aboutsummaryrefslogtreecommitdiffstats
path: root/epan/dissectors/packet-frame.c
AgeCommit message (Collapse)AuthorFilesLines
2011-10-04Use ENC_NA as encoding for proto_tree_add_item() calls which directly ↵Bill Meier1-1/+1
reference an hf item (in hf[] with types: FT_NONE FT_BYTES FT_IPV6 FT_IPXNET FT_OID Note: Encoding field set to ENC_NA only if the field was previously TRUE|FALSE|ENC_LITTLE_ENDIAN|ENC_BIG_ENDIAN svn path=/trunk/; revision=39260
2011-08-13From Edwin Groothuis via bug 6179:Stig Bjørlykke1-0/+8
Added Time Shift functionality. From me: Renamed to use "Time Shift" everywhere + some other minor cleanups. svn path=/trunk/; revision=38510
2011-08-08Remove unneeded #includes: proto.h,tvbuff.h,value_string.h,stdlib.h,...Bill Meier1-1/+0
svn path=/trunk/; revision=38413
2011-04-23Use orginal nsstime_t structures (without copying).Jakub Zawadzki1-16/+7
svn path=/trunk/; revision=36829
2011-04-15From Edwin Groothuis via bug #5833: Make number of bits in Frame headerStephen Fisher1-4/+14
optional svn path=/trunk/; revision=36652
2011-02-12The lack of _WITH_PHDR in WTAP_ENCAP_BLUETOOTH_H4 means there's noGuy Harris1-1/+0
pseudo-header, and hence there's no direction indication. Don't set pinfo->p2p_dir for it. Use WTAP_ENCAP_BLUETOOTH_H4_WITH_PHDR, not WTAP_ENCAP_BLUETOOTH_H4, for capture files where we have the direction. Don't assume pinfo->p2p_dir is either P2P_DIR_SENT or P2P_DIR_RECV when setting the info column in various Bluetooth dissectors; it might be unknown. In the HCI H4 dissector, put the direction into the info column regardless of whether we have a type match or not; the dissectors for HCI packet types appear to assume it's been set (as they put a blank at the beginning of the stuff they append to the direction). svn path=/trunk/; revision=35933
2010-12-20Rename the routines that handle dissector tables with unsigned integerGuy Harris1-1/+1
keys to have _uint in their names, to match the routines that handle dissector tables with string keys. (Using _port can confuse people into thinking they're intended solely for use with TCP/UDP/etc. ports when, in fact, they work better for things such as Ethernet types, where the binding of particular values to particular protocols are a lot stronger.) svn path=/trunk/; revision=35224
2010-06-09Do some constifying [or other] based upon gcc -Wwrite-strings warnings.Bill Meier1-1/+1
svn path=/trunk/; revision=33198
2010-01-08Changes to use consistent indentation.Bill Meier1-206/+206
svn path=/trunk/; revision=31470
2009-12-19Oops, back out my little test change.Guy Harris1-4/+0
svn path=/trunk/; revision=31320
2009-12-19For fields of type FT_ABSOLUTE_TIME, have the "display" value be one ofGuy Harris1-1/+5
ABSOLUTE_TIME_LOCAL or ABSOLUTE_TIME_UTC, indicating whether to display the date/time in local time or UTC. (int)ABSOLUTE_TIME_LOCAL == (int)BASE_NONE, so there's no source or binary compatiblity issue, although we might want to eliminate BASE_NONE at some point and have the BASE_ values used with integral types start at 0, so that you can't specify BASE_NONE for an integral field. svn path=/trunk/; revision=31319
2009-12-17Introduce "Ignore Packet" in the packet list.Stig Bjørlykke1-0/+15
This will remove the package from the dissection functions without removing it from the capture file. svn path=/trunk/; revision=31287
2009-11-29From enhancement bug #4272: Patch to add new filterable field -Stephen Fisher1-0/+15
frame.time_epoch svn path=/trunk/; revision=31110
2009-11-25Show the number of bits captured and on the wire. Use unsigned ints.Gerald Combs1-6/+12
svn path=/trunk/; revision=31074
2009-09-21Store 'color_filter' as const in 'frame_data'Kovarththanan Rajaratnam1-1/+1
svn path=/trunk/; revision=30051
2009-09-07Store the packet encapsulation type as gint8. Saves 3 bytes per packetKovarththanan Rajaratnam1-1/+1
