expert.h File Reference

#include <epan/proto.h>
#include <epan/packet_info.h>
#include <wsutil/value_string.h>
#include "ws_symbol_export.h"

Go to the source code of this file.

Classes
struct	expert_info_s
	Holds expert info data for a single packet event; used internally and for display purposes only. More...
struct	expert_field
	Pairs an expert info index with its associated header field index for registration and display. More...
struct	expert_field_info
	Describes a registered expert info field, including dissector-supplied metadata and registration state. More...
struct	ei_register_info
	Bundles an expert_field handle with its expert_field_info for use in bulk registration. More...

Macros
#define	EI_INIT_EI   0
#define	EI_INIT_HF   0
#define	EI_INIT   {EI_INIT_EI, EI_INIT_HF}
#define	EXPFILL
	Prefill macro for the registration-managed fields of an expert_field_info; use as a trailing initializer in static declarations.
#define	PRE_ALLOC_EXPERT_FIELDS_MEM   5000
#define	EXPERT_CHECKSUM_DISABLED   -2
#define	EXPERT_CHECKSUM_UNKNOWN   -1
#define	EXPERT_CHECKSUM_GOOD   0
#define	EXPERT_CHECKSUM_BAD   1

Typedefs
typedef struct expert_info_s	expert_info_t
	Holds expert info data for a single packet event; used internally and for display purposes only.
typedef struct expert_field	expert_field
	Pairs an expert info index with its associated header field index for registration and display.
typedef struct expert_field_info	expert_field_info
	Describes a registered expert info field, including dissector-supplied metadata and registration state.
typedef struct ei_register_info	ei_register_info
	Bundles an expert_field handle with its expert_field_info for use in bulk registration.
typedef struct expert_module	expert_module_t

Functions
void	expert_init (void)
	Initializes expert system.
void	expert_packet_init (void)
	Initializes the expert system for each packet.
void	expert_cleanup (void)
	Cleans up resources used by expert processing.
void	expert_packet_cleanup (void)
	Cleans up resources used by expert processing.
WS_DLL_PUBLIC int	expert_get_highest_severity (void)
	Get the highest severity of expert information.
WS_DLL_PUBLIC void	expert_update_comment_count (uint64_t count)
	Update the expert info comment count.
WS_DLL_PUBLIC proto_item *	expert_add_info (packet_info *pinfo, proto_item *pi, expert_field *eiindex)
	Add an expert info.
WS_DLL_PUBLIC proto_item *	expert_add_info_format (packet_info *pinfo, proto_item *pi, expert_field *eiindex, const char *format,...)
WS_DLL_PUBLIC proto_item *	proto_tree_add_expert (proto_tree *tree, packet_info *pinfo, expert_field *eiindex, tvbuff_t *tvb, unsigned start, unsigned length)
WS_DLL_PUBLIC proto_item *	proto_tree_add_expert_remaining (proto_tree *tree, packet_info *pinfo, expert_field *eiindex, tvbuff_t *tvb, unsigned start)
	Add an expert info associated with some byte data.
WS_DLL_PUBLIC proto_item *	proto_tree_add_expert_format (proto_tree *tree, packet_info *pinfo, expert_field *eiindex, tvbuff_t *tvb, unsigned start, unsigned length, const char *format,...)
	Add an expert info associated with some byte data.
WS_DLL_PUBLIC proto_item *	proto_tree_add_expert_format_remaining (proto_tree *tree, packet_info *pinfo, expert_field *eiindex, tvbuff_t *tvb, unsigned start, const char *format,...)
WS_DLL_PUBLIC expert_module_t *	expert_register_protocol (int id)
	Register that a protocol has expert info.
void	expert_deregister_expertinfo (const char *abbrev)
	Deregister a expert info.
void	expert_deregister_protocol (expert_module_t *module)
	Deregister expert info from a protocol.
void	expert_free_deregistered_expertinfos (void)
	Free deregistered expert infos.
WS_DLL_PUBLIC const char *	expert_get_summary (expert_field *eiindex)
	Get summary text of an expert_info field.
WS_DLL_PUBLIC void	expert_register_field_array (expert_module_t *module, ei_register_info *ei, const int num_records)
	Register a expert field array.

