Stats_tree enhancements for sorting, averages and burst rate. Bug 9452 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9452)

From Deon van der Westhuysen

- Bug fix: object leak in stats_tree after a tap reset (for example apply statistics preferences with a stats_tree window open)
- Bug fix: correct sample code in README.stats_tree
- Add: slash in plug-in name now creates submenu as docs describe (was a bug?)
- Add: menu separator before the stat_tree registered plug-ins
- Add: stats_tree can now calculate averages for nodes; automatically calculated for range nodes. Add section in README.stats_tree describing averages.
- Add: stats_tree can now calculate burst rate of each node (like rate but with a shorter, sliding time window)
- Add: sorting for stats_tree plug-ins. Can sort on node name, count, average, min, max values and burst rate.
- Add: preferences for stats_tree system (default sort column, burst calc params)
- Add: stats_tree window copy to clipboard and export and plain text, csv and XML.
- Added sample of new functionality in $srcdir/plugins/stats_tree/pinfo_stats_tree.c
- Moved all stats_tree sample plug-ins to "IP Statistics" submenu.

svn path=/trunk/; revision=53657

5 files changed, 888 insertions, 18 deletions

diff --git a/epan/prefs.c b/epan/prefs.c
index ab55672406..ea4c40b0b2 100644
--- a/epan/prefs.c
+++ b/epan/prefs.c
@@ -58,6 +58,7 @@
 #include "epan/filter_expressions.h"
 
 #include "epan/wmem/wmem.h"
+#include <epan/stats_tree.h>
 
 /* Internal functions */
 static module_t *find_subtree(module_t *parent, const char *tilte);
@@ -1256,6 +1257,16 @@ static const enum_val_t gui_qt_language[] = {
     {NULL, NULL, -1}
 };
 
+static const enum_val_t st_sort_col_vals[] = {
+    { "name",    "Node name (topic/item)", ST_SORT_COL_NAME },
+    { "count",   "Item count", ST_SORT_COL_COUNT },
+    { "average", "Average value of the node", ST_SORT_COL_AVG },
+    { "min",     "Minimum value of the node", ST_SORT_COL_MIN },
+    { "max",     "Maximum value of the node", ST_SORT_COL_MAX },
+    { "burst",   "Burst rate of the node", ST_SORT_COL_BURSTRATE },
+    { NULL,      NULL,         0 }
+};
+
 static void
 stats_callback(void)
 {
@@ -1269,6 +1280,22 @@ stats_callback(void)
         prefs.rtp_player_max_visible = RTP_PLAYER_DEFAULT_VISIBLE;
 #endif
 
+    /* burst resolution can't be less than 1 (ms) */
+    if (prefs.st_burst_resolution < 1) {
+        prefs.st_burst_resolution = 1;
+    }
+    else if (prefs.st_burst_resolution > ST_MAX_BURSTRES) {
+        prefs.st_burst_resolution = ST_MAX_BURSTRES;
+    }
+    /* make sure burst window value makes sense */
+    if (prefs.st_burst_windowlen < prefs.st_burst_resolution) {
+        prefs.st_burst_windowlen = prefs.st_burst_resolution;
+    }
+    /* round burst window down to multiple of resolution */
+    prefs.st_burst_windowlen -= prefs.st_burst_windowlen%prefs.st_burst_resolution;
+    if ((prefs.st_burst_windowlen/prefs.st_burst_resolution) > ST_MAX_BURSTBUCKETS) {
+        prefs.st_burst_windowlen = prefs.st_burst_resolution*ST_MAX_BURSTBUCKETS;
+    }
 }
 
 static void
@@ -2461,6 +2488,73 @@ prefs_register_modules(void)
                                    &prefs.rtp_player_max_visible);
 #endif
 
+    prefs_register_bool_preference(stats_module, "st_enable_burstinfo",
+            "Enable the calculation of burst information",
+            "If enabled burst rates will be calcuted for statistics that use the stats_tree system. "
+            "Burst rates are calculated over a much shorter time interval than the rate column.",
+            &prefs.st_enable_burstinfo);
+
+    prefs_register_bool_preference(stats_module, "st_burst_showcount",
+            "Show burst count for item rather than rate",
+            "If selected the stats_tree statistics nodes will show the count of events "
+            "within the burst window instead of a burst rate. Burst rate is calculated "
+            "as number of events within burst window divided by the burst windown length.",
+            &prefs.st_burst_showcount);
+
+    prefs_register_uint_preference(stats_module, "st_burst_resolution",
+            "Burst rate resolution (ms)",
+            "Sets the duration of the time interval into which events are grouped when calculating "
+            "the burst rate. Higher resolution (smaller number) increases processing overhead.",
+            10,&prefs.st_burst_resolution);
+
+    prefs_register_uint_preference(stats_module, "st_burst_windowlen",
+            "Burst rate window size (ms)",
+            "Sets the duration of the sliding window during which the burst rate is "
+            "measured. Longer window relative to burst rate resolution increases "
+            "processing overhead. Will be truncated to a multiple of burst resolution.",
+            10,&prefs.st_burst_windowlen);
+            
+    prefs_register_enum_preference(stats_module, "st_sort_defcolflag",
+            "Default sort column for stats_tree stats",
+            "Sets the default column by which stats based on the stats_tree "
+            "system is sorted.",
+            &prefs.st_sort_defcolflag, st_sort_col_vals, FALSE);
+
+     prefs_register_bool_preference(stats_module, "st_sort_defdescending",
+            "Default stats_tree sort order is descending",
+            "When selected, statistics based on the stats_tree system will by default "
+            "be sorted in descending order.",
+            &prefs.st_sort_defdescending);
+
+     prefs_register_bool_preference(stats_module, "st_sort_casesensitve",
+            "Case sensitive sort of stats_tree item names",
+            "When selected, the item/node names of statistics based on the stats_tree "
+            "system will be sorted taking case into account. Else the case of the name "
+            "will be ignored.",
+            &prefs.st_sort_casesensitve);
+            
+     prefs_register_bool_preference(stats_module, "st_sort_rng_nameonly",
+            "Always sort 'range' nodes by name",
+            "When selected, the stats_tree nodes representing a range of values "
+            "(0-49, 50-100, etc.) will always be sorted by name (the range of the "
+            "node). Else range nodes are sorted by the same column as the rest of "
+            " the tree.",
+            &prefs.st_sort_rng_nameonly);
+
+     prefs_register_bool_preference(stats_module, "st_sort_rng_fixorder",
+            "Always sort 'range' nodes in ascending order",
+            "When selected, the stats_tree nodes representing a range of values "
+            "(0-49, 50-100, etc.) will always be sorted ascending; else it follows "
+            "the sort direction of the tree. Only effective if \"Always sort "
+            "'range' nodes by name\" is also selected.",
+            &prefs.st_sort_rng_fixorder);
+            
+     prefs_register_bool_preference(stats_module, "st_sort_showfullname",
+            "Display the full stats_tree plug-in name",
+            "When selected, the full name (including menu path) of the stats_tree "
+            "plug-in is show in windows. If cleared the plug-in name is shown "
+            "without menu path (only the part of the name after last '/' character.)",
+            &prefs.st_sort_showfullname);
 
