aboutsummaryrefslogtreecommitdiffstats
path: root/epan/frame_data.c
AgeCommit message (Collapse)AuthorFilesLines
2016-01-25Move the proto data stuff out of frame_data.[ch].Guy Harris1-124/+1
It's not tied to the frame_data structure any more, so it belongs by itself. Clean up some #includes while we're at it; in particular, frame_data.h doesn't use anything related to tvbuffs, so don't have it gratuitiously include tvbuff.h. Change-Id: Ic32922d4a3840bac47007c5d4c546b8842245e0c Reviewed-on: https://code.wireshark.org/review/13518 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-23Add more fields to packet_info structure and use them.Guy Harris1-1/+0
Add fields for the absolute time stamp (and another field for a presence flag for the absolute time stamp) and the packet encapsulation for the packet. This lets us remove the field for the packet encapsulation in the frame_data structure; do so. Change-Id: Ifb910a9a192414e2a53086f3f7b97f39ed36aa39 Reviewed-on: https://code.wireshark.org/review/13499 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-23Use structure assignment for nstime_t.Guy Harris1-2/+1
Change-Id: Iab049e7708642a306764d80839bf0d5139889212 Reviewed-on: https://code.wireshark.org/review/13498 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-15Always initialize need_colorize flagPascal Quantin1-0/+1
Change-Id: I1da2f3e5d5cd6111a6ac7abaee2a97a36e8fd3c1 Reviewed-on: https://code.wireshark.org/review/13309 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2015-10-28frame_data: Reset subnum if visited is resettedRoland Knall1-0/+1
subnum get's resetted when the file is reloaded. But subnum does not get resetted, if for instance a preference has been set directly via (Protocol Name)->Protocol Preferences-> ... in the Protocol list. But flags.visited get's resetted. This leads to the scenario, where reloading a trace starts subnum with 0 and applying a preference starts subnum with the highest value it had before. This patch ensures, that all methods for reloading the frame lead to the same init value Change-Id: I167d1e03f7e2e6c60492f501ee5cb9555ac12ac9 Reviewed-on: https://code.wireshark.org/review/11341 Reviewed-by: Roland Knall <rknall@gmail.com> Reviewed-by: Michael Mann <mmann78@netscape.net> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2015-01-18Remove some apparently-unnecessary includes of emem.h.Guy Harris1-1/+0
Change-Id: Ib7d1b587b439ff21ec6b7f1756ce6ccf25b66f80 Reviewed-on: https://code.wireshark.org/review/6635 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-09-28Make the time stamp resolution per-packet.Guy Harris1-0/+1
Pcap-ng files don't have a per-file time stamp resolution, they have a per-interface time stamp resolution. Add new time stamp resolution types of "unknown" and "per-packet", add the time stamp resolution to struct wtap_pkthdr, have the libwiretap core initialize it to the per-file time stamp resolution, and have pcap-ng do the same thing with the resolution that it does with the packet encapsulation. Get rid of the TS_PREC_AUTO_XXX values; just have TS_PREC_AUTO, which means "use the packet's resolution to determine how many significant digits to display". Rename all the WTAP_FILE_TSPREC_XXX values to WTAP_TSPREC_XXX, as they're also used for per-packet values. Change-Id: If9fd8f799b19836a5104aaa0870a951498886c69 Reviewed-on: https://code.wireshark.org/review/4349 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-09-16Fix spelling: cant-->can't, wont-->won't, etcBill Meier1-1/+1
Change-Id: Ia6c3e7a25615bf8e052c3bacf096d76df775c9c2 Reviewed-on: https://code.wireshark.org/review/4126 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-07-10I don't see the point of inserting p_proto_data sorted useAndersBroman1-4/+3
g_slist_prepend(). While there fix deprecated API. Change-Id: Id5241348927d904d859530fac3f43f2b301a1acb Reviewed-on: https://code.wireshark.org/review/2982 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-06-05Make socpe a local variable, can be used if we change the g_slist to aAndersBroman1-4/+7
