I've done more than a day to change the timestamp resolution from microseconds to nanoseconds. As I really don't want to loose those changes, I'm going to check in the changes I've done so far. Hopefully someone else will give me a helping hand with the things left ...
What's done: I've changed the timestamp resolution from usec to nsec in almost any place in the sources. I've changed parts of the implementation in nstime.s/.h and a lot of places elsewhere.
As I don't understand the editcap source (well, I'm maybe just too tired right now), hopefully someone else might be able to fix this soon.
Doing all those changes, we get native nanosecond timestamp resolution in Ethereal. After fixing all the remaining issues, I'll take a look how to display this in a convenient way...
As I've also changed the wiretap timestamp resolution from usec to nsec we might want to change the wiretap version number...
svn path=/trunk/; revision=15520
filter as an argument on the command line and have a dialog box to enter
the display filter through the GUI. Use it for all stats using
"gtk_tap_dfilter_dlg_cb()".
Add a top-level "stat_menu.h" file to declare "REGISTER_STAT_GROUP_E"
for the benefit of the declaration of "register_dfilter_stat()" in the
top-level "tap_dfilter_dlg.h". Rename the "stat_menu.h" in the gtk
directory to "gtk_stat_menu.h", so as not to have two headers with the
same name.
Get rid of headers not declaring any functions not being used in the
module.
svn path=/trunk/; revision=15493
(so if the file's gzipped, it's *NOT* the size of the file after
uncompressing), and an approximation of the amount of that data read
sequentially so far.
Use those for various progress bars and the like.
Make the fstat() in the Ascend trace reader directly use wth->fd, as
it's inside Wiretap; that gets rid of the last caller of wtap_fd() (as
we're no longer directly using fstat() or lseek() in Ethereal), so get
rid of wtap_fd().
svn path=/trunk/; revision=15437
data, so that "f_len" still keeps the size of the underlying file (which
is necessary in order to make the progress bar when files are being read
work correctly).
svn path=/trunk/; revision=15415
name of the file being loaded to "delayed_create_progress_dlg()". Get
rid of the pointless "g_strdup_printf()" call (which amounted to a
more-expensive "g_strdup()", and the variables it used.
svn path=/trunk/; revision=15248
-show the current capture file size, if capturing in real time mode.
-move the packet "Drops" count (if available) from file to packets statusbar part
svn path=/trunk/; revision=14130
If this is used together with an option where input files changes too fast (e.g. new file every second), capturing will be (hopefully) stopped.
I've replaced the former capture pipe message format into a somewhat more general format to remove a lot of confusion.
svn path=/trunk/; revision=14054
most notably:
- moved opening of safe_file to the capture child (capture_loop.c)
- removed save_file_fd from capture_opts (no longer need to have it global)
svn path=/trunk/; revision=13953
structures allocated by a dissection. Currently, it's the same as
"init_dissection()", but they should be split with "init_dissection()"
allocating the initial data structures and "cleanup_dissection()"
freeing them and *not* reallocating the initial data structures.
Use "cleanup_dissection()" in "cf_close()" to make it easier to find leaks.
svn path=/trunk/; revision=13881
This is currently still disabled, as we cannot pass all required capture flags to the child process (lack of command line parameters).
svn path=/trunk/; revision=13558
file name argument; if the pointed-to pointer is null, it opens a
temporary file, and sets that pointer to a mallocated copy of the
pathname of the temporary file. It no longer needs a file descriptor as
an argument.
svn path=/trunk/; revision=13419
so if "wtap_dump_fdopen()" succeeds (as a side-effect of calling
"wtap_dump_close()"), even if "cf_merge_fails()" after that, so it
should do so if it fails.
That means we don't need to close it in the callers of "cf_merge_files()".
svn path=/trunk/; revision=13407
object code for libethereal.dll isn't generated by the
makefile in /trunk.
Having no code in /trunk linked into libethereal.dll
anymore, the definition of the macro _NEED_VAR_IMPORT_
can be moved from various source files in /trunk to /trunk/Makefile.nmake .
So do that, too.
svn path=/trunk/; revision=13389
to the "start live capture" callback, and call that from "do_capture()".
When opening a capture file, don't pop up the "What do you want to do?"
pane when closing any existing file you have open, as we're just going
to put the regular view up right after that.
svn path=/trunk/; revision=13332
Mark the "func" argument to "cf_callback_remove()" as unused.
Get rid of the "iface" argument to "cf_start_tail()", as it's no longer
used.
svn path=/trunk/; revision=13331
I've implemented a very simple callback mechanism which provides exactly this. I've tried GHook from GLib before, but this doesn't seem to be the right thing, as it's too inflexible for the purpose here.
So I've implemented a callback function in main.c which receives all "events" and spreads them to menu, statusbar and itself.
I would see this implementation as a prototype which may need improvements. Please comment the changes.
svn path=/trunk/; revision=13330
"main_set_for_capture_file()"; it should only deal with menus, not
anything else - and it gets called while the menus are being set up,
which is before the main window has been completely created, so
"main_widgets_show_or_hide()", which is called by
"main_set_for_capture_file()", gets errors trying to show or hide
widgets the pointers to which are null.
svn path=/trunk/; revision=13328
move another two capture related fields (iface and cfilter) from cfile to capture_opts
also move the handling of capture related command line options from main.c to capture.c, that way a future privilege seperated capture program can use the same code to parse it's command line than Ethereal.
It might be even possible to share this parser code even with Tethereal, didn't took a closer look at this.
svn path=/trunk/; revision=13320
cf_ functions, have separate ones for different classes of routines, and
use gboolean when the return value is just "success" or "failure" - that
way you don't get compiler warnings if a case statement isn't handling a
particular status value if the routine in question won't return it.
svn path=/trunk/; revision=13293
This includes: all functions in file.h now have a cf_ prefix, will have doxygen tags, will have the capture_file *cf as the first parameter and I tried to generalize the return values for non trivial functions.
Hopefully, I didn't introduced any new bugs, as I had to change a lot of files...
svn path=/trunk/; revision=13289
don't use global cfile at all but only an untpyed handle to call the cf_... functions in file.c
move the save_file member from capture_file to capture_opts, as it's only used while capturing and while preparing it
svn path=/trunk/; revision=13276
one.
