aboutsummaryrefslogtreecommitdiffstats
path: root/packet-frame.c
AgeCommit message (Collapse)AuthorFilesLines
2004-07-18Move dissectors to epan/dissectors directory.Gilbert Ramirez1-342/+0
Also move ncp222.py, x11-fields, process-x11-fields.pl, make-reg-dotc, and make-reg-dotc.py. Adjust #include lines in files that include packet-*.h files. svn path=/trunk/; revision=11410
2004-07-18Set the svn:eol-style property on all text files to "native", so thatGuy Harris1-1/+1
they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-01-03Apply the patches from Tadaaki Nagao for a global version of disabledRichard Sharpe1-5/+5
protocols ... svn path=/trunk/; revision=9538
2003-12-06Add the ability to print packet dissections in PDML (an XML-based format)Gilbert Ramirez1-6/+6
to tethereal. It could be added to Ethereal, but the GUI changes to allow the user to select PDML as a print format have not been added. Provide a python module (EtherealXML.py) to help parse PDML. Provide a sample app (msnchat) which uses tethereal and EtherealXML.py to reconstruct MSN Chat sessions from packet capture files. It produces a nice HTML report of the chat sessions. Document tethereal's PDML and EtherealXML.py usage in doc/README.xml-output Update tethereal's manpage to reflect the new [-T pdml|ps|text] option svn path=/trunk/; revision=9180
2003-10-25Add a new WTAP_ENCAP_CHDLC_WITH_PHDR type, to distinguish Cisco HDLCGuy Harris1-2/+2
captures with packet direction information from captures without it. Use them appropriately. svn path=/trunk/; revision=8780
2003-10-23Add a "show_exception()" routine that takes an exception code as anGuy Harris1-7/+20
argument, and puts the appropriate exception indication into the tree. In "dissect_frame()", do a CATCH_ALL for exceptions, and pass the exception code to "show_exception()". svn path=/trunk/; revision=8758
2003-09-22Add filterable field for REF TIME frames so it is easy to search for themRonnie Sahlberg1-1/+10
svn path=/trunk/; revision=8511
2003-09-12Attempt to prettify frame.time_relativeRonnie Sahlberg1-5/+5
and some other fields svn path=/trunk/; revision=8460
2003-09-12Added TimeReference frames.Ronnie Sahlberg1-2/+2
One can now select a packet and mark it as a TimeReference packet using the menu. A TimeReference packet will be indicated by having all timestamp related column entries replaced by the string *REF* A TimeReference packet will always be displayed in the packet pane, and overrides any display filters. When a frame is a TimeReference frame, all later frames will calculate the TimeRelativeToFirstPacket relative to the timestamp of the TimeReference frame instead of the first frame of the capture. You can have any number of TimeReference frames you like. svn path=/trunk/; revision=8459
2003-03-03Handle packet direction information for SDLC Sniffer captures.Guy Harris1-1/+2
Add a bunch of capture types discovered by stuffing them into Windows Sniffer captures and seeing what a Sniffer thought they were. Add support for writing at least some of them. svn path=/trunk/; revision=7265
2003-02-27From Didier Gautheron: provide a mechanism to indicate why reassemblyGuy Harris1-5/+6
wasn't done, and, for TCP, use that mechanism if reassembly isn't done is an incorrect TCP checksum. svn path=/trunk/; revision=7212
2003-01-31Add WTAP_ENCAP_FRELAY_WITH_PHDR for use with Frame Relay capture filesGuy Harris1-2/+2
that have direction information. Support writing WTAP_ENCAP_FRELAY_WITH_PHDR and WTAP_ENCAP_PPP_WITH_PHDR captures out in libpcap format - we throw away the direction information, but so it goes. When reading/writing Windows Sniffer format, read and write the direction flag. svn path=/trunk/; revision=7052
2002-12-20Add support for Wellfleet HDLC. It now can see inside the packets and handlesRichard Sharpe1-1/+2
the capture I was sent as a bunch of TCP segments containing LPD stuff. svn path=/trunk/; revision=6810
2002-10-31Discard the WTAP_ENCAP_LAPD encapsulation type in favor of aGuy Harris1-2/+6
