Separately count all records and data records.

A file might contain only metadata records, which exist only to provide
information needed to interpret data records; no point in showing them
in record counts.

Put the counts into the structure that we fill in, and rename the
structure and the routine to reflect that it determines statistics other
than just times.

Speak of data records rather than packets; the file might be full of
Sysdig event records but not have any packets in it, for example.

Change-Id: I8553181dca4129736bdae2c0cbba92becc28d6ef
Reviewed-on: https://code.wireshark.org/review/25722
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>

5 files changed, 142 insertions, 92 deletions

diff --git a/ui/file_dialog.c b/ui/file_dialog.c
index 754d4b6f5c..712a6734cc 100644
--- a/ui/file_dialog.c
+++ b/ui/file_dialog.c
@@ -21,22 +21,26 @@
 
 #include "ui/file_dialog.h"
 
-ws_file_preview_times_status
-get_times_for_preview(wtap *wth, ws_file_preview_times *times,
-                      guint32 *num_packets, int *err, gchar **err_info)
+ws_file_preview_stats_status
+get_stats_for_preview(wtap *wth, ws_file_preview_stats *stats,
+                      int *err, gchar **err_info)
 {
     gint64       data_offset;
     const wtap_rec *rec;
-    guint32      packets;
+    guint32      records;
+    guint32      data_records;
+    double       start_time;
+    double       stop_time;
     gboolean     have_times;
     gboolean     timed_out;
     time_t       time_preview, time_current;
     double       cur_time;
 
-    times->start_time = 0;
-    times->stop_time = 0;
-    packets = 0;
     have_times = FALSE;
+    start_time = 0;
+    stop_time = 0;
+    records = 0;
+    data_records = 0;
     timed_out = FALSE;
     time(&time_preview);
     while ((wtap_read(wth, err, err_info, &data_offset))) {
@@ -44,20 +48,30 @@ get_times_for_preview(wtap *wth, ws_file_preview_times *times,
         if (rec->presence_flags & WTAP_HAS_TS) {
             cur_time = nstime_to_sec(&rec->ts);
             if (!have_times) {
-                times->start_time = cur_time;
-                times->stop_time = cur_time;
+                start_time = cur_time;
+                stop_time = cur_time;
                 have_times = TRUE;
             }
-            if (cur_time < times->start_time) {
-                times->start_time = cur_time;
+            if (cur_time < start_time) {
+                start_time = cur_time;
             }
-            if (cur_time > times->stop_time){
-                times->stop_time = cur_time;
+            if (cur_time > stop_time){
+                stop_time = cur_time;
             }
         }
 
-        packets++;
-        if (packets%1000 == 0) {
+        switch (rec->rec_type) {
+
+        case REC_TYPE_PACKET:
+        case REC_TYPE_FT_SPECIFIC_EVENT:
+        case REC_TYPE_FT_SPECIFIC_REPORT:
+        case REC_TYPE_SYSCALL:
+            data_records++;
+            break;
+        }
+
+        records++;
+        if ((records % 1000) == 0) {
             /* do we have a timeout? */
             time(&time_current);
             if (time_current-time_preview >= (time_t) prefs.gui_fileopen_preview) {
@@ -66,19 +80,18 @@ get_times_for_preview(wtap *wth, ws_file_preview_times *times,
             }
         }
     }
-    *num_packets = packets;
+
+    stats->have_times = have_times;
+    stats->start_time = start_time;
+    stats->stop_time = stop_time;
+    stats->records = records;
+    stats->data_records = data_records;
+
     if (*err != 0) {
         /* Read error. */
         return PREVIEW_READ_ERROR;
     }
-
-    if (have_times) {
-        if (timed_out)
-            return PREVIEW_TIMED_OUT;
-        else
-            return PREVIEW_HAVE_TIMES;
-    } else
-        return PREVIEW_HAVE_NO_TIMES;
+    return timed_out ? PREVIEW_TIMED_OUT : PREVIEW_SUCCEEDED;
 }
 
