aboutsummaryrefslogtreecommitdiffstats
path: root/epan/follow.c
AgeCommit message (Collapse)AuthorFilesLines
2016-11-10tcp: Fix Follow TCP tap data and when its tapped.Michael Mann1-0/+41
Use the model from the 2.0 branch and earlier that only "tapped" the follow data in a single location. This fixes duplicate data for reassembled data and handles out-of-order packets. Bug: 12855 Change-Id: I5268f13e3c08e9271acf026b859de693ad794c94 Reviewed-on: https://code.wireshark.org/review/18368 Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-02-10Bring back packet_num in "Follow Stream"Stig Bjørlykke1-0/+1
The packet_num was left uninitialized after refactoring "Follow Stream". Ping-Bug: 11988 Change-Id: Iaea2560c8417503de59ddb0337cd023bcbcbbfee Reviewed-on: https://code.wireshark.org/review/13872 Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2016-01-12Refactor "Follow Stream" functionality on all GUI interfaces.Michael Mann1-238/+129
Create a "registration" system for Follow functionality so most of the work can be abstracted into a dissector and GUI can just be responsible for "display". This also removes the global variables in follow.c to open up multithreading possibilities. TCP, UDP and HTTP all have the same "tap interface" for Follow functionality (passing a tvb with byte data to "follow"). SSL still has it's own behavior, so Follow structures have to take that into account. TShark through the Follow registration now has support for HTTP. The only thing possibly missing is dynamic menu generation to further reduce explicit knowledge of Follow "type" (and rely on registration) Bug: 11988 Change-Id: I559d9ee1312406ad0986d4dce9fa67ea2103b339 Reviewed-on: https://code.wireshark.org/review/13161 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-01-07Remove some unnecessary dependencies and cleanup some codeJoão Valverde1-16/+14
No need for the GTK dependency on dissectors/packet-ipv6.h. Add the stream_addr typedef in follow.h to make some code simpler. Change-Id: I1cf906f58734a90263141362f2da33a140f93533 Reviewed-on: https://code.wireshark.org/review/13063 Reviewed-by: João Valverde <j@v6e.pt> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-01-06KISS the Follow TCP functionality.Michael Mann1-328/+38
[KISS - Keep It Simple, Stupid] Convert the Follow TCP functionality to use a tap from the TCP dissector that passes the tvb of the payload. This makes things A LOT simpler, but relies on the TCP dissector to make all decisions. The "tap" logic passes tvb data 1. Before calls to process_tcp_payload 2. Before hf_tcp_segment_data fields (that aren't retransmissions or otherwise handled) Follow up patches will be necessary to clean up all of the supporting "follow" functionality that is now useless. Bug: 6925 Bug: 9780 Change-Id: I4e7f5d453519be839de39a109bafa899b9987139 Reviewed-on: https://code.wireshark.org/review/13038 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-01-03Add HTTP Follow streamMichael Mann1-3/+11
This automatically detects and decompresses HTTP along a TCP stream through the use of taps. Bug: 3528 Change-Id: I8ab832d509700d0da8eabf3c3e514d8511c598d3 Reviewed-on: https://code.wireshark.org/review/13009 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-10-22Use address functions instead of ADDRESS macros in asn1 and epanGerald Combs1-6/+6
Replace CMP_ADDRESS, COPY_ADDRESS, et al with their lower-case equivalents in the asn1 and epan directories. Change-Id: I4043b0931d4353d60cffbd829e30269eb8d08cf4 Reviewed-on: https://code.wireshark.org/review/11200 Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-06-06ui/follow: fix The 'find_addr[UDP_STREAM]' variable is assigned values twice ↵Alexis La Goutte1-1/+1
successively. Perhaps this is a mistake. Found by PVS Studio (V519) Yes, there is a mistake ! Change-Id: I6c6c67300c0e05d3ede00be27f675cc8b15bb439 Reviewed-on: https://code.wireshark.org/review/8794 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2015-01-18Remove some apparently-unnecessary includes of emem.h.Guy Harris1-1/+0
Change-Id: Ib7d1b587b439ff21ec6b7f1756ce6ccf25b66f80 Reviewed-on: https://code.wireshark.org/review/6635 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-29Add ability to follow UDP stream by indexPascal Quantin1-51/+90
-z "follow,udp" tshark cli command now supports a stream index It is now possible to select the UDP stream displayed in Qt GUI (like for TCP) Change-Id: Ia367f36ea4f60db0fddb997a7e0903c09e172f2d Reviewed-on: https://code.wireshark.org/review/6083 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2014-12-28Replace ip6_to_str and ip6_guint8_to_str with address_to_str and tvb_ip_to_str.Michael Mann1-2/+2
Change-Id: I1d258923a7a63539ec8456d3e306bca5016a1e4b Reviewed-on: https://code.wireshark.org/review/6060 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com> Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-12-26Replace ip_to_str with [ep_]address_to_str and tvb_ip_to_str.Michael Mann1-2/+2
