aboutsummaryrefslogtreecommitdiffstats
path: root/packet-tcp.c
AgeCommit message (Collapse)AuthorFilesLines
2004-05-15remove FI_LINK again,Ulf Lamping1-3/+1
as this info can be derived from the presence of the FT_FRAMENUM field svn path=/trunk/; revision=10900
2004-05-14add support to link from specially marked fields to related packets,Ulf Lamping1-2/+5
a doubleclick will follow the link svn path=/trunk/; revision=10897
2004-05-14add support to link from specially marked fields to related packets,Ulf Lamping1-1/+2
a doubleclick will follow the link svn path=/trunk/; revision=10892
2004-05-14mark some more protocol fields as generatedUlf Lamping1-17/+33
svn path=/trunk/; revision=10890
2004-05-01add PROTO_ITEM_SET_HIDDEN() and PROTO_ITEM_SET_GENERATED(),Ulf Lamping1-3/+6
this sets flags for later rendering of the field data svn path=/trunk/; revision=10752
2004-04-30MSVC warnings removedUlf Lamping1-2/+2
svn path=/trunk/; revision=10738
2004-04-29added "[CHECKSUM INCORRECT]" to the info columnUlf Lamping1-2/+5
svn path=/trunk/; revision=10726
2004-04-23From Jon Oberheide: put the "this is a continuation of" item into theGuy Harris1-5/+5
protocol tree under the TCP top-level item, rather than at the top level itself, as the protocol hierarchy statistics code can't handle non-protocol items at the top level. svn path=/trunk/; revision=10670
2004-04-15Add some braces to squelch a GCC warning.Guy Harris1-2/+3
svn path=/trunk/; revision=10602
2004-04-08update tcp so that it will print the string "(relative sequence/ack number)" ↵Ronnie Sahlberg1-4/+16
in the header for the fields affected by using human readable sequence and ack numbers. svn path=/trunk/; revision=10560
2004-03-27From Ronnie Sahlberg: RST and FIN segments are neither zero-windowGuy Harris1-5/+12
packets nor duplicate ACKs. svn path=/trunk/; revision=10506
2004-03-19From Ronnie Sahlberg:Guy Harris1-27/+92
make tcp_dissect_pdus() understand how to skip to the next PDU; make the skip-to-the-next-PDU code stop attempting to decode segments that are known to be completely within an already seen PDU. svn path=/trunk/; revision=10406
2004-02-24fixed various typosUlf Lamping1-2/+2
svn path=/trunk/; revision=10220
2004-02-24with the cahnges to when to call the heuristic dissectorRonnie Sahlberg1-6/+20
(and the fact that nbss does not register its conversation) this caused WANT_PDU_TRACKING to be decremented multiple times between the dissectors and thus ethereal could no longer reliably spot SMB PDUs that started in the middle of a tcp segment (unless we do reassembly which we dont do unless we have to since it eats soo many resources) FIX so that ethereal once again can spot SMB (and other) protocol PDUs that start in the middle of a segment. svn path=/trunk/; revision=10219
2003-12-30Export a "dissect_tcp_payload()" routine from the TCP dissector, for useGuy Harris1-17/+30
by pass-through proxying dissectors such as the SOCKS dissector; it does the work of processing a TCP segment, including desegmentation. Export the "next sequence number" value to subdissectors, so they can use it when calling "dissect_tcp_payload()". Use that in the SOCKS dissector. svn path=/trunk/; revision=9489
2003-12-09As per Didier Gautheron, dissect TCP options regardless of whether we'reGuy Harris1-5/+8
building a protocol tree, so the Info column is set correctly. svn path=/trunk/; revision=9214
2003-11-19Update to TCP, when we see a SYN|ACK packetm reset base_ack to the current ↵Ronnie Sahlberg1-4/+11
ACK-1 so that it looks right when doing relative sequence numbers. I.e. SEQ : seq==0 ack==0 SEQ|ACK seq==0 ack==1 ACK seq==1 ack==1 This looks much more correct. This change also fixes the problem reported to ethereal-dev recently with "Follow TCP Stream" dropping the first character of the stream. svn path=/trunk/; revision=9034
2003-11-18From Lars Roland: the window size passed toGuy Harris1-2/+2
"tcp_analyze_sequence_number()" is a "guint32", as it might be scaled - make the arugment a "guint32" as well. svn path=/trunk/; revision=9014
2003-11-13Change the gboolean controlling whether to use TCP Sequence Number Analysis ↵Ronnie Sahlberg1-3/+3
and TCP Relative Sequence Numbers to default to ENABLED instead of DISABLED. These features do not consume that much memory or CPU but will greatly enhance the feature set of ethereal. Make it enabled by default so also those that never venture into the preferences dialog will benefit from it. svn path=/trunk/; revision=8957
