 +00:00
col_append_fstr(pinfo->cinfo, COL_INFO,
"[Unreassembled Packet%s]",
pinfo->noreassembly_reason);
Add support for reassembling RPC-over-TCP fragments, and do that in both RPC and NDMP. Show the RPC-over-TCP fragment header as a tree with bitfields below it. Add a routine to show a reported bounds error as an "Unreassembled Packet" or a "Malformed Packet" depending on whether "pinfo->fragmented" is set, and have NBNS and RPC use that. Add "ett_ndmp_file_stats" to the list of ett_ values to be initialized (it wasn't in that list, and wasn't getting initialized). When freeing up various hash tables and memory chunks in the RPC dissector, zero out the pointers to them, just to make sure we don't try to free them again. Always destroy the TCP segment key and address memory chunks in "tcp_desegment_init()", regardless of whether TCP desegmentation is enabled - we don't *allocate* them if TCP desegmentation isn't enabled, but we should free them even if it's not enabled. Also, when we free them, set the pointers to them to null, so we don't double-free them. Supply to subdissectors called from the TCP dissector the sequence number of the first byte handed to the sub dissector. svn path=/trunk/; revision=4753
2002-02-18 23:51:55 +00:00
proto_tree_add_protocol_format(tree, proto_unreassembled,
From Didier Gautheron: provide a mechanism to indicate why reassembly wasn't done, and, for TCP, use that mechanism if reassembly isn't done is an incorrect TCP checksum. svn path=/trunk/; revision=7212
2003-02-27 03:56:48 +00:00
tvb, 0, 0, "[Unreassembled Packet%s: %s]",
pinfo->noreassembly_reason, pinfo->current_proto);
Add support for reassembling RPC-over-TCP fragments, and do that in both RPC and NDMP. Show the RPC-over-TCP fragment header as a tree with bitfields below it. Add a routine to show a reported bounds error as an "Unreassembled Packet" or a "Malformed Packet" depending on whether "pinfo->fragmented" is set, and have NBNS and RPC use that. Add "ett_ndmp_file_stats" to the list of ett_ values to be initialized (it wasn't in that list, and wasn't getting initialized). When freeing up various hash tables and memory chunks in the RPC dissector, zero out the pointers to them, just to make sure we don't try to free them again. Always destroy the TCP segment key and address memory chunks in "tcp_desegment_init()", regardless of whether TCP desegmentation is enabled - we don't *allocate* them if TCP desegmentation isn't enabled, but we should free them even if it's not enabled. Also, when we free them, set the pointers to them to null, so we don't double-free them. Supply to subdissectors called from the TCP dissector the sequence number of the first byte handed to the sub dissector. svn path=/trunk/; revision=4753
2002-02-18 23:51:55 +00:00
} else {
if (check_col(pinfo->cinfo, COL_INFO))
col_append_str(pinfo->cinfo, COL_INFO,
"[Malformed Packet]");
proto_tree_add_protocol_format(tree, proto_malformed,
tvb, 0, 0, "[Malformed Packet: %s]", pinfo->current_proto);
}
}
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
void
proto_register_frame(void)
{
static hf_register_info hf[] = {
{ &hf_frame_arrival_time,
{ "Arrival Time", "frame.time", FT_ABSOLUTE_TIME, BASE_NONE, NULL, 0x0,
Attempt to prettify frame.time_relative and some other fields svn path=/trunk/; revision=8460
2003-09-12 04:52:55 +00:00
"Absolute time when this frame was captured", HFILL }},
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
{ &hf_frame_time_delta,
{ "Time delta from previous packet", "frame.time_delta", FT_RELATIVE_TIME, BASE_NONE, NULL,
0x0,
Attempt to prettify frame.time_relative and some other fields svn path=/trunk/; revision=8460
2003-09-12 04:52:55 +00:00
"Time delta since previous diplayed frame", HFILL }},
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Add the relative time to the frame tree, at the request of Manfred Young. svn path=/trunk/; revision=2762
2000-12-15 03:30:21 +00:00
{ &hf_frame_time_relative,
Attempt to prettify frame.time_relative and some other fields svn path=/trunk/; revision=8460
2003-09-12 04:52:55 +00:00
{ "Time since reference or first frame", "frame.time_relative", FT_RELATIVE_TIME, BASE_NONE, NULL,
Add the relative time to the frame tree, at the request of Manfred Young. svn path=/trunk/; revision=2762
2000-12-15 03:30:21 +00:00
0x0,
Attempt to prettify frame.time_relative and some other fields svn path=/trunk/; revision=8460
2003-09-12 04:52:55 +00:00
"Time relative reference or first frame", HFILL }},
Add the relative time to the frame tree, at the request of Manfred Young. svn path=/trunk/; revision=2762
2000-12-15 03:30:21 +00:00
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
{ &hf_frame_number,
{ "Frame Number", "frame.number", FT_UINT32, BASE_DEC, NULL, 0x0,