wmem_list. Change-Id: I176a2acc5ae334916978f543c959287bf0d8541e Reviewed-on: https://code.wireshark.org/review/1979 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-04-06Fix indent (use 2 spaces) and add modelinse info for frame_data.hAlexis La Goutte1-4/+4
Change-Id: Ib9eced1b652345cd40edb96ddde092f41a8f669c Reviewed-on: https://code.wireshark.org/review/986 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2013-12-03Avoid including <epan/epan.h> in dissectors.Jakub Zawadzki1-0/+1
svn path=/trunk/; revision=53774
2013-11-23Use 32bit key in p_add_proto_data() and friends. Bug 9453 ↵Michael Mann1-4/+4
(https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9453) From Dirk svn path=/trunk/; revision=53529
2013-11-23Create the ability to have packet scoped "proto" data. Bug 9470 ↵Michael Mann1-13/+37
(https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9470) I'm not sold on the name or module the proto_data functions live in, but I believe the function arguments are solid and gives us the most flexibility for the future. And search/replace of a function name is easy enough to do. The big driving force for getting this in sooner rather than later is the saved memory on ethernet packets (and IP packets soon), that used to have file_scope() proto data when all it needed was packet_scope() data (technically packet_info->pool scoped), strictly for Decode As. All dissectors that use p_add_proto_data() only for Decode As functionality have been converted to using packet_scope(). All other dissectors were converted to using file_scope() which was the original scope for "proto" data. svn path=/trunk/; revision=53520
2013-11-06Add support for displaying dates as year and day-of-year (1-origin).Guy Harris1-4/+8
In the process, fix various man page descriptions of the -t flag, and add support for UTC absolute times in the iousers and iostat TShark taps. svn path=/trunk/; revision=53114
2013-09-13Explicitly include emem.h where it is neededJörg Mayer1-0/+1
svn path=/trunk/; revision=51997
2013-08-01Initialize fdata->flags.has_user_comment too.Jeff Morriss1-1/+2
svn path=/trunk/; revision=51095
2013-08-01Remove fdata->opt_comment, add pkt_comment to pinfoJakub Zawadzki1-6/+1
Original (read from file) comments can be accessed by pkthdr->opt_comment Keep user comments in seperated BST, add new method for epan session to get it. svn path=/trunk/; revision=51090
2013-07-30Remove interface_id, pack_flags from frame_data structure.Jakub Zawadzki1-4/+0
This patch assumes that wtap_phdr interface_id, pack_flags both from initial read and seek read will contain same values. Please fix if it's not. svn path=/trunk/; revision=51041
2013-07-21Replace relative timestamp with reference frame number. Saves 16B per frame.Jakub Zawadzki1-18/+29
svn path=/trunk/; revision=50772
2013-07-21Add helper function to epan_session which can be used to get absolute ↵Jakub Zawadzki1-20/+19
timestamp of given frame. Remove ->prev_cap, for testing purpose also replace ->prev_dis with number of previously displayed frame number. This patch reduce size of frame_data by 8B (amd64) This is what (I think) was suggested by Guy in comment 13 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5821#c13) svn path=/trunk/; revision=50765
2013-05-15Un-shadow a couple of variables.Gerald Combs1-2/+2
svn path=/trunk/; revision=49317
2013-05-15- Use the key for comparison of per_proto_data.Anders Broman1-5/+20
- Show the number of per-packet-data entries and which protocol has made entries in the frame. svn path=/trunk/; revision=49313
2013-05-15Fix copy/paste error introduced in r49259Pascal Quantin1-3/+3
svn path=/trunk/; revision=49310
2013-05-12Add the posibillity to use a key for per-packet-data.Anders Broman1-3/+7
svn path=/trunk/; revision=49259
2013-03-20 From beroset:Bill Meier1-1/+1
remove C++ incompatibilities https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8416 attachment #10397 svn path=/trunk/; revision=48438
2013-03-15Fix the leaking of packet comments, i.e. the rest ofEvan Huus1-8/+25