Change-Id: I40d0c8253743183aecef252040b7dd6742ae5c71 Reviewed-on: https://code.wireshark.org/review/5934 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-10-10Add editor modelines; Adjust whitespace as needed.Bill Meier1-0/+13
Change-Id: I3dc57f4c2ca57585103e3b71503ac4c332903e50 Reviewed-on: https://code.wireshark.org/review/4594 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-05-12Fix tshark -z follow,tcp stats regression when TCP stream index is > 0Pascal Quantin1-4/+0
With tshark stats are being configured before the file gets loaded and the number of TCP streams are computed Bug: 9541 Change-Id: I42c2891124f1781b05967d5f071ad40df2d6d9f5 Reviewed-on: https://code.wireshark.org/review/1598 Reviewed-by: Evan Huus <eapache@gmail.com> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2014-04-01replace comparing sequence numbers of TCP segments with wrap-firendly XX_SEQ ↵Pavel Karneliuk1-37/+37
macros; replace tabs with 2 whitespace indentations Change-Id: I8af522cc34863501195d0a79db5c0ab4135246a8 Reviewed-on: https://code.wireshark.org/review/907 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-04-01fix comparing a sequence number of TCP fragment when its value wraps over ↵Pavel Karneliuk1-1/+1
uint32_t limit Change-Id: I0ff939e2d1265a2d9380c83f8f538bb43b0dadf9 Reviewed-on: https://code.wireshark.org/review/875 Reviewed-by: Pavel Karneliuk <pavel_karneliuk@epam.com> Reviewed-by: Evan Huus <eapache@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-02-25Remove trailing whitespaceBill Meier1-9/+9
Change-Id: I8116f63ff88687c8db3fd6e8e23b22ab2f759af0 Reviewed-on: https://code.wireshark.org/review/385 Reviewed-by: Bill Meier <wmeier@newsguy.com> Tested-by: Bill Meier <wmeier@newsguy.com>
2014-01-14Don't cast away constness.Guy Harris1-2/+2
svn path=/trunk/; revision=54798
2013-11-22Replace packet_info->ipproto with packet_info->layers loop to determine TCP/UDP.Michael Mann1-5/+25
svn path=/trunk/; revision=53503
2013-11-19Set our IPv6 status when we set addresses.Gerald Combs1-0/+5
svn path=/trunk/; revision=53440
2013-11-14Add packet information and selection to the Follow Stream dialog.Gerald Combs1-3/+4
Collect packet numbers when following streams so that we can correlate text positions with packets. Add a FollowStreamText class so that we can track mouse events. Add a hint label that shows the packet under the cursor along with packet counts and the number of "turns". Add the packet number to the C array dump. Note that dumping to YAML might be useful for Scapy users. svn path=/trunk/; revision=53314
2013-11-13Highlight selected sequence diagram items.Gerald Combs1-4/+22
Create a new dialog each time the user follows a stream. A lot of the follow code seems to assume one and only one dialog so there are likely outstanding bugs. Don't use the global cfile (should we deprecate its usage?). We want to move closer to multiple documents, not further away. Clean up after ourselves. Free our payload list and unlink our temp file. Make a bunch of gchar*s QStrings. Make sure our destructor gets called and use it. Make member variable and method names more consistent. svn path=/trunk/; revision=53306
2013-11-11From doh via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9112 :Pascal Quantin1-3/+3
Fix incorrect "bytes missing in capture file" in "check_fragments" svn path=/trunk/; revision=53257
2013-11-09Include <epan/to_str.h> only when needed.Jakub Zawadzki1-0/+1
svn path=/trunk/; revision=53189
2013-09-13Explicitly include emem.h where it is neededJörg Mayer1-0/+1
svn path=/trunk/; revision=51997
2013-07-03WS_DLL_PUBLIC is now always WS_DLL_PUBLIC_NOEXTERN with "extern" added;Guy Harris1-1/+1
just define WS_DLL_PUBLIC_NOEXTERN inside the ifdefs, and define WS_DLL_PUBLIC as WS_DLL_PUBLIC_NOEXTERN followed by "extern". Then rename WS_DLL_PUBLIC_NOEXTERN to WS_DLL_PUBLIC_DEF, to clarify that it's what should be used for definitions; at least on Windows, you *have* to use it when declaring arrays without a size, and, whilst you might be able to use WS_DLL_PUBLIC for definitions of functions and perhaps data definitions other than no-size arrays, it might be clearer to rename WS_DLL_PUBLIC to WS_DLL_PUBLIC_DECL and use it only for declarations. svn path=/trunk/; revision=50334
2013-03-20 From beroset:Bill Meier1-2/+2
remove C++ incompatibilities https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8416 attachment #10397 svn path=/trunk/; revision=48438
2013-03-01Export libwireshark symbols using WS_DLL_PUBLIC defineBalint Reczey1-0/+1
Also remove old WS_VAR_IMPORT define and related Makefile magic everywhere in the project. svn path=/trunk/; revision=47992
2012-12-26Fix a bunch of warnings.Guy Harris1-13/+13
