Example #1
0
static void
dissect_ppcap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
	proto_item *ti;
	proto_tree *ppcap_tree, *ppcap_tree1;
	guint16 msg_type;
	int offset = 0;
	payload_type_type payload_type = PPCAP_UNKNOWN;

	col_set_str(pinfo->cinfo, COL_PROTOCOL, "PPCAP");
	col_clear(pinfo->cinfo, COL_INFO);

	ti = proto_tree_add_item(tree, proto_ppcap, tvb, 0, -1, ENC_NA);
	ppcap_tree = proto_item_add_subtree(ti, ett_ppcap);

	while (tvb_reported_length_remaining(tvb, offset) > 0)
	{
		msg_type = tvb_get_ntohs(tvb, offset);
		ppcap_tree1 = proto_tree_add_subtree(ppcap_tree, tvb, offset, 2, ett_ppcap1, NULL,
					val_to_str(msg_type, payload_tag_values, "Unknown PPCAP message type (%u)"));
		offset  = offset + 2;
		switch (msg_type) {
		case 1:
			payload_type = PPCAP_UNKNOWN;
			offset = dissect_ppcap_payload_type(tvb, ppcap_tree1, offset, &payload_type);
			break;
		case 2:
			offset = dissect_ppcap_payload_data(tvb, pinfo, ppcap_tree1, offset, tree, payload_type);
			break;
		case 3:
			offset = dissect_ppcap_source_address(tvb, pinfo, ppcap_tree1, offset);
			break;
		case 4:
			offset = dissect_ppcap_destination_address(tvb, pinfo, ppcap_tree1, offset);
			break;
		case 5:
			if(global_ppcap_rev_doc == PPCAP_REV_DOC_2014_MAR)
			offset = dissect_ppcap_local_port(tvb,ppcap_tree1, offset);
			break;
		case 6:
			if(global_ppcap_rev_doc == PPCAP_REV_DOC_2014_MAR)
			offset = dissect_ppcap_remote_port(tvb,ppcap_tree1, offset);
			break;
		case 7:
			if(global_ppcap_rev_doc == PPCAP_REV_DOC_2014_MAR)
			offset = dissect_ppcap_tcp_sip_msg(tvb,ppcap_tree1, offset);
			break;
		case 256:
			if(global_ppcap_rev_doc == PPCAP_REV_DOC_PC1)
			offset = dissect_ppcap_info_string(tvb, ppcap_tree1, offset);
			break;
		}
	}
}
Example #2
0
static void
dissect_ppcap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
	proto_item *ti, *ti1;
	proto_tree *ppcap_tree, *ppcap_tree1;
	guint16 msg_type, msg_len;
	int offset = 0;
	payload_type_type payload_type = PPCAP_UNKNOWN;

	col_set_str(pinfo->cinfo, COL_PROTOCOL, "PPCAP");
	col_clear(pinfo->cinfo, COL_INFO);

	ti = proto_tree_add_item(tree, proto_ppcap, tvb, 0, -1, ENC_NA);
	ppcap_tree = proto_item_add_subtree(ti, ett_ppcap);

	while (tvb_length_remaining(tvb, offset) > 0)
	{
		msg_type = tvb_get_ntohs(tvb, offset);
		ti1 = proto_tree_add_text(ppcap_tree, tvb, offset, 2, "%s",
					val_to_str(msg_type, payload_tag_values, "Unknown PPCAP message type (%u)"));
		ppcap_tree1 = proto_item_add_subtree(ti1, ett_ppcap1);
		offset  = offset + 2;
		msg_len = tvb_get_ntohs(tvb, offset);
		proto_tree_add_item( ppcap_tree1, hf_ppcap_length, tvb, offset, 2, ENC_BIG_ENDIAN);
		offset  = offset + 2;
		switch (msg_type) {
		case 1:
			payload_type = PPCAP_UNKNOWN;
			offset = dissect_ppcap_payload_type(tvb, ppcap_tree1, offset, msg_len, &payload_type);
			break;
		case 2:
			offset = dissect_ppcap_payload_data(tvb, pinfo, ppcap_tree1, offset, msg_len, tree, payload_type);
			break;
		case 3:
			offset = dissect_ppcap_source_address(tvb, pinfo, ppcap_tree1, offset, msg_len);
			break;
		case 4:
			offset = dissect_ppcap_destination_address(tvb, pinfo, ppcap_tree1, offset, msg_len);
			break;
		case 256:
			offset = dissect_ppcap_info_string(tvb, ppcap_tree1, offset, msg_len);
			break;
		}
	}
}