|
Wireshark 4.7.0
The Wireshark network protocol analyzer
|
Go to the source code of this file.
Classes | |
| struct | _conversation_hash_t |
| struct | _conversation_key_t |
| Composite hash table key identifying a conversation by its two endpoints and optional ID. More... | |
| struct | endpoint_key_t |
| Composite hash table key identifying a single network endpoint by address and port. More... | |
| struct | _ct_dissector_info |
| Dissector info block for a conversation table, providing filter-type resolution. More... | |
| struct | _et_dissector_info |
| Dissector info block for an endpoint table, providing filter-type resolution. More... | |
| struct | _conversation_extension_tcp_t |
| struct | _conversation_item_t |
| struct | _endpoint_item_t |
Macros | |
| #define | CONV_ID_UNSET UINT32_MAX |
| #define | CONV_FILTER_INVALID "INVALID" |
| #define | ENDPOINT_TAP_PREFIX "endpoints" |
Typedefs | |
| typedef uint32_t | conv_id_t |
| typedef struct _conversation_hash_t | conv_hash_t |
| typedef struct _conversation_key_t | conv_key_t |
| Composite hash table key identifying a conversation by its two endpoints and optional ID. | |
| typedef endpoint_key_t | host_key_t |
| typedef const char *(* | conv_get_filter_type) (struct _conversation_item_t *item, conv_filter_type_e filter) |
| typedef struct _ct_dissector_info | ct_dissector_info_t |
| Dissector info block for a conversation table, providing filter-type resolution. | |
| typedef const char *(* | endpoint_get_filter_type) (struct _endpoint_item_t *item, conv_filter_type_e filter_type) |
| Callback that resolves a display filter field name for a given endpoint item and filter type. | |
| typedef struct _et_dissector_info | et_dissector_info_t |
| Dissector info block for an endpoint table, providing filter-type resolution. | |
| typedef et_dissector_info_t | hostlist_dissector_info_t |
| typedef void(* | conv_gui_init_cb) (struct register_ct *ct, const char *filter) |
| typedef void(* | endpoint_gui_init_cb) (struct register_ct *ct, const char *filter) |
| typedef struct register_ct | register_ct_t |
| typedef struct _conversation_extension_tcp_t | conv_extension_tcp_t |
| typedef struct _conversation_item_t | conv_item_t |
| typedef struct _endpoint_item_t | endpoint_item_t |
| typedef endpoint_item_t | hostlist_talker_t |
Enumerations | |
| enum | conv_filter_type_e { CONV_FT_SRC_ADDRESS , CONV_FT_DST_ADDRESS , CONV_FT_ANY_ADDRESS , CONV_FT_SRC_PORT , CONV_FT_DST_PORT , CONV_FT_ANY_PORT } |
| Field type selector for building a conversation display filter. More... | |
| enum | conv_direction_e { CONV_DIR_A_TO_FROM_B , CONV_DIR_A_TO_B , CONV_DIR_A_FROM_B , CONV_DIR_A_TO_FROM_ANY , CONV_DIR_A_TO_ANY , CONV_DIR_A_FROM_ANY , CONV_DIR_ANY_TO_FROM_B , CONV_DIR_ANY_TO_B , CONV_DIR_ANY_FROM_B } |
| Directional filter scope for a conversation, relative to endpoints A and B. More... | |
Functions | |
| void | conversation_table_init (void) |
| Initialize the conversation table system. | |
| WS_DLL_PUBLIC void | register_conversation_table (const int proto_id, bool hide_ports, tap_packet_cb conv_packet_func, tap_packet_cb endpoint_packet_func) |
| Register the conversation table for the conversation and endpoint windows. | |
| WS_DLL_PUBLIC bool | get_conversation_hide_ports (register_ct_t *ct) |
| Should port columns be hidden? | |
| WS_DLL_PUBLIC int | get_conversation_proto_id (register_ct_t *ct) |
| Get protocol ID of a conversation table. | |
| WS_DLL_PUBLIC tap_packet_cb | get_conversation_packet_func (register_ct_t *ct) |
| Get conversation tap function handler of a conversation table. | |
| WS_DLL_PUBLIC tap_packet_cb | get_endpoint_packet_func (register_ct_t *ct) |
| Get endpoint tap function handler for a conversation table. | |
| WS_DLL_PUBLIC tap_packet_cb | get_hostlist_packet_func (register_ct_t *ct) |
| Get the packet callback function for hostlist conversations. | |
| WS_DLL_PUBLIC register_ct_t * | get_conversation_by_proto_id (int proto_id) |
