| Wireshark 4.7.3 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
epan.h
Go to the documentation of this file.
1
9#pragma once
10#include <wsutil/feature_list.h>
11#include <epan/tvbuff.h>
12#include <epan/prefs.h>
13#include <epan/frame_data.h>
14#include <epan/register.h>
15#include <wiretap/wtap_opttypes.h>
16
17#ifdef __cplusplus
18 extern "C" {
19#endif /* __cplusplus */
20
28 extern bool wireshark_abort_on_dissector_bug;
29
37 extern bool wireshark_abort_on_too_many_items;
38
45WS_DLL_PUBLIC void ws_dissector_bug(const char *format, ...)
46 G_GNUC_PRINTF(1,2);
47
54#define ws_dissector_oops(_fmt, ...) ws_dissector_bug("OOPS: " _fmt, __VA_ARGS__)
55
62 typedef struct epan_dissect epan_dissect_t;
63
64 struct epan_dfilter;
65 struct epan_column_info;
66
73 struct packet_provider_data;
74
81 struct packet_provider_funcs {
89 const nstime_t *(*get_frame_ts)(struct packet_provider_data *prov, uint32_t frame_num);
90
97 const nstime_t *(*get_start_ts)(struct packet_provider_data *prov);
98
105 const nstime_t *(*get_end_ts)(struct packet_provider_data *prov);
106
115 const char *(*get_interface_name)(struct packet_provider_data *prov, uint32_t interface_id, unsigned section_number);
116
125 const char *(*get_interface_description)(struct packet_provider_data *prov, uint32_t interface_id, unsigned section_number);
126
134 wtap_block_t (*get_modified_block)(struct packet_provider_data *prov, const frame_data *fd);
135
144 int32_t (*get_process_id)(struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number);
145
154 const char *(*get_process_name)(struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number);
155
165 const uint8_t *(*get_process_uuid)(struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number, size_t *uuid_size);
166};
167
175/*
176 Ref 1
177 Epan
178 Enhanced Packet ANalyzer, aka the packet analyzing engine. Source code can be found in the epan directory.
179
180 Protocol-Tree - Keep data of the capture file protocol information.
181
182 Dissectors - The various protocol dissectors in epan/dissectors.
183
184 Plugins - Some of the protocol dissectors are implemented as plugins. Source code can be found at plugins.
185
186 Display-Filters - the display filter engine at epan/dfilter
187
188*/
189
193 typedef struct {
194 const char* env_var_prefix;
195 const char** col_fmt;
196 int num_cols;
197 register_entity_func register_func;
198 register_entity_func handoff_func;
199 struct _tap_reg const* tap_reg_listeners;
200} epan_app_data_t;
201
213WS_DLL_PUBLIC
214 bool epan_init(register_cb cb, void *client_data, bool load_plugins, epan_app_data_t* app_data);
215
221WS_DLL_PUBLIC
222 e_prefs *epan_load_settings(void);
223
230WS_DLL_PUBLIC
231 void epan_cleanup(void);
232
233
241 typedef struct {
245 void (*init)(void);
246
250 void (*post_init)(void);
251
255 void (*dissect_init)(epan_dissect_t *);
256
260 void (*dissect_cleanup)(epan_dissect_t *);
261
265 void (*cleanup)(void);
266
273 void (*register_all_protocols)(register_cb cb, void *user_data);
274
281 void (*register_all_handoffs)(register_cb cb, void *user_data);
282
286 void (*register_all_tap_listeners)(void);
287} epan_plugin;
288
301WS_DLL_PUBLIC void epan_register_plugin(const epan_plugin *plugin);
302
311WS_DLL_PUBLIC int epan_plugins_supported(void);
312
320 void epan_conversation_init(void);
321
322
323 typedef struct epan_session epan_t;
334 typedef struct epan_session epan_t;
335
349WS_DLL_PUBLIC epan_t *epan_new(struct packet_provider_data *prov,
350 const struct packet_provider_funcs *funcs);
351
364WS_DLL_PUBLIC wtap_block_t epan_get_modified_block(const epan_t *session, const frame_data *fd);
365
