aboutsummaryrefslogtreecommitdiffstats
path: root/packet-ip.c
AgeCommit message (Collapse)AuthorFilesLines
2004-07-18Set the svn:eol-style property on all text files to "native", so thatGuy Harris1-1/+1
they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-04-19Add a textual "(Dont Fragment)" and "(More Fragments)" to the ip.flags lineOlivier Biot1-1/+3
in case the DF bit or the MF bit is set. svn path=/trunk/; revision=10644
2004-02-18From Nick Black: the 0x8000 bit in the flags field is *NOT* aGuy Harris1-7/+13
"congestion" bit for ECN. Show it as a reserved bit. Put semicolons, not commas, at the end of the calls to put flags field bits into the protocol tree. svn path=/trunk/; revision=10087
2003-11-13Change the strings shown for ICMP TTL exceeded to match the wording in the ↵Ronnie Sahlberg1-3/+3
standard svn path=/trunk/; revision=8955
2003-10-15From Giles Scott: make some items in the ICMP protocol tree named fields.Guy Harris1-9/+26
svn path=/trunk/; revision=8710
2003-08-29Set "addr" before using it, regardless of whether "ip_summary_in_tree"Guy Harris1-3/+3
is set or not. Copy the destination address, not the source address, when processing the destination address. svn path=/trunk/; revision=8314
2003-08-29Copy the source and destination addresses into a guint32, so that we don'tGerald Combs1-7/+10
bus error on RISC systems. svn path=/trunk/; revision=8304
2003-08-28Make "process_reassembled_data()" do the check for fragmentation notGuy Harris1-8/+3
being complete and for fragmentation being trivial (i.e., the packet in question is both the first and last fragment). Have its callers *not* do that check - this lets "process_reassembled_data()" put in the "Reassembled in" item for fragments other than the last fragment. Add a "Reassembled in" field to TDS. svn path=/trunk/; revision=8295
2003-08-26Pass the pointer in the "data" field of the destination address, not aGuy Harris1-2/+2
pointer to that pointer, to "ip_to_str()". svn path=/trunk/; revision=8273
2003-08-23New feature. Statistics/EndpointTalkjers can now present a sortable table ↵Ronnie Sahlberg1-15/+14
with a list of all seen conversations of a certain type. Supported types are Ethernet/TokenRing/IP/UDP and TCP. Will add FibreChannel soon. The framework for this feature needs to be enhanced in the future so that by selecting one entry and click the right mousebutton, this will bring up a menu with Prepare/Match options with suboptions for AnyDirection, ForwardOnly or ReverseOnly which updates the display filter accordingly. Had to update some of the taps as well to change them to use a proper address structure for the address fields. We should now be able to to these stats correctly even for ip tunneled over ip tunnelled over ip ... svn path=/trunk/; revision=8222
2003-07-11Add a routine "dissect_ipv6_options()" that works likeGuy Harris1-1/+2
"dissect_ip_tcp_options()" but for options that are like IPv6 options (i.e., the length byte has a value that doesn't include the option code or length byte). Add an "ip_opts.h" header to declare it, and move the declaration of stuff used by it and "dissect_ip_tcp_options()", and the declaration of "dissect_ip_tcp_options()", to that header. Use "dissect_ipv6_options()" for Mobile IPv6 options. Get rid of the unused "mip6_opt_types[]" array in "packet-mip6.h". svn path=/trunk/; revision=8015
2003-07-09Removed duplicate definitions of flags_set_truth.Tim Potter1-6/+1
svn path=/trunk/; revision=8001
2003-06-05Frame numbers are unsigned.Guy Harris1-2/+2
svn path=/trunk/; revision=7794
2003-04-29Don't export "ip_dissector_table" explicitly; now that we haveGuy Harris1-3/+2
"find_dissector_table()", have the IPv6 and IPSEC dissectors fetch the IP dissector table by name. svn path=/trunk/; revision=7600
2003-04-20Add a pointer to an hf_ value for a "reassembled_in" field (which can beGuy Harris1-5/+10
null) to the "fragment_items" structure, and don't pass that value into "process_reassembled_data()", just have it use the value in the "fragment_items" structure passed to it. Make "process_reassembled_data()" capable of handling reassembly done by "fragment_add_seq_check()", and use it in the ATP and 802.11 dissectors; give them "reassembled_in" fields. Make "process_reassembled_data()" handle only the case of a completed reassembly (fd_head != NULL) so that we can use it in those dissectors without gunking the code up too much. svn path=/trunk/; revision=7513
2003-04-20Pull much of the processing done after a call to "fragment_add_check()"Guy Harris1-61/+4
into a subroutine, for use in other dissectors. Use it in the IPv6 and CLNP dissectors. svn path=/trunk/; revision=7510
2003-04-20We can't use the frame_data structure as a key structure when lookingGuy Harris1-8/+43