| get conversation table from protocol ID | |
| WS_DLL_PUBLIC void | conversation_table_set_gui_info (conv_gui_init_cb init_cb) |
| Register "initialization function" used by the GUI to create conversation table display in GUI. | |
| WS_DLL_PUBLIC void | endpoint_table_set_gui_info (endpoint_gui_init_cb init_cb) |
| Register "initialization function" used by the GUI to create endpoint table display in GUI. | |
| WS_DLL_PUBLIC void | hostlist_table_set_gui_info (endpoint_gui_init_cb init_cb) |
| Set GUI initialization callback for hostlist table. | |
| WS_DLL_PUBLIC void | conversation_table_iterate_tables (wmem_foreach_func func, void *user_data) |
| Iterator to walk conversation tables and execute func. | |
| WS_DLL_PUBLIC unsigned | conversation_table_get_num (void) |
| Get the total number of conversation tables. | |
| WS_DLL_PUBLIC void | reset_conversation_table_data (conv_hash_t *ch) |
| Remove all entries from the conversation table. | |
| WS_DLL_PUBLIC void | reset_endpoint_table_data (conv_hash_t *ch) |
| Remove all entries from the endpoint table. | |
| WS_DLL_PUBLIC void | reset_hostlist_table_data (conv_hash_t *ch) |
| Reset data in hostlist table. | |
| WS_DLL_PUBLIC void | dissector_conversation_init (const char *opt_arg, void *userdata) |
| Initialize dissector conversation for stats and (possibly) GUI. | |
| WS_DLL_PUBLIC void | dissector_endpoint_init (const char *opt_arg, void *userdata) |
| Initialize dissector endpoint for stats and (possibly) GUI. | |
| WS_DLL_PUBLIC void | dissector_hostlist_init (const char *opt_arg, void *userdata) |
| Initialize the dissector host list with the given options and user data. | |
| WS_DLL_PUBLIC char * | get_conversation_address (wmem_allocator_t *allocator, address *addr, bool resolve_names) |
| Get the string representation of an address. | |
| WS_DLL_PUBLIC char * | get_conversation_port (wmem_allocator_t *allocator, uint32_t port, conversation_type ctype, bool resolve_names) |
| Get the string representation of a port. | |
| WS_DLL_PUBLIC char * | get_endpoint_port (wmem_allocator_t *allocator, endpoint_item_t *item, bool resolve_names) |
| Get the string representation of the port for an endpoint_item_t. | |
| WS_DLL_PUBLIC char * | get_conversation_filter (conv_item_t *conv_item, conv_direction_e direction) |
| Get a display filter for the given conversation and direction. | |
| WS_DLL_PUBLIC char * | get_endpoint_filter (endpoint_item_t *endpoint_item) |
| Get a display filter for the given endpoint. | |
| WS_DLL_PUBLIC char * | get_hostlist_filter (endpoint_item_t *endpoint_item) |
| Retrieves a hostlist filter for an endpoint item. | |
| WS_DLL_PUBLIC void | add_conversation_table_data (conv_hash_t *ch, const address *src, const address *dst, uint32_t src_port, uint32_t dst_port, int num_frames, int num_bytes, nstime_t *ts, nstime_t *abs_ts, ct_dissector_info_t *ct_info, conversation_type ctype) |
| Add some data to the conversation table. | |
| WS_DLL_PUBLIC conv_item_t * | add_conversation_table_data_with_conv_id (conv_hash_t *ch, const address *src, const address *dst, uint32_t src_port, uint32_t dst_port, conv_id_t conv_id, int num_frames, int num_bytes, nstime_t *ts, nstime_t *abs_ts, ct_dissector_info_t *ct_info, conversation_type ctype) |
| Add some data to the conversation table, passing a value to be used in addition to the address and port quadruple to uniquely identify the conversation. | |
| WS_DLL_PUBLIC void | add_conversation_table_data_extended (conv_hash_t *ch, const address *src, const address *dst, uint32_t src_port, uint32_t dst_port, conv_id_t conv_id, int num_frames, int num_bytes, nstime_t *ts, nstime_t *abs_ts, ct_dissector_info_t *ct_info, conversation_type ctype, uint32_t frameid, int(*proto_conv_cb)(conversation_t *)) |
| Decorates add_conversation_table_data_with_conv_id() in order to be able to add protocol dependent additional statistics. | |
