| Wireshark 4.7.3 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
Classes | Macros | Typedefs | Functions | Variables
etl.h File Reference
`#include "wiretap/wtap.h"`
`#include "ws_symbol_export.h"`
`#include "wiretap/wtap_module.h"`
`#include <glib.h>`
`#include <stdlib.h>`
`#include <windows.h>`
`#include <winsock2.h>`
`#include <tdh.h>`
`#include <guiddef.h>`

Go to the source code of this file.

## Classes
struct | SUPER_EVENT_TRACE_PROPERTIES
| Extends EVENT_TRACE_PROPERTIES with padding to accommodate the session and log file name strings that must follow it in memory. More...
struct | _PROVIDER_FILTER
| Specifies the ETW provider filter criteria used to select which events are collected from a provider. More...
struct | _SCENARIO
| Pairs a named capture scenario with the ETW provider filter that defines what is collected for that scenario. More...

## Macros
#define | LOGGER_NAME L"wireshark etwdump"
#define | SCENARIO_KEY L"Scenario-"
| Registry or lookup key prefix used to identify scenario entries by name.

## Typedefs
typedef struct _PROVIDER_FILTER | PROVIDER_FILTER
| Specifies the ETW provider filter criteria used to select which events are collected from a provider.
typedef struct _SCENARIO | SCENARIO
| Pairs a named capture scenario with the ETW provider filter that defines what is collected for that scenario.

## Functions
wtap_open_return_val | etw_dump (const char *etl_filename, const char *pcapng_filename, const char *params, int *err, char **err_info)
| Dumps ETL data to a PCAPNG file.
void | wtap_etl_add_interface (int pkt_encap, const char *interface_name, unsigned short interface_name_length, const char *interface_desc, unsigned short interface_desc_length)
| Adds a new interface to the ETL (Extcap) dump.
void | wtap_etl_rec_dump (char *etl_record, ULONG total_packet_length, ULONG original_packet_length, unsigned int interface_id, BOOLEAN is_inbound, ULARGE_INTEGER timestamp, int pkt_encap, char *comment, unsigned short comment_length)
| Dumps an ETL record as a Wireshark packet.

## Variables
const struct _SCENARIO | g_scenarios []
| Global array of all registered capture scenarios; terminated by a sentinel entry.

## Detailed Description

Copyright 2020, Odysseus Yang

Wireshark - Network traffic analyzer By Gerald Combs geral.nosp@m.d@wi.nosp@m.resha.nosp@m.rk.o.nosp@m.rg Copyright 1998 Gerald Combs

SPDX-License-Identifier: GPL-2.0-or-later

## Function Documentation

## ◆ etw_dump()

wtap_open_return_val etw_dump | ( | const char * | etl_filename,
|  | const char * | pcapng_filename,
|  | const char * | params,
|  | int * | err,
|  | char ** | err_info )
| extern

Dumps ETL data to a PCAPNG file.

Parameters

  etl_filename | The filename of the ETL input file.
  pcapng_filename | The filename of the PCAPNG output file.
  params | Additional parameters for the dump process.
  err | Pointer to an integer that will receive an error code if an error occurs.
  err_info | Pointer to a string that will receive an error message if an error occurs.

Returns
  wtap_open_return_val The result of the dump operation.

## ◆ wtap_etl_add_interface()

void wtap_etl_add_interface | ( | int | pkt_encap,
|  | const char * | interface_name,
|  | unsigned short | interface_name_length,
|  | const char * | interface_desc,
|  | unsigned short | interface_desc_length )
| extern

Adds a new interface to the ETL (Extcap) dump.

This function is used to add a new interface to the ETL dump with the specified parameters.

Parameters

  pkt_encap | The packet encapsulation type for the interface.
  interface_name | The name of the interface.
  interface_name_length | The length of the interface name.
  interface_desc | A description of the interface.
  interface_desc_length | The length of the interface description.

## ◆ wtap_etl_rec_dump()

void wtap_etl_rec_dump | ( | char * | etl_record,
|  | ULONG | total_packet_length,
|  | ULONG | original_packet_length,
|  | unsigned int | interface_id,
|  | BOOLEAN | is_inbound,
|  | ULARGE_INTEGER | timestamp,
|  | int | pkt_encap,
|  | char * | comment,
|  | unsigned short | comment_length )
| extern

Dumps an ETL record as a Wireshark packet.

Parameters

  etl_record | Pointer to the ETL record data.
  total_packet_length | Total length of the packet in bytes.
  original_packet_length | Original length of the packet in bytes.
  interface_id | Interface ID for the packet.
  is_inbound | Boolean indicating if the packet is inbound.
  timestamp | Timestamp of the packet.
  pkt_encap | Packet encapsulation type.
  comment | Optional comment associated with the packet.
  comment_length | Length of the comment in bytes.