for reassembled frames - in Tethereal, there's only one frame_data structure used for all frames. Instead, use the frame number itself as the key. Add a "fragment_add_check()" routine, for fragments where there's a fragment offset rather than a fragment sequence number, which does the same sort of thing as "fragment_add_seq_check()" - i.e., once reassembly is done, it puts the reassembled fragment into a separate hash table, so that there're only incomplete reassemblies in the fragment hash table. That's necessary in order to handle cases where the packet ID field can be reused. Use that routine for IPv4 fragment reassembly - IP IDs can be reused (in fact, RFC 791 suggests that doing so might be a feature: It is appropriate for some higher level protocols to choose the identifier. For example, TCP protocol modules may retransmit an identical TCP segment, and the probability for correct reception would be enhanced if the retransmission carried the same identifier as the original transmission since fragments of either datagram could be used to construct a correct TCP segment. and RFC 1122 says that it's permitted to do so, although it also says "we believe that retransmitting the same Identification field is not useful": 3.2.1.5 Identification: RFC-791 Section 3.2 When sending an identical copy of an earlier datagram, a host MAY optionally retain the same Identification field in the copy. DISCUSSION: Some Internet protocol experts have maintained that when a host sends an identical copy of an earlier datagram, the new copy should contain the same Identification value as the original. There are two suggested advantages: (1) if the datagrams are fragmented and some of the fragments are lost, the receiver may be able to reconstruct a complete datagram from fragments of the original and the copies; (2) a congested gateway might use the IP Identification field (and Fragment Offset) to discard duplicate datagrams from the queue. However, the observed patterns of datagram loss in the Internet do not favor the probability of retransmitted fragments filling reassembly gaps, while other mechanisms (e.g., TCP repacketizing upon retransmission) tend to prevent retransmission of an identical datagram [IP:9]. Therefore, we believe that retransmitting the same Identification field is not useful. Also, a connectionless transport protocol like UDP would require the cooperation of the application programs to retain the same Identification value in identical datagrams. and, in any case, I've seen that in at least one capture, and it confuses the current reassembly code). Unfortunately, that means that fragments other than the last fragment can't be tagged with the frame number in which the reassembly was done; see the comment in packet-ip.c for a discussion of that problem. svn path=/trunk/; revision=7506
2003-04-18Update the ip fragment reassembly so that the subdissector is onlyRonnie Sahlberg1-19/+39
called from the frame where the ip packet was reassembled instead of from each fragment. For fragments, put [Reassembled in #xx] in the summary pane so it is easy to see which fragments are successfully reassembled and which are not. For fragments, add a "This fragment is reassembled in:xx" to the tree pane so and make it FT_FRAMENUM so it is easy to jump top the reassembled ip packet. svn path=/trunk/; revision=7489
2003-04-16Update packet-ip.c to print the identification number in decimal as well as ↵Ronnie Sahlberg1-2/+2
hexadecimal to make it easier to crossreference packets between output from other sniffers that display it in DEC instead of HEX. Since this value has no human readable meaning it should be displayed in HEX only but make ethereal also display the "wrong" base to enhance human compatibility. svn path=/trunk/; revision=7471
2003-03-04When deciding whether we have enough data in a lower-level packet toGuy Harris1-4/+5
attempt reassembly of a higher-level packet that includes the lower-level packet, use "tvb_bytes_exist()" to check whether all the data that's to be included in the reassembly is available, rather than by checking whether the packet is short. Add some checks of that sort that were missing. Use the reported length of the packet when doing reassembly. Make the "iphdrlen" field of a "packet_info" structure be the length of the IP header in bytes, not in 4-byte words. svn path=/trunk/; revision=7274
2003-03-03Update for tethereal -z io,users, top talkers :Ronnie Sahlberg1-1/+2
"tcpip" added. -z io,users,tcpip will create a top talkers list of individual tcpip connections svn path=/trunk/; revision=7264
2003-01-28Panic if a preference starts with the name of the module to which itGuy Harris1-2/+2
belongs, as that's redundant. Fix a bunch of cases where that was done, and map the old name to the new name. Instead of marking "mtp3.mtp3_standard" as obsolete, map it to "mtp3.standard". svn path=/trunk/; revision=7030
2003-01-23In the BSDs, ARCNET packets don't have an offset field between theGuy Harris1-2/+3
