Wireshark 4.5.0
The Wireshark network protocol analyzer
|
#include <wiretap/wtap.h>
#include <epan/epan.h>
#include <epan/print.h>
#include <epan/fifo_string_cache.h>
#include <ui/packet_range.h>
Go to the source code of this file.
Classes | |
struct | match_data |
struct | print_args_t |
Typedefs | |
typedef void(* | cf_callback_t) (int event, void *data, void *user_data) |
Enumerations | |
enum | cf_status_t { CF_OK , CF_ERROR } |
enum | cf_read_status_t { CF_READ_OK , CF_READ_ERROR , CF_READ_ABORTED } |
enum | cf_write_status_t { CF_WRITE_OK , CF_WRITE_ERROR , CF_WRITE_ABORTED } |
enum | cf_print_status_t { CF_PRINT_OK , CF_PRINT_OPEN_ERROR , CF_PRINT_WRITE_ERROR } |
enum | cf_cbs { cf_cb_file_opened , cf_cb_file_closing , cf_cb_file_closed , cf_cb_file_read_started , cf_cb_file_read_finished , cf_cb_file_reload_started , cf_cb_file_reload_finished , cf_cb_file_rescan_started , cf_cb_file_rescan_finished , cf_cb_file_retap_started , cf_cb_file_retap_finished , cf_cb_file_merge_started , cf_cb_file_merge_finished , cf_cb_file_fast_save_finished , cf_cb_file_save_started , cf_cb_file_save_finished , cf_cb_file_save_failed , cf_cb_file_save_stopped } |
enum | print_range_e { print_range_selected_only , print_range_marked_only , print_range_all_displayed , print_range_all_captured } |
Definitions for file structures and routines
Wireshark - Network traffic analyzer By Gerald Combs geral.nosp@m.d@wi.nosp@m.resha.nosp@m.rk.o.nosp@m.rg Copyright 1998 Gerald Combs
SPDX-License-Identifier: GPL-2.0-or-later
enum cf_print_status_t |
enum cf_read_status_t |
enum cf_status_t |
enum cf_write_status_t |
bool cf_add_ip_name_from_string | ( | capture_file * | cf, |
const char * | addr, | ||
const char * | name | ||
) |
Add a resolved address to this file's list of resolved addresses.
cf | the capture file |
addr | a string representing an IPv4 or IPv6 address |
name | a string containing a name corresponding to that address |
|
extern |
Add a capture file event callback.
func | The function to be called for each event. The function will be passed three parameters: The event type (event), event-dependent data (data), and user-supplied data (user_data). Event-dependent data may be a capture_file pointer, character pointer, or NULL. |
user_data | User-supplied data to pass to the callback. May be NULL. |
|
extern |
Remove a capture file event callback.
func | The function to be removed. |
user_data | User-supplied data. Must be the same value supplied to cf_callback_add. |
bool cf_can_save | ( | capture_file * | cf | ) |
Determine whether this capture file can be saved with a "save" operation; if there's nothing unsaved, it can't.
cf | the capture file to check |
bool cf_can_save_as | ( | capture_file * | cf | ) |
Determine whether this capture file can be saved with a "save as" operation.
cf | the capture file to check |
bool cf_can_write_with_wiretap | ( | capture_file * | cf | ) |
Determine whether this capture file (or a range of it) can be written in any format using Wiretap rather than by copying the raw data.
cf | the capture file to check |
void cf_close | ( | capture_file * | cf | ) |
Close a capture file.
cf | the capture file to be closed |
uint32_t cf_comment_types | ( | capture_file * | cf | ) |
What types of comments does this file have?
cf | the capture file |
cf_read_status_t cf_continue_tail | ( | capture_file * | cf, |
volatile int | to_read, | ||
wtap_rec * | rec, | ||
Buffer * | buf, | ||
int * | err, | ||
fifo_string_cache_t * | frame_dup_cache, | ||
GChecksum * | frame_cksum | ||
) |
cf_write_status_t cf_export_specified_packets | ( | capture_file * | cf, |
const char * | fname, | ||
packet_range_t * | range, | ||
unsigned | save_format, | ||
wtap_compression_type | compression_type | ||
) |
Export some or all packets from a capture file to a new file. If there's already a file with that name, do a "safe save", writing to a temporary file in the same directory and, if the write succeeds, renaming the new file on top of the old file, so that if the write fails, the old file is still intact.