svn path=/trunk/; revision=29767
2009-09-06We track all protocols that appear in each packet in the frame dissector. ↵Kovarththanan Rajaratnam1-12/+16
This is an expensive operation because we: * Disable the TRY_TO_FAKE_THIS_ITEM optimization * Use GString to store the protocols We should only do this if the 'hf_frame_protocols' is referenced (unlikely) svn path=/trunk/; revision=29733
2009-09-06The frame dissector disables the TRY_TO_FAKE_THIS_ITEM() optimization by ↵Kovarththanan Rajaratnam1-5/+6
marking the protocol tree as permamently visible. It only needs to disable the optimization temporarily while it creates the protocol item it intends to use proto_item_append_string() on svn path=/trunk/; revision=29730
2009-08-15The frame dissector contains a kludge to workaround the fact that the ↵Kovarththanan Rajaratnam1-20/+12
Protocol Hierarchy stats tap always needs the protocol node to appear even though no color, display filter etc. reference it. This is no longer needed due to r29380. svn path=/trunk/; revision=29428
2009-08-03(Trivial) Fix two typos.Bill Meier1-1/+1
svn path=/trunk/; revision=29271
2009-07-22Get rid of check_col() in some of the more frequently used dissectors.Anders Broman1-19/+12
svn path=/trunk/; revision=29170
2009-06-18From Kovarththanan Rajaratnam via bug 3548:Stig Bjørlykke1-6/+6
(1) Trailing/leading spaces are removed from 'name's/'blurb's (2) Duplicate 'blurb's are replaced with NULL (3) Empty ("") 'blurb's are replaced with NULL (4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME, FT_PROTOCOL, FT_STRING and FT_STRINGZ field types (5) Only allow non-zero value for 'display' if 'bitmask' is non-zero svn path=/trunk/; revision=28770
2009-02-16Add support for reading Apple's Bluetooth PacketLogger capture files toStephen Fisher1-4/+4
wiretap. Modify various other locations to accommodate the fact that PacketLogger files do not specify the direction of packets. svn path=/trunk/; revision=27463
2009-01-29Group time related fields.Jaap Keuter1-51/+40
Drop packet length in favor of frame length. Clean up code / indentations / header fields. Improve docsis preference description. svn path=/trunk/; revision=27329
2009-01-29Add initializer for force_docsis_encap preference.Jaap Keuter1-1/+1
svn path=/trunk/; revision=27328
2009-01-07From Duncan Salerno:Jaap Keuter1-0/+5
Added LAPDm protocol dissector, GSM Um layer, and wiretap support for dct3trace captures, generated by gammu (many available at http://wiki.thc.org/gsm). svn path=/trunk/; revision=27176
2009-01-04From Jim Young:Jaap Keuter1-0/+28
The attached patch augments the epan/dissectors/packet-frame.c module to optionally generate MD5 hashes of each packet. These MD5 hashes are calculated in the same manner as the MD5 hash used for duplicate packet removal by the editcap utility. The ability to generate the MD5 hashes can be enabled or disabled by a new boolean preferences option: frame.generate_md5_hash. By default MD5 hash generation is disabled. To help identify frames with matching MD5 hashes this patch also includes a new display filter: frame.md5_hash. svn path=/trunk/; revision=27150
2008-12-18Fix various typos and spelling errors (mostly in text strings)Bill Meier1-3/+3
svn path=/trunk/; revision=27050
2008-10-24Windows build: #include winsock2.h only when needed.Bill Meier1-0/+5
#include winsock2.h pulls in about 90 distinct .h files and about 140 total .h files. Currently winsock2.h is (mostly unnecessarily) included for each dissector via packet.h/wtap.h. This patch removes #include winsock2.h from wtap.h and then includes winsock2.h (or windows.h) in the few specific places required. With this patch, my Windows Wireshark build takes about 30% less time. svn path=/trunk/; revision=26535
2008-05-21Fix http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2549 : make the frame ↵Jeff Morriss1-1/+43
