epan/dissectors/packet-xml.c try to decrypt data, but the data doesn't look correct yet
[metze/wireshark/wip.git] / sharkd_session.c
index 087f2f658901ff8f2575b4f59b8bdc7c8de08af0..eafb9c52e017a8c697f8b69e4a050650b3691bf0 100644 (file)
 
 #include <stdio.h>
 #include <stdlib.h>
+#include <stdarg.h>
 #include <string.h>
 #include <errno.h>
 
 #include <glib.h>
 
-#include <wsutil/wsjsmn.h>
+#include <wsutil/wsjson.h>
 #include <wsutil/ws_printf.h>
+#include <wsutil/json_dumper.h>
 
 #include <file.h>
 #include <epan/epan_dissect.h>
@@ -34,6 +36,7 @@
 
 #include <ui/ssl_key_export.h>
 
+#include <ui/io_graph_item.h>
 #include <epan/stats_tree_priv.h>
 #include <epan/stat_tap_ui.h>
 #include <epan/conversation_table.h>
@@ -49,6 +52,7 @@
 #include <ui/voip_calls.h>
 #include <ui/rtp_stream.h>
 #include <ui/tap-rtp-common.h>
+#include <ui/tap-rtp-analysis.h>
 #include <epan/to_str.h>
 
 #include <epan/addr_resolv.h>
 # include <codecs/speex/speex_resampler.h>
 #endif /* HAVE_SPEEXDSP */
 
-#ifdef HAVE_GEOIP
-# include <GeoIP.h>
-# include <epan/geoip_db.h>
-# include <wsutil/pint.h>
-#endif
+#include <epan/maxmind_db.h>
 
-#include <wsutil/glib-compat.h>
+#include <wsutil/pint.h>
 #include <wsutil/strtoi.h>
 
 #include "globals.h"
 
 struct sharkd_filter_item
 {
-       guint8 *filtered;
+       guint8 *filtered; /* can be NULL if all frames are matching for given filter. */
 };
 
 static GHashTable *filter_table = NULL;
 
-static gboolean
-json_unescape_str(char *input)
-{
-       return wsjsmn_unescape_json_string(input, input);
-}
+static json_dumper dumper = {0};
 
 static const char *
 json_find_attr(const char *buf, const jsmntok_t *tokens, int count, const char *attr)
@@ -104,71 +100,84 @@ json_find_attr(const char *buf, const jsmntok_t *tokens, int count, const char *
 }
 
 static void
-json_puts_string(const char *str)
+json_print_base64(const guint8 *data, size_t len)
 {
-       int i;
-
-       if (str == NULL)
-               str = "";
-
-       putchar('"');
-       for (i = 0; str[i]; i++)
-       {
-               switch (str[i])
-               {
-                       case '\\':
-                       case '"':
-                               putchar('\\');
-                               putchar(str[i]);
-                               break;
-
-                       case '\n':
-                               putchar('\\');
-                               putchar('n');
-                               break;
+       json_dumper_begin_base64(&dumper);
+       json_dumper_write_base64(&dumper, data, len);
+       json_dumper_end_base64(&dumper);
+}
 
-                       default:
-                               putchar(str[i]);
-                               break;
-               }
+static void G_GNUC_PRINTF(2, 3)
+sharkd_json_value_anyf(const char *key, const char *format, ...)
+{
+       if (key)
+               json_dumper_set_member_name(&dumper, key);
+
+       if (format) {
+               va_list ap;
+               va_start(ap, format);
+               json_dumper_value_va_list(&dumper, format, ap);
+               va_end(ap);
        }
-
-       putchar('"');
 }
 
 static void
-json_print_base64_step(const guint8 *data, int *state1, int *state2)
+sharkd_json_value_string(const char *key, const char *str)
 {
-       gchar buf[(1 / 3 + 1) * 4 + 4 + 1];
-       gsize wrote;
+       if (key)
+               json_dumper_set_member_name(&dumper, key);
+       if (str)
+               json_dumper_value_string(&dumper, str);
+}
 
-       if (data)
-               wrote = g_base64_encode_step(data, 1, FALSE, buf, state1, state2);
-       else
-               wrote = g_base64_encode_close(FALSE, buf, state1, state2);
+static void
+sharkd_json_value_base64(const char *key, const guint8 *data, size_t len)
+{
+       if (key)
+               json_dumper_set_member_name(&dumper, key);
+       json_print_base64(data, len);
+}
 
-       if (wrote > 0)
-       {
-               buf[wrote] = '\0';
-               printf("%s", buf);
+static void G_GNUC_PRINTF(2, 3)
+sharkd_json_value_stringf(const char *key, const char *format, ...)
+{
+       if (key)
+               json_dumper_set_member_name(&dumper, key);
+
+       if (format) {
+               va_list ap;
+               va_start(ap, format);
+               char* sformat = g_strdup_printf("\"%s\"", format);
+               json_dumper_value_va_list(&dumper, sformat, ap);
+               g_free(sformat);
+               va_end(ap);
        }
 }
 
 static void
-json_print_base64(const guint8 *data, size_t len)
+sharkd_json_array_open(const char *key)
 {
-       size_t i;
-       int base64_state1 = 0;
-       int base64_state2 = 0;
-
-       putchar('"');
+       if (key)
+               json_dumper_set_member_name(&dumper, key);
+       json_dumper_begin_array(&dumper);
+}
 
-       for (i = 0; i < len; i++)
-               json_print_base64_step(&data[i], &base64_state1, &base64_state2);
+static void
+sharkd_json_array_close(void)
+{
+       json_dumper_end_array(&dumper);
+}
 
-       json_print_base64_step(NULL, &base64_state1, &base64_state2);
+static void
+sharkd_json_simple_reply(int err, const char *errmsg)
+{
+       json_dumper_begin_object(&dumper);
+       sharkd_json_value_anyf("err", "%d", err);
+       if (errmsg)
+               sharkd_json_value_string("errmsg", errmsg);
 
-       putchar('"');
+       json_dumper_end_object(&dumper);
+       json_dumper_finish(&dumper);
 }
 
 static void
@@ -180,7 +189,7 @@ sharkd_session_filter_free(gpointer data)
        g_free(l);
 }
 
-static const guint8 *
+static const struct sharkd_filter_item *
 sharkd_session_filter_data(const char *filter)
 {
        struct sharkd_filter_item *l;
@@ -201,47 +210,44 @@ sharkd_session_filter_data(const char *filter)
                g_hash_table_insert(filter_table, g_strdup(filter), l);
        }
 
-       return l->filtered;
+       return l;
 }
 
-struct sharkd_rtp_match
-{
-       guint32 addr_src, addr_dst;
-       address src_addr;
-       address dst_addr;
-       guint16 src_port;
-       guint16 dst_port;
-       guint32 ssrc;
-};
-
 static gboolean
-sharkd_rtp_match_init(struct sharkd_rtp_match *req, const char *init_str)
+sharkd_rtp_match_init(rtpstream_id_t *id, const char *init_str)
 {
        gboolean ret = FALSE;
        char **arr;
+       guint32 tmp_addr_src, tmp_addr_dst;
+       address tmp_src_addr, tmp_dst_addr;
+
+       memset(id, 0, sizeof(*id));
 
        arr = g_strsplit(init_str, "_", 7); /* pass larger value, so we'll catch incorrect input :) */
        if (g_strv_length(arr) != 5)
                goto fail;
 
        /* TODO, for now only IPv4 */
-       if (!get_host_ipaddr(arr[0], &req->addr_src))
+       if (!get_host_ipaddr(arr[0], &tmp_addr_src))
                goto fail;
 
-       if (!ws_strtou16(arr[1], NULL, &req->src_port))
+       if (!ws_strtou16(arr[1], NULL, &id->src_port))
                goto fail;
 
-       if (!get_host_ipaddr(arr[2], &req->addr_dst))
+       if (!get_host_ipaddr(arr[2], &tmp_addr_dst))
                goto fail;
 
-       if (!ws_strtou16(arr[3], NULL, &req->dst_port))
+       if (!ws_strtou16(arr[3], NULL, &id->dst_port))
                goto fail;
 
-       if (!ws_hexstrtou32(arr[4], NULL, &req->ssrc))
+       if (!ws_hexstrtou32(arr[4], NULL, &id->ssrc))
                goto fail;
 
-       set_address(&req->src_addr, AT_IPv4, 4, &req->addr_src);
-       set_address(&req->dst_addr, AT_IPv4, 4, &req->addr_dst);
+       set_address(&tmp_src_addr, AT_IPv4, 4, &tmp_addr_src);
+       copy_address(&id->src_addr, &tmp_src_addr);
+       set_address(&tmp_dst_addr, AT_IPv4, 4, &tmp_addr_dst);
+       copy_address(&id->dst_addr, &tmp_dst_addr);
+
        ret = TRUE;
 
 fail:
@@ -250,153 +256,121 @@ fail:
 }
 
 static gboolean
-sharkd_rtp_match_check(const struct sharkd_rtp_match *req, const packet_info *pinfo, const struct _rtp_info *rtp_info)
-{
-       if (rtp_info->info_sync_src == req->ssrc &&
-               pinfo->srcport == req->src_port &&
-               pinfo->destport == req->dst_port &&
-               addresses_equal(&pinfo->src, &req->src_addr) &&
-               addresses_equal(&pinfo->dst, &req->dst_addr))
-       {
-               return TRUE;
-       }
-
-       return FALSE;
-}
-
-static gboolean
-sharkd_session_process_info_nstat_cb(const void *key, void *value, void *userdata)
+sharkd_session_process_info_nstat_cb(const void *key, void *value, void *userdata _U_)
 {
-       stat_tap_table_ui *new_stat_tap = (stat_tap_table_ui *) value;
-       int *pi = (int *) userdata;
+       stat_tap_table_ui *stat_tap = (stat_tap_table_ui *) value;
 
-       printf("%s{", (*pi) ? "," : "");
-               printf("\"name\":\"%s\"", new_stat_tap->title);
-               printf(",\"tap\":\"nstat:%s\"", (const char *) key);
-       printf("}");
+       json_dumper_begin_object(&dumper);
+               sharkd_json_value_string("name", stat_tap->title);
+               sharkd_json_value_stringf("tap", "nstat:%s", (const char *) key);
+       json_dumper_end_object(&dumper);
 
-       *pi = *pi + 1;
        return FALSE;
 }
 
 static gboolean
-sharkd_session_process_info_conv_cb(const void* key, void* value, void* userdata)
+sharkd_session_process_info_conv_cb(const void* key, void* value, void* userdata _U_)
 {
        struct register_ct *table = (struct register_ct *) value;
-       int *pi = (int *) userdata;
 
        const char *label = (const char *) key;
 
        if (get_conversation_packet_func(table))
        {
-               printf("%s{", (*pi) ? "," : "");
-                       printf("\"name\":\"Conversation List/%s\"", label);
-                       printf(",\"tap\":\"conv:%s\"", label);
-               printf("}");
-
-               *pi = *pi + 1;
+               json_dumper_begin_object(&dumper);
+                       sharkd_json_value_stringf("name", "Conversation List/%s", label);
+                       sharkd_json_value_stringf("tap", "conv:%s", label);
+               json_dumper_end_object(&dumper);
        }
 
        if (get_hostlist_packet_func(table))
        {
-               printf("%s{", (*pi) ? "," : "");
-                       printf("\"name\":\"Endpoint/%s\"", label);
-                       printf(",\"tap\":\"endpt:%s\"", label);
-               printf("}");
-
-               *pi = *pi + 1;
+               json_dumper_begin_object(&dumper);
+                       sharkd_json_value_stringf("name", "Endpoint/%s", label);
+                       sharkd_json_value_stringf("tap", "endpt:%s", label);
+               json_dumper_end_object(&dumper);
        }
        return FALSE;
 }
 
 static gboolean
-sharkd_session_seq_analysis_cb(const void *key, void *value, void *userdata)
+sharkd_session_seq_analysis_cb(const void *key, void *value, void *userdata _U_)
 {
        register_analysis_t *analysis = (register_analysis_t *) value;
-       int *pi = (int *) userdata;
 
