path: root/packet-range.c
AgeCommit message (Collapse)AuthorFilesLines
2012-05-22Note that packet_range_calc() and packet_range_calc_user() can beGuy Harris1-2/+22
painfully slow with a large capture. svn path=/trunk/; revision=42763
2012-02-28Fix https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3315 -Jeff Morriss1-2/+11
make Save-As/Displayed/All-Packets save not only the displayed packets but also any other packets needed (e.g., for reassembly) to fully dissect the displayed packets. This works only for the "All packets" case; choosing only the Selected packet, the Marked packets, or a range of packets would require actually storing which packets depend on which (too much memory) or going through the packet list many times (too slow). Also, this behavior is always the case: you can't save the displayed packets without their dependencies (I don't see why this would be desirable). So far this is done for SCTP and things using the reassembly routines (TCP has been tested). The Win32 dialog was modified but hasn't been tested yet. One confusing aspect of the UI is that the Displayed count in the Save-As dialog does not match the number of displayed packets. (I tried renaming the button "Displayed + Dependencies" but it looked too big.) The tooltip tries to explain this and the fact that this works only in the All-Packets case; suggestions for improvement are welcome. Implementation details: Dissectors (or the reassembly code) can list frames which were needed to build the current frame's tree. If the current frame passes the display filter then each listed frame is marked as "depended upon" (this takes up the last free frame_data flag). When performing a Save-As/Displayed/All-Packets then choose packets which passed the dfilter _or_ are depended upon. svn path=/trunk/; revision=41216
2011-06-30Undo r37833 in favor of Sake's changes to be committed at some future date.Chris Maynard1-1/+1
svn path=/trunk/; revision=37839
2011-06-29Based on user feedback from Sharkfest '11, make the default choice when ↵Chris Maynard1-1/+1
saving or printing packets apply to only displayed packets and not all packets. svn path=/trunk/; revision=37833
2011-04-27Create a new frame_data_sequence data type; it represents a denseGuy Harris1-5/+5
sequence of frame_data structures, indexed by the frame number. Extract the relevant bits of the capture_file data structure and move them to the frame_data_sequence, and move the relevant code from cfile.c and tweak it to handle frame_data_sequence structures. Have a possibly-null pointer to a frame_data_sequence structure in the capture_file structure; if it's null, we aren't keeping a sequence of frame_data structures (we don't keep that sequence when we're doing one-pass processing in TShark). Nothing in libwireshark should care about a capture_file structure; get rid of some unnecessary includes of cfile.h. svn path=/trunk/; revision=36881
2011-04-26Short-term hack to fix bug 5855 - don't try to process all theGuy Harris1-145/+162
frame_data structures for all the packets if we don't actually *have* any frame_data structures for any packets, e.g. in TShark in one-pass mode. Also: Use #if 0/#endif instead of commenting out. Consistently use 4-space indentation. svn path=/trunk/; revision=36879
2011-04-25Store the frame_data structures in a tree, rather than a linked list. Guy Harris1-23/+21
This lets us get rid of the per-frame_data-structure prev and next pointers, saving memory (at least according to Activity Monitor's report of the virtual address space size on my Snow Leopard machine, it's a noticeable saving), and lets us look up frame_data structures by frame number in O(log2(number of frames)) time rather than O(number of frames) time. It seems to take more CPU time when reading in the file, but seems to go from "finished reading in all the packets" to "displaying the packets" faster and seems to free up the frame_data structures faster when closing the file. It *is* doing more copying, currently, as we now don't allocate the frame_data structure until after the packet has passed the read filter, so that might account for the additional CPU time. (Oh, and, for what it's worth, on an LP64 platform, a frame_data structure is exactly 128 bytes long. However, there's more stuff to remove, so the power-of-2 size is not guaranteed to remain, and it's not a power-of-2 size on an ILP32 platform.) It also means we don't need GLib 2.10 or later for the two-pass mode in TShark. It also means some code in the TCP dissector that was checking pinfo->fd->next to see if it's NULL, in order to see if this is the last packet in the file, no longer works, but that wasn't guaranteed to work anyway: we might be doing a one-pass read through the capture in TShark; we might be dissecting the frame while we're reading in the packets for the first time in Wireshark; we might be doing a live capture in Wireshark; in which case packets might be prematurely considered "the last packet". #if 0 the no-longer-working tests, pending figuring out a better way of doing it. svn path=/trunk/; revision=36849
2010-01-26Introduce "Remove Ignored packets" in Packet Range frames, which is used inStig Bjørlykke1-1/+42
Save As, Export and Print dialogs. svn path=/trunk/; revision=31680
2009-09-21Rename capture_file.plist to capture_file.plist_start to make it consistent ↵Kovarththanan Rajaratnam1-8/+8
with capture_file.plist_end svn path=/trunk/; revision=30047
2009-08-26(FWIW) One step towards including stdio.h & stdlib.h only when req'd.Bill Meier1-0/+1
svn path=/trunk/; revision=29568
2006-05-21name changeRonnie Sahlberg1-2/+2
svn path=/trunk/; revision=18197
2005-08-14Some 'no previous declararion' warning fixesJörg Mayer1-1/+1
svn path=/trunk/; revision=15355
2004-10-16Remove the fixed maximum number of subranges in a range_t; dynamicallyGuy Harris1-6/+29
allocate them to be large enough. Add checks that the numbers in the range fit in a guint32. Check the validity of a range before saving or printing, and report errors in an alert box. Clean up white space. svn path=/trunk/; revision=12320
2004-10-16Make the nranges member of a range_t be the number of ranges, not theGuy Harris1-0/+1
number of ranges - 1, and update loops that iterate over all the ranges appropriately. Make "range_convert_str()" return a success/failure indication, and check it. Rewrite it to do more checks, and not to blithely ignore unknown characters. svn path=/trunk/; revision=12313
2004-09-04The packet range stuff knows about capture_file structures, so it'sGuy Harris1-0/+253
really more of an Ethereal/Tethereal component than a libethereal component (nothing else in libethereal knows about capture files); move it back out of libethereal. (The range stuff doesn't; we leave it in libethereal.) svn path=/trunk/; revision=11898