     /* Protocols */
     protocols_module = prefs_register_module(NULL, "protocols", "Protocols",
@@ -2903,7 +2997,16 @@ pre_init_prefs(void)
 /* set the default values for the tap/statistics dialog box */
   prefs.tap_update_interval    = TAP_UPDATE_DEFAULT_INTERVAL;
   prefs.rtp_player_max_visible = RTP_PLAYER_DEFAULT_VISIBLE;
-
+  prefs.st_enable_burstinfo = TRUE;
+  prefs.st_burst_showcount = FALSE;
+  prefs.st_burst_resolution = ST_DEF_BURSTRES;
+  prefs.st_burst_windowlen = ST_DEF_BURSTLEN;
+  prefs.st_sort_casesensitve = TRUE;
+  prefs.st_sort_rng_fixorder = TRUE;
+  prefs.st_sort_rng_nameonly = TRUE;
+  prefs.st_sort_defcolflag = ST_SORT_COL_COUNT;
+  prefs.st_sort_defdescending = TRUE;
+  prefs.st_sort_showfullname = FALSE;
   prefs.display_hidden_proto_items = FALSE;
 
   prefs_pre_initialized = TRUE;
diff --git a/epan/prefs.h b/epan/prefs.h
index 9b9b1a1000..729ece2a4c 100644
--- a/epan/prefs.h
+++ b/epan/prefs.h
@@ -50,6 +50,10 @@ extern "C" {
 
 #define RTP_PLAYER_DEFAULT_VISIBLE 4
 #define TAP_UPDATE_DEFAULT_INTERVAL 3000
+#define	ST_DEF_BURSTRES 5
+#define ST_DEF_BURSTLEN 100
+#define ST_MAX_BURSTRES 600000	/* somewhat arbirary limit of 10 minutes */
+#define ST_MAX_BURSTBUCKETS 100	/* somewhat arbirary limit - more buckets degrade performance */
 
 /*
  * Convert a string listing name resolution types to a bitmask of
@@ -208,6 +212,16 @@ typedef struct _e_prefs {
   gboolean     unknown_colorfilters;  /* unknown or obsolete color filter(s) */
   guint        gui_qt_language;       /* Qt Translation language selection */
   gboolean     gui_packet_editor;     /* Enable Packet Editor */
+  gboolean     st_enable_burstinfo;
+  gboolean     st_burst_showcount;
+  gint         st_burst_resolution;
+  gint         st_burst_windowlen;
+  gboolean     st_sort_casesensitve;
+  gboolean     st_sort_rng_fixorder;
+  gboolean     st_sort_rng_nameonly;
+  gint         st_sort_defcolflag;
+  gboolean     st_sort_defdescending;
+  gboolean     st_sort_showfullname;
 } e_prefs;
 
 WS_DLL_PUBLIC e_prefs prefs;
diff --git a/epan/stats_tree.c b/epan/stats_tree.c
index a49f33357d..d1db527485 100644
--- a/epan/stats_tree.c
+++ b/epan/stats_tree.c
@@ -23,28 +23,47 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
+ /* stats_tree modifications by Deon van der Westhuysen, November 2013
+  * support for
+  *  - sorting by column,
+  *  - calculation of average values
+  *  - calculation of burst rate
+  *  - export to text, CSV or XML file
+  */
+
 #include "config.h"
 
 #include <glib.h>
+#include <glib/gprintf.h>
 
 #include <stdlib.h>
 
 #include <epan/stats_tree_priv.h>
+#include <epan/prefs.h>
+#include <math.h>
 #include <string.h>
 
 #include "stats_tree.h"
 
-/*
-TODO:
-   - sort out the sorting issue
-
- */
+enum _stat_tree_columns {
+	COL_NAME,
+	COL_COUNT,
+	COL_AVERAGE,
+	COL_MIN,
+	COL_MAX,
+	COL_RATE,
+	COL_PERCENT,
+	COL_BURSTRATE,
+	COL_BURSTTIME,
+	N_COLUMNS
+};
 
 /* used to contain the registered stat trees */
 static GHashTable *registry = NULL;
 
 /* writes into the buffers pointed by value, rate and percent
    the string representations of a node*/
+/*** DEPRECIATED ***/
 extern void
 stats_tree_get_strs_from_node(const stat_node *node, gchar *value, gchar *rate, gchar *percent)
 {
@@ -99,7 +118,14 @@ stats_tree_branch_max_namelen(const stat_node *node, guint indent)
 		}
 	}
 
+	if (node->st_flags&ST_FLG_ROOTCHILD) {
+		gchar *display_name= stats_tree_get_displayname(node->name);
+		len = (guint) strlen(display_name) + indent;
+		g_free(display_name);
+	}
+	else {
 	len = (guint) strlen(node->name) + indent;
+	}
 	maxlen = len > maxlen ? len : maxlen;
 
 	return maxlen;
@@ -109,6 +135,7 @@ static gchar *format;
 