-       printf("%s{", (*pi) ? "," : "");
-               printf("\"name\":\"%s\"", sequence_analysis_get_ui_name(analysis));
-               printf(",\"tap\":\"seqa:%s\"", (const char *) key);
-       printf("}");
+       json_dumper_begin_object(&dumper);
+               sharkd_json_value_string("name", sequence_analysis_get_ui_name(analysis));
+               sharkd_json_value_stringf("tap", "seqa:%s", (const char *) key);
+       json_dumper_end_object(&dumper);
 
-       *pi = *pi + 1;
        return FALSE;
 }
 
 static gboolean
-sharkd_export_object_visit_cb(const void *key _U_, void *value, void *user_data)
+sharkd_export_object_visit_cb(const void *key _U_, void *value, void *user_data _U_)
 {
        register_eo_t *eo = (register_eo_t *) value;
-       int *pi = (int *) user_data;
 
        const int proto_id = get_eo_proto_id(eo);
        const char *filter = proto_get_protocol_filter_name(proto_id);
        const char *label  = proto_get_protocol_short_name(find_protocol_by_id(proto_id));
 
-       printf("%s{", (*pi) ? "," : "");
-               printf("\"name\":\"Export Object/%s\"", label);
-               printf(",\"tap\":\"eo:%s\"", filter);
-       printf("}");
+       json_dumper_begin_object(&dumper);
+               sharkd_json_value_stringf("name", "Export Object/%s", label);
+               sharkd_json_value_stringf("tap", "eo:%s", filter);
+       json_dumper_end_object(&dumper);
 
-       *pi = *pi + 1;
        return FALSE;
 }
 
 static gboolean
-sharkd_srt_visit_cb(const void *key _U_, void *value, void *user_data)
+sharkd_srt_visit_cb(const void *key _U_, void *value, void *user_data _U_)
 {
        register_srt_t *srt = (register_srt_t *) value;
-       int *pi = (int *) user_data;
 
        const int proto_id = get_srt_proto_id(srt);
        const char *filter = proto_get_protocol_filter_name(proto_id);
        const char *label  = proto_get_protocol_short_name(find_protocol_by_id(proto_id));
 
-       printf("%s{", (*pi) ? "," : "");
-               printf("\"name\":\"Service Response Time/%s\"", label);
-               printf(",\"tap\":\"srt:%s\"", filter);
-       printf("}");
+       json_dumper_begin_object(&dumper);
+               sharkd_json_value_stringf("name", "Service Response Time/%s", label);
+               sharkd_json_value_stringf("tap", "srt:%s", filter);
+       json_dumper_end_object(&dumper);
 
-       *pi = *pi + 1;
        return FALSE;
 }
 
 static gboolean
-sharkd_rtd_visit_cb(const void *key _U_, void *value, void *user_data)
+sharkd_rtd_visit_cb(const void *key _U_, void *value, void *user_data _U_)
 {
        register_rtd_t *rtd = (register_rtd_t *) value;
-       int *pi = (int *) user_data;
 
        const int proto_id = get_rtd_proto_id(rtd);
        const char *filter = proto_get_protocol_filter_name(proto_id);
        const char *label  = proto_get_protocol_short_name(find_protocol_by_id(proto_id));
 
-       printf("%s{", (*pi) ? "," : "");
-               printf("\"name\":\"Response Time Delay/%s\"", label);
-               printf(",\"tap\":\"rtd:%s\"", filter);
-       printf("}");
+       json_dumper_begin_object(&dumper);
+               sharkd_json_value_stringf("name", "Response Time Delay/%s", label);
+               sharkd_json_value_stringf("tap", "rtd:%s", filter);
+       json_dumper_end_object(&dumper);
 
-       *pi = *pi + 1;
        return FALSE;
 }
 
 static gboolean
-sharkd_follower_visit_cb(const void *key _U_, void *value, void *user_data)
+sharkd_follower_visit_cb(const void *key _U_, void *value, void *user_data _U_)
 {
        register_follow_t *follower = (register_follow_t *) value;
-       int *pi = (int *) user_data;
 
        const int proto_id = get_follow_proto_id(follower);
        const char *label  = proto_get_protocol_short_name(find_protocol_by_id(proto_id));
        const char *filter = label; /* correct: get_follow_by_name() is registered by short name */
 
-       printf("%s{", (*pi) ? "," : "");
-               printf("\"name\":\"Follow/%s\"", label);
-               printf(",\"tap\":\"follow:%s\"", filter);
-       printf("}");
+       json_dumper_begin_object(&dumper);
+               sharkd_json_value_stringf("name", "Follow/%s", label);
+               sharkd_json_value_stringf("tap", "follow:%s", filter);
+       json_dumper_end_object(&dumper);
 
-       *pi = *pi + 1;
        return FALSE;
 }
 
@@ -406,6 +380,8 @@ sharkd_follower_visit_cb(const void *key _U_, void *value, void *user_data)
  * Process info request
  *
  * Output object with attributes:
+ *   (m) version - version number
+ *
  *   (m) columns - available column formats, array of object with attributes:
  *                  'name'   - column name
  *                  'format' - column format-name
@@ -434,110 +410,118 @@ sharkd_follower_visit_cb(const void *key _U_, void *value, void *user_data)
  *                  'name' - sequence analysis name
  *                  'tap'  - sharkd tap-name
  *
- *   (m) taps - available taps, array of object with attributes:
+ *   (m) taps    - available taps, array of object with attributes:
  *                  'name' - tap name
  *                  'tap'  - sharkd tap-name
  *
- *   (m) follow - available followers, array of object with attributes:
+ *   (m) follow  - available followers, array of object with attributes:
+ *                  'name' - tap name
+ *                  'tap'  - sharkd tap-name
+ *
+ *   (m) ftypes  - conversation table for FT_ number to string, array of FT_xxx strings.
+ *
+ *   (m) nstat   - available table-based taps, array of object with attributes:
  *                  'name' - tap name
  *                  'tap'  - sharkd tap-name
  *
- *   (m) ftypes   - conversation table for FT_ number to string
  */
 static void
 sharkd_session_process_info(void)
 {
        int i;
 
-       printf("{\"columns\":[");
+       json_dumper_begin_object(&dumper);
+
+       sharkd_json_array_open("columns");
        for (i = 0; i < NUM_COL_FMTS; i++)
        {
                const char *col_format = col_format_to_string(i);
                const char *col_descr  = col_format_desc(i);
 
-               printf("%s{", (i) ? "," : "");
-                       printf("\"name\":\"%s\"", col_descr);
-                       printf(",\"format\":\"%s\"", col_format);
-               printf("}");
+               json_dumper_begin_object(&dumper);
+                       sharkd_json_value_string("name", col_descr);
+                       sharkd_json_value_string("format", col_format);
+               json_dumper_end_object(&dumper);
        }
-       printf("]");
+       sharkd_json_array_close();
 
-       printf(",\"stats\":[");
+       sharkd_json_array_open("stats");
        {
                GList *cfg_list = stats_tree_get_cfg_list();
                GList *l;
-               const char *sepa = "";
 
                for (l = cfg_list; l; l = l->next)
                {
                        stats_tree_cfg *cfg = (stats_tree_cfg *) l->data;
 
-                       printf("%s{", sepa);
-                               printf("\"name\":\"%s\"", cfg->name);
-                               printf(",\"tap\":\"stat:%s\"", cfg->abbr);
-                       printf("}");
-                       sepa = ",";
+                       json_dumper_begin_object(&dumper);
+                               sharkd_json_value_string("name", cfg->name);
+                               sharkd_json_value_stringf("tap", "stat:%s", cfg->abbr);
+                       json_dumper_end_object(&dumper);
                }
 
                g_list_free(cfg_list);
        }
-       printf("]");
+       sharkd_json_array_close();
 
-       printf(",\"ftypes\":[");
+       sharkd_json_array_open("ftypes");
        for (i = 0; i < FT_NUM_TYPES; i++)
-       {
-               if (i)
-                       printf(",");
-               json_puts_string(ftype_name((ftenum_t) i));
-       }
-       printf("]");
+               sharkd_json_value_string(NULL, ftype_name((ftenum_t) i));
+       sharkd_json_array_close();
 
-       printf(",\"version\":");
-       json_puts_string(sharkd_version());
+       sharkd_json_value_string("version", sharkd_version());
 
-       printf(",\"nstat\":[");
+       sharkd_json_array_open("nstat");
        i = 0;
-       new_stat_tap_iterate_tables(sharkd_session_process_info_nstat_cb, &i);
-       printf("]");
+       stat_tap_iterate_tables(sharkd_session_process_info_nstat_cb, &i);
+       sharkd_json_array_close();
 
-       printf(",\"convs\":[");
+       sharkd_json_array_open("convs");
        i = 0;
        conversation_table_iterate_tables(sharkd_session_process_info_conv_cb, &i);
-       printf("]");
+       sharkd_json_array_close();
 
-       printf(",\"seqa\":[");
+       sharkd_json_array_open("seqa");
        i = 0;
        sequence_analysis_table_iterate_tables(sharkd_session_seq_analysis_cb, &i);
-       printf("]");
+       sharkd_json_array_close();
 
-       printf(",\"taps\":[");
+       sharkd_json_array_open("taps");
        {
-               printf("{\"name\":\"%s\",\"tap\":\"%s\"}", "RTP streams", "rtp-streams");
-               printf(",{\"name\":\"%s\",\"tap\":\"%s\"}", "Expert Information", "expert");
+               json_dumper_begin_object(&dumper);
+               sharkd_json_value_string("name", "RTP streams");
+               sharkd_json_value_string("tap", "rtp-streams");
+               json_dumper_end_object(&dumper);
+
+               json_dumper_begin_object(&dumper);
+               sharkd_json_value_string("name", "Expert Information");
+               sharkd_json_value_string("tap", "expert");
+               json_dumper_end_object(&dumper);
        }
-       printf("]");
+       sharkd_json_array_close();
 
-       printf(",\"eo\":[");
+       sharkd_json_array_open("eo");
        i = 0;
        eo_iterate_tables(sharkd_export_object_visit_cb, &i);
-       printf("]");
+       sharkd_json_array_close();
 
-       printf(",\"srt\":[");
+       sharkd_json_array_open("srt");
        i = 0;
        srt_table_iterate_tables(sharkd_srt_visit_cb, &i);
-       printf("]");
+       sharkd_json_array_close();
 
-       printf(",\"rtd\":[");
+       sharkd_json_array_open("rtd");
        i = 0;
        rtd_table_iterate_tables(sharkd_rtd_visit_cb, &i);
-       printf("]");
+       sharkd_json_array_close();
 
-       printf(",\"follow\":[");
+       sharkd_json_array_open("follow");
        i = 0;
        follow_iterate_followers(sharkd_follower_visit_cb, &i);
-       printf("]");
+       sharkd_json_array_close();
 
-       printf("}\n");
+       json_dumper_end_object(&dumper);
+       json_dumper_finish(&dumper);
 }
 
 /**
@@ -564,7 +548,7 @@ sharkd_session_process_load(const char *buf, const jsmntok_t *tokens, int count)
 
        if (sharkd_cf_open(tok_file, WTAP_TYPE_AUTO, FALSE, &err) != CF_OK)
        {
-               printf("{\"err\":%d}\n", err);
+               sharkd_json_simple_reply(err, NULL);
                return;
        }
 
@@ -579,7 +563,7 @@ sharkd_session_process_load(const char *buf, const jsmntok_t *tokens, int count)
        }
        ENDTRY;
 
