aboutsummaryrefslogtreecommitdiffstats
path: root/packet-tcp.c
AgeCommit message (Collapse)AuthorFilesLines
2003-07-24From Lars Roland: add a preference to control whether, in the TCPGuy Harris1-10/+21
dissector, heuristic dissectors should be checked before, or after, dissectors for specific port numbers. Add a similar preference for UDP. Clean up white space. svn path=/trunk/; revision=8082
2003-07-16Clean out the correct hash table.Guy Harris1-2/+2
svn path=/trunk/; revision=8024
2003-07-11Add a routine "dissect_ipv6_options()" that works likeGuy Harris1-1/+3
"dissect_ip_tcp_options()" but for options that are like IPv6 options (i.e., the length byte has a value that doesn't include the option code or length byte). Add an "ip_opts.h" header to declare it, and move the declaration of stuff used by it and "dissect_ip_tcp_options()", and the declaration of "dissect_ip_tcp_options()", to that header. Use "dissect_ipv6_options()" for Mobile IPv6 options. Get rid of the unused "mip6_opt_types[]" array in "packet-mip6.h". svn path=/trunk/; revision=8015
2003-06-04Put in a comment noting that we might not want to process the payload ofGuy Harris1-1/+8
a TCP segment, and probably don't want to hand the segment to a TCP tap, if the TCP segment is included in an error packet. svn path=/trunk/; revision=7780
2003-05-21If the reported length of the TCP packet is less than the TCP headerGuy Harris1-22/+34
length, we can't get the segment length (although we can at least try to dissect the header). If that's the case, put in Ronnie's "short segment" note. Also, put into the information we pass to TCP taps an indication of whether the segment length is valid or not. svn path=/trunk/; revision=7705
2003-05-21If we're inside an error packet, don't assume we know the length of theGuy Harris1-6/+14
TCP segment, as we might not have the entire segment. svn path=/trunk/; revision=7704
2003-05-21If we were handed a fragmented packet, don't do anything that depends onGuy Harris1-47/+48
knowing the actual length of the packet, as we don't know that length (IP fragments don't contain the length of the full packet - you don't know how big the reassembled packet is until you reassemble it). We don't have to worry about dissecting the TCP header in them, though. svn path=/trunk/; revision=7703
2003-05-20Do not decode the full tcp header if the reported length is less than 20Ronnie Sahlberg1-3/+18
or the reported tcp header length. This is probably caused either by a very very short capture length or by nmap or someone playing firewall fragment games to the tcp flags field. svn path=/trunk/; revision=7698
2003-05-16Update the tcp sequence analysis to understand and decode properlyRonnie Sahlberg1-2/+16
the rather brilliant keep-alive packets solaris use. Solaris does not do RFC793 keepalives at all, instead they do a quite brilliant workalike that gies them reliable keepalives. svn path=/trunk/; revision=7685
2003-04-23Update to TCP to handle hints from dissectors where the next PDU may start.Ronnie Sahlberg1-39/+260
ONCRPC dissector updated to provide hint to TCP where the next RPCoverTCP PDU starts as example. Trivial updates to the other TCP based protocols required to amke them handle this as well. See the updates to packet-rpc.c as an example. This is enabled by activating tcp analysis and provides hints to TCP to know where PDUs starts when not aligned to the start of the segment. svn path=/trunk/; revision=7543
2003-04-20Add a pointer to an hf_ value for a "reassembled_in" field (which can beGuy Harris1-1/+2
null) to the "fragment_items" structure, and don't pass that value into "process_reassembled_data()", just have it use the value in the "fragment_items" structure passed to it. Make "process_reassembled_data()" capable of handling reassembly done by "fragment_add_seq_check()", and use it in the ATP and 802.11 dissectors; give them "reassembled_in" fields. Make "process_reassembled_data()" handle only the case of a completed reassembly (fd_head != NULL) so that we can use it in those dissectors without gunking the code up too much. svn path=/trunk/; revision=7513
2003-03-27Use FT_FRAMENUM for the "Duplicate to the ACK in frame" and "This is anGuy Harris1-3/+3