 /* populates the given GString with a tree representation of a branch given by node,
 using indent spaces as initial indentation */
+/*** DEPRECIATED ***/
 extern void
 stats_tree_branch_to_str(const stat_node *node, GString *s, guint indent)
 {
@@ -157,6 +184,7 @@ free_stat_node(stat_node *node)
 {
 	stat_node *child;
 	stat_node *next;
+	burst_bucket *bucket;
 
 	if (node->children) {
         for (child = node->children; child; child = next ) {
@@ -170,6 +198,12 @@ free_stat_node(stat_node *node)
 
 	if (node->hash) g_hash_table_destroy(node->hash);
 
+	while (node->bh) {
+		bucket = node->bh;
+		node->bh = bucket->next;
+		g_free(bucket);
+	}
+
 	g_free(node->rng);
 	g_free(node->name);
 	g_free(node);
@@ -185,6 +219,7 @@ stats_tree_free(stats_tree *st)
 	g_free(st->filter);
 	g_hash_table_destroy(st->names);
 	g_ptr_array_free(st->parents,TRUE);
+	g_free(st->display_name);
 
 	for (child = st->root.children; child; child = next ) {
 		/* child->next will be gone after free_stat_node, so cache it here */
@@ -207,14 +242,30 @@ static void
 reset_stat_node(stat_node *node)
 {
 	stat_node *child;
+	burst_bucket *bucket;
+
+	node->counter = 0;
+	node->total = 0;
+	node->minvalue = G_MAXINT;
+	node->maxvalue = G_MININT;
+	node->st_flags = 0;
+
+	while (node->bh) {
+		bucket = node->bh;
+		node->bh = bucket->next;
+		g_free(bucket);
+	}
+	node->bh = (burst_bucket*)g_malloc0(sizeof(burst_bucket));
+	node->bt = node->bh;
+	node->bcount = 0;
+	node->max_burst = 0;
+	node->burst_time = -1.0;
 
 	if (node->children) {
 		for (child = node->children; child; child = child->next )
 			reset_stat_node(child);
 	}
 
-	node->counter = 0;
-
 	if(node->st->cfg->reset_node) {
 		node->st->cfg->reset_node(node);
 	}
@@ -229,6 +280,7 @@ stats_tree_reset(void *p)
 
 	st->start = -1.0;
 	st->elapsed = 0.0;
+	st->now = - 1.0;
 
 	reset_stat_node(&st->root);
 
@@ -252,6 +304,27 @@ stats_tree_reinit(void *p)
 
 	st->root.children = NULL;
 	st->root.counter = 0;
+	st->root.total = 0;
+	st->root.minvalue = G_MAXINT;
+	st->root.maxvalue = G_MININT;
+	st->root.st_flags = 0;
+
+	st->root.bh = (burst_bucket*)g_malloc0(sizeof(burst_bucket));
+	st->root.bt = st->root.bh;
+	st->root.bcount = 0;
+	st->root.max_burst = 0;
+	st->root.burst_time = -1.0;
+
+	/* No more stat_nodes left in tree - clean out hash, array */
+	g_hash_table_remove_all(st->names);
+	if (st->parents->len>1) {
+		g_ptr_array_remove_range(st->parents, 1, st->parents->len-1);
+	}
+
+	/* Do not update st_flags for the tree (sorting) - leave as was */
+	st->num_columns = N_COLUMNS;
+	g_free(st->display_name);
+	st->display_name= stats_tree_get_displayname(st->cfg->name);
 
 	if (st->cfg->init) {
 		st->cfg->init(st);
@@ -265,7 +338,6 @@ stats_tree_register_with_group(const char *tapname, const char *abbr, const char
 		    stat_tree_packet_cb packet, stat_tree_init_cb init,
 		    stat_tree_cleanup_cb cleanup, register_stat_group_t stat_group)
 {
-
 	stats_tree_cfg *cfg = (stats_tree_cfg *)g_malloc( sizeof(stats_tree_cfg) );
 
 	/* at the very least the abbrev and the packet function should be given */
@@ -281,7 +353,8 @@ stats_tree_register_with_group(const char *tapname, const char *abbr, const char
 	cfg->init = init;
 	cfg->cleanup = cleanup;
 
-	cfg->flags = flags;
+	cfg->flags = flags&~ST_FLG_MASK;
+	cfg->st_flags = flags&ST_FLG_MASK;
 
 	/* these have to be filled in by implementations */
 	cfg->setup_node_pr = NULL;
@@ -344,7 +417,18 @@ stats_tree_new(stats_tree_cfg *cfg, tree_pres *pr, const char *filter)
 	st->elapsed = 0.0;
 
 	st->root.counter = 0;
-	st->root.name = g_strdup(cfg->name);
+	st->root.total = 0;
+	st->root.minvalue = G_MAXINT;
+	st->root.maxvalue = G_MININT;
+	st->root.st_flags = 0;
+
+	st->root.bh = (burst_bucket*)g_malloc0(sizeof(burst_bucket));
+	st->root.bt = st->root.bh;
+	st->root.bcount = 0;
+	st->root.max_burst = 0;
+	st->root.burst_time = -1.0;
+
+	st->root.name = stats_tree_get_displayname(cfg->name);
 	st->root.st = st;
 	st->root.parent = NULL;
 	st->root.children = NULL;
@@ -352,6 +436,18 @@ stats_tree_new(stats_tree_cfg *cfg, tree_pres *pr, const char *filter)
 	st->root.hash = NULL;
 	st->root.pr = NULL;
 
+	st->st_flags = st->cfg->st_flags;
+
+	if (!(st->st_flags&ST_FLG_SRTCOL_MASK)) {
+		/* No default sort specified - use preferences */
+		st->st_flags |= prefs.st_sort_defcolflag<<ST_FLG_SRTCOL_SHIFT;
+		if (prefs.st_sort_defdescending) {
+			st->st_flags |= ST_FLG_SORT_DESC;
+		}
+	}
+	st->num_columns = N_COLUMNS;
+	st->display_name= stats_tree_get_displayname(st->cfg->name);
+
 	g_ptr_array_add(st->parents,&st->root);
 
 	return st;
@@ -362,11 +458,11 @@ extern int
 stats_tree_packet(void *p, packet_info *pinfo, epan_dissect_t *edt, const void *pri)
 {
 	stats_tree *st = (stats_tree *)p;
-	double now = nstime_to_msec(&pinfo->rel_ts);
 
