/* Returns TRUE if the packet is from a client */
static gboolean
is_client(packet_info *pinfo) {
if (value_is_in_range(gopher_tcp_range, pinfo->destport)) {
return TRUE;
}
return FALSE;
}
/* do we have to process this packet? */
range_process_e packet_range_process_packet(packet_range_t *range, frame_data *fdata) {
if (range->remove_ignored && fdata->flags.ignored) {
return range_process_next;
}
switch(range->process) {
case(range_process_all):
break;
case(range_process_selected):
if (range->selected_done) {
return range_processing_finished;
}
if (fdata->num != cfile.current_frame->num) {
return range_process_next;
}
range->selected_done = TRUE;
break;
case(range_process_marked):
if (fdata->flags.marked == FALSE) {
return range_process_next;
}
break;
case(range_process_marked_range):
if (range->marked_range_left == 0) {
return range_processing_finished;
}
if (fdata->flags.marked == TRUE) {
range->marked_range_active = TRUE;
}
if (range->marked_range_active == FALSE ) {
return range_process_next;
}
if (!range->process_filtered ||
(range->process_filtered && fdata->flags.passed_dfilter == TRUE))
{
range->marked_range_left--;
}
break;
case(range_process_user_range):
if (value_is_in_range(range->user_range, fdata->num) == FALSE) {
return range_process_next;
}
break;
default:
g_assert_not_reached();
}
/* This packet has to pass the display filter but didn't?
* Try next, but only if we're not including dependent packets and this
* packet happens to be a dependency on something that is displayed.
*/
if ((range->process_filtered && fdata->flags.passed_dfilter == FALSE) &&
!(range->include_dependents && fdata->flags.dependent_of_displayed)) {
return range_process_next;
}
/* We fell through the conditions above, so we accept this packet */
return range_process_this;
}
/* (re-)calculate the user specified packet range counts */
static void packet_range_calc_user(packet_range_t *range) {
guint32 framenum;
frame_data *packet;
range->user_range_cnt = 0L;
range->ignored_user_range_cnt = 0L;
range->displayed_user_range_cnt = 0L;
range->displayed_ignored_user_range_cnt = 0L;
/* This doesn't work unless you have a full set of frame_data
* structures for all packets in the capture, which is not,
* for example, the case when TShark is doing a one-pass
* read of a file or a live capture.
*/
if (cfile.frames != NULL) {
for(framenum = 1; framenum <= cfile.count; framenum++) {
packet = frame_data_sequence_find(cfile.frames, framenum);
if (value_is_in_range(range->user_range, framenum)) {
range->user_range_cnt++;
if (packet->flags.ignored) {
range->ignored_user_range_cnt++;
}
if (packet->flags.passed_dfilter) {
range->displayed_user_range_cnt++;
if (packet->flags.ignored) {
range->displayed_ignored_user_range_cnt++;
}
}
}
}
}
}
/* (re-)calculate the user specified packet range counts */
static void packet_range_calc_user(packet_range_t *range) {
guint32 current_count;
frame_data *packet;
range->user_range_cnt = 0L;
range->ignored_user_range_cnt = 0L;
range->displayed_user_range_cnt = 0L;
range->displayed_ignored_user_range_cnt = 0L;
current_count = 0;
for(packet = cfile.plist_start; packet != NULL; packet = packet->next) {
current_count++;
if (value_is_in_range(range->user_range, current_count)) {
range->user_range_cnt++;
if (packet->flags.ignored) {
range->ignored_user_range_cnt++;
}
if (packet->flags.passed_dfilter) {
range->displayed_user_range_cnt++;
if (packet->flags.ignored) {
range->displayed_ignored_user_range_cnt++;
}
}
}
}
}
/* do we have to process this packet? */
range_process_e packet_range_process_packet(packet_range_t *range, frame_data *fdata) {
if (range->remove_ignored && fdata->flags.ignored) {
return range_process_next;
}
switch(range->process) {
case(range_process_all):
break;
case(range_process_selected):
if (range->selected_done) {
return range_processing_finished;
}
if (fdata->num != cfile.current_frame->num) {
return range_process_next;
}
range->selected_done = TRUE;
break;
case(range_process_marked):
if (fdata->flags.marked == FALSE) {
return range_process_next;
}
break;
case(range_process_marked_range):
if (range->marked_range_left == 0) {
return range_processing_finished;
}
if (fdata->flags.marked == TRUE) {
range->marked_range_active = TRUE;
}
if (range->marked_range_active == FALSE ) {
return range_process_next;
}
if (!range->process_filtered ||
(range->process_filtered && fdata->flags.passed_dfilter == TRUE))
{
range->marked_range_left--;
}
break;
case(range_process_user_range):
if (value_is_in_range(range->user_range, fdata->num) == FALSE) {
return range_process_next;
}
break;
default:
g_assert_not_reached();
}
/* this packet has to pass the display filter but didn't? -> try next */
if (range->process_filtered && fdata->flags.passed_dfilter == FALSE) {
return range_process_next;
}
/* We fell through the conditions above, so we accept this packet */
return range_process_this;
}
/* This is a debug function to check the range functionality */
static void
value_is_in_range_check(range_t *range, guint32 val)
{
/* Print the result for a given value */
printf("Function : value_is_in_range_check Number %u\t",val);
if (value_is_in_range(range, val)) {
printf("is in range\n");
} else {
printf("is not in range\n");
}
}
/* (re-)calculate the user specified packet range counts */
static void packet_range_calc_user(packet_range_t *range) {
guint32 framenum;
frame_data *packet;
range->user_range_cnt = 0;
range->ignored_user_range_cnt = 0;
range->displayed_user_range_cnt = 0;
range->displayed_ignored_user_range_cnt = 0;
g_assert(range->cf != NULL);
/* XXX - this doesn't work unless you have a full set of frame_data
* structures for all packets in the capture, which is not,
* for example, the case when TShark is doing a one-pass
* read of a file or a live capture.
*
* It's also horribly slow on large captures, causing it to
* take a long time for the Save As dialog to pop up, for
* example. This obviously can't be kept in the capture_file
* structure and recalculated whenever we filter the display
* or mark frames as ignored, as the results of this depend
* on what the user specifies. In some cases, limiting the
* frame_data structures at which we look to the ones specified
* by the user might help, but if most of the frames are in
* the range, that won't help. In that case, if we could
* examine the *complement* of the range, and *subtract* them
* from the statistics for the capture as a whole, that might
* help, but if the user specified about *half* the packets in
* the range, that won't help, either.
*/
if (range->cf->frames != NULL) {
for(framenum = 1; framenum <= range->cf->count; framenum++) {
packet = frame_data_sequence_find(range->cf->frames, framenum);
if (value_is_in_range(range->user_range, framenum)) {
range->user_range_cnt++;
if (packet->flags.ignored) {
range->ignored_user_range_cnt++;
}
if (packet->flags.passed_dfilter) {
range->displayed_user_range_cnt++;
if (packet->flags.ignored) {
range->displayed_ignored_user_range_cnt++;
}
}
}
}
}
}