 /*
diff --git a/ui/file_dialog.h b/ui/file_dialog.h
index 5cc455082d..b77213ec98 100644
--- a/ui/file_dialog.h
+++ b/ui/file_dialog.h
@@ -32,20 +32,22 @@ typedef enum {
 } export_type_e;
 
 typedef struct {
-    double start_time; /* seconds, with nsec resolution */
-    double stop_time;  /* seconds, with nsec resolution */
-} ws_file_preview_times;
+    gboolean have_times;  /* TRUE if we have start and stop times */
+    double start_time;    /* seconds, with nsec resolution */
+    double stop_time;     /* seconds, with nsec resolution */
+    guint32 records;      /* total number of records */
+    guint32 data_records; /* number of data records */
+} ws_file_preview_stats;
 
 typedef enum {
-    PREVIEW_HAVE_TIMES,
-    PREVIEW_HAVE_NO_TIMES,
+    PREVIEW_SUCCEEDED,
     PREVIEW_TIMED_OUT,
     PREVIEW_READ_ERROR
-} ws_file_preview_times_status;
+} ws_file_preview_stats_status;
 
-extern ws_file_preview_times_status
-get_times_for_preview(wtap *wth, ws_file_preview_times *times,
-                      guint32 *num_packets, int *err, gchar **err_info);
+extern ws_file_preview_stats_status
+get_stats_for_preview(wtap *wth, ws_file_preview_stats *stats,
+                      int *err, gchar **err_info);
 
 #ifdef __cplusplus
 }
diff --git a/ui/gtk/capture_file_dlg.c b/ui/gtk/capture_file_dlg.c
index d83ca35cde..bae633e28e 100644
--- a/ui/gtk/capture_file_dlg.c
+++ b/ui/gtk/capture_file_dlg.c
@@ -87,7 +87,7 @@ static gboolean test_file_close(capture_file *cf, gboolean from_quit,
 #define PREVIEW_TABLE_KEY         "preview_table_key"
 #define PREVIEW_FORMAT_KEY        "preview_format_key"
 #define PREVIEW_SIZE_KEY          "preview_size_key"
-#define PREVIEW_PACKETS_KEY       "preview_packets_key"
+#define PREVIEW_DATA_RECORDS_KEY  "preview_data_records_key"
 #define PREVIEW_FIRST_ELAPSED_KEY "preview_first_elapsed_key"
 
 /* XXX - can we make these not be static? */
@@ -113,7 +113,7 @@ preview_set_filename(GtkWidget *prev, const gchar *cf_name)
   gtk_label_set_text(GTK_LABEL(label), "-");
   label = (GtkWidget *)g_object_get_data(G_OBJECT(prev), PREVIEW_SIZE_KEY);
   gtk_label_set_text(GTK_LABEL(label), "-");
-  label = (GtkWidget *)g_object_get_data(G_OBJECT(prev), PREVIEW_PACKETS_KEY);
+  label = (GtkWidget *)g_object_get_data(G_OBJECT(prev), PREVIEW_DATA_RECORDS_KEY);
   gtk_label_set_text(GTK_LABEL(label), "-");
   label = (GtkWidget *)g_object_get_data(G_OBJECT(prev), PREVIEW_FIRST_ELAPSED_KEY);
   gtk_label_set_text(GTK_LABEL(label), "-");
@@ -166,22 +166,21 @@ preview_do(GtkWidget *prev, wtap *wth)
   GtkWidget    *label;
   int           err;
   gchar        *err_info;
-  guint32       packets;
-  ws_file_preview_times times;
-  ws_file_preview_times_status status;
+  ws_file_preview_stats stats;
+  ws_file_preview_stats_status status;
   gchar         string_buff[PREVIEW_STR_MAX];
   gchar         first_buff[PREVIEW_STR_MAX];
   time_t        ti_time;
   struct tm    *ti_tm;
   unsigned int  elapsed_time;
 
