static void
dissect_ppcap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
proto_item *ti;
proto_tree *ppcap_tree, *ppcap_tree1;
guint16 msg_type;
int offset = 0;
payload_type_type payload_type = PPCAP_UNKNOWN;
col_set_str(pinfo->cinfo, COL_PROTOCOL, "PPCAP");
col_clear(pinfo->cinfo, COL_INFO);
ti = proto_tree_add_item(tree, proto_ppcap, tvb, 0, -1, ENC_NA);
ppcap_tree = proto_item_add_subtree(ti, ett_ppcap);
while (tvb_reported_length_remaining(tvb, offset) > 0)
{
msg_type = tvb_get_ntohs(tvb, offset);
ppcap_tree1 = proto_tree_add_subtree(ppcap_tree, tvb, offset, 2, ett_ppcap1, NULL,
val_to_str(msg_type, payload_tag_values, "Unknown PPCAP message type (%u)"));
offset = offset + 2;
switch (msg_type) {
case 1:
payload_type = PPCAP_UNKNOWN;
offset = dissect_ppcap_payload_type(tvb, ppcap_tree1, offset, &payload_type);
break;
case 2:
offset = dissect_ppcap_payload_data(tvb, pinfo, ppcap_tree1, offset, tree, payload_type);
break;
case 3:
offset = dissect_ppcap_source_address(tvb, pinfo, ppcap_tree1, offset);
break;
case 4:
offset = dissect_ppcap_destination_address(tvb, pinfo, ppcap_tree1, offset);
break;
case 5:
if(global_ppcap_rev_doc == PPCAP_REV_DOC_2014_MAR)
offset = dissect_ppcap_local_port(tvb,ppcap_tree1, offset);
break;
case 6:
if(global_ppcap_rev_doc == PPCAP_REV_DOC_2014_MAR)
offset = dissect_ppcap_remote_port(tvb,ppcap_tree1, offset);
break;
case 7:
if(global_ppcap_rev_doc == PPCAP_REV_DOC_2014_MAR)
offset = dissect_ppcap_tcp_sip_msg(tvb,ppcap_tree1, offset);
break;
case 256:
if(global_ppcap_rev_doc == PPCAP_REV_DOC_PC1)
offset = dissect_ppcap_info_string(tvb, ppcap_tree1, offset);
break;
}
}
}
static void
dissect_ppcap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
proto_item *ti, *ti1;
proto_tree *ppcap_tree, *ppcap_tree1;
guint16 msg_type, msg_len;
int offset = 0;
payload_type_type payload_type = PPCAP_UNKNOWN;
col_set_str(pinfo->cinfo, COL_PROTOCOL, "PPCAP");
col_clear(pinfo->cinfo, COL_INFO);
ti = proto_tree_add_item(tree, proto_ppcap, tvb, 0, -1, ENC_NA);
ppcap_tree = proto_item_add_subtree(ti, ett_ppcap);
while (tvb_length_remaining(tvb, offset) > 0)
{
msg_type = tvb_get_ntohs(tvb, offset);
ti1 = proto_tree_add_text(ppcap_tree, tvb, offset, 2, "%s",
val_to_str(msg_type, payload_tag_values, "Unknown PPCAP message type (%u)"));
ppcap_tree1 = proto_item_add_subtree(ti1, ett_ppcap1);
offset = offset + 2;
msg_len = tvb_get_ntohs(tvb, offset);
proto_tree_add_item( ppcap_tree1, hf_ppcap_length, tvb, offset, 2, ENC_BIG_ENDIAN);
offset = offset + 2;
switch (msg_type) {
case 1:
payload_type = PPCAP_UNKNOWN;
offset = dissect_ppcap_payload_type(tvb, ppcap_tree1, offset, msg_len, &payload_type);
break;
case 2:
offset = dissect_ppcap_payload_data(tvb, pinfo, ppcap_tree1, offset, msg_len, tree, payload_type);
break;
case 3:
offset = dissect_ppcap_source_address(tvb, pinfo, ppcap_tree1, offset, msg_len);
break;
case 4:
offset = dissect_ppcap_destination_address(tvb, pinfo, ppcap_tree1, offset, msg_len);
break;
case 256:
offset = dissect_ppcap_info_string(tvb, ppcap_tree1, offset, msg_len);
break;
}
}
}