2 * Definitions for packet info structures and routines
6 * Wireshark - Network traffic analyzer
7 * By Gerald Combs <gerald@wireshark.org>
8 * Copyright 1998 Gerald Combs
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version 2
13 * of the License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
25 #ifndef __PACKET_INFO_H__
26 #define __PACKET_INFO_H__
28 #include "frame_data.h"
33 * Dissected packet data and metadata.
36 /** @defgroup packetinfo Packet Data and Metadata
41 /* Also defined in wiretap/wtap.h */
42 #define P2P_DIR_UNKNOWN -1
43 #define P2P_DIR_SENT 0
44 #define P2P_DIR_RECV 1
47 #define LINK_DIR_UNKNOWN -1
51 #define PINFO_SOF_FIRST_FRAME 0x1
52 #define PINFO_SOF_SOFF 0x2
53 #define PINFO_EOF_LAST_FRAME 0x80
54 #define PINFO_EOF_INVALID 0x40
55 #define MAX_NUMBER_OF_PPIDS 2
57 typedef struct _packet_info {
58 const char *current_proto; /**< name of protocol currently being dissected */
59 column_info *cinfo; /**< Column formatting information */
61 union wtap_pseudo_header *pseudo_header;
62 struct wtap_pkthdr *phdr;
63 GSList *data_src; /**< Frame data sources */
64 address dl_src; /**< link-layer source address */
65 address dl_dst; /**< link-layer destination address */
66 address net_src; /**< network-layer source address */
67 address net_dst; /**< network-layer destination address */
68 address src; /**< source address (net if present, DL otherwise )*/
69 address dst; /**< destination address (net if present, DL otherwise )*/
70 guint32 ethertype; /**< Ethernet Type Code, if this is an Ethernet packet */
71 guint32 ipproto; /**< IP protocol, if this is an IP packet */
72 guint32 mpls_label; /**< last mpls label in label stack, if this is a MPLS packet */
73 circuit_type ctype; /**< type of circuit, for protocols with a VC identifier */
74 guint32 circuit_id; /**< circuit ID, for protocols with a VC identifier */
75 const char *noreassembly_reason; /**< reason why reassembly wasn't done, if any */
76 gboolean fragmented; /**< TRUE if the protocol is only a fragment */
78 guint32 in_error_pkt:1; /**< TRUE if we're inside an {ICMP,CLNP,...} error packet */
79 guint32 in_gre_pkt:1; /**< TRUE if we're encapsulated inside a GRE packet */
81 port_type ptype; /**< type of the following two port numbers */
82 guint32 srcport; /**< source port */
83 guint32 destport; /**< destination port */
84 guint32 match_uint; /**< matched uint for calling subdissector from table */
85 const char *match_string; /**< matched string for calling subdissector from table */
86 guint16 can_desegment; /**< >0 if this segment could be desegmented.
87 A dissector that can offer this API (e.g.
88 TCP) sets can_desegment=2, then
89 can_desegment is decremented by 1 each time
90 we pass to the next subdissector. Thus only
91 the dissector immediately above the
92 protocol which sets the flag can use it*/
93 guint16 saved_can_desegment; /**< Value of can_desegment before current
94 dissector was called. Supplied so that
95 dissectors for proxy protocols such as
96 SOCKS can restore it, allowing the
97 dissectors that they call to use the
98 TCP dissector's desegmentation (SOCKS
99 just retransmits TCP segments once it's
100 finished setting things up, so the TCP
101 desegmentor can desegment its payload). */
102 int desegment_offset; /**< offset to stuff needing desegmentation */
103 #define DESEGMENT_ONE_MORE_SEGMENT 0x0fffffff
104 #define DESEGMENT_UNTIL_FIN 0x0ffffffe
105 guint32 desegment_len; /**< requested desegmentation additional length
107 DESEGMENT_ONE_MORE_SEGMENT:
108 Desegment one more full segment
109 (warning! only partially implemented)
111 Desgment all data for this tcp session
112 until the FIN segment.
114 guint16 want_pdu_tracking; /**< >0 if the subdissector has specified
115 a value in 'bytes_until_next_pdu'.
116 When a dissector detects that the next PDU
117 will start beyond the start of the next
118 segment, it can set this value to 2
119 and 'bytes_until_next_pdu' to the number of
120 bytes beyond the next segment where the
123 If the protocol dissector below this
124 one is capable of PDU tracking it can
125 use this hint to detect PDUs that starts
126 unaligned to the segment boundaries.
127 The TCP dissector is using this hint from
128 (some) protocols to detect when a new PDU
129 starts in the middle of a tcp segment.