WTAP_ENCAP_ISDN encapsulation type, which includes a pseudo-header giving the direction (user-to-network or network-to-user) and the channel number. Add a new circuit type, using the ISDN channel number as the circuit ID. Add an ISDN dissector to put the direction and channel number into the protocol tree and to call the appropriate dissector for the payload based on the channel (LAPD for the D channel; V.120, PPP, or data for B channels, based on some heuristics). svn path=/trunk/; revision=6521
2002-09-04Tap api. tap is a simple api that can be used for arbitrary extensions.Ronnie Sahlberg1-1/+8
One example extension is rpcstat. Try -Z rpc,rtt,100003,3 as argument to tethereal when reading a capture containing NFSv3 packets. tap-rpcstat.[ch] is intended to demonstrate the api and can be used to base other extensions on. svn path=/trunk/; revision=6175
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-7/+7
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-26From Ulf Lamping:Guy Harris1-2/+2
Put "bytes" after the byte counts for the frame sizes in the top-level item for the "Frame" protocol, to make it clearer what they refer to. Put the source and destination MAC addresses into the top-level item for Ethernet. svn path=/trunk/; revision=6090
2002-08-06Put in a comment noting that forcibly setting "pinfo->fd->lnk_t" meansGuy Harris1-1/+11
you can't turn the "Treat all frames as DOCSIS frames" option off. svn path=/trunk/; revision=5958
2002-07-12From Anand V. Narwani:Guy Harris1-1/+10
DOCSIS support, including support for "Ethernet" captures where the raw frame is a DOCSIS frame rather than an Ethernet frame (some Cisco cable-modem head-end gear can send out a trace of all traffic on an Ethernet, but what it sends are the raw bytes of DOCSIS frames, not Ethernet frames) Get rid of second AUTHORS entry for Devin Heitmueller, merging its item into the older entry. Clean up the order of some lists of plugin items. svn path=/trunk/; revision=5861
2002-05-04From Didier Gautheron: put "frame.marked" into the "Frame" subtree, notGuy Harris1-2/+3
into the top-level tree. svn path=/trunk/; revision=5393
2002-05-03From Didier Gautheron: add a "frame.marked" hidden field, set if theGuy Harris1-1/+7
frame is marked, so that you can use Find Frame to find the next marked frame, and can filter the display to show only marked frames. Update the documentation to note that "frame.marked" is set on marked frames. svn path=/trunk/; revision=5377
2002-04-13"pinfo->pseudo_header" might be null, even for link-layer types such asGuy Harris1-11/+18
WTAP_ENCAP_CHDLC; check whether it's null before using it. Use FROM_DCE rather than 0x80 to check the "this is DCE->DTE" bit in "x25.flags". svn path=/trunk/; revision=5148
2002-04-08More static-ization.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=5131
2002-02-18Add support for reassembling RPC-over-TCP fragments, and do that in bothGuy Harris1-25/+30
RPC and NDMP. Show the RPC-over-TCP fragment header as a tree with bitfields below it. Add a routine to show a reported bounds error as an "Unreassembled Packet" or a "Malformed Packet" depending on whether "pinfo->fragmented" is set, and have NBNS and RPC use that. Add "ett_ndmp_file_stats" to the list of ett_ values to be initialized (it wasn't in that list, and wasn't getting initialized). When freeing up various hash tables and memory chunks in the RPC dissector, zero out the pointers to them, just to make sure we don't try to free them again. Always destroy the TCP segment key and address memory chunks in "tcp_desegment_init()", regardless of whether TCP desegmentation is enabled - we don't *allocate* them if TCP desegmentation isn't enabled, but we should free them even if it's not enabled. Also, when we free them, set the pointers to them to null, so we don't double-free them. Supply to subdissectors called from the TCP dissector the sequence number of the first byte handed to the sub dissector. svn path=/trunk/; revision=4753
2002-01-24Replace a bunch of "tvb_length()" and "tvb_length_remaining()" calls inGuy Harris1-2/+2