-       printf("{\"err\":%d}\n", err);
+       sharkd_json_simple_reply(err, NULL);
 }
 
 /**
@@ -596,16 +580,16 @@ sharkd_session_process_load(const char *buf, const jsmntok_t *tokens, int count)
 static void
 sharkd_session_process_status(void)
 {
-       printf("{\"frames\":%u", cfile.count);
+       json_dumper_begin_object(&dumper);
 
-       printf(",\"duration\":%.9f", nstime_to_sec(&cfile.elapsed_time));
+       sharkd_json_value_anyf("frames", "%u", cfile.count);
+       sharkd_json_value_anyf("duration", "%.9f", nstime_to_sec(&cfile.elapsed_time));
 
        if (cfile.filename)
        {
                char *name = g_path_get_basename(cfile.filename);
 
-               printf(",\"filename\":");
-               json_puts_string(name);
+               sharkd_json_value_string("filename", name);
                g_free(name);
        }
 
@@ -614,10 +598,11 @@ sharkd_session_process_status(void)
                gint64 file_size = wtap_file_size(cfile.provider.wth, NULL);
 
                if (file_size > 0)
-                       printf(",\"filesize\":%" G_GINT64_FORMAT, file_size);
+                       sharkd_json_value_anyf("filesize", "%" G_GINT64_FORMAT, file_size);
        }
 
-       printf("}\n");
+       json_dumper_end_object(&dumper);
+       json_dumper_finish(&dumper);
 }
 
 struct sharkd_analyse_data
@@ -655,10 +640,7 @@ sharkd_session_process_analyse_cb(epan_dissect_t *edt, proto_tree *tree, struct
                        if (!g_hash_table_lookup_extended(analyser->protocols_set, GUINT_TO_POINTER(proto_id), NULL, NULL))
                        {
                                g_hash_table_insert(analyser->protocols_set, GUINT_TO_POINTER(proto_id), GUINT_TO_POINTER(proto_id));
-
-                               if (g_hash_table_size(analyser->protocols_set) != 1)
-                                       printf(",");
-                               json_puts_string(proto_get_protocol_filter_name(proto_id));
+                               sharkd_json_value_string(NULL, proto_get_protocol_filter_name(proto_id));
                        }
                }
        }
@@ -686,20 +668,23 @@ sharkd_session_process_analyse(void)
        analyser.last_time  = NULL;
        analyser.protocols_set = g_hash_table_new(NULL /* g_direct_hash() */, NULL /* g_direct_equal */);
 
-       printf("{\"frames\":%u", cfile.count);
+       json_dumper_begin_object(&dumper);
 
-       printf(",\"protocols\":[");
+       sharkd_json_value_anyf("frames", "%u", cfile.count);
+
+       sharkd_json_array_open("protocols");
        for (framenum = 1; framenum <= cfile.count; framenum++)
-               sharkd_dissect_request(framenum, (framenum != 1) ? 1 : 0, framenum - 1, &sharkd_session_process_analyse_cb, 0, 0, 0, &analyser);
-       printf("]");
+               sharkd_dissect_request(framenum, (framenum != 1) ? 1 : 0, framenum - 1, &sharkd_session_process_analyse_cb, SHARKD_DISSECT_FLAG_NULL, &analyser);
+       sharkd_json_array_close();
 
        if (analyser.first_time)
-               printf(",\"first\":%.9f", nstime_to_sec(analyser.first_time));
+               sharkd_json_value_anyf("first", "%.9f", nstime_to_sec(analyser.first_time));
 
        if (analyser.last_time)
-               printf(",\"last\":%.9f", nstime_to_sec(analyser.last_time));
+               sharkd_json_value_anyf("last", "%.9f", nstime_to_sec(analyser.last_time));
 
-       printf("}\n");
+       json_dumper_end_object(&dumper);
+       json_dumper_finish(&dumper);
 
        g_hash_table_destroy(analyser.protocols_set);
 }
@@ -809,7 +794,6 @@ sharkd_session_process_frames(const char *buf, const jsmntok_t *tokens, int coun
 
        const guint8 *filter_data = NULL;
 
-       const char *frame_sepa = "";
        int col;
 
        guint32 framenum, prev_dis_num = 0;
@@ -830,9 +814,12 @@ sharkd_session_process_frames(const char *buf, const jsmntok_t *tokens, int coun
 
        if (tok_filter)
        {
-               filter_data = sharkd_session_filter_data(tok_filter);
-               if (!filter_data)
+               const struct sharkd_filter_item *filter_item;
+
+               filter_item = sharkd_session_filter_data(tok_filter);
+               if (!filter_item)
                        return;
+               filter_data = filter_item->filtered;
        }
 
        skip = 0;
@@ -855,7 +842,7 @@ sharkd_session_process_frames(const char *buf, const jsmntok_t *tokens, int coun
                        return;
        }
 
-       printf("[");
+       sharkd_json_array_open(NULL);
        for (framenum = 1; framenum <= cfile.count; framenum++)
        {
                frame_data *fdata;
@@ -890,6 +877,12 @@ sharkd_session_process_frames(const char *buf, const jsmntok_t *tokens, int coun
                                                break;
                                        }
                                }
+
+                               if (*tok_refs == '\0' && framenum >= next_ref_frame)
+                               {
+                                       current_ref_frame = next_ref_frame;
+                                       next_ref_frame = G_MAXUINT32;
+                               }
                        }
 
                        if (current_ref_frame)
@@ -899,44 +892,45 @@ sharkd_session_process_frames(const char *buf, const jsmntok_t *tokens, int coun
                fdata = sharkd_get_frame(framenum);
                sharkd_dissect_columns(fdata, ref_frame, prev_dis_num, cinfo, (fdata->color_filter == NULL));
 
-               printf("%s{\"c\":[", frame_sepa);
+               json_dumper_begin_object(&dumper);
+
+               sharkd_json_array_open("c");
                for (col = 0; col < cinfo->num_cols; ++col)
                {
                        const col_item_t *col_item = &cinfo->columns[col];
 
-                       if (col)
-                               printf(",");
-
-                       json_puts_string(col_item->col_data);
+                       sharkd_json_value_string(NULL, col_item->col_data);
                }
-               printf("],\"num\":%u", framenum);
+               sharkd_json_array_close();
+
+               sharkd_json_value_anyf("num", "%u", framenum);
 
-               if (fdata->flags.has_user_comment || fdata->flags.has_phdr_comment)
+               if (fdata->has_user_comment || fdata->has_phdr_comment)
                {
-                       if (!fdata->flags.has_user_comment || sharkd_get_user_comment(fdata) != NULL)
-                               printf(",\"ct\":true");
+                       if (!fdata->has_user_comment || sharkd_get_user_comment(fdata) != NULL)
+                               sharkd_json_value_anyf("ct", "true");
                }
 
-               if (fdata->flags.ignored)
-                       printf(",\"i\":true");
+               if (fdata->ignored)
+                       sharkd_json_value_anyf("i", "true");
 
-               if (fdata->flags.marked)
-                       printf(",\"m\":true");
+               if (fdata->marked)
+                       sharkd_json_value_anyf("m", "true");
 
                if (fdata->color_filter)
                {
-                       printf(",\"bg\":\"%x\"", color_t_to_rgb(&fdata->color_filter->bg_color));
-                       printf(",\"fg\":\"%x\"", color_t_to_rgb(&fdata->color_filter->fg_color));
+                       sharkd_json_value_stringf("bg", "%x", color_t_to_rgb(&fdata->color_filter->bg_color));
+                       sharkd_json_value_stringf("fg", "%x", color_t_to_rgb(&fdata->color_filter->fg_color));
                }
 
-               printf("}");
-               frame_sepa = ",";
+               json_dumper_end_object(&dumper);
                prev_dis_num = framenum;
 
                if (limit && --limit == 0)
                        break;
        }
-       printf("]\n");
+       sharkd_json_array_close();
+       json_dumper_finish(&dumper);
 
        if (cinfo != &cfile.cinfo)
                col_cleanup(cinfo);
@@ -946,48 +940,58 @@ static void
 sharkd_session_process_tap_stats_node_cb(const stat_node *n)
 {
        stat_node *node;
-       const char *sepa = "";
 
-       printf("[");
+       sharkd_json_array_open(NULL);
        for (node = n->children; node; node = node->next)
        {
+               json_dumper_begin_object(&dumper);
+
                /* code based on stats_tree_get_values_from_node() */
-               printf("%s{\"name\":\"%s\"", sepa, node->name);
-               printf(",\"count\":%d", node->counter);
+               sharkd_json_value_string("name", node->name);
+               sharkd_json_value_anyf("count", "%d", node->counter);
                if (node->counter && ((node->st_flags & ST_FLG_AVERAGE) || node->rng))
                {
-                       printf(",\"avg\":%.2f", ((float)node->total) / node->counter);
-                       printf(",\"min\":%d", node->minvalue);
-                       printf(",\"max\":%d", node->maxvalue);
+                       switch(node->datatype)
+                       {
+                       case STAT_DT_INT:
+                               sharkd_json_value_anyf("avg", "%.2f", ((float)node->total.int_total) / node->counter);
+                               sharkd_json_value_anyf("min", "%d", node->minvalue.int_min);
+                               sharkd_json_value_anyf("max", "%d", node->maxvalue.int_max);
+                               break;
+                       case STAT_DT_FLOAT:
+                               sharkd_json_value_anyf("avg", "%.2f", node->total.float_total / node->counter);
+                               sharkd_json_value_anyf("min", "%f", node->minvalue.float_min);
+                               sharkd_json_value_anyf("max", "%f", node->maxvalue.float_max);
+                               break;
+                       }
                }
 
                if (node->st->elapsed)
-                       printf(",\"rate\":%.4f",((float)node->counter) / node->st->elapsed);
+                       sharkd_json_value_anyf("rate", "%.4f", ((float)node->counter) / node->st->elapsed);
 
                if (node->parent && node->parent->counter)
-                       printf(",\"perc\":%.2f", (node->counter * 100.0) / node->parent->counter);
+                       sharkd_json_value_anyf("perc", "%.2f", (node->counter * 100.0) / node->parent->counter);
                else if (node->parent == &(node->st->root))
-                       printf(",\"perc\":100");
+                       sharkd_json_value_anyf("perc", "100");
 
                if (prefs.st_enable_burstinfo && node->max_burst)
                {
                        if (prefs.st_burst_showcount)
-                               printf(",\"burstcount\":%d", node->max_burst);
+                               sharkd_json_value_anyf("burstcount", "%d", node->max_burst);
                        else
-                               printf(",\"burstrate\":%.4f", ((double)node->max_burst) / prefs.st_burst_windowlen);
+                               sharkd_json_value_anyf("burstrate", "%.4f", ((double)node->max_burst) / prefs.st_burst_windowlen);
 
-                       printf(",\"bursttime\":%.3f", ((double)node->burst_time / 1000.0));
+                       sharkd_json_value_anyf("bursttime", "%.3f", (node->burst_time / 1000.0));
                }
 
                if (node->children)
                {
-                       printf(",\"sub\":");
+                       sharkd_json_value_anyf("sub", NULL);
                        sharkd_session_process_tap_stats_node_cb(node);
                }
-               printf("}");
-               sepa = ",";
+               json_dumper_end_object(&dumper);
        }
-       printf("]");
+       sharkd_json_array_close();
 }
 
 /**
@@ -1016,11 +1020,16 @@ sharkd_session_process_tap_stats_cb(void *psp)
 {
        stats_tree *st = (stats_tree *) psp;
 
-       printf("{\"tap\":\"stats:%s\",\"type\":\"stats\"", st->cfg->abbr);
+       json_dumper_begin_object(&dumper);
+
+       sharkd_json_value_stringf("tap", "stats:%s", st->cfg->abbr);
+       sharkd_json_value_string("type", "stats");
+       sharkd_json_value_string("name", st->cfg->name);
 