"get_basename()" doesn't modify its argument, and its callers don't
modify the substring pointed to by the result, so make it take a "const
char *" as an argument and return a "const char *".
"find_last_pathname_separator()" doesn't modify its argument, so make it
a "const char *" - but some of its callers pass a non-"const" "char *"
and modify the result, so don't make its return value a "const char *".
And, as none of its callers are outside "filesystem.c", make it static.
In "about_folders_page_new()", have separate variables for pathnames
returned as "const char *" (which are cached by the routine that returns
them, so you can't modify them - and can't free them, so get rid of the
commented-out "g_free()" calls for them) and pathnames returned as "char
*" (which are allocated anew for each call, and can be modified, but
have to be freed).
Clean up white space.
svn path=/trunk/; revision=12881
that return the next packet from a set of {chronologically sorted,
sequential-by-file} packets; it doesn't need to have a loop over all
those packets, or any code to write packets.
Supply those abstractions, change the code that merges packets to do its
own writing, and have the Ethereal version manage a progress bar and
have the mergecap version print packet numbers in verbose mode, as the
common merge code used to do.
svn path=/trunk/; revision=12427
indication - success, read failure, write failure - and have their
callers handle read failures by looking for the file that got the read
failure and reporting the failure in question.
Free up the err_info string returned by "wtap_read()" after using it.
svn path=/trunk/; revision=12423
mergecap.c (get rid of the verbose printing of information for each
packet).
Have "merge_append_files()" return FALSE only on a write error, as
"merge_files()" does.
Sort the routines in "merge.c" in the order from "merge.h".
svn path=/trunk/; revision=12422
and use that information to provide better error messages.
Have "merge_open_outfile()" do all the work of filling in the
merge_out_file_t structure, with the values to use passed as arguments.
Get rid of some structure members that used to be used solely to pass
information to "merge_open_outfile()".
Add a "cf_merge_files()" routine to do the merging and reporting of errors.
svn path=/trunk/; revision=12420
really more of an Ethereal/Tethereal component than a libethereal
component (nothing else in libethereal knows about capture files); move
it back out of libethereal. (The range stuff doesn't; we leave it in
libethereal.)
svn path=/trunk/; revision=11898
they should ultimately be split into files with routines that handle
ranges, which are just subsets of [0,2^32), and packet ranges, which are
subsets of the packet list, possibly specified by a range.
Move them into epan, so they can be used by, for example, utilities that
handle ranges, such editcap.
svn path=/trunk/; revision=11890
already been marked and have unmark_frame() do likewise. Don't mess
with the marked frame count in mark_all_frames().
Be a little more paranoid about the marked frame count in other places.
svn path=/trunk/; revision=11775
"print_ok_cb()", and have "print_packets()" just work on a
"print_stream_t" handed to it, so that different platforms can open the
printer/print file in different ways (opening the file is probably not
going to be platform-dependent, but opening the printer will be).
svn path=/trunk/; revision=11544
a structure containing a pointer to print operations for that object and
a pointer to the private subclass-dependent data for that object, with
subclasses for text and PostScript, and use those rather than the old
scheme where a print format was passed as an argument - or where (as in
the case of printing summary information in Tethereal) we just printed
as text even if "-T ps" was selected.
Check whether those routines succeed or get an I/O error writing output.
Clean up indentation.
svn path=/trunk/; revision=11514
Also move ncp222.py, x11-fields, process-x11-fields.pl,
make-reg-dotc, and make-reg-dotc.py.
Adjust #include lines in files that include packet-*.h
files.
svn path=/trunk/; revision=11410
they have LF at the end of the line on UN*X and CR/LF on Windows;
hopefully this means that if a CR/LF version is checked in on Windows,
the CRs will be stripped so that they show up only when checked out on
Windows, not on UN*X.
svn path=/trunk/; revision=11400
the "text vs. PostScript" choice. The "text vs. PostScript" choice
should probably ultimately be done with a generic set of print methods,
to handle various platform-native print mechanisms more cleanly (and
perhaps the dialog box code for "export as {PDML,PSML}" should be
separate from the "export as text"/"print" dialog).
svn path=/trunk/; revision=11342
is per-packet and the packet has an encapsulation type we don't know
about, so handle it on reads as well as errors - show an error message
noting that we had a packet with a network type we don't know about, and
show the extra info returned for that error giving details.
It shouldn't return WTAP_ERR_UNSUPPORTED, however, so just give the
"wtap_strerror()" error for that case.
svn path=/trunk/; revision=11340
add a config.nmake option to control whether to build
libethereal.dll or not;
remove "./wiretap" from PATH to prevent problems due to
wrongly-loaded files;
build dissector.lib with MSVC;
move "print.c" and "ps.c" to the dissector helpers, as "print.c"
imports variables from packet-frame.c and packet-data.c, which
are in libethereal;
move "g711.c" out of the dissector helpers, as they're used only
by Ethereal in a tap, not in Tethereal or in any dissector;
add a .def file for libethereal;
arrange to declare global variables exported from libethereal
with "__declspec(dllimport)" when building programs that import
those variables;
update the NSIS installer.
Make the "configure" script define ETH_VAR_IMPORT as "extern".
svn path=/trunk/; revision=10834
when using GTK2 code for rendering the error. In order to correctly
render the error message, it must be XML escaped.
TODO: track down the remaining places where this XML escaping is
required, and fix it there too (not sure if they exist though).
svn path=/trunk/; revision=10764
-ps: added formatting hints for ghostscript, so pdf conversion will be much better
-ps: print a thin line at the top and bottom of each page
-ps/text: add an option to start a new page for every packet (formfeed)
svn path=/trunk/; revision=10660
print the header before each summary line, and print a blank line
separating the summary line and the remaining information.
svn path=/trunk/; revision=10614
with "string" rather than "ascii", to make it clearer what they're
involved with.
Use "gtk_toggle_button_set_active()", not
"gtk_toggle_button_set_state()" (the latter is a deprecated alias for
the former, probably dating back to GTK+ 1.0[.x] - 1.2[.x] and later
have "gtk_toggle_button_set_active()").