Cast away some implicit 64-bit-to-32-bit conversion errors due to use of sizeof. Cast away some implicit 64-bit-to-32-bit conversion errors due to use of strtol() and strtoul(). Change some data types to avoid those implicit conversion warnings. When assigning a constant to a float, make sure the constant isn't a double, by appending "f" to the constant. Constify a bunch of variables, parameters, and return values to eliminate warnings due to strings being given const qualifiers. Cast away those warnings in some cases where an API we don't control forces us to do so. Enable a bunch of additional warnings by default. Note why at least some of the other warnings aren't enabled. randpkt.c and text2pcap.c are used to build programs, so they don't need to be in EXTRA_DIST. If the user specifies --enable-warnings-as-errors, add -Werror *even if the user specified --enable-extra-gcc-flags; assume they know what they're doing and are willing to have the compile fail due to the extra GCC warnings being treated as errors. svn path=/trunk/; revision=46748
2012-12-05Fix numerous instances of a variable/parameter name "shadowing" a library ↵Bill Meier1-3/+3
function name; (At least some (gcc ?) compilers give a "shadow" warning for these). svn path=/trunk/; revision=46402
2012-09-20We always HAVE_CONFIG_H so don't bother checking whether we have it or not.Jeff Morriss1-3/+1
svn path=/trunk/; revision=45016
2012-06-28Update Free Software Foundation address.Jakub Zawadzki1-1/+1
(COPYING will be updated in next commit) svn path=/trunk/; revision=43536
2012-02-05From QA Cafe:Anders Broman1-1/+83
Add support to follow UDP and TCP streams like wireshark does. UDP streams are selected with IP address/port pairs. TCP stream are selected with either the stream index or IP address/port pairs. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6684 svn path=/trunk/; revision=40852
2011-07-17Repair "Follow TCP Stream" which got broken by my change in SVN 38056Sake Blok1-15/+18
Mental note: Try to not do half work ;-) svn path=/trunk/; revision=38065
2010-01-28Fix various gcc -Wshadow warnings.Bill Meier1-17/+17
svn path=/trunk/; revision=31720
2009-12-21Fix some [-XX bytes missing in capture file] messages when doing Sake Blok1-9/+13
follow TCP stream. svn path=/trunk/; revision=31334
2009-12-13Remove obsoleted test (test is obsoleted by svn 31252)Sake Blok1-16/+0
svn path=/trunk/; revision=31253
2009-12-13Fix for bug 3955 and 4288. When doing Follow TCP stream, there was no Sake Blok1-3/+8
check whether a packet belonged to the correct tcp stream (when there are multiple streams in the tracefile with the samen ip addresses and tcp ports. svn path=/trunk/; revision=31252
2009-04-07size_t fixes.Gerald Combs1-1/+1
svn path=/trunk/; revision=27984
2008-12-23From Didier Gautheron:Jaap Keuter1-2/+8
In follow.c there's stuff like: DISSECTOR_ASSERT(... fwrite( data, 1, sc->dlen, data_out_file ) If DISSECTOR_ASSERT is defined as a noop then fwrite is not called. svn path=/trunk/; revision=27093
2008-09-30Fix for bug 1447: Follow TCP Stream show only the first streamSake Blok1-12/+11
Use the new "tcp.stream eq XXX" as a display filter for follow tcp stream. This makes sure only the tcp stream which the selected packet belangs to will be shown (in case tcp ports are reused in the tracefile). svn path=/trunk/; revision=26306
2008-05-13Fix the tcp reassembly routine in epan/follow.c :Sake Blok1-1/+37
- Don't do '<gulongvar>-<gulongvar> > 0' as it will always be true :-) - Handle the case where a segment is partially retransmitted svn path=/trunk/; revision=25289
2007-12-15Fixes the "follow tcp stream" output when there are frames missing in theSake Blok1-28/+61
capture file that were actually on the wire. The reassembly code waited for the gaps to be filled in by retransmissions, which would never come. With this fix all acknowledged data will be output with "[xxx bytes missing in capture file]" inserted in every gap. svn path=/trunk/; revision=23878
2007-11-03- Future improve/clean up the now generic follow stream codeStephen Fisher1-12/+35
- Add "Follow UDP Stream" feature svn path=/trunk/; revision=23346
2007-05-22Have the follow code keep track of whether there's any data in the TCPGuy Harris1-2/+7
stream, and, if there isn't, pop up a dialog indicating that there isn't any data in the stream. This fixes bug 1604. svn path=/trunk/; revision=21870
2007-05-21put fwrite and fread into DISSECTOR_ASSERT in order to use the resultJörg Mayer1-2/+2
svn path=/trunk/; revision=21865
2007-03-26Fix a bunch more warnings. Add -Werror when using --with-warnings-as-errorsStephen Fisher1-1/+1
under gcc to tools/lemon, plugins/mate and epan/ svn path=/trunk/; revision=21204
2006-05-21name changeRonnie Sahlberg1-2/+2
svn path=/trunk/; revision=18197
2005-08-08various code cleanup:Ulf Lamping1-4/+3
-use g_snprintf instead of sprintf and snprintf -use g_strdup_printf where appropriate -remove #include "snprintf.h" (as only g_snprintf should be used) -replace some more alloc/realloc/calloc/free with their glib pendants svn path=/trunk/; revision=15264
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-21 08:19:59 +0000