aboutsummaryrefslogtreecommitdiffstats
path: root/epan/frame_data.h
AgeCommit message (Collapse)AuthorFilesLines
2012-02-28Fix https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3315 -Jeff Morriss1-0/+1
make Save-As/Displayed/All-Packets save not only the displayed packets but also any other packets needed (e.g., for reassembly) to fully dissect the displayed packets. This works only for the "All packets" case; choosing only the Selected packet, the Marked packets, or a range of packets would require actually storing which packets depend on which (too much memory) or going through the packet list many times (too slow). Also, this behavior is always the case: you can't save the displayed packets without their dependencies (I don't see why this would be desirable). So far this is done for SCTP and things using the reassembly routines (TCP has been tested). The Win32 dialog was modified but hasn't been tested yet. One confusing aspect of the UI is that the Displayed count in the Save-As dialog does not match the number of displayed packets. (I tried renaming the button "Displayed + Dependencies" but it looked too big.) The tooltip tries to explain this and the fact that this works only in the All-Packets case; suggestions for improvement are welcome. Implementation details: Dissectors (or the reassembly code) can list frames which were needed to build the current frame's tree. If the current frame passes the display filter then each listed frame is marked as "depended upon" (this takes up the last free frame_data flag). When performing a Save-As/Displayed/All-Packets then choose packets which passed the dfilter _or_ are depended upon. svn path=/trunk/; revision=41216
2012-02-25Add a presence flag field to the packet information structure filled inGuy Harris1-0/+2
by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2012-02-11Add the abillity to read and write option comments unedited.Anders Broman1-14/+16
This is POC we may want to have more efficient use of the frame data structure etc. But this allows for work to be done on the GUI to actually add comments. svn path=/trunk/; revision=40969
2011-08-13From Edwin Groothuis via bug 6179:Stig Bjørlykke1-0/+1
Added Time Shift functionality. From me: Renamed to use "Time Shift" everywhere + some other minor cleanups. svn path=/trunk/; revision=38510
2011-05-12Packet editor: support for saving changed frames.Jakub Zawadzki1-0/+8
svn path=/trunk/; revision=37099
2011-05-03TShark doesn't need column text attached to each frame; move col_textGuy Harris1-3/+0
and col_text_len from the frame_data structure to the PacketRecord structure. svn path=/trunk/; revision=36967
2011-04-25Store the frame_data structures in a tree, rather than a linked list. Guy Harris1-2/+0
This lets us get rid of the per-frame_data-structure prev and next pointers, saving memory (at least according to Activity Monitor's report of the virtual address space size on my Snow Leopard machine, it's a noticeable saving), and lets us look up frame_data structures by frame number in O(log2(number of frames)) time rather than O(number of frames) time. It seems to take more CPU time when reading in the file, but seems to go from "finished reading in all the packets" to "displaying the packets" faster and seems to free up the frame_data structures faster when closing the file. It *is* doing more copying, currently, as we now don't allocate the frame_data structure until after the packet has passed the read filter, so that might account for the additional CPU time. (Oh, and, for what it's worth, on an LP64 platform, a frame_data structure is exactly 128 bytes long. However, there's more stuff to remove, so the power-of-2 size is not guaranteed to remain, and it's not a power-of-2 size on an ILP32 platform.) It also means we don't need GLib 2.10 or later for the two-pass mode in TShark. It also means some code in the TCP dissector that was checking pinfo->fd->next to see if it's NULL, in order to see if this is the last packet in the file, no longer works, but that wasn't guaranteed to work anyway: we might be doing a one-pass read through the capture in TShark; we might be dissecting the frame while we're reading in the packets for the first time in Wireshark; we might be doing a live capture in Wireshark; in which case packets might be prematurely considered "the last packet". #if 0 the no-longer-working tests, pending figuring out a better way of doing it. svn path=/trunk/; revision=36849
2011-03-08Removal of the old packet-list in favor of the new packet list.Sake Blok1-2/+0
It compiles with "./configure without options" on my Mac. Let's see what the buildbots have to say about it :-) svn path=/trunk/; revision=36161
2010-08-29Doxygen changes.Anders Broman1-24/+24
svn path=/trunk/; revision=33990
2010-08-28Doxygen changes.Anders Broman1-27/+29
svn path=/trunk/; revision=33981
2010-07-22In the frame_data structure, expand the per-packetGuy Harris1-2/+2
