expert.h File Reference

#include <epan/proto.h>
#include <epan/packet_info.h>
#include "value_string.h"
#include "ws_symbol_export.h"

Go to the source code of this file.

Classes
struct	expert_info_s
struct	expert_field
struct	expert_field_info
struct	ei_register_info

Macros
#define	EI_INIT_EI   -1
#define	EI_INIT_HF   -1
#define	EI_INIT   {EI_INIT_EI, EI_INIT_HF}
#define	EXPFILL
#define	PRE_ALLOC_EXPERT_FIELDS_MEM   5000
#define	EXPERT_CHECKSUM_DISABLED   -2
#define	EXPERT_CHECKSUM_UNKNOWN   -1
#define	EXPERT_CHECKSUM_GOOD   0
#define	EXPERT_CHECKSUM_BAD   1

Typedefs
typedef struct expert_info_s	expert_info_t
typedef struct expert_field	expert_field
typedef struct expert_field_info	expert_field_info
typedef struct ei_register_info	ei_register_info
typedef struct expert_module	expert_module_t

Functions
void	expert_init (void)
void	expert_packet_init (void)
void	expert_cleanup (void)
void	expert_packet_cleanup (void)
WS_DLL_PUBLIC int	expert_get_highest_severity (void)
WS_DLL_PUBLIC void	expert_update_comment_count (uint64_t count)
WS_DLL_PUBLIC proto_item *	expert_add_info (packet_info *pinfo, proto_item *pi, expert_field *eiindex)
WS_DLL_PUBLIC proto_item *	expert_add_info_format (packet_info *pinfo, proto_item *pi, expert_field *eiindex, const char *format,...) G_GNUC_PRINTF(4
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item *	proto_tree_add_expert (proto_tree *tree, packet_info *pinfo, expert_field *eiindex, tvbuff_t *tvb, int start, int length)
WS_DLL_PUBLIC proto_item *	proto_tree_add_expert_format (proto_tree *tree, packet_info *pinfo, expert_field *eiindex, tvbuff_t *tvb, int start, int length, const char *format,...) G_GNUC_PRINTF(7
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC expert_module_t *	expert_register_protocol (int id)
void	expert_deregister_expertinfo (const char *abbrev)
void	expert_deregister_protocol (expert_module_t *module)
void	expert_free_deregistered_expertinfos (void)
WS_DLL_PUBLIC const char *	expert_get_summary (expert_field *eiindex)
WS_DLL_PUBLIC void	expert_register_field_array (expert_module_t *module, ei_register_info *ei, const int num_records)

Variables
WS_DLL_PUBLIC int	proto_expert
WS_DLL_PUBLIC const value_string	expert_group_vals []
WS_DLL_PUBLIC const value_string	expert_severity_vals []
WS_DLL_PUBLIC const value_string	expert_checksum_vals []

Detailed Description

Collecting of Expert information.

For further info, see: https://gitlab.com/wireshark/wireshark/-/wikis/Development/ExpertInfo

Wireshark - Network traffic analyzer By Gerald Combs geral.nosp@m.d@wi.nosp@m.resha.nosp@m.rk.o.nosp@m.rg Copyright 1998 Gerald Combs

SPDX-License-Identifier: GPL-2.0-or-later

Macro Definition Documentation

EXPFILL

#define EXPFILL

Value:

        0, NULL, 0, \
        {0, {NULL, NULL, FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL}}

Typedef Documentation

expert_info_t

typedef struct expert_info_s expert_info_t

only for internal and display use.

Function Documentation

expert_add_info()

WS_DLL_PUBLIC proto_item * expert_add_info	(	packet_info *	pinfo,
		proto_item *	pi,
		expert_field *	eiindex
	)

Add an expert info. Add an expert info tree to a protocol item using registered expert info item

Parameters

pinfo	Packet info of the currently processed packet. May be NULL if pi is supplied
pi	Current protocol item (or NULL)
eiindex	The registered expert info item

Returns

the newly created expert info tree

expert_add_info_format()

WS_DLL_PUBLIC proto_item * expert_add_info_format	(	packet_info *	pinfo,
		proto_item *	pi,
		expert_field *	eiindex,
		const char *	format,
			...
	)

Add an expert info. Add an expert info tree to a protocol item using registered expert info item, but with a formatted message.

Parameters

pinfo	Packet info of the currently processed packet. May be NULL if pi is supplied
pi	Current protocol item (or NULL)
eiindex	The registered expert info item
format	Printf-style format string for additional arguments

Returns

the newly created expert info tree

expert_deregister_expertinfo()

void expert_deregister_expertinfo

(

const char *

abbrev

)

Deregister a expert info.

expert_deregister_protocol()

void expert_deregister_protocol

(

expert_module_t *

module

)

Deregister expert info from a protocol.

expert_free_deregistered_expertinfos()

void expert_free_deregistered_expertinfos

(

void

)

Free deregistered expert infos.

expert_get_summary()

WS_DLL_PUBLIC const char * expert_get_summary

(

expert_field *

eiindex

)

Get summary text of an expert_info field. This is intended for use in expert_add_info_format or proto_tree_add_expert_format to get the "base" string to then append additional information

expert_register_field_array()

WS_DLL_PUBLIC void expert_register_field_array	(	expert_module_t *	module,
		ei_register_info *	ei,
		const int	num_records
	)

Register a expert field array.

Parameters

module	the protocol handle from expert_register_protocol()
ei	the ei_register_info array
num_records	the number of records in exp

proto_tree_add_expert()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item * proto_tree_add_expert	(	proto_tree *	tree,
		packet_info *	pinfo,
		expert_field *	eiindex,
		tvbuff_t *	tvb,
		int	start,
		int	length
	)

Add an expert info associated with some byte data Add an expert info tree to a protocol item using registered expert info item. This function is intended to replace places where a "text only" proto_tree_add_xxx API + expert_add_info would be used.

Parameters

tree	Current protocol tree (or NULL)
pinfo	Packet info of the currently processed packet. May be NULL if tree is supplied
eiindex	The registered expert info item
tvb	the tv buffer of the current data
start	start of data in tvb
length	length of data in tvb

Returns

the newly created item above expert info tree

proto_tree_add_expert_format()

WS_DLL_PUBLIC proto_item * proto_tree_add_expert_format	(	proto_tree *	tree,
		packet_info *	pinfo,
		expert_field *	eiindex,
		tvbuff_t *	tvb,
		int	start,
		int	length,
		const char *	format,
			...
	)

Add an expert info associated with some byte data Add an expert info tree to a protocol item, using registered expert info item, but with a formatted message. Add an expert info tree to a protocol item using registered expert info item. This function is intended to replace places where a "text only" proto_tree_add_xxx API + expert_add_info_format would be used.

Parameters

tree	Current protocol tree (or NULL)
pinfo	Packet info of the currently processed packet. May be NULL if tree is supplied
eiindex	The registered expert info item
tvb	the tv buffer of the current data
start	start of data in tvb
length	length of data in tvb
format	Printf-style format string for additional arguments

Returns

the newly created item above expert info tree