osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity
wireshark/epan/dissectors/packet-frame.c

848 lines
30 KiB
C
Raw Normal View History

Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
/* packet-frame.c
*
* Top-most dissector. Decides dissector based on Wiretap Encapsulation Type.
*
Set the svn:eol-style property on all text files to "native", so that they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-07-18 00:24:25 +00:00
* $Id$
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
*
change a whole bunch of ethereal into wireshark svn path=/trunk/; revision=18196
2006-05-21 04:49:01 +00:00
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
* Copyright 2000 Gerald Combs
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
*
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
*
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
*
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
Update Free Software Foundation address. (COPYING will be updated in next commit) svn path=/trunk/; revision=43536
2012-06-28 22:56:06 +00:00
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
*/
We always HAVE_CONFIG_H so don't bother checking whether we have it or not. svn path=/trunk/; revision=45017
2012-09-20 02:03:38 +00:00
#include "config.h"
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Windows build: #include winsock2.h only when needed. #include winsock2.h pulls in about 90 distinct .h files and about 140 total .h files. Currently winsock2.h is (mostly unnecessarily) included for each dissector via packet.h/wtap.h. This patch removes #include winsock2.h from wtap.h and then includes winsock2.h (or windows.h) in the few specific places required. With this patch, my Windows Wireshark build takes about 30% less time. svn path=/trunk/; revision=26535
2008-10-24 00:42:09 +00:00
#ifdef _MSC_VER
#include <windows.h>
#endif
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
#include <glib.h>
Include files from the "epan" directory and subdirectories thereof with "epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
2002-01-21 07:37:49 +00:00
#include <epan/packet.h>
Move show_exception() and show_reported_bounds_error() to epan/show_exception.c, as it's used outside epan/dissectors/packet-frame.c. Update their callers to include <epan/show_exception.h> to get their declaration. Add a CATCH_NONFATAL_ERRORS macro that catches all exceptions that, if there's more stuff in the packet to dissect after the dissector call that threw the exception, doesn't mean you shouldn't go ahead and dissect that stuff. Use it in all those cases, including ones where BoundsError was inappropriately being caught (you want those passed up to the top level, so that the packet is reported as having been cut short in the capture process). Add a CATCH_BOUNDS_ERRORS macro that catches all exceptions that correspond to running past the end of the data for a tvbuff; use it rather than explicitly catching those exceptions individually, and rather than just catching all exceptions (the only place that DissectorError should be caught, for example, is at the top level, so dissector bugs show up in the protocol tree). Don't catch and then immediately rethrow exceptions without doing anything else; just let the exceptions go up to the final catcher. Use show_exception() to report non-fatal errors, rather than doing it yourself. If a dissector is called from Lua, catch all non-fatal errors and use show_exception() to report them rather than catching only ReportedBoundsError and adding a proto_malformed item. Don't catch exceptions when constructing a trailer tvbuff in packet-ieee8023.c - just construct it after the payload has been dissected, and let whatever exceptions that throws be handled at the top level. Avoid some TRY/CATCH/ENDTRY cases by using checks such as tvb_bytes_exist() before even looking in the tvbuff. svn path=/trunk/; revision=47924
2013-02-27 22:43:54 +00:00
#include <epan/show_exception.h>
Include files from the "epan" directory and subdirectories thereof with "epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
2002-01-21 07:37:49 +00:00
#include <epan/timestamp.h>
Move prefs.c and prefs.h into the epan subdirectory. svn path=/trunk/; revision=12115
2004-09-27 22:55:15 +00:00
#include <epan/prefs.h>
Move the tap infrastructure to the epan directory. svn path=/trunk/; revision=12128
2004-09-29 00:06:36 +00:00
#include <epan/tap.h>
I'm adding the "Expert Info" prototype now, as it seems to be in a state where others might have a look and probably already find it useful :-). Anyway, we can easily disable it at one or two places in the code if it get's in our way of a new release. Please see: http://wiki.ethereal.com/Development/ExpertInfo for a complete overview of the intended feature and it's current state of implementation. While I'm working on this, I've also added some more status result codes to the DCE/RPC and DCOM dissectors. svn path=/trunk/; revision=15754
2005-09-11 16:55:34 +00:00
#include <epan/expert.h>
Rename crypt-xxx to xxx svn path=/trunk/; revision=40511
2012-01-15 12:29:44 +00:00
#include <epan/crypt/md5.h>
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Move show_exception() and show_reported_bounds_error() to epan/show_exception.c, as it's used outside epan/dissectors/packet-frame.c. Update their callers to include <epan/show_exception.h> to get their declaration. Add a CATCH_NONFATAL_ERRORS macro that catches all exceptions that, if there's more stuff in the packet to dissect after the dissector call that threw the exception, doesn't mean you shouldn't go ahead and dissect that stuff. Use it in all those cases, including ones where BoundsError was inappropriately being caught (you want those passed up to the top level, so that the packet is reported as having been cut short in the capture process). Add a CATCH_BOUNDS_ERRORS macro that catches all exceptions that correspond to running past the end of the data for a tvbuff; use it rather than explicitly catching those exceptions individually, and rather than just catching all exceptions (the only place that DissectorError should be caught, for example, is at the top level, so dissector bugs show up in the protocol tree). Don't catch and then immediately rethrow exceptions without doing anything else; just let the exceptions go up to the final catcher. Use show_exception() to report non-fatal errors, rather than doing it yourself. If a dissector is called from Lua, catch all non-fatal errors and use show_exception() to report them rather than catching only ReportedBoundsError and adding a proto_malformed item. Don't catch exceptions when constructing a trailer tvbuff in packet-ieee8023.c - just construct it after the payload has been dissected, and let whatever exceptions that throws be handled at the top level. Avoid some TRY/CATCH/ENDTRY cases by using checks such as tvb_bytes_exist() before even looking in the tvbuff. svn path=/trunk/; revision=47924
2013-02-27 22:43:54 +00:00
#include "packet-frame.h"
add matched coloring rule name and string to the frame dissector output (or nothing if no coloring rule matched or none was set) svn path=/trunk/; revision=17068
2006-01-21 17:49:00 +00:00
#include "color.h"
#include "color_filters.h"
Add the ability to print packet dissections in PDML (an XML-based format) to tethereal. It could be added to Ethereal, but the GUI changes to allow the user to select PDML as a print format have not been added. Provide a python module (EtherealXML.py) to help parse PDML. Provide a sample app (msnchat) which uses tethereal and EtherealXML.py to reconstruct MSN Chat sessions from packet capture files. It produces a nice HTML report of the chat sessions. Document tethereal's PDML and EtherealXML.py usage in doc/README.xml-output Update tethereal's manpage to reflect the new [-T pdml|ps|text] option svn path=/trunk/; revision=9180
2003-12-06 06:09:13 +00:00
int proto_frame = -1;
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
int proto_pkt_comment = -1;
Add the ability to print packet dissections in PDML (an XML-based format) to tethereal. It could be added to Ethereal, but the GUI changes to allow the user to select PDML as a print format have not been added. Provide a python module (EtherealXML.py) to help parse PDML. Provide a sample app (msnchat) which uses tethereal and EtherealXML.py to reconstruct MSN Chat sessions from packet capture files. It produces a nice HTML report of the chat sessions. Document tethereal's PDML and EtherealXML.py usage in doc/README.xml-output Update tethereal's manpage to reflect the new [-T pdml|ps|text] option svn path=/trunk/; revision=9180
2003-12-06 06:09:13 +00:00
int hf_frame_arrival_time = -1;
From Edwin Groothuis via bug 6179: Added Time Shift functionality. From me: Renamed to use "Time Shift" everywhere + some other minor cleanups. svn path=/trunk/; revision=38510
2011-08-13 17:39:38 +00:00
int hf_frame_shift_offset = -1;
From enhancement bug #4272: Patch to add new filterable field - frame.time_epoch svn path=/trunk/; revision=31110
2009-11-29 09:26:01 +00:00
int hf_frame_arrival_time_epoch = -1;
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
static int hf_frame_time_delta = -1;
From Sake Blok: Fix for bug #491: Unexpected frame.time_delta behavior This patch ... fixes bug 491. It does this by changing the behaviour of the frame.time_delta field so it reflects the delta time between captured packets (tshark already did this). To keep the delta time between displayed packets, the field frame.time_delta_displayed is created. svn path=/trunk/; revision=21154
2007-03-23 18:08:17 +00:00
static int hf_frame_time_delta_displayed = -1;
Add the relative time to the frame tree, at the request of Manfred Young. svn path=/trunk/; revision=2762
2000-12-15 03:30:21 +00:00
static int hf_frame_time_relative = -1;
Group time related fields. Drop packet length in favor of frame length. Clean up code / indentations / header fields. Improve docsis preference description. svn path=/trunk/; revision=27329
2009-01-29 22:43:49 +00:00
static int hf_frame_time_reference = -1;
Add the ability to print packet dissections in PDML (an XML-based format) to tethereal. It could be added to Ethereal, but the GUI changes to allow the user to select PDML as a print format have not been added. Provide a python module (EtherealXML.py) to help parse PDML. Provide a sample app (msnchat) which uses tethereal and EtherealXML.py to reconstruct MSN Chat sessions from packet capture files. It produces a nice HTML report of the chat sessions. Document tethereal's PDML and EtherealXML.py usage in doc/README.xml-output Update tethereal's manpage to reflect the new [-T pdml|ps|text] option svn path=/trunk/; revision=9180
2003-12-06 06:09:13 +00:00
int hf_frame_number = -1;
Change frame dissector to show "frame" instead of "packet" for all fields for consistency. The frame.pkt_len filter is now deprecated, but still supported as a hidden field for an easy transition. The new field name is frame.len. svn path=/trunk/; revision=20519
2007-01-21 23:02:07 +00:00
int hf_frame_len = -1;
Add the ability to print packet dissections in PDML (an XML-based format) to tethereal. It could be added to Ethereal, but the GUI changes to allow the user to select PDML as a print format have not been added. Provide a python module (EtherealXML.py) to help parse PDML. Provide a sample app (msnchat) which uses tethereal and EtherealXML.py to reconstruct MSN Chat sessions from packet capture files. It produces a nice HTML report of the chat sessions. Document tethereal's PDML and EtherealXML.py usage in doc/README.xml-output Update tethereal's manpage to reflect the new [-T pdml|ps|text] option svn path=/trunk/; revision=9180
2003-12-06 06:09:13 +00:00
int hf_frame_capture_len = -1;
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
static int hf_frame_p2p_dir = -1;
Add an option to show the File Offset of a frame. Not useful for general packet analyzing, but useful when developing wiretap code or other such low-level development. Default preference is *not* to show File Offset. svn path=/trunk/; revision=4120
2001-11-01 04:00:56 +00:00
static int hf_frame_file_off = -1;
From Jim Young: The attached patch augments the epan/dissectors/packet-frame.c module to optionally generate MD5 hashes of each packet. These MD5 hashes are calculated in the same manner as the MD5 hash used for duplicate packet removal by the editcap utility. The ability to generate the MD5 hashes can be enabled or disabled by a new boolean preferences option: frame.generate_md5_hash. By default MD5 hash generation is disabled. To help identify frames with matching MD5 hashes this patch also includes a new display filter: frame.md5_hash. svn path=/trunk/; revision=27150
2009-01-04 12:08:17 +00:00
static int hf_frame_md5_hash = -1;
From Didier Gautheron: add a "frame.marked" hidden field, set if the frame is marked, so that you can use Find Frame to find the next marked frame, and can filter the display to show only marked frames. Update the documentation to note that "frame.marked" is set on marked frames. svn path=/trunk/; revision=5377
2002-05-03 21:38:20 +00:00
static int hf_frame_marked = -1;
Introduce "Ignore Packet" in the packet list. This will remove the package from the dissection functions without removing it from the capture file. svn path=/trunk/; revision=31287
2009-12-17 01:18:14 +00:00
static int hf_frame_ignored = -1;
- Add support for libpcap files for MTP2 with a per packet header indicating the direction, narrowband/broadband, and interface number. - Add support to display the direction and interface number. - Add support to packet-mtp2.c to use the broadband/narrowband indication. svn path=/trunk/; revision=14265