-  status = get_times_for_preview(wth, &times, &packets, &err, &err_info);
+  status = get_stats_for_preview(wth, &stats, &err, &err_info);
 
   if(status == PREVIEW_READ_ERROR) {
     /* XXX - give error details? */
     g_free(err_info);
-    g_snprintf(string_buff, PREVIEW_STR_MAX, "error after reading %u packets", packets);
-    label = (GtkWidget *)g_object_get_data(G_OBJECT(prev), PREVIEW_PACKETS_KEY);
+    g_snprintf(string_buff, PREVIEW_STR_MAX, "error after reading %u records", stats.records);
+    label = (GtkWidget *)g_object_get_data(G_OBJECT(prev), PREVIEW_DATA_RECORDS_KEY);
     gtk_label_set_text(GTK_LABEL(label), string_buff);
     wtap_close(wth);
     return;
@@ -189,18 +188,22 @@ preview_do(GtkWidget *prev, wtap *wth)
 
   /* packet count */
   if(status == PREVIEW_TIMED_OUT) {
-    g_snprintf(string_buff, PREVIEW_STR_MAX, "more than %u packets (preview timeout)", packets);
+    g_snprintf(string_buff, PREVIEW_STR_MAX, "more than %u data records (preview timeout)", stats.data_records);
   } else {
-    g_snprintf(string_buff, PREVIEW_STR_MAX, "%u", packets);
+    g_snprintf(string_buff, PREVIEW_STR_MAX, "%u", stats.data_records);
   }
-  label = (GtkWidget *)g_object_get_data(G_OBJECT(prev), PREVIEW_PACKETS_KEY);
+  label = (GtkWidget *)g_object_get_data(G_OBJECT(prev), PREVIEW_DATA_RECORDS_KEY);
   gtk_label_set_text(GTK_LABEL(label), string_buff);
 
   /* First packet */
-  if(status == PREVIEW_HAVE_NO_TIMES) {
-    g_snprintf(first_buff, PREVIEW_STR_MAX, "unknown");
-  } else {
-    ti_time = (long)times.start_time;
+  if(stats.have_times) {
+    /*
+     * We saw at least one record with a time stamp, so we can give
+     * a start time (if we have a mix of records with and without
+     * time stamps, and there were records without time stamps
+     * before the one with a time stamp, this may be inaccurate).
+     */
+    ti_time = (long)stats.start_time;
     ti_tm = localtime( &ti_time );
     if (ti_tm) {
       g_snprintf(first_buff, PREVIEW_STR_MAX,
@@ -214,22 +217,30 @@ preview_do(GtkWidget *prev, wtap *wth)
     } else {
       g_snprintf(first_buff, PREVIEW_STR_MAX, "?");
     }
+  } else {
+    g_snprintf(first_buff, PREVIEW_STR_MAX, "unknown");
   }
 
