| Wireshark 4.7.3 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
Classes | Macros | Typedefs | Enumerations | Functions
follow.h File Reference
`#include <epan/epan.h>`
`#include <epan/packet.h>`
`#include <wsutil/inet_cidr.h>`
`#include <epan/tap.h>`
`#include <epan/wmem_scopes.h>`
`#include "ws_symbol_export.h"`

Go to the source code of this file.

## Classes
union | _stream_addr
| Represents an IP address for a stream, supporting both IPv4 and IPv6. More...
struct | follow_record_t
| Represents a single chunk of data from one side of a followed stream. More...
struct | _follow_info
| Aggregates all state for following and reassembling a single stream across both client and server directions. More...
struct | _follow_stream_tap_data

## Macros
#define | SUBSTREAM_UNUSED UINT64_C(0xFFFFFFFFFFFFFFFF)

## Typedefs
typedef union _stream_addr | stream_addr
| Represents an IP address for a stream, supporting both IPv4 and IPv6.
typedef struct _follow_info | follow_info_t
| Aggregates all state for following and reassembling a single stream across both client and server directions.
typedef struct register_follow | register_follow_t
typedef char *(* | follow_conv_filter_func) (epan_dissect_t *edt, packet_info *pinfo, unsigned *stream, unsigned *sub_stream)
typedef char *(* | follow_index_filter_func) (unsigned stream, unsigned sub_stream)
typedef char *(* | follow_address_filter_func) (address *src_addr, address *dst_addr, int src_port, int dst_port)
typedef char *(* | follow_port_to_display_func) (wmem_allocator_t *allocator, unsigned port)
typedef uint32_t(* | follow_stream_count_func) (void)
typedef bool(* | follow_sub_stream_id_func) (unsigned stream, unsigned sub_stream, bool le, unsigned *sub_stream_out)
typedef struct _follow_stream_tap_data | follow_stream_tap_data_t

## Enumerations
enum | show_stream_t { FROM_CLIENT , FROM_SERVER , BOTH_HOSTS }
| Indicates the direction of a network stream for display purposes. More...

## Functions
void | follow_init (void)
WS_DLL_PUBLIC void | register_follow_stream (const int proto_id, const char *tap_listener, follow_conv_filter_func conv_filter, follow_index_filter_func index_filter, follow_address_filter_func address_filter, follow_port_to_display_func port_to_display, tap_packet_cb tap_handler, follow_stream_count_func stream_count, follow_sub_stream_id_func sub_stream_id)
| Register a new follow stream.
WS_DLL_PUBLIC int | get_follow_proto_id (register_follow_t *follower)
| Get protocol ID from registered follower.
WS_DLL_PUBLIC const char * | get_follow_tap_string (register_follow_t *follower)
| Get tap name string from registered follower (used for register_tap_listener).
WS_DLL_PUBLIC register_follow_t * | get_follow_by_name (const char *proto_short_name)
| Get a registered follower by protocol short name.
WS_DLL_PUBLIC register_follow_t * | get_follow_by_proto_id (const int proto_id)
| Get a registered follower by protocol id.
WS_DLL_PUBLIC follow_conv_filter_func | get_follow_conv_func (register_follow_t *follower)
| Provide function that builds a follow filter based on the current packet's conversation.
WS_DLL_PUBLIC follow_index_filter_func | get_follow_index_func (register_follow_t *follower)
| Provide function that builds a follow filter based on stream.
WS_DLL_PUBLIC follow_address_filter_func | get_follow_address_func (register_follow_t *follower)
| Provide function that builds a follow filter based on address/port pairs.
WS_DLL_PUBLIC follow_port_to_display_func | get_follow_port_to_display (register_follow_t *follower)
| Provide function that resolves port number to name based on follower.
WS_DLL_PUBLIC tap_packet_cb | get_follow_tap_handler (register_follow_t *follower)
| Provide function that handles tap data (tap_packet_cb parameter of register_tap_listener).
WS_DLL_PUBLIC follow_stream_count_func | get_follow_stream_count_func (register_follow_t *follower)
| Provide function that gets the total number of streams for a registered follower The function can be NULL if the follower does not count the number of streams.
WS_DLL_PUBLIC follow_sub_stream_id_func | get_follow_sub_stream_id_func (register_follow_t *follower)
| Retrieve the next sub-stream ID for a given stream and stream ID.
WS_DLL_PUBLIC tap_packet_status | follow_stream_tap_listener (void *tapdata, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data, tap_flags_t flags)
| Tap listener for dissectors that export follow data with a tvb and the stream id[s].
WS_DLL_PUBLIC tap_packet_status | follow_tvb_tap_listener (void *tapdata, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data, tap_flags_t flags)
| Tap listener for dissectors that export follow data via a tvb.
WS_DLL_PUBLIC void | follow_iterate_followers (wmem_foreach_func func, void *user_data)
| Iterator to walk all registered followers and execute func.
WS_DLL_PUBLIC char * | follow_get_stat_tap_string (register_follow_t *follower)
| Generate -z stat (tap) name for a follower Currently used only by TShark.
WS_DLL_PUBLIC void | follow_reset_stream (follow_info_t *info)
| Clear payload, fragments, counters, addresses, and ports of follow_info_t for retapping.
WS_DLL_PUBLIC void | follow_info_free (follow_info_t *follow_info)
| Free follow_info_t structure Free everything except the GUI element.