381WS_DLL_PUBLIC const char *epan_get_interface_name(const epan_t *session, uint32_t interface_id, unsigned section_number);
382
397WS_DLL_PUBLIC const char *epan_get_interface_description(const epan_t *session, uint32_t interface_id, unsigned section_number);
398
415WS_DLL_PUBLIC int32_t epan_get_process_id(const epan_t *session, uint32_t process_info_id, unsigned section_number);
416
433WS_DLL_PUBLIC const char *epan_get_process_name(const epan_t *session, uint32_t process_info_id, unsigned section_number);
434
452WS_DLL_PUBLIC const uint8_t *epan_get_process_uuid(const epan_t *session, uint32_t process_info_id, unsigned section_number, size_t *uuid_size);
453
466 const nstime_t *epan_get_frame_ts(const epan_t *session, uint32_t frame_num);
467
478 const nstime_t *epan_get_start_ts(const epan_t *session);
479
489WS_DLL_PUBLIC void epan_free(epan_t *session);
490
501WS_DLL_PUBLIC const char* epan_get_version(void);
502
516WS_DLL_PUBLIC void epan_get_version_number(int *major, int *minor, int *micro);
517
526WS_DLL_PUBLIC const char* epan_get_environment_prefix(void);
527
542WS_DLL_PUBLIC
543 void epan_set_always_visible(bool force);
544
553WS_DLL_PUBLIC
554 void
555 epan_dissect_init(epan_dissect_t *edt, epan_t *session, const bool create_proto_tree, const bool proto_tree_visible);
556
569WS_DLL_PUBLIC
570 epan_dissect_t*
571 epan_dissect_new(epan_t *session, const bool create_proto_tree, const bool proto_tree_visible);
572
582WS_DLL_PUBLIC
583 void
584 epan_dissect_reset(epan_dissect_t *edt);
585
592WS_DLL_PUBLIC
593 void
594 epan_dissect_fake_protocols(epan_dissect_t *edt, const bool fake_protocols);
595
609WS_DLL_PUBLIC
610 void
611 epan_dissect_run(epan_dissect_t *edt, int file_type_subtype,
612 wtap_rec *rec, frame_data *fd, struct epan_column_info *cinfo);
613
630WS_DLL_PUBLIC
631 void
632 epan_dissect_run_with_taps(epan_dissect_t *edt, int file_type_subtype,
633 wtap_rec *rec, frame_data *fd, struct epan_column_info *cinfo);
634
650WS_DLL_PUBLIC
651 void
652 epan_dissect_file_run(epan_dissect_t *edt, wtap_rec *rec,
653 frame_data *fd, struct epan_column_info *cinfo);
654
671WS_DLL_PUBLIC
672 void
673 epan_dissect_file_run_with_taps(epan_dissect_t *edt, wtap_rec *rec,
674 frame_data *fd, struct epan_column_info *cinfo);
675
692WS_DLL_PUBLIC
693 void
694 epan_dissect_prime_with_dfilter(epan_dissect_t *edt, const struct epan_dfilter *dfcode);
695
709WS_DLL_PUBLIC
710 void
711 epan_dissect_prime_with_dfilter_print(epan_dissect_t *edt, const struct epan_dfilter *dfcode);
712
726WS_DLL_PUBLIC
727 void
728 epan_dissect_prime_with_hfid(epan_dissect_t *edt, int hfid);
729
743WS_DLL_PUBLIC
744 void
745 epan_dissect_prime_with_hfid_array(epan_dissect_t *edt, GArray *hfids);
746
759WS_DLL_PUBLIC
760 void
761 epan_dissect_fill_in_columns(epan_dissect_t *edt, const bool fill_col_exprs, const bool fill_fd_columns);
762
778WS_DLL_PUBLIC
779 bool
780 epan_dissect_packet_contains_field(epan_dissect_t* edt,
781 const char *field_name);
782
796WS_DLL_PUBLIC
797 void
798 epan_dissect_cleanup(epan_dissect_t* edt);
799
810WS_DLL_PUBLIC
811 void
812 epan_dissect_free(epan_dissect_t* edt);
813
831 const char *
832 epan_custom_set(epan_dissect_t *edt, GSList *ids, int occurrence, bool display_details,
833 char *result, char *expr, const int size);
834
840WS_DLL_PUBLIC
841 void
842 epan_gather_compile_info(feature_list l);
843
849WS_DLL_PUBLIC
850 void
851 epan_gather_runtime_info(feature_list l);
852
853#ifdef __cplusplus
854}
855#endif /* __cplusplus */
epan_dissect_init
WS_DLL_PUBLIC void epan_dissect_init(epan_dissect_t *edt, epan_t *session, const bool create_proto_tree, const bool proto_tree_visible)
Initialize an existing single packet dissection.