2005-05-02 14:07:33 +00:00
static int hf_link_number = -1;
Add a field called "frame.protocols" which shows the protocols present in the frame. The filter "frame.protocols contains ip:icmp:ip" could be used to find any ICMP packets containing IP headers. Clean up whitespace. svn path=/trunk/; revision=13118
2005-01-19 04:49:29 +00:00
static int hf_frame_protocols = -1;
add matched coloring rule name and string to the frame dissector output (or nothing if no coloring rule matched or none was set) svn path=/trunk/; revision=17068
2006-01-21 17:49:00 +00:00
static int hf_frame_color_filter_name = -1;
static int hf_frame_color_filter_text = -1;
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
static int hf_frame_interface_id = -1;
Add support for displaying the Packet Block Flags Word of pcapng. svn path=/trunk/; revision=46698
2012-12-22 19:48:17 +00:00
static int hf_frame_pack_flags = -1;
static int hf_frame_pack_direction = -1;
static int hf_frame_pack_reception_type = -1;
static int hf_frame_pack_fcs_length = -1;
static int hf_frame_pack_reserved = -1;
static int hf_frame_pack_crc_error = -1;
static int hf_frame_pack_wrong_packet_too_long_error = -1;
static int hf_frame_pack_wrong_packet_too_short_error = -1;
static int hf_frame_pack_wrong_inter_frame_gap_error = -1;
static int hf_frame_pack_unaligned_frame_error = -1;
static int hf_frame_pack_start_frame_delimiter_error = -1;
static int hf_frame_pack_preamble_error = -1;
static int hf_frame_pack_symbol_error = -1;
Show WIRETAP_ENC svn path=/trunk/; revision=42126
2012-04-18 08:26:08 +00:00
static int hf_frame_wtap_encap = -1;
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
static int hf_comments_text = -1;
- Use the key for comparison of per_proto_data. - Show the number of per-packet-data entries and which protocol has made entries in the frame. svn path=/trunk/; revision=49313
2013-05-15 16:50:37 +00:00
static int hf_frame_num_p_prot_data = -1;
From Didier Gautheron: add a "frame.marked" hidden field, set if the frame is marked, so that you can use Find Frame to find the next marked frame, and can filter the display to show only marked frames. Update the documentation to note that "frame.marked" is set on marked frames. svn path=/trunk/; revision=5377
2002-05-03 21:38:20 +00:00
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
static gint ett_frame = -1;
Add support for displaying the Packet Block Flags Word of pcapng. svn path=/trunk/; revision=46698
2012-12-22 19:48:17 +00:00
static gint ett_flags = -1;
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
static gint ett_comments = -1;
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Batch of filterable expert infos. svn path=/trunk/; revision=49584
2013-05-26 03:29:07 +00:00
static expert_field ei_comments_text = EI_INIT;
static expert_field ei_arrive_time_out_of_range = EI_INIT;
Tap api. tap is a simple api that can be used for arbitrary extensions. One example extension is rpcstat. Try -Z rpc,rtt,100003,3 as argument to tethereal when reading a capture containing NFSv3 packets. tap-rpcstat.[ch] is intended to demonstrate the api and can be used to base other extensions on. svn path=/trunk/; revision=6175
2002-09-04 09:40:29 +00:00
static int frame_tap = -1;
Added a proto_reg_handoff_frame() function and switched from using dissect_data() to using call_dissector() svn path=/trunk/; revision=4268
2001-11-26 01:23:59 +00:00
static dissector_handle_t data_handle;
From Anand V. Narwani: DOCSIS support, including support for "Ethernet" captures where the raw frame is a DOCSIS frame rather than an Ethernet frame (some Cisco cable-modem head-end gear can send out a trace of all traffic on an Ethernet, but what it sends are the raw bytes of DOCSIS frames, not Ethernet frames) Get rid of second AUTHORS entry for Devin Heitmueller, merging its item into the older entry. Clean up the order of some lists of plugin items. svn path=/trunk/; revision=5861
2002-07-12 22:52:43 +00:00
static dissector_handle_t docsis_handle;
Added a proto_reg_handoff_frame() function and switched from using dissect_data() to using call_dissector() svn path=/trunk/; revision=4268
2001-11-26 01:23:59 +00:00
Add an option to show the File Offset of a frame. Not useful for general packet analyzing, but useful when developing wiretap code or other such low-level development. Default preference is *not* to show File Offset. svn path=/trunk/; revision=4120
2001-11-01 04:00:56 +00:00
/* Preferences */
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
static gboolean show_file_off = FALSE;
static gboolean force_docsis_encap = FALSE;
static gboolean generate_md5_hash = FALSE;
From enhancement bug #4272: Patch to add new filterable field - frame.time_epoch svn path=/trunk/; revision=31110
2009-11-29 09:26:01 +00:00
static gboolean generate_epoch_time = TRUE;
From Edwin Groothuis via bug #5833: Make number of bits in Frame header optional svn path=/trunk/; revision=36652
2011-04-15 17:53:23 +00:00
static gboolean generate_bits_field = TRUE;
Add an option to show the File Offset of a frame. Not useful for general packet analyzing, but useful when developing wiretap code or other such low-level development. Default preference is *not* to show File Offset. svn path=/trunk/; revision=4120
2001-11-01 04:00:56 +00:00
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
static const value_string p2p_dirs[] = {
Add support for reading Apple's Bluetooth PacketLogger capture files to wiretap. Modify various other locations to accommodate the fact that PacketLogger files do not specify the direction of packets. svn path=/trunk/; revision=27463
2009-02-16 07:24:04 +00:00
{ P2P_DIR_UNKNOWN, "Unknown" },
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
{ P2P_DIR_SENT, "Sent" },
{ P2P_DIR_RECV, "Received" },
{ 0, NULL }
};
Wrap the dissect_fddi() call (with a 4th argument) with dissect_fddi_not_bitswapped() and dissect_fddi_bitswapped(), both of which use the standard 3-argument tvbuffified-dissector argument list. Add a dissector table called "wtap_encap" which is used to call dissectors from dissect_frame(). The switch() statement from this top-level dissector is removed. The link-layer dissectors register themselves with the "wtap_encap" dissector table. The dissectors are now static where possible. svn path=/trunk/; revision=2708
2000-11-29 05:16:15 +00:00
Add support for displaying the Packet Block Flags Word of pcapng. svn path=/trunk/; revision=46698
2012-12-22 19:48:17 +00:00
#define PACKET_WORD_DIRECTION_MASK 0x00000003
#define PACKET_WORD_RECEPTION_TYPE_MASK 0x0000001C
#define PACKET_WORD_FCS_LENGTH_MASK 0x000001E0
#define PACKET_WORD_RESERVED_MASK 0x0000FE00
#define PACKET_WORD_CRC_ERR_MASK 0x01000000
#define PACKET_WORD_PACKET_TOO_LONG_ERR_MASK 0x02000000
#define PACKET_WORD_PACKET_TOO_SHORT_ERR_MASK 0x04000000
#define PACKET_WORD_WRONG_INTER_FRAME_GAP_ERR_MASK 0x08000000
#define PACKET_WORD_UNALIGNED_FRAME_ERR_MASK 0x10000000
#define PACKET_WORD_START_FRAME_DELIMITER_ERR_MASK 0x20000000
#define PACKET_WORD_PREAMBLE_ERR_MASK 0x40000000
#define PACKET_WORD_SYMBOL_ERR_MASK 0x80000000
static const value_string packet_word_directions[] = {
{ 0x00, "Not available" },
{ 0x01, "Inbound" },
{ 0x02, "Outbound" },
{ 0x03, "Undefined" },
{ 0, NULL }
};
static const value_string packet_word_reception_types[] = {
{ 0x00, "Not specified" },
{ 0x01, "Unicast" },
{ 0x02, "Multicast" },
{ 0x03, "Broadcast" },
{ 0x04, "Promiscuous" },
{ 0x05, "Undefined" },
{ 0x06, "Undefined" },
{ 0x07, "Undefined" },
{ 0, NULL }
};
Add support for PPI (the Per-Packet Information header), described at http://www.cacetech.com/documents/PPI_Header_format_1.0.pdf . svn path=/trunk/; revision=22094
2007-06-13 22:36:58 +00:00
dissector_table_t wtap_encap_dissector_table;
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
Clarify the description of frame.time_delta. This partially addresses bug 491. svn path=/trunk/; revision=20870
2007-02-20 01:32:14 +00:00
/*
From Stig B Patch for COTP reassembly. There does not seem to be any reasonable or cleaner way to fix COTP reassembly than adding the frame.[ch] patch. svn path=/trunk/; revision=16813
2005-12-16 00:32:12 +00:00
* Routine used to register frame end routine. The routine should only
(Trivial) Fix two typos. svn path=/trunk/; revision=29271
2009-08-03 14:17:31 +00:00
* be registered when the dissector is used in the frame, not in the
From Stig B Patch for COTP reassembly. There does not seem to be any reasonable or cleaner way to fix COTP reassembly than adding the frame.[ch] patch. svn path=/trunk/; revision=16813
2005-12-16 00:32:12 +00:00
* proto_register_XXX function.
*/
void
MT: move global frame_end_routines to packet_info. svn path=/trunk/; revision=44748
2012-09-03 12:00:40 +00:00
register_frame_end_routine(packet_info *pinfo, void (*func)(void))
From Stig B Patch for COTP reassembly. There does not seem to be any reasonable or cleaner way to fix COTP reassembly than adding the frame.[ch] patch. svn path=/trunk/; revision=16813
2005-12-16 00:32:12 +00:00
{
MT: move global frame_end_routines to packet_info. svn path=/trunk/; revision=44748
2012-09-03 12:00:40 +00:00
pinfo->frame_end_routines = g_slist_append(pinfo->frame_end_routines, (gpointer)func);
From Stig B Patch for COTP reassembly. There does not seem to be any reasonable or cleaner way to fix COTP reassembly than adding the frame.[ch] patch. svn path=/trunk/; revision=16813
2005-12-16 00:32:12 +00:00
}
typedef void (*void_func_t)(void);
static void
call_frame_end_routine(gpointer routine, gpointer dummy _U_)
{
void_func_t func = (void_func_t)routine;
(*func)();
}
More static-ization. svn path=/trunk/; revision=5131
2002-04-08 20:30:56 +00:00
static void
Major speed improvement for filtering and dissection. It should not dump core as far as all my tests are concerned and Menu_Statistics/ProtocolHierStats work It needs more testing and there might still be cases where it will crash that will need to be fixed but I feel it will be worth it since it will decrease the time to filter very large capture files dramatically. Real significant performance boost for very large captures. (If we cant fix all the problems we can just revert this patch) svn path=/trunk/; revision=14051
2005-04-11 08:43:51 +00:00
dissect_frame(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
{
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
proto_item *volatile ti = NULL, *comment_item;
guint cap_len = 0, frame_len = 0;
proto_tree *volatile tree;
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
proto_tree *comments_tree;
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
proto_item *item;
Do some constifying [or other] based upon gcc -Wwrite-strings warnings. svn path=/trunk/; revision=33198
2010-06-09 18:12:17 +00:00
const gchar *cap_plurality, *frame_plurality;
Major speed improvement for filtering and dissection. It should not dump core as far as all my tests are concerned and Menu_Statistics/ProtocolHierStats work It needs more testing and there might still be cases where it will crash that will need to be fixed but I feel it will be worth it since it will decrease the time to filter very large capture files dramatically. Real significant performance boost for very large captures. (If we cant fix all the problems we can just revert this patch) svn path=/trunk/; revision=14051
2005-04-11 08:43:51 +00:00
tree=parent_tree;
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
pinfo->current_proto = "Frame";
"pinfo->pseudo_header" might be null, even for link-layer types such as WTAP_ENCAP_CHDLC; check whether it's null before using it. Use FROM_DCE rather than 0x80 to check the "this is DCE->DTE" bit in "x25.flags". svn path=/trunk/; revision=5148
2002-04-13 00:02:55 +00:00
if (pinfo->pseudo_header != NULL) {
switch (pinfo->fd->lnk_t) {
Add support for Wellfleet HDLC. It now can see inside the packets and handles the capture I was sent as a bunch of TCP segments containing LPD stuff. svn path=/trunk/; revision=6810
2002-12-20 07:56:07 +00:00
case WTAP_ENCAP_WFLEET_HDLC:
Add a new WTAP_ENCAP_CHDLC_WITH_PHDR type, to distinguish Cisco HDLC captures with packet direction information from captures without it. Use them appropriately. svn path=/trunk/; revision=8780
2003-10-25 07:17:28 +00:00
case WTAP_ENCAP_CHDLC_WITH_PHDR:
"pinfo->pseudo_header" might be null, even for link-layer types such as WTAP_ENCAP_CHDLC; check whether it's null before using it. Use FROM_DCE rather than 0x80 to check the "this is DCE->DTE" bit in "x25.flags". svn path=/trunk/; revision=5148
2002-04-13 00:02:55 +00:00
case WTAP_ENCAP_PPP_WITH_PHDR:
Handle packet direction information for SDLC Sniffer captures. Add a bunch of capture types discovered by stuffing them into Windows Sniffer captures and seeing what a Sniffer thought they were. Add support for writing at least some of them. svn path=/trunk/; revision=7265
2003-03-03 23:29:59 +00:00
case WTAP_ENCAP_SDLC:
From Paolo Abeni via bug 1751: http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1751 The patch adds support to wiretap for a new libpcap DLT for bluetooth captures. This DLT carries the direction information, which now can be displayed correctly. The hci H4 dissector is updated to handle also the newly introduced wtap encap. svn path=/trunk/; revision=23208
2007-10-16 17:19:16 +00:00
case WTAP_ENCAP_BLUETOOTH_H4_WITH_PHDR:
"pinfo->pseudo_header" might be null, even for link-layer types such as WTAP_ENCAP_CHDLC; check whether it's null before using it. Use FROM_DCE rather than 0x80 to check the "this is DCE->DTE" bit in "x25.flags". svn path=/trunk/; revision=5148
2002-04-13 00:02:55 +00:00
pinfo->p2p_dir = pinfo->pseudo_header->p2p.sent ?