   /* Elapsed time */
-  if(status == PREVIEW_HAVE_NO_TIMES) {
-    g_snprintf(string_buff, PREVIEW_STR_MAX, "%s / unknown", first_buff);
-  } else {
-    elapsed_time = (unsigned int)(times.stop_time-times.start_time);
-    if(status == PREVIEW_TIMED_OUT) {
-      g_snprintf(string_buff, PREVIEW_STR_MAX, "%s / unknown", first_buff);
-    } else if (elapsed_time/86400) {
+  if(status == PREVIEW_SUCCEEDED && stats.have_times) {
+    /*
+     * We didn't time out, so we looked at all packets, and we got
+     * at least one packet with a time stamp, so we can calculate
+     * an elapsed time from the time stamp of the last packet with
+     * with a time stamp (if we have a mix of records with and without
+     * time stamps, and there were records without time stamps after
+     * the last one with a time stamp, this may be inaccurate).
+     */
+    elapsed_time = (unsigned int)(stats.stop_time-stats.start_time);
+    if (elapsed_time/86400) {
       g_snprintf(string_buff, PREVIEW_STR_MAX, "%s / %02u days %02u:%02u:%02u",
                  first_buff, elapsed_time/86400, elapsed_time%86400/3600, elapsed_time%3600/60, elapsed_time%60);
     } else {
       g_snprintf(string_buff, PREVIEW_STR_MAX, "%s / %02u:%02u:%02u",
                  first_buff, elapsed_time%86400/3600, elapsed_time%3600/60, elapsed_time%60);
     }
+  } else {
+    g_snprintf(string_buff, PREVIEW_STR_MAX, "%s / unknown", first_buff);
   }
   label = (GtkWidget *)g_object_get_data(G_OBJECT(prev), PREVIEW_FIRST_ELAPSED_KEY);
   gtk_label_set_text(GTK_LABEL(label), string_buff);
@@ -365,7 +376,7 @@ preview_new(void)
   label = add_string_to_grid(grid, &row, "Size:", "-");
   g_object_set_data(G_OBJECT(grid), PREVIEW_SIZE_KEY, label);
   label = add_string_to_grid(grid, &row, "Packets:", "-");
-  g_object_set_data(G_OBJECT(grid), PREVIEW_PACKETS_KEY, label);
+  g_object_set_data(G_OBJECT(grid), PREVIEW_DATA_RECORDS_KEY, label);
   label = add_string_to_grid(grid, &row, "Start / elapsed:", "-");
   g_object_set_data(G_OBJECT(grid), PREVIEW_FIRST_ELAPSED_KEY, label);
 
diff --git a/ui/qt/capture_file_dialog.cpp b/ui/qt/capture_file_dialog.cpp
index e114fb2dd2..99d9bf23fb 100644
--- a/ui/qt/capture_file_dialog.cpp
+++ b/ui/qt/capture_file_dialog.cpp
@@ -689,9 +689,8 @@ void CaptureFileDialog::preview(const QString & path)
     wtap        *wth;
     int          err;
     gchar       *err_info;
-    ws_file_preview_times times;
-    ws_file_preview_times_status status;
-    guint32      packets;
+    ws_file_preview_stats stats;
+    ws_file_preview_stats_status status;
     time_t       ti_time;
     struct tm   *ti_tm;
     unsigned int elapsed_time;
@@ -736,31 +735,35 @@ void CaptureFileDialog::preview(const QString & path)
     // Finder and Windows Explorer use IEC. What do the various Linux file managers use?
     QString size_str(gchar_free_to_qstring(format_size(filesize, format_size_unit_bytes|format_size_prefix_iec)));
 
-    status = get_times_for_preview(wth, &times, &packets, &err, &err_info);
+    status = get_stats_for_preview(wth, &stats, &err, &err_info);
 
     if(status == PREVIEW_READ_ERROR) {
         // XXX - give error details?
         g_free(err_info);
-        preview_size_.setText(tr("%1, error after %Ln packet(s)", "", packets)
+        preview_size_.setText(tr("%1, error after %Ln record(s)", "", stats.records)
                               .arg(size_str));
         return;
     }
 
     // Packet count
     if(status == PREVIEW_TIMED_OUT) {
-        preview_size_.setText(tr("%1, timed out at %Ln packet(s)", "", packets)
+        preview_size_.setText(tr("%1, timed out at %Ln data record(s)", "", stats.data_records)
                               .arg(size_str));
     } else {
-        preview_size_.setText(tr("%1, %Ln packet(s)", "", packets)
+        preview_size_.setText(tr("%1, %Ln data record(s)", "", stats.data_records)
                               .arg(size_str));
     }
 