-       printf(",\"name\":\"%s\",\"stats\":", st->cfg->name);
+       sharkd_json_value_anyf("stats", NULL);
        sharkd_session_process_tap_stats_node_cb(&st->root);
-       printf("},");
+
+       json_dumper_end_object(&dumper);
 }
 
 static void
@@ -1056,47 +1065,43 @@ sharkd_session_process_tap_expert_cb(void *tapdata)
 {
        struct sharkd_expert_tap *etd = (struct sharkd_expert_tap *) tapdata;
        GSList *list;
-       const char *sepa = "";
 
-       printf("{\"tap\":\"%s\",\"type\":\"%s\"", "expert", "expert");
+       json_dumper_begin_object(&dumper);
+
+       sharkd_json_value_string("tap", "expert");
+       sharkd_json_value_string("type", "expert");
 
-       printf(",\"details\":[");
+       sharkd_json_array_open("details");
        for (list = etd->details; list; list = list->next)
        {
                expert_info_t *ei = (expert_info_t *) list->data;
                const char *tmp;
 
-               printf("%s{", sepa);
+               json_dumper_begin_object(&dumper);
 
-               printf("\"f\":%u,", ei->packet_num);
+               sharkd_json_value_anyf("f", "%u", ei->packet_num);
 
                tmp = try_val_to_str(ei->severity, expert_severity_vals);
                if (tmp)
-                       printf("\"s\":\"%s\",", tmp);
+                       sharkd_json_value_string("s", tmp);
 
                tmp = try_val_to_str(ei->group, expert_group_vals);
                if (tmp)
-                       printf("\"g\":\"%s\",", tmp);
+                       sharkd_json_value_string("g", tmp);
 
-               printf("\"m\":");
-               json_puts_string(ei->summary);
-               printf(",");
+               sharkd_json_value_string("m", ei->summary);
 
                if (ei->protocol)
-               {
-                       printf("\"p\":");
-                       json_puts_string(ei->protocol);
-               }
+                       sharkd_json_value_string("p", ei->protocol);
 
-               printf("}");
-               sepa = ",";
+               json_dumper_end_object(&dumper);
        }
-       printf("]");
+       sharkd_json_array_close();
 
-       printf("},");
+       json_dumper_end_object(&dumper);
 }
 
-static gboolean
+static tap_packet_status
 sharkd_session_packet_tap_expert_cb(void *tapdata, packet_info *pinfo _U_, epan_dissect_t *edt _U_, const void *pointer)
 {
        struct sharkd_expert_tap *etd = (struct sharkd_expert_tap *) tapdata;
@@ -1104,7 +1109,7 @@ sharkd_session_packet_tap_expert_cb(void *tapdata, packet_info *pinfo _U_, epan_
        expert_info_t *ei_copy;
 
        if (ei == NULL)
-               return FALSE;
+               return TAP_PACKET_DONT_REDRAW;
 
        ei_copy = g_new(expert_info_t, 1);
        /* Note: this is a shallow copy */
@@ -1116,7 +1121,7 @@ sharkd_session_packet_tap_expert_cb(void *tapdata, packet_info *pinfo _U_, epan_
 
        etd->details = g_slist_prepend(etd->details, ei_copy);
 
-       return TRUE;
+       return TAP_PACKET_REDRAW;
 }
 
 static void
@@ -1149,28 +1154,24 @@ sharkd_session_process_tap_flow_cb(void *tapdata)
        GList *flow_list;
        guint i;
 
-       const char *sepa = "";
-
        sequence_analysis_get_nodes(graph_analysis);
 
-       printf("{\"tap\":\"seqa:%s\",\"type\":\"%s\"", graph_analysis->name, "flow");
+       json_dumper_begin_object(&dumper);
+       sharkd_json_value_stringf("tap", "seqa:%s", graph_analysis->name);
+       sharkd_json_value_string("type", "flow");
 
-       printf(",\"nodes\":[");
+       sharkd_json_array_open("nodes");
        for (i = 0; i < graph_analysis->num_nodes; i++)
        {
                char *addr_str;
 
-               if (i)
-                       printf(",");
-
                addr_str = address_to_display(NULL, &(graph_analysis->nodes[i]));
-               json_puts_string(addr_str);
+               sharkd_json_value_string(NULL, addr_str);
                wmem_free(NULL, addr_str);
        }
-       printf("]");
-
-       printf(",\"flows\":[");
+       sharkd_json_array_close();
 
+       sharkd_json_array_open("flows");
        flow_list = g_queue_peek_nth_link(graph_analysis->items, 0);
        while (flow_list)
        {
@@ -1181,25 +1182,20 @@ sharkd_session_process_tap_flow_cb(void *tapdata)
                if (!sai->display)
                        continue;
 
-               printf("%s{", sepa);
+               json_dumper_begin_object(&dumper);
 
-               printf("\"t\":\"%s\"", sai->time_str);
-               printf(",\"n\":[%u,%u]", sai->src_node, sai->dst_node);
-               printf(",\"pn\":[%u,%u]", sai->port_src, sai->port_dst);
+               sharkd_json_value_string("t", sai->time_str);
+               sharkd_json_value_anyf("n", "[%u,%u]", sai->src_node, sai->dst_node);
+               sharkd_json_value_anyf("pn", "[%u,%u]", sai->port_src, sai->port_dst);
 
                if (sai->comment)
-               {
-                       printf(",\"c\":");
-                       json_puts_string(sai->comment);
-               }
+                       sharkd_json_value_string("c", sai->comment);
 
-               printf("}");
-               sepa = ",";
+               json_dumper_end_object(&dumper);
        }
+       sharkd_json_array_close();
 
-       printf("]");
-
-       printf("},");
+       json_dumper_end_object(&dumper);
 }
 
 static void
@@ -1218,126 +1214,78 @@ struct sharkd_conv_tap_data
        gboolean resolve_port;
 };
 
-static int
+static gboolean
 sharkd_session_geoip_addr(address *addr, const char *suffix)
 {
-       int with_geoip = 0;
-
-       (void) addr;
-       (void) suffix;
+       const mmdb_lookup_t *lookup = NULL;
+       gboolean with_geoip = FALSE;
+       char json_key[64];
 
-#ifdef HAVE_GEOIP
        if (addr->type == AT_IPv4)
        {
-               guint32 ip = pntoh32(addr->data);
-
-               guint num_dbs = geoip_db_num_dbs();
-               guint dbnum;
-
-               for (dbnum = 0; dbnum < num_dbs; dbnum++)
-               {
-                       const char *geoip_key = NULL;
-                       char *geoip_val;
-
-                       int db_type = geoip_db_type(dbnum);
-
-                       switch (db_type)
-                       {
-                               case GEOIP_COUNTRY_EDITION:
-                                       geoip_key = "geoip_country";
-                                       break;
-
-                               case GEOIP_CITY_EDITION_REV0:
-                               case GEOIP_CITY_EDITION_REV1:
-                                       geoip_key = "geoip_city";
-                                       break;
-
-                               case GEOIP_ORG_EDITION:
-                                       geoip_key = "geoip_org";
-                                       break;
-
-                               case GEOIP_ISP_EDITION:
-                                       geoip_key = "geoip_isp";
-                                       break;
-
-                               case GEOIP_ASNUM_EDITION:
-                                       geoip_key = "geoip_as";
-                                       break;
+               guint32 ip;
 
-                               case WS_LAT_FAKE_EDITION:
-                                       geoip_key = "geoip_lat";
-                                       break;
-
-                               case WS_LON_FAKE_EDITION:
-                                       geoip_key = "geoip_lon";
-                                       break;
-                       }
-
-                       if (geoip_key && (geoip_val = geoip_db_lookup_ipv4(dbnum, ip, NULL)))
-                       {
-                               printf(",\"%s%s\":", geoip_key, suffix);
-                               json_puts_string(geoip_val);
-                               with_geoip = 1;
-                       }
-               }
+               memcpy(&ip, addr->data, 4);
+               lookup = maxmind_db_lookup_ipv4(ip);
        }
-#ifdef HAVE_GEOIP_V6
-       if (addr->type == AT_IPv6)
+       else if (addr->type == AT_IPv6)
        {
                const ws_in6_addr *ip6 = (const ws_in6_addr *) addr->data;
 
-               guint num_dbs = geoip_db_num_dbs();
-               guint dbnum;
+               lookup = maxmind_db_lookup_ipv6(ip6);
+       }
 
-               for (dbnum = 0; dbnum < num_dbs; dbnum++)
-               {
-                       const char *geoip_key = NULL;
-                       char *geoip_val;
+       if (!lookup || !lookup->found)
+               return FALSE;
 
-                       int db_type = geoip_db_type(dbnum);
+       if (lookup->country)
+       {
+               snprintf(json_key, sizeof(json_key), "geoip_country%s", suffix);
+               sharkd_json_value_string(json_key, lookup->country);
+               with_geoip = TRUE;
+       }
 
-                       switch (db_type)
-                       {
-                               case GEOIP_COUNTRY_EDITION_V6:
-                                       geoip_key = "geoip_country";
-                                       break;
-#if NUM_DB_TYPES > 31
-                               case GEOIP_CITY_EDITION_REV0_V6:
-                               case GEOIP_CITY_EDITION_REV1_V6:
-                                       geoip_key = "geoip_city";
-                                       break;
+       if (lookup->country_iso)
+       {
+               snprintf(json_key, sizeof(json_key), "geoip_country_iso%s", suffix);
+               sharkd_json_value_string(json_key, lookup->country_iso);
+               with_geoip = TRUE;
+       }
 
-                               case GEOIP_ORG_EDITION_V6:
-                                       geoip_key = "geoip_org";
-                                       break;
+       if (lookup->city)
+       {
+               snprintf(json_key, sizeof(json_key), "geoip_city%s", suffix);
+               sharkd_json_value_string(json_key, lookup->city);
+               with_geoip = TRUE;
+       }
 
-                               case GEOIP_ISP_EDITION_V6:
-                                       geoip_key = "geoip_isp";
-                                       break;
+       if (lookup->as_org)
+       {
+               snprintf(json_key, sizeof(json_key), "geoip_as_org%s", suffix);
+               sharkd_json_value_string(json_key, lookup->as_org);
+               with_geoip = TRUE;
+       }
 
-                               case GEOIP_ASNUM_EDITION_V6:
-                                       geoip_key = "geoip_as";
-                                       break;
-#endif /* DB_NUM_TYPES */
-                               case WS_LAT_FAKE_EDITION:
-                                       geoip_key = "geoip_lat";
-                                       break;
+       if (lookup->as_number > 0)
+       {
+               snprintf(json_key, sizeof(json_key), "geoip_as%s", suffix);
+               sharkd_json_value_anyf(json_key, "%u", lookup->as_number);
+               with_geoip = TRUE;
+       }
 
-                               case WS_LON_FAKE_EDITION:
-                                       geoip_key = "geoip_lon";
-                                       break;
-                       }
+       if (lookup->latitude >= -90.0 && lookup->latitude <= 90.0)
+       {
+               snprintf(json_key, sizeof(json_key), "geoip_lat%s", suffix);
+               sharkd_json_value_anyf(json_key, "%f", lookup->latitude);
+               with_geoip = TRUE;
+       }
 