arguments to "proto_tree_add_text()", and to "proto_tree_add_XXX()" calls that add FT_NONE or FT_PROTO items to the protocol tree, with -1. Replace some calls to "tvb_length()" or "tvb_length_remaining()" with calls to "tvb_reported_length()" and "tvb_reported_length_remaining()", as those give the actual length of the data in the packet, not just the data that happened to be captured. svn path=/trunk/; revision=4605
2002-01-21Include files from the "epan" directory and subdirectories thereof withGuy Harris1-4/+4
"epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
2002-01-17Mark un-reassembled TCP segments as (possibly) being un-reassembled, byGuy Harris1-3/+3
setting the "pinfo->fragmented" flag. If a ReportedBoundsError occurs, flag the frame as being an unreassembled packet, not an unreassembled fragmented packet, as it may have been segmented across TCP segment boundaries rather than being part of an IPv4/IPv6/CLNP/etc. fragmented/segmented packet. svn path=/trunk/; revision=4558
2002-01-17Use the "fragmented" field of the "packet_info" structure inGuy Harris1-7/+32
"dissect_frame()" to indicate whether a ReportedBoundsError was due to the packet being malformed (i.e., the packet was shorter than it's supposed to be, so the dissector went past the end trying to extract fields that were supposed to be there) or due to it not being reassembled (i.e., the packet was fragmented, and we didn't reassemble it, but just treated the first fragment as the entire packet, so the dissector went past the end trying to extract fields that were partially or completely in fragments after that). Mark the latter as being unreasembled rather than malformed. Properly initialize, save, and restore that field, and properly set it, so that works. svn path=/trunk/; revision=4555
2002-01-08If a ReportedBoundsError exception occurs, report it as a "malformedGuy Harris1-6/+6
packet" rather than a "malformed frame" - the packet in question might be part of a link-layer frame or might span more than one link-layer frame. svn path=/trunk/; revision=4497
2001-12-24Cisco HDLC and frame relay direction reporting, from Tom Nisbet.Gerald Combs1-1/+7
svn path=/trunk/; revision=4447
2001-12-10Move the pointer to the "column_info" structure in the "frame_data"Guy Harris1-9/+10
structure to the "packet_info" structure; only stuff that's permanently stored with each frame should be in the "frame_data" structure, and the "column_info" structure is not guaranteed to hold the column values for that frame at all times - it was only in the "frame_data" structure so that it could be passed to dissectors, and, as all dissectors are now passed a pointer to a "packet_info" structure, it could just as well be put in the "packet_info" structure. That saves memory, by shrinking the "frame_data" structure (there's one of those per frame), and also lets us clean up the code a bit. svn path=/trunk/; revision=4370
2001-12-08Clean up indentation.Guy Harris1-15/+16
svn path=/trunk/; revision=4362
2001-12-08Attach a descriptive name field type and base to dissector tables; thatGuy Harris1-2/+3
specifies how the selector values used as keys in those tables are to be displayed, and the title to use when displaying the table. Use that information in the code to display the initial and current entries of various dissector tables. Have the dissector for BACnet APDUs register itself by name, and have the BACnet NPDU dissector call it iff the BAC_CONTROL_NET bit isn't set, rather than doing it with a dissector table. svn path=/trunk/; revision=4358
2001-12-06WTAP_ENCAP_ values are #defined in decimal; display them in decimal.Guy Harris1-2/+2
svn path=/trunk/; revision=4349
2001-11-26Added a proto_reg_handoff_frame() function and switched fromEd Warnicke1-2/+9
using dissect_data() to using call_dissector() svn path=/trunk/; revision=4268
2001-11-01Add an option to show the File Offset of a frame. Not useful forGilbert Ramirez1-1/+23
general packet analyzing, but useful when developing wiretap code or other such low-level development. Default preference is *not* to show File Offset. svn path=/trunk/; revision=4120