2003-11-11Make the declaration of "process_tcp_payload()" match the definition.Guy Harris1-2/+2
svn path=/trunk/; revision=8941
2003-11-08Have "decode_tcp_ports()" handle only the handoff to a subdissector -Guy Harris1-59/+62
and have it return TRUE if we succeeded, FALSE otherwise - and have an internal "process_tcp_payload()" routine handle the (TCP-specific) PDU tracking and sequence number analysis, with an argument to indicate whether it should do that or not (i.e., whether it's being handed a TCP segment or reassembled data). svn path=/trunk/; revision=8914
2003-11-08"decode_tcp_ports()" is for use by protocols that proxy transport-layerGuy Harris1-34/+56
packets/sessions, e.g. MSProxy and SOCKS. It should not cause any of the TCP-specific stuff such as sequence number analysis or PDU tracking to be done. (Actually, MSProxy and SOCKS should offer desegmentation services *themselves* and do their *own* PDU tracking, rather than just passing stuff on to "decode_tcp_ports()", but that's another matter.) Make "tcp_tree" once again be a local variable to "dissect_tcp()", and pass it as an argument to those functions that use it. svn path=/trunk/; revision=8912
2003-11-06Update to LDAP and TCPRonnie Sahlberg1-2/+7
LDAP messages that span multiple segments will throw an exception unless we have reassembly enabled. Update TCP so that IF an exception was thrown that we still pick up any hints provided by the subdissector about where the next PDU starts. Update LDAP so that it will rpovide hints to TCP about where the next LDAP PDU starts in the sequence number space. Thus now ethereal can find and dissect LDAP PDUs that starts somewhere in the middle of a TCP segment. svn path=/trunk/; revision=8895
2003-11-06Fix for TCP.Ronnie Sahlberg1-6/+38
If we have short or malformed PDUs in protocols above TCP this will generate an exception and thus some of the stateful things such as keeping track of and printing the tcp analysis data will be shourcutted and not called. Add a wrapper around the call to the subdissectors above TCP so that if an exception is generated we will still catch it and explicitely call tcp_print_sequence_number_analysis() so that also short packets are handled well. svn path=/trunk/; revision=8891
2003-10-28Full duplex analyzers that capture each direction of a link with a separate ↵Ronnie Sahlberg1-3/+12
NIC will lose the time integrity between the two NICs more often than one might expect. It is thus relatively common that a data segment and its ACK being swapped in the capture file. Therefore, drop the condition that a segment must not have been acked yet in the detection of OutOfOrder segments. Second, fix a bug where we didnt keep track of the ack numbers properly for relative sequence number analysis. svn path=/trunk/; revision=8800
2003-10-27Squelch some signed vs. unsigned comparison warnings.Guy Harris1-4/+3
Get rid of an unused variable. svn path=/trunk/; revision=8788
2003-10-25Update / cleanup to tcp sequence number analysis and new featuresRonnie Sahlberg1-47/+221
moved some variables to the structure where they belonged instead of where they currently were and reduced the complexity of the code Fast Retransmission: Ethereal not tries to detect and flag FastRetransmissions: The heuristics for this check is: >=3 dupacks in other direction this semgent is what the dupacks are asking for it arrived within 10ms of the last dupack (10ms should be short enough to not confuse with real RTOs) OutOfOrder segments Previously all segments that did not advance the right edge of the window was flagged as retransmission now ethereal will try to flag segments that are merely reordered as OutOfOrder segments insteaD tHE HEURISTICS ARE: it has not been ACKed yet we have not seen it before it arrived within 4ms of the segment immediately to the right in the window svn path=/trunk/; revision=8775
2003-10-10From Matthijs MelchiorRonnie Sahlberg1-14/+5
Small change to the TCP sequence number analysis and relative sequence number code so that it plays a bit nicer with captures generated by text2pcap. Change the criterion used to initialize the base sequence and ack numbers to set these base offsets where it detects that the bookkeeping structures are NULL (as in no previous packet seen for this session) instead of using a hardcoded magic number 0, which might actually occur in normal captures. svn path=/trunk/; revision=8674