| WS_DLL_PUBLIC void | add_conversation_table_data_ipv4_subnet (conv_hash_t *ch, const address *src, const address *dst, uint32_t src_port, uint32_t dst_port, conv_id_t conv_id, int num_frames, int num_bytes, nstime_t *ts, nstime_t *abs_ts, ct_dissector_info_t *ct_info, conversation_type ctype) |
| Encapsulates add_conversation_table_data_with_conv_id() for the IPv4 specific case when the subnet aggregation user preference is true. | |
| WS_DLL_PUBLIC void | add_endpoint_table_data (conv_hash_t *ch, const address *addr, uint32_t port, bool sender, int num_frames, int num_bytes, et_dissector_info_t *et_info, endpoint_type etype) |
| Add some data to the endpoint table. | |
| WS_DLL_PUBLIC void | add_endpoint_table_data_ipv4_subnet (conv_hash_t *ch, const address *addr, uint32_t port, bool sender, int num_frames, int num_bytes, et_dissector_info_t *et_info, endpoint_type etype) |
| Encapsulates add_endpoint_table_data() for the IPv4 specific case when the subnet aggregation user preference is true. | |
| WS_DLL_PUBLIC void | add_hostlist_table_data (conv_hash_t *ch, const address *addr, uint32_t port, bool sender, int num_frames, int num_bytes, et_dissector_info_t *et_info, endpoint_type etype) |
| Adds data to the hostlist table for a conversation. | |
Conversation definitions.
| typedef struct _conversation_extension_tcp_t conv_extension_tcp_t |
Conversation extension for TCP
| typedef struct _conversation_hash_t conv_hash_t |
Conversation hash + value storage Hash table keys are conv_key_t. Hash table values are indexes into conv_array.
| typedef uint32_t conv_id_t |
conv_id_t is a type that can aid in conversation identification. When included in a "conversation key", whatever that may be, in addition to the typical { address, port, address, port } quadruple, it helps differentiate in case the quadruple is not sufficiently unique. For example, it is not uncommon to see a TCP quadruple reused these days, and employing a conv_id_t field ensures that each instance of a reused TCP conversation is tracked independently. Currently this type is used in both Wireshark's and tshark's conversation tables implementations (they are different, hence the need for a whole header file for this one silly type alias).
The "protocol" or "statistic" code responsible for instantiating the "conversation key" is also responsible for assigning its conv_id_t, and therefore its interpretation is specific to its assignor. For example, the TCP conversations tables in Wireshark and tshark assign the value of tcp.stream. If a conv_id_t field is not used, it should be assigned the value CONV_ID_UNSET.
| typedef struct _conversation_item_t conv_item_t |
Conversation list information
| typedef const char *(* endpoint_get_filter_type) (struct _endpoint_item_t *item, conv_filter_type_e filter_type) |
Callback that resolves a display filter field name for a given endpoint item and filter type.
| item | Pointer to the endpoint item being queried. |
| filter_type | The conversation filter type to resolve. |
filter_type, or NULL if unsupported. | typedef struct _endpoint_item_t endpoint_item_t |
Endpoint information
| typedef struct register_ct register_ct_t |
Structure for information about a registered conversation table; this information is for both the conversation table and any endpoint table associated with it.
| enum conv_direction_e |
Directional filter scope for a conversation, relative to endpoints A and B.
| enum conv_filter_type_e |
Field type selector for building a conversation display filter.
| WS_DLL_PUBLIC void add_conversation_table_data | ( | conv_hash_t * | ch, |
| const address * | src, | ||
| const address * | dst, | ||
| uint32_t | src_port, | ||
| uint32_t | dst_port, | ||
| int | num_frames, | ||
| int | num_bytes, | ||
| nstime_t * | ts, | ||
| nstime_t * | abs_ts, | ||
| ct_dissector_info_t * | ct_info, | ||
| conversation_type | ctype | ||
| ) |
Add some data to the conversation table.