dissector catch exceptions generated by post dissectors. svn path=/trunk/; revision=25339
2008-02-03From Shane Kearns (bug 2237):Stig Bjørlykke1-0/+5
Added support for Symbian OS btsnoop. The bluetooth HCI layer in Symbian OS can be configured to log all packets to a file. The log format, "btsnoop" is based on the RFC1761 "snoop" format - but differences in the header make it incompatible. The btsnoop format supports logging of these formats: "H1" (raw HCI packets without framing) "H4" (HCI UART packets including packet type header) "H5" (HCI 3 wire UART packets including framing) "BCSP" (HCI bluecore serial protocol including framing) "H1" and "H4" are section numbers in the original v1 bluetooth specifications, but still used colloquially - wireshark's existing support for Linux bluez HCI logs uses the "H4" name. In practice, the "H1" format is used for H5,BCSP and USB HCI logs, as the HCI packet logs are mainly useful for debugging higher layers, bluetooth profiles and bluetooth applications. From me: Deleted some unused prototypes. Mark an unused parameter. svn path=/trunk/; revision=24263
2007-12-23Use proto functions i.s.o. manipulating node data directly.Jaap Keuter1-1/+1
svn path=/trunk/; revision=23940
2007-11-16When reassembly is off, catch ReportedBoundsError when calling a subdissectorJeff Morriss1-1/+1
on the first fragment of a fragmented message. This allows us to continue dissecting chunks even if one of the first chunks in the frame was fragmented. (It's useful to keep doing this partial dissection just so we have some idea what's in that chunk.) (One could rightfully argue that you should only see a fragmented chunk bundled with another chunk when retransmitting but, well, I'm staring at traces of an implementation--to remain nameless to protect the guilty--which is sometimes fragmenting and then bundling the fragments into one packet.) svn path=/trunk/; revision=23471
2007-10-16From Paolo Abeni via bug 1751:Jeff Morriss1-0/+1
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1751 The patch adds support to wiretap for a new libpcap DLT for bluetooth captures. This DLT carries the direction information, which now can be displayed correctly. The hci H4 dissector is updated to handle also the newly introduced wtap encap. svn path=/trunk/; revision=23208
2007-06-13Add support for PPI (the Per-Packet Information header), described atGerald Combs1-1/+1
http://www.cacetech.com/documents/PPI_Header_format_1.0.pdf . svn path=/trunk/; revision=22094
2007-06-08From Stephen Donnelly of Endace:Guy Harris1-2/+1
The code for reading ERF files has not been significantly updated since 2004. This patch brings it up to date with a number of changes. 1) Increase number of decodable ERF types from 7 to 12. This covers newer DAG card models and firmware updates. 2) Fix timestamp conversion. Was calculating only microsecond precision, now displaying with nanosecond resolution. Hardware precision is 7.5 to 30 ns depending on model. 3) Allow the user to specify HDLC encapsulation as 'chdlc', 'ppp_serial', 'frelay' or 'mtp2'. This is needed because the ERF HDLC capture formats do not include information on what protocol is used at the next level. This is currently done via an environment variable 'ERF_HDLC_ENCAP' and is analagous to the existing 'ERF_ATM_ENCAP' variable. If the user does not specify an HDLC encapsulation it tries to guess, and falls back to MTP2 for backwards compatibility with Florent's existing behaviour. I know environment variables are ugly, suggestions are welcome. 