Try to detect duplicated packets due to mirroring/span ports by comparing src MAC addresses.

svn path=/trunk/; revision=47324

2 files changed, 20 insertions, 9 deletions

diff --git a/ui/gtk/rtp_analysis.c b/ui/gtk/rtp_analysis.c
index cda714017d..2b538db1c3 100644
--- a/ui/gtk/rtp_analysis.c
+++ b/ui/gtk/rtp_analysis.c
@@ -555,6 +555,7 @@ static const GdkColor COLOR_DEFAULT = {0, 0xffff, 0xffff, 0xffff};
 static const GdkColor COLOR_ERROR = {0, 0xffff, 0xbfff, 0xbfff};
 static const GdkColor COLOR_WARNING = {0, 0xffff, 0xdfff, 0xbfff};
 static const GdkColor COLOR_CN = {0, 0xbfff, 0xbfff, 0xffff};
+GdkColor yellow = {0, 0xffff, 0xffff, 0x0000};
 COLOR_T_EVENT g_snprintf(color_str, sizeof(color_str), "#ef8c bfff ffff");
 static const GdkColor COLOR_FOREGROUND = {0, 0x0000, 0x0000, 0x0000};
 */
@@ -569,7 +570,7 @@ rtp_packet_add_info(GtkWidget *list, user_data_t * user_data,
 	gchar	   timeStr[32];
 	struct tm *tm_tmp;
 	time_t	   then;
-	gchar	   status[40];
+	gchar	   status[80];
 	gchar	   color_str[14];
 
 	then = pinfo->fd->abs_ts.secs;
@@ -602,6 +603,11 @@ rtp_packet_add_info(GtkWidget *list, user_data_t * user_data,
 		/* color = COLOR_ERROR; */
 		g_snprintf(color_str, sizeof(color_str), "#ffffbfffbfff");
 	}
+	else if (statinfo->flags & STAT_FLAG_DUP_PKT) {
+		g_snprintf(status, sizeof(status), "Suspected duplicate(MAC address) only delta time calculated");
+		/* color = Yellow; */
+		g_snprintf(color_str, sizeof(color_str), "#ffffffff0000");
+	}
 	else if (statinfo->flags & STAT_FLAG_REG_PT_CHANGE) {
 		if (statinfo->flags & STAT_FLAG_PT_T_EVENT) {
 			g_snprintf(status, sizeof(status), "Payload changed to PT=%u telephone/event", statinfo->pt);
@@ -1353,9 +1359,10 @@ dialog_graph_draw(user_data_t* user_data)
 				   * ((last_interval-interval)/user_data->dlg.dialog_graph.interval + 1))
 				+ left_x_border;
 
-			if (user_data->dlg.dialog_graph.graph[i]
-.items[interval/user_data->dlg.dialog_graph.interval].flags & (STAT_FLAG_WRONG_SEQ|STAT_FLAG_MARKER)) {
-				if (user_data->dlg.dialog_graph.graph[i].items[interval/user_data->dlg.dialog_graph.interval].flags & STAT_FLAG_WRONG_SEQ) {
+			if (user_data->dlg.dialog_graph.graph[i].items[interval/user_data->dlg.dialog_graph.interval].flags & 
+				(STAT_FLAG_WRONG_SEQ|STAT_FLAG_MARKER|STAT_FLAG_DUP_PKT)) {
+				if (user_data->dlg.dialog_graph.graph[i].items[interval/user_data->dlg.dialog_graph.interval].flags & 
+					(STAT_FLAG_WRONG_SEQ|STAT_FLAG_DUP_PKT)) {
 					g_strlcpy(label_string, "x", sizeof(label_string));
 				} else {
 					g_strlcpy(label_string, "m", sizeof(label_string));
@@ -3547,7 +3554,8 @@ create_rtp_dialog(user_data_t* user_data)
 		str_src, user_data->port_src_fwd, str_dst, user_data->port_dst_fwd, user_data->ssrc_fwd);
 
 	g_snprintf(label_forward_tree, sizeof(label_forward_tree),
-		"Analysing stream from  %s port %u  to  %s port %u   SSRC = 0x%X",
+		"Analysing stream from  %s port %u  to  %s port %u   SSRC = 0x%X \n"
+		"Note many things affects the accurasy of the analysis, use with caution",
 		str_src, user_data->port_src_fwd, str_dst, user_data->port_dst_fwd, user_data->ssrc_fwd);
 
 
@@ -3555,7 +3563,8 @@ create_rtp_dialog(user_data_t* user_data)
 	g_strlcpy(str_dst, get_addr_name(&(user_data->dst_rev)), sizeof(str_dst));
 
 	g_snprintf(label_reverse, sizeof(label_reverse),
-		"Analysing stream from  %s port %u  to  %s port %u   SSRC = 0x%X",
+		"Analysing stream from  %s port %u  to  %s port %u   SSRC = 0x%X \n"
+		"Note many things affects the accurasy of the analysis, use with caution",
 		str_src, user_data->port_src_rev, str_dst, user_data->port_dst_rev, user_data->ssrc_rev);
 
 	/* Start a notebook for flipping between sets of changes */
diff --git a/ui/gtk/rtp_analysis.h b/ui/gtk/rtp_analysis.h
index 675a1382b1..2eb495c96b 100644
--- a/ui/gtk/rtp_analysis.h
+++ b/ui/gtk/rtp_analysis.h
@@ -64,12 +64,13 @@ typedef struct _bw_history_item {
 #define BUFF_BW 300 
 
 typedef struct _tap_rtp_stat_t {
-	gboolean first_packet;     /* do not use in code that is called after rtp_packet_analyse */
+	gboolean first_packet;     /**< do not use in code that is called after rtp_packet_analyse */
 	                           /* use (flags & STAT_FLAG_FIRST) instead */
 	/* all of the following fields will be initialized after
 	 * rtp_packet_analyse has been called
 	 */
-	guint32 flags;             /* see STAT_FLAG-defines below */
+	address first_packet_mac_addr;	/**< MAC address of first packet, used to determine duplicates due to mirroring */
+	guint32 flags;					/* see STAT_FLAG-defines below */
 	guint16 seq_num;
 	guint32 timestamp;
 	guint32 first_timestamp;
@@ -88,7 +89,7 @@ typedef struct _tap_rtp_stat_t {
 	double sumTS;
 	double sumt2;
 	double sumtTS;
-	double time;           /* Unit is ms */
+	double time;           /**< Unit is ms */
 	double start_time;
 	double lastnominaltime;
 	double max_delta;
@@ -118,6 +119,7 @@ typedef struct _tap_rtp_stat_t {
 #define STAT_FLAG_REG_PT_CHANGE		0x040
 #define STAT_FLAG_WRONG_TIMESTAMP	0x080
 #define STAT_FLAG_PT_T_EVENT		0x100
+#define STAT_FLAG_DUP_PKT			0x200
 
 /* forward */
 struct _rtp_info;