packet.h File Reference

#include <wsutil/array.h>
#include "proto.h"
#include "range.h"
#include "tvbuff.h"
#include "epan.h"
#include "frame_data.h"
#include "packet_info.h"
#include "column-utils.h"
#include "guid-utils.h"

Go to the source code of this file.

Classes
struct	_guid_key
	Lookup key for GUID-indexed dissector tables, combining a GUID with an optional version field. More...
struct	heur_dtbl_entry
	Represents a single entry in a heuristic dissector table, binding a heuristic dissector to its protocol and configuration. More...
struct	frame_data_s
	Holds the data passed to the frame dissector for dissection of a single packet frame. More...
struct	file_data_s
	Holds the data passed to the file dissector for dissection of a capture file as a whole. More...
struct	ethertype_data_s
	Holds the parameters passed to the Ethertype dissector for dissecting an Ethernet payload. More...

Macros
#define	hi_nibble(b)   (((b) & 0xf0) >> 4)
#define	lo_nibble(b)   ((b) & 0x0f)
#define	BYTES_ARE_IN_FRAME(offset, captured_len, len)
#define	STRING_CASE_SENSITIVE   0
#define	STRING_CASE_INSENSITIVE   1

Typedefs
typedef struct wtap_block *	wtap_block_t
typedef struct dissector_handle *	dissector_handle_t
typedef struct dissector_table *	dissector_table_t
typedef int(*	dissector_t) (tvbuff_t *, packet_info *, proto_tree *, void *)
typedef int(*	dissector_cb_t) (tvbuff_t *, packet_info *, proto_tree *, void *, void *)
typedef bool(*	heur_dissector_t) (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *)
typedef void(*	DATFunc) (const char *table_name, ftenum_t selector_type, void *key, void *value, void *user_data)
typedef void(*	DATFunc_handle) (const char *table_name, void *value, void *user_data)
typedef void(*	DATFunc_table) (const char *table_name, const char *ui_name, void *user_data)
typedef struct dtbl_entry	dtbl_entry_t
typedef struct _guid_key	guid_key
	Lookup key for GUID-indexed dissector tables, combining a GUID with an optional version field.
typedef struct heur_dissector_list *	heur_dissector_list_t
typedef struct heur_dtbl_entry	heur_dtbl_entry_t
	Represents a single entry in a heuristic dissector table, binding a heuristic dissector to its protocol and configuration.
typedef void(*	DATFunc_heur) (const char *table_name, struct heur_dtbl_entry *entry, void *user_data)
typedef void(*	DATFunc_heur_table) (const char *table_name, struct heur_dissector_list *table, void *user_data)
typedef struct depend_dissector_list *	depend_dissector_list_t
typedef struct frame_data_s	frame_data_t
	Holds the data passed to the frame dissector for dissection of a single packet frame.
typedef struct file_data_s	file_data_t
	Holds the data passed to the file dissector for dissection of a capture file as a whole.
typedef struct ethertype_data_s	ethertype_data_t
	Holds the parameters passed to the Ethertype dissector for dissecting an Ethernet payload.

Enumerations
enum	heuristic_enable_e { HEURISTIC_DISABLE , HEURISTIC_ENABLE }
	Controls whether a heuristic dissector is active. More...
enum	data_source_media_type_e { DS_MEDIA_TYPE_APPLICATION_OCTET_STREAM , DS_MEDIA_TYPE_APPLICATION_JSON }
	MIME media type descriptor for a packet data source buffer. More...