From Joerg Mayer: explicitly fill in all members of a "header_field_info" structure, including the ones that are later set by the routines to register fields. svn path=/trunk/; revision=3561
2001-06-18 02:18:27 +00:00
"", HFILL }},
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
{ &hf_frame_packet_len,
{ "Total Frame Length", "frame.pkt_len", FT_UINT32, BASE_DEC, NULL, 0x0,
From Joerg Mayer: explicitly fill in all members of a "header_field_info" structure, including the ones that are later set by the routines to register fields. svn path=/trunk/; revision=3561
2001-06-18 02:18:27 +00:00
"", HFILL }},
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
{ &hf_frame_capture_len,
{ "Capture Frame Length", "frame.cap_len", FT_UINT32, BASE_DEC, NULL, 0x0,
From Joerg Mayer: explicitly fill in all members of a "header_field_info" structure, including the ones that are later set by the routines to register fields. svn path=/trunk/; revision=3561
2001-06-18 02:18:27 +00:00
"", HFILL }},
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
{ &hf_frame_p2p_dir,
{ "Point-to-Point Direction", "frame.p2p_dir", FT_UINT8, BASE_DEC, VALS(p2p_dirs), 0x0,
From Joerg Mayer: explicitly fill in all members of a "header_field_info" structure, including the ones that are later set by the routines to register fields. svn path=/trunk/; revision=3561
2001-06-18 02:18:27 +00:00
"", HFILL }},
Add an option to show the File Offset of a frame. Not useful for general packet analyzing, but useful when developing wiretap code or other such low-level development. Default preference is *not* to show File Offset. svn path=/trunk/; revision=4120
2001-11-01 04:00:56 +00:00
{ &hf_frame_file_off,
{ "File Offset", "frame.file_off", FT_INT32, BASE_DEC, NULL, 0x0,
"", HFILL }},
From Didier Gautheron: add a "frame.marked" hidden field, set if the frame is marked, so that you can use Find Frame to find the next marked frame, and can filter the display to show only marked frames. Update the documentation to note that "frame.marked" is set on marked frames. svn path=/trunk/; revision=5377
2002-05-03 21:38:20 +00:00
{ &hf_frame_marked,
{ "Frame is marked", "frame.marked", FT_BOOLEAN, 8, NULL, 0x0,
"Frame is marked in the GUI", HFILL }},
Add filterable field for REF TIME frames so it is easy to search for them svn path=/trunk/; revision=8511
2003-09-22 09:06:10 +00:00
{ &hf_frame_ref_time,
{ "This is a Ref Time frame", "frame.ref_time", FT_NONE, 0, NULL, 0x0,
"This frame is a Reference Time frame", HFILL }},
Add a field called "frame.protocols" which shows the protocols present in the frame. The filter "frame.protocols contains ip:icmp:ip" could be used to find any ICMP packets containing IP headers. Clean up whitespace. svn path=/trunk/; revision=13118
2005-01-19 04:49:29 +00:00
{ &hf_frame_protocols,
{ "Protocols in frame", "frame.protocols", FT_STRING, 0, NULL, 0x0,
"Protocols carried by this frame", HFILL }},
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
};
static gint *ett[] = {
&ett_frame,
};
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
module_t *frame_module;
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Attach a descriptive name field type and base to dissector tables; that specifies how the selector values used as keys in those tables are to be displayed, and the title to use when displaying the table. Use that information in the code to display the initial and current entries of various dissector tables. Have the dissector for BACnet APDUs register itself by name, and have the BACnet NPDU dissector call it iff the BAC_CONTROL_NET bit isn't set, rather than doing it with a dissector table. svn path=/trunk/; revision=4358
2001-12-08 06:41:48 +00:00
wtap_encap_dissector_table = register_dissector_table("wtap_encap",
"Wiretap encapsulation type", FT_UINT32, BASE_DEC);
Wrap the dissect_fddi() call (with a 4th argument) with dissect_fddi_not_bitswapped() and dissect_fddi_bitswapped(), both of which use the standard 3-argument tvbuffified-dissector argument list. Add a dissector table called "wtap_encap" which is used to call dissectors from dissect_frame(). The switch() statement from this top-level dissector is removed. The link-layer dissectors register themselves with the "wtap_encap" dissector table. The dissectors are now static where possible. svn path=/trunk/; revision=2708
2000-11-29 05:16:15 +00:00