addresses and the protocol type, as supplied by BPF; on Linux, they *do* have an offset field, as supplied by PF_PACKET sockets. Add a new WTAP_ENCAP_ARCNET_LINUX, with packets that include the offset field, and don't dissect an offset in WTAP_ENCAP_ARCNET packets. Map a libpcap link-layer type of 129 to WTAP_ENCAP_ARCNET_LINUX; that value was recently assigned to Linux-style ARCNET. Add some more ARCNET protocol IDs. For most protocol IDs, dissect an ATA 878.2 fragmentation header; don't do it for RFC 1051 IP and ARP, and Diagnose packets. Set the length of the ARCNET protocol tree item appropriately. Dissect both the RFC 1051 and RFC 1201 styles of IP and ARP over ARCNET, and dissect the RFC 1201 style of RARP as well. svn path=/trunk/; revision=6981
2003-01-22Patch for packet-ip to make it TAPableRonnie Sahlberg1-74/+82
svn path=/trunk/; revision=6969
2003-01-20Move into "call_dissector_work()" the stuff to handle dissecting, inGuy Harris1-74/+4
error packets, the copy of the packet that got the error, rather than doing it in the CLNP dissector and the ICMP dissector and the ICMPv6 dissector and the PPP dissector for various control protocols; have it do that work iff "pinfo->in_error_pkt" is set. svn path=/trunk/; revision=6942
2003-01-19When dissecting the packet that gave an ICMP error, save the writabilityGuy Harris1-6/+32
state of the columns and the current protocol, and restore them when done. Also, cache BoundsError and, if we get a BoundsError, restore them and then re-throw the BoundsError, so we see a "Short Frame" indication if the frame was cut off by the snapshot length. svn path=/trunk/; revision=6941
2003-01-14Don't copy the entire IP header into a structure, extract stuff from itGuy Harris1-104/+140
as you dissect it, so we can dissect packets that are cut short before the end of an IP header. Check for an IP total length less than the header length. svn path=/trunk/; revision=6921
2002-12-19Update reassemble.c/show_item and all callers to use FT_FRAMENUM for the ↵Ronnie Sahlberg1-3/+3
list of packets corresponding to a reassembled pdu svn path=/trunk/; revision=6807
2002-10-25Count ICMPv6 packets as ICMP when capturing.Guy Harris1-1/+2
Check the next header type - properly handling extension headers - in "capture_ipv6()". Get rid of the count of IPv6 packets - we break that down in "capture_ipv6()" now. Fix a typo. svn path=/trunk/; revision=6510
2002-10-24Add a "fragment_add_seq_next()" to reassemble fragments that don't haveGuy Harris1-2/+2
sequence numbers or offsets and are thus assumed to be received in order with no duplicates or dropped fragments (e.g., for NetBIOS Frame, where 802.2 LLC guarantees in-order delivery to NetBIOS with no duplicates or dropped fragments). "show_fragment_tree()' and "show_fragment_seq_tree()" don't modify the "fragment_items" to which the "fit" argument points, so make that argument a "const fragment_items *". Make all the "fragment_items" tables "static" (as they're not used outside the modules defining them) and "const" (as they're not modified). Add support for reassembly of NetBIOS fragmented requests and responses. Get rid of an unnecessary include of "packet-tr.c" in the NetBIOS dissector, and make its table of dissection function pointers static. Fix some typos in the AppleTalk and NetBIOS dissectors. svn path=/trunk/; revision=6491
2002-10-18From Peter Fales: ARCNET support.Guy Harris1-1/+3
Sort the lists of dissectors in the DISSECTOR_SRC macros in "Makefile.am" and "Makefile.nmake". svn path=/trunk/; revision=6450
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-34/+34
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-02Replace the types from sys/types.h and netinet/in.h by their glib.hJörg Mayer1-11/+3
equivalents for the toplevel directory. The removal of winsock2.h will hopefully not cause any problems under MSVC++, as those files using struct timeval still include wtap.h, which still includes winsock2.h. svn path=/trunk/; revision=5932
2002-07-15From Joerg Mayer:Guy Harris1-9/+9
Change struct addr to guint32 which is the way it is used anyway. Use the GLib macros to convert from network to host byte order. svn path=/trunk/; revision=5878
2002-06-09From John Wells: Fix the default offset adjustment in dissect_mip_extentions.Gerald Combs1-2/+2
svn path=/trunk/; revision=5657
2002-06-07Add "show_fragment_seq_tree()", which is like "show_fragment_tree()",Guy Harris1-4/+5
but for stuff reassembled with "fragment_add_seq()" or "fragment_add_seq_check()". Add a "fragment tag" string to the "fragment_items", so that packets with fragmentation errors can be properly flagged as having "Illegal fragments" or "Illegal segments" depending on the term used with the protocol in question. Make all the dissectors that can use "show_fragment_tree()" or "show_fragment_seq_tree()", and don't already use them, do so. svn path=/trunk/; revision=5644