-                       if (geoip_key && (geoip_val = geoip_db_lookup_ipv6(dbnum, *ip6, NULL)))
-                       {
-                               printf(",\"%s%s\":", geoip_key, suffix);
-                               json_puts_string(geoip_val);
-                               with_geoip = 1;
-                       }
-               }
+       if (lookup->longitude >= -180.0 && lookup->longitude <= 180.0)
+       {
+               snprintf(json_key, sizeof(json_key), "geoip_lon%s", suffix);
+               sharkd_json_value_anyf(json_key, "%f", lookup->longitude);
+               with_geoip = TRUE;
        }
-#endif /* HAVE_GEOIP_V6 */
-#endif /* HAVE_GEOIP */
 
        return with_geoip;
 }
@@ -1363,7 +1311,7 @@ struct sharkd_analyse_rtp_items
 struct sharkd_analyse_rtp
 {
        const char *tap_name;
-       struct sharkd_rtp_match rtp;
+       rtpstream_id_t id;
 
        GSList *packets;
        double start_time;
@@ -1379,18 +1327,18 @@ sharkd_session_process_tap_rtp_free_cb(void *tapdata)
        g_free(rtp_req);
 }
 
-static gboolean
+static tap_packet_status
 sharkd_session_packet_tap_rtp_analyse_cb(void *tapdata, packet_info *pinfo, epan_dissect_t *edt _U_, const void *pointer)
 {
        struct sharkd_analyse_rtp *rtp_req = (struct sharkd_analyse_rtp *) tapdata;
-       const struct _rtp_info *rtpinfo = (const struct _rtp_info *) pointer;
+       const struct _rtp_info *rtp_info = (const struct _rtp_info *) pointer;
 
-       if (sharkd_rtp_match_check(&rtp_req->rtp, pinfo, rtpinfo))
+       if (rtpstream_id_equal_pinfo_rtp_info(&rtp_req->id, pinfo, rtp_info))
        {
                tap_rtp_stat_t *statinfo = &(rtp_req->statinfo);
                struct sharkd_analyse_rtp_items *item;
 
-               rtp_packet_analyse(statinfo, pinfo, rtpinfo);
+               rtppacket_analyse(statinfo, pinfo, rtp_info);
 
                item = (struct sharkd_analyse_rtp_items *) g_malloc(sizeof(struct sharkd_analyse_rtp_items));
 
@@ -1398,12 +1346,12 @@ sharkd_session_packet_tap_rtp_analyse_cb(void *tapdata, packet_info *pinfo, epan
                        rtp_req->start_time = nstime_to_sec(&pinfo->abs_ts);
 
                item->frame_num    = pinfo->num;
-               item->sequence_num = rtpinfo->info_seq_num;
+               item->sequence_num = rtp_info->info_seq_num;
                item->delta        = (statinfo->flags & STAT_FLAG_FIRST) ? 0.0 : statinfo->delta;
                item->jitter       = (statinfo->flags & STAT_FLAG_FIRST) ? 0.0 : statinfo->jitter;
                item->skew         = (statinfo->flags & STAT_FLAG_FIRST) ? 0.0 : statinfo->skew;
                item->bandwidth    = statinfo->bandwidth;
-               item->marker       = rtpinfo->info_marker_set ? TRUE : FALSE;
+               item->marker       = rtp_info->info_marker_set ? TRUE : FALSE;
                item->arrive_offset= nstime_to_sec(&pinfo->abs_ts) - rtp_req->start_time;
 
                item->flags = statinfo->flags;
@@ -1413,7 +1361,7 @@ sharkd_session_packet_tap_rtp_analyse_cb(void *tapdata, packet_info *pinfo, epan
                rtp_req->packets = g_slist_append(rtp_req->packets, item);
        }
 
-       return TRUE;
+       return TAP_PACKET_REDRAW;
 }
 
 /**
@@ -1454,74 +1402,97 @@ sharkd_session_process_tap_rtp_analyse_cb(void *tapdata)
        const struct sharkd_analyse_rtp *rtp_req = (struct sharkd_analyse_rtp *) tapdata;
        const tap_rtp_stat_t *statinfo = &rtp_req->statinfo;
 
-       const char *sepa = "";
        GSList *l;
 
-       printf("{\"tap\":\"%s\",\"type\":\"rtp-analyse\"", rtp_req->tap_name);
+       json_dumper_begin_object(&dumper);
 
-       printf(",\"ssrc\":%u", rtp_req->rtp.ssrc);
+       sharkd_json_value_string("tap", rtp_req->tap_name);
+       sharkd_json_value_string("type", "rtp-analyse");
+       sharkd_json_value_anyf("ssrc", "%u", rtp_req->id.ssrc);
 
-       printf(",\"max_delta\":%f", statinfo->max_delta);
-       printf(",\"max_delta_nr\":%u", statinfo->max_nr);
-       printf(",\"max_jitter\":%f", statinfo->max_jitter);
-       printf(",\"mean_jitter\":%f", statinfo->mean_jitter);
-       printf(",\"max_skew\":%f", statinfo->max_skew);
-       printf(",\"total_nr\":%u", statinfo->total_nr);
-       printf(",\"seq_err\":%u", statinfo->sequence);
-       printf(",\"duration\":%f", statinfo->time - statinfo->start_time);
+       sharkd_json_value_anyf("max_delta", "%f", statinfo->max_delta);
+       sharkd_json_value_anyf("max_delta_nr", "%u", statinfo->max_nr);
+       sharkd_json_value_anyf("max_jitter", "%f", statinfo->max_jitter);
+       sharkd_json_value_anyf("mean_jitter", "%f", statinfo->mean_jitter);
+       sharkd_json_value_anyf("max_skew", "%f", statinfo->max_skew);
+       sharkd_json_value_anyf("total_nr", "%u", statinfo->total_nr);
+       sharkd_json_value_anyf("seq_err", "%u", statinfo->sequence);
+       sharkd_json_value_anyf("duration", "%f", statinfo->time - statinfo->start_time);
 
-       printf(",\"items\":[");
+       sharkd_json_array_open("items");
        for (l = rtp_req->packets; l; l = l->next)
        {
                struct sharkd_analyse_rtp_items *item = (struct sharkd_analyse_rtp_items *) l->data;
 
-               printf("%s{", sepa);
+               json_dumper_begin_object(&dumper);
 
-               printf("\"f\":%u", item->frame_num);
-               printf(",\"o\":%.9f", item->arrive_offset);
-               printf(",\"sn\":%u", item->sequence_num);
-               printf(",\"d\":%.2f", item->delta);
-               printf(",\"j\":%.2f", item->jitter);
-               printf(",\"sk\":%.2f", item->skew);
-               printf(",\"bw\":%.2f", item->bandwidth);
+               sharkd_json_value_anyf("f", "%u", item->frame_num);
+               sharkd_json_value_anyf("o", "%.9f", item->arrive_offset);
+               sharkd_json_value_anyf("sn", "%u", item->sequence_num);
+               sharkd_json_value_anyf("d", "%.2f", item->delta);
+               sharkd_json_value_anyf("j", "%.2f", item->jitter);
+               sharkd_json_value_anyf("sk", "%.2f", item->skew);
+               sharkd_json_value_anyf("bw", "%.2f", item->bandwidth);
 
                if (item->pt == PT_CN)
-                       printf(",\"s\":\"%s\",\"t\":%d", "Comfort noise (PT=13, RFC 3389)", RTP_TYPE_CN);
+               {
+                       sharkd_json_value_string("s", "Comfort noise (PT=13, RFC 3389)");
+                       sharkd_json_value_anyf("t", "%d", RTP_TYPE_CN);
+               }
                else if (item->pt == PT_CN_OLD)
-                       printf(",\"s\":\"%s\",\"t\":%d", "Comfort noise (PT=19, reserved)", RTP_TYPE_CN);
+               {
+                       sharkd_json_value_string("s", "Comfort noise (PT=19, reserved)");
+                       sharkd_json_value_anyf("t", "%d", RTP_TYPE_CN);
+               }
                else if (item->flags & STAT_FLAG_WRONG_SEQ)
-                       printf(",\"s\":\"%s\",\"t\":%d", "Wrong sequence number", RTP_TYPE_ERROR);
+               {
+                       sharkd_json_value_string("s", "Wrong sequence number");
+                       sharkd_json_value_anyf("t", "%d", RTP_TYPE_ERROR);
+               }
                else if (item->flags & STAT_FLAG_DUP_PKT)
-                       printf(",\"s\":\"%s\",\"t\":%d", "Suspected duplicate (MAC address) only delta time calculated", RTP_TYPE_WARN);
+               {
+                       sharkd_json_value_string("s", "Suspected duplicate (MAC address) only delta time calculated");
+                       sharkd_json_value_anyf("t", "%d", RTP_TYPE_WARN);
+               }
                else if (item->flags & STAT_FLAG_REG_PT_CHANGE)
-                       printf(",\"s\":\"Payload changed to PT=%u%s\",\"t\":%d",
+               {
+                       sharkd_json_value_stringf("s", "Payload changed to PT=%u%s",
                                item->pt,
-                               (item->flags & STAT_FLAG_PT_T_EVENT) ? " telephone/event" : "",
-                               RTP_TYPE_WARN);
+                               (item->flags & STAT_FLAG_PT_T_EVENT) ? " telephone/event" : "");
+                       sharkd_json_value_anyf("t", "%d", RTP_TYPE_WARN);
+               }
                else if (item->flags & STAT_FLAG_WRONG_TIMESTAMP)
-                       printf(",\"s\":\"%s\",\"t\":%d", "Incorrect timestamp", RTP_TYPE_WARN);
+               {
+                       sharkd_json_value_string("s", "Incorrect timestamp");
+                       sharkd_json_value_anyf("t", "%d", RTP_TYPE_WARN);
+               }
                else if ((item->flags & STAT_FLAG_PT_CHANGE)
                        &&  !(item->flags & STAT_FLAG_FIRST)
                        &&  !(item->flags & STAT_FLAG_PT_CN)
                        &&  (item->flags & STAT_FLAG_FOLLOW_PT_CN)
                        &&  !(item->flags & STAT_FLAG_MARKER))
                {
-                       printf(",\"s\":\"%s\",\"t\":%d", "Marker missing?", RTP_TYPE_WARN);
+                       sharkd_json_value_string("s", "Marker missing?");
+                       sharkd_json_value_anyf("t", "%d", RTP_TYPE_WARN);
                }
                else if (item->flags & STAT_FLAG_PT_T_EVENT)
-                       printf(",\"s\":\"PT=%u telephone/event\",\"t\":%d", item->pt, RTP_TYPE_PT_EVENT);
+               {
+                       sharkd_json_value_stringf("s", "PT=%u telephone/event", item->pt);
+                       sharkd_json_value_anyf("t", "%d", RTP_TYPE_PT_EVENT);
+               }
                else if (item->flags & STAT_FLAG_MARKER)
-                       printf(",\"t\":%d", RTP_TYPE_WARN);
+               {
+                       sharkd_json_value_anyf("t", "%d", RTP_TYPE_WARN);
+               }
 
                if (item->marker)
-                       printf(",\"mark\":1");
+                       sharkd_json_value_anyf("mark", "1");
 
-               printf("}");
-               sepa = ",";
+               json_dumper_end_object(&dumper);
        }
-       printf("]");
+       sharkd_json_array_close();
 
-       printf("},");
+       json_dumper_end_object(&dumper);
 }
 
 /**
@@ -1532,6 +1503,7 @@ sharkd_session_process_tap_rtp_analyse_cb(void *tapdata)
  *   (m) type       - tap output type
  *   (m) proto      - protocol short name
  *   (o) filter     - filter string
+ *   (o) geoip      - whether GeoIP information is available, boolean
  *
  *   (o) convs      - array of object with attributes:
  *                  (m) saddr - source address
@@ -1544,6 +1516,7 @@ sharkd_session_process_tap_rtp_analyse_cb(void *tapdata)
  *                  (m) rxb   - RX bytes
  *                  (m) start - (relative) first packet time
  *                  (m) stop  - (relative) last packet time
+ *                  (o) filter - conversation filter
  *
  *   (o) hosts      - array of object with attributes:
  *                  (m) host - host address
@@ -1564,21 +1537,24 @@ sharkd_session_process_tap_conv_cb(void *arg)
 
        int with_geoip = 0;
 