2003-09-18Don't store the setting of the window scale option unless the "RelativeGuy Harris1-4/+6
sequence numbers and window scaling" option is set, as that option says it controls whether we attempt to display the real post-scaling window size. Also, don't store it unless the "Analyze TCP sequence numbers" option is set, as "Relative sequence numbers and window scaling" requires it, because, unless "Analyze TCP sequence numbers" is set, we don't set up conversations for TCP connections and don't have a pool of data structures for per-connection information into which to store the window scale option value. svn path=/trunk/; revision=8490
2003-09-12Enhancement to the TCP dissector:Ronnie Sahlberg1-6/+46
Track window scaling and display the window field after it has been scaled to its real value If we have seen a SYN packet with a WindowScalingOption then if the option to use RelativeSequence numbers has been enabled, then ethereal will change the presented window field to be the window after it has been scaled to the real value. This obviously only works if we have seen the SYN packet and if the SYN packet contained a window scaling option svn path=/trunk/; revision=8461
2003-09-08Cosmetic change to TCPRonnie Sahlberg1-11/+38
An ACK to a KeepAlive is not a DupACK. Detect these ACKs and mark them as KeepAliveACK instead of as DupACK (or maybe dont mark them at all? ) At least they shouldnt be marked as DupACKs svn path=/trunk/; revision=8411
2003-08-29If something is a KeepAlive it is just a keepalive and not also a dup ackRonnie Sahlberg1-4/+7
svn path=/trunk/; revision=8312
2003-08-29If the FIN flag is set it is NOT a keepaliveRonnie Sahlberg1-7/+9
fix small typo svn path=/trunk/; revision=8311
2003-08-28Add a "reassembled in" field.Guy Harris1-2/+31
svn path=/trunk/; revision=8294
2003-08-23New feature. Statistics/EndpointTalkjers can now present a sortable table ↵Ronnie Sahlberg1-3/+3
with a list of all seen conversations of a certain type. Supported types are Ethernet/TokenRing/IP/UDP and TCP. Will add FibreChannel soon. The framework for this feature needs to be enhanced in the future so that by selecting one entry and click the right mousebutton, this will bring up a menu with Prepare/Match options with suboptions for AnyDirection, ForwardOnly or ReverseOnly which updates the display filter accordingly. Had to update some of the taps as well to change them to use a proper address structure for the address fields. We should now be able to to these stats correctly even for ip tunneled over ip tunnelled over ip ... svn path=/trunk/; revision=8222
2003-07-24From Lars Roland: add a preference to control whether, in the TCPGuy Harris1-10/+21
dissector, heuristic dissectors should be checked before, or after, dissectors for specific port numbers. Add a similar preference for UDP. Clean up white space. svn path=/trunk/; revision=8082
2003-07-16Clean out the correct hash table.Guy Harris1-2/+2
svn path=/trunk/; revision=8024
2003-07-11Add a routine "dissect_ipv6_options()" that works likeGuy Harris1-1/+3
"dissect_ip_tcp_options()" but for options that are like IPv6 options (i.e., the length byte has a value that doesn't include the option code or length byte). Add an "ip_opts.h" header to declare it, and move the declaration of stuff used by it and "dissect_ip_tcp_options()", and the declaration of "dissect_ip_tcp_options()", to that header. Use "dissect_ipv6_options()" for Mobile IPv6 options. Get rid of the unused "mip6_opt_types[]" array in "packet-mip6.h". svn path=/trunk/; revision=8015
2003-06-04Put in a comment noting that we might not want to process the payload ofGuy Harris1-1/+8
a TCP segment, and probably don't want to hand the segment to a TCP tap, if the TCP segment is included in an error packet. svn path=/trunk/; revision=7780
2003-05-21If the reported length of the TCP packet is less than the TCP headerGuy Harris1-22/+34
length, we can't get the segment length (although we can at least try to dissect the header). If that's the case, put in Ronnie's "short segment" note. Also, put into the information we pass to TCP taps an indication of whether the segment length is valid or not. svn path=/trunk/; revision=7705