Do *NOT* change the radio buttons for the type of string search to do
based on whether we're doing a string search or not - doing so means we
don't correctly remember the type of string search.
Get rid of code to fetch some values that we don't subsequently use.
svn path=/trunk/; revision=10609
put the definition of it back under HAVE_LIBPCAP and don't add an extra
declaration in "file.h", as there's no longer code that needs to refer
to it if HAVE_LIBPCAP isn't defined.
svn path=/trunk/; revision=10350
I don't know whether this is the optimal patch, but it does the job.
file.h: extern declaration of auto_scroll_live
file.c: always declare auto_scroll_live
svn path=/trunk/; revision=10347
"main_filter_packets()", to force the filtering to be done even if the
filter is the same as the current one; this is necessary in order to
make sure "Follow TCP Stream" gets the packets processed even if you're
filtering the stream that's currently filtered in.
svn path=/trunk/; revision=10209
read errors; there are separate implementations for Ethereal (pops up an
alert box) and Tethereal (prints an error message).
Use those routines in the ASN.1 dissector.
svn path=/trunk/; revision=10152
"cf_XXX_failure_alert_box()" routines that put the alert box up, and
directly call the "alert_box.h" routines for OS errors.
svn path=/trunk/; revision=10028
attempt to write to a file (or close a file opened for writing).
Get rid of no-longer-needed #includes of <epan/filesystem.h>.
svn path=/trunk/; revision=10027
filter expressions; use that in a number of places, so we use the same
alert box. (More work is needed to figure out the right way to handle
some other "dfilter_compile()" failures.)
Use the error message from the display filter as the primary error, as
that's the message that tells you what the underlying problem is. (The
GNOME HIG says "In most situations the user should only need the primary
text to make a quick decision", so the primary text should tell you
what's wrong with the filter, not just that it's invalid. If there are
messages from the display filter code that don't give enough
information, or are a bit cryptic, such as "Unexpected end of filter
string," those should be fixed in the display filter code.)
Improve the error used if an empty filter is used for "find frame".
svn path=/trunk/; revision=10025
"simple_dialog()"; NULL might be #defined to be a pointer expression on
some platforms, causing compiler warnings (and, on platforms where a
null pointer doesn't have all its bits 0, possibly causing misbehavior,
although I don't think there are any such platforms on which Ethereal
runs).
Don't allow 0 as button mask argument to "simple_dialog()".
Squelch a compiler warning.
Report fatal problems as errors, not warnings.
Report file I/O errors with "file_open_error_message()".
Report file write errors (including those reported by "close()", e.g.
some errors writing to an NFS server) when saving raw packet data to a
file.
svn path=/trunk/; revision=9915
addition to an error code, an error info string, for
WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and
WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with
"g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed
strings returned as the error info string, and change the callers of
those routines to, for those errors, put the info string into the
printed message or alert box for the error.
Add messages for cases where those errors were returned without printing
an additional message.
Nobody uses the error code from "cf_read()" - "cf_read()" puts up the
alert box itself for failures; get rid of the error code, so it just
returns a success/failure indication.
Rename "file_read_error_message()" to "cf_read_error_message()", as it
handles read errors from Wiretap, and have it take an error info string
as an argument. (That handles a lot of the work of putting the info
string into the error message.)
Make some variables in "ascend-grammar.y" static.
Check the return value of "erf_read_header()" in "erf_seek_read()".
Get rid of an unused #define in "i4btrace.c".
svn path=/trunk/; revision=9852
"capture_file" structure. Keep it locally, instead.
Check for errors when printing packets.
Report failure to open a print destination and failure to write to a
print destination differently.
Don't have the "print preamble" and "print final" routines return
success/failure indications - revert to the old scheme where they
didn't, and have the callers use "ferror()" to check for errors.
Report write errors when printing dissections in Tethereal.
Report print errors as errors, not warnings.
svn path=/trunk/; revision=9828
"file_close_error_message()" - but just use "file_write_error_message()"
for UNIX-style errors, under the assumption that a close will only fail
because a buffer-flushing write fails or because "close()" itself fails
when, for example, pushing unsynced NFS client-side writes out over the
wire.
Make several routines in "print.c" return success/failure indications.
Check for write errors when printing "Follow TCP Stream" stuff or saving
it to a file.
svn path=/trunk/; revision=9825
"cf_write_error_message()"/"file_write_error_message()".
Use "file_open_error_message()" instead of "cf_open_error_message()" in
some places we missed in the previous checkin.
Catch ENOSPC and EDQUOT in "file_open_error_message()".
Use "file_open_error_message()" rather than "file_write_error_message()"
to report errors when creating the file to which we're saving the
"Follow TCP Stream" data.
svn path=/trunk/; revision=9823
translate UNIX errno values to a somewhat friendly message format
string.
Rename "file_open_error_message()" in "file.c" to
"cf_open_error_message()", make "cf_open_error_message()" use the new
"file_open_error_message()" for UNIX errno values, have "do_capture()"
in "capture.c" use "file_open_error_message()" to report errors from
"open()", and make "cf_open_error_message()" static as nothing outside
"file.c" uses it.
Do similar stuff in "tethereal.c".
svn path=/trunk/; revision=9821
As this will always be a Cancel of a running operation, this parameter was removed.
This makes us also able to use a stock button for this.
svn path=/trunk/; revision=9774
b.) added new feature "Edit->Go To First Packet" "Edit->Go To Last Packet" with corresponding menu and toolbar items
c.) added new feature "View->Zoom In" / "View->Zoom Out" / View->Normal Size" with corresponding menu and toolbar items
This feature will act as a "size offset" to the current fontsize, so that the packet list/tree view/... will have a larger/smaller font size.
The value is stored inside the recent file.
d.) Win32 only: Try to get the win32 system font and fontsize at program startup and show the menus/dialogs and such with the same font and fontsize like other win32 windows.
This makes the program make a *lot* more feel like a normal win32 program.
svn path=/trunk/; revision=9753
them and running all taps on them, but not reconstructing the packet
list. Use that in the IO-stat tap rather than "redissect_packet()"; the
latter does more work and redraws the display, neither of which are
necessary.
Call the filter callback when the Calc field is changed, to redraw the
graphs; that change also fixes things so that it's called when the
Filter field is changed.