cf | the capture file to write to |
fname | the filename to write to |
range | the range of packets to write |
save_format | the format of the file to write (libpcap, ...) |
compression_type | type of compression to use when writing, if any |
void cf_fake_continue_tail | ( | capture_file * | cf | ) |
Fake reading packets from the "end" of a capture file.
cf | the capture file to be read from |
cf_status_t cf_filter_packets | ( | capture_file * | cf, |
char * | dfilter, | ||
bool | force | ||
) |
"Display Filter" packets in the capture file.
cf | the capture file |
dfilter | the display filter |
force | true if do in any case, false only if dfilter changed |
bool cf_find_packet_data | ( | capture_file * | cf, |
const uint8_t * | string, | ||
size_t | string_size, | ||
search_direction | dir, | ||
bool | multiple | ||
) |
Find packet whose data contains a specified byte string.
cf | the capture file |
string | the string to find |
string_size | the size of the string to find |
dir | direction in which to search |
multiple | whether to look for the next occurrence of the same string in the current packet, or to only match once per frame |
bool cf_find_packet_dfilter | ( | capture_file * | cf, |
dfilter_t * | sfcode, | ||
search_direction | dir, | ||
bool | start_current | ||
) |
Find packet that matches a compiled display filter.
cf | the capture file |
sfcode | the display filter to match |
dir | direction in which to search |
start_current | whether to start searching from the current frame |
bool cf_find_packet_dfilter_string | ( | capture_file * | cf, |
const char * | filter, | ||
search_direction | dir | ||
) |
Find packet that matches a display filter given as a text string.
cf | the capture file |
filter | the display filter to match |
dir | direction in which to search |
bool cf_find_packet_marked | ( | capture_file * | cf, |
search_direction | dir | ||
) |
Find marked packet.
cf | the capture file |
dir | direction in which to search |
bool cf_find_packet_protocol_tree | ( | capture_file * | cf, |
const char * | string, | ||
search_direction | dir, | ||
bool | multiple | ||
) |
Find packet with a protocol tree item that contains a specified text string.
cf | the capture file |
string | the string to find |
dir | direction in which to search |
multiple | whether to look for the next occurrence of the same string in the current packet, or to only match once per frame |
bool cf_find_packet_summary_line | ( | capture_file * | cf, |
const char * | string, | ||
search_direction | dir | ||
) |
Find packet whose summary line contains a specified text string.
cf | the capture file |
string | the string to find |
dir | direction in which to search |
bool cf_find_packet_time_reference | ( | capture_file * | cf, |
search_direction | dir | ||
) |
Find time-reference packet.
cf | the capture file |
dir | direction in which to search |
|
extern |
Find field with a label that contains the text string cfile->sfilter in a protocol tree.
cf | the capture file |
tree | the protocol tree |
cf_read_status_t cf_finish_tail | ( | capture_file * | cf, |
wtap_rec * | rec, | ||
Buffer * | buf, | ||
int * | err, | ||
fifo_string_cache_t * | frame_dup_cache, | ||
GChecksum * | frame_cksum | ||
) |
char * cf_get_basename | ( | capture_file * | cf | ) |
Get a name that can be used to generate a file name from the capture file name. It's based on the displayable name, so it's UTF-8; if it ends with a suffix that's used by a file type libwiretap can read, we strip that suffix off.
cf | the capture file |
unsigned long cf_get_computed_elapsed | ( | capture_file * | cf | ) |
Return the time it took to load the file (in msec).
char * cf_get_display_name | ( | capture_file * | cf | ) |
Get a displayable name of the capture file.
cf | the capture file |
uint32_t cf_get_drops | ( | capture_file * | cf | ) |
Get the number of packet drops while capturing.
cf | the capture file |
bool cf_get_drops_known | ( | capture_file * | cf | ) |
Get flag state, if the number of packet drops while capturing are known or not.
cf | the capture file |
int cf_get_packet_count | ( | capture_file * | cf | ) |
Get the number of packets in the capture file.
cf | the capture file |
const char * cf_get_tempfile_source | ( | capture_file * | cf | ) |
Get the source of the capture data for temporary files. Guaranteed to return a non-null value. The returned value should not be freed.
cf | the capture file |
bool cf_goto_frame | ( | capture_file * | cf, |
unsigned | row, | ||
bool | exact | ||
) |
GoTo Packet with the given row.
