/* Returns TRUE if the packet is from a client */ static gboolean is_client(packet_info *pinfo) { if (value_is_in_range(gopher_tcp_range, pinfo->destport)) { return TRUE; } return FALSE; }
/* do we have to process this packet? */ range_process_e packet_range_process_packet(packet_range_t *range, frame_data *fdata) { if (range->remove_ignored && fdata->flags.ignored) { return range_process_next; } switch(range->process) { case(range_process_all): break; case(range_process_selected): if (range->selected_done) { return range_processing_finished; } if (fdata->num != cfile.current_frame->num) { return range_process_next; } range->selected_done = TRUE; break; case(range_process_marked): if (fdata->flags.marked == FALSE) { return range_process_next; } break; case(range_process_marked_range): if (range->marked_range_left == 0) { return range_processing_finished; } if (fdata->flags.marked == TRUE) { range->marked_range_active = TRUE; } if (range->marked_range_active == FALSE ) { return range_process_next; } if (!range->process_filtered || (range->process_filtered && fdata->flags.passed_dfilter == TRUE)) { range->marked_range_left--; } break; case(range_process_user_range): if (value_is_in_range(range->user_range, fdata->num) == FALSE) { return range_process_next; } break; default: g_assert_not_reached(); } /* This packet has to pass the display filter but didn't? * Try next, but only if we're not including dependent packets and this * packet happens to be a dependency on something that is displayed. */ if ((range->process_filtered && fdata->flags.passed_dfilter == FALSE) && !(range->include_dependents && fdata->flags.dependent_of_displayed)) { return range_process_next; } /* We fell through the conditions above, so we accept this packet */ return range_process_this; }
/* (re-)calculate the user specified packet range counts */ static void packet_range_calc_user(packet_range_t *range) { guint32 framenum; frame_data *packet; range->user_range_cnt = 0L; range->ignored_user_range_cnt = 0L; range->displayed_user_range_cnt = 0L; range->displayed_ignored_user_range_cnt = 0L; /* This doesn't work unless you have a full set of frame_data * structures for all packets in the capture, which is not, * for example, the case when TShark is doing a one-pass * read of a file or a live capture. */ if (cfile.frames != NULL) { for(framenum = 1; framenum <= cfile.count; framenum++) { packet = frame_data_sequence_find(cfile.frames, framenum); if (value_is_in_range(range->user_range, framenum)) { range->user_range_cnt++; if (packet->flags.ignored) { range->ignored_user_range_cnt++; } if (packet->flags.passed_dfilter) { range->displayed_user_range_cnt++; if (packet->flags.ignored) { range->displayed_ignored_user_range_cnt++; } } } } } }
/* (re-)calculate the user specified packet range counts */ static void packet_range_calc_user(packet_range_t *range) { guint32 current_count; frame_data *packet; range->user_range_cnt = 0L; range->ignored_user_range_cnt = 0L; range->displayed_user_range_cnt = 0L; range->displayed_ignored_user_range_cnt = 0L; current_count = 0; for(packet = cfile.plist_start; packet != NULL; packet = packet->next) { current_count++; if (value_is_in_range(range->user_range, current_count)) { range->user_range_cnt++; if (packet->flags.ignored) { range->ignored_user_range_cnt++; } if (packet->flags.passed_dfilter) { range->displayed_user_range_cnt++; if (packet->flags.ignored) { range->displayed_ignored_user_range_cnt++; } } } } }
/* do we have to process this packet? */ range_process_e packet_range_process_packet(packet_range_t *range, frame_data *fdata) { if (range->remove_ignored && fdata->flags.ignored) { return range_process_next; } switch(range->process) { case(range_process_all): break; case(range_process_selected): if (range->selected_done) { return range_processing_finished; } if (fdata->num != cfile.current_frame->num) { return range_process_next; } range->selected_done = TRUE; break; case(range_process_marked): if (fdata->flags.marked == FALSE) { return range_process_next; } break; case(range_process_marked_range): if (range->marked_range_left == 0) { return range_processing_finished; } if (fdata->flags.marked == TRUE) { range->marked_range_active = TRUE; } if (range->marked_range_active == FALSE ) { return range_process_next; } if (!range->process_filtered || (range->process_filtered && fdata->flags.passed_dfilter == TRUE)) { range->marked_range_left--; } break; case(range_process_user_range): if (value_is_in_range(range->user_range, fdata->num) == FALSE) { return range_process_next; } break; default: g_assert_not_reached(); } /* this packet has to pass the display filter but didn't? -> try next */ if (range->process_filtered && fdata->flags.passed_dfilter == FALSE) { return range_process_next; } /* We fell through the conditions above, so we accept this packet */ return range_process_this; }
/* This is a debug function to check the range functionality */ static void value_is_in_range_check(range_t *range, guint32 val) { /* Print the result for a given value */ printf("Function : value_is_in_range_check Number %u\t",val); if (value_is_in_range(range, val)) { printf("is in range\n"); } else { printf("is not in range\n"); } }
/* (re-)calculate the user specified packet range counts */ static void packet_range_calc_user(packet_range_t *range) { guint32 framenum; frame_data *packet; range->user_range_cnt = 0; range->ignored_user_range_cnt = 0; range->displayed_user_range_cnt = 0; range->displayed_ignored_user_range_cnt = 0; g_assert(range->cf != NULL); /* XXX - this doesn't work unless you have a full set of frame_data * structures for all packets in the capture, which is not, * for example, the case when TShark is doing a one-pass * read of a file or a live capture. * * It's also horribly slow on large captures, causing it to * take a long time for the Save As dialog to pop up, for * example. This obviously can't be kept in the capture_file * structure and recalculated whenever we filter the display * or mark frames as ignored, as the results of this depend * on what the user specifies. In some cases, limiting the * frame_data structures at which we look to the ones specified * by the user might help, but if most of the frames are in * the range, that won't help. In that case, if we could * examine the *complement* of the range, and *subtract* them * from the statistics for the capture as a whole, that might * help, but if the user specified about *half* the packets in * the range, that won't help, either. */ if (range->cf->frames != NULL) { for(framenum = 1; framenum <= range->cf->count; framenum++) { packet = frame_data_sequence_find(range->cf->frames, framenum); if (value_is_in_range(range->user_range, framenum)) { range->user_range_cnt++; if (packet->flags.ignored) { range->ignored_user_range_cnt++; } if (packet->flags.passed_dfilter) { range->displayed_user_range_cnt++; if (packet->flags.ignored) { range->displayed_ignored_user_range_cnt++; } } } } } }