P2P_DIR_SENT : P2P_DIR_RECV;
break;
From Shane Kearns (bug 2237): Added support for Symbian OS btsnoop. The bluetooth HCI layer in Symbian OS can be configured to log all packets to a file. The log format, "btsnoop" is based on the RFC1761 "snoop" format - but differences in the header make it incompatible. The btsnoop format supports logging of these formats: "H1" (raw HCI packets without framing) "H4" (HCI UART packets including packet type header) "H5" (HCI 3 wire UART packets including framing) "BCSP" (HCI bluecore serial protocol including framing) "H1" and "H4" are section numbers in the original v1 bluetooth specifications, but still used colloquially - wireshark's existing support for Linux bluez HCI logs uses the "H4" name. In practice, the "H1" format is used for H5,BCSP and USB HCI logs, as the HCI packet logs are mainly useful for debugging higher layers, bluetooth profiles and bluetooth applications. From me: Deleted some unused prototypes. Mark an unused parameter. svn path=/trunk/; revision=24263
2008-02-03 21:11:53 +00:00
case WTAP_ENCAP_BLUETOOTH_HCI:
Add support for reading Apple's Bluetooth PacketLogger capture files to wiretap. Modify various other locations to accommodate the fact that PacketLogger files do not specify the direction of packets. svn path=/trunk/; revision=27463
2009-02-16 07:24:04 +00:00
pinfo->p2p_dir = pinfo->pseudo_header->bthci.sent;
From Shane Kearns (bug 2237): Added support for Symbian OS btsnoop. The bluetooth HCI layer in Symbian OS can be configured to log all packets to a file. The log format, "btsnoop" is based on the RFC1761 "snoop" format - but differences in the header make it incompatible. The btsnoop format supports logging of these formats: "H1" (raw HCI packets without framing) "H4" (HCI UART packets including packet type header) "H5" (HCI 3 wire UART packets including framing) "BCSP" (HCI bluecore serial protocol including framing) "H1" and "H4" are section numbers in the original v1 bluetooth specifications, but still used colloquially - wireshark's existing support for Linux bluez HCI logs uses the "H4" name. In practice, the "H1" format is used for H5,BCSP and USB HCI logs, as the HCI packet logs are mainly useful for debugging higher layers, bluetooth profiles and bluetooth applications. From me: Deleted some unused prototypes. Mark an unused parameter. svn path=/trunk/; revision=24263
2008-02-03 21:11:53 +00:00
break;
"pinfo->pseudo_header" might be null, even for link-layer types such as WTAP_ENCAP_CHDLC; check whether it's null before using it. Use FROM_DCE rather than 0x80 to check the "this is DCE->DTE" bit in "x25.flags". svn path=/trunk/; revision=5148
2002-04-13 00:02:55 +00:00
case WTAP_ENCAP_LAPB:
Add WTAP_ENCAP_FRELAY_WITH_PHDR for use with Frame Relay capture files that have direction information. Support writing WTAP_ENCAP_FRELAY_WITH_PHDR and WTAP_ENCAP_PPP_WITH_PHDR captures out in libpcap format - we throw away the direction information, but so it goes. When reading/writing Windows Sniffer format, read and write the direction flag. svn path=/trunk/; revision=7052
2003-01-31 01:02:14 +00:00
case WTAP_ENCAP_FRELAY_WITH_PHDR:
"pinfo->pseudo_header" might be null, even for link-layer types such as WTAP_ENCAP_CHDLC; check whether it's null before using it. Use FROM_DCE rather than 0x80 to check the "this is DCE->DTE" bit in "x25.flags". svn path=/trunk/; revision=5148
2002-04-13 00:02:55 +00:00
pinfo->p2p_dir =
(pinfo->pseudo_header->x25.flags & FROM_DCE) ?
P2P_DIR_RECV : P2P_DIR_SENT;
break;
Discard the WTAP_ENCAP_LAPD encapsulation type in favor of a WTAP_ENCAP_ISDN encapsulation type, which includes a pseudo-header giving the direction (user-to-network or network-to-user) and the channel number. Add a new circuit type, using the ISDN channel number as the circuit ID. Add an ISDN dissector to put the direction and channel number into the protocol tree and to call the appropriate dissector for the payload based on the channel (LAPD for the D channel; V.120, PPP, or data for B channels, based on some heuristics). svn path=/trunk/; revision=6521
2002-10-31 07:12:42 +00:00
case WTAP_ENCAP_ISDN:
From Rolf Fiedler: Patch to add V5.2 tracing capability on E1 links using EyeSDN probes. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7027 Removed preference related stufff as it's not needed. svn path=/trunk/; revision=41915
2012-04-04 07:33:39 +00:00
case WTAP_ENCAP_V5_EF:
case WTAP_ENCAP_DPNSS:
Indicate where BACnet MS/TP is specified. Add a new WTAP_ENCAP_BACNET_MS_TP_WITH_PHDR encapsulation type, for use by the EyeSDN file reader; unlike the pcap-encapsulated MS/TP, it includes a direction indicator. Don't treat WTAP_ENCAP_BACNET_MS_TP as if it has a direction indicator, as it doesn't; instead, do that for WTAP_ENCAP_BACNET_MS_TP_WITH_PHDR. Add some missing entries to encap_table_base for WTAP_ENCAP_ values that didn't get entries added. svn path=/trunk/; revision=41969
2012-04-06 03:42:32 +00:00
case WTAP_ENCAP_BACNET_MS_TP_WITH_PHDR:
Discard the WTAP_ENCAP_LAPD encapsulation type in favor of a WTAP_ENCAP_ISDN encapsulation type, which includes a pseudo-header giving the direction (user-to-network or network-to-user) and the channel number. Add a new circuit type, using the ISDN channel number as the circuit ID. Add an ISDN dissector to put the direction and channel number into the protocol tree and to call the appropriate dissector for the payload based on the channel (LAPD for the D channel; V.120, PPP, or data for B channels, based on some heuristics). svn path=/trunk/; revision=6521
2002-10-31 07:12:42 +00:00
pinfo->p2p_dir = pinfo->pseudo_header->isdn.uton ?
P2P_DIR_SENT : P2P_DIR_RECV;
break;
from Daniele Orlandi: The attached patch adds support for LAPD frames captured using vISDN thru libpcap. The support has already been included in libpcap. The patch adds a new wiretap encapsulation, the necessary glue to decode SLL-encapsulated frames, and some minor change in the LAPD dissector in order to support the remote-to-remote frames captured on the ISDN E-Channel. Please apply ethereal-encap-table.diff before, as it fixes a misalignment in the encapsulation names table. svn path=/trunk/; revision=17451
2006-03-02 21:29:15 +00:00
case WTAP_ENCAP_LINUX_LAPD:
pinfo->p2p_dir = (pinfo->pseudo_header->lapd.pkttype == 3 ||
pinfo->pseudo_header->lapd.pkttype == 4) ?
P2P_DIR_SENT : P2P_DIR_RECV;
break;
- Add support for libpcap files for MTP2 with a per packet header indicating the direction, narrowband/broadband, and interface number. - Add support to display the direction and interface number. - Add support to packet-mtp2.c to use the broadband/narrowband indication. svn path=/trunk/; revision=14265
2005-05-02 14:07:33 +00:00
case WTAP_ENCAP_MTP2_WITH_PHDR:
pinfo->p2p_dir = pinfo->pseudo_header->mtp2.sent ?
P2P_DIR_SENT : P2P_DIR_RECV;
pinfo->link_number = pinfo->pseudo_header->mtp2.link_number;
From Stephen Donnelly of Endace: The code for reading ERF files has not been significantly updated since 2004. This patch brings it up to date with a number of changes. 1) Increase number of decodable ERF types from 7 to 12. This covers newer DAG card models and firmware updates. 2) Fix timestamp conversion. Was calculating only microsecond precision, now displaying with nanosecond resolution. Hardware precision is 7.5 to 30 ns depending on model. 3) Allow the user to specify HDLC encapsulation as 'chdlc', 'ppp_serial', 'frelay' or 'mtp2'. This is needed because the ERF HDLC capture formats do not include information on what protocol is used at the next level. This is currently done via an environment variable 'ERF_HDLC_ENCAP' and is analagous to the existing 'ERF_ATM_ENCAP' variable. If the user does not specify an HDLC encapsulation it tries to guess, and falls back to MTP2 for backwards compatibility with Florent's existing behaviour. I know environment variables are ugly, suggestions are welcome. 4) When reading HDLC captures as MTP2, use WTAP_ENCAP_MTP2_WITH_PHDR rather than WTAP_ENCAP_MTP2. This allows us to put the 'Multi-Channel ERF' record 'channel number' field into the MTP2 pseudo header > 'link_number' field. This is then displayed in Frame information, and can be filtered on. (Would be nice if it could be made a display column?) Because the ERF record does not specify whether Annex A is used or not, we pass MTP2_ANNEX_A_USED_UNKNOWN and allow the existing user preference to decide. Move the MTP2_ANNEX_A_ definitions into Wiretap, make the annex_a_used field a guint8, and change MTP2_ANNEX_A_USED_UNKNOWN to 2 so it fits in a guint8. (This means that if you can save an ERF MTP2 file as a libpcap file, the pseudo-header will have MTP2_ANNEX_A_USED_UNKNOWN in it.) svn path=/trunk/; revision=22067
2007-06-08 17:06:13 +00:00
pinfo->annex_a_used = pinfo->pseudo_header->mtp2.annex_a_used;
- Add support for libpcap files for MTP2 with a per packet header indicating the direction, narrowband/broadband, and interface number. - Add support to display the direction and interface number. - Add support to packet-mtp2.c to use the broadband/narrowband indication. svn path=/trunk/; revision=14265
2005-05-02 14:07:33 +00:00
break;
Clarify the description of frame.time_delta. This partially addresses bug 491. svn path=/trunk/; revision=20870
2007-02-20 01:32:14 +00:00
From Duncan Salerno: Added LAPDm protocol dissector, GSM Um layer, and wiretap support for dct3trace captures, generated by gammu (many available at http://wiki.thc.org/gsm). svn path=/trunk/; revision=27176
2009-01-07 07:21:31 +00:00
case WTAP_ENCAP_GSM_UM:
pinfo->p2p_dir = pinfo->pseudo_header->gsm_um.uplink ?