## Detailed Description

Copyright 1998 Mike Hall mlh@i.nosp@m.o.co.nosp@m.m

Wireshark - Network traffic analyzer By Gerald Combs geral.nosp@m.d@wi.nosp@m.resha.nosp@m.rk.o.nosp@m.rg Copyright 1998 Gerald Combs

SPDX-License-Identifier: GPL-2.0-or-later

## Typedef Documentation

## ◆ stream_addr

typedef union _stream_addr stream_addr

Represents an IP address for a stream, supporting both IPv4 and IPv6.

This union allows flexible storage of either an IPv4 or IPv6 address for stream identification or filtering.

## Enumeration Type Documentation

## ◆ show_stream_t

enum show_stream_t

Indicates the direction of a network stream for display purposes.

Used to filter or label stream data based on its origin.

Enumerator
FROM_CLIENT | Data originating from the client.
FROM_SERVER | Data originating from the server.
BOTH_HOSTS | Data from client or server.

## Function Documentation

## ◆ follow_get_stat_tap_string()

WS_DLL_PUBLIC char * follow_get_stat_tap_string | ( | register_follow_t * | follower | ) |

Generate -z stat (tap) name for a follower Currently used only by TShark.

Parameters

  follower | [in] Registered follower

Returns
  A tap data handler

## ◆ follow_info_free()

WS_DLL_PUBLIC void follow_info_free | ( | follow_info_t * | follow_info | ) |

Free follow_info_t structure Free everything except the GUI element.

Parameters

  follow_info | [in] follower info

## ◆ follow_init()

void follow_init | ( | void |  | ) |
| extern

Initialize the follow conversation/stream system.

## ◆ follow_iterate_followers()

WS_DLL_PUBLIC void follow_iterate_followers | ( | wmem_foreach_func | func,
|  | void * | user_data )

Iterator to walk all registered followers and execute func.

Parameters

  func | action to be performed on all conversation tables
  user_data | any data needed to help perform function

## ◆ follow_reset_stream()

WS_DLL_PUBLIC void follow_reset_stream | ( | follow_info_t * | info | ) |

Clear payload, fragments, counters, addresses, and ports of follow_info_t for retapping.

Does not clear substream_id, which is used for selecting which tvbs are tapped. Free everything except the GUI element and the follow_info_t structure itself

Parameters

  info | [in] follower info

## ◆ follow_stream_tap_listener()

WS_DLL_PUBLIC tap_packet_status follow_stream_tap_listener | ( | void * | tapdata,
|  | packet_info * | pinfo,
|  | epan_dissect_t *edt | _U_,
|  | const void * | data,
|  | tap_flags_t | flags )

Tap listener for dissectors that export follow data with a tvb and the stream id[s].

If a frame can contain follow data from multiple streams for the same protocol, this allows follow taps to select only the data for the stream being followed. This also allows the follow tap to assign data to the client or server side by using the source and destination addresses and ports as they were at the time of tapping, instead of using the values from pinfo, which may be different, e.g., when there is tunneling.

Parameters

  tapdata | Opaque follow‑tap context (typically a follow_info struct).
  pinfo | Packet metadata for the current frame.
  edt | Dissection tree (unused).
  data | Protocol‑specific follow data, expected to contain a follow_stream_tap_data_t
  flags | Tap flags describing packet‑level conditions.

Returns
  tap_packet_status indicating whether UI components should update.

## ◆ follow_tvb_tap_listener()

WS_DLL_PUBLIC tap_packet_status follow_tvb_tap_listener | ( | void * | tapdata,
|  | packet_info * | pinfo,
|  | epan_dissect_t *edt | _U_,
|  | const void * | data,
|  | tap_flags_t | flags )

Tap listener for dissectors that export follow data via a tvb.

Tap function handler when dissector's tap provides follow data as a tvb. Used by TCP, UDP and HTTP followers

Parameters

  tapdata | Opaque follow‑tap context (typically a follow_info struct).
  pinfo | Packet metadata for the current frame.
  edt | Dissection tree (unused).
  data | Protocol‑specific follow data, expected to contain a tvb.
  flags | Tap flags describing packet‑level conditions.