Functions
void	packet_init (void)
	Initialize the packet dissection engine.
void	packet_cache_proto_handles (void)
	Cache protocol handles for fast lookup during dissection.
void	packet_all_tables_sort_handles (void)
	Sort the dissector handles in all dissector tables.
void	packet_cleanup (void)
	Clean up the packet dissection engine.
WS_DLL_PUBLIC dissector_handle_t	dtbl_entry_get_handle (dtbl_entry_t *dtbl_entry)
	Return the currently active dissector handle for a dissector table entry.
WS_DLL_PUBLIC dissector_handle_t	dtbl_entry_get_initial_handle (dtbl_entry_t *entry)
	Return the initial (registered) dissector handle for a dissector table entry.
void	dissector_table_foreach_changed (const char *table_name, DATFunc func, void *user_data)
WS_DLL_PUBLIC void	dissector_table_foreach (const char *table_name, DATFunc func, void *user_data)
WS_DLL_PUBLIC void	dissector_all_tables_foreach_changed (DATFunc func, void *user_data)
WS_DLL_PUBLIC void	dissector_table_foreach_handle (const char *table_name, DATFunc_handle func, void *user_data)
WS_DLL_PUBLIC void	dissector_all_tables_foreach_table (DATFunc_table func, void *user_data, GCompareFunc compare_key_func)
WS_DLL_PUBLIC dissector_table_t	register_dissector_table (const char *name, const char *ui_name, const int proto, const ftenum_t type, const int param)
	a protocol uses the function to register a sub-dissector table
WS_DLL_PUBLIC dissector_table_t	register_custom_dissector_table (const char *name, const char *ui_name, const int proto, GHashFunc hash_func, GEqualFunc key_equal_func, GDestroyNotify key_destroy_func)
	Similar to register_dissector_table, but with a "custom" hash function to store subdissectors.
WS_DLL_PUBLIC void	register_dissector_table_alias (dissector_table_t dissector_table, const char *alias_name)
void	deregister_dissector_table (const char *name)
	Deregister the dissector table by table name.
WS_DLL_PUBLIC dissector_table_t	find_dissector_table (const char *name)
	Find a dissector table by its internal name.
WS_DLL_PUBLIC const char *	get_dissector_table_ui_name (const char *name)
	Return the UI display name for a dissector table.
WS_DLL_PUBLIC ftenum_t	get_dissector_table_selector_type (const char *name)
	Return the field type of the selector for a dissector table.
WS_DLL_PUBLIC int	get_dissector_table_param (const char *name)
	Return the parameter value associated with a dissector table.
WS_DLL_PUBLIC void	dissector_dump_dissector_tables (void)
	Print information about all registered dissector tables to standard output.
WS_DLL_PUBLIC void	dissector_add_uint (const char *name, const uint32_t pattern, dissector_handle_t handle)
	Add a uint-keyed entry to a dissector table.
WS_DLL_PUBLIC void	dissector_add_uint_with_preference (const char *name, const uint32_t pattern, dissector_handle_t handle)
	Add a uint-keyed entry to a dissector table and automatically register a corresponding user preference.
WS_DLL_PUBLIC void	dissector_add_uint_range (const char *abbrev, range_t *range, dissector_handle_t handle)
	Add a range of uint-keyed entries to a dissector table.
WS_DLL_PUBLIC void	dissector_add_uint_range_with_preference (const char *abbrev, const char *range_str, dissector_handle_t handle)
	Add a range of uint-keyed entries to a dissector table and automatically register a corresponding user preference.
WS_DLL_PUBLIC void	dissector_delete_uint (const char *name, const uint32_t pattern, dissector_handle_t handle)
	Remove the entry for a specific uint value from a dissector table.
WS_DLL_PUBLIC void	dissector_delete_uint_range (const char *abbrev, range_t *range, dissector_handle_t handle)
	Remove a range of uint-keyed entries from a dissector table.
WS_DLL_PUBLIC void	dissector_delete_all (const char *name, dissector_handle_t handle)
	Remove all entries for a given dissector handle from a table.
WS_DLL_PUBLIC void	dissector_change_uint (const char *abbrev, const uint32_t pattern, dissector_handle_t handle)