131 There is intelligence in the glue between
132 dissector layers to make sure that this
133 request is only passed down to the protocol
134 immediately below the current one and not
137 guint32 bytes_until_next_pdu;
140 int iplen; /**< total length of IP packet */
141 int iphdrlen; /**< length of IP header */
142 guint8 ip_ttl; /**< IP time to live */
143 int p2p_dir; /**< Packet was captured as an
144 outbound (P2P_DIR_SENT)
145 inbound (P2P_DIR_RECV)
146 unknown (P2P_DIR_UNKNOWN) */
147 guint16 oxid; /**< next 2 fields reqd to identify fibre */
148 guint16 rxid; /**< channel conversations */
149 guint8 r_ctl; /**< R_CTL field in Fibre Channel Protocol */
150 guint8 sof_eof; /**< FC's SOF/EOF encoding passed to FC decoder
151 * Bit 7 set if Last frame in sequence
152 * Bit 6 set if invalid frame content
154 * Bit 1 set if first frame in sequence
156 guint16 src_idx; /**< Source port index (Cisco MDS-specific) */
157 guint16 dst_idx; /**< Dest port index (Cisco MDS-specific) */
158 guint16 vsan; /**< Fibre channel/Cisco MDS-specific */
160 /* Extra data for DCERPC handling and tracking of context ids */
161 guint16 dcectxid; /**< Context ID (DCERPC-specific) */
162 int dcetransporttype; /**< Transport type
163 * Value -1 means "not a DCERPC packet"
165 guint16 dcetransportsalt; /**< fid: if transporttype==DCE_CN_TRANSPORT_SMBPIPE */
167 /**< Extra data for handling of decryption of GSSAPI wrapped tvbuffs.
168 Caller sets decrypt_gssapi_tvb if this service is requested.
169 If gssapi_encrypted_tvb is NULL, then the rest of the tvb data following
170 the gssapi blob itself is decrypted othervise the gssapi_encrypted_tvb
171 tvb will be decrypted (DCERPC has the data before the gssapi blob)
172 If, on return, gssapi_data_encrypted is FALSE, the wrapped tvbuff
173 was signed (i.e., an encrypted signature was present, to check
174 whether the data was modified by a man in the middle) but not sealed
175 (i.e., the data itself wasn't encrypted).
177 #define DECRYPT_GSSAPI_NORMAL 1
178 #define DECRYPT_GSSAPI_DCE 2
179 guint16 decrypt_gssapi_tvb;
180 tvbuff_t *gssapi_wrap_tvb;
181 tvbuff_t *gssapi_encrypted_tvb;
182 tvbuff_t *gssapi_decrypted_tvb;
183 gboolean gssapi_data_encrypted;
185 guint32 ppid; /**< SCTP PPI of current DATA chunk */
186 /** This is a valid PPID, but we use it to mark the end of the list */
187 #define LAST_PPID 0xffffffff
188 guint32 ppids[MAX_NUMBER_OF_PPIDS]; /**< The first NUMBER_OF_PPIDS PPIDS which are present
191 void *private_data; /**< pointer to data passed from one dissector to another */
192 GHashTable *private_table; /**< a hash table passed from one dissector to another */
194 guint8 curr_layer_num; /**< The current "depth" or layer number in the current frame */
195 /* TODO: Use emem_strbuf_t instead */
196 GString *layer_names; /**< layers of each protocol */
198 guint8 annex_a_used; /**< used in packet-mtp2.c
200 * MTP2_ANNEX_A_NOT_USED 0
201 * MTP2_ANNEX_A_USED 1
202 * MTP2_ANNEX_A_USED_UNKNOWN 2
204 guint16 profinet_type; /**< the type of PROFINET packet (0: not a PROFINET packet) */
206 void *tcp_tree; /**< proto_tree for the tcp layer */
208 const char *dcerpc_procedure_name; /* Used by PIDL to store the name of the current dcerpc procedure */
210 struct _sccp_msg_info_t* sccp_info;
211 guint16 clnp_srcref; /**< clnp/cotp source reference (can't use srcport, this would confuse tpkt) */
212 guint16 clnp_dstref; /**< clnp/cotp destination reference (can't use dstport, this would confuse tpkt) */
214 guint16 zbee_cluster_id; /**< ZigBee cluster ID, an application-specific message identifier that
215 * happens to be included in the transport (APS) layer header.
217 guint8 zbee_stack_vers; /**< ZigBee stack version number, present in the ZigBee network layer, but
218 * impacts the packet format at all layers of the ZigBee stack.
220 int link_dir; /**< 3GPP messages are sometime different UP link(UL) or Downlink(DL) */
221 GSList* dependent_frames; /**< A list of frames which this one depends on */
223 GSList *frame_end_routines;
225 struct _wmem_allocator_t *pool; /**< Memory pool scoped to the pinfo struct */
226 struct epan_session *epan;
227 nstime_t rel_ts; /**< Relative timestamp (yes, it can be negative) */
228 const gchar *pkt_comment; /**< NULL if not available */
233 #endif /* __PACKET_INFO_H__ */