Definition epan.c:679
epan_dissect_fake_protocols
WS_DLL_PUBLIC void epan_dissect_fake_protocols(epan_dissect_t *edt, const bool fake_protocols)
Indicate whether protocols should be faked during dissection.
Definition epan.c:748
epan_get_process_id
WS_DLL_PUBLIC int32_t epan_get_process_id(const epan_t *session, uint32_t process_info_id, unsigned section_number)
Retrieve the process ID associated with a given process info record.
Definition epan.c:611
epan_init
WS_DLL_PUBLIC bool epan_init(register_cb cb, void *client_data, bool load_plugins, epan_app_data_t *app_data)
Initialize the entire epan module.
Definition epan.c:294
epan_conversation_init
void epan_conversation_init(void)
Initialize the table of conversations.
Definition epan.c:658
epan_dissect_file_run
WS_DLL_PUBLIC void epan_dissect_file_run(epan_dissect_t *edt, wtap_rec *rec, frame_data *fd, struct epan_column_info *cinfo)
Run a dissection of file-based packet data.
Definition epan.c:785
epan_gather_compile_info
WS_DLL_PUBLIC void epan_gather_compile_info(feature_list l)
Get compile-time information for libraries used by libwireshark.
Definition epan.c:916
epan_dissect_cleanup
WS_DLL_PUBLIC void epan_dissect_cleanup(epan_dissect_t *edt)
Release resources associated with a packet dissection context.
Definition epan.c:812
epan_t
struct epan_session epan_t
Represents a dissection session state.
Definition epan.h:323
epan_get_process_name
WS_DLL_PUBLIC const char * epan_get_process_name(const epan_t *session, uint32_t process_info_id, unsigned section_number)
Retrieve the name of a process associated with a given process info record.
Definition epan.c:629
epan_dissect_fill_in_columns
WS_DLL_PUBLIC void epan_dissect_fill_in_columns(epan_dissect_t *edt, const bool fill_col_exprs, const bool fill_fd_columns)
Populate packet list columns with dissection output.
Definition epan.c:887
epan_new
WS_DLL_PUBLIC epan_t * epan_new(struct packet_provider_data *prov, const struct packet_provider_funcs *funcs)
Create a new epan dissection session.
Definition epan.c:538
epan_get_interface_description
WS_DLL_PUBLIC const char * epan_get_interface_description(const epan_t *session, uint32_t interface_id, unsigned section_number)
Retrieve the description of a network interface.
Definition epan.c:571
epan_load_settings
WS_DLL_PUBLIC e_prefs * epan_load_settings(void)
Load all settings from the current profile that affect epan.
Definition epan.c:437
epan_free
WS_DLL_PUBLIC void epan_free(epan_t *session)
Free an epan dissection session.
Definition epan.c:647
epan_dissect_prime_with_hfid
WS_DLL_PUBLIC void epan_dissect_prime_with_hfid(epan_dissect_t *edt, int hfid)
Prime a dissection context's protocol tree with a specific field or protocol.
Definition epan.c:859
epan_dissect_t
struct epan_dissect epan_dissect_t
Opaque type representing a single packet dissection context.
Definition epan.h:62
epan_dissect_reset
WS_DLL_PUBLIC void epan_dissect_reset(epan_dissect_t *edt)
Reset a dissection context for reuse.
Definition epan.c:708
epan_plugins_supported
WS_DLL_PUBLIC int epan_plugins_supported(void)
Check plugin support status for libwireshark components.
Definition epan.c:277
epan_cleanup
WS_DLL_PUBLIC void epan_cleanup(void)
Clean up the entire epan module.