2001-09-14Make the resolution for time values be nanoseconds rather thanGuy Harris1-11/+11
microseconds. Fix some "signed vs. unsigned" comparison warnings. svn path=/trunk/; revision=3934
2001-06-18From Joerg Mayer: explicitly fill in all members of aGuy Harris1-8/+8
"header_field_info" structure, including the ones that are later set by the routines to register fields. svn path=/trunk/; revision=3561
2001-04-01Added a register_dissector() call in packet-frame.c so that frame is nowEd Warnicke1-1/+2
a registered dissector and can be called by call_dissector(). svn path=/trunk/; revision=3233
2001-01-03Have "proto_register_protocol()" build a list of data structures forGuy Harris1-4/+13
protocols, in addition to adding structures to the list of filterable fields. Give it an extra argument that specifies a "short name" for the protocol, for use in such places as pinfo->current_proto; the dialog box for constructing filters; the preferences tab for the protocol; and so on (although we're not yet using it in all those places). Make the preference name that appears in the preferences file and the command line for the DIAMETER protocol "diameter", not "Diameter"; the convention is that the name in question be all-lower-case. Make some routines and variables that aren't exported static. Update a comment in the ICP dissector to make it clear that the dissector won't see fragments other than the first fragment of a fragmented datagram. svn path=/trunk/; revision=2810
2000-12-29If we get an exception when dissecting a packet, append "[Short Frame]"Guy Harris1-1/+5
or "[Malformed Frame]" to the Info column. Make some dissectors set the Protocol column and clear the Info column before fetching anything from the tvbuff they were handed, so that if the frame is short or malformed, it'll be marked as being the right top-level protocol, and the Info column won't have cruft left over from the previous protocol. svn path=/trunk/; revision=2800
2000-12-15Add the relative time to the frame tree, at the request of Manfred Young.Gerald Combs1-1/+13
svn path=/trunk/; revision=2762
2000-11-29Wrap the dissect_fddi() call (with a 4th argument) withGilbert Ramirez1-70/+13
dissect_fddi_not_bitswapped() and dissect_fddi_bitswapped(), both of which use the standard 3-argument tvbuffified-dissector argument list. Add a dissector table called "wtap_encap" which is used to call dissectors from dissect_frame(). The switch() statement from this top-level dissector is removed. The link-layer dissectors register themselves with the "wtap_encap" dissector table. The dissectors are now static where possible. svn path=/trunk/; revision=2708
2000-11-15IEEE 802.11 support, from Johan Jorgensen of Axis Communications AB.Guy Harris1-2/+5
Add in stuff for a bunch of libpcap formats either in libpcap 0.5.2 or in the current CVS version; we don't implement all of them in Ethereal/Wiretap (those are "#if 0"ed out), but we do implement the IEEE 802.11 stuff (which isn't yet in libpcap or tcpdump, but the CVS version of libpcap *does* reserve 105 as the encapsulation type number for 802.11). svn path=/trunk/; revision=2646
2000-10-06Implement epan_dissect_new() and epan_dissect_free(). These are theGilbert Ramirez1-0/+233
"top-level" dissectors that libepan-users call, instead of dissect_packet(). The epan_dissect_t holds the tvbuff after dissection so that the tvbuff's memory is not cleared until after the proto_tree is freed. (I might stuff the proto_tree into the epan_dissect_t, too). What remains of dissect_packet() in packet.c handles the tvbuff initialiation. The real meat of dissect_packet() is now in dissect_frame(), in packet-frame.c This means that "packet.c" is no longer a dissector, os it is no longer passed to make-reg-dotc. Once dissect_fddi() gets two wrapper functions (dissect_fddi_swapped() and dissect_fddi_nonswapped()), the a dissector handoff routine could be used instead of the switch statement in dissect_frame(). I'd register a field like "wtap.encap" svn path=/trunk/; revision=2478
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-27 10:43:02 +0000