P2P_DIR_SENT : P2P_DIR_RECV;
break;
"pinfo->pseudo_header" might be null, even for link-layer types such as WTAP_ENCAP_CHDLC; check whether it's null before using it. Use FROM_DCE rather than 0x80 to check the "this is DCE->DTE" bit in "x25.flags". svn path=/trunk/; revision=5148
2002-04-13 00:02:55 +00:00
}
Cisco HDLC and frame relay direction reporting, from Tom Nisbet. svn path=/trunk/; revision=4447
2001-12-24 17:06:53 +00:00
}
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
if(pinfo->fd->opt_comment){
item = proto_tree_add_item(tree, proto_pkt_comment, tvb, 0, -1, ENC_NA);
comments_tree = proto_item_add_subtree(item, ett_comments);
Use the expert system to show packet comments. The packet comment widget should be replaced by a ListView with two columns, packet no and Comment. svn path=/trunk/; revision=41322
2012-03-02 13:31:16 +00:00
comment_item = proto_tree_add_string_format(comments_tree, hf_comments_text, tvb, 0, -1,
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
pinfo->fd->opt_comment, "%s",
pinfo->fd->opt_comment);
Batch of filterable expert infos. svn path=/trunk/; revision=49584
2013-05-26 03:29:07 +00:00
expert_add_info_format_text(pinfo, comment_item, &ei_comments_text,
Use the expert system to show packet comments. The packet comment widget should be replaced by a ListView with two columns, packet no and Comment. svn path=/trunk/; revision=41322
2012-03-02 13:31:16 +00:00
"%s", pinfo->fd->opt_comment);
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
}
The frame dissector contains a kludge to workaround the fact that the Protocol Hierarchy stats tap always needs the protocol node to appear even though no color, display filter etc. reference it. This is no longer needed due to r29380. svn path=/trunk/; revision=29428
2009-08-15 08:05:10 +00:00
/* if FRAME is not referenced from any filters we dont need to worry about
generating any tree items. */
if(!proto_field_is_referenced(tree, proto_frame)) {
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
tree=NULL;
Add a presence flag field to the packet information structure filled in by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2012-02-25 23:24:34 +00:00
if(pinfo->fd->flags.has_ts) {
if(pinfo->fd->abs_ts.nsecs < 0 || pinfo->fd->abs_ts.nsecs >= 1000000000)
Batch of filterable expert infos. svn path=/trunk/; revision=49584
2013-05-26 03:29:07 +00:00
expert_add_info(pinfo, NULL, &ei_arrive_time_out_of_range);
Add a presence flag field to the packet information structure filled in by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2012-02-25 23:24:34 +00:00
}
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
} else {
Add support for displaying the Packet Block Flags Word of pcapng. svn path=/trunk/; revision=46698
2012-12-22 19:48:17 +00:00
proto_tree *fh_tree;
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
gboolean old_visible;
/* Put in frame header information. */
cap_len = tvb_length(tvb);
frame_len = tvb_reported_length(tvb);
cap_plurality = plurality(cap_len, "", "s");
frame_plurality = plurality(frame_len, "", "s");
Add a presence flag field to the packet information structure filled in by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2012-02-25 23:24:34 +00:00
ti = proto_tree_add_protocol_format(tree, proto_frame, tvb, 0, -1,
"Frame %u: %u byte%s on wire",
pinfo->fd->num, frame_len, frame_plurality);
From Edwin Groothuis via bug #5833: Make number of bits in Frame header optional svn path=/trunk/; revision=36652
2011-04-15 17:53:23 +00:00
if (generate_bits_field)
Add a presence flag field to the packet information structure filled in by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2012-02-25 23:24:34 +00:00
proto_item_append_text(ti, " (%u bits)", frame_len * 8);
proto_item_append_text(ti, ", %u byte%s captured",
cap_len, cap_plurality);
if (generate_bits_field) {
proto_item_append_text(ti, " (%u bits)",
cap_len * 8);
}
if (pinfo->fd->flags.has_if_id) {
proto_item_append_text(ti, " on interface %u",
pinfo->fd->interface_id);
}
Add support for displaying the Packet Block Flags Word of pcapng. svn path=/trunk/; revision=46698
2012-12-22 19:48:17 +00:00
if (pinfo->fd->flags.has_pack_flags) {
if (pinfo->fd->pack_flags & 0x00000001) {
proto_item_append_text(ti, " (inbound)");
pinfo->p2p_dir = P2P_DIR_RECV;
}
if (pinfo->fd->pack_flags & 0x00000002) {
proto_item_append_text(ti, " (outbound)");
pinfo->p2p_dir = P2P_DIR_SENT;
}
}
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
fh_tree = proto_item_add_subtree(ti, ett_frame);
The frame dissector contains a kludge to workaround the fact that the Protocol Hierarchy stats tap always needs the protocol node to appear even though no color, display filter etc. reference it. This is no longer needed due to r29380. svn path=/trunk/; revision=29428
2009-08-15 08:05:10 +00:00
Abuse epan_t more: add callback to get interface name. svn path=/trunk/; revision=50794
2013-07-22 19:38:38 +00:00
if (pinfo->fd->flags.has_if_id && proto_field_is_referenced(tree, hf_frame_interface_id)) {
const char *interface_name = epan_get_interface_name(pinfo->epan, pinfo->fd->interface_id);
if (interface_name)
proto_tree_add_uint_format_value(fh_tree, hf_frame_interface_id, tvb, 0, 0, pinfo->fd->interface_id, "%u (%s)", pinfo->fd->interface_id, interface_name);
else
proto_tree_add_uint(fh_tree, hf_frame_interface_id, tvb, 0, 0, pinfo->fd->interface_id);
}
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
Add support for displaying the Packet Block Flags Word of pcapng. svn path=/trunk/; revision=46698
2012-12-22 19:48:17 +00:00
if (pinfo->fd->flags.has_pack_flags) {
proto_tree *flags_tree;
proto_item *flags_item;
flags_item = proto_tree_add_uint(fh_tree, hf_frame_pack_flags, tvb, 0, 0, pinfo->fd->pack_flags);
flags_tree = proto_item_add_subtree(flags_item, ett_flags);
proto_tree_add_uint(flags_tree, hf_frame_pack_direction, tvb, 0, 0, pinfo->fd->pack_flags);
proto_tree_add_uint(flags_tree, hf_frame_pack_reception_type, tvb, 0, 0, pinfo->fd->pack_flags);
proto_tree_add_uint(flags_tree, hf_frame_pack_fcs_length, tvb, 0, 0, pinfo->fd->pack_flags);
proto_tree_add_uint(flags_tree, hf_frame_pack_reserved, tvb, 0, 0, pinfo->fd->pack_flags);
proto_tree_add_boolean(flags_tree, hf_frame_pack_crc_error, tvb, 0, 0, pinfo->fd->pack_flags);
proto_tree_add_boolean(flags_tree, hf_frame_pack_wrong_packet_too_long_error, tvb, 0, 0, pinfo->fd->pack_flags);
proto_tree_add_boolean(flags_tree, hf_frame_pack_wrong_packet_too_short_error, tvb, 0, 0, pinfo->fd->pack_flags);
proto_tree_add_boolean(flags_tree, hf_frame_pack_wrong_inter_frame_gap_error, tvb, 0, 0, pinfo->fd->pack_flags);
proto_tree_add_boolean(flags_tree, hf_frame_pack_unaligned_frame_error, tvb, 0, 0, pinfo->fd->pack_flags);
proto_tree_add_boolean(flags_tree, hf_frame_pack_start_frame_delimiter_error, tvb, 0, 0, pinfo->fd->pack_flags);
proto_tree_add_boolean(flags_tree, hf_frame_pack_preamble_error, tvb, 0, 0, pinfo->fd->pack_flags);
proto_tree_add_boolean(flags_tree, hf_frame_pack_symbol_error, tvb, 0, 0, pinfo->fd->pack_flags);
}
Show WIRETAP_ENC svn path=/trunk/; revision=42126
2012-04-18 08:26:08 +00:00
proto_tree_add_int(fh_tree, hf_frame_wtap_encap, tvb, 0, 0, pinfo->fd->lnk_t);
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
Add a presence flag field to the packet information structure filled in by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2012-02-25 23:24:34 +00:00
if (pinfo->fd->flags.has_ts) {
proto_tree_add_time(fh_tree, hf_frame_arrival_time, tvb,
0, 0, &(pinfo->fd->abs_ts));
if(pinfo->fd->abs_ts.nsecs < 0 || pinfo->fd->abs_ts.nsecs >= 1000000000) {
expert_add_info + proto_tree_add_text = proto_tree_add_expert, where applicable svn path=/trunk/; revision=50337
2013-07-03 02:59:31 +00:00
expert_add_info_format_text(pinfo, ti, &ei_arrive_time_out_of_range,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
"Arrival Time: Fractional second %09ld is invalid,"
" the valid range is 0-1000000000",
(long) pinfo->fd->abs_ts.nsecs);
Add a presence flag field to the packet information structure filled in by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2012-02-25 23:24:34 +00:00
}
item = proto_tree_add_time(fh_tree, hf_frame_shift_offset, tvb,
0, 0, &(pinfo->fd->shift_offset));
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
PROTO_ITEM_SET_GENERATED(item);
Add a presence flag field to the packet information structure filled in by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2012-02-25 23:24:34 +00:00
if(generate_epoch_time) {
proto_tree_add_time(fh_tree, hf_frame_arrival_time_epoch, tvb,
0, 0, &(pinfo->fd->abs_ts));
}
Show the number of bits captured and on the wire. Use unsigned ints. svn path=/trunk/; revision=31074
2009-11-25 19:18:41 +00:00
Store pointers to previously displayed and captured packet, not nstime_t deltas. This commit reduces size (from 144B to 128B on AMD64) of frame_data structure. Part of bug 5821: Reduce per-packet memory requirements. svn path=/trunk/; revision=45071
2012-09-23 16:25:28 +00:00
if (proto_field_is_referenced(tree, hf_frame_time_delta)) {
nstime_t del_cap_ts;
Clarify the description of frame.time_delta. This partially addresses bug 491. svn path=/trunk/; revision=20870
2007-02-20 01:32:14 +00:00
Add helper function to epan_session which can be used to get absolute timestamp of given frame. Remove ->prev_cap, for testing purpose also replace ->prev_dis with number of previously displayed frame number. This patch reduce size of frame_data by 8B (amd64) This is what (I think) was suggested by Guy in comment 13 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5821#c13) svn path=/trunk/; revision=50765
2013-07-21 20:48:30 +00:00
frame_delta_abs_time(pinfo->epan, pinfo->fd, pinfo->fd->num - 1, &del_cap_ts);
Store pointers to previously displayed and captured packet, not nstime_t deltas. This commit reduces size (from 144B to 128B on AMD64) of frame_data structure. Part of bug 5821: Reduce per-packet memory requirements. svn path=/trunk/; revision=45071
2012-09-23 16:25:28 +00:00
item = proto_tree_add_time(fh_tree, hf_frame_time_delta, tvb,
0, 0, &(del_cap_ts));
PROTO_ITEM_SET_GENERATED(item);
}
if (proto_field_is_referenced(tree, hf_frame_time_delta_displayed)) {
nstime_t del_dis_ts;
Add helper function to epan_session which can be used to get absolute timestamp of given frame. Remove ->prev_cap, for testing purpose also replace ->prev_dis with number of previously displayed frame number. This patch reduce size of frame_data by 8B (amd64) This is what (I think) was suggested by Guy in comment 13 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5821#c13) svn path=/trunk/; revision=50765
2013-07-21 20:48:30 +00:00
frame_delta_abs_time(pinfo->epan, pinfo->fd, pinfo->fd->prev_dis_num, &del_dis_ts);