	Override the dissector for a uint value in a dissector table.
WS_DLL_PUBLIC void	dissector_reset_uint (const char *name, const uint32_t pattern)
	Reset a uint dissector table entry to its initial registered value.
WS_DLL_PUBLIC bool	dissector_is_uint_changed (dissector_table_t const sub_dissectors, const uint32_t uint_val)
	Return whether a uint dissector table entry has been overridden.
WS_DLL_PUBLIC int	dissector_try_uint (dissector_table_t sub_dissectors, const uint32_t uint_val, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
	Try to dissect using a uint-keyed dissector table entry.
WS_DLL_PUBLIC int	dissector_try_uint_with_data (dissector_table_t sub_dissectors, const uint32_t uint_val, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, const bool add_proto_name, void *data)
	Try to dissect using a uint-keyed dissector table entry, with additional options and caller data.
WS_DLL_PUBLIC dissector_handle_t	dissector_get_uint_handle (dissector_table_t const sub_dissectors, const uint32_t uint_val)
WS_DLL_PUBLIC dissector_handle_t	dissector_get_default_uint_handle (const char *name, const uint32_t uint_val)
WS_DLL_PUBLIC void	dissector_add_string (const char *name, const char *pattern, dissector_handle_t handle)
	Add a string-keyed entry to a dissector table.
WS_DLL_PUBLIC void	dissector_delete_string (const char *name, const char *pattern, dissector_handle_t handle)
	Remove the entry for a specific string value from a dissector table.
WS_DLL_PUBLIC void	dissector_change_string (const char *name, const char *pattern, dissector_handle_t handle)
	Override the dissector for a string value in a dissector table.
WS_DLL_PUBLIC void	dissector_reset_string (const char *name, const char *pattern)
	Reset a string dissector table entry to its initial registered value.
WS_DLL_PUBLIC bool	dissector_is_string_changed (dissector_table_t const subdissectors, const char *string)
	Return whether a string dissector table entry has been overridden.
WS_DLL_PUBLIC int	dissector_try_string_with_data (dissector_table_t sub_dissectors, const char *string, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, const bool add_proto_name, void *data)
	Look for a given string in a given dissector table and, if found, call the dissector with the arguments supplied, and return the number of bytes consumed, otherwise return 0.
WS_DLL_PUBLIC dissector_handle_t	dissector_get_string_handle (dissector_table_t sub_dissectors, const char *string)
WS_DLL_PUBLIC dissector_handle_t	dissector_get_default_string_handle (const char *name, const char *string)
WS_DLL_PUBLIC void	dissector_add_custom_table_handle (const char *name, void *pattern, dissector_handle_t handle)
	Add an entry to a "custom" dissector table.
WS_DLL_PUBLIC dissector_handle_t	dissector_get_custom_table_handle (dissector_table_t sub_dissectors, void *key)
WS_DLL_PUBLIC void	dissector_add_guid (const char *name, guid_key *guid_val, dissector_handle_t handle)
	Add an entry to a guid dissector table.
WS_DLL_PUBLIC int	dissector_try_guid_with_data (dissector_table_t sub_dissectors, guid_key *guid_val, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, const bool add_proto_name, void *data)
	Look for a given value in a given guid dissector table and, if found, call the dissector with the arguments supplied, and return true, otherwise return false.
WS_DLL_PUBLIC void	dissector_delete_guid (const char *name, guid_key *guid_val, dissector_handle_t handle)
	Delete a GUID from a dissector table.
WS_DLL_PUBLIC dissector_handle_t	dissector_get_guid_handle (dissector_table_t const sub_dissectors, guid_key *guid_val)
WS_DLL_PUBLIC int	dissector_try_payload_with_data (dissector_table_t sub_dissectors, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, const bool add_proto_name, void *data)
	Invoke the currently assigned payload dissector for a dissector table.