Rename the "filter_button" member of an io_stat_graph_t to
"filter_field", as it's not the "Filter:" button, it's the text field
containing the filter expression.
svn path=/trunk/; revision=9659
packets in a loop; it handles reading the packet from the capture file,
creating and updating the progress bar, handling the stop button,
and handling range specifications.
Use that for printing and saving packets. (There might be other loops
that should use it as well.)
svn path=/trunk/; revision=9620
filter's colors" bug, by storing the pointer to the matching color_filter_t
structure in the frame_data structure.
Replace "frame" and "frames" by "packet" and "packets" in many places.
svn path=/trunk/; revision=9607
use the common display filter dialog infrastructure in the MGCP
service response time tap;
add common infrastructure for updating the titles of tap dialogs
when the capture file name changes.
svn path=/trunk/; revision=9366
"opened capture files" and "display filter used",
the settings will be saved in the file "recent" in the users config path
svn path=/trunk/; revision=9275
captures, as it has to compute the width of an auto-resizing column in
every row. Just pick fixed widths for the columns (and tune the width
of the "Protocol" column so that it's not narrower than the column
title).
svn path=/trunk/; revision=9219
pointers to the first *and* last child, in the "proto_node" structure
itself. That saves us one level of indirection and memory allocation,
and lets us append to a tree by appending to the last child directly,
rather than having to scan through the list of siblings of the first
child to find the end of that list.
svn path=/trunk/; revision=9171
last columns, if any, with that format, and use that to speed up
processing of columns with a particular format and checking whether
we're displaying a column with a particular format.
svn path=/trunk/; revision=9147
This makes the CulmulativeBytes field make more sense since if we want
something to be a TimeReference frame it is likely that we also want to
measure BOTH time and number of bytes (==culmulative bytes) until the event we are looking at.
svn path=/trunk/; revision=8956
return "<no file>" if there is no file loaded yet instead of crashing in io-stat
io-stat only print the label for the top tick on the y axis to make it look less cluttered
svn path=/trunk/; revision=8781
"set_menus_for_selected_packet()" and
"set_menus_for_selected_tree_row()", and have them decide whether to
enable or disable menu items based on whether that structure indicates
that a packet or field is selected and, if one is, on its properties.
Pass to the "selected packet enabled" routine for a menu item the
"frame_data" and "edt" members of the "capture_file" structure, and pass
to the "selected tree row enabled" routine the "field_info" member of
that structure.
Clear "cf->current_frame" if no packet is selected.
svn path=/trunk/; revision=8525
don't have to worry about the file name being null when
"cf_get_display_name()" is called. (It should never be called before we
have a capture file open; if it is, that's a bug.)
svn path=/trunk/; revision=8482
capture temporary files, it's "<capture", and for saved capture files,
it's the last component of the pathname of the file. Use that in
various places when displaying the file name.
svn path=/trunk/; revision=8474
One can now select a packet and mark it as a TimeReference packet using the menu.
A TimeReference packet will be indicated by having all timestamp related column entries replaced by the string *REF*
A TimeReference packet will always be displayed in the packet pane, and overrides any display filters.
When a frame is a TimeReference frame, all later frames will calculate the TimeRelativeToFirstPacket relative to the timestamp of the TimeReference frame instead of the first frame of the capture.
You can have any number of TimeReference frames you like.
svn path=/trunk/; revision=8459
the option to print only marked packets similarly, rather than as
"Suppress unmarked packets" (for consistency, and because the latter
isn't unlike a double negative).
svn path=/trunk/; revision=8451
Only calculate culmulative bytes on those packets that are actually displayed in the packet pane.
When a display filter is applied, culmulative bytes should only be calculated on thoise packets that are actually displayed.
svn path=/trunk/; revision=8418
Ethereal presents a column to display culmulative bytes into the capture.
A new column type is added : Culmulative Bytes.
While PacketLength column type specifies the number of bytes in the current packet,
Culmulative Bytes specifies the culmulative number of bytes from the start of the capture.
svn path=/trunk/; revision=8359
so we shouldn't torment the users by offering it.
Check the string type and convert it to an internal representation in
the GUI code; have the search code deal only with the internal
representation.
Save the case-sensitivity flag, and the indication of where string
searches look, along with other search parameters.
Upper-casify the string, for case-insensitive searches, in the GUI code;
don't save the upper-casified string, so it doesn't SHOUT at you when
you next pop up a "find" dialog.
Convert the hex value string to raw binary data in the GUI code, rather
than doing so in the search code. Check that it's a valid string.
Connect the signals to the radio buttons after the pointers have been
attached to various GUI items - the signal handlers expect some of those
pointers to be attached, and aren't happy if they're not.
Have "find_packet()" contain a framework for searching, but not contain
the matching code; instead, pass it a pointer to a matching routine and
an opaque pointer to be passed to the matching routine. Have all the
routines that do different types of searching have their own matching
routines, and use the common "find_packet()" code, rather than
duplicating that code.
Search for the Info column by column type, not by name (the user can
change the name).
When matching on the protocol tree, don't format the entire protocol
tree into a big buffer - just have a routine that matches the text
representation of a protocol tree item against a string, and, if it
finds a match, sets a "we found a match flag" and returns; have that
routine not bother doing any more work if that flag is set.
(Unfortunately, you can't abort "g_node_children_foreach()" in the
middle of a traversal.)
Free the generated display filter code after a find-by-display-filter
finishes.
svn path=/trunk/; revision=8306
isn't sufficient if the line to be printed is more than twice the
current size of the line buffer. Make it twice the size of the line to
be printed, instead.
svn path=/trunk/; revision=7921
specified by the user, so if the frame with that frame number isn't
being displayed, just refer to it as "That frame", not "The frame with
that frame number". (That's even OK if they *did* specify it.)
(If there's no such frame, that "shouldn't happen" in cases where it was
implicitly specified, e.g. by getting it from a list of fragments, or a
"{request,reply} is in frame XXX" field, or clicking on a point in a TCP
graph.)
svn path=/trunk/; revision=7258
frame and the previous frame in the capture - a frame that might not be
displayed, so you don't know what it was - rather than the previous
frame in the display, as is intended. Fix that.
svn path=/trunk/; revision=6708
in continue_tail_cap_file, the following test :
else if (*err != 0)
sometimes reads uninitialized memory (so the test might be incorrect).