Store pointers to previously displayed and captured packet, not nstime_t deltas. This commit reduces size (from 144B to 128B on AMD64) of frame_data structure. Part of bug 5821: Reduce per-packet memory requirements. svn path=/trunk/; revision=45071
2012-09-23 16:25:28 +00:00
item = proto_tree_add_time(fh_tree, hf_frame_time_delta_displayed, tvb,
0, 0, &(del_dis_ts));
PROTO_ITEM_SET_GENERATED(item);
}
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Add a presence flag field to the packet information structure filled in by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2012-02-25 23:24:34 +00:00
item = proto_tree_add_time(fh_tree, hf_frame_time_relative, tvb,
Replace relative timestamp with reference frame number. Saves 16B per frame. svn path=/trunk/; revision=50772
2013-07-21 23:07:33 +00:00
0, 0, &(pinfo->rel_ts));
Add a presence flag field to the packet information structure filled in by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2012-02-25 23:24:34 +00:00
PROTO_ITEM_SET_GENERATED(item);
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
Add a presence flag field to the packet information structure filled in by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2012-02-25 23:24:34 +00:00
if(pinfo->fd->flags.ref_time){
ti = proto_tree_add_item(fh_tree, hf_frame_time_reference, tvb, 0, 0, ENC_NA);
PROTO_ITEM_SET_GENERATED(ti);
}
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
}
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
proto_tree_add_uint(fh_tree, hf_frame_number, tvb,
0, 0, pinfo->fd->num);
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
proto_tree_add_uint_format(fh_tree, hf_frame_len, tvb,
0, 0, frame_len, "Frame Length: %u byte%s (%u bits)",
frame_len, frame_plurality, frame_len * 8);
From Sake Blok: Fix for bug #491: Unexpected frame.time_delta behavior This patch ... fixes bug 491. It does this by changing the behaviour of the frame.time_delta field so it reflects the delta time between captured packets (tshark already did this). To keep the delta time between displayed packets, the field frame.time_delta_displayed is created. svn path=/trunk/; revision=21154
2007-03-23 18:08:17 +00:00
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
proto_tree_add_uint_format(fh_tree, hf_frame_capture_len, tvb,
0, 0, cap_len, "Capture Length: %u byte%s (%u bits)",
cap_len, cap_plurality, cap_len * 8);
From Sake Blok: Fix for bug #491: Unexpected frame.time_delta behavior This patch ... fixes bug 491. It does this by changing the behaviour of the frame.time_delta field so it reflects the delta time between captured packets (tshark already did this). To keep the delta time between displayed packets, the field frame.time_delta_displayed is created. svn path=/trunk/; revision=21154
2007-03-23 18:08:17 +00:00
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
if (generate_md5_hash) {
const guint8 *cp;
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
md5_state_t md_ctx;
md5_byte_t digest[16];
Fix a bunch of warnings. Cast away some implicit 64-bit-to-32-bit conversion errors due to use of sizeof. Cast away some implicit 64-bit-to-32-bit conversion errors due to use of strtol() and strtoul(). Change some data types to avoid those implicit conversion warnings. When assigning a constant to a float, make sure the constant isn't a double, by appending "f" to the constant. Constify a bunch of variables, parameters, and return values to eliminate warnings due to strings being given const qualifiers. Cast away those warnings in some cases where an API we don't control forces us to do so. Enable a bunch of additional warnings by default. Note why at least some of the other warnings aren't enabled. randpkt.c and text2pcap.c are used to build programs, so they don't need to be in EXTRA_DIST. If the user specifies --enable-warnings-as-errors, add -Werror *even if the user specified --enable-extra-gcc-flags; assume they know what they're doing and are willing to have the compile fail due to the extra GCC warnings being treated as errors. svn path=/trunk/; revision=46748
2012-12-26 05:57:06 +00:00
const gchar *digest_string;
Add the relative time to the frame tree, at the request of Manfred Young. svn path=/trunk/; revision=2762
2000-12-15 03:30:21 +00:00
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
cp = tvb_get_ptr(tvb, 0, cap_len);
Add the relative time to the frame tree, at the request of Manfred Young. svn path=/trunk/; revision=2762
2000-12-15 03:30:21 +00:00
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
md5_init(&md_ctx);
md5_append(&md_ctx, cp, cap_len);
md5_finish(&md_ctx, digest);
digest_string = bytestring_to_str(digest, 16, '\0');
ti = proto_tree_add_string(fh_tree, hf_frame_md5_hash, tvb, 0, 0, digest_string);
PROTO_ITEM_SET_GENERATED(ti);
}
ti = proto_tree_add_boolean(fh_tree, hf_frame_marked, tvb, 0, 0,pinfo->fd->flags.marked);
Group time related fields. Drop packet length in favor of frame length. Clean up code / indentations / header fields. Improve docsis preference description. svn path=/trunk/; revision=27329
2009-01-29 22:43:49 +00:00
PROTO_ITEM_SET_GENERATED(ti);
Add a field called "frame.protocols" which shows the protocols present in the frame. The filter "frame.protocols contains ip:icmp:ip" could be used to find any ICMP packets containing IP headers. Clean up whitespace. svn path=/trunk/; revision=13118
2005-01-19 04:49:29 +00:00
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
ti = proto_tree_add_boolean(fh_tree, hf_frame_ignored, tvb, 0, 0,pinfo->fd->flags.ignored);
PROTO_ITEM_SET_GENERATED(ti);
Wrap the dissect_fddi() call (with a 4th argument) with dissect_fddi_not_bitswapped() and dissect_fddi_bitswapped(), both of which use the standard 3-argument tvbuffified-dissector argument list. Add a dissector table called "wtap_encap" which is used to call dissectors from dissect_frame(). The switch() statement from this top-level dissector is removed. The link-layer dissectors register themselves with the "wtap_encap" dissector table. The dissectors are now static where possible. svn path=/trunk/; revision=2708
2000-11-29 05:16:15 +00:00
Add curr_layer_num which can be used to keep track of multiple occurances of the same protocol in a frame. svn path=/trunk/; revision=48997
2013-04-23 17:17:56 +00:00
pinfo->curr_layer_num = 0;
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
if(proto_field_is_referenced(tree, hf_frame_protocols)) {
/* we are going to be using proto_item_append_string() on
* hf_frame_protocols, and we must therefore disable the
* TRY_TO_FAKE_THIS_ITEM() optimisation for the tree by
* setting it as visible.
*
* See proto.h for details.
*/
old_visible = proto_tree_set_visible(fh_tree, TRUE);
ti = proto_tree_add_string(fh_tree, hf_frame_protocols, tvb, 0, 0, "");
PROTO_ITEM_SET_GENERATED(ti);
proto_tree_set_visible(fh_tree, old_visible);
pinfo->layer_names = g_string_new("");
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
}
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
else
pinfo->layer_names = NULL;
- Use the key for comparison of per_proto_data. - Show the number of per-packet-data entries and which protocol has made entries in the frame. svn path=/trunk/; revision=49313
2013-05-15 16:50:37 +00:00
if(pinfo->fd->pfd != 0){
Un-shadow a couple of variables. svn path=/trunk/; revision=49317
2013-05-15 17:49:45 +00:00
proto_item *ppd_item;
- Use the key for comparison of per_proto_data. - Show the number of per-packet-data entries and which protocol has made entries in the frame. svn path=/trunk/; revision=49313
2013-05-15 16:50:37 +00:00
guint num_entries = g_slist_length(pinfo->fd->pfd);
guint i;
Un-shadow a couple of variables. svn path=/trunk/; revision=49317
2013-05-15 17:49:45 +00:00
ppd_item = proto_tree_add_uint(fh_tree, hf_frame_num_p_prot_data, tvb, 0, 0, num_entries);
PROTO_ITEM_SET_GENERATED(ppd_item);
- Use the key for comparison of per_proto_data. - Show the number of per-packet-data entries and which protocol has made entries in the frame. svn path=/trunk/; revision=49313
2013-05-15 16:50:37 +00:00
for(i=0; i<num_entries; i++){
proto_tree_add_text (fh_tree, tvb, 0, 0, "%s",p_get_proto_name_and_key(pinfo->fd, i));
}
}
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
/* Check for existences of P2P pseudo header */
if (pinfo->p2p_dir != P2P_DIR_UNKNOWN) {
proto_tree_add_int(fh_tree, hf_frame_p2p_dir, tvb,
0, 0, pinfo->p2p_dir);
}
/* Check for existences of MTP2 link number */
if ((pinfo->pseudo_header != NULL ) && (pinfo->fd->lnk_t == WTAP_ENCAP_MTP2_WITH_PHDR)) {
proto_tree_add_uint(fh_tree, hf_link_number, tvb,
0, 0, pinfo->link_number);
}
if (show_file_off) {
proto_tree_add_int64_format(fh_tree, hf_frame_file_off, tvb,
0, 0, pinfo->fd->file_off,
"File Offset: %" G_GINT64_MODIFIER "d (0x%" G_GINT64_MODIFIER "x)",
pinfo->fd->file_off, pinfo->fd->file_off);
}
if(pinfo->fd->color_filter != NULL) {
From beroset: remove C++ incompatibilities https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8416 svn path=/trunk/; revision=48426
2013-03-19 20:00:52 +00:00
const color_filter_t *color_filter = (const color_filter_t *)pinfo->fd->color_filter;
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
item = proto_tree_add_string(fh_tree, hf_frame_color_filter_name, tvb,
0, 0, color_filter->filter_name);
PROTO_ITEM_SET_GENERATED(item);
item = proto_tree_add_string(fh_tree, hf_frame_color_filter_text, tvb,
0, 0, color_filter->filter_text);
PROTO_ITEM_SET_GENERATED(item);
}
}
if (pinfo->fd->flags.ignored) {
/* Ignored package, stop handling here */
col_set_str(pinfo->cinfo, COL_INFO, "<Ignored>");
proto_tree_add_text (tree, tvb, 0, -1, "This frame is marked as ignored");
return;
fix for bug 718 dont play games with lnk_t If the preference is set to unconditionally dissect everything as docsis just call the docsis handler directly. svn path=/trunk/; revision=17377
2006-02-23 09:11:00 +00:00
}
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
/* Portable Exception Handling to trap Wireshark specific exceptions like BoundsError exceptions */
TRY {
from Gisle Vanem: This file uses SEH which AFAIK is only available for MS Visual-C. I build using MingW/gcc, so the attached patch is needed. svn path=/trunk/; revision=17102
2006-01-25 21:34:04 +00:00
#ifdef _MSC_VER
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
/* Win32: Visual-C Structured Exception Handling (SEH) to trap hardware exceptions
like memory access violations.
(a running debugger will be called before the except part below) */
Add a comment noting that on Windows the "use of window's own __try {} __finally {} and __except {} mechanism" along with "macros based on kazlib's exception code" has problems and does not always work properly. svn path=/trunk/; revision=45831
2012-10-29 20:12:28 +00:00
/* Note: A Windows "exceptional exception" may leave the kazlib's (Portable Exception Handling)
stack in an inconsistent state thus causing a crash at some point in the
handling of the exception.
