TCP: Added bytes sent since last PSH flag

Added tcp.analysis.push_bytes_sent to see how many bytes sent since the last PSH flag. Can be useful when analyzing application behavior and performance and bytes_in_flight gets altered by ACKs

Change-Id: I8c6348de43cdb1545169d3a04773885d2411eb00
Reviewed-on: https://code.wireshark.org/review/9822
Reviewed-by: Jasper Bongertz <jasper@packet-foo.com>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

2 files changed, 48 insertions, 0 deletions

diff --git a/epan/dissectors/packet-tcp.c b/epan/dissectors/packet-tcp.c
index 319a84d14e..af5f60983d 100644
--- a/epan/dissectors/packet-tcp.c
+++ b/epan/dissectors/packet-tcp.c
@@ -144,6 +144,7 @@ static int hf_tcp_urgent_pointer = -1;
 static int hf_tcp_analysis = -1;
 static int hf_tcp_analysis_flags = -1;
 static int hf_tcp_analysis_bytes_in_flight = -1;
+static int hf_tcp_analysis_push_bytes_sent = -1;
 static int hf_tcp_analysis_acks_frame = -1;
 static int hf_tcp_analysis_ack_rtt = -1;
 static int hf_tcp_analysis_first_rtt = -1;
@@ -909,6 +910,10 @@ init_tcp_conversation_data(packet_info *pinfo)
     tcpd->ts_prev.nsecs=pinfo->abs_ts.nsecs;
     tcpd->flow1.valid_bif = 1;
     tcpd->flow2.valid_bif = 1;
+    tcpd->flow1.push_bytes_sent = 0;
+    tcpd->flow2.push_bytes_sent = 0;
+    tcpd->flow1.push_set_last = FALSE;
+    tcpd->flow2.push_set_last = FALSE;
     tcpd->stream = tcp_stream_count++;
     tcpd->server_port = 0;
 
@@ -1738,6 +1743,23 @@ finished_checking_retransmission_type:
             }
             tcpd->ta->bytes_in_flight = in_flight;
         }
+
+        if((flags & TH_PUSH) && !tcpd->fwd->push_set_last) {
+          tcpd->fwd->push_bytes_sent += seglen;
+          tcpd->fwd->push_set_last = TRUE;
+        } else if ((flags & TH_PUSH) && tcpd->fwd->push_set_last) {
+          tcpd->fwd->push_bytes_sent = seglen;
+          tcpd->fwd->push_set_last = TRUE;
+        } else if (tcpd->fwd->push_set_last) {
+          tcpd->fwd->push_bytes_sent = seglen;
+          tcpd->fwd->push_set_last = FALSE;
+        } else {
+          tcpd->fwd->push_bytes_sent += seglen;
+        }
+        if(!tcpd->ta) {
+          tcp_analyze_get_acked_struct(pinfo->fd->num, seq, ack, TRUE, tcpd);
+        }
+        tcpd->ta->push_bytes_sent = tcpd->fwd->push_bytes_sent;
     }
 
 }
@@ -2042,6 +2064,24 @@ mptcp_add_analysis_subtree(packet_info *pinfo, tvbuff_t *tvb, proto_tree *parent
 
 
 static void
+tcp_sequence_number_analysis_print_push_bytes_sent(packet_info * pinfo _U_,
+                          tvbuff_t * tvb _U_,
+                          proto_tree * flags_tree _U_,
+                          struct tcp_acked *ta
+                        )
+{
+    proto_item * flags_item;
+
+    if (tcp_track_bytes_in_flight) {
+        flags_item=proto_tree_add_uint(flags_tree,
+                                       hf_tcp_analysis_push_bytes_sent,
+                                       tvb, 0, 0, ta->push_bytes_sent);
+
+        PROTO_ITEM_SET_GENERATED(flags_item);
+    }
+}
+
+static void
 tcp_print_sequence_number_analysis(packet_info *pinfo, tvbuff_t *tvb, proto_tree *parent_tree,
                           struct tcp_analysis *tcpd, guint32 seq, guint32 ack)
 {
@@ -2088,6 +2128,7 @@ tcp_print_sequence_number_analysis(packet_info *pinfo, tvbuff_t *tvb, proto_tree
     if(ta->bytes_in_flight) {
         /* print results for amount of data in flight */
         tcp_sequence_number_analysis_print_bytes_in_flight(pinfo, tvb, tree, ta);
+        tcp_sequence_number_analysis_print_push_bytes_sent(pinfo, tvb, tree, ta);
     }
 
     if(ta->flags) {
@@ -5903,6 +5944,10 @@ proto_register_tcp(void)
           { "Bytes in flight",            "tcp.analysis.bytes_in_flight", FT_UINT32, BASE_DEC, NULL, 0x0,
             "How many bytes are now in flight for this connection", HFILL}},
 
+        { &hf_tcp_analysis_push_bytes_sent,
+          { "Bytes sent since last PSH flag",            "tcp.analysis.push_bytes_sent", FT_UINT32, BASE_DEC, NULL, 0x0,
+            "How many bytes have been sent since the last PSH flag", HFILL}},
+
         { &hf_tcp_analysis_ack_rtt,
           { "The RTT to ACK the segment was",            "tcp.analysis.ack_rtt", FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
             "How long time it took to ACK the segment (RTT)", HFILL}},
diff --git a/epan/dissectors/packet-tcp.h b/epan/dissectors/packet-tcp.h
index efc45bb23d..0fc768a8d6 100644
--- a/epan/dissectors/packet-tcp.h
+++ b/epan/dissectors/packet-tcp.h
@@ -160,6 +160,7 @@ struct tcp_acked {
 	guint32 dupack_num;	/* dup ack number */
 	guint32 dupack_frame;	/* dup ack to frame # */
 	guint32 bytes_in_flight; /* number of bytes in flight */
+	guint32 push_bytes_sent; /* bytes since the last PSH flag */
 };
 
 /* One instance of this structure is created for each pdu that spans across
@@ -261,6 +262,8 @@ typedef struct _tcp_flow_t {
 	gint16  scps_capable;   /* flow advertised scps capabilities */
 	guint16 maxsizeacked;   /* 0 if not yet known */
 	gboolean valid_bif;     /* if lost pkts, disable BiF until ACK is recvd */
+	guint32 push_bytes_sent; /* bytes since the last PSH flag */
+	gboolean push_set_last; /* tracking last time PSH flag was set */
 
 /* This tcp flow/session contains only one single PDU and should
  * be reassembled until the final FIN segment.