path: root/README.macos
diff options
authorGerald Combs <gerald@zing.org>2015-06-01 19:48:23 -0700
committerGerald Combs <gerald@wireshark.org>2015-11-10 20:59:53 +0000
commit0d497e812508b3d71716618e39647a107c206b1d (patch)
tree79976b05e07aa180f7b50f4f0ec7d6348b04c3fe /README.macos
parent6a56224c18ec0ed19ad1a6e2b9172d330eeb14f0 (diff)
Initial Sysdig syscall (event) support.
Add a dissector for reading Sysdig event blocks. It only handles plain events but it's usable for reading trace files on hand here. Use a script to generate various parts of the dissector. As an experiment, update parts in-place instead of using a template. Ultimately there should probably be a top-level "Syscall" or "Event" dissector alongside the "Frame" dissector, which could then call this. You could then directly compare an executable's system calls alongside its network traffic. For now leverage the pcapng_block dissector and keep everything under "Frame". Next steps: - Items listed at the top of packet-sysdig-event.c. Change-Id: I17077e8d7f40d10a946d61189ebc077d81c4da37 Reviewed-on: https://code.wireshark.org/review/11103 Petri-Dish: Gerald Combs <gerald@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Gerald Combs <gerald@wireshark.org>
Diffstat (limited to 'README.macos')
0 files changed, 0 insertions, 0 deletions