-	if (st->start < 0.0) st->start = now;
+	st->now = nstime_to_msec(&pinfo->rel_ts);
+	if (st->start < 0.0) st->start = st->now;
 
-	st->elapsed = now - st->start;
+	st->elapsed = st->now - st->start;
 
 	if (st->cfg->packet)
 		return st->cfg->packet(st,pinfo,edt,pri);
@@ -461,6 +557,17 @@ new_stat_node(stats_tree *st, const gchar *name, int parent_id,
 	stat_node *last_chld = NULL;
 
 	node->counter = 0;
+	node->total = 0;
+	node->minvalue = G_MAXINT;
+	node->maxvalue = G_MININT;
+	node->st_flags = parent_id?0:ST_FLG_ROOTCHILD;
+
+	node->bh = (burst_bucket*)g_malloc0(sizeof(burst_bucket));
+	node->bt = node->bh;
+	node->bcount = 0;
+	node->max_burst = 0;
+	node->burst_time = -1;
+
 	node->name = g_strdup(name);
 	node->children = NULL;
 	node->next = NULL;
@@ -535,7 +642,92 @@ stats_tree_create_node_by_pname(stats_tree *st, const gchar *name,
 	return stats_tree_create_node(st,name,stats_tree_parent_id_by_name(st,parent_name),with_children);
 }
 
+/* Internal function to update the burst calculation data - add entry to bucket */
+static void
+update_burst_calc(stat_node *node, gint value)
+{
+	double current_bucket;
+	double burstwin;
+
+	burst_bucket *bn;
 
+	if (!prefs.st_enable_burstinfo) {
+		return;
+	}
+
+	/* NB thebucket list should always contain at least one node - even if it is */
+	/* the dummy created at init time. Head and tail should never be NULL!       */
+	current_bucket= floor(node->st->now/prefs.st_burst_resolution);
+	burstwin= prefs.st_burst_windowlen/prefs.st_burst_resolution;
+	if (current_bucket>node->bt->bucket_no) {
+		/* Must add a new bucket at the burst list tail */
+		bn = (burst_bucket*)g_malloc0(sizeof(burst_bucket));
+		bn->count = value;
+		bn->bucket_no = current_bucket;
+		bn->start_time = node->st->now;
+		bn->prev = node->bt;
+		node->bt->next = bn;
+		node->bt = bn;
+		/* And add value to the current burst count for node */
+		node->bcount += value;
+		/* Check if bucket list head is now too old and must be removed */
+		while (current_bucket>=(node->bh->bucket_no+burstwin)) {
+			/* off with its head! */
+			bn = node->bh;
+			node->bh = bn->next;
+			node->bh->prev = NULL;
+			node->bcount -= bn->count;
+			g_free(bn);
+		}
+	}
+	else if (current_bucket<node->bh->bucket_no) {
+		/* Packet must be added at head of burst list - check if not too old */
+		if ((current_bucket+burstwin)>node->bt->bucket_no) {
+			/* packet still within the window */
+			bn = (burst_bucket*)g_malloc0(sizeof(burst_bucket));
+			bn->count = value;
+			bn->bucket_no = current_bucket;
+			bn->start_time = node->st->now;
+			bn->next = node->bh;
+			node->bh->prev = bn;
+			node->bh = bn;
+			/* And add value to the current burst count for node */
+			node->bcount += value;
+		}
+	}
+	else
+	{
+		/* Somewhere in the middle... */
+		burst_bucket *search = node->bt;
+		while (current_bucket<search->bucket_no) {
+			search = search->prev;
+		}
+		if (current_bucket==search->bucket_no) {
+			/* found existing bucket, increase value */
+			search->count += value;
+			if (search->start_time>node->st->now) {
+				search->start_time = node->st->now;
+			}
+		}
+		else {
+			/* must add a new bucket after bn. */
+			bn = (burst_bucket*)g_malloc0(sizeof(burst_bucket));
+			bn->count = value;
+			bn->bucket_no = current_bucket;
+			bn->start_time = node->st->now;
+			bn->prev = search;
+			bn->next = search->next;
+			search->next = bn;
+			bn->next->prev = bn;
+		}
+		node->bcount += value;
+	}
+	if (node->bcount>node->max_burst) {
+		/* new record burst */
+		node->max_burst = node->bcount;
+		node->burst_time = node->bh->start_time;
+	}
+}
 
 /*
  * Increases by delta the counter of the node whose name is given
@@ -564,8 +756,31 @@ stats_tree_manip_node(manip_node_mode mode, stats_tree *st, const char *name,
 		node = new_stat_node(st,name,parent_id,with_hash,with_hash);
 
 	switch (mode) {
-		case MN_INCREASE: node->counter += value; break;
+		case MN_INCREASE:
+				node->counter += value;
+				update_burst_calc(node, value);
+				break;
 		case MN_SET: node->counter = value; break;
+		case MN_AVERAGE:
+				node->counter++;
+				update_burst_calc(node, 1);
+				/* fall through to average code */
+		case MN_AVERAGE_NOTICK:
+				node->total += value;
+				if (node->minvalue > value) {
+					node->minvalue = value;
+				}
+				if (node->maxvalue < value) {
+					node->maxvalue = value;
+				}
+				node->st_flags |= ST_FLG_AVERAGE;
+				break;
+		case MN_SET_FLAGS:
+				node->st_flags |= value;
+				break;
+		case MN_CLEAR_FLAGS:
+				node->st_flags &= ~value;
+				break;
 	}
 
 	if (node)
@@ -746,12 +961,31 @@ stats_tree_tick_range(stats_tree *st, const gchar *name, int parent_id,
 	if ( node == NULL )
 		g_assert_not_reached();
 