Have "proto_register_protocol()" build a list of data structures for protocols, in addition to adding structures to the list of filterable fields. Give it an extra argument that specifies a "short name" for the protocol, for use in such places as pinfo->current_proto; the dialog box for constructing filters; the preferences tab for the protocol; and so on (although we're not yet using it in all those places). Make the preference name that appears in the preferences file and the command line for the DIAMETER protocol "diameter", not "Diameter"; the convention is that the name in question be all-lower-case. Make some routines and variables that aren't exported static. Update a comment in the ICP dissector to make it clear that the dissector won't see fragments other than the first fragment of a fragmented datagram. svn path=/trunk/; revision=2810
2001-01-03 06:56:03 +00:00
proto_frame = proto_register_protocol("Frame", "Frame", "frame");
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
proto_register_field_array(proto_frame, hf, array_length(hf));
proto_register_subtree_array(ett, array_length(ett));
Added a register_dissector() call in packet-frame.c so that frame is now a registered dissector and can be called by call_dissector(). svn path=/trunk/; revision=3233
2001-04-01 21:12:05 +00:00
register_dissector("frame",dissect_frame,proto_frame);
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Have "proto_register_protocol()" build a list of data structures for protocols, in addition to adding structures to the list of filterable fields. Give it an extra argument that specifies a "short name" for the protocol, for use in such places as pinfo->current_proto; the dialog box for constructing filters; the preferences tab for the protocol; and so on (although we're not yet using it in all those places). Make the preference name that appears in the preferences file and the command line for the DIAMETER protocol "diameter", not "Diameter"; the convention is that the name in question be all-lower-case. Make some routines and variables that aren't exported static. Update a comment in the ICP dissector to make it clear that the dissector won't see fragments other than the first fragment of a fragmented datagram. svn path=/trunk/; revision=2810
2001-01-03 06:56:03 +00:00
/* You can't disable dissection of "Frame", as that would be
tantamount to not doing any dissection whatsoever. */
Apply the patches from Tadaaki Nagao for a global version of disabled protocols ... svn path=/trunk/; revision=9538
2004-01-03 18:40:08 +00:00
proto_set_cant_toggle(proto_frame);
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Have "proto_register_protocol()" build a list of data structures for protocols, in addition to adding structures to the list of filterable fields. Give it an extra argument that specifies a "short name" for the protocol, for use in such places as pinfo->current_proto; the dialog box for constructing filters; the preferences tab for the protocol; and so on (although we're not yet using it in all those places). Make the preference name that appears in the preferences file and the command line for the DIAMETER protocol "diameter", not "Diameter"; the convention is that the name in question be all-lower-case. Make some routines and variables that aren't exported static. Update a comment in the ICP dissector to make it clear that the dissector won't see fragments other than the first fragment of a fragmented datagram. svn path=/trunk/; revision=2810
2001-01-03 06:56:03 +00:00
proto_short = proto_register_protocol("Short Frame", "Short frame", "short");
If a ReportedBoundsError exception occurs, report it as a "malformed packet" rather than a "malformed frame" - the packet in question might be part of a link-layer frame or might span more than one link-layer frame. svn path=/trunk/; revision=4497
2002-01-08 07:17:55 +00:00
proto_malformed = proto_register_protocol("Malformed Packet",
"Malformed packet", "malformed");
Use the "fragmented" field of the "packet_info" structure in "dissect_frame()" to indicate whether a ReportedBoundsError was due to the packet being malformed (i.e., the packet was shorter than it's supposed to be, so the dissector went past the end trying to extract fields that were supposed to be there) or due to it not being reassembled (i.e., the packet was fragmented, and we didn't reassemble it, but just treated the first fragment as the entire packet, so the dissector went past the end trying to extract fields that were partially or completely in fragments after that). Mark the latter as being unreasembled rather than malformed. Properly initialize, save, and restore that field, and properly set it, so that works. svn path=/trunk/; revision=4555
2002-01-17 06:29:20 +00:00
proto_unreassembled = proto_register_protocol(
"Unreassembled Fragmented Packet",
"Unreassembled fragmented packet", "unreassembled");