2003-05-21If we're inside an error packet, don't assume we know the length of theGuy Harris1-6/+14
TCP segment, as we might not have the entire segment. svn path=/trunk/; revision=7704
2003-05-21If we were handed a fragmented packet, don't do anything that depends onGuy Harris1-47/+48
knowing the actual length of the packet, as we don't know that length (IP fragments don't contain the length of the full packet - you don't know how big the reassembled packet is until you reassemble it). We don't have to worry about dissecting the TCP header in them, though. svn path=/trunk/; revision=7703
2003-05-20Do not decode the full tcp header if the reported length is less than 20Ronnie Sahlberg1-3/+18
or the reported tcp header length. This is probably caused either by a very very short capture length or by nmap or someone playing firewall fragment games to the tcp flags field. svn path=/trunk/; revision=7698
2003-05-16Update the tcp sequence analysis to understand and decode properlyRonnie Sahlberg1-2/+16
the rather brilliant keep-alive packets solaris use. Solaris does not do RFC793 keepalives at all, instead they do a quite brilliant workalike that gies them reliable keepalives. svn path=/trunk/; revision=7685
2003-04-23Update to TCP to handle hints from dissectors where the next PDU may start.Ronnie Sahlberg1-39/+260
ONCRPC dissector updated to provide hint to TCP where the next RPCoverTCP PDU starts as example. Trivial updates to the other TCP based protocols required to amke them handle this as well. See the updates to packet-rpc.c as an example. This is enabled by activating tcp analysis and provides hints to TCP to know where PDUs starts when not aligned to the start of the segment. svn path=/trunk/; revision=7543
2003-04-20Add a pointer to an hf_ value for a "reassembled_in" field (which can beGuy Harris1-1/+2
null) to the "fragment_items" structure, and don't pass that value into "process_reassembled_data()", just have it use the value in the "fragment_items" structure passed to it. Make "process_reassembled_data()" capable of handling reassembly done by "fragment_add_seq_check()", and use it in the ATP and 802.11 dissectors; give them "reassembled_in" fields. Make "process_reassembled_data()" handle only the case of a completed reassembly (fd_head != NULL) so that we can use it in those dissectors without gunking the code up too much. svn path=/trunk/; revision=7513
2003-03-27Use FT_FRAMENUM for the "Duplicate to the ACK in frame" and "This is anGuy Harris1-3/+3
ACK to the segment in frame" fields, so you can use the "Go To Corresponding Frame" menu item. svn path=/trunk/; revision=7379
2003-03-27Enhancement to TCP Sequence AnalysisRonnie Sahlberg1-5/+27
Duplicate ACKs that are detected/suspected are now also flagged with which frame the original ACK was seen in and the dup ack number. This is displayed both in the summary pane as well as in the tree pane. svn path=/trunk/; revision=7375
2003-03-26Fixed a small bug in tcp sequence number analysis.Ronnie Sahlberg1-7/+9
FIN flag would previously only add one to the sequence number if the FIN packet was empty, i.e. did not carry any payload data. This caused ethereal to incorrectly flag the ACK to such packets (FIN+payload data) to be incorrectly flagged as ACK to previously lost segment. Change the algorithm to always add 1 to the segment length, and thus the sequence number for all packets with teh FIN bit set. svn path=/trunk/; revision=7371
2003-03-05Use the reported length, not the captured length, as the fragment lengthGuy Harris1-5/+3
when doing reassembly. In some additional places, use "tvb_bytes_exist()" to check whether we have enough data to do reassembly, rather than checking to see if the frame is short (it might be short but we might still have enough data to do reassembly). In DCE RPC, use the fragment length from the header as the number of bytes of fragment data. There's no need to check "pinfo->fragmented" before doing reassembly in the DCERPC-over-SMB-pipes code - either we have all the data or we don't. In SNA and WTP reassembly, add a check to make sure we have all the data to be reassembled. svn path=/trunk/; revision=7282
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-28 18:21:21 +0000