2002-06-05Added show_fragment_tree() to reassemble. This function will do the commonRonnie Sahlberg1-73/+15
task of creating a fregment tree for the fragmented packets. Having this identical code to create this tree in every dissector that does PDU reassembly is a huge waste and duplication of code. Updated IP, SMB and DCERPC to use the new function. svn path=/trunk/; revision=5626
2002-06-04Get rid of the "data_src" member of the "frame_data" structure; put itGuy Harris1-2/+2
in the "packet_info" structure instead, as we don't need a pointer for every single frame in the capture file, just for each frame for which we currently have an open "epan_dissect_t". svn path=/trunk/; revision=5614
2002-05-30Don't pass "tvb_reported_length_remaining(tvb, offset)" as the fourthGuy Harris1-4/+7
argument to "tvb_new_subset()" - just use -1 if the subset tvbuff is to run to the end of the parent tvbuff. svn path=/trunk/; revision=5597
2002-03-31Get rid of an unused argument.Guy Harris1-10/+12
Use the reported length, not the captured length, of a tvbuff when scanning through it. Mark unused arguments that can't be eliminated as unused. svn path=/trunk/; revision=5058
2002-03-27In the protocol tree entries for lists of fragments/segments, make theGuy Harris1-24/+24
top-level item correspond to the reassembled data, and make the item for each fragment/segment correspond to the part of that reassembled data that came from that fragment/segment. svn path=/trunk/; revision=5025
2002-02-27Label the data source for various forms of reassembled data with theGuy Harris1-2/+2
protocol that fragmented them, rather than just calling them "Reassembled". Do the same with uncompressed WCP data. svn path=/trunk/; revision=4822
2002-02-18Don't give tvbuffs names; instead, give data sources names, where aGuy Harris1-3/+3
"data source" has a name and a top-level tvbuff, and frames can have a list of data sources associated with them. Use the tvbuff pointer to determine which data source is the data source for a given field; this means we don't have to worry about multiple data sources with the same name - the only thing the name does is label the notebook tab for the display of the data source, and label the hex dump of the data source in print/Tethereal output. Clean up a bunch of things discovered in the process of doing the above. svn path=/trunk/; revision=4749
2002-02-17With the tvbuffication of all dissectors, the "packet_info" structure noGuy Harris1-2/+2
longer contains length fields, so there's no need to pass a "packet_info *" argument to "set_actual_length()". svn path=/trunk/; revision=4748
2002-02-01Properly add the Boolean "checksum is bad" flag.Guy Harris1-3/+3
svn path=/trunk/; revision=4666
2002-01-30Make some variables volatile because GCC on Digital UNIX complainedGuy Harris1-7/+7
about them being trashed by setjmp/longjmp (does GCC there stuff them into registers? They're bigger than 64 bits, so they don't even fit into a single register on Alpha). svn path=/trunk/; revision=4636
2002-01-21Include files from the "epan" directory and subdirectories thereof withGuy Harris1-3/+3
"epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
2002-01-20If reassembly is enabled, don't try to do any reassembly work at all onGuy Harris1-16/+11
a fragment unless we've captured all the data in the fragment and (in IPv4 and CLNP) it has a valid checksum, so that if the first fragment is a short frame or a frame with an invalid checksum, we'll treat it as if reassembly weren't enabled, and will dissect what data we have in it, rather than not dissecting *any* of the fragments above the IP/CLNP layer. svn path=/trunk/; revision=4575
2002-01-17Use the "fragmented" field of the "packet_info" structure inGuy Harris1-2/+6
"dissect_frame()" to indicate whether a ReportedBoundsError was due to the packet being malformed (i.e., the packet was shorter than it's supposed to be, so the dissector went past the end trying to extract fields that were supposed to be there) or due to it not being reassembled (i.e., the packet was fragmented, and we didn't reassemble it, but just treated the first fragment as the entire packet, so the dissector went past the end trying to extract fields that were partially or completely in fragments after that). Mark the latter as being unreasembled rather than malformed. Properly initialize, save, and restore that field, and properly set it, so that works. svn path=/trunk/; revision=4555
2002-01-10As per a comment from Ronnie Sahlberg, display TCP sequence numbers inGuy Harris1-5/+5
the list of segments in a desegmented PDU as unsigned, rather than signed. Fix some other displays of unsigned quantities with "%d" while we're at it. svn path=/trunk/; revision=4516
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-27 11:39:23 +0000