WS_DLL_PUBLIC void	dissector_change_payload (const char *abbrev, dissector_handle_t handle)
	Override the payload dissector for an FT_NONE dissector table.
WS_DLL_PUBLIC void	dissector_reset_payload (const char *name)
	Reset an FT_NONE payload dissector table to its initial registered value.
WS_DLL_PUBLIC dissector_handle_t	dissector_get_payload_handle (dissector_table_t const dissector_table)
	Return the currently active dissector handle for a payload dissector table.
WS_DLL_PUBLIC void	dissector_add_for_decode_as (const char *name, dissector_handle_t handle)
	Register a dissector handle as a candidate for Decode As on a table.
WS_DLL_PUBLIC void	dissector_add_for_decode_as_with_preference (const char *name, dissector_handle_t handle)
	Same as dissector_add_for_decode_as(), but also registers a user preference for the dissector table value.
WS_DLL_PUBLIC GSList *	dissector_table_get_dissector_handles (dissector_table_t dissector_table)
	Return the list of all dissector handles registered with a table.
WS_DLL_PUBLIC dissector_handle_t	dissector_table_get_dissector_handle (dissector_table_t dissector_table, const char *description)
	Look up a dissector handle in a table by its description string.
WS_DLL_PUBLIC ftenum_t	dissector_table_get_type (dissector_table_t dissector_table)
	Return the selector field type of a dissector table.
WS_DLL_PUBLIC void	dissector_table_allow_decode_as (dissector_table_t dissector_table)
	Mark a dissector table as supporting Decode As.
WS_DLL_PUBLIC bool	dissector_table_supports_decode_as (dissector_table_t dissector_table)
	Return whether a dissector table supports Decode As.
WS_DLL_PUBLIC heur_dissector_list_t	register_heur_dissector_list_with_description (const char *name, const char *ui_name, const int proto)
WS_DLL_PUBLIC const char *	heur_dissector_list_get_description (heur_dissector_list_t list)
WS_DLL_PUBLIC heur_dissector_list_t	register_heur_dissector_list (const char *name, const int proto)
void	deregister_heur_dissector_list (const char *name)
WS_DLL_PUBLIC void	heur_dissector_table_foreach (const char *table_name, DATFunc_heur func, void *user_data)
WS_DLL_PUBLIC void	dissector_all_heur_tables_foreach_table (DATFunc_heur_table func, void *user_data, GCompareFunc compare_key_func)
WS_DLL_PUBLIC bool	has_heur_dissector_list (const char *name)
	Check if a heuristic dissector list of the given name exists.
WS_DLL_PUBLIC bool	dissector_try_heuristic (heur_dissector_list_t sub_dissectors, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, heur_dtbl_entry_t **hdtbl_entry, void *data)
WS_DLL_PUBLIC heur_dissector_list_t	find_heur_dissector_list (const char *name)
WS_DLL_PUBLIC heur_dtbl_entry_t *	find_heur_dissector_by_unique_short_name (const char *short_name)
WS_DLL_PUBLIC void	heur_dissector_add (const char *name, heur_dissector_t dissector, const char *display_name, const char *internal_name, const int proto, heuristic_enable_e enable)
WS_DLL_PUBLIC void	heur_dissector_delete (const char *name, heur_dissector_t dissector, const int proto)
WS_DLL_PUBLIC dissector_handle_t	register_dissector (const char *name, dissector_t dissector, const int proto)
	Register a new dissector with the global dissector registry.
WS_DLL_PUBLIC dissector_handle_t	register_dissector_with_description (const char *name, const char *description, dissector_t dissector, const int proto)
	Register a new dissector with a custom user-visible description.
WS_DLL_PUBLIC dissector_handle_t	register_dissector_with_data (const char *name, dissector_cb_t dissector, const int proto, void *cb_data)
	Register a new dissector that carries an opaque callback pointer.
void	deregister_dissector (const char *name)
	Deregister a previously registered dissector.
WS_DLL_PUBLIC const char *	dissector_handle_get_protocol_long_name (const dissector_handle_t handle)
	Return the long (full) protocol name for a dissector handle.