4) When reading HDLC captures as MTP2, use WTAP_ENCAP_MTP2_WITH_PHDR rather than WTAP_ENCAP_MTP2. This allows us to put the 'Multi-Channel ERF' record 'channel number' field into the MTP2 pseudo header > 'link_number' field. This is then displayed in Frame information, and can be filtered on. (Would be nice if it could be made a display column?) Because the ERF record does not specify whether Annex A is used or not, we pass MTP2_ANNEX_A_USED_UNKNOWN and allow the existing user preference to decide. Move the MTP2_ANNEX_A_ definitions into Wiretap, make the annex_a_used field a guint8, and change MTP2_ANNEX_A_USED_UNKNOWN to 2 so it fits in a guint8. (This means that if you can save an ERF MTP2 file as a libpcap file, the pseudo-header will have MTP2_ANNEX_A_USED_UNKNOWN in it.) svn path=/trunk/; revision=22067
2007-05-29Use G_GINT64_MODIFIER, rather than the PRI[douxX]64 macros, for GLibGuy Harris1-1/+1
routines and routines using those routines. GLib might use different modifiers for 64-bit quantities than the platform's C library does. svn path=/trunk/; revision=21990
2007-05-12From bug 1492: Fortify layer name presentation.Jaap Keuter1-5/+5
Some code cleanups. svn path=/trunk/; revision=21752
2007-04-17Fix warnings of the form "long long unsigned int format, guint64 arg": useJeff Morriss1-1/+1
the PRI macros instead of %llu, etc. svn path=/trunk/; revision=21454
2007-04-16Frame numbers are unsigned, print them as suchJeff Morriss1-1/+1
svn path=/trunk/; revision=21443
2007-03-27Fix about 100 simple to fix warnings from gcc 4.0 in epan/dissectors Stephen Fisher1-1/+1
svn path=/trunk/; revision=21233
2007-03-23From Sake Blok:Stephen Fisher1-2/+14
Fix for bug #491: Unexpected frame.time_delta behavior This patch ... fixes bug 491. It does this by changing the behaviour of the frame.time_delta field so it reflects the delta time between captured packets (tshark already did this). To keep the delta time between displayed packets, the field frame.time_delta_displayed is created. svn path=/trunk/; revision=21154
2007-02-20Clarify the description of frame.time_delta. This partially addressesGerald Combs1-10/+10
bug 491. svn path=/trunk/; revision=20870
2007-02-10add STATUS_STACK_OVERFLOW to the possible Win32 exception codes - ↵Ulf Lamping1-1/+6
unfortunately, this exception seems to corrupt the stack at least in a way that the TRY / CATCH pair later causes an access violation ... svn path=/trunk/; revision=20764
2007-01-21Change frame dissector to show "frame" instead of "packet" for all fieldsStephen Fisher1-8/+20
for consistency. The frame.pkt_len filter is now deprecated, but still supported as a hidden field for an easy transition. The new field name is frame.len. svn path=/trunk/; revision=20519
2007-01-15instead of simply doing an assert when running out of memory in emem, throw ↵Ulf Lamping1-0/+3
a new OutOfMemoryError Exception, so file.c can show at least a better explanation to the user before Wireshark terminates XXX - to prevent a busy wait, I need a portable way to wait for a short time period, like Sleep() for Windows svn path=/trunk/; revision=20437
2006-11-05change all file offsets from long to gint64 so we can - theoretically - ↵Ulf Lamping1-3/+3
handle files > 2GB correct. Please distclean Win32 builds! svn path=/trunk/; revision=19814
2006-06-12I couldn't find the filter string to show only the marked frames until I had ↵Ulf Lamping1-8/+10
a look at the source code (the corresponding field was hidden) -> that's not very intuitive. So make the field "frame.marked" visible and tag it as generated. Move both "time reference" and "marked frame" fields towards the end of the "frame" protocol fields. Should be copied over to trunk-1.0 svn path=/trunk/; revision=18435
2006-05-21change a whole bunch of ethereal into wiresharkRonnie Sahlberg1-3/+3
svn path=/trunk/; revision=18196
2006-04-16The code to read hcidump files sets the p2p pseudo-header forGuy Harris1-0/+1
WTAP_ENCAP_BLUETOOTH_H4. svn path=/trunk/; revision=17874
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-01 01:17:54 +0000