Commit Graph

204 Commits

Author SHA1 Message Date
Gerald Combs 033366bda6 From Edwin Groothuis via bug 5813:
In the explanation of TCP Option 78 (Riverbed Transparency), the labels
are "CSH IP Addr/Port" and "SSH IP Addr/Port". This should be "Src SH IP
Addr/Port" and "Dst SH IP Addr/Port".
The filter keys for these labels are correct.

svn path=/trunk/; revision=36667
2011-04-16 16:45:38 +00:00
Bill Meier 9b36f03fc9 Don't assign to a proto_item * if the value won't be used: Coverity 1054-1056.
svn path=/trunk/; revision=36631
2011-04-13 21:27:08 +00:00
Chris Maynard 39013df13f Allow TCP segment data to be filterable via "tcp.data".
svn path=/trunk/; revision=36629
2011-04-13 18:15:41 +00:00
Stig Bjørlykke 8d62b393a4 Register tcp by name.
To be used in User DLT's and Lua scripts.

svn path=/trunk/; revision=36414
2011-03-31 12:18:14 +00:00
Jeff Morriss 5e1b6cf408 Reword the comments from rev 36304.
Replace the tabs in the file (mostly added by me) with spaces (for consistency).

svn path=/trunk/; revision=36338
2011-03-25 22:20:27 +00:00
Jeff Morriss cc6fc23812 From Didier via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3055 :
Apply rev 25869 to most of the rest of the TCP-desegmenting dissectors.
(The SSL dissector was already updated in one of two spots with bug 4535/rev
32456.)

A couple of the patches had to be manually applied.

From me: Fix the comments to match the change (including in the TCP and SSL
dissectors.)

svn path=/trunk/; revision=36332
2011-03-25 19:02:18 +00:00
Jeff Morriss 2c8e2564f6 Fix the problem reported in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3785#c14 :
If we thought we finished reassembly (and called the subdissector) only to find
out that the subdissector asked for more data, handle the case where the
subdissector asked for DESEGMENT_UNTIL_FIN.  Previously we only handled the
possibility that the subdissector would ask for a specific number of bytes or
DESEGMENT_ONE_MORE_SEGMENT.

svn path=/trunk/; revision=36330
2011-03-25 15:45:37 +00:00
Gerald Combs 2ea9b63ee7 If a segment looks like a retransmission, don't mark it out-of-order.
svn path=/trunk/; revision=36323
2011-03-25 00:28:47 +00:00
Jeff Morriss 8c73d0c6f4 If we've already seen a segment which starts a multi-segment pdu (i.e., it's
a retransmission), don't add it to the list (tree) of multi-segment pdus.

Otherwise, if we'd already seen the rest of the pdu and the other segments
were not retransmitted, the retransmission would break dissection of the pdu
because lookups for the segment would find the retransmission (to which the
other segments were not attached).

Since we know this segment is a retransmission, don't bother handing it off
to the subdissector either.

Use PINFO_FD_VISITED().
Add some white space in the desegmentation routine to improve readability.

Apply the same changes to the SSL dissector.

svn path=/trunk/; revision=36304
2011-03-24 02:10:04 +00:00
Sake Blok f28084f772 Fix for bug 5743 : tshark incorrectly calculates tcp stream for SYN packets when port numbers are re-used
svn path=/trunk/; revision=36162
2011-03-08 11:26:34 +00:00
Stig Bjørlykke 84bc28bd6a Introduce "Fragment count" filter element for all protocols doing reassembly.
svn path=/trunk/; revision=35705
2011-01-30 21:01:07 +00:00
Sake Blok ea4ac173d0 Add "tcp.window_size_value" and "tcp.window_size_scalefactor" conform
the discussion in bug 5541. Since we now have the window size value as
well as the scaled window size, there is no need anymore for the
tcp preference "tcp_window_scaling".


svn path=/trunk/; revision=35425
2011-01-08 15:51:38 +00:00
Guy Harris 4b057e1071 It's not a good idea to use tcph->th_seglen if you haven't set it.
Fixes bug 4211.