+       json_dumper_begin_object(&dumper);
+       sharkd_json_value_string("tap", iu->type);
+
        if (!strncmp(iu->type, "conv:", 5))
        {
-               printf("{\"tap\":\"%s\",\"type\":\"conv\"", iu->type);
-               printf(",\"convs\":[");
+               sharkd_json_value_string("type", "conv");
+               sharkd_json_array_open("convs");
                proto = iu->type + 5;
        }
        else if (!strncmp(iu->type, "endpt:", 6))
        {
-               printf("{\"tap\":\"%s\",\"type\":\"host\"", iu->type);
-               printf(",\"hosts\":[");
+               sharkd_json_value_string("type", "host");
+               sharkd_json_array_open("hosts");
                proto = iu->type + 6;
        }
        else
        {
-               printf("{\"tap\":\"%s\",\"type\":\"err\"", iu->type);
+               sharkd_json_value_string("type", "err");
                proto = "";
        }
 
@@ -1593,33 +1569,33 @@ sharkd_session_process_tap_conv_cb(void *arg)
                        char *src_port, *dst_port;
                        char *filter_str;
 
-                       printf("%s{", i ? "," : "");
+                       json_dumper_begin_object(&dumper);
 
-                       printf("\"saddr\":\"%s\"",  (src_addr = get_conversation_address(NULL, &iui->src_address, iu->resolve_name)));
-                       printf(",\"daddr\":\"%s\"", (dst_addr = get_conversation_address(NULL, &iui->dst_address, iu->resolve_name)));
+                       sharkd_json_value_string("saddr", (src_addr = get_conversation_address(NULL, &iui->src_address, iu->resolve_name)));
+                       sharkd_json_value_string("daddr", (dst_addr = get_conversation_address(NULL, &iui->dst_address, iu->resolve_name)));
 
                        if (proto_with_port)
                        {
-                               printf(",\"sport\":\"%s\"", (src_port = get_conversation_port(NULL, iui->src_port, iui->etype, iu->resolve_port)));
-                               printf(",\"dport\":\"%s\"", (dst_port = get_conversation_port(NULL, iui->dst_port, iui->etype, iu->resolve_port)));
+                               sharkd_json_value_string("sport", (src_port = get_conversation_port(NULL, iui->src_port, iui->etype, iu->resolve_port)));
+                               sharkd_json_value_string("dport", (dst_port = get_conversation_port(NULL, iui->dst_port, iui->etype, iu->resolve_port)));
 
                                wmem_free(NULL, src_port);
                                wmem_free(NULL, dst_port);
                        }
 
-                       printf(",\"rxf\":%" G_GUINT64_FORMAT, iui->rx_frames);
-                       printf(",\"rxb\":%" G_GUINT64_FORMAT, iui->rx_bytes);
+                       sharkd_json_value_anyf("rxf", "%" G_GUINT64_FORMAT, iui->rx_frames);
+                       sharkd_json_value_anyf("rxb", "%" G_GUINT64_FORMAT, iui->rx_bytes);
 
-                       printf(",\"txf\":%" G_GUINT64_FORMAT, iui->tx_frames);
-                       printf(",\"txb\":%" G_GUINT64_FORMAT, iui->tx_bytes);
+                       sharkd_json_value_anyf("txf", "%" G_GUINT64_FORMAT, iui->tx_frames);
+                       sharkd_json_value_anyf("txb", "%" G_GUINT64_FORMAT, iui->tx_bytes);
 
-                       printf(",\"start\":%.9f", nstime_to_sec(&iui->start_time));
-                       printf(",\"stop\":%.9f", nstime_to_sec(&iui->stop_time));
+                       sharkd_json_value_anyf("start", "%.9f", nstime_to_sec(&iui->start_time));
+                       sharkd_json_value_anyf("stop", "%.9f", nstime_to_sec(&iui->stop_time));
 
                        filter_str = get_conversation_filter(iui, CONV_DIR_A_TO_FROM_B);
                        if (filter_str)
                        {
-                               printf(",\"filter\":\"%s\"", filter_str);
+                               sharkd_json_value_string("filter", filter_str);
                                g_free(filter_str);
                        }
 
@@ -1631,7 +1607,7 @@ sharkd_session_process_tap_conv_cb(void *arg)
                        if (sharkd_session_geoip_addr(&(iui->dst_address), "2"))
                                with_geoip = 1;
 
-                       printf("}");
+                       json_dumper_end_object(&dumper);
                }
        }
        else if (iu->hash.conv_array != NULL && !strncmp(iu->type, "endpt:", 6))
@@ -1642,27 +1618,27 @@ sharkd_session_process_tap_conv_cb(void *arg)
                        char *host_str, *port_str;
                        char *filter_str;
 
-                       printf("%s{", i ? "," : "");
+                       json_dumper_begin_object(&dumper);
 
-                       printf("\"host\":\"%s\"", (host_str = get_conversation_address(NULL, &host->myaddress, iu->resolve_name)));
+                       sharkd_json_value_string("host", (host_str = get_conversation_address(NULL, &host->myaddress, iu->resolve_name)));
 
                        if (proto_with_port)
                        {
-                               printf(",\"port\":\"%s\"", (port_str = get_conversation_port(NULL, host->port, host->etype, iu->resolve_port)));
+                               sharkd_json_value_string("port", (port_str = get_conversation_port(NULL, host->port, host->etype, iu->resolve_port)));
 
                                wmem_free(NULL, port_str);
                        }
 
-                       printf(",\"rxf\":%" G_GUINT64_FORMAT, host->rx_frames);
-                       printf(",\"rxb\":%" G_GUINT64_FORMAT, host->rx_bytes);
+                       sharkd_json_value_anyf("rxf", "%" G_GUINT64_FORMAT, host->rx_frames);
+                       sharkd_json_value_anyf("rxb", "%" G_GUINT64_FORMAT, host->rx_bytes);
 
-                       printf(",\"txf\":%" G_GUINT64_FORMAT, host->tx_frames);
-                       printf(",\"txb\":%" G_GUINT64_FORMAT, host->tx_bytes);
+                       sharkd_json_value_anyf("txf", "%" G_GUINT64_FORMAT, host->tx_frames);
+                       sharkd_json_value_anyf("txb", "%" G_GUINT64_FORMAT, host->tx_bytes);
 
                        filter_str = get_hostlist_filter(host);
                        if (filter_str)
                        {
-                               printf(",\"filter\":\"%s\"", filter_str);
+                               sharkd_json_value_string("filter", filter_str);
                                g_free(filter_str);
                        }
 
@@ -1670,11 +1646,15 @@ sharkd_session_process_tap_conv_cb(void *arg)
 
                        if (sharkd_session_geoip_addr(&(host->myaddress), ""))
                                with_geoip = 1;
-                       printf("}");
+                       json_dumper_end_object(&dumper);
                }
        }
+       sharkd_json_array_close();
 
-       printf("],\"proto\":\"%s\",\"geoip\":%s},", proto, with_geoip ? "true" : "false");
+       sharkd_json_value_string("proto", proto);
+       sharkd_json_value_anyf("geoip", with_geoip ? "true" : "false");
+
+       json_dumper_end_object(&dumper);
 }
 
 static void
@@ -1711,103 +1691,91 @@ sharkd_session_free_tap_conv_cb(void *arg)
 static void
 sharkd_session_process_tap_nstat_cb(void *arg)
 {
-       new_stat_data_t *stat_data = (new_stat_data_t *) arg;
+       stat_data_t *stat_data = (stat_data_t *) arg;
        guint i, j, k;
 
-       printf("{\"tap\":\"nstat:%s\",\"type\":\"nstat\"", stat_data->stat_tap_data->cli_string);
+       json_dumper_begin_object(&dumper);
+       sharkd_json_value_stringf("tap", "nstat:%s", stat_data->stat_tap_data->cli_string);
+       sharkd_json_value_string("type", "nstat");
 
-       printf(",\"fields\":[");
+       sharkd_json_array_open("fields");
        for (i = 0; i < stat_data->stat_tap_data->nfields; i++)
        {
                stat_tap_table_item *field = &(stat_data->stat_tap_data->fields[i]);
 
-               if (i)
-                       printf(",");
-
-               printf("{");
-
-               printf("\"c\":");
-               json_puts_string(field->column_name);
-
-               printf("}");
+               json_dumper_begin_object(&dumper);
+               sharkd_json_value_string("c", field->column_name);
+               json_dumper_end_object(&dumper);
        }
-       printf("]");
+       sharkd_json_array_close();
 
-       printf(",\"tables\":[");
+       sharkd_json_array_open("tables");
        for (i = 0; i < stat_data->stat_tap_data->tables->len; i++)
        {
                stat_tap_table *table = g_array_index(stat_data->stat_tap_data->tables, stat_tap_table *, i);
-               const char *sepa = "";
-
-               if (i)
-                       printf(",");
 
-               printf("{");
+               json_dumper_begin_object(&dumper);
 
-               printf("\"t\":");
-               printf("\"%s\"", table->title);
+               sharkd_json_value_string("t", table->title);
 
-               printf(",\"i\":[");
+               sharkd_json_array_open("i");
                for (j = 0; j < table->num_elements; j++)
                {
                        stat_tap_table_item_type *field_data;
 
-                       field_data = new_stat_tap_get_field_data(table, j, 0);
+                       field_data = stat_tap_get_field_data(table, j, 0);
                        if (field_data == NULL || field_data->type == TABLE_ITEM_NONE) /* Nothing for us here */
                                continue;
 
-                       printf("%s[", sepa);
+                       sharkd_json_array_open(NULL);
                        for (k = 0; k < table->num_fields; k++)
                        {
-                               field_data = new_stat_tap_get_field_data(table, j, k);
-
-                               if (k)
-                                       printf(",");
+                               field_data = stat_tap_get_field_data(table, j, k);
 
                                switch (field_data->type)
                                {
                                        case TABLE_ITEM_UINT:
-                                               printf("%u", field_data->value.uint_value);
+                                               sharkd_json_value_anyf(NULL, "%u", field_data->value.uint_value);
                                                break;
 
                                        case TABLE_ITEM_INT:
-                                               printf("%d", field_data->value.uint_value);
+                                               sharkd_json_value_anyf(NULL, "%d", field_data->value.int_value);
                                                break;
 
                                        case TABLE_ITEM_STRING:
-                                               json_puts_string(field_data->value.string_value);
+                                               sharkd_json_value_string(NULL, field_data->value.string_value);
                                                break;
 
                                        case TABLE_ITEM_FLOAT:
-                                               printf("%f", field_data->value.float_value);
+                                               sharkd_json_value_anyf(NULL, "%f", field_data->value.float_value);
                                                break;
 
                                        case TABLE_ITEM_ENUM:
-                                               printf("%d", field_data->value.enum_value);
+                                               sharkd_json_value_anyf(NULL, "%d", field_data->value.enum_value);
                                                break;
 
                                        case TABLE_ITEM_NONE:
-                                               printf("null");
+                                               sharkd_json_value_anyf(NULL, "null");
                                                break;
                                }
                        }
 
-                       printf("]");
-                       sepa = ",";
+                       sharkd_json_array_close();
                }
-               printf("]");
-               printf("}");
+               sharkd_json_array_close();
+               json_dumper_end_object(&dumper);
        }
+       sharkd_json_array_close();
 
-       printf("]},");
+       json_dumper_end_object(&dumper);
 }
 
 static void
 sharkd_session_free_tap_nstat_cb(void *arg)
 {
-       new_stat_data_t *stat_data = (new_stat_data_t *) arg;
+       stat_data_t *stat_data = (stat_data_t *) arg;
 
-       free_stat_tables(stat_data->stat_tap_data, NULL, NULL);
+       free_stat_tables(stat_data->stat_tap_data);
 }
 