Definition epan.c:456
epan_dissect_free
WS_DLL_PUBLIC void epan_dissect_free(epan_dissect_t *edt)
Free a single packet dissection context.
Definition epan.c:840
epan_get_version_number
WS_DLL_PUBLIC void epan_get_version_number(int *major, int *minor, int *micro)
Retrieve the version number of the epan library.
Definition epan.c:154
epan_get_modified_block
WS_DLL_PUBLIC wtap_block_t epan_get_modified_block(const epan_t *session, const frame_data *fd)
Retrieve a modified capture block associated with a specific frame.
Definition epan.c:553
epan_get_environment_prefix
WS_DLL_PUBLIC const char * epan_get_environment_prefix(void)
Retrieve the environment prefix string used by epan.
Definition epan.c:165
epan_dissect_packet_contains_field
WS_DLL_PUBLIC bool epan_dissect_packet_contains_field(epan_dissect_t *edt, const char *field_name)
Check whether a dissected packet contains a specific named field.
Definition epan.c:894
epan_get_frame_ts
const nstime_t * epan_get_frame_ts(const epan_t *session, uint32_t frame_num)
Retrieve the timestamp of a specific frame.
Definition epan.c:580
epan_dissect_prime_with_dfilter
WS_DLL_PUBLIC void epan_dissect_prime_with_dfilter(epan_dissect_t *edt, const struct epan_dfilter *dfcode)
Prime a dissection context's protocol tree using a display filter.
epan_get_process_uuid
WS_DLL_PUBLIC const uint8_t * epan_get_process_uuid(const epan_t *session, uint32_t process_info_id, unsigned section_number, size_t *uuid_size)
Retrieve the UUID of a process associated with a given process info record.
Definition epan.c:638
epan_get_start_ts
const nstime_t * epan_get_start_ts(const epan_t *session)
Retrieve the start timestamp of the capture session.
Definition epan.c:595
epan_dissect_run
WS_DLL_PUBLIC void epan_dissect_run(epan_dissect_t *edt, int file_type_subtype, wtap_rec *rec, frame_data *fd, struct epan_column_info *cinfo)
Run a single packet dissection.
Definition epan.c:755
epan_gather_runtime_info
WS_DLL_PUBLIC void epan_gather_runtime_info(feature_list l)
Get runtime information for libraries used by libwireshark.
Definition epan.c:1021
epan_dissect_prime_with_hfid_array
WS_DLL_PUBLIC void epan_dissect_prime_with_hfid_array(epan_dissect_t *edt, GArray *hfids)
Prime a dissection context's protocol tree with a set of fields or protocols.
Definition epan.c:865
ws_dissector_bug
WS_DLL_PUBLIC void ws_dissector_bug(const char *format,...)
Report a dissector bug (and optionally abort).
Definition epan.c:128
epan_get_version
WS_DLL_PUBLIC const char * epan_get_version(void)
Retrieve the epan library's version as a string.
Definition epan.c:149
epan_dissect_new
WS_DLL_PUBLIC epan_dissect_t * epan_dissect_new(epan_t *session, const bool create_proto_tree, const bool proto_tree_visible)
Create a new single packet dissection.
Definition epan.c:737
epan_dissect_prime_with_dfilter_print
WS_DLL_PUBLIC void epan_dissect_prime_with_dfilter_print(epan_dissect_t *edt, const struct epan_dfilter *dfcode)
Prime a dissection context's protocol tree using a display filter, marking fields for print output.
epan_dissect_file_run_with_taps
WS_DLL_PUBLIC void epan_dissect_file_run_with_taps(epan_dissect_t *edt, wtap_rec *rec, frame_data *fd, struct epan_column_info *cinfo)
Run a dissection of file-based packet data and invoke tap listeners.
Definition epan.c:799
epan_set_always_visible
WS_DLL_PUBLIC void epan_set_always_visible(bool force)
Set or unset the tree to always be visible when epan_dissect_init() is called.
Definition epan.c:670
epan_dissect_run_with_taps
WS_DLL_PUBLIC void epan_dissect_run_with_taps(epan_dissect_t *edt, int file_type_subtype, wtap_rec *rec, frame_data *fd, struct epan_column_info *cinfo)
Run a single packet dissection and invoke tap listeners.