     // First packet + elapsed time
     QString first_elapsed;
-    if(status == PREVIEW_HAVE_NO_TIMES) {
-        first_elapsed = tr("unknown");
-    } else {
-        ti_time = (long)times.start_time;
+    if(stats.have_times) {
+        //
+        // We saw at least one record with a time stamp, so we can give
+        // a start time (if we have a mix of records with and without
+        // time stamps, and there were records without time stamps
+        // before the first one with a time stamp, this may be inaccurate).
+        //
+        ti_time = (long)stats.start_time;
         ti_tm = localtime(&ti_time);
         first_elapsed = "?";
         if(ti_tm) {
@@ -774,23 +777,31 @@ void CaptureFileDialog::preview(const QString & path)
                      ti_tm->tm_sec
                      );
         }
+    } else {
+        first_elapsed = tr("unknown");
     }
 
     // Elapsed time
     first_elapsed += " / ";
-    if(status == PREVIEW_HAVE_NO_TIMES) {
-        first_elapsed += tr("unknown");
-    } else {
-        elapsed_time = (unsigned int)(times.stop_time-times.start_time);
-        if(status == PREVIEW_TIMED_OUT) {
-            first_elapsed += tr("unknown");
-        } else if(elapsed_time/86400) {
+    if(status == PREVIEW_SUCCEEDED && stats.have_times) {
+        //
+        // We didn't time out, so we looked at all packets, and we got
+        // at least one packet with a time stamp, so we can calculate
+        // an elapsed time from the time stamp of the last packet with
+        // with a time stamp (if we have a mix of records with and without
+        // time stamps, and there were records without time stamps after
+        // the last one with a time stamp, this may be inaccurate).
+        //
+        elapsed_time = (unsigned int)(stats.stop_time-stats.start_time);
+        if(elapsed_time/86400) {
             first_elapsed += QString().sprintf("%02u days %02u:%02u:%02u",
                     elapsed_time/86400, elapsed_time%86400/3600, elapsed_time%3600/60, elapsed_time%60);
         } else {
             first_elapsed += QString().sprintf("%02u:%02u:%02u",
                     elapsed_time%86400/3600, elapsed_time%3600/60, elapsed_time%60);
         }
+    } else {
+        first_elapsed += tr("unknown");
     }
     preview_first_elapsed_.setText(first_elapsed);
 
diff --git a/ui/win32/file_dlg_win32.c b/ui/win32/file_dlg_win32.c
index 0145dc7ba7..c7089c8051 100644
--- a/ui/win32/file_dlg_win32.c
+++ b/ui/win32/file_dlg_win32.c
@@ -1113,9 +1113,8 @@ preview_set_file_info(HWND of_hwnd, gchar *preview_file) {
     wtap       *wth;
     int         err;
     gchar      *err_info;
-    guint32     packets;
-    ws_file_preview_times times;
-    ws_file_preview_times_status status;
+    ws_file_preview_stats stats;
+    ws_file_preview_stats_status status;
     TCHAR       string_buff[PREVIEW_STR_MAX];
     TCHAR       first_buff[PREVIEW_STR_MAX];
     gint64      filesize;
@@ -1176,13 +1175,13 @@ preview_set_file_info(HWND of_hwnd, gchar *preview_file) {
     // Windows Explorer uses IEC.
     size_str = format_size(filesize, format_size_unit_bytes|format_size_prefix_iec);
 
-    status = get_times_for_preview(wth, &times, &packets, &err, &err_info);
+    status = get_stats_for_preview(wth, &stats, &err, &err_info);
 
     if(status == PREVIEW_READ_ERROR) {
         /* XXX - give error details? */
         g_free(err_info);
-        utf_8to16_snprintf(string_buff, PREVIEW_STR_MAX, "%s, error after %u packets",
-            size_str, packets);
+        utf_8to16_snprintf(string_buff, PREVIEW_STR_MAX, "%s, error after %u records",
+            size_str, stats.records);
         g_free(size_str);
         cur_ctrl = GetDlgItem(of_hwnd, EWFD_PTX_SIZE);
         SetWindowText(cur_ctrl, string_buff);
@@ -1192,21 +1191,25 @@ preview_set_file_info(HWND of_hwnd, gchar *preview_file) {
 