 /**
@@ -1850,21 +1818,22 @@ sharkd_session_process_tap_rtd_cb(void *arg)
         * (for usage grep for: register_rtd_table)
         */
        const value_string *vs = get_rtd_value_string(rtd);
-       const char *sepa = "";
 
-       printf("{\"tap\":\"rtd:%s\",\"type\":\"rtd\"", filter);
+       json_dumper_begin_object(&dumper);
+       sharkd_json_value_stringf("tap", "rtd:%s", filter);
+       sharkd_json_value_string("type", "rtd");
 
        if (rtd_data->stat_table.num_rtds == 1)
        {
                const rtd_timestat *ms = &rtd_data->stat_table.time_stats[0];
 
-               printf(",\"open_req\":%u", ms->open_req_num);
-               printf(",\"disc_rsp\":%u", ms->disc_rsp_num);
-               printf(",\"req_dup\":%u", ms->req_dup_num);
-               printf(",\"rsp_dup\":%u", ms->rsp_dup_num);
+               sharkd_json_value_anyf("open_req", "%u", ms->open_req_num);
+               sharkd_json_value_anyf("disc_rsp", "%u", ms->disc_rsp_num);
+               sharkd_json_value_anyf("req_dup", "%u", ms->req_dup_num);
+               sharkd_json_value_anyf("rsp_dup", "%u", ms->rsp_dup_num);
        }
 
-       printf(",\"stats\":[");
+       sharkd_json_array_open("stats");
        for (i = 0; i < rtd_data->stat_table.num_rtds; i++)
        {
                const rtd_timestat *ms = &rtd_data->stat_table.time_stats[i];
@@ -1876,36 +1845,36 @@ sharkd_session_process_tap_rtd_cb(void *arg)
                        if (ms->rtd[j].num == 0)
                                continue;
 
-                       printf("%s{", sepa);
+                       json_dumper_begin_object(&dumper);
 
                        if (rtd_data->stat_table.num_rtds == 1)
                                type_str = val_to_str_const(j, vs, "Other"); /* 1 table - description per row */
                        else
                                type_str = val_to_str_const(i, vs, "Other"); /* multiple table - description per table */
-                       printf("\"type\":");
-                       json_puts_string(type_str);
+                       sharkd_json_value_string("type", type_str);
 
-                       printf(",\"num\":%u", ms->rtd[j].num);
-                       printf(",\"min\":%.9f", nstime_to_sec(&(ms->rtd[j].min)));
-                       printf(",\"max\":%.9f", nstime_to_sec(&(ms->rtd[j].max)));
-                       printf(",\"tot\":%.9f", nstime_to_sec(&(ms->rtd[j].tot)));
-                       printf(",\"min_frame\":%u", ms->rtd[j].min_num);
-                       printf(",\"max_frame\":%u", ms->rtd[j].max_num);
+                       sharkd_json_value_anyf("num", "%u", ms->rtd[j].num);
+                       sharkd_json_value_anyf("min", "%.9f", nstime_to_sec(&(ms->rtd[j].min)));
+                       sharkd_json_value_anyf("max", "%.9f", nstime_to_sec(&(ms->rtd[j].max)));
+                       sharkd_json_value_anyf("tot", "%.9f", nstime_to_sec(&(ms->rtd[j].tot)));
+                       sharkd_json_value_anyf("min_frame", "%u", ms->rtd[j].min_num);
+                       sharkd_json_value_anyf("max_frame", "%u", ms->rtd[j].max_num);
 
                        if (rtd_data->stat_table.num_rtds != 1)
                        {
                                /* like in tshark, display it on every row */
-                               printf(",\"open_req\":%u", ms->open_req_num);
-                               printf(",\"disc_rsp\":%u", ms->disc_rsp_num);
-                               printf(",\"req_dup\":%u", ms->req_dup_num);
-                               printf(",\"rsp_dup\":%u", ms->rsp_dup_num);
+                               sharkd_json_value_anyf("open_req", "%u", ms->open_req_num);
+                               sharkd_json_value_anyf("disc_rsp", "%u", ms->disc_rsp_num);
+                               sharkd_json_value_anyf("req_dup", "%u", ms->req_dup_num);
+                               sharkd_json_value_anyf("rsp_dup", "%u", ms->rsp_dup_num);
                        }
 
-                       printf("}");
-                       sepa = ",";
+                       json_dumper_end_object(&dumper);
                }
        }
-       printf("]},");
+       sharkd_json_array_close();
+
+       json_dumper_end_object(&dumper);
 }
 
 static void
@@ -1913,7 +1882,7 @@ sharkd_session_free_tap_rtd_cb(void *arg)
 {
        rtd_data_t *rtd_data = (rtd_data_t *) arg;
 
-       free_rtd_table(&rtd_data->stat_table, NULL, NULL);
+       free_rtd_table(&rtd_data->stat_table);
        g_free(rtd_data);
 }
 
@@ -1946,42 +1915,34 @@ sharkd_session_process_tap_srt_cb(void *arg)
 
        guint i;
 
-       printf("{\"tap\":\"srt:%s\",\"type\":\"srt\"", filter);
+       json_dumper_begin_object(&dumper);
+       sharkd_json_value_stringf("tap", "srt:%s", filter);
+       sharkd_json_value_string("type", "srt");
 
-       printf(",\"tables\":[");
+       sharkd_json_array_open("tables");
        for (i = 0; i < srt_data->srt_array->len; i++)
        {
                /* SRT table */
                srt_stat_table *rst = g_array_index(srt_data->srt_array, srt_stat_table *, i);
-               const char *sepa = "";
 
                int j;
 
-               if (i)
-                       printf(",");
-               printf("{");
+               json_dumper_begin_object(&dumper);
 
-               printf("\"n\":");
                if (rst->name)
-                       json_puts_string(rst->name);
+                       sharkd_json_value_string("n", rst->name);
                else if (rst->short_name)
-                       json_puts_string(rst->short_name);
+                       sharkd_json_value_string("n", rst->short_name);
                else
-                       printf("\"table%u\"", i);
+                       sharkd_json_value_stringf("n", "table%u", i);
 
                if (rst->filter_string)
-               {
-                       printf(",\"f\":");
-                       json_puts_string(rst->filter_string);
-               }
+                       sharkd_json_value_string("f", rst->filter_string);
 
                if (rst->proc_column_name)
-               {
-                       printf(",\"c\":");
-                       json_puts_string(rst->proc_column_name);
-               }
+                       sharkd_json_value_string("c", rst->proc_column_name);
 
-               printf(",\"r\":[");
+               sharkd_json_array_open("r");
                for (j = 0; j < rst->num_procs; j++)
                {
                        /* SRT row */
@@ -1990,27 +1951,28 @@ sharkd_session_process_tap_srt_cb(void *arg)
                        if (proc->stats.num == 0)
                                continue;
 
-                       printf("%s{", sepa);
+                       json_dumper_begin_object(&dumper);
 
-                       printf("\"n\":");
-                       json_puts_string(proc->procedure);
+                       sharkd_json_value_string("n", proc->procedure);
 
                        if (rst->filter_string)
-                               printf(",\"idx\":%d", proc->proc_index);
+                               sharkd_json_value_anyf("idx", "%d", proc->proc_index);
 
-                       printf(",\"num\":%u", proc->stats.num);
+                       sharkd_json_value_anyf("num", "%u", proc->stats.num);
 
-                       printf(",\"min\":%.9f", nstime_to_sec(&proc->stats.min));
-                       printf(",\"max\":%.9f", nstime_to_sec(&proc->stats.max));
-                       printf(",\"tot\":%.9f", nstime_to_sec(&proc->stats.tot));
+                       sharkd_json_value_anyf("min", "%.9f", nstime_to_sec(&proc->stats.min));
+                       sharkd_json_value_anyf("max", "%.9f", nstime_to_sec(&proc->stats.max));
+                       sharkd_json_value_anyf("tot", "%.9f", nstime_to_sec(&proc->stats.tot));
 
-                       printf("}");
-                       sepa = ",";
+                       json_dumper_end_object(&dumper);
                }
-               printf("]}");
+               sharkd_json_array_close();
+
+               json_dumper_end_object(&dumper);
        }
+       sharkd_json_array_close();
 
-       printf("]},");
+       json_dumper_end_object(&dumper);
 }
 
 static void
@@ -2019,7 +1981,7 @@ sharkd_session_free_tap_srt_cb(void *arg)
        srt_data_t *srt_data = (srt_data_t *) arg;
        register_srt_t *srt = (register_srt_t *) srt_data->user_data;
 
-       free_srt_table(srt, srt_data->srt_array, NULL, NULL);
+       free_srt_table(srt, srt_data->srt_array);
        g_array_free(srt_data->srt_array, TRUE);
        g_free(srt_data);
 }
@@ -2057,46 +2019,41 @@ sharkd_session_process_tap_eo_cb(void *tapdata)
        GSList *slist;
        int i = 0;
 
-       printf("{\"tap\":\"%s\",\"type\":\"eo\"", object_list->type);
-       printf(",\"proto\":\"%s\"", object_list->proto);
-       printf(",\"objects\":[");
+       json_dumper_begin_object(&dumper);
+       sharkd_json_value_string("tap", object_list->type);
+       sharkd_json_value_string("type", "eo");
+
+       sharkd_json_value_string("proto", object_list->proto);
 
+       sharkd_json_array_open("objects");
        for (slist = object_list->entries; slist; slist = slist->next)
        {
                const export_object_entry_t *eo_entry = (export_object_entry_t *) slist->data;
 
-               printf("%s{", i ? "," : "");
+               json_dumper_begin_object(&dumper);
 
-               printf("\"pkt\":%u", eo_entry->pkt_num);
+               sharkd_json_value_anyf("pkt", "%u", eo_entry->pkt_num);
 
                if (eo_entry->hostname)
-               {
-                       printf(",\"hostname\":");
-                       json_puts_string(eo_entry->hostname);
-               }
+                       sharkd_json_value_string("hostname", eo_entry->hostname);
 
                if (eo_entry->content_type)
-               {
-                       printf(",\"type\":");
-                       json_puts_string(eo_entry->content_type);
-               }
+                       sharkd_json_value_string("type", eo_entry->content_type);
 
                if (eo_entry->filename)
-               {
-                       printf(",\"filename\":");
-                       json_puts_string(eo_entry->filename);
-               }
+                       sharkd_json_value_string("filename", eo_entry->filename);
 
-               printf(",\"_download\":\"%s_%d\"", object_list->type, i);
+               sharkd_json_value_stringf("_download", "%s_%d", object_list->type, i);
 
-               printf(",\"len\":%" G_GINT64_FORMAT, eo_entry->payload_len);
+               sharkd_json_value_anyf("len", "%" G_GINT64_FORMAT, eo_entry->payload_len);
 
-               printf("}");
+               json_dumper_end_object(&dumper);
 
                i++;
        }
+       sharkd_json_array_close();
 
-       printf("]},");
+       json_dumper_end_object(&dumper);
 }
 
 static void
@@ -2143,59 +2100,50 @@ sharkd_session_process_tap_rtp_cb(void *arg)
        rtpstream_tapinfo_t *rtp_tapinfo = (rtpstream_tapinfo_t *) arg;
 
        GList *listx;
-       const char *sepa = "";
 
-       printf("{\"tap\":\"%s\",\"type\":\"%s\"", "rtp-streams", "rtp-streams");
+       json_dumper_begin_object(&dumper);
+       sharkd_json_value_string("tap", "rtp-streams");
+       sharkd_json_value_string("type", "rtp-streams");
 