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7530 The frame_data_cleanup function was ambiguous; it was being used for two different purposes, and did neither of them quite properly. Split it instead into frame_data_reset and frame_data_destroy, and call the correct one depending on why we were originally calling frame_data_cleanup. svn path=/trunk/; revision=48324
2012-12-22Add support for displaying the Packet Block Flags Word of pcapng.Michael Tüxen1-0/+2
svn path=/trunk/; revision=46698
2012-12-08Convert the SMTP dissector and the frame_data manager from emem to wmem.Evan Huus1-2/+2
Canaries in the coal mine, since I have a capture handy that I know excercises both code paths. svn path=/trunk/; revision=46470
2012-10-03Trivial: use consistent indentation; reformat a long line.Bill Meier1-67/+70
svn path=/trunk/; revision=45288
2012-09-23Store pointers to previously displayed and captured packet, not nstime_t deltas.Jakub Zawadzki1-42/+53
This commit reduces size (from 144B to 128B on AMD64) of frame_data structure. Part of bug 5821: Reduce per-packet memory requirements. svn path=/trunk/; revision=45071
2012-09-20We always HAVE_CONFIG_H so don't bother checking whether we have it or not.Jeff Morriss1-3/+1
svn path=/trunk/; revision=45016
2012-07-26Revert r44049, frame_data_cleanup() is called when redissecting.Jakub Zawadzki1-0/+7
svn path=/trunk/; revision=44051
2012-07-26Free frame comment.Jakub Zawadzki1-3/+7
svn path=/trunk/; revision=44049
2012-06-28Update Free Software Foundation address.Jakub Zawadzki1-1/+1
(COPYING will be updated in next commit) svn path=/trunk/; revision=43536
2012-05-16Fix a bunch of uninitialized variables found by Coverity Scan. CIDsGerald Combs1-5/+11
702403, 702404, 702405, 702406, 702407, 702408, 702409, 702410, 702411, and 702412. svn path=/trunk/; revision=42658
2012-02-28Fix https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3315 -Jeff Morriss1-0/+1
make Save-As/Displayed/All-Packets save not only the displayed packets but also any other packets needed (e.g., for reassembly) to fully dissect the displayed packets. This works only for the "All packets" case; choosing only the Selected packet, the Marked packets, or a range of packets would require actually storing which packets depend on which (too much memory) or going through the packet list many times (too slow). Also, this behavior is always the case: you can't save the displayed packets without their dependencies (I don't see why this would be desirable). So far this is done for SCTP and things using the reassembly routines (TCP has been tested). The Win32 dialog was modified but hasn't been tested yet. One confusing aspect of the UI is that the Displayed count in the Save-As dialog does not match the number of displayed packets. (I tried renaming the button "Displayed + Dependencies" but it looked too big.) The tooltip tries to explain this and the fact that this works only in the All-Packets case; suggestions for improvement are welcome. Implementation details: Dissectors (or the reassembly code) can list frames which were needed to build the current frame's tree. If the current frame passes the display filter then each listed frame is marked as "depended upon" (this takes up the last free frame_data flag). When performing a Save-As/Displayed/All-Packets then choose packets which passed the dfilter _or_ are depended upon. svn path=/trunk/; revision=41216
2012-02-25Add a presence flag field to the packet information structure filled inGuy Harris1-0/+2
by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2012-02-11Add the abillity to read and write option comments unedited.Anders Broman1-0/+2
This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2011-08-13From Edwin Groothuis via bug 6179:Stig Bjørlykke1-0/+2
Added Time Shift functionality. From me: Renamed to use "Time Shift" everywhere + some other minor cleanups. svn path=/trunk/; revision=38510
2011-07-04From Michael Mann:Anders Broman1-0/+4
Added ability to display UTC time or UTC time with date. I liked having the difference between UTC and local time, not just setting local=UTC. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2629 svn path=/trunk/; revision=37898