cf | the capture file |
row | the row to go to |
exact | if true, fail if the row exists and is filtered (not displayed) if false, go to the nearest displayed packet instead |
bool cf_goto_framenum | ( | capture_file * | cf | ) |
Go to frame specified by currently selected protocol tree field. (Go To Corresponding Packet)
cf | the capture file |
bool cf_has_unsaved_data | ( | capture_file * | cf | ) |
Determine whether this capture file has unsaved data.
cf | the capture file to check |
void cf_ignore_frame | ( | capture_file * | cf, |
frame_data * | frame | ||
) |
Ignore a particular frame in a particular capture.
cf | the capture file |
frame | the frame to be ignored |
bool cf_is_tempfile | ( | capture_file * | cf | ) |
Is this capture file a temporary file?
cf | the capture file |
void cf_mark_frame | ( | capture_file * | cf, |
frame_data * | frame | ||
) |
Mark a particular frame in a particular capture.
cf | the capture file |
frame | the frame to be marked |
cf_status_t cf_merge_files_to_tempfile | ( | void * | pd_window, |
const char * | temp_dir, | ||
char ** | out_filenamep, | ||
int | in_file_count, | ||
const char *const * | in_filenames, | ||
int | file_type, | ||
bool | do_append | ||
) |
Merge two or more capture files into a temporary file.
pd_window | Window pointer suitable for use by delayed_create_progress_dlg. |
out_filenamep | Points to a pointer that's set to point to the pathname of the temporary file; it's allocated with g_malloc() |
in_file_count | the number of input files to merge |
in_filenames | array of input filenames |
file_type | the output filetype |
do_append | false to merge chronologically, true simply append |
cf_status_t cf_open | ( | capture_file * | cf, |
const char * | fname, | ||
unsigned int | type, | ||
bool | is_tempfile, | ||
int * | err | ||
) |
Open a capture file.
cf | the capture file to be opened |
fname | the filename to be opened |
type | WTAP_TYPE_AUTO for automatic or index to direct open routine |
is_tempfile | is this a temporary file? |
err | error code |
cf_print_status_t cf_print_packets | ( | capture_file * | cf, |
print_args_t * | print_args, | ||
bool | show_progress_bar | ||
) |
Print the capture file.
cf | the capture file |
print_args | the arguments what and how to print |
show_progress_bar | true if a progress bar is to be shown |
cf_read_status_t cf_read | ( | capture_file * | cf, |
bool | reloading | ||
) |
Read all packets of a capture file into the internal structures.
cf | the capture file to be read |
reloading | reread asked for from cf_save_records() |
bool cf_read_current_record | ( | capture_file * | cf | ) |
Read the metadata and raw data for the current record into a capture_file structure's rec and buf for the current record. It will pop up an alert box if there's an error.
cf | the capture file from which to read the record |
bool cf_read_record | ( | capture_file * | cf, |
const frame_data * | fdata, | ||
wtap_rec * | rec, | ||
Buffer * | buf | ||
) |
Read the metadata and raw data for a record. It will pop up an alert box if there's an error.
cf | the capture file from which to read the record |
fdata | the frame_data structure for the record in question |
rec | pointer to a wtap_rec structure to contain the record's metadata |
buf | a Buffer into which to read the record's raw data |
bool cf_read_record_no_alert | ( | capture_file * | cf, |
const frame_data * | fdata, | ||
wtap_rec * | rec, | ||
Buffer * | buf | ||
) |
Same as cf_read_record() but does not pop alert box on error
void cf_redissect_packets | ( | capture_file * | cf | ) |
"Something" has changed, rescan all packets.
cf | the capture file |
void cf_reftime_packets | ( | capture_file * | cf | ) |
Scan through all frame data and recalculate the ref time without rereading the file.
cf | the capture file |
cf_status_t cf_reload | ( | capture_file * | cf | ) |
Reload a capture file.
cf | the capture file to be reloaded |
cf_read_status_t cf_retap_packets | ( | capture_file * | cf | ) |
Rescan all packets and just run taps - don't reconstruct the display.
cf | the capture file |
cf_write_status_t cf_save_records | ( | capture_file * | cf, |
const char * | fname, | ||
unsigned | save_format, | ||
wtap_compression_type | compression_type, | ||
bool | discard_comments, | ||
bool | dont_reopen | ||
) |
Save all packets in a capture file to a new file, and, if that succeeds, make that file the current capture file. If there's already a file with that name, do a "safe save", writing to a temporary file in the same directory and, if the write succeeds, renaming the new file on top of the old file, so that if the write fails, the old file is still intact.