Variables
WS_DLL_PUBLIC int	proto_expert
WS_DLL_PUBLIC const value_string	expert_group_vals []
WS_DLL_PUBLIC const value_string	expert_severity_vals []
WS_DLL_PUBLIC const value_string	expert_checksum_vals []

Detailed Description

Collecting of Expert information.

For further info, see WSDG: 9.3. How to add an expert item: https://www.wireshark.org/docs/wsdg_html/#ChDissectExpertInfo

Wireshark - Network traffic analyzer By Gerald Combs geral.nosp@m.d@wi.nosp@m.resha.nosp@m.rk.o.nosp@m.rg Copyright 1998 Gerald Combs

SPDX-License-Identifier: GPL-2.0-or-later

Macro Definition Documentation

EI_INIT

#define EI_INIT   {EI_INIT_EI, EI_INIT_HF}

Compound initializer for an expert_field, zeroing both ei and hf.

EI_INIT_EI

#define EI_INIT_EI   0

Default initializer value for the expert info index field of an expert_field.

EI_INIT_HF

#define EI_INIT_HF   0

Default initializer value for the header field index field of an expert_field.

EXPFILL

#define EXPFILL

Value:

        0, NULL, 0, NULL, \
        {0, {NULL, NULL, FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL}}

Prefill macro for the registration-managed fields of an expert_field_info; use as a trailing initializer in static declarations.

Function Documentation

expert_add_info()

WS_DLL_PUBLIC proto_item * expert_add_info	(	packet_info *	pinfo,
		proto_item *	pi,
		expert_field *	eiindex
	)

Add an expert info.

Add an expert info tree to a protocol item using registered expert info item

Parameters

pinfo	Packet info of the currently processed packet. May be NULL if pi is supplied
pi	Current protocol item (or NULL)
eiindex	The registered expert info item

Returns

the newly created expert info tree

expert_add_info_format()

WS_DLL_PUBLIC proto_item * expert_add_info_format	(	packet_info *	pinfo,
		proto_item *	pi,
		expert_field *	eiindex,
		const char *	format,
			...
	)

Add an expert info. Add an expert info tree to a protocol item using registered expert info item, but with a formatted message.

Parameters

pinfo	Packet info of the currently processed packet. May be NULL if pi is supplied
pi	Current protocol item (or NULL)
eiindex	The registered expert info item
format	Printf-style format string for additional arguments

Returns

the newly created expert info tree

expert_deregister_expertinfo()

void expert_deregister_expertinfo

(

const char *

abbrev

)

Deregister a expert info.

Parameters

abbrev

The abbreviation of the expert info to deregister.

expert_deregister_protocol()

void expert_deregister_protocol

(

expert_module_t *

module

)

Deregister expert info from a protocol.

Parameters

module

The expert module for the protocol.

expert_get_highest_severity()

WS_DLL_PUBLIC int expert_get_highest_severity

(

void

)

Get the highest severity of expert information.

Returns

The highest severity level.

expert_get_summary()

WS_DLL_PUBLIC const char * expert_get_summary

(

expert_field *

eiindex

)

Get summary text of an expert_info field.

This is intended for use in expert_add_info_format or proto_tree_add_expert_format to get the "base" string to then append additional information

Parameters

eiindex

The registered expert info item

Returns

The summary text of the expert info item, or NULL if the item is not found.

Get summary text of an expert_info field. This is intended for use in expert_add_info_format or proto_tree_add_expert_format to get the "base" string to then append additional information

expert_init()

void expert_init ( void  )

extern

Initializes expert system.

This function initializes the expert system, setting up necessary data structures and resources.

expert_packet_cleanup()

void expert_packet_cleanup ( void  )

extern

Cleans up resources used by expert processing.

This function is responsible for cleaning up any resources that were allocated during the initialization and operation of expert processing in Wireshark.

expert_packet_init()

void expert_packet_init ( void  )

extern

Initializes the expert system for each packet.

This function initializes the expert system for each packet, setting up necessary data structures and resources.

expert_register_field_array()

WS_DLL_PUBLIC void expert_register_field_array	(	expert_module_t *	module,
		ei_register_info *	ei,
		const int	num_records
	)

Register a expert field array.