+	/* update stats for container node. counter should already be ticked so we only update total and min/max */
+	node->total += value_in_range;
+	if (node->minvalue > value_in_range) {
+		node->minvalue = value_in_range;
+	}
+	if (node->maxvalue < value_in_range) {
+		node->maxvalue = value_in_range;
+	}
+	node->st_flags |= ST_FLG_AVERAGE;
+
 	for ( child = node->children; child; child = child->next) {
 		floor =  child->rng->floor;
 		ceil = child->rng->ceil;
 
 		if ( value_in_range >= floor && value_in_range <= ceil ) {
 			child->counter++;
+			child->total += value_in_range;
+			if (child->minvalue > value_in_range) {
+				child->minvalue = value_in_range;
+			}
+			if (child->maxvalue < value_in_range) {
+				child->maxvalue = value_in_range;
+			}
+			child->st_flags |= ST_FLG_AVERAGE;
+			update_burst_calc(child, 1);
 			return node->id;
 		}
 	}
@@ -788,12 +1022,402 @@ stats_tree_create_pivot_by_pname(stats_tree *st, const gchar *name,
 extern int
 stats_tree_tick_pivot(stats_tree *st, int pivot_id, const gchar *pivot_value)
 {
-
 	stat_node *parent = (stat_node *)g_ptr_array_index(st->parents,pivot_id);
 
 	parent->counter++;
+	update_burst_calc(parent, 1);
 	stats_tree_manip_node( MN_INCREASE, st, pivot_value, pivot_id, FALSE, 1);
 