Returns
  tap_packet_status indicating whether UI components should update.

## ◆ get_follow_address_func()

WS_DLL_PUBLIC follow_address_filter_func get_follow_address_func | ( | register_follow_t * | follower | ) |

Provide function that builds a follow filter based on address/port pairs.

Parameters

  follower | [in] Registered follower

Returns
  A filter function handler

## ◆ get_follow_by_name()

WS_DLL_PUBLIC register_follow_t * get_follow_by_name | ( | const char * | proto_short_name | ) |

Get a registered follower by protocol short name.

Parameters

  proto_short_name | Protocol short name

Returns
  tap registered follower if match, otherwise NULL

## ◆ get_follow_by_proto_id()

WS_DLL_PUBLIC register_follow_t * get_follow_by_proto_id | ( | const int | proto_id | ) |

Get a registered follower by protocol id.

Parameters

  proto_id | Protocol Id

Returns
  tap registered follower if match, otherwise NULL

## ◆ get_follow_conv_func()

WS_DLL_PUBLIC follow_conv_filter_func get_follow_conv_func | ( | register_follow_t * | follower | ) |

Provide function that builds a follow filter based on the current packet's conversation.

Parameters

  follower | [in] Registered follower

Returns
  A filter function handler

## ◆ get_follow_index_func()

WS_DLL_PUBLIC follow_index_filter_func get_follow_index_func | ( | register_follow_t * | follower | ) |

Provide function that builds a follow filter based on stream.

Parameters

  follower | [in] Registered follower

Returns
  A filter function handler

## ◆ get_follow_port_to_display()

WS_DLL_PUBLIC follow_port_to_display_func get_follow_port_to_display | ( | register_follow_t * | follower | ) |

Provide function that resolves port number to name based on follower.

Parameters

  follower | [in] Registered follower

Returns
  A port resolver function handler

## ◆ get_follow_proto_id()

WS_DLL_PUBLIC int get_follow_proto_id | ( | register_follow_t * | follower | ) |

Get protocol ID from registered follower.

Parameters

  follower | Registered follower

Returns
  protocol id of follower

## ◆ get_follow_stream_count_func()

WS_DLL_PUBLIC follow_stream_count_func get_follow_stream_count_func | ( | register_follow_t * | follower | ) |

Provide function that gets the total number of streams for a registered follower The function can be NULL if the follower does not count the number of streams.

Parameters

  follower | [in] Registered follower

Returns
  A stream count handler

## ◆ get_follow_sub_stream_id_func()

WS_DLL_PUBLIC follow_sub_stream_id_func get_follow_sub_stream_id_func | ( | register_follow_t * | follower | ) |

Retrieve the next sub-stream ID for a given stream and stream ID.

Provide function that, for given stream and sub stream ids, searches for the first sub stream id less than or equal (or greater than or equal) the given sub stream id present on the given stream id. Returns true and the sub stream id found, or false. This is used by the GUI to select valid sub stream numbers, e.g. when incrementing or decrementing the sub stream ID widget. This function should be NULL if the follower does not have sub streams.

Parameters

  follower | [in] Registered follower

Returns
  A sub stream id function handler

## ◆ get_follow_tap_handler()

WS_DLL_PUBLIC tap_packet_cb get_follow_tap_handler | ( | register_follow_t * | follower | ) |

Provide function that handles tap data (tap_packet_cb parameter of register_tap_listener).

Parameters

  follower | [in] Registered follower

Returns
  A tap packet handler

## ◆ get_follow_tap_string()

WS_DLL_PUBLIC const char * get_follow_tap_string | ( | register_follow_t * | follower | ) |

Get tap name string from registered follower (used for register_tap_listener).

Parameters

  follower | Registered follower

Returns
  tap name string of follower

## ◆ register_follow_stream()

WS_DLL_PUBLIC void register_follow_stream | ( | const int | proto_id,
|  | const char * | tap_listener,
|  | follow_conv_filter_func | conv_filter,
|  | follow_index_filter_func | index_filter,
|  | follow_address_filter_func | address_filter,
|  | follow_port_to_display_func | port_to_display,
|  | tap_packet_cb | tap_handler,
|  | follow_stream_count_func | stream_count,
|  | follow_sub_stream_id_func | sub_stream_id )

Register a new follow stream.

Parameters

  proto_id | Protocol ID.
  tap_listener | TAP listener name.
  conv_filter | Conversation filter function.
  index_filter | Index filter function.
  address_filter | Address filter function.
  port_to_display | Port to display function.
  tap_handler | TAP handler function.
  stream_count | Stream count function.
  sub_stream_id | Sub-stream ID function.