We now set *err to 0 at the beginning of the function.
svn path=/trunk/; revision=6418
- moved color_filter_t in color.h
- change color_filter_t to use color_t instead of GdkColor
This changed allowed to remove the last gtk includes in file.c. It is
now completely free of any gtk related code.
svn path=/trunk/; revision=6324
- created a few packet_list_xxx functions (ui_util.h gtk/packet_list.c
gtk2/packet_list.c) ;
- removed almost all "gtk/xxx" and "gtk2/xxx" includes in file.c
The only remaining includes are related to color filters. We have to
make color_filter_t GUI independent by replacing GdkColor with color_t.
I'll work on this later.
svn path=/trunk/; revision=6311
All the deprecated widgets have not been replaced yet :
GtkList and GtkCList ==> GtkTreeView conversion :
- color_dlg.c
- column_prefs.c
- decode_as_dlg.c : done
- dfilter_expr_dialog
- filter_prefs.c
- main.c
- plugins_dlg.c : done
GtkCTree ==> GtkTreeView conversion : done
GtkText ==> GtkTextView conversion : done
Remaining problems :
- gtk_font_selection_dialog_set_filter doesn't exist anymore (but hasn't
been removed from the documentation). I don't know how to filter the
font selection dialog to get only fixed width fonts ;
- we have to remove GUI prefs which are not usefule anymore : tree line
style and tree expander style.
svn path=/trunk/; revision=6153
information.
Fix the types of some variables (make the file position in
"read_cap_file()" a "long", as Wiretap supports "long" offsets, and make
processed-packet counts in packet-processing loops "int"s, as the total
packet count in a "capture_file" structure is an "int").
svn path=/trunk/; revision=6112
equivalents for the toplevel directory. The removal of winsock2.h will
hopefully not cause any problems under MSVC++, as those files using
struct timeval still include wtap.h, which still includes winsock2.h.
svn path=/trunk/; revision=5932
Ethereal sometimes creates a progress dialog bar and then, if
the processing is fast, quickly destroys it. The resulting
"flash" can be disconcerting. This set of patches ensures a
progress bar is either not created or is displayed for a minimum
time.
svn path=/trunk/; revision=5916
Allow "-" as the output file name in Wiretap, referring to the
standard error.
Optimize the capture loop.
Fix some of the error-message printing code in Ethereal and Tethereal.
Have Wiretap check whether it can seek on a file descriptor, and pass
the results of that test to the file-type-specific "open for output"
routine. Have the "open for output" routines for files where we need to
seek when writing the file return an error if seeks don't work.
svn path=/trunk/; revision=5884
padding when printing text and use "putline" when printing PostScript.
Eliminate "hexdump", as it's just a special case of "putline".
Have "proto_tree_print_node()" just call "print_line()".
Get rid of "print_ps_hex()" - the font used for the hex dump and the
protocol tree are the same, so there's no need to switch fonts.
svn path=/trunk/; revision=5798
routines; instead, rename "print_hex_data_common()" to
"print_hex_data_buffer()" as it prints a buffer in hex and ASCII (or
EBCDIC), and have it take the print format as an argument.
Have it use "print_line()" to print lines, and fix "print_line()" so
that it prints a buffer *without* a newline at the end, printing the
newline itself.
svn path=/trunk/; revision=5729
Have "wtap_open_offline()", if asked to open a FIFO, return that error
if it was asked to open the file for random access.
svn path=/trunk/; revision=5643
in the "packet_info" structure instead, as we don't need a pointer for
every single frame in the capture file, just for each frame for which we
currently have an open "epan_dissect_t".
svn path=/trunk/; revision=5614
"from_filename" - are both null-terminated strings; compare them with
"strcmp", not "strncmp()". ("cf->filename" is a "char *", so
"sizeof(cf->filename)" is not the right third argument to "strncmp()" in
any case, as it's the size of a pointer, which is probably either 4 or 8
bytes.)
Make the dialog box for "Can't save over current capture file" an
ESD_TYPE_CRIT dialog box, as it's a fatal error.
svn path=/trunk/; revision=5526
Don't show progress bar for quick "Find Frame" searches
Add "Find Next" and "Find Previous" to repeat searches
Add documentation for "Find Next" and "Find Previous".
svn path=/trunk/; revision=5378
have "filter_packets()" make a copy of the filter string handed
to it, as it may save the filter string in the "capture_file"
structure, and the caller of "filter_packets()" shouldn't have
to worry about the string it passed to "filter_packets()" being
stashed away somewhere so that it can't just free that string or
change it;
have callers of "filter_packets()" free up the string they
handed to it, if the string was allocated and they're done with
it;
plug some memory leaks in "match_selected_cb_do()".
Check for an illegal "action" argument being passed to
"match_selected_cb_do()".
Move some keys out of "keys.h" into "gtk/main.c", as they're only used
in "gtk/main.c".
Make the pointer to the filter list a data item for the combo box, as
it's a copy of the list of strings for the combo box, rather than
attaching it to the widgets that activate the filter (a pointer to the
combo box *itself* is a data item for those widgets).
In "filter_activate_cb()", make a copy of the text from the text entry
field as soon as we fetch it, and use that copy. Free that copy if
we didn't add the filter to the filter list.
Don't make a copy of the entire filter list and use that to set the
combo box's list of items - just use the list itself. Also, when the
list is changed, make the new value the data for the combo box (the list
pointer will actually not be changed, because we happen to be using
"g_list_append()", but let's not rely on that).
svn path=/trunk/; revision=5368
the file grew while we were reading it, and re-fetch the size and try
again; if it's still > 1, give up and clamp it at 1 so that the GTK+
progress bar code doesn't complain.
svn path=/trunk/; revision=5232
be eliminated (because the function is called through a pointer, and
other functions called through the same pointer *do* use the argument)
as unused.
svn path=/trunk/; revision=5050
an "err" argument that points to an "int" into which to put an error
code if it fails.
Check for errors in one call to it, and note that we should do so in
other places.