2011-05-03TShark doesn't need column text attached to each frame; move col_textGuy Harris1-2/+0
and col_text_len from the frame_data structure to the PacketRecord structure. svn path=/trunk/; revision=36967
2011-04-27Create a new frame_data_sequence data type; it represents a denseGuy Harris1-1/+0
sequence of frame_data structures, indexed by the frame number. Extract the relevant bits of the capture_file data structure and move them to the frame_data_sequence, and move the relevant code from cfile.c and tweak it to handle frame_data_sequence structures. Have a possibly-null pointer to a frame_data_sequence structure in the capture_file structure; if it's null, we aren't keeping a sequence of frame_data structures (we don't keep that sequence when we're doing one-pass processing in TShark). Nothing in libwireshark should care about a capture_file structure; get rid of some unnecessary includes of cfile.h. svn path=/trunk/; revision=36881
2011-04-25Store the frame_data structures in a tree, rather than a linked list. Guy Harris1-2/+0
This lets us get rid of the per-frame_data-structure prev and next pointers, saving memory (at least according to Activity Monitor's report of the virtual address space size on my Snow Leopard machine, it's a noticeable saving), and lets us look up frame_data structures by frame number in O(log2(number of frames)) time rather than O(number of frames) time. It seems to take more CPU time when reading in the file, but seems to go from "finished reading in all the packets" to "displaying the packets" faster and seems to free up the frame_data structures faster when closing the file. It *is* doing more copying, currently, as we now don't allocate the frame_data structure until after the packet has passed the read filter, so that might account for the additional CPU time. (Oh, and, for what it's worth, on an LP64 platform, a frame_data structure is exactly 128 bytes long. However, there's more stuff to remove, so the power-of-2 size is not guaranteed to remain, and it's not a power-of-2 size on an ILP32 platform.) It also means we don't need GLib 2.10 or later for the two-pass mode in TShark. It also means some code in the TCP dissector that was checking pinfo->fd->next to see if it's NULL, in order to see if this is the last packet in the file, no longer works, but that wasn't guaranteed to work anyway: we might be doing a one-pass read through the capture in TShark; we might be dissecting the frame while we're reading in the packets for the first time in Wireshark; we might be doing a live capture in Wireshark; in which case packets might be prematurely considered "the last packet". #if 0 the no-longer-working tests, pending figuring out a better way of doing it. svn path=/trunk/; revision=36849
2011-03-08Removal of the old packet-list in favor of the new packet list.Sake Blok1-2/+0
It compiles with "./configure without options" on my Mac. Let's see what the buildbots have to say about it :-) svn path=/trunk/; revision=36161
2010-07-22In the frame_data structure, expand the per-packetGuy Harris1-3/+3
encapsulation/data-link type to 16 bits, and shuffle some fields to eliminate some unnecessary padding - the net result should be no change in the structure size for 32 bits and a few bytes removed for 64 bits. This allows more encapsulation types - we've just about run out of the ones that fit in a signed 8-bit integer - and thus should fix bug 5025. svn path=/trunk/; revision=33613
2010-06-23Ensure the "Delta time displayed" is always zero for the first displayedStig Bjørlykke1-8/+7
packet, and not the delta from the first captured package. svn path=/trunk/; revision=33301
2010-01-19Use more unique names for certain enum constants.Bill Meier1-1/+1
(enum constant names are part of the global name space). (Fixes at least one gcc -Wshadow warning). svn path=/trunk/; revision=31572
2009-12-17Introduce "Ignore Packet" in the packet list.Stig Bjørlykke1-0/+1
This will remove the package from the dissection functions without removing it from the capture file. svn path=/trunk/; revision=31287
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-28 01:39:46 +0000