encapsulation/data-link type to 16 bits, and shuffle some fields to eliminate some unnecessary padding - the net result should be no change in the structure size for 32 bits and a few bytes removed for 64 bits. This allows more encapsulation types - we've just about run out of the ones that fit in a signed 8-bit integer - and thus should fix bug 5025. svn path=/trunk/; revision=33613
2009-12-17Introduce "Ignore Packet" in the packet list.Stig Bjørlykke1-0/+1
This will remove the package from the dissection functions without removing it from the capture file. svn path=/trunk/; revision=31287
2009-11-29Provide some utility macros for commonly used frame data fields.Jaap Keuter1-0/+3
svn path=/trunk/; revision=31126
2009-11-05From Tobias Witek:Anders Broman1-0/+1
w protocols: UMTS RLC (ETSI TS 125 322), UMTS MAC (ETSI TS 125 321) https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3495 svn path=/trunk/; revision=30838
2009-09-22Refactor frame_data_init() into frame_data_set_before_dissect() and ↵Kovarththanan Rajaratnam1-2/+8
frame_data_set_after_dissect(). svn path=/trunk/; revision=30066
2009-09-21Store 'color_filter' as const in 'frame_data'Kovarththanan Rajaratnam1-1/+1
svn path=/trunk/; revision=30051
2009-09-21Guard fdata->col_text_len/fdata->col_text with NEW_PACKET_LISTKovarththanan Rajaratnam1-8/+10
svn path=/trunk/; revision=30044
2009-09-21Move frame_data_init() declaration to frame_data.hKovarththanan Rajaratnam1-0/+8
svn path=/trunk/; revision=30033
2009-09-20Introduce frame_data_cleanup() and start using itKovarththanan Rajaratnam1-0/+3
svn path=/trunk/; revision=30023
2009-09-07Store the packet encapsulation type as gint8. Saves 3 bytes per packetKovarththanan Rajaratnam1-3/+6
svn path=/trunk/; revision=29767
2009-09-07Track length of columns strings. We'll need this in order to resize columns ↵Kovarththanan Rajaratnam1-0/+1
quickly svn path=/trunk/; revision=29759
2009-08-20Prepare to store column text in frame data directly.Anders Broman1-5/+6
svn path=/trunk/; revision=29483
2009-07-27From Kovarththanan Rajaratnam:Anders Broman1-1/+1
Only fill in frame_data vals when needed. svn path=/trunk/; revision=29203
2009-07-22From Jakub Zawadzki:Anders Broman1-0/+3
This patch is cut&paste code from gtk/main_packet_list.c:packet_list_compare() to new function frame_data_compare() + it make use of new function inside packet_list_compare() and packet_list_compare_records() svn path=/trunk/; revision=29164
2009-07-21From didier gautheron via bug 3762:Stig Bjørlykke1-1/+0
This patch removes col_expr in frame_data structure, it can be recomputed when needed. svn path=/trunk/; revision=29159
2009-07-12From Kovarththanan Rajaratnam via bug 3702:Stig Bjørlykke1-1/+2
This patch optimizes the data source name processing in add_new_data_source() by delaying it. We now simply store the constant string and lazily compute the name when needed. This gives a performance boost because we only need the name if we have multiple data sources. svn path=/trunk/; revision=29066
2008-03-01Custom column updates:Stephen Fisher1-0/+1
- Change apply / prepare / ... as filter to use the field's value, which is now stored in fdata as well as cinfo. Now we don't have to reprocess the entire packet list when using these features. This also prevents the use of these features from overwriting custom column information. (custom columns can now be used in apply / prepare ... as filter) - Break col_expr and col_expr_val out into a struct that is included not only in cinfo, but now also fdata. - Have col_custom_set_fstr() quote FT_STRING & FT_STRINGZ when storing the col_expr_val value (for filter creation). svn path=/trunk/; revision=24511
2007-03-23From Sake Blok:Stephen Fisher1-1/+2
Fix for bug #491: Unexpected frame.time_delta behavior This patch ... fixes bug 491. It does this by changing the behaviour of the frame.time_delta field so it reflects the delta time between captured packets (tshark already did this). To keep the delta time between displayed packets, the field frame.time_delta_displayed is created. svn path=/trunk/; revision=21154
2006-11-05change all file offsets from long to gint64 so we can - theoretically - ↵Ulf Lamping1-1/+1
handle files > 2GB correct. Please distclean Win32 builds! svn path=/trunk/; revision=19814
2006-05-21name changeRonnie Sahlberg1-2/+2
svn path=/trunk/; revision=18197
2006-01-24minor code cleanupUlf Lamping1-14/+3
svn path=/trunk/; revision=17093
2005-09-11Frame numbers are unsigned, and they start at 1; 0 is what's used forGuy Harris1-0/+3
"unknown" for frame numbers. Note that in epan/frame_data.h, and make the frame number in experts unsigned, and use 0 for "unknown", and display it as an unsigned number - and, if it's 0, don't display it at all. Fix the signature of "expert_dlg_draw()" to match what a tap's draw routine's signature is expected to be. svn path=/trunk/; revision=15760
2005-08-24EVERYTHING IN THE BUILDBOT IS GOING TO BE RED!!! Sorry! Ulf Lamping1-6/+4