ACK to the segment in frame" fields, so you can use the "Go To Corresponding Frame" menu item. svn path=/trunk/; revision=7379
2003-03-27Enhancement to TCP Sequence AnalysisRonnie Sahlberg1-5/+27
Duplicate ACKs that are detected/suspected are now also flagged with which frame the original ACK was seen in and the dup ack number. This is displayed both in the summary pane as well as in the tree pane. svn path=/trunk/; revision=7375
2003-03-26Fixed a small bug in tcp sequence number analysis.Ronnie Sahlberg1-7/+9
FIN flag would previously only add one to the sequence number if the FIN packet was empty, i.e. did not carry any payload data. This caused ethereal to incorrectly flag the ACK to such packets (FIN+payload data) to be incorrectly flagged as ACK to previously lost segment. Change the algorithm to always add 1 to the segment length, and thus the sequence number for all packets with teh FIN bit set. svn path=/trunk/; revision=7371
2003-03-05Use the reported length, not the captured length, as the fragment lengthGuy Harris1-5/+3
when doing reassembly. In some additional places, use "tvb_bytes_exist()" to check whether we have enough data to do reassembly, rather than checking to see if the frame is short (it might be short but we might still have enough data to do reassembly). In DCE RPC, use the fragment length from the header as the number of bytes of fragment data. There's no need to check "pinfo->fragmented" before doing reassembly in the DCERPC-over-SMB-pipes code - either we have all the data or we don't. In SNA and WTP reassembly, add a check to make sure we have all the data to be reassembled. svn path=/trunk/; revision=7282
2003-03-04Pretty up the handling of SACK. Have tested now, looks OK.Richard Sharpe1-7/+7
svn path=/trunk/; revision=7273
2003-03-03Update for tethereal -z io,users, top talkers :Ronnie Sahlberg1-2/+3
"tcpip" added. -z io,users,tcpip will create a top talkers list of individual tcpip connections svn path=/trunk/; revision=7264
2003-03-03Add SACK leftedge and rightedge filtering ... Added them as decimalRichard Sharpe1-3/+15
values which seemed appropriate, but had the split them into two items in the option tree. svn path=/trunk/; revision=7260
2003-03-03As suggested by Guy, rather than add_uint_hidden, and then add_text,Richard Sharpe1-9/+6
do an add_uint_format(...). It was all too easy. svn path=/trunk/; revision=7259
2003-03-01Allow filtering on the window scale value ...Richard Sharpe1-1/+3
svn path=/trunk/; revision=7236
2003-03-01Adding more options supportRichard Sharpe1-4/+9
svn path=/trunk/; revision=7235
2003-03-01Add tcp.options.mss_val to allow filtering on the value of the MSS optionRichard Sharpe1-1/+7
svn path=/trunk/; revision=7233
2003-03-01Some more options, cc and time stamp.Richard Sharpe1-1/+5
svn path=/trunk/; revision=7232
2003-03-01More tcp options stuff ...Richard Sharpe1-17/+29
svn path=/trunk/; revision=7231
2003-03-01More TCP Options supportRichard Sharpe1-1/+34
svn path=/trunk/; revision=7230
2003-03-01Start adding support for options as hidden fields in the dissect tree.Richard Sharpe1-1/+12
svn path=/trunk/; revision=7228
2003-02-27From Didier Gautheron: provide a mechanism to indicate why reassemblyGuy Harris1-2/+2
wasn't done, and, for TCP, use that mechanism if reassembly isn't done is an incorrect TCP checksum. svn path=/trunk/; revision=7212
2003-02-21Protect against wraparound when scanning through a bunch of TCP data inGuy Harris1-1/+6
"tcp_dissect_pdus()". svn path=/trunk/; revision=7179
2003-02-18From Didier Gautheron: fix desegmentation code to handle sequence numberGuy Harris1-9/+9
overflow. svn path=/trunk/; revision=7169
2003-01-28Panic if a preference starts with the name of the module to which itGuy Harris1-4/+4
belongs, as that's redundant. Fix a bunch of cases where that was done, and map the old name to the new name. Instead of marking "mtp3.mtp3_standard" as obsolete, map it to "mtp3.standard". svn path=/trunk/; revision=7030
2002-12-19Update reassemble.c/show_item and all callers to use FT_FRAMENUM for the ↵Ronnie Sahlberg1-19/+60