Definition epan.c:772
epan_custom_set
const char * epan_custom_set(epan_dissect_t *edt, GSList *ids, int occurrence, bool display_details, char *result, char *expr, const int size)
Set the value of a custom column based on specified fields and expression.
Definition epan.c:877
epan_register_plugin
WS_DLL_PUBLIC void epan_register_plugin(const epan_plugin *plugin)
Register an epan plugin with the dissection engine.
epan_get_interface_name
WS_DLL_PUBLIC const char * epan_get_interface_name(const epan_t *session, uint32_t interface_id, unsigned section_number)
Retrieve the name of a network interface.
Definition epan.c:562
feature_list.h
feature_list
GList ** feature_list
Semi-opaque handle to a list of features or dependencies.
Definition feature_list.h:33
frame_data.h
frame_data
DIAG_OFF_PEDANTIC struct _frame_data frame_data
Frame data structure.
prefs.h
e_prefs
struct _e_prefs e_prefs
Global Wireshark preferences structure holding all persistent configuration settings.
register.h
_tap_reg
Describes a single built-in tap registration entry, pairing a tap name with its registration callback...
Definition tap.h:90
client_data
Definition packet-bt-dht.c:97
epan_app_data_t
Information about the application that wants to use epan.
Definition epan.h:193
epan_app_data_t::register_func
register_entity_func register_func
Definition epan.h:197
epan_app_data_t::num_cols
int num_cols
Definition epan.h:196
epan_app_data_t::env_var_prefix
const char * env_var_prefix
Definition epan.h:194
epan_app_data_t::tap_reg_listeners
struct _tap_reg const * tap_reg_listeners
Definition epan.h:199
epan_app_data_t::col_fmt
const char ** col_fmt
Definition epan.h:195
epan_app_data_t::handoff_func
register_entity_func handoff_func
Definition epan.h:198
epan_column_info
Definition column-info.h:59
epan_dfilter
The compiled display filter object passed back to the user.
Definition dfilter-int.h:46
epan_dissect
Holds all state for the dissection of a single byte array, including session, buffer,...
Definition epan_dissect.h:28
epan_plugin
Plugin interface for EPAN modules.
Definition epan.h:241
epan_plugin::dissect_init
void(* dissect_init)(epan_dissect_t *)
Called before each dissection begins.
Definition epan.h:255
epan_plugin::post_init
void(* post_init)(void)
Called at the end of epan_init().
Definition epan.h:250
epan_plugin::register_all_tap_listeners
void(* register_all_tap_listeners)(void)
Register all tap listeners.
Definition epan.h:286
epan_plugin::register_all_handoffs
void(* register_all_handoffs)(register_cb cb, void *user_data)
Register all protocol handoffs.
Definition epan.h:281
epan_plugin::init
void(* init)(void)
Called before proto_init().
Definition epan.h:245
epan_plugin::cleanup
void(* cleanup)(void)
Called during EPAN shutdown.
Definition epan.h:265
epan_plugin::dissect_cleanup
void(* dissect_cleanup)(epan_dissect_t *)
Called after each dissection completes.
Definition epan.h:260
epan_plugin::register_all_protocols
void(* register_all_protocols)(register_cb cb, void *user_data)
Register all protocols with the core.
Definition epan.h:273
epan_session
Definition epan.c:532
nstime_t
Definition nstime.h:26
packet_provider_data
Packet provider context for programs operating on a capture file.
Definition cfile.h:72
packet_provider_funcs
Structure containing pointers to functions supplied by the user of libwireshark.
Definition epan.h:81
packet_provider_funcs::get_modified_block
wtap_block_t(* get_modified_block)(struct packet_provider_data *prov, const frame_data *fd)
Get a modified WTAP block for a given frame.
Definition epan.h:134
packet_provider_funcs::get_process_id
int32_t(* get_process_id)(struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number)
Get the process ID associated with a packet.
Definition epan.h:144
wtap_rec
Represents a single capture record read from or written to a capture file, regardless of record type.
Definition wtap.h:1600
tvbuff.h
wtap_opttypes.h