 	return pivot_id;
 }
 
+extern gchar*
+stats_tree_get_displayname (gchar* fullname)
+{
+	gchar *buf = g_strdup(fullname);
+	gchar *sep;
+
+	if (prefs.st_sort_showfullname) {
+		return buf; /* unmodifed */
+	}
+
+	sep = buf;
+	while (sep= strchr(sep,'/')) {
+		if (*(++sep)=='/') {  /* escapeded slash - two slash characters after each other */
+			memmove(sep,sep+1,strlen(sep));
+		}
+		else {
+			/* we got a new path separator */
+			memmove(buf,sep,strlen(sep)+1);
+			sep = buf;
+		}
+	}
+
+	return buf;
+}
+
+extern gint
+stats_tree_get_default_sort_col (stats_tree *st)
+{
+	switch ((st->st_flags&ST_FLG_SRTCOL_MASK)>>ST_FLG_SRTCOL_SHIFT) {
+		case ST_SORT_COL_NAME:		return COL_NAME;
+		case ST_SORT_COL_COUNT:		return COL_COUNT;
+		case ST_SORT_COL_AVG:		return COL_AVERAGE;
+		case ST_SORT_COL_MIN:		return COL_MIN;
+		case ST_SORT_COL_MAX:		return COL_MAX;
+		case ST_SORT_COL_BURSTRATE:	return COL_BURSTRATE;
+	}
+	return COL_COUNT;	/* nothing specific set */
+}					
+
+extern gboolean
+stats_tree_is_default_sort_DESC (stats_tree *st)
+{
+	return st->st_flags&ST_FLG_SORT_DESC;
+}
+
+extern gchar*
+stats_tree_get_column_name (gint index)
+{
+	switch (index) {
+		case COL_NAME:		return "Topic / Item";
+		case COL_COUNT:		return "Count";
+		case COL_AVERAGE:	return "Average";
+		case COL_MIN:		return "Min val";
+		case COL_MAX:		return "Max val";
+		case COL_RATE:		return "Rate (ms)";
+		case COL_PERCENT:	return "Percent";
+		case COL_BURSTRATE:	return prefs.st_burst_showcount?"Burst count":"Burst rate";
+		case COL_BURSTTIME:	return "Burst start";
+		default:			return "(Unknown)";
+	}
+}
+
+extern gint
+stats_tree_get_column_size (gint index)
+{
+ if (index==COL_NAME) {
+	return 36;		/* but caller should really call stats_tree_branch_max_namelen() */
+ }
+ if (index<N_COLUMNS) {
+	return 12;		/* all numerica values this size */
+ }
+ return 0;			/* invalid column */
+}
+
+extern gboolean
+stats_tree_is_sortable_column (gint index)
+{
+	switch (index) {
+		case COL_NAME:
+		case COL_COUNT:
+		case COL_AVERAGE:
+		case COL_MIN:
+		case COL_MAX:
+		case COL_BURSTRATE:	return TRUE;
+		default:			return FALSE;
+	}
+}
+
+extern gchar**
+stats_tree_get_values_from_node (const stat_node* node)
+{
+	gchar        **values = (gchar**) g_malloc0(sizeof(gchar*)*(node->st->num_columns));
+
+	values[COL_NAME]= (node->st_flags&ST_FLG_ROOTCHILD)?stats_tree_get_displayname(node->name):g_strdup(node->name);
+	values[COL_COUNT]= g_strdup_printf("%u",node->counter);
+	values[COL_AVERAGE]= ((node->st_flags&ST_FLG_AVERAGE)||node->rng)?
+				(node->counter?g_strdup_printf("%.2f",((float)node->total)/node->counter):g_strdup("-")):
+				g_strdup("");
+	values[COL_MIN]= ((node->st_flags&ST_FLG_AVERAGE)||node->rng)?
+				(node->counter?g_strdup_printf("%u",node->minvalue):g_strdup("-")):
+				g_strdup("");
+	values[COL_MAX]= ((node->st_flags&ST_FLG_AVERAGE)||node->rng)?
+				(node->counter?g_strdup_printf("%u",node->maxvalue):g_strdup("-")):
+				g_strdup("");
+	values[COL_RATE]= (node->st->elapsed)?g_strdup_printf("%.4f",((float)node->counter)/node->st->elapsed):g_strdup("");
+	values[COL_PERCENT]= ((node->parent)&&(node->parent->counter))?
+				g_strdup_printf("%.2f%%",(node->counter*100.0)/node->parent->counter):
+				(node->parent==&(node->st->root)?g_strdup("100%"):g_strdup(""));
+	if (node->st->num_columns>COL_BURSTTIME) {
+		values[COL_BURSTRATE]= (!prefs.st_enable_burstinfo)?g_strdup(""):
+				(node->max_burst?(prefs.st_burst_showcount?
+								g_strdup_printf("%d",node->max_burst):
+								g_strdup_printf("%.4f",((double)node->max_burst)/prefs.st_burst_windowlen)):
+				g_strdup("-"));
+		values[COL_BURSTTIME]= (!prefs.st_enable_burstinfo)?g_strdup(""):
+				(node->max_burst?g_strdup_printf("%.3f",((double)node->burst_time/1000.0)):g_strdup("-"));
+	}
+	return values;
+}
+
+extern gint
+stats_tree_sort_compare (const stat_node *a, const stat_node *b, gint sort_column,
+					gboolean sort_descending)
+{
+	int	result;
+	float avg_a, avg_b;
+
+	if  (prefs.st_sort_rng_nameonly&&(a->rng&&b->rng)) {
+		/* always sort ranges by range name */
+		result = a->rng->floor - b->rng->floor;
+		if (sort_descending&&(!prefs.st_sort_rng_fixorder)) {
+			result= -result;
+		}		
+		return result;
+	}
+
+	switch (sort_column)
+	{
+		case COL_NAME:		if  (a->rng&&b->rng) {
+								result = a->rng->floor - b->rng->floor;
+							}
+							else if (prefs.st_sort_casesensitve) {
+								result = strcmp(a->name,b->name);
+							}
+							else {
+								result = g_ascii_strcasecmp(a->name,b->name);
+							}
+							break;
+
+		case COL_COUNT:		result = a->counter - b->counter;
+							break;
+
+		case COL_AVERAGE:	if (a->counter) {
+								result= 1;		/* assume a>b */
+								if (b->counter) {
+									avg_a= ((float)a->total)/a->counter;
+									avg_b= ((float)b->total)/b->counter;
+									result= (avg_a>avg_b)?1:((avg_a<avg_b)?-1:0);
+								}
+							}
+							else {
+								result= -1;		/* let b>a */
+							}
+							break;
+
+		case COL_MIN:		result = a->minvalue - b->minvalue;
+							break;
+
+		case COL_MAX:		result = a->maxvalue - b->maxvalue;
+							break;
+
+		case COL_BURSTRATE:	result = a->max_burst - b->max_burst;
+	}
+ 	
+	/* break tie between items with same primary search result */
+	if (!result) {
+		if (sort_column==COL_NAME) {
+			result = a->counter - b->counter;
+		}
+		else {
+			if  (a->rng&&b->rng) {
+				result = a->rng->floor - b->rng->floor;
+			}
+			else if (prefs.st_sort_casesensitve) {
+				result = strcmp(a->name,b->name);
+			}
+			else {
+				result = g_ascii_strcasecmp(a->name,b->name);
+			}
+		}
+	}
+
+	/* take into account sort order */
+	if (sort_descending) {
+		result= -result;
+	}
+
+	if ((a->st_flags&ST_FLG_SORT_TOP)!=(b->st_flags&ST_FLG_SORT_TOP)) {
+		/* different sort groups top vs non-top */
+		result= (a->st_flags&ST_FLG_SORT_TOP)?-1:1;
+	}
+	return result;
+}
+
+extern GString*
+stats_tree_format_as_str(const stats_tree* st, guint format,
+					gint sort_column, gboolean sort_descending)
+{
+	int maxnamelen= stats_tree_branch_max_namelen(&st->root,0);
+	stat_node *child;
+	GString *s;
+	int count;
+	gchar *separator;
+
+	if (format==ST_FORMAT_XML) {
+		s = g_string_new("<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n");
+	}
+	else if (format==ST_FORMAT_CSV) {
+		s = g_string_new("\"level\",\"parent\",");
+		for (count = 0; count<st->num_columns; count++) {
+			g_string_append_printf(s,"\"%s\",",stats_tree_get_column_name(count));
+		}
+		g_string_append (s,"\n");
+	}
+	else if (format==ST_FORMAT_PLAIN) {
+		char fmt[16];
+		int sep_length;
+
+		sep_length= maxnamelen;
+		for (count = 1; count<st->num_columns; count++) {
+			sep_length += stats_tree_get_column_size(count)+2;
+		}
+		separator = g_malloc(sep_length+1);
+		memset (separator, '=', sep_length);
+		separator[sep_length] = 0;
+
+		s = g_string_new("\n");
+		g_string_append(s,separator);
+		g_string_append_printf(s,"\n%s:\n",st->cfg->name);
+		g_sprintf (fmt,"%%-%us",maxnamelen);
+		g_string_append_printf(s,fmt,stats_tree_get_column_name(0));
+		for (count = 1; count<st->num_columns; count++) {
+			g_sprintf (fmt," %%-%us",stats_tree_get_column_size(count)+1);
+			g_string_append_printf(s,fmt,stats_tree_get_column_name(count));
+		}
+		memset (separator, '-', sep_length);
+		g_string_append_printf(s,"\n%s\n",separator);
+	}
+	else {
+		return g_string_new("unknown format for stats_tree\n");
+	}
+
+	for (child = st->root.children; child; child = child->next ) {
+		stats_tree_format_node_as_str(child,s,format,0,"",maxnamelen,sort_column,sort_descending);
+
+	}
+
+	if (format==ST_FORMAT_PLAIN) {
+		g_string_append_printf(s,"\n%s\n",separator);
+		g_free(separator);
+	}
+
+	return s;
+}
+
+typedef struct {
+	gint sort_column;
+	gboolean sort_descending;
+}	sortinfo;
+
+/* Function to compare elements for child array sort. a and b are children, user_data
+points to a st_flags value */
+extern gint
+stat_node_array_sortcmp (gconstpointer a, gconstpointer b, gpointer user_data)
+{
+ /* user_data is *guint value to st_flags */
+ return stats_tree_sort_compare (*(stat_node**)a,*(stat_node**)b,
+					((sortinfo*)user_data)->sort_column,((sortinfo*)user_data)->sort_descending);
+};
+
+static gchar*
+clean_for_xml_tag (gchar *str)
+{
+	gchar *s = str;
+	while (s=strpbrk(s,"!\"#$%%&'()*+,/;<=>?@[\\]^`{|}~ ")) {
+		*(s++) = '-';
+	}
+	return str;
+}
+
+static GString*
+escape_xml_chars (gchar *str)
+{
+	GString *s= g_string_new("");
+	while (1) {
+		switch (*str) {
+			case 0:		return s;
+			case '<':	g_string_append(s,"&lt;");
+						break;
+			case '>':	g_string_append(s,"&gt;");
+						break;
+			case '&':	g_string_append(s,"&amp;");
+						break;
+			case '\'':	g_string_append(s,"&apos;");
+						break;
+			case '"':	g_string_append(s,"&quot;");
+						break;
+			default:	g_string_append_c(s,*str);
+						break;
+		}
+		str++;
+	}
+
+	return s;
+}
+/** helper funcation to add note to formatted stats_tree */
+WS_DLL_PUBLIC void stats_tree_format_node_as_str(const stat_node *node,	GString *s,
+					guint format, guint indent, gchar *path, gint maxnamelen, gint sort_column,
+					gboolean sort_descending)
+{
+	int count;
+	int num_columns= node->st->num_columns;
+	gchar **values= stats_tree_get_values_from_node(node);
+	stat_node *child;
+	sortinfo si;
+
+	if (format==ST_FORMAT_XML) {
+		GString *itemname= escape_xml_chars(values[0]);
+		g_string_append_printf(s,"<stat-node name=\"%s\"%s>\n",itemname->str,
+				node->rng?" isrange=\"true\"":"");
+		g_string_free(itemname,TRUE);
+		g_string_append(s,"");
+		for (count = 1; count<num_columns; count++) {
+			gchar *colname= g_strdup(stats_tree_get_column_name(count));
+			g_string_append_printf(s,"<%s>",clean_for_xml_tag(colname));
+			g_string_append_printf(s,"%s</%s>\n",values[count],colname);
+			g_free(colname);
+		}
+	}
+	else if (format==ST_FORMAT_CSV) {
+		g_string_append_printf(s,"%d,\"%s\",\"%s\"",indent,path,values[0]);
+		for (count = 1; count<num_columns; count++) {
+			g_string_append_printf(s,",%s",values[count]);
+		}
+		g_string_append (s,"\n");
+	}
+	else if (format==ST_FORMAT_PLAIN) {
+		char fmt[16];
+
+		g_sprintf (fmt,"%%%ds%%-%us",indent,maxnamelen-indent);
+		g_string_append_printf(s,fmt,"",values[0]);
+		for (count = 1; count<num_columns; count++) {
+			g_sprintf (fmt," %%-%us",stats_tree_get_column_size(count)+1);
+			g_string_append_printf(s,fmt,values[count]);
+		}
+		g_string_append (s,"\n");
+	}
+
+	indent++;
+	indent = indent > INDENT_MAX ? INDENT_MAX : indent;
+    path= g_strdup_printf ("%s/%s",path,values[0]);
+
+	for (count = 0; count<num_columns; count++) {
+		g_free(values[count]);
+	}
+	g_free(values);
+
+	if (node->children) {
+		GArray *Children= g_array_new(FALSE,FALSE,sizeof(child));
+		for (child = node->children; child; child = child->next ) {
+			g_array_append_val(Children,child);
+		}
+		si.sort_column = sort_column;
+		si.sort_descending = sort_descending;
+		g_array_sort_with_data(Children,stat_node_array_sortcmp,&si);
+		for (count = 0; count<((int)Children->len); count++) {
+			stats_tree_format_node_as_str(g_array_index(Children,stat_node*,count), s, format,
+					indent, path, maxnamelen, sort_column, sort_descending);
+		}
+		g_array_free(Children,FALSE);
+	}
+	g_free(path);
+
+	if (format==ST_FORMAT_XML) {
+		g_string_append(s,"</stat-node>\n");
+	}
+}
+
+
+
diff --git a/epan/stats_tree.h b/epan/stats_tree.h
index 06db45f1dc..23e2c8175b 100644
--- a/epan/stats_tree.h
+++ b/epan/stats_tree.h
@@ -35,6 +35,24 @@
 