list of packets corresponding to a reassembled pdu svn path=/trunk/; revision=6807
2002-12-17From Jason House, support for TAPping from TCP protocolRonnie Sahlberg1-80/+75
svn path=/trunk/; revision=6792
2002-12-02Don't cast away constness, and fix variable and structure memberGuy Harris1-4/+4
qualifiers as necessary to ensure that we don't have to. "strcmp()", "strcasecmp()", and "memcmp()" don't return booleans; don't test their results as if they did. Use "guint8", not "guchar", for a pointer to (one or more) 8-bit bytes. Update Michael Tuexen's e-mail address. svn path=/trunk/; revision=6726
2002-11-27Check whether we got an overflow for the PDU length *before* we checkGuy Harris1-12/+12
whether we have that much data. svn path=/trunk/; revision=6675
2002-11-07Must use the proper proto_tree_add_... call for FT_NONERonnie Sahlberg1-9/+9
svn path=/trunk/; revision=6577
2002-11-07hf_index update for TCPRonnie Sahlberg1-9/+9
svn path=/trunk/; revision=6576
2002-11-02Fixed small bug in TCP seq/ack analysis. Forgot to check a pointer for NULL ↵Ronnie Sahlberg1-2/+4
which caused crashes sometimes. svn path=/trunk/; revision=6546
2002-11-01Three more things for TCP seq/ack analysis to check for and flag:Ronnie Sahlberg1-13/+92
ZeroWindow: ZeroWindow segments are detected and flagged ZeroWindowProbe: detected and flagged ZeroWindowViolation: attempts to write >1 byte of data to a zerowindow is detected and flagged. svn path=/trunk/; revision=6543
2002-11-01Update to TCP seq/ack analysis: tcp seq/ack analysis should now be able toRonnie Sahlberg1-2/+74
detect suspected duplicate ACKs. svn path=/trunk/; revision=6542
2002-10-17From Ronnie Sahlberg: use the frame number of a TCP segment, rather thanGuy Harris1-6/+14
its starting sequence number, as the "fragment ID" when reassembling, and include the source and destination port numbers in a "tcp_segment_key" structure and use that as part of the key in the hash table for segments, so that we don't get spoofed by segments in two directions in the same conversation, or by segments in two separate conversations between the same hosts, having the same starting sequence number (which is not unlikely to happen if relative sequence numbers are being used). svn path=/trunk/; revision=6443
2002-09-18From Didier: bugfix for sequence number wrappingRonnie Sahlberg1-5/+5
svn path=/trunk/; revision=6303
2002-09-11fix for the fixRonnie Sahlberg1-2/+2
svn path=/trunk/; revision=6274
2002-09-11Tiny change to the tcp seq/ack analysis.Ronnie Sahlberg1-12/+5
If the addresses are equal, compare the ports with '>' instead of '-' since '>' will work regardless of whether the values are unsigned or not. svn path=/trunk/; revision=6268
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-25/+25
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-22Properly display the window scale option.Guy Harris1-2/+2
svn path=/trunk/; revision=6065
2002-08-22"CMP_ADDRESS()" is not guaranteed to return 0, 1, or -1, it's justGuy Harris1-6/+35
guaranteed to return 0, a positive number, or a negative number, based on the result of the comparison. Furthermore, if it returns 0, meaning the source and destination addresses are the same, we have to look at the port numbers to decide which side of the conversation the frame is from. svn path=/trunk/; revision=6064
2002-08-21Create a subtree with an item "tcp.analysis.flags" to keep allRonnie Sahlberg1-20/+35
tcp sequence number analysis flags, such as retransmission , lost-segment, etc to make it easier to search for all these conditions. svn path=/trunk/; revision=6056
2002-08-21Moved the generic true_false_string saying "Set", "Not set" intoTim Potter1-8/+1
epan/packet.c It was cut and pasted into seven other dissectors! svn path=/trunk/; revision=6052
2002-08-17Reverted part of the previous patch. It seemed we found a few too manyRonnie Sahlberg1-2/+2
packets to display the ACK data for. svn path=/trunk/; revision=6008
2002-08-16Fixed bug not handling FIN pakcets properly.Ronnie Sahlberg1-2/+9
Fixed another tiny bug where it would forget to check ACKs outside the window sometimes. svn path=/trunk/; revision=6001
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-13 18:15:51 +0000