| ch | the table to add the data to |
| src | source address |
| dst | destination address |
| src_port | source port |
| dst_port | destination port |
| num_frames | number of packets |
| num_bytes | number of bytes |
| ts | timestamp |
| abs_ts | absolute timestamp |
| ct_info | callback handlers from the dissector |
| ctype | the conversation type (e.g. CONVERSATION_TCP) |
| WS_DLL_PUBLIC void add_conversation_table_data_extended | ( | conv_hash_t * | ch, |
| const address * | src, | ||
| const address * | dst, | ||
| uint32_t | src_port, | ||
| uint32_t | dst_port, | ||
| conv_id_t | conv_id, | ||
| int | num_frames, | ||
| int | num_bytes, | ||
| nstime_t * | ts, | ||
| nstime_t * | abs_ts, | ||
| ct_dissector_info_t * | ct_info, | ||
| conversation_type | ctype, | ||
| uint32_t | frameid, | ||
| int(*)(conversation_t *) | proto_conv_cb | ||
| ) |
Decorates add_conversation_table_data_with_conv_id() in order to be able to add protocol dependent additional statistics.
| ch | the table to add the data to |
| src | source address |
| dst | destination address |
| src_port | source port |
| dst_port | destination port |
| conv_id | a value to help differentiate the conversation in case the address and port quadruple is not sufficiently unique |
| num_frames | number of packets |
| num_bytes | number of bytes |
| ts | timestamp |
| abs_ts | absolute timestamp |
| ct_info | callback handlers from the dissector |
| ctype | the conversation type (e.g. CONVERSATION_TCP) |
| frameid | the frame id of the packet being processed |
| proto_conv_cb | a callback function that will be called with the conversation item as argument, and that can be used to set protocol dependent additional statistics in the conversation item |
| WS_DLL_PUBLIC void add_conversation_table_data_ipv4_subnet | ( | conv_hash_t * | ch, |
| const address * | src, | ||
| const address * | dst, | ||
| uint32_t | src_port, | ||
| uint32_t | dst_port, | ||
| conv_id_t | conv_id, | ||
| int | num_frames, | ||
| int | num_bytes, | ||
| nstime_t * | ts, | ||
| nstime_t * | abs_ts, | ||
| ct_dissector_info_t * | ct_info, | ||
| conversation_type | ctype | ||
| ) |
Encapsulates add_conversation_table_data_with_conv_id() for the IPv4 specific case when the subnet aggregation user preference is true.
| ch | the table to add the data to |
| src | source address |
| dst | destination address |
| src_port | source port |
| dst_port | destination port |
| conv_id | a value to help differentiate the conversation in case the address and port quadruple is not sufficiently unique |
| num_frames | number of packets |
| num_bytes | number of bytes |
| ts | timestamp |
| abs_ts | absolute timestamp |
| ct_info | callback handlers from the dissector |
| ctype | the conversation type (e.g. CONVERSATION_TCP) |
| WS_DLL_PUBLIC conv_item_t * add_conversation_table_data_with_conv_id | ( | conv_hash_t * | ch, |
| const address * | src, | ||
| const address * | dst, | ||
| uint32_t | src_port, | ||
| uint32_t | dst_port, | ||
| conv_id_t | conv_id, | ||
| int | num_frames, | ||
| int | num_bytes, | ||
| nstime_t * | ts, | ||
| nstime_t * | abs_ts, | ||
| ct_dissector_info_t * | ct_info, | ||
| conversation_type | ctype | ||
| ) |
Add some data to the conversation table, passing a value to be used in addition to the address and port quadruple to uniquely identify the conversation.
| ch | the table to add the data to |
| src | source address |
| dst | destination address |
| src_port | source port |
| dst_port | destination port |
| num_frames | number of packets |
| num_bytes | number of bytes |
| ts | timestamp |
| abs_ts | absolute timestamp |
| ct_info | callback handlers from the dissector |
| ctype | the conversation type (e.g. CONVERSATION_TCP) |
| conv_id | a value to help differentiate the conversation in case the address and port quadruple is not sufficiently unique |
< flag for the conversation handler
< flag for the conversation handler
| WS_DLL_PUBLIC void add_endpoint_table_data | ( | conv_hash_t * | ch, |
| const address * | addr, | ||
| uint32_t | port, | ||
| bool | sender, | ||
| int | num_frames, | ||
| int | num_bytes, | ||
| et_dissector_info_t * | et_info, | ||
| endpoint_type | etype | ||
| ) |
Add some data to the endpoint table.