Have "proto_register_protocol()" build a list of data structures for protocols, in addition to adding structures to the list of filterable fields. Give it an extra argument that specifies a "short name" for the protocol, for use in such places as pinfo->current_proto; the dialog box for constructing filters; the preferences tab for the protocol; and so on (although we're not yet using it in all those places). Make the preference name that appears in the preferences file and the command line for the DIAMETER protocol "diameter", not "Diameter"; the convention is that the name in question be all-lower-case. Make some routines and variables that aren't exported static. Update a comment in the ICP dissector to make it clear that the dissector won't see fragments other than the first fragment of a fragmented datagram. svn path=/trunk/; revision=2810
2001-01-03 06:56:03 +00:00
Use the "fragmented" field of the "packet_info" structure in "dissect_frame()" to indicate whether a ReportedBoundsError was due to the packet being malformed (i.e., the packet was shorter than it's supposed to be, so the dissector went past the end trying to extract fields that were supposed to be there) or due to it not being reassembled (i.e., the packet was fragmented, and we didn't reassemble it, but just treated the first fragment as the entire packet, so the dissector went past the end trying to extract fields that were partially or completely in fragments after that). Mark the latter as being unreasembled rather than malformed. Properly initialize, save, and restore that field, and properly set it, so that works. svn path=/trunk/; revision=4555
2002-01-17 06:29:20 +00:00
/* "Short Frame", "Malformed Packet", and "Unreassembled Fragmented
Packet" aren't really protocols, they're error indications;
disabling them makes no sense. */
Apply the patches from Tadaaki Nagao for a global version of disabled protocols ... svn path=/trunk/; revision=9538
2004-01-03 18:40:08 +00:00
proto_set_cant_toggle(proto_short);
proto_set_cant_toggle(proto_malformed);
proto_set_cant_toggle(proto_unreassembled);
Add an option to show the File Offset of a frame. Not useful for general packet analyzing, but useful when developing wiretap code or other such low-level development. Default preference is *not* to show File Offset. svn path=/trunk/; revision=4120
2001-11-01 04:00:56 +00:00
Clean up indentation. svn path=/trunk/; revision=4362
2001-12-08 21:03:41 +00:00
/* Our preferences */
frame_module = prefs_register_protocol(proto_frame, NULL);
prefs_register_bool_preference(frame_module, "show_file_off",
"Show File Offset", "Show File Offset", &show_file_off);
From Anand V. Narwani: DOCSIS support, including support for "Ethernet" captures where the raw frame is a DOCSIS frame rather than an Ethernet frame (some Cisco cable-modem head-end gear can send out a trace of all traffic on an Ethernet, but what it sends are the raw bytes of DOCSIS frames, not Ethernet frames) Get rid of second AUTHORS entry for Devin Heitmueller, merging its item into the older entry. Clean up the order of some lists of plugin items. svn path=/trunk/; revision=5861
2002-07-12 22:52:43 +00:00
prefs_register_bool_preference(frame_module, "force_docsis_encap",
"Treat all frames as DOCSIS frames", "Treat all frames as DOCSIS Frames", &force_docsis_encap);
Tap api. tap is a simple api that can be used for arbitrary extensions. One example extension is rpcstat. Try -Z rpc,rtt,100003,3 as argument to tethereal when reading a capture containing NFSv3 packets. tap-rpcstat.[ch] is intended to demonstrate the api and can be used to base other extensions on. svn path=/trunk/; revision=6175
2002-09-04 09:40:29 +00:00
frame_tap=register_tap("frame");
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
}
Added a proto_reg_handoff_frame() function and switched from using dissect_data() to using call_dissector() svn path=/trunk/; revision=4268
2001-11-26 01:23:59 +00:00
void
Clean up indentation. svn path=/trunk/; revision=4362
2001-12-08 21:03:41 +00:00
proto_reg_handoff_frame(void)
{
data_handle = find_dissector("data");
From Anand V. Narwani: DOCSIS support, including support for "Ethernet" captures where the raw frame is a DOCSIS frame rather than an Ethernet frame (some Cisco cable-modem head-end gear can send out a trace of all traffic on an Ethernet, but what it sends are the raw bytes of DOCSIS frames, not Ethernet frames) Get rid of second AUTHORS entry for Devin Heitmueller, merging its item into the older entry. Clean up the order of some lists of plugin items. svn path=/trunk/; revision=5861
2002-07-12 22:52:43 +00:00
docsis_handle = find_dissector("docsis");
From LEGO if Mate is pressent call it. svn path=/trunk/; revision=12615
2004-11-28 20:52:52 +00:00
mate_handle = find_dissector("mate");
Added a proto_reg_handoff_frame() function and switched from using dissect_data() to using call_dissector() svn path=/trunk/; revision=4268
2001-11-26 01:23:59 +00:00
}