| Wireshark 4.7.3 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
Public Attributes | List of all members
_RRPD Struct Reference

Fully Qualified Message ID representing a Request-Response Pair Descriptor (RRPD), used to correlate request and response frames across a conversation. More...

`#include <packet-transum.h>`

## Public Attributes
bool | c2s
uint8_t | ip_proto
uint32_t | stream_no
uint64_t | session_id
uint64_t | msg_id
bool | decode_based
bool | is_retrans
uint32_t | req_first_frame
nstime_t | req_first_rtime
uint32_t | req_last_frame
nstime_t | req_last_rtime
uint32_t | rsp_first_frame
nstime_t | rsp_first_rtime
uint32_t | rsp_last_frame
nstime_t | rsp_last_rtime
unsigned | calculation
uint32_t | req_search_total
uint32_t | rsp_search_total

## Detailed Description

Fully Qualified Message ID representing a Request-Response Pair Descriptor (RRPD), used to correlate request and response frames across a conversation.

## Member Data Documentation

## ◆ c2s

bool _RRPD::c2s

True if the associated packet is client-to-service; false if service-to-client. Only valid when this RRPD is embedded in a subpacket structure.

## ◆ calculation

unsigned _RRPD::calculation

Identifier of the RR calculation method (e.g. GTCP, GUDP, DCERPC) used to detect this pair.

## ◆ decode_based

bool _RRPD::decode_based

True if APDU boundaries are determined by application-protocol decoding (e.g. DCERPC); false if determined by a stream direction change.

## ◆ ip_proto

uint8_t _RRPD::ip_proto

IP protocol number (e.g. IPPROTO_TCP, IPPROTO_UDP) for this request-response pair.

## ◆ is_retrans

bool _RRPD::is_retrans

True if this RRPD was identified as a retransmission and should be excluded from response-time calculations.

## ◆ msg_id

uint64_t _RRPD::msg_id

Application-layer message identifier uniquely distinguishing this request-response pair within the session.

## ◆ req_first_frame

uint32_t _RRPD::req_first_frame

Wireshark frame number of the first frame of the request APDU.

## ◆ req_first_rtime

nstime_t _RRPD::req_first_rtime

Capture-relative timestamp of the first frame of the request APDU.

## ◆ req_last_frame

uint32_t _RRPD::req_last_frame

Wireshark frame number of the last frame of the request APDU.

## ◆ req_last_rtime

nstime_t _RRPD::req_last_rtime

Capture-relative timestamp of the last frame of the request APDU.

## ◆ req_search_total

uint32_t _RRPD::req_search_total

Cumulative number of steps taken backwards through the rrpd_list when matching requests to this entry; used for performance tuning.

## ◆ rsp_first_frame

uint32_t _RRPD::rsp_first_frame

Wireshark frame number of the first frame of the response APDU.

## ◆ rsp_first_rtime

nstime_t _RRPD::rsp_first_rtime

Capture-relative timestamp of the first frame of the response APDU.

## ◆ rsp_last_frame

uint32_t _RRPD::rsp_last_frame

Wireshark frame number of the last frame of the response APDU.

## ◆ rsp_last_rtime

nstime_t _RRPD::rsp_last_rtime

Capture-relative timestamp of the last frame of the response APDU.

## ◆ rsp_search_total

uint32_t _RRPD::rsp_search_total

Cumulative number of steps taken backwards through the rrpd_list when matching responses to this entry; used for performance tuning.

## ◆ session_id

uint64_t _RRPD::session_id

Application-layer session identifier, used by protocols that multiplex sessions over a single stream.

## ◆ stream_no

uint32_t _RRPD::stream_no

Wireshark transport stream index identifying the TCP or UDP stream carrying this pair.

The documentation for this struct was generated from the following file:

- /builds/wireshark/wireshark/plugins/epan/transum/packet-transum.h