See: https://www.wireshark.org/lists/wireshark-dev/200704/msg00243.html
*/
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
__try {
#endif
if ((force_docsis_encap) && (docsis_handle)) {
call_dissector(docsis_handle, tvb, pinfo, parent_tree);
} else {
Rename the routines that handle dissector tables with unsigned integer keys to have _uint in their names, to match the routines that handle dissector tables with string keys. (Using _port can confuse people into thinking they're intended solely for use with TCP/UDP/etc. ports when, in fact, they work better for things such as Ethernet types, where the binding of particular values to particular protocols are a lot stronger.) svn path=/trunk/; revision=35224
2010-12-20 05:35:29 +00:00
if (!dissector_try_uint(wtap_encap_dissector_table, pinfo->fd->lnk_t,
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
tvb, pinfo, parent_tree)) {
col_set_str(pinfo->cinfo, COL_PROTOCOL, "UNKNOWN");
col_add_fstr(pinfo->cinfo, COL_INFO, "WTAP_ENCAP = %d",
pinfo->fd->lnk_t);
call_dissector(data_handle,tvb, pinfo, parent_tree);
}
}
#ifdef _MSC_VER
Use __except(EXCEPTION_EXECUTE_HANDLER) rather than __except(TRUE); Strictly speaking, it appears that __except(EXCEPTION_EXECUTE_HANDLER) rather than __exept(TRUE) should be used altho in actuality there's no difference since TRUE (as defined by GLIB) == EXCEPTION_EXECUTE_HANDLER. svn path=/trunk/; revision=40022
2011-11-28 16:23:55 +00:00
} __except(EXCEPTION_EXECUTE_HANDLER /* handle all exceptions */) {
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
switch(GetExceptionCode()) {
case(STATUS_ACCESS_VIOLATION):
show_exception(tvb, pinfo, parent_tree, DissectorError,
"STATUS_ACCESS_VIOLATION: dissector accessed an invalid memory address");
break;
case(STATUS_INTEGER_DIVIDE_BY_ZERO):
show_exception(tvb, pinfo, parent_tree, DissectorError,
"STATUS_INTEGER_DIVIDE_BY_ZERO: dissector tried an integer division by zero");
break;
case(STATUS_STACK_OVERFLOW):
show_exception(tvb, pinfo, parent_tree, DissectorError,
"STATUS_STACK_OVERFLOW: dissector overflowed the stack (e.g. endless loop)");
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
/* XXX - this will have probably corrupted the stack,
which makes problems later in the exception code */
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
break;
/* XXX - add other hardware exception codes as required */
default:
show_exception(tvb, pinfo, parent_tree, DissectorError,
g_strdup_printf("dissector caused an unknown exception: 0x%x", GetExceptionCode()));
}
}
add Win32 Structured Exception Handling (SEH) at the same place we're already doing the Portable Exception Handling. This way we (hopefully) can continue dissecting with the next packet, even if a more serious exception had occured, e.g. a memory access violation or a divide by zero exception. Obviously, not all problems solved, as SEH won't protect us from other problems, e.g. endless loops and such svn path=/trunk/; revision=17070
2006-01-22 02:22:14 +00:00
#endif
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
}
Move show_exception() and show_reported_bounds_error() to epan/show_exception.c, as it's used outside epan/dissectors/packet-frame.c. Update their callers to include <epan/show_exception.h> to get their declaration. Add a CATCH_NONFATAL_ERRORS macro that catches all exceptions that, if there's more stuff in the packet to dissect after the dissector call that threw the exception, doesn't mean you shouldn't go ahead and dissect that stuff. Use it in all those cases, including ones where BoundsError was inappropriately being caught (you want those passed up to the top level, so that the packet is reported as having been cut short in the capture process). Add a CATCH_BOUNDS_ERRORS macro that catches all exceptions that correspond to running past the end of the data for a tvbuff; use it rather than explicitly catching those exceptions individually, and rather than just catching all exceptions (the only place that DissectorError should be caught, for example, is at the top level, so dissector bugs show up in the protocol tree). Don't catch and then immediately rethrow exceptions without doing anything else; just let the exceptions go up to the final catcher. Use show_exception() to report non-fatal errors, rather than doing it yourself. If a dissector is called from Lua, catch all non-fatal errors and use show_exception() to report them rather than catching only ReportedBoundsError and adding a proto_malformed item. Don't catch exceptions when constructing a trailer tvbuff in packet-ieee8023.c - just construct it after the payload has been dissected, and let whatever exceptions that throws be handled at the top level. Avoid some TRY/CATCH/ENDTRY cases by using checks such as tvb_bytes_exist() before even looking in the tvbuff. svn path=/trunk/; revision=47924
2013-02-27 22:43:54 +00:00
CATCH_BOUNDS_AND_DISSECTOR_ERRORS {
Major speed improvement for filtering and dissection. It should not dump core as far as all my tests are concerned and Menu_Statistics/ProtocolHierStats work It needs more testing and there might still be cases where it will crash that will need to be fixed but I feel it will be worth it since it will decrease the time to filter very large capture files dramatically. Real significant performance boost for very large captures. (If we cant fix all the problems we can just revert this patch) svn path=/trunk/; revision=14051
2005-04-11 08:43:51 +00:00
show_exception(tvb, pinfo, parent_tree, EXCEPT_CODE, GET_MESSAGE);
Add a "show_exception()" routine that takes an exception code as an argument, and puts the appropriate exception indication into the tree. In "dissect_frame()", do a CATCH_ALL for exceptions, and pass the exception code to "show_exception()". svn path=/trunk/; revision=8758
2003-10-23 05:01:39 +00:00
}
ENDTRY;
From bug 1492: Fortify layer name presentation. Some code cleanups. svn path=/trunk/; revision=21752
2007-05-12 19:54:55 +00:00
if (tree && pinfo->layer_names) {
Add a field called "frame.protocols" which shows the protocols present in the frame. The filter "frame.protocols contains ip:icmp:ip" could be used to find any ICMP packets containing IP headers. Clean up whitespace. svn path=/trunk/; revision=13118
2005-01-19 04:49:29 +00:00
proto_item_append_string(ti, pinfo->layer_names->str);
g_string_free(pinfo->layer_names, TRUE);
pinfo->layer_names = NULL;
}
Fix http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2549 : make the frame dissector catch exceptions generated by post dissectors. svn path=/trunk/; revision=25339
2008-05-21 14:18:37 +00:00
/* Call postdissectors if we have any (while trying to avoid another
* TRY/CATCH)
*/
if (have_postdissector()) {
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
TRY {
Fix http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2549 : make the frame dissector catch exceptions generated by post dissectors. svn path=/trunk/; revision=25339
2008-05-21 14:18:37 +00:00
#ifdef _MSC_VER
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
/* Win32: Visual-C Structured Exception Handling (SEH)
to trap hardware exceptions like memory access violations */
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
/* (a running debugger will be called before the except part below) */
Add a comment noting that on Windows the "use of window's own __try {} __finally {} and __except {} mechanism" along with "macros based on kazlib's exception code" has problems and does not always work properly. svn path=/trunk/; revision=45831
2012-10-29 20:12:28 +00:00
/* Note: A Windows "exceptional exception" may leave the kazlib's (Portable Exception Handling)
stack in an inconsistent state thus causing a crash at some point in the
handling of the exception.
See: https://www.wireshark.org/lists/wireshark-dev/200704/msg00243.html
*/
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
__try {
Fix http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2549 : make the frame dissector catch exceptions generated by post dissectors. svn path=/trunk/; revision=25339
2008-05-21 14:18:37 +00:00
#endif
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
call_all_postdissectors(tvb, pinfo, parent_tree);
Fix http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2549 : make the frame dissector catch exceptions generated by post dissectors. svn path=/trunk/; revision=25339
2008-05-21 14:18:37 +00:00
#ifdef _MSC_VER
Use __except(EXCEPTION_EXECUTE_HANDLER) rather than __except(TRUE); Strictly speaking, it appears that __except(EXCEPTION_EXECUTE_HANDLER) rather than __exept(TRUE) should be used altho in actuality there's no difference since TRUE (as defined by GLIB) == EXCEPTION_EXECUTE_HANDLER. svn path=/trunk/; revision=40022
2011-11-28 16:23:55 +00:00
} __except(EXCEPTION_EXECUTE_HANDLER /* handle all exceptions */) {
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
switch(GetExceptionCode()) {
case(STATUS_ACCESS_VIOLATION):
show_exception(tvb, pinfo, parent_tree, DissectorError,
"STATUS_ACCESS_VIOLATION: dissector accessed an invalid memory address");
break;
case(STATUS_INTEGER_DIVIDE_BY_ZERO):
show_exception(tvb, pinfo, parent_tree, DissectorError,
"STATUS_INTEGER_DIVIDE_BY_ZERO: dissector tried an integer division by zero");
break;
case(STATUS_STACK_OVERFLOW):
show_exception(tvb, pinfo, parent_tree, DissectorError,
"STATUS_STACK_OVERFLOW: dissector overflowed the stack (e.g. endless loop)");
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
/* XXX - this will have probably corrupted the stack,
which makes problems later in the exception code */
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
break;
/* XXX - add other hardware exception codes as required */
default:
show_exception(tvb, pinfo, parent_tree, DissectorError,
g_strdup_printf("dissector caused an unknown exception: 0x%x", GetExceptionCode()));
}
}
Fix http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2549 : make the frame dissector catch exceptions generated by post dissectors. svn path=/trunk/; revision=25339
2008-05-21 14:18:37 +00:00
#endif
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
}
Move show_exception() and show_reported_bounds_error() to epan/show_exception.c, as it's used outside epan/dissectors/packet-frame.c. Update their callers to include <epan/show_exception.h> to get their declaration. Add a CATCH_NONFATAL_ERRORS macro that catches all exceptions that, if there's more stuff in the packet to dissect after the dissector call that threw the exception, doesn't mean you shouldn't go ahead and dissect that stuff. Use it in all those cases, including ones where BoundsError was inappropriately being caught (you want those passed up to the top level, so that the packet is reported as having been cut short in the capture process). Add a CATCH_BOUNDS_ERRORS macro that catches all exceptions that correspond to running past the end of the data for a tvbuff; use it rather than explicitly catching those exceptions individually, and rather than just catching all exceptions (the only place that DissectorError should be caught, for example, is at the top level, so dissector bugs show up in the protocol tree). Don't catch and then immediately rethrow exceptions without doing anything else; just let the exceptions go up to the final catcher. Use show_exception() to report non-fatal errors, rather than doing it yourself. If a dissector is called from Lua, catch all non-fatal errors and use show_exception() to report them rather than catching only ReportedBoundsError and adding a proto_malformed item. Don't catch exceptions when constructing a trailer tvbuff in packet-ieee8023.c - just construct it after the payload has been dissected, and let whatever exceptions that throws be handled at the top level. Avoid some TRY/CATCH/ENDTRY cases by using checks such as tvb_bytes_exist() before even looking in the tvbuff. svn path=/trunk/; revision=47924
2013-02-27 22:43:54 +00:00
CATCH_BOUNDS_AND_DISSECTOR_ERRORS {
Changes to use consistent indentation. svn path=/trunk/; revision=31470
2010-01-08 21:07:51 +00:00
show_exception(tvb, pinfo, parent_tree, EXCEPT_CODE, GET_MESSAGE);
}
ENDTRY;
Fix http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2549 : make the frame dissector catch exceptions generated by post dissectors. svn path=/trunk/; revision=25339
2008-05-21 14:18:37 +00:00
}
Add a field called "frame.protocols" which shows the protocols present in the frame. The filter "frame.protocols contains ip:icmp:ip" could be used to find any ICMP packets containing IP headers. Clean up whitespace. svn path=/trunk/; revision=13118
2005-01-19 04:49:29 +00:00
Add register_postdissector() to the API. Dissectors registered with register_postdissector() will be called after all other dissectors have been called. Use it to register mate. svn path=/trunk/; revision=17089
2006-01-24 00:26:57 +00:00
tap_queue_packet(frame_tap, pinfo, NULL);
Clarify the description of frame.time_delta. This partially addresses bug 491. svn path=/trunk/; revision=20870
2007-02-20 01:32:14 +00:00
From LEGO if Mate is pressent call it. svn path=/trunk/; revision=12615
2004-11-28 20:52:52 +00:00
MT: move global frame_end_routines to packet_info. svn path=/trunk/; revision=44748
2012-09-03 12:00:40 +00:00
if (pinfo->frame_end_routines) {
g_slist_foreach(pinfo->frame_end_routines, &call_frame_end_routine, NULL);
g_slist_free(pinfo->frame_end_routines);
pinfo->frame_end_routines = NULL;