I've done more than a day to change the timestamp resolution from microseconds to nanoseconds. As I really don't want to loose those changes, I'm going to check in the changes I've done so far. Hopefully someone else will give me a helping hand with the things left ... What's done: I've changed the timestamp resolution from usec to nsec in almost any place in the sources. I've changed parts of the implementation in nstime.s/.h and a lot of places elsewhere. As I don't understand the editcap source (well, I'm maybe just too tired right now), hopefully someone else might be able to fix this soon. Doing all those changes, we get native nanosecond timestamp resolution in Ethereal. After fixing all the remaining issues, I'll take a look how to display this in a convenient way... As I've also changed the wiretap timestamp resolution from usec to nsec we might want to change the wiretap version number... svn path=/trunk/; revision=15520
2005-08-13get rid of one more gmemchunkRonnie Sahlberg1-6/+0
svn path=/trunk/; revision=15332
2004-07-18Set the svn:eol-style property on all text files to "native", so thatGuy Harris1-1/+1
they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-01-31Fix the spelling of "cumulative" (and variables whose names derive fromGuy Harris1-2/+2
that spelling). svn path=/trunk/; revision=9917
2004-01-10Remove a C++ style commentJörg Mayer1-2/+1
svn path=/trunk/; revision=9630
2004-01-09Fix the "unmarking a packet matching a color filter does not apply the colorOlivier Biot1-1/+15
filter's colors" bug, by storing the pointer to the matching color_filter_t structure in the frame_data structure. Replace "frame" and "frames" by "packet" and "packets" in many places. svn path=/trunk/; revision=9607
2003-09-12Added TimeReference frames.Ronnie Sahlberg1-1/+2
One can now select a packet and mark it as a TimeReference packet using the menu. A TimeReference packet will be indicated by having all timestamp related column entries replaced by the string *REF* A TimeReference packet will always be displayed in the packet pane, and overrides any display filters. When a frame is a TimeReference frame, all later frames will calculate the TimeRelativeToFirstPacket relative to the timestamp of the TimeReference frame instead of the first frame of the capture. You can have any number of TimeReference frames you like. svn path=/trunk/; revision=8459
2003-09-03And for Cal,Ronnie Sahlberg1-1/+2
Ethereal presents a column to display culmulative bytes into the capture. A new column type is added : Culmulative Bytes. While PacketLength column type specifies the number of bytes in the current packet, Culmulative Bytes specifies the culmulative number of bytes from the start of the capture. svn path=/trunk/; revision=8359
2003-07-08Added prototype for p_rem_proto_data()Tim Potter1-1/+2
Fixed bug in said function which prevented it from actually working. svn path=/trunk/; revision=7982
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-4/+4
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6116
2002-08-14From Tomas Kukosa: add some more routines to the plugin API.Guy Harris1-5/+5
While we're at it, add "extern" to a bunch of function declaration the preceding change *didn't* require to have the "extern" added. svn path=/trunk/; revision=5995
2002-06-04Get rid of the "data_src" member of the "frame_data" structure; put itGuy Harris1-2/+1
in the "packet_info" structure instead, as we don't need a pointer for every single frame in the capture file, just for each frame for which we currently have an open "epan_dissect_t". svn path=/trunk/; revision=5614
2002-02-18Don't give tvbuffs names; instead, give data sources names, where aGuy Harris1-1/+11
"data source" has a name and a top-level tvbuff, and frames can have a list of data sources associated with them. Use the tvbuff pointer to determine which data source is the data source for a given field; this means we don't have to worry about multiple data sources with the same name - the only thing the name does is label the notebook tab for the display of the data source, and label the hex dump of the data source in print/Tethereal output. Clean up a bunch of things discovered in the process of doing the above. svn path=/trunk/; revision=4749
2001-12-10Remove some extra blank lines.Guy Harris1-4/+1
svn path=/trunk/; revision=4374
2001-12-10Move the pointer to the "column_info" structure in the "frame_data"Guy Harris1-18/+15
structure to the "packet_info" structure; only stuff that's permanently stored with each frame should be in the "frame_data" structure, and the "column_info" structure is not guaranteed to hold the column values for that frame at all times - it was only in the "frame_data" structure so that it could be passed to dissectors, and, as all dissectors are now passed a pointer to a "packet_info" structure, it could just as well be put in the "packet_info" structure. That saves memory, by shrinking the "frame_data" structure (there's one of those per frame), and also lets us clean up the code a bit. svn path=/trunk/; revision=4370
2001-04-01Moved the frame_data structures and functions from packet.{h,c} toEd Warnicke1-0/+74
frame_data{h,c}. Added a frame_data_init to be called by epan_init. svn path=/trunk/; revision=3223
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-29 17:01:49 +0000