 #define STAT_TREE_ROOT "root"
 
+#define	ST_FLG_AVERAGE		0x10000000	/* Calculate overages for nodes, rather than totals */
+#define	ST_FLG_ROOTCHILD	0x20000000	/* This node is a direct child of the root node */
+#define	ST_FLG_DEF_NOEXPAND	0x01000000	/* This node should not be expanded by default */
+#define	ST_FLG_SORT_DESC	0x00800000	/* When sorting, sort ascending instead of decending */
+#define	ST_FLG_SORT_TOP		0x00400000	/* When sorting always keep these lines on of list */
+#define ST_FLG_SRTCOL_MASK	0x000F0000	/* Mask for sort column ID */
+#define	ST_FLG_SRTCOL_SHIFT	16			/* Number of bits to shift masked result */
+
+#define	ST_FLG_MASK			(ST_FLG_AVERAGE|ST_FLG_ROOTCHILD|ST_FLG_DEF_NOEXPAND|\
+							ST_FLG_SORT_TOP|ST_FLG_SORT_DESC|ST_FLG_SRTCOL_MASK)
+
+#define ST_SORT_COL_NAME	1		/* Sort nodes by node names */
+#define ST_SORT_COL_COUNT	2		/* Sort nodes by node count */
+#define ST_SORT_COL_AVG		3		/* Sort nodes by node average */
+#define ST_SORT_COL_MIN		4		/* Sort nodes by minimum node value */
+#define ST_SORT_COL_MAX		5		/* Sort nodes by maximum node value */
+#define ST_SORT_COL_BURSTRATE	6	/* Sort nodes by burst rate */
+
 /* obscure information regarding the stats_tree */
 typedef struct _stats_tree stats_tree;
 
@@ -168,7 +186,14 @@ WS_DLL_PUBLIC int stats_tree_tick_pivot(stats_tree *st,
  * using parent_name as parent node (NULL for root).
  * with_children=TRUE to indicate that the created node will be a parent
  */
-typedef enum _manip_node_mode { MN_INCREASE, MN_SET } manip_node_mode;
+typedef enum _manip_node_mode {
+	MN_INCREASE,
+	MN_SET,
+	MN_AVERAGE,
+	MN_AVERAGE_NOTICK,
+	MN_SET_FLAGS,
+	MN_CLEAR_FLAGS
+} manip_node_mode;
 WS_DLL_PUBLIC int stats_tree_manip_node(manip_node_mode mode,
 				 stats_tree *st,
 				 const gchar *name,
@@ -188,4 +213,26 @@ WS_DLL_PUBLIC int stats_tree_manip_node(manip_node_mode mode,
 #define zero_stat_node(st,name,parent_id,with_children) \
 (stats_tree_manip_node(MN_SET,(st),(name),(parent_id),(with_children),0))
 