From Stig B Patch for COTP reassembly. There does not seem to be any reasonable or cleaner way to fix COTP reassembly than adding the frame.[ch] patch. svn path=/trunk/; revision=16813
2005-12-16 00:32:12 +00:00
}
Add a "show_exception()" routine that takes an exception code as an argument, and puts the appropriate exception indication into the tree. In "dissect_frame()", do a CATCH_ALL for exceptions, and pass the exception code to "show_exception()". svn path=/trunk/; revision=8758
2003-10-23 05:01:39 +00:00
}
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
void
proto_register_frame(void)
{
static hf_register_info hf[] = {
{ &hf_frame_arrival_time,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Arrival Time", "frame.time",
FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
"Absolute time when this frame was captured", HFILL }},
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
From Edwin Groothuis via bug 6179: Added Time Shift functionality. From me: Renamed to use "Time Shift" everywhere + some other minor cleanups. svn path=/trunk/; revision=38510
2011-08-13 17:39:38 +00:00
{ &hf_frame_shift_offset,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Time shift for this packet", "frame.offset_shift",
FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
"Time shift applied to this packet", HFILL }},
From Edwin Groothuis via bug 6179: Added Time Shift functionality. From me: Renamed to use "Time Shift" everywhere + some other minor cleanups. svn path=/trunk/; revision=38510
2011-08-13 17:39:38 +00:00
From enhancement bug #4272: Patch to add new filterable field - frame.time_epoch svn path=/trunk/; revision=31110
2009-11-29 09:26:01 +00:00
{ &hf_frame_arrival_time_epoch,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Epoch Time", "frame.time_epoch",
FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
"Epoch time when this frame was captured", HFILL }},
From enhancement bug #4272: Patch to add new filterable field - frame.time_epoch svn path=/trunk/; revision=31110
2009-11-29 09:26:01 +00:00
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
{ &hf_frame_time_delta,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Time delta from previous captured frame", "frame.time_delta",
FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
NULL, HFILL }},
From Sake Blok: Fix for bug #491: Unexpected frame.time_delta behavior This patch ... fixes bug 491. It does this by changing the behaviour of the frame.time_delta field so it reflects the delta time between captured packets (tshark already did this). To keep the delta time between displayed packets, the field frame.time_delta_displayed is created. svn path=/trunk/; revision=21154
2007-03-23 18:08:17 +00:00
{ &hf_frame_time_delta_displayed,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Time delta from previous displayed frame", "frame.time_delta_displayed",
FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
NULL, HFILL }},
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Add the relative time to the frame tree, at the request of Manfred Young. svn path=/trunk/; revision=2762
2000-12-15 03:30:21 +00:00
{ &hf_frame_time_relative,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Time since reference or first frame", "frame.time_relative",
FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
"Time relative to time reference or first frame", HFILL }},
Add the relative time to the frame tree, at the request of Manfred Young. svn path=/trunk/; revision=2762
2000-12-15 03:30:21 +00:00
Group time related fields. Drop packet length in favor of frame length. Clean up code / indentations / header fields. Improve docsis preference description. svn path=/trunk/; revision=27329
2009-01-29 22:43:49 +00:00
{ &hf_frame_time_reference,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "This is a Time Reference frame", "frame.ref_time",
FT_NONE, BASE_NONE, NULL, 0x0,
"This frame is a Time Reference frame", HFILL }},
Group time related fields. Drop packet length in favor of frame length. Clean up code / indentations / header fields. Improve docsis preference description. svn path=/trunk/; revision=27329
2009-01-29 22:43:49 +00:00
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
{ &hf_frame_number,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Frame Number", "frame.number",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }},
Change frame dissector to show "frame" instead of "packet" for all fields for consistency. The frame.pkt_len filter is now deprecated, but still supported as a hidden field for an easy transition. The new field name is frame.len. svn path=/trunk/; revision=20519
2007-01-21 23:02:07 +00:00
{ &hf_frame_len,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Frame length on the wire", "frame.len",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }},
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
{ &hf_frame_capture_len,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Frame length stored into the capture file", "frame.cap_len",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }},
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
From Jim Young: The attached patch augments the epan/dissectors/packet-frame.c module to optionally generate MD5 hashes of each packet. These MD5 hashes are calculated in the same manner as the MD5 hash used for duplicate packet removal by the editcap utility. The ability to generate the MD5 hashes can be enabled or disabled by a new boolean preferences option: frame.generate_md5_hash. By default MD5 hash generation is disabled. To help identify frames with matching MD5 hashes this patch also includes a new display filter: frame.md5_hash. svn path=/trunk/; revision=27150
2009-01-04 12:08:17 +00:00
{ &hf_frame_md5_hash,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Frame MD5 Hash", "frame.md5_hash",
FT_STRING, BASE_NONE, NULL, 0x0,
NULL, HFILL }},
From Jim Young: The attached patch augments the epan/dissectors/packet-frame.c module to optionally generate MD5 hashes of each packet. These MD5 hashes are calculated in the same manner as the MD5 hash used for duplicate packet removal by the editcap utility. The ability to generate the MD5 hashes can be enabled or disabled by a new boolean preferences option: frame.generate_md5_hash. By default MD5 hash generation is disabled. To help identify frames with matching MD5 hashes this patch also includes a new display filter: frame.md5_hash. svn path=/trunk/; revision=27150
2009-01-04 12:08:17 +00:00
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
{ &hf_frame_p2p_dir,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Point-to-Point Direction", "frame.p2p_dir",
FT_INT8, BASE_DEC, VALS(p2p_dirs), 0x0,
NULL, HFILL }},
Add an option to show the File Offset of a frame. Not useful for general packet analyzing, but useful when developing wiretap code or other such low-level development. Default preference is *not* to show File Offset. svn path=/trunk/; revision=4120
2001-11-01 04:00:56 +00:00
- Add support for libpcap files for MTP2 with a per packet header indicating the direction, narrowband/broadband, and interface number. - Add support to display the direction and interface number. - Add support to packet-mtp2.c to use the broadband/narrowband indication. svn path=/trunk/; revision=14265
2005-05-02 14:07:33 +00:00
{ &hf_link_number,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Link Number", "frame.link_nr",
FT_UINT16, BASE_DEC, NULL, 0x0,
NULL, HFILL }},
- Add support for libpcap files for MTP2 with a per packet header indicating the direction, narrowband/broadband, and interface number. - Add support to display the direction and interface number. - Add support to packet-mtp2.c to use the broadband/narrowband indication. svn path=/trunk/; revision=14265
2005-05-02 14:07:33 +00:00
Add an option to show the File Offset of a frame. Not useful for general packet analyzing, but useful when developing wiretap code or other such low-level development. Default preference is *not* to show File Offset. svn path=/trunk/; revision=4120
2001-11-01 04:00:56 +00:00
{ &hf_frame_file_off,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "File Offset", "frame.file_off",
FT_INT64, BASE_DEC, NULL, 0x0,
NULL, HFILL }},
Add an option to show the File Offset of a frame. Not useful for general packet analyzing, but useful when developing wiretap code or other such low-level development. Default preference is *not* to show File Offset. svn path=/trunk/; revision=4120
2001-11-01 04:00:56 +00:00
From Didier Gautheron: add a "frame.marked" hidden field, set if the frame is marked, so that you can use Find Frame to find the next marked frame, and can filter the display to show only marked frames. Update the documentation to note that "frame.marked" is set on marked frames. svn path=/trunk/; revision=5377
2002-05-03 21:38:20 +00:00
{ &hf_frame_marked,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Frame is marked", "frame.marked",
FT_BOOLEAN, BASE_NONE, NULL, 0x0,
"Frame is marked in the GUI", HFILL }},
Add filterable field for REF TIME frames so it is easy to search for them svn path=/trunk/; revision=8511
2003-09-22 09:06:10 +00:00
Introduce "Ignore Packet" in the packet list. This will remove the package from the dissection functions without removing it from the capture file. svn path=/trunk/; revision=31287
2009-12-17 01:18:14 +00:00
{ &hf_frame_ignored,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Frame is ignored", "frame.ignored",
FT_BOOLEAN, BASE_NONE, NULL, 0x0,
"Frame is ignored by the dissectors", HFILL }},
Introduce "Ignore Packet" in the packet list. This will remove the package from the dissection functions without removing it from the capture file. svn path=/trunk/; revision=31287
2009-12-17 01:18:14 +00:00
Add a field called "frame.protocols" which shows the protocols present in the frame. The filter "frame.protocols contains ip:icmp:ip" could be used to find any ICMP packets containing IP headers. Clean up whitespace. svn path=/trunk/; revision=13118
2005-01-19 04:49:29 +00:00
{ &hf_frame_protocols,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Protocols in frame", "frame.protocols",
FT_STRING, BASE_NONE, NULL, 0x0,
"Protocols carried by this frame", HFILL }},
add matched coloring rule name and string to the frame dissector output (or nothing if no coloring rule matched or none was set) svn path=/trunk/; revision=17068
2006-01-21 17:49:00 +00:00
{ &hf_frame_color_filter_name,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Coloring Rule Name", "frame.coloring_rule.name",
FT_STRING, BASE_NONE, NULL, 0x0,
"The frame matched the coloring rule with this name", HFILL }},
Group time related fields. Drop packet length in favor of frame length. Clean up code / indentations / header fields. Improve docsis preference description. svn path=/trunk/; revision=27329
2009-01-29 22:43:49 +00:00
add matched coloring rule name and string to the frame dissector output (or nothing if no coloring rule matched or none was set) svn path=/trunk/; revision=17068
2006-01-21 17:49:00 +00:00
{ &hf_frame_color_filter_text,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Coloring Rule String", "frame.coloring_rule.string",
FT_STRING, BASE_NONE, NULL, 0x0,
"The frame matched this coloring rule string", HFILL }},
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
{ &hf_frame_interface_id,
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
{ "Interface id", "frame.interface_id",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }},
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
Add support for displaying the Packet Block Flags Word of pcapng. svn path=/trunk/; revision=46698
2012-12-22 19:48:17 +00:00
{ &hf_frame_pack_flags,
{ "Packet flags", "frame.packet_flags",
FT_UINT32, BASE_HEX, NULL, 0x0,
NULL, HFILL }},
{ &hf_frame_pack_direction,
{ "Direction", "frame.packet_flags_direction",
Fox copy-and-paste error. svn path=/trunk/; revision=46701
2012-12-22 20:56:58 +00:00
FT_UINT32, BASE_HEX, VALS(&packet_word_directions), PACKET_WORD_DIRECTION_MASK,
Add support for displaying the Packet Block Flags Word of pcapng. svn path=/trunk/; revision=46698
2012-12-22 19:48:17 +00:00
NULL, HFILL }},
{ &hf_frame_pack_reception_type,
{ "Reception type", "frame.packet_flags_reception_type",
Fox copy-and-paste error. svn path=/trunk/; revision=46701
2012-12-22 20:56:58 +00:00
FT_UINT32, BASE_DEC, VALS(&packet_word_reception_types), PACKET_WORD_RECEPTION_TYPE_MASK,
Add support for displaying the Packet Block Flags Word of pcapng. svn path=/trunk/; revision=46698
2012-12-22 19:48:17 +00:00
NULL, HFILL }},
{ &hf_frame_pack_fcs_length,
{ "FCS length", "frame.packet_flags_fcs_length",
FT_UINT32, BASE_DEC, NULL, PACKET_WORD_FCS_LENGTH_MASK,
NULL, HFILL }},
{ &hf_frame_pack_reserved,
{ "Reserved", "frame.packet_flags_reserved",
FT_UINT32, BASE_DEC, NULL, PACKET_WORD_RESERVED_MASK,
NULL, HFILL }},
{ &hf_frame_pack_crc_error,
{ "CRC error", "frame.packet_flags_crc_error",
FT_BOOLEAN, 32, TFS(&tfs_set_notset), PACKET_WORD_CRC_ERR_MASK,
NULL, HFILL }},
{ &hf_frame_pack_wrong_packet_too_long_error,
{ "Packet too long error", "frame.packet_flags_packet_too_error",
FT_BOOLEAN, 32, TFS(&tfs_set_notset), PACKET_WORD_PACKET_TOO_LONG_ERR_MASK,
NULL, HFILL }},
{ &hf_frame_pack_wrong_packet_too_short_error,
{ "Packet too short error", "frame.packet_flags_packet_too_short_error",