svn path=/trunk/; revision=35313
2010-12-31 00:02:54 +00:00
Guy Harris a8bc4a0d13 Rename the routines that handle dissector tables with unsigned integer
keys to have _uint in their names, to match the routines that handle
dissector tables with string keys.  (Using _port can confuse people into
thinking they're intended solely for use with TCP/UDP/etc. ports when,
in fact, they work better for things such as Ethernet types, where the
binding of particular values to particular protocols are a lot
stronger.)

svn path=/trunk/; revision=35224
2010-12-20 05:35:29 +00:00
Jaap Keuter 9da77c4716 Riverbed published patch for dissection of Riverbed TCP Probe/Transparency TCP options.
svn path=/trunk/; revision=35184
2010-12-14 07:43:17 +00:00
Bill Meier 03b57df5a0 Fix various typos and spelling errors.
svn path=/trunk/; revision=35126
2010-12-06 01:34:58 +00:00
Anders Broman 2c042dcd15 Use value_string_ext.
svn path=/trunk/; revision=34845
2010-11-11 21:18:15 +00:00
Anders Broman 0d246c79a9 display the the PDU length as "cut short"if it crosses the boundary of the
* packet and no more packets are available.
Based on the patch from Alexander Koeppe in
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5285

svn path=/trunk/; revision=34799
2010-11-06 21:05:45 +00:00
Jeff Morriss 33f116a46d Restore pinfo->private_data after an exception was thrown by a subdissector.
This is necessary in case a subdissector had changed it but was unable to
restore it (due to the exception).

Remove check_col().

svn path=/trunk/; revision=34436
2010-10-08 17:48:22 +00:00
Stephen Fisher 0e0641f079 Put the ": %u (multiply by %u)" back on the TCP window scaling option, so
users don't have to expand the tree to see the details that were there 
before rev 34094.


svn path=/trunk/; revision=34096
2010-09-10 16:33:46 +00:00
Stephen Fisher f2e2be709a Expand description for "NOP" and "EOL" options to "No-Operation (NOP)" and
"End of Options List (EOL)" respectively.


svn path=/trunk/; revision=34095
2010-09-10 16:23:58 +00:00
Stephen Fisher 8d3e472866 Enhance the TCP option display for window scaling.
svn path=/trunk/; revision=34094
2010-09-10 16:12:17 +00:00
Stephen Fisher ff5cfee491 Turn the TCP timestamp option into a subtree to also show the option kind,
option length and values with proto_tree_add_item() intead of _add_text().
The options tree still shows the same information as before until the sub-
tree is expanded.

The goal is to do this with all TCP and IP options.


svn path=/trunk/; revision=34088
2010-09-08 23:10:52 +00:00
Stig Bjørlykke d968bc8b61 Mask out the header length from th_flags.
svn path=/trunk/; revision=34087
2010-09-08 21:25:14 +00:00
Stephen Fisher b17b2eb187 Make the Windows buildbot happy: guint8 -> guint16 for flags variable in
definition of tcp_analyze_sequence_number(). 


svn path=/trunk/; revision=34086
2010-09-08 21:11:45 +00:00
Stephen Fisher e12fc91a33 Minor correction to SVN revision 34084: we better only try up to the 9
available values in flags[], so we don't run past the end of the array
if one of the reserved flags is set. 


svn path=/trunk/; revision=34085
2010-09-08 20:52:00 +00:00
Stephen Fisher dfacac4421 Expand the TCP flags to include the low nibble of the byte that has
the header length in the high nibble.  The only new flag is nonce (NS);
the remaining three bits are still reserved.


svn path=/trunk/; revision=34084
2010-09-08 20:43:19 +00:00
Stephen Fisher de23882f07 Fix typo in comment: datat -> data
svn path=/trunk/; revision=34044
2010-09-02 17:11:48 +00:00
Sake Blok 93cfe5571b From Cal Turney (bug 5132):
TCP bytes_in flight becomes inflated with lost packets 

This patch suspends Bytes-in-Flight calculation when missing packets are detected.


svn path=/trunk/; revision=33994
2010-08-29 15:27:20 +00:00
Stig Bjørlykke e3aab56e64 Added support for RFC5482: User Timeout Option.
svn path=/trunk/; revision=33784
2010-08-12 14:09:08 +00:00
Gerald Combs 7e0e3b696b Revert r30979, which removed the window size in SYN packets. People were
asking where it went.