| ch | the table hash to add the data to |
| addr | address |
| port | port |
| sender | true, if this is a sender |
| num_frames | number of packets |
| num_bytes | number of bytes |
| et_info | endpoint information provided by dissector |
| etype | the endpoint type (e.g. ENDPOINT_TCP) |
< flag for the conversation handler
| WS_DLL_PUBLIC void add_endpoint_table_data_ipv4_subnet | ( | conv_hash_t * | ch, |
| const address * | addr, | ||
| uint32_t | port, | ||
| bool | sender, | ||
| int | num_frames, | ||
| int | num_bytes, | ||
| et_dissector_info_t * | et_info, | ||
| endpoint_type | etype | ||
| ) |
Encapsulates add_endpoint_table_data() for the IPv4 specific case when the subnet aggregation user preference is true.
| ch | the table hash to add the data to |
| addr | address |
| port | port |
| sender | true, if this is a sender |
| num_frames | number of packets |
| num_bytes | number of bytes |
| et_info | endpoint information provided by dissector |
| etype | the endpoint type (e.g. ENDPOINT_TCP) |
< replace with subnets when possible, and keep original data
| WS_DLL_PUBLIC void add_hostlist_table_data | ( | conv_hash_t * | ch, |
| const address * | addr, | ||
| uint32_t | port, | ||
| bool | sender, | ||
| int | num_frames, | ||
| int | num_bytes, | ||
| et_dissector_info_t * | et_info, | ||
| endpoint_type | etype | ||
| ) |
Adds data to the hostlist table for a conversation.
| ch | Pointer to the conversation hash table. |
| addr | Address of the endpoint. |
| port | Port number of the endpoint. |
| sender | Boolean indicating if this is the sender's data. |
| num_frames | Number of frames associated with the endpoint. |
| num_bytes | Total bytes associated with the endpoint. |
| et_info | Pointer to the dissector information. |
| etype | Type of the endpoint. |
| WS_DLL_PUBLIC unsigned conversation_table_get_num | ( | void | ) |
Get the total number of conversation tables.
| WS_DLL_PUBLIC void conversation_table_iterate_tables | ( | wmem_foreach_func | func, |
| void * | user_data | ||
| ) |
Iterator to walk conversation tables and execute func.
| func | action to be performed on all conversation tables |
| user_data | any data needed to help perform function |
| WS_DLL_PUBLIC void conversation_table_set_gui_info | ( | conv_gui_init_cb | init_cb | ) |
Register "initialization function" used by the GUI to create conversation table display in GUI.
| init_cb | callback function that will be called when conversation table "display is instantiated in GUI |
| WS_DLL_PUBLIC void dissector_conversation_init | ( | const char * | opt_arg, |
| void * | userdata | ||
| ) |
Initialize dissector conversation for stats and (possibly) GUI.
| opt_arg | filter string to compare with dissector |
| userdata | register_ct_t* for dissector conversation table |
| WS_DLL_PUBLIC void dissector_endpoint_init | ( | const char * | opt_arg, |
| void * | userdata | ||
| ) |
Initialize dissector endpoint for stats and (possibly) GUI.
| opt_arg | filter string to compare with dissector |
| userdata | register_ct_t* for dissector conversation table |
| WS_DLL_PUBLIC void dissector_hostlist_init | ( | const char * | opt_arg, |
| void * | userdata | ||
| ) |
Initialize the dissector host list with the given options and user data.
| opt_arg | Options argument for initialization. |
| userdata | User data to be passed during initialization. |
| WS_DLL_PUBLIC void endpoint_table_set_gui_info | ( | endpoint_gui_init_cb | init_cb | ) |
Register "initialization function" used by the GUI to create endpoint table display in GUI.
| init_cb | callback function that will be called when endpoint table "display" is instantiated in GUI |
| WS_DLL_PUBLIC char * get_conversation_address | ( | wmem_allocator_t * | allocator, |
| address * | addr, | ||
| bool | resolve_names | ||
| ) |
Get the string representation of an address.