In the "wtap_seek_read()" call in the TCP graphing code, don't overwrite
"cfile.pseudo_header", and make the buffer into which we read the data
WTAP_MAX_PACKET_SIZE bytes, as it should be.
In some of the file readers for text files, check for errors from the
"parse the record header" and "parse the hex dump" routines when reading
sequentially.
In "csids_seek_read()", fix some calls to "file_error()" to check the
error on the random stream (that being what we're reading).
svn path=/trunk/; revision=4874
non-existent functions.
Remove the "filetype" argument from the "can_write_encap" functions for
particular capture file types - the argument value is implicit, in that
the routine being called is the routine for that particular file type.
svn path=/trunk/; revision=4823
"init_dissection()" which calls "epan_conversation_init()", does the
work that "init_all_protocols()" did, and then calls
"reassemble_init()", so that the standard sequence of dissection
initialization is done in one place, rather than having multiple places
call the same sequence of routines.
svn path=/trunk/; revision=4797
"data source" has a name and a top-level tvbuff, and frames can have a
list of data sources associated with them.
Use the tvbuff pointer to determine which data source is the data source
for a given field; this means we don't have to worry about multiple data
sources with the same name - the only thing the name does is label the
notebook tab for the display of the data source, and label the hex dump
of the data source in print/Tethereal output.
Clean up a bunch of things discovered in the process of doing the above.
svn path=/trunk/; revision=4749
reading the capture file. Have callers of "wtap_snapshot_length()"
treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so
that, when writing a capture file in a format that *does* store the
snapshot length, we can at least put *something* in the file).
If we don't know the snapshot length of the current capture file, don't
display a value in the summary window.
Don't use "cfile.snap" as the snapshot length option when capturing -
doing so causes Ethereal to default, when capturing, to the snapshot
length of the last capture file that you read in, rather than to the
snapshot length of the last capture you did (or the initial default of
"no snapshot length").
Redo the "Capture Options" dialog box to group options into sections
with frames around them, and add units to the snapshot length, maximum
file size, and capture duration options, as per a suggestion by Ulf
Lamping. Also add units to the capture count option.
Make the snapshot length, capture count, maximum file size, and capture
duration options into a combination of a check box and a spin button.
If the check box is not checked, the limit in question is inactive
(snapshot length of 65535, no max packet count, no max file size, no max
capture duration); if it's checked, the spinbox specifies the limit.
Default all of the check boxes to "not checked" and all of the spin
boxes to small values.
Use "gtk_toggle_button_get_active()" rather than directly fetching the
state of a check box.
svn path=/trunk/; revision=4709
"epan/..." pathnames, so as to avoid collisions with header files in any
of the directories in which we look (e.g., "proto.h", as some other
package has its own "proto.h" file which it installs in the top-level
include directory).
Don't add "-I" flags to search "epan", as that's no longer necessary
(and we want includes of "epan" headers to fail if the "epan/" is left
out, so that we don't re-introduce includes lacking "epan/").
svn path=/trunk/; revision=4586
and "Automatic scrolling in live capture" options from the preference
settings for them, so that the preference settings affect the initial
values of those options, but changing those values in a capture don't
affect the preferences, and don't automatically get saved when you save
the preferences.
If we're building without libpcap, don't have an "Automatic scrolling in
live capture" option anywhere.
svn path=/trunk/; revision=4514
variables wrap-around. Since the request/reply packets are related via
a hash based on these uniqueness variables, long NCP traces can
have mis-matches reqeust/reply records.
Thus, only do the hash-lookup for the reply packet during the first
sequential scan of the trace file. Once the pertinent info is found,
store it in the packet's private data area.
Since the memory allocated for the hash and for the structures that make
up the keys are no longer needed after the first sequential run through
the trace file, arrange to free that memory after the first sequential
run. Similar to the register_init_routine() that allows dissectors
to register callbacks for calling *before* a capture file is loaded,
set up a register_postseq_cleanup_routine() function that allows
dissectors to register callbacks for calling *after* the first
sequential run-through of the trace file is made. This is not
a *final* cleanup callback, since Ethereal will still have that trace file
open for random-access reading.
I didn't have tethereal call postseq_cleanup_all_protocols() since
tethereal doesn't keep the trace file open for random-access reading.
I could easily be swayed to make tethereal call that function, however.
svn path=/trunk/; revision=4484
there are any columns whose time formats will change, and just return if
there aren't.
We also, however, need to set the "writable" flag on the columns before
doing that check, as "check_col()" checks whether the column in question
is writable; in this context, all columns are writable.
svn path=/trunk/; revision=4472
Put a hash-table of "interesting" fields in the per-proto-tree data.
The dfilter code records which fields/protocols are "interesting" (by which
I mean, their value or existence is checked). Thus, the proto_tree routines
can create special arrays of field_info*'s that are ready for the dfilter
engine to use during a filter operation.
Also store the "proto_tree_is_visible" boolean, renamed "visible", in
the per-proto-tree data.
Move epan_dissect_t to its own header file to make #include dependencies
easier to handle.
Provide epan_dissect_fill_in_columns(), which accepts just the epan_dissect_t*
as an argument.
epan_dissect_new() needs to be followed by epan_dissect_run() for the
dissection to actually take place. Between those two calls,
epan_dissect_prime_dfilter() can be run 0, 1, or multiple times in order to
prime the empty proto_tree with the "intersesting" fields from the dfilter_t.
svn path=/trunk/; revision=4422
display representation should be put into protocol tree items if a
protocol tree is to be constructed; have it set "proto_tree_is_visible"
from that argument.
svn path=/trunk/; revision=4408
structure to the "packet_info" structure; only stuff that's permanently
stored with each frame should be in the "frame_data" structure, and the
"column_info" structure is not guaranteed to hold the column values for
that frame at all times - it was only in the "frame_data" structure so
that it could be passed to dissectors, and, as all dissectors are now
passed a pointer to a "packet_info" structure, it could just as well be
put in the "packet_info" structure.
That saves memory, by shrinking the "frame_data" structure (there's one
of those per frame), and also lets us clean up the code a bit.
svn path=/trunk/; revision=4370
already contain a pointer to an epan_dissect_t, which contains
the proto_tree.