WS_DLL_PUBLIC const char *	dissector_handle_get_protocol_short_name (const dissector_handle_t handle)
	Return the short protocol name for a dissector handle.
WS_DLL_PUBLIC const char *	dissector_handle_get_short_name (const dissector_handle_t handle)
	Return the short protocol name for a dissector handle.
WS_DLL_PUBLIC const char *	dissector_handle_get_description (const dissector_handle_t handle)
	Return the user-visible description for a dissector handle.
WS_DLL_PUBLIC int	dissector_handle_get_protocol_index (const dissector_handle_t handle)
	Return the protocol index for a dissector handle.
WS_DLL_PUBLIC GList *	get_dissector_names (void)
	Return a GList of all registered dissector name strings.
WS_DLL_PUBLIC dissector_handle_t	find_dissector (const char *name)
	Find a registered dissector by name.
WS_DLL_PUBLIC dissector_handle_t	find_dissector_add_dependency (const char *name, const int parent_proto)
	Find a registered dissector by name and record a protocol dependency.
WS_DLL_PUBLIC const char *	dissector_handle_get_dissector_name (const dissector_handle_t handle)
	Return the registered name of a dissector from its handle.
WS_DLL_PUBLIC const char *	dissector_handle_get_pref_suffix (const dissector_handle_t handle)
	Return the preferences suffix string for a dissector handle.
WS_DLL_PUBLIC dissector_handle_t	create_dissector_handle (dissector_t dissector, const int proto)
	Create an anonymous, unregistered dissector handle.
WS_DLL_PUBLIC dissector_handle_t	create_dissector_handle_with_name (dissector_t dissector, const int proto, const char *name)
	Create a named, unregistered dissector handle.
WS_DLL_PUBLIC dissector_handle_t	create_dissector_handle_with_name_and_description (dissector_t dissector, const int proto, const char *name, const char *description)
WS_DLL_PUBLIC dissector_handle_t	create_dissector_handle_with_data (dissector_cb_t dissector, const int proto, void *cb_data)
	Create an anonymous, unregistered callback-style dissector handle.
WS_DLL_PUBLIC void	dissector_dump_dissectors (void)
	Dump all registered dissectors to the standard output.
WS_DLL_PUBLIC int	call_dissector_with_data (dissector_handle_t handle, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
	Call a dissector through a handle and if no dissector was found pass it over to the "data" dissector instead.
WS_DLL_PUBLIC int	call_dissector (dissector_handle_t handle, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
	Call a dissector through its handle, falling back to the data dissector.
WS_DLL_PUBLIC int	call_data_dissector (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
	Call a data dissector.
WS_DLL_PUBLIC int	call_dissector_only (dissector_handle_t handle, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
WS_DLL_PUBLIC void	call_heur_dissector_direct (heur_dtbl_entry_t *heur_dtbl_entry, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
WS_DLL_PUBLIC bool	register_depend_dissector (const char *parent, const char *dependent)
WS_DLL_PUBLIC bool	deregister_depend_dissector (const char *parent, const char *dependent)
WS_DLL_PUBLIC depend_dissector_list_t	find_depend_dissector_list (const char *name)
WS_DLL_PUBLIC void	set_actual_length (tvbuff_t *tvb, const unsigned specified_len)
	Given a tvbuff, and a length from a packet header, adjust the length of the tvbuff to reflect the specified length.
WS_DLL_PUBLIC void	register_init_routine (void(*func)(void))
WS_DLL_PUBLIC void	register_cleanup_routine (void(*func)(void))
WS_DLL_PUBLIC void	register_shutdown_routine (void(*func)(void))
void	init_dissection (const char *app_env_var_prefix)
	Initialize all data structures used for dissection.
void	cleanup_dissection (void)
	Free data structures allocated for dissection.
WS_DLL_PUBLIC void	register_postseq_cleanup_routine (void(*func)(void))