FT_BOOLEAN, 32, TFS(&tfs_set_notset), PACKET_WORD_PACKET_TOO_SHORT_ERR_MASK,
NULL, HFILL }},
{ &hf_frame_pack_wrong_inter_frame_gap_error,
{ "Wrong interframe gap error", "frame.packet_flags_wrong_inter_frame_gap_error",
FT_BOOLEAN, 32, TFS(&tfs_set_notset), PACKET_WORD_WRONG_INTER_FRAME_GAP_ERR_MASK,
NULL, HFILL }},
{ &hf_frame_pack_unaligned_frame_error,
{ "Unaligned frame error", "frame.packet_flags_unaligned_frame_error",
FT_BOOLEAN, 32, TFS(&tfs_set_notset), PACKET_WORD_UNALIGNED_FRAME_ERR_MASK,
NULL, HFILL }},
{ &hf_frame_pack_start_frame_delimiter_error,
{ "Start frame delimiter error", "frame.packet_flags_start_frame_delimiter_error",
FT_BOOLEAN, 32, TFS(&tfs_set_notset), PACKET_WORD_START_FRAME_DELIMITER_ERR_MASK,
NULL, HFILL }},
{ &hf_frame_pack_preamble_error,
{ "Preamble error", "frame.packet_flags_preamble_error",
FT_BOOLEAN, 32, TFS(&tfs_set_notset), PACKET_WORD_PREAMBLE_ERR_MASK,
NULL, HFILL }},
{ &hf_frame_pack_symbol_error,
{ "Symbol error", "frame.packet_flags_symbol_error",
FT_BOOLEAN, 32, TFS(&tfs_set_notset), PACKET_WORD_SYMBOL_ERR_MASK,
NULL, HFILL }},
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
{ &hf_comments_text,
Update display filter names per Bug 2794. Part 1 of many. svn path=/trunk/; revision=43907
2012-07-22 03:06:37 +00:00
{ "Comment", "frame.comment",
General cleanup to include: - remove unneeded includes; - remove "boilerplate" comments; - reformat hf[] entries; - reformat long lines; - unneeded use of check_col(); - whitespace fixes. svn path=/trunk/; revision=42402
2012-05-03 19:31:03 +00:00
FT_STRING, BASE_NONE, NULL, 0x0,
NULL, HFILL }},
- Use the key for comparison of per_proto_data. - Show the number of per-packet-data entries and which protocol has made entries in the frame. svn path=/trunk/; revision=49313
2013-05-15 16:50:37 +00:00
{ &hf_frame_num_p_prot_data,
{ "Number of per-protocol-data", "frame.p_prot_data",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }},
Group time related fields. Drop packet length in favor of frame length. Clean up code / indentations / header fields. Improve docsis preference description. svn path=/trunk/; revision=27329
2009-01-29 22:43:49 +00:00
};
From Stephen Donnelly: Correct ERF name, add WTAP_ENCAP string display https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7313 svn path=/trunk/; revision=43141
2012-06-06 20:35:37 +00:00
static hf_register_info hf_encap =
{ &hf_frame_wtap_encap,
{ "Encapsulation type", "frame.encap_type",
FT_INT16, BASE_DEC, NULL, 0x0,
NULL, HFILL }};
static gint *ett[] = {
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
&ett_frame,
Add support for displaying the Packet Block Flags Word of pcapng. svn path=/trunk/; revision=46698
2012-12-22 19:48:17 +00:00
&ett_flags,
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
&ett_comments
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
};
From Stephen Donnelly: Correct ERF name, add WTAP_ENCAP string display https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7313 svn path=/trunk/; revision=43141
2012-06-06 20:35:37 +00:00
Batch of filterable expert infos. svn path=/trunk/; revision=49584
2013-05-26 03:29:07 +00:00
static ei_register_info ei[] = {
{ &ei_comments_text, { "frame.comment.expert", PI_COMMENTS_GROUP, PI_COMMENT, "Formatted comment", EXPFILL }},
expert_add_info + proto_tree_add_text = proto_tree_add_expert, where applicable svn path=/trunk/; revision=50337
2013-07-03 02:59:31 +00:00
{ &ei_arrive_time_out_of_range, { "frame.time_invalid", PI_SEQUENCE, PI_NOTE, "Arrival Time: Fractional second out of range (0-1000000000)", EXPFILL }},
Batch of filterable expert infos. svn path=/trunk/; revision=49584
2013-05-26 03:29:07 +00:00
};
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
module_t *frame_module;
Batch of filterable expert infos. svn path=/trunk/; revision=49584
2013-05-26 03:29:07 +00:00
expert_module_t* expert_frame;
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
From Stephen Donnelly: Correct ERF name, add WTAP_ENCAP string display https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7313 svn path=/trunk/; revision=43141
2012-06-06 20:35:37 +00:00
if (hf_encap.hfinfo.strings == NULL) {
int encap_count = wtap_get_num_encap_types();
value_string *arr;
int i;
hf_encap.hfinfo.strings = arr = g_new(value_string, encap_count+1);
for (i = 0; i < encap_count; i++) {
arr[i].value = i;
arr[i].strptr = wtap_encap_string(i);
}
arr[encap_count].value = 0;
arr[encap_count].strptr = NULL;
}
Attach a descriptive name field type and base to dissector tables; that specifies how the selector values used as keys in those tables are to be displayed, and the title to use when displaying the table. Use that information in the code to display the initial and current entries of various dissector tables. Have the dissector for BACnet APDUs register itself by name, and have the BACnet NPDU dissector call it iff the BAC_CONTROL_NET bit isn't set, rather than doing it with a dissector table. svn path=/trunk/; revision=4358
2001-12-08 06:41:48 +00:00
wtap_encap_dissector_table = register_dissector_table("wtap_encap",
"Wiretap encapsulation type", FT_UINT32, BASE_DEC);
Wrap the dissect_fddi() call (with a 4th argument) with dissect_fddi_not_bitswapped() and dissect_fddi_bitswapped(), both of which use the standard 3-argument tvbuffified-dissector argument list. Add a dissector table called "wtap_encap" which is used to call dissectors from dissect_frame(). The switch() statement from this top-level dissector is removed. The link-layer dissectors register themselves with the "wtap_encap" dissector table. The dissectors are now static where possible. svn path=/trunk/; revision=2708
2000-11-29 05:16:15 +00:00
Have "proto_register_protocol()" build a list of data structures for protocols, in addition to adding structures to the list of filterable fields. Give it an extra argument that specifies a "short name" for the protocol, for use in such places as pinfo->current_proto; the dialog box for constructing filters; the preferences tab for the protocol; and so on (although we're not yet using it in all those places). Make the preference name that appears in the preferences file and the command line for the DIAMETER protocol "diameter", not "Diameter"; the convention is that the name in question be all-lower-case. Make some routines and variables that aren't exported static. Update a comment in the ICP dissector to make it clear that the dissector won't see fragments other than the first fragment of a fragmented datagram. svn path=/trunk/; revision=2810
2001-01-03 06:56:03 +00:00
proto_frame = proto_register_protocol("Frame", "Frame", "frame");
Add the abillity to read and write option comments unedited. This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2012-02-11 12:34:39 +00:00
proto_pkt_comment = proto_register_protocol("Packet comments", "Pkt_Comment", "pkt_comment");
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
proto_register_field_array(proto_frame, hf, array_length(hf));
From Stephen Donnelly: Correct ERF name, add WTAP_ENCAP string display https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7313 svn path=/trunk/; revision=43141
2012-06-06 20:35:37 +00:00
proto_register_field_array(proto_frame, &hf_encap, 1);
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
proto_register_subtree_array(ett, array_length(ett));
Batch of filterable expert infos. svn path=/trunk/; revision=49584
2013-05-26 03:29:07 +00:00
expert_frame = expert_register_protocol(proto_frame);
expert_register_field_array(expert_frame, ei, array_length(ei));
Added a register_dissector() call in packet-frame.c so that frame is now a registered dissector and can be called by call_dissector(). svn path=/trunk/; revision=3233
2001-04-01 21:12:05 +00:00
register_dissector("frame",dissect_frame,proto_frame);
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Have "proto_register_protocol()" build a list of data structures for protocols, in addition to adding structures to the list of filterable fields. Give it an extra argument that specifies a "short name" for the protocol, for use in such places as pinfo->current_proto; the dialog box for constructing filters; the preferences tab for the protocol; and so on (although we're not yet using it in all those places). Make the preference name that appears in the preferences file and the command line for the DIAMETER protocol "diameter", not "Diameter"; the convention is that the name in question be all-lower-case. Make some routines and variables that aren't exported static. Update a comment in the ICP dissector to make it clear that the dissector won't see fragments other than the first fragment of a fragmented datagram. svn path=/trunk/; revision=2810
2001-01-03 06:56:03 +00:00
/* You can't disable dissection of "Frame", as that would be
tantamount to not doing any dissection whatsoever. */
Apply the patches from Tadaaki Nagao for a global version of disabled protocols ... svn path=/trunk/; revision=9538
2004-01-03 18:40:08 +00:00
proto_set_cant_toggle(proto_frame);
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
Clean up indentation. svn path=/trunk/; revision=4362
2001-12-08 21:03:41 +00:00
/* Our preferences */
frame_module = prefs_register_protocol(proto_frame, NULL);
prefs_register_bool_preference(frame_module, "show_file_off",
Group time related fields. Drop packet length in favor of frame length. Clean up code / indentations / header fields. Improve docsis preference description. svn path=/trunk/; revision=27329
2009-01-29 22:43:49 +00:00
"Show File Offset", "Show offset of frame in capture file", &show_file_off);
From Anand V. Narwani: DOCSIS support, including support for "Ethernet" captures where the raw frame is a DOCSIS frame rather than an Ethernet frame (some Cisco cable-modem head-end gear can send out a trace of all traffic on an Ethernet, but what it sends are the raw bytes of DOCSIS frames, not Ethernet frames) Get rid of second AUTHORS entry for Devin Heitmueller, merging its item into the older entry. Clean up the order of some lists of plugin items. svn path=/trunk/; revision=5861
2002-07-12 22:52:43 +00:00
prefs_register_bool_preference(frame_module, "force_docsis_encap",
"Treat all frames as DOCSIS frames", "Treat all frames as DOCSIS Frames", &force_docsis_encap);
From Jim Young: The attached patch augments the epan/dissectors/packet-frame.c module to optionally generate MD5 hashes of each packet. These MD5 hashes are calculated in the same manner as the MD5 hash used for duplicate packet removal by the editcap utility. The ability to generate the MD5 hashes can be enabled or disabled by a new boolean preferences option: frame.generate_md5_hash. By default MD5 hash generation is disabled. To help identify frames with matching MD5 hashes this patch also includes a new display filter: frame.md5_hash. svn path=/trunk/; revision=27150
2009-01-04 12:08:17 +00:00
prefs_register_bool_preference(frame_module, "generate_md5_hash",
"Generate an MD5 hash of each frame",
"Whether or not MD5 hashes should be generated for each frame, useful for finding duplicate frames.",
&generate_md5_hash);
From enhancement bug #4272: Patch to add new filterable field - frame.time_epoch svn path=/trunk/; revision=31110
2009-11-29 09:26:01 +00:00
prefs_register_bool_preference(frame_module, "generate_epoch_time",
"Generate an epoch time entry for each frame",
"Whether or not an Epoch time entry should be generated for each frame.",
&generate_epoch_time);
From Edwin Groothuis via bug #5833: Make number of bits in Frame header optional svn path=/trunk/; revision=36652
2011-04-15 17:53:23 +00:00
prefs_register_bool_preference(frame_module, "generate_bits_field",
"Show the number of bits in the frame",
"Whether or not the number of bits in the frame should be shown.",
&generate_bits_field);
Tap api. tap is a simple api that can be used for arbitrary extensions. One example extension is rpcstat. Try -Z rpc,rtt,100003,3 as argument to tethereal when reading a capture containing NFSv3 packets. tap-rpcstat.[ch] is intended to demonstrate the api and can be used to base other extensions on. svn path=/trunk/; revision=6175
2002-09-04 09:40:29 +00:00
frame_tap=register_tap("frame");
Implement epan_dissect_new() and epan_dissect_free(). These are the "top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
2000-10-06 10:11:40 +00:00
}
Added a proto_reg_handoff_frame() function and switched from using dissect_data() to using call_dissector() svn path=/trunk/; revision=4268
2001-11-26 01:23:59 +00:00
void
Clean up indentation. svn path=/trunk/; revision=4362
2001-12-08 21:03:41 +00:00
proto_reg_handoff_frame(void)
{
data_handle = find_dissector("data");
From Anand V. Narwani: DOCSIS support, including support for "Ethernet" captures where the raw frame is a DOCSIS frame rather than an Ethernet frame (some Cisco cable-modem head-end gear can send out a trace of all traffic on an Ethernet, but what it sends are the raw bytes of DOCSIS frames, not Ethernet frames) Get rid of second AUTHORS entry for Devin Heitmueller, merging its item into the older entry. Clean up the order of some lists of plugin items. svn path=/trunk/; revision=5861
2002-07-12 22:52:43 +00:00
docsis_handle = find_dissector("docsis");
Added a proto_reg_handoff_frame() function and switched from using dissect_data() to using call_dissector() svn path=/trunk/; revision=4268
2001-11-26 01:23:59 +00:00
}