Parameters

module	the protocol handle from expert_register_protocol()
ei	the ei_register_info array
num_records	the number of records in exp

expert_register_protocol()

WS_DLL_PUBLIC expert_module_t * expert_register_protocol

(

int

id

)

Register that a protocol has expert info.

Parameters

id	The protocol ID to register.

Returns

A pointer to the expert module for the protocol, or NULL if registration fails.

expert_update_comment_count()

WS_DLL_PUBLIC void expert_update_comment_count

(

uint64_t

count

)

Update the expert info comment count.

Parameters

count

The new comment count.

proto_tree_add_expert()

WS_DLL_PUBLIC proto_item * proto_tree_add_expert	(	proto_tree *	tree,
		packet_info *	pinfo,
		expert_field *	eiindex,
		tvbuff_t *	tvb,
		unsigned	start,
		unsigned	length
	)

Add an expert info associated with some byte data Add an expert info tree to a protocol item using registered expert info item. This function is intended to replace places where a "text only" proto_tree_add_xxx API + expert_add_info would be used.

Parameters

tree	Current protocol tree (or NULL)
pinfo	Packet info of the currently processed packet. May be NULL if tree is supplied
eiindex	The registered expert info item
tvb	the tv buffer of the current data
start	start of data in tvb
length	length of data in tvb

Returns

the newly created item above expert info tree

proto_tree_add_expert_format()

WS_DLL_PUBLIC proto_item * proto_tree_add_expert_format	(	proto_tree *	tree,
		packet_info *	pinfo,
		expert_field *	eiindex,
		tvbuff_t *	tvb,
		unsigned	start,
		unsigned	length,
		const char *	format,
			...
	)

Add an expert info associated with some byte data.

Add an expert info tree to a protocol item, using registered expert info item, but with a formatted message. Add an expert info tree to a protocol item using registered expert info item. This function is intended to replace places where a "text only" proto_tree_add_xxx API + expert_add_info_format would be used.

Parameters

tree	Current protocol tree (or NULL)
pinfo	Packet info of the currently processed packet. May be NULL if tree is supplied
eiindex	The registered expert info item
tvb	the tv buffer of the current data
start	start of data in tvb
length	length of data in tvb
format	Printf-style format string for additional arguments

Returns

the newly created item above expert info tree

proto_tree_add_expert_format_remaining()

WS_DLL_PUBLIC proto_item * proto_tree_add_expert_format_remaining	(	proto_tree *	tree,
		packet_info *	pinfo,
		expert_field *	eiindex,
		tvbuff_t *	tvb,
		unsigned	start,
		const char *	format,
			...
	)

Same as proto_tree_add_expert_format but without the length parameter, length will be sret to end of the tvb. Add an expert info associated with some byte data Add an expert info tree to a protocol item, using registered expert info item, but with a formatted message. Add an expert info tree to a protocol item using registered expert info item. This function is intended to replace places where a "text only" proto_tree_add_xxx API + expert_add_info_format would be used.

Parameters

tree	Current protocol tree (or NULL)
pinfo	Packet info of the currently processed packet. May be NULL if tree is supplied
eiindex	The registered expert info item
tvb	the tv buffer of the current data
start	start of data in tvb
format	Printf-style format string for additional arguments

Returns

the newly created item above expert info tree

proto_tree_add_expert_remaining()

WS_DLL_PUBLIC proto_item * proto_tree_add_expert_remaining	(	proto_tree *	tree,
		packet_info *	pinfo,
		expert_field *	eiindex,
		tvbuff_t *	tvb,
		unsigned	start
	)

Add an expert info associated with some byte data.

Add an expert info tree to a protocol item using registered expert info item. This function is intended to replace places where a "text only" proto_tree_add_xxx API + expert_add_info would be used. Length will be to the end of the tvb.

Parameters

tree	Current protocol tree (or NULL)
pinfo	Packet info of the currently processed packet. May be NULL if tree is supplied
eiindex	The registered expert info item
tvb	the tv buffer of the current data
start	start of data in tvb

Returns

the newly created item above expert info tree