svn path=/trunk/; revision=33694
2010-08-03 00:09:41 +00:00
Bill Meier 05b7c16830 Implement a separate pref for enabling tracking of tcp window scaling
(instead of including this pref as part of enabling tcp relative sequence numbers).

svn path=/trunk/; revision=33479
2010-07-09 01:46:11 +00:00
Gerald Combs 8906791528 Shorten "Number of bytes in flight" to "Bytes in flight", otherwise we
end up with a really wide column.

svn path=/trunk/; revision=33373
2010-06-29 15:58:00 +00:00
Stig Bjørlykke 1069c8dccf Added an expert info for "4 NOP in a row" in IP and TCP.
svn path=/trunk/; revision=33265
2010-06-20 16:22:51 +00:00
Jeff Morriss 729de1a635 As suggested in http://www.wireshark.org/lists/wireshark-dev/200809/msg00075.html
(as referenced in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2907 ) and
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3411 :

Write a new convenience routine for finding a conversation and, if it is not
found, create it.  The frame number and addresses are taken from pinfo (as is
the common case).

Use this function in a bunch of dissectors.

svn path=/trunk/; revision=32790
2010-05-13 18:28:34 +00:00
Bill Meier b693776556 Let's not use tabs with tab-width=4; Converts tabs to spaces (with indent=4).
Also: use consistent indentation.

svn path=/trunk/; revision=32586
2010-04-28 16:03:47 +00:00
Jaap Keuter 67f0696eda From jmmikkel:
Set the sequence number for the next PDU if the current frame contains both the finish of the previous and the complete next one.

svn path=/trunk/; revision=32585
2010-04-28 08:19:39 +00:00
Jaap Keuter bba09f0284 From Alexis La Goutte:
Add support of TCP Packet Mood (TCP Option 25)
More information is available in RFC 5841

svn path=/trunk/; revision=32498
2010-04-16 19:21:31 +00:00
Jaap Keuter 3f6e8b0284 From Martin Visser:
Please change the dissector so that TCP packets that have the "SACK permitted"
option set, set the "tcp.options.sack_perm" field to 1.

svn path=/trunk/; revision=32273
2010-03-23 20:05:04 +00:00
Jaap Keuter ac07c187ee Harden "Process Information" presentation functions.
svn path=/trunk/; revision=31806
2010-02-05 22:08:29 +00:00
Stig Bjørlykke 47e732e29e Changed "reassembled_length" -> "reassembled.length".
svn path=/trunk/; revision=31776
2010-02-03 08:47:15 +00:00
Stig Bjørlykke 98df26f3a9 Added protocol name to "Reassembled length" text.
svn path=/trunk/; revision=31774
2010-02-02 22:32:31 +00:00
Stig Bjørlykke 88b72356ad Introduce "Reassembled length" filter element for all protocols doing
reassembly.

svn path=/trunk/; revision=31767
2010-02-02 16:01:52 +00:00
Bill Meier 73eb16d678 Fix some gcc -Wshadow warnings
svn path=/trunk/; revision=31623
2010-01-22 17:41:47 +00:00
Anders Broman 4a38ad658c Get rid of check_col();
svn path=/trunk/; revision=31533
2010-01-15 07:32:04 +00:00
Anders Broman 90bf722451 From Chris Costa:
tcp.analysis.acks_frame and tcp.analysis.ack_rtt is not reliable.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3311

svn path=/trunk/; revision=31532
2010-01-15 07:20:25 +00:00
Anders Broman a230916b8e From Didier Gautheron:
Don't use packet without data in sequence analysis.

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2054

svn path=/trunk/; revision=31531
2010-01-15 07:07:28 +00:00
Sake Blok 1580d332f4 Fix for bug 3955 and 4288. When doing Follow TCP stream, there was no
check whether a packet belonged to the correct tcp stream (when there 
are multiple streams in the tracefile with the samen ip addresses and 
tcp ports.


svn path=/trunk/; revision=31252
2009-12-13 01:10:55 +00:00
Ronnie Sahlberg 6c05ca1051 dont print the window size for the initial SYN packet
svn path=/trunk/; revision=30979
2009-11-16 21:26:55 +00:00
Anders Broman 88bb44a51e From Jakub Zawadzki:
Cleanup dissector code - use proper memory functions.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4164

svn path=/trunk/; revision=30691
2009-10-25 11:43:30 +00:00