	Allow protocols to register a "cleanup" routine to be run after the initial sequential run through the packets. Note that the file can still be open after this; this is not the final cleanup.
WS_DLL_PUBLIC void	postseq_cleanup_all_protocols (void)
	Call all the registered "postseq_cleanup" routines.
WS_DLL_PUBLIC void	register_final_registration_routine (void(*func)(void))
void	final_registration_all_protocols (void)
	Call all the registered "final_registration" routines.
WS_DLL_PUBLIC struct data_source *	add_new_data_source (packet_info *pinfo, tvbuff_t *tvb, const char *name)
WS_DLL_PUBLIC void	set_data_source_name (packet_info *pinfo, struct data_source *src, const char *name)
WS_DLL_PUBLIC void	set_data_source_media_type (struct data_source *src, data_source_media_type_e media_type)
WS_DLL_PUBLIC void	remove_last_data_source (packet_info *pinfo)
	Remove the most recently added data source from a packet.
WS_DLL_PUBLIC const char *	get_data_source_name (const struct data_source *src)
	Return the display name of a data source.
WS_DLL_PUBLIC char *	get_data_source_description (const struct data_source *src)
	Return the description of a data source.
WS_DLL_PUBLIC tvbuff_t *	get_data_source_tvb (const struct data_source *src)
	Return the tvbuff associated with a data source.
WS_DLL_PUBLIC struct data_source *	get_data_source_by_name (const packet_info *pinfo, const char *name)
WS_DLL_PUBLIC struct data_source *	get_data_source_by_tvb (const packet_info *pinfo, const tvbuff_t *tvb)
WS_DLL_PUBLIC data_source_media_type_e	get_data_source_media_type (const struct data_source *src)
void	free_data_sources (packet_info *pinfo)
	Free up a frame's list of data sources.
WS_DLL_PUBLIC void	mark_frame_as_depended_upon (frame_data *fd, uint32_t frame_num)
	Mark another frame as depended upon by the current frame.
void	dissect_record (struct epan_dissect *edt, int file_type_subtype, wtap_rec *rec, frame_data *fd, column_info *cinfo)
	Dissectors should never modify the record data.
void	dissect_file (struct epan_dissect *edt, wtap_rec *rec, frame_data *fd, column_info *cinfo)
	Dissectors should never modify the file data.
WS_DLL_PUBLIC void	dissector_dump_decodes (void)
	Dump layer/selector/dissector records in a fashion similar to the proto_registrar_dump_* routines.
WS_DLL_PUBLIC void	dissector_dump_heur_decodes (void)
	For each heuristic dissector table, dump list of dissectors (filter_names) for that table.
WS_DLL_PUBLIC void	register_postdissector (dissector_handle_t handle)
	Register a postdissector; the argument is the dissector handle for it.
WS_DLL_PUBLIC void	set_postdissector_wanted_hfids (dissector_handle_t handle, GArray *wanted_hfids)
void	deregister_postdissector (dissector_handle_t handle)
	Deregister a postdissector. Not for use in (post)dissectors or applications; only to be used by libwireshark itself.
bool	have_postdissector (void)
	Return whether any postdissectors are registered.
void	call_all_postdissectors (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
	Invoke all registered postdissectors on the current frame.
WS_DLL_PUBLIC bool	postdissectors_want_hfids (void)
	Return whether any postdissector has requested specific hfids.
void	prime_epan_dissect_with_postdissector_wanted_hfids (epan_dissect_t *edt)
	Prime an epan_dissect_t with all hfids requested by postdissectors.
WS_DLL_PUBLIC void	increment_dissection_depth (packet_info *pinfo)
WS_DLL_PUBLIC void	increment_dissection_depth_by_n (packet_info *pinfo, unsigned n)
WS_DLL_PUBLIC void	decrement_dissection_depth (packet_info *pinfo)
	Decrement the dissection depth.
WS_DLL_PUBLIC void	decrement_dissection_depth_by_n (packet_info *pinfo, unsigned n)
	Decrement the dissection depth by a value.

Detailed Description

Definitions for packet disassembly structures and routines

Wireshark - Network traffic analyzer By Gerald Combs geral.nosp@m.d@wi.nosp@m.resha.nosp@m.rk.o.nosp@m.rg Copyright 1998 Gerald Combs

SPDX-License-Identifier: GPL-2.0-or-later