+/*
+ * Add value to average calculation WITHOUT ticking node. Node MUST be ticked separately!
+ *
+ * Intention is to allow code to separately tick node (backward compatibility for plugin)
+ * and set value to use for averages. Older versions without average support will then at
+ * least show a count instead of 0.
+ */
+#define avg_stat_node_add_value_notick(st,name,parent_id,with_children,value) \
+(stats_tree_manip_node(MN_AVERAGE_NOTICK,(st),(name),(parent_id),(with_children),value))
+
+/* Tick node and add a new value to the average calculation for this stats node. */
+#define avg_stat_node_add_value(st,name,parent_id,with_children,value) \
+(stats_tree_manip_node(MN_AVERAGE,(st),(name),(parent_id),(with_children),value))
+
+/* Set flags for this node. Node created if it does not yet exist. */
+#define stat_node_set_flags(st,name,parent_id,with_children,flags) \
+(stats_tree_manip_node(MN_SET_FLAGS,(st),(name),(parent_id),(with_children),flags))
+
+/* Clear flags for this node. Node created if it does not yet exist. */
+#define stat_node_clear_flags(st,name,parent_id,with_children,flags) \
+(stats_tree_manip_node(MN_CLEAR_FLAGS,(st),(name),(parent_id),(with_children),flags))
+
 #endif /* __STATS_TREE_H */
diff --git a/epan/stats_tree_priv.h b/epan/stats_tree_priv.h
index ce817e6634..a6790e495d 100644
--- a/epan/stats_tree_priv.h
+++ b/epan/stats_tree_priv.h
@@ -57,12 +57,32 @@ typedef struct _range_pair {
 	gint ceil;
 } range_pair_t;
 
+typedef struct _burst_bucket burst_bucket;
+struct _burst_bucket {
+	burst_bucket	*next;
+	burst_bucket	*prev;
+	gint			count;
+	double			bucket_no;
+	double			start_time;
+};
+
 struct _stat_node {
 	gchar*			name;
 	int			id;
 	
 	/** the counter it keeps */
 	gint			counter;
+	/** total of all values submitted - for computing averages */
+	gint64			total;
+	gint			minvalue;
+	gint			maxvalue;
+	int				st_flags;
+
+	/** fields for burst rate calculation */
+	gint			bcount;
+	burst_bucket	*bh, *bt;
+	gint			max_burst;
+	double			burst_time;
 
 	/** children nodes by name */
 	GHashTable		*hash;
@@ -91,6 +111,11 @@ struct _stats_tree {
 	/* times */
 	double			start;
 	double			elapsed;
+	double			now;
+
+	int				st_flags;
+	gint			num_columns;
+	gchar			*display_name;
 
    /** used to lookup named parents:
 	*    key: parent node name
@@ -152,6 +177,9 @@ struct _stats_tree_cfg {
 	void (*free_tree_pr)(stats_tree*);
 	void (*draw_tree)(stats_tree*);
 	void (*reset_tree)(stats_tree*);
+
+	/** flags for the stats tree (sorting etc.) default values to new trees */
+	guint st_flags;
 };
 
 /* guess what, this is it! */
@@ -193,7 +221,9 @@ WS_DLL_PUBLIC GList *stats_tree_get_cfg_list(void);
 
 /** extracts node data as strings from a stat_node into
    the buffers given by value, rate and precent
-   if NULL they are ignored */
+   if NULL they are ignored
+
+   DO NOT USE FOR NEW CODE. Use stats_tree_get_values_from_node() instead */
 WS_DLL_PUBLIC void stats_tree_get_strs_from_node(const stat_node *node,
 					  gchar *value,
 					  gchar *rate,
@@ -217,4 +247,56 @@ WS_DLL_PUBLIC gchar *stats_tree_node_to_str(const stat_node *node,
 }
 #endif /* __cplusplus */
 
+/** get the display name for the stats_tree (or node name) based on the
+    st_sort_showfullname preference. If not set remove everything before
+    last unescaped backslash. Caller must free the result */
+WS_DLL_PUBLIC gchar* stats_tree_get_displayname (gchar* fullname);
+
+/** returns the column number of the default column to sort on */
+WS_DLL_PUBLIC gint stats_tree_get_default_sort_col (stats_tree *st);
+
+/** returns the default sort order to use */
+WS_DLL_PUBLIC gboolean stats_tree_is_default_sort_DESC (stats_tree *st);
+
+/** returns the column name for a given column index */
+WS_DLL_PUBLIC gchar* stats_tree_get_column_name (gint index);
+
+/** returns the maximum number of characters in the value of a column */
+WS_DLL_PUBLIC gint stats_tree_get_column_size (gint index);
+
+/** returns TRUE is the the column name for a given column index can be sorted*/
+WS_DLL_PUBLIC gboolean stats_tree_is_sortable_column (gint index);
+
+/** returns the formatted column values for the current node
+  as array of gchar*. Caller must free entries and free array */
+WS_DLL_PUBLIC gchar** stats_tree_get_values_from_node (const stat_node* node);
+
+/** function to compare two nodes for sort, based on sort_column. */
+WS_DLL_PUBLIC gint stats_tree_sort_compare (const stat_node *a,
+					const stat_node *b,
+					gint sort_column,
+					gboolean sort_descending);
+
+/** wrapper for stats_tree_sort_compare() function that can be called from array sort. */
+WS_DLL_PUBLIC gint stat_node_array_sortcmp (gconstpointer a,
+					gconstpointer b,
+					gpointer user_data);
+
+/** function to copy stats_tree into GString. format deternmines output format */
+typedef enum _st_format_type { ST_FORMAT_PLAIN, ST_FORMAT_CSV, ST_FORMAT_XML};
+WS_DLL_PUBLIC GString* stats_tree_format_as_str(const stats_tree* st,
+					guint format,
+					gint sort_column,
+					gboolean sort_descending);
+
+/** helper funcation to add note to formatted stats_tree */
+WS_DLL_PUBLIC void stats_tree_format_node_as_str(const stat_node *node,
+					GString *s,
+					guint format,
+					guint indent,
+					gchar *path,
+					gint maxnamelen,
+					gint sort_column,
+					gboolean sort_descending);
+
 #endif /* __STATS_TREE_PRIV_H */