Routines calling epan_dissect_new() do not create their own
proto_tree via proto_tree_create_root(); instead, they pass a boolean
to epan_dissect_new() telling it whether it should create the root
proto_tree.
svn path=/trunk/; revision=4343
trying to read the frame table, return -1 with "*err" set to
WTAP_ERR_SHORT_READ, don't return 0 - we've already decided that the
file is a NetMon file, so we shouldn't return a "this isn't a NetMon
file" indication, we should return a "this file is too short" error, as
that's what the problem is.
Fix up the error messages for WTAP_ERR_SHORT_READ to indicate that the
read might have gotten cut short in the middle of data other than a
packet.
svn path=/trunk/; revision=4331
access their own "pinfo". A packet_info is stored in epan_dissect_t,
which is created for the dissection of a single packet.
GUI functions which need to access the packet_info of the currently
selected packet used to use "pi"; now they use cfile.edt->pi. cfile's
"edt" member is the epan_dissect_t of the currently-selected packet.
The functionality of blank_packetinfo() was moved into
dissect_packet(), as that's the only place that called blank_packetinfo(),
after a spurious call to blank_packetinfo() was removed from
packet_list_select_cb().
svn path=/trunk/; revision=4246
and call it both from "select_packet()" and "create_new_window()",
rather than having two similar loops in both places.
svn path=/trunk/; revision=4233
directory in which global data files are stored. If an installed binary
is being run, that's the correct directory for them; if a build-tree
binary is being run, the "manuf" file will be there, and you can put
other data files there as well, if necessary.
Do the same with plugins, except that, if there's no
"plugins\\{version}" subdirectory of that directory, fall back on the
default installation directory, so you at least have a place where you
can put plugins for use by build-tree binaries. (Should we, instead,
have the Windows build procedure create a subdirectory of the "plugins"
source directory, with the plugin version number as its name, and copy
the plugins there, so you'd use the build-tree plugin binaries?)
Move "test_for_directory()" out of "util.c" and into
"epan/filesystem.c", with the other file system access portability
wrappers and convenience routines. Fix "util.h" not to declare it - or
other routines moved to "epan/filesystem.c" a while ago.
svn path=/trunk/; revision=3858
allow you to suppress the printing of unmarked packets.
This allows a user to mark the packets they wish to print and
print ONLY those packets by suppressing all other unmarked packets.
This may seem like a bit of a convoluted way of expressing things,
as usually the desired behavior would be to print the marked packets.
However, we do NOT print marked packets that are not displayed under
the current filter. To be maximally explicite I've expressed this
as suppressing unmarked frames.
svn path=/trunk/; revision=3736
get from calling "wtap_file()", so get rid of the call and the
(otherwise unused) variable to which its result gets assigned.
That lets us get rid of "wtap_file()" in Wiretap.
It also lets us get rid of the include of "zlib.h" in "file.h"; the
#defines of "file_open()", "filed_open()", and "file_close()" are also
unnecessary, so we get rid of those as well.
However, that means we need to include <zlib.h> in "gtk/main.c" and
"tethereal.c", so that the version number of libz is defined and can
show up in the version string.
svn path=/trunk/; revision=3652
a "Match Selected" on it - we can't do a "Match Selected" if the field
has no value (e.g., FT_NULL) and has a length of 0.
If we unselect the current packet, we don't have a protocol tree, so we
don't have a currently selected field - clear the "Match Selected" menu
item and the display in the status line of information about the
currently selected field.
Move the low-level statusbar manipulation into "gtk/main.c", in routines
whose API doesn't expose anything GTK+-ish.
"close_cap_file()" calls one of those routines to clear out the status
bar, so it doesn't need to take a pointer to the statusbar widget as an
argument.
"clear_tree_and_hex_views()" is purely a display-manipulating routine;
move it to "gtk/proto_draw.c".
Extract from "tree_view_unselect_row_cb()" an "unselect_field()" routine
to do all the work that needs to be done if the currently selected
protocol tree row is unselected, and call it if the currently selected
packet list row is unselected (if it's unselected, there *is* no
protocol tree, so no row can be selected), as well as from
"tree_view_unselect_row_cb()".
Before pushing a new field-description message onto the statusbar, pop
the old one off.
Get rid of an unused variable (set, but not used).
svn path=/trunk/; revision=3513
by the "edt" member of a "capture_file" structure if we were selecting a
new frame, we were just overwriting that pointer).
Update Gerald's e-mail address.
svn path=/trunk/; revision=3470
control whether we have a child process do the capturing; a user might
want the packet list to be updated as packets arrive but *not* want it
to scroll so that the most recently arrived packets are shown.
"prefs.capture_auto_scroll", not "auto_scroll_live", should control
whether we scroll a real-time-update capture's packet list;
"auto_scroll_live" isn't set by the capture dialog box,
"prefs_capture_auto_scroll" is.
svn path=/trunk/; revision=3388
as, on a large capture, it could take a significant amount of time.
Let the user stop the computation and, if they do, don't pop up the
statistics dialog box.
Create a new header file declaring the routines to create, update, and
destroy progress dialog boxes; those routines' APIs don't depend on
GTK+, but others declared in "ui_util.h" do, and we don't want to oblige
a source file to depend on GTK+ headers unless it uses a GTK+ API or an
API that depends on GTK+.
svn path=/trunk/; revision=3179
Tvbuffers changed to added the data source name,
GUI and printing code changed to support these changes
and display the multiple hex views.
svn path=/trunk/; revision=3165
capturing; if we succeed, display the packet drops count as the "Drops"
value in the status line and as the "Dropped packets" statistics in the
summary dialog box, otherwise don't display it at all.
In Tethereal, attempt to get the packet statistics from libpcap when
capturing; if we succeed, and if there were any dropped packets, print
out the count of dropped packets when the capture finishes.
svn path=/trunk/; revision=3016
into epan/ftypes.
Re-write display filter routines using Lemon parser instead of yacc.
Besides using a different tool, the new grammar is much simpler, while
the display filter engine itself is more powerful and more easily extended.
Add dftest executable, to test display filter "bytecode" generation.
Add option to "configure" to build dftest or randpkt, both of which are not
built by default.
Implement Ed Warnicke's ideas about dranges in the new display filter and
ftype code.
Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered
as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree,
while FT_PROTOCOL is used for protocols. This was necessary for being
able to make byte slices (ranges) out of protocols, like "frame[0:3]"
Win32 Makefile.nmake's will be added tonight.
svn path=/trunk/; revision=2967
requires that the dfilter code be initialized before the plugins are
added; this required us to *re*-initialize the dfilter code after
reading in all the plugins, as the plugins may themselves have added new
filterable fields - that was a bit of a mess), and make the
"Tools->Plugins" dialog box show the new-style plugins.
svn path=/trunk/; revision=2950
"color_t" structure to store color values (although currently it has all
the same fields that a GdkColor has; its currently advantage is that you
don't have to include any GTK/GDK stuff to declare it).
Add routines in the "gtk" directory to convert between "color_t" and
GdkColor values.
Define, in "prefs.h", all colors as "color_t" values rather than
GdkColor values. "prefs.h" now no longer needs to include <gtk/gtk.h>,
so don't include it.
svn path=/trunk/; revision=2692
can be put, and a pointer to the string for the column, which might or
might not point to that buffer.
Add a routine "col_set_str()", which sets the string for the column to
the string passed to it as an argument; it should only be handed a
static string (a string constant would be ideal). It doesn't do any
copying, so it's faster than "col_add_str()".
Make the routines that append to columns check whether the pointer to
the string for the column points to the buffer for the column and, if
not, copy the string for the column to the buffer for the column so that
you can append to it (so you can use "col_set_str()" and then use
"col_append_str()" or "col_append_fstr()").
Convert a bunch of "col_add_str()" calls that take a string constant as
an argument to "col_set_str()" calls.
Convert some "col_add_fstr()" calls that take a string constant as the
only argument - i.e., the format string doesn't have any "%" slots into
which to put strings for subsequent arguments to "col_set_str()" calls
(those calls are just like "col_add_str()" calls).
Replace an END_OF_FRAME reference in a tvbuffified dissector with a
"tvb_length(tvb)" call.
svn path=/trunk/; revision=2670
files from being #included in epan/packet.c.
Fix the other files that need either "gtk/colors.h" or <gtk/gtk.h> #included
as a result of not pulling in gtk/colors.h automatically because of file.h.
svn path=/trunk/; revision=2519
"top-level" dissectors that libepan-users call, instead of dissect_packet().
The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's
memory is not cleared until after the proto_tree is freed. (I might stuff
the proto_tree into the epan_dissect_t, too).
What remains of dissect_packet() in packet.c handles the tvbuff initialiation.
The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c
This means that "packet.c" is no longer a dissector, os it is no longer
passed to make-reg-dotc.
Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped()
and dissect_fddi_nonswapped()), the a dissector handoff routine could
be used instead of the switch statement in dissect_frame(). I'd register
a field like "wtap.encap"
svn path=/trunk/; revision=2478
attempt to read from a capture file is to check whether the error
returned was 0 - if it is, it's an EOF. We no longer guarantee that the
data offset supplied will be negative on an error and 0 on an EOF.
svn path=/trunk/; revision=2445
may be redrawing a packet window that displays a frame other than the
current frame; give it arguments to specify the raw frame data and
"frame_data" structure for the frame.
This requires that each packet window have, associated with it, a
pointer to the "frame_data" structure; that replaces the "cap_len" and
"encoding" fields in a "PacketWinData" structure, as those are just
copies of fields from the frame's "frame_data" structure.
"packet_hex_print()" needn't be passed both the start and length values
from a "field_info" structure - just pass it a pointer to that
structure, or NULL for "no field is selected in the packet". It also
needn't, any longer, be passed the "cap_len" and "flags.encoding" fields
of a "frame_data" structure - just pass it a pointer to that structure.
In "redraw_hex_dump_all()", don't redraw the hex dump pane of the main
window if there is no current frame.
svn path=/trunk/; revision=2404
the text in all "Follow TCP Stream" windows;
the text in the help window if we have one up;
all hex dump windows;
when GUI preference changes are to be applied, so that font changes and
"Follow TCP Stream" color changes show up.
Update both the Roman and bold font when the font is changed.
Don't decrement the reference counts on the old Roman and bold fonts
until that's all done.
svn path=/trunk/; revision=2401
highlighting of the bytes, in the hex dump window, corresponding to a
selected field.
Also, make "remember_ptree_widget()" static, as it's not used outside
"gtk/proto_draw.c".
svn path=/trunk/; revision=2399
a "keep reading" boolean value is returned from the function.
This avoids having to hack around the fact that some file formats truly
do have records that start at offset 0. (i4btrace and csids have no
file header. Neither does the pppdump-style file that I'm looking at right now).
svn path=/trunk/; revision=2392
capture, clear the per-frame data pointers of all frames in the capture,
as those pointers now refer to data that's been freed.
Do that to all frames even if the user stops the rescan in the middle -
and clear the "visited" flag for all frames as well.
svn path=/trunk/; revision=2361
redissecting the packets due to some preference changing, as the
preference may affect what state information gets constructed as a
result of some particular frame being dissected.
We don't have to do it when filtering the packets, or colorizing them,
however.
svn path=/trunk/; revision=2359
number of replies seen, keep the frame number of the first request seen
for that call and the first reply seen for that call. Use that to
determine whether a request or reply is a duplicate or not.
That means that we don't have to reset the table of RPC calls on a
rescan of the capture (which didn't even fix all the cases where we'd
have misreported the original call or reply as a duplicate due to having
seen it once on the initial pass through the file and once again when,
for example, the user clicked on the packet); doing so causes plenty of
other problems, so don't do that - and don't clear the "visited" flag on
frames on a rescan, either, as that's only done because we were clearing
out conversations and calling all protocols' "init" routines.
As a free bonus, this means that, for a reply, we know what frame the
request was in; put that information into the protocol tree for the
reply, snoop-style.
Make the table of RPC call information, and the routines that manipulate
it, static to "packet-rpc.c"; nobody outside "packet-rpc.c" uses them.
svn path=/trunk/; revision=2358
color of marked frames.
They are currently only available from preferences file,
but I will add the color selection in GUI later.
svn path=/trunk/; revision=2327
Ulf Lamping