cf | the capture file to save to |
fname | the filename to save to |
save_format | the format of the file to save (libpcap, ...) |
compression_type | type of compression to use when writing, if any |
discard_comments | true if we should discard comments if the save succeeds (because we saved in a format that doesn't support comments) |
dont_reopen | true if it shouldn't reopen and make that file the current capture file |
void cf_select_packet | ( | capture_file * | cf, |
frame_data * | frame | ||
) |
Select the packet in the given row.
cf | the capture file |
frame | the frame to be selected |
void cf_set_drops | ( | capture_file * | cf, |
uint32_t | drops | ||
) |
Set the number of packet drops while capturing.
cf | the capture file |
drops | the number of packet drops occurred while capturing |
void cf_set_drops_known | ( | capture_file * | cf, |
bool | drops_known | ||
) |
Set flag, if the number of packet drops while capturing are known or not.
cf | the capture file |
drops_known | true if the number of packet drops are known, false otherwise |
|
extern |
Set maximum number of records per capture file.
max_records | maximum number of records to support. |
bool cf_set_modified_block | ( | capture_file * | cf, |
frame_data * | fd, | ||
const wtap_block_t | new_block | ||
) |
Update(replace) the block on a capture from a frame
cf | the capture file |
fd | the frame_data structure for the frame |
new_block | the block replacing the old block |
void cf_set_rfcode | ( | capture_file * | cf, |
dfilter_t * | rfcode | ||
) |
Set the read filter.
cf | the capture file |
rfcode | the readfilter |
void cf_set_tempfile | ( | capture_file * | cf, |
bool | is_tempfile | ||
) |
Set flag, that this file is a tempfile.
void cf_set_tempfile_source | ( | capture_file * | cf, |
char * | source | ||
) |
Set the source of the capture data for temporary files, e.g. "Interface eth0" or "Pipe from Pong"
cf | the capture file |
source | the source description. this will be copied internally. |
void cf_unignore_frame | ( | capture_file * | cf, |
frame_data * | frame | ||
) |
Unignore a particular frame in a particular capture.
cf | the capture file |
frame | the frame to be unignored |
void cf_unmark_frame | ( | capture_file * | cf, |
frame_data * | frame | ||
) |
Unmark a particular frame in a particular capture.
cf | the capture file |
frame | the frame to be unmarked |
void cf_unselect_packet | ( | capture_file * | cf | ) |
Unselect all packets, if any.
cf | the capture file |
void cf_update_section_comment | ( | capture_file * | cf, |
char * | comment | ||
) |
Update(replace) the comment on a capture from the SHB data block XXX - should support multiple sections.
cf | the capture file |
comment | the string replacing the old comment |
void cf_update_section_comments | ( | capture_file * | cf, |
unsigned | shb_idx, | ||
char ** | comments | ||
) |
Update(replace) the comments on a capture from the SHB data block
cf | the capture file |
shb_idx | the index of the SHB (0-indexed) |
comments | a NULL-terminated string array of comments. The function takes ownership of the string array and frees it and the contents. |
cf_print_status_t cf_write_carrays_packets | ( | capture_file * | cf, |
print_args_t * | print_args | ||
) |
Print (export) the capture file into C Arrays format.
cf | the capture file |
print_args | the arguments what and how to export |
cf_print_status_t cf_write_csv_packets | ( | capture_file * | cf, |
print_args_t * | print_args | ||
) |
Print (export) the capture file into CSV format.
cf | the capture file |
print_args | the arguments what and how to export |
cf_print_status_t cf_write_json_packets | ( | capture_file * | cf, |
print_args_t * | print_args | ||
) |
Print (export) the capture file into JSON format.
cf | the capture file |
print_args | the arguments what and how to export |
cf_print_status_t cf_write_pdml_packets | ( | capture_file * | cf, |
print_args_t * | print_args | ||
) |
Print (export) the capture file into PDML format.
cf | the capture file |
print_args | the arguments what and how to export |
cf_print_status_t cf_write_psml_packets | ( | capture_file * | cf, |
print_args_t * | print_args | ||
) |
Print (export) the capture file into PSML format.
cf | the capture file |
print_args | the arguments what and how to export |