| allocator | The wmem allocator to use when allocating the string |
| addr | The address. |
| resolve_names | Enable name resolution. |
| WS_DLL_PUBLIC register_ct_t * get_conversation_by_proto_id | ( | int | proto_id | ) |
get conversation table from protocol ID
| proto_id | protocol ID |
get conversation from protocol ID
| proto_id | protocol ID |
| WS_DLL_PUBLIC char * get_conversation_filter | ( | conv_item_t * | conv_item, |
| conv_direction_e | direction | ||
| ) |
Get a display filter for the given conversation and direction.
| conv_item | The conversation. |
| direction | The desired direction. |
| WS_DLL_PUBLIC bool get_conversation_hide_ports | ( | register_ct_t * | ct | ) |
Should port columns be hidden?
| ct | Registered conversation table |
| WS_DLL_PUBLIC tap_packet_cb get_conversation_packet_func | ( | register_ct_t * | ct | ) |
Get conversation tap function handler of a conversation table.
| ct | Registered conversation table |
| WS_DLL_PUBLIC char * get_conversation_port | ( | wmem_allocator_t * | allocator, |
| uint32_t | port, | ||
| conversation_type | ctype, | ||
| bool | resolve_names | ||
| ) |
Get the string representation of a port.
| allocator | The wmem allocator to use when allocating the string |
| port | The port number. |
| ctype | The conversation type. |
| resolve_names | Enable name resolution. |
XXX - this should really be a port type, as we just supply a port.
| WS_DLL_PUBLIC int get_conversation_proto_id | ( | register_ct_t * | ct | ) |
Get protocol ID of a conversation table.
| ct | Registered conversation table |
| WS_DLL_PUBLIC char * get_endpoint_filter | ( | endpoint_item_t * | endpoint_item | ) |
Get a display filter for the given endpoint.
| endpoint_item | The endpoint. |
| WS_DLL_PUBLIC tap_packet_cb get_endpoint_packet_func | ( | register_ct_t * | ct | ) |
Get endpoint tap function handler for a conversation table.
| ct | Registered conversation table |
| WS_DLL_PUBLIC char * get_endpoint_port | ( | wmem_allocator_t * | allocator, |
| endpoint_item_t * | item, | ||
| bool | resolve_names | ||
| ) |
Get the string representation of the port for an endpoint_item_t.
| allocator | The wmem allocator to use when allocating the string |
| item | Pointer to the endpoint_item_t |
| resolve_names | Enable name resolution. |
XXX - this should really be a port type, as we just supply a port.
| WS_DLL_PUBLIC char * get_hostlist_filter | ( | endpoint_item_t * | endpoint_item | ) |
Retrieves a hostlist filter for an endpoint item.
| endpoint_item | The endpoint item to retrieve the filter for. |
| WS_DLL_PUBLIC tap_packet_cb get_hostlist_packet_func | ( | register_ct_t * | ct | ) |
Get the packet callback function for hostlist conversations.
| ct | Pointer to the conversation table. |
| WS_DLL_PUBLIC void hostlist_table_set_gui_info | ( | endpoint_gui_init_cb | init_cb | ) |
Set GUI initialization callback for hostlist table.
| init_cb | Callback function to initialize GUI information. |
| WS_DLL_PUBLIC void register_conversation_table | ( | const int | proto_id, |
| bool | hide_ports, | ||
| tap_packet_cb | conv_packet_func, | ||
| tap_packet_cb | endpoint_packet_func | ||
| ) |
Register the conversation table for the conversation and endpoint windows.
| proto_id | is the protocol with conversation |
| hide_ports | hide the port columns |
| conv_packet_func | the registered conversation tap name |
| endpoint_packet_func | the registered endpoint tap name |
| WS_DLL_PUBLIC void reset_conversation_table_data | ( | conv_hash_t * | ch | ) |
Remove all entries from the conversation table.
| ch | the table to reset |
| WS_DLL_PUBLIC void reset_endpoint_table_data | ( | conv_hash_t * | ch | ) |
Remove all entries from the endpoint table.
| ch | the table to reset |
| WS_DLL_PUBLIC void reset_hostlist_table_data | ( | conv_hash_t * | ch | ) |
Reset data in hostlist table.
| ch | Pointer to conversation hash table. |