     /* Packet count */
     if(status == PREVIEW_TIMED_OUT) {
-        utf_8to16_snprintf(string_buff, PREVIEW_STR_MAX, "%s, timed out at %u packets",
-            size_str, packets);
+        utf_8to16_snprintf(string_buff, PREVIEW_STR_MAX, "%s, timed out at %u data records",
+            size_str, stats.data_records);
     } else {
-        utf_8to16_snprintf(string_buff, PREVIEW_STR_MAX, "%s, %u packets",
-            size_str, packets);
+        utf_8to16_snprintf(string_buff, PREVIEW_STR_MAX, "%s, %u data records",
+            size_str, stats.data_records);
     }
     g_free(size_str);
     cur_ctrl = GetDlgItem(of_hwnd, EWFD_PTX_SIZE);
     SetWindowText(cur_ctrl, string_buff);
 
     /* First packet / elapsed time */
-    if(status == PREVIEW_HAVE_NO_TIMES) {
-        StringCchPrintf(first_buff, PREVIEW_STR_MAX, _T("unknown"));
-    } else {
-        ti_time = (long)times.start_time;
+    if(stats.have_times) {
+        /*
+         * We saw at least one record with a time stamp, so we can give
+         * a start time (if we have a mix of records with and without
+         * time stamps, and there were records without time stamps
+         * before the one with a time stamp, this may be inaccurate).
+         */
+        ti_time = (long)stats.start_time;
         ti_tm = localtime( &ti_time );
         if(ti_tm) {
             StringCchPrintf(first_buff, PREVIEW_STR_MAX,
@@ -1220,13 +1223,21 @@ preview_set_file_info(HWND of_hwnd, gchar *preview_file) {
         } else {
             StringCchPrintf(first_buff, PREVIEW_STR_MAX, _T("?"));
         }
+    } else {
+        StringCchPrintf(first_buff, PREVIEW_STR_MAX, _T("unknown"));
     }
 
     /* Elapsed time */
-    if(status == PREVIEW_HAVE_NO_TIMES) {
-        StringCchPrintf(string_buff, PREVIEW_STR_MAX, _T("%s / unknown"));
-    } else {
-        elapsed_time = (unsigned int)(times.stop_time-times.start_time);
+    if(status == PREVIEW_SUCCEEDED && stats.have_times) {
+        /*
+         * We didn't time out, so we looked at all packets, and we got
+         * at least one packet with a time stamp, so we can calculate
+         * an elapsed time from the time stamp of the last packet with
+         * with a time stamp (if we have a mix of records with and without
+         * time stamps, and there were records without time stamps after
+         * the last one with a time stamp, this may be inaccurate).
+         */
+        elapsed_time = (unsigned int)(stats.stop_time-stats.start_time);
         if(status == PREVIEW_TIMED_OUT) {
             StringCchPrintf(string_buff, PREVIEW_STR_MAX, _T("%s / unknown"), first_buff);
         } else if(elapsed_time/86400) {
@@ -1236,6 +1247,8 @@ preview_set_file_info(HWND of_hwnd, gchar *preview_file) {
             StringCchPrintf(string_buff, PREVIEW_STR_MAX, _T("%s / %02u:%02u:%02u"),
                 first_buff, elapsed_time%86400/3600, elapsed_time%3600/60, elapsed_time%60);
         }
+    } else {
+        StringCchPrintf(string_buff, PREVIEW_STR_MAX, _T("%s / unknown"));
     }
     cur_ctrl = GetDlgItem(of_hwnd, EWFD_PTX_START_ELAPSED);
     SetWindowText(cur_ctrl, string_buff);