-       printf(",\"streams\":[");
+       sharkd_json_array_open("streams");
        for (listx = g_list_first(rtp_tapinfo->strinfo_list); listx; listx = listx->next)
        {
-               rtp_stream_info_t *streaminfo = (rtp_stream_info_t *) listx->data;
-
-               char *src_addr, *dst_addr;
-               char *payload;
-               guint32 expected;
+               rtpstream_info_t *streaminfo = (rtpstream_info_t *) listx->data;
+               rtpstream_info_calc_t calc;
 
-               src_addr = address_to_display(NULL, &(streaminfo->src_addr));
-               dst_addr = address_to_display(NULL, &(streaminfo->dest_addr));
+               rtpstream_info_calculate(streaminfo, &calc);
 
-               if (streaminfo->payload_type_name != NULL)
-                       payload = wmem_strdup(NULL, streaminfo->payload_type_name);
-               else
-                       payload = val_to_str_ext_wmem(NULL, streaminfo->payload_type, &rtp_payload_type_short_vals_ext, "Unknown (%u)");
+               json_dumper_begin_object(&dumper);
 
-               printf("%s{\"ssrc\":%u", sepa, streaminfo->ssrc);
-               printf(",\"payload\":\"%s\"", payload);
+               sharkd_json_value_anyf("ssrc", "%u", calc.ssrc);
+               sharkd_json_value_string("payload", calc.all_payload_type_names);
 
-               printf(",\"saddr\":\"%s\"", src_addr);
-               printf(",\"sport\":%u", streaminfo->src_port);
+               sharkd_json_value_string("saddr", calc.src_addr_str);
+               sharkd_json_value_anyf("sport", "%u", calc.src_port);
+               sharkd_json_value_string("daddr", calc.dst_addr_str);
+               sharkd_json_value_anyf("dport", "%u", calc.dst_port);
 
-               printf(",\"daddr\":\"%s\"", dst_addr);
-               printf(",\"dport\":%u", streaminfo->dest_port);
+               sharkd_json_value_anyf("pkts", "%u", calc.packet_count);
 
-               printf(",\"pkts\":%u", streaminfo->packet_count);
+               sharkd_json_value_anyf("max_delta", "%f",calc.max_delta);
+               sharkd_json_value_anyf("max_jitter", "%f", calc.max_jitter);
+               sharkd_json_value_anyf("mean_jitter", "%f", calc.mean_jitter);
 
-               printf(",\"max_delta\":%f", streaminfo->rtp_stats.max_delta);
-               printf(",\"max_jitter\":%f", streaminfo->rtp_stats.max_jitter);
-               printf(",\"mean_jitter\":%f", streaminfo->rtp_stats.mean_jitter);
+               sharkd_json_value_anyf("expectednr", "%u", calc.packet_expected);
+               sharkd_json_value_anyf("totalnr", "%u", calc.total_nr);
 
-               expected = (streaminfo->rtp_stats.stop_seq_nr + streaminfo->rtp_stats.cycles * 65536) - streaminfo->rtp_stats.start_seq_nr + 1;
-               printf(",\"expectednr\":%u", expected);
-               printf(",\"totalnr\":%u", streaminfo->rtp_stats.total_nr);
-
-               printf(",\"problem\":%s", streaminfo->problem ? "true" : "false");
+               sharkd_json_value_anyf("problem", calc.problem ? "true" : "false");
 
                /* for filter */
-               printf(",\"ipver\":%d", (streaminfo->src_addr.type == AT_IPv6) ? 6 : 4);
+               sharkd_json_value_anyf("ipver", "%d", (streaminfo->id.src_addr.type == AT_IPv6) ? 6 : 4);
 
-               wmem_free(NULL, src_addr);
-               wmem_free(NULL, dst_addr);
-               wmem_free(NULL, payload);
+               rtpstream_info_calc_free(&calc);
 
-               printf("}");
-               sepa = ",";
+               json_dumper_end_object(&dumper);
        }
-       printf("]},");
+       sharkd_json_array_close();
+
+       json_dumper_end_object(&dumper);
 }
 
 /**
@@ -2265,7 +2213,7 @@ sharkd_session_process_tap(char *buf, const jsmntok_t *tokens, int count)
 
                        st = stats_tree_new(cfg, NULL, tap_filter);
 
-                       tap_error = register_tap_listener(st->cfg->tapname, st, st->filter, st->cfg->flags, stats_tree_reset, stats_tree_packet, sharkd_session_process_tap_stats_cb);
+                       tap_error = register_tap_listener(st->cfg->tapname, st, st->filter, st->cfg->flags, stats_tree_reset, stats_tree_packet, sharkd_session_process_tap_stats_cb, NULL);
 
                        if (!tap_error && cfg->init)
                                cfg->init(st);
@@ -2280,7 +2228,7 @@ sharkd_session_process_tap(char *buf, const jsmntok_t *tokens, int count)
                        expert_tap = g_new0(struct sharkd_expert_tap, 1);
                        expert_tap->text = g_string_chunk_new(100);
 
-                       tap_error = register_tap_listener("expert", expert_tap, NULL, 0, NULL, sharkd_session_packet_tap_expert_cb, sharkd_session_process_tap_expert_cb);
+                       tap_error = register_tap_listener("expert", expert_tap, NULL, 0, NULL, sharkd_session_packet_tap_expert_cb, sharkd_session_process_tap_expert_cb, NULL);
 
                        tap_data = expert_tap;
                        tap_free = sharkd_session_free_tap_expert_cb;
@@ -2309,7 +2257,7 @@ sharkd_session_process_tap(char *buf, const jsmntok_t *tokens, int count)
                        tap_flags = sequence_analysis_get_tap_flags(analysis);
                        tap_func  = sequence_analysis_get_packet_func(analysis);
 
-                       tap_error = register_tap_listener(tap_name, graph_analysis, NULL, tap_flags, NULL, tap_func, sharkd_session_process_tap_flow_cb);
+                       tap_error = register_tap_listener(tap_name, graph_analysis, NULL, tap_flags, NULL, tap_func, sharkd_session_process_tap_flow_cb, NULL);
 
                        tap_data = graph_analysis;
                        tap_free = sharkd_session_free_tap_flow_cb;
@@ -2357,15 +2305,15 @@ sharkd_session_process_tap(char *buf, const jsmntok_t *tokens, int count)
                        ct_data->resolve_name = TRUE;
                        ct_data->resolve_port = TRUE;
 
-                       tap_error = register_tap_listener(ct_tapname, &ct_data->hash, tap_filter, 0, NULL, tap_func, sharkd_session_process_tap_conv_cb);
+                       tap_error = register_tap_listener(ct_tapname, &ct_data->hash, tap_filter, 0, NULL, tap_func, sharkd_session_process_tap_conv_cb, NULL);
 
                        tap_data = &ct_data->hash;
                        tap_free = sharkd_session_free_tap_conv_cb;
                }
                else if (!strncmp(tok_tap, "nstat:", 6))
                {
-                       stat_tap_table_ui *stat_tap = new_stat_tap_by_name(tok_tap + 6);
-                       new_stat_data_t *stat_data;
+                       stat_tap_table_ui *stat_tap = stat_tap_by_name(tok_tap + 6);
+                       stat_data_t *stat_data;
 
                        if (!stat_tap)
                        {
@@ -2373,13 +2321,13 @@ sharkd_session_process_tap(char *buf, const jsmntok_t *tokens, int count)
                                continue;
                        }
 
-                       stat_tap->stat_tap_init_cb(stat_tap, NULL, NULL);
+                       stat_tap->stat_tap_init_cb(stat_tap);
 
-                       stat_data = g_new0(new_stat_data_t, 1);
+                       stat_data = g_new0(stat_data_t, 1);
                        stat_data->stat_tap_data = stat_tap;
                        stat_data->user_data = NULL;
 
-                       tap_error = register_tap_listener(stat_tap->tap_name, stat_data, tap_filter, 0, NULL, stat_tap->packet_func, sharkd_session_process_tap_nstat_cb);
+                       tap_error = register_tap_listener(stat_tap->tap_name, stat_data, tap_filter, 0, NULL, stat_tap->packet_func, sharkd_session_process_tap_nstat_cb, NULL);
 
                        tap_data = stat_data;
                        tap_free = sharkd_session_free_tap_nstat_cb;
@@ -2408,7 +2356,7 @@ sharkd_session_process_tap(char *buf, const jsmntok_t *tokens, int count)
                        rtd_data->user_data = rtd;
                        rtd_table_dissector_init(rtd, &rtd_data->stat_table, NULL, NULL);
 
-                       tap_error = register_tap_listener(get_rtd_tap_listener_name(rtd), rtd_data, tap_filter, 0, NULL, get_rtd_packet_func(rtd), sharkd_session_process_tap_rtd_cb);
+                       tap_error = register_tap_listener(get_rtd_tap_listener_name(rtd), rtd_data, tap_filter, 0, NULL, get_rtd_packet_func(rtd), sharkd_session_process_tap_rtd_cb, NULL);
 
                        tap_data = rtd_data;
                        tap_free = sharkd_session_free_tap_rtd_cb;
@@ -2436,9 +2384,9 @@ sharkd_session_process_tap(char *buf, const jsmntok_t *tokens, int count)
                        srt_data = g_new0(srt_data_t, 1);
                        srt_data->srt_array = g_array_new(FALSE, TRUE, sizeof(srt_stat_table *));
                        srt_data->user_data = srt;
-                       srt_table_dissector_init(srt, srt_data->srt_array, NULL, NULL);
+                       srt_table_dissector_init(srt, srt_data->srt_array);
 
-                       tap_error = register_tap_listener(get_srt_tap_listener_name(srt), srt_data, tap_filter, 0, NULL, get_srt_packet_func(srt), sharkd_session_process_tap_srt_cb);
+                       tap_error = register_tap_listener(get_srt_tap_listener_name(srt), srt_data, tap_filter, 0, NULL, get_srt_packet_func(srt), sharkd_session_process_tap_srt_cb, NULL);
 
                        tap_data = srt_data;
                        tap_free = sharkd_session_free_tap_srt_cb;
@@ -2480,14 +2428,14 @@ sharkd_session_process_tap(char *buf, const jsmntok_t *tokens, int count)
                        eo_object->get_entry = sharkd_eo_object_list_get_entry;
                        eo_object->gui_data = (void *) object_list;
 
-                       tap_error = register_tap_listener(get_eo_tap_listener_name(eo), eo_object, NULL, 0, NULL, get_eo_packet_func(eo), sharkd_session_process_tap_eo_cb);
+                       tap_error = register_tap_listener(get_eo_tap_listener_name(eo), eo_object, NULL, 0, NULL, get_eo_packet_func(eo), sharkd_session_process_tap_eo_cb, NULL);
 
                        tap_data = eo_object;
                        tap_free = g_free; /* need to free only eo_object, object_list need to be kept for potential download */
                }
                else if (!strcmp(tok_tap, "rtp-streams"))
                {
-                       tap_error = register_tap_listener("rtp", &rtp_tapinfo, tap_filter, 0, rtpstream_reset_cb, rtpstream_packet, sharkd_session_process_tap_rtp_cb);
+                       tap_error = register_tap_listener("rtp", &rtp_tapinfo, tap_filter, 0, rtpstream_reset_cb, rtpstream_packet_cb, sharkd_session_process_tap_rtp_cb, NULL);
 
                        tap_data = &rtp_tapinfo;
                        tap_free = rtpstream_reset_cb;
@@ -2497,8 +2445,9 @@ sharkd_session_process_tap(char *buf, const jsmntok_t *tokens, int count)
                        struct sharkd_analyse_rtp *rtp_req;
 
                        rtp_req = (struct sharkd_analyse_rtp *) g_malloc0(sizeof(*rtp_req));
-                       if (!sharkd_rtp_match_init(&rtp_req->rtp, tok_tap + 12))
+                       if (!sharkd_rtp_match_init(&rtp_req->id, tok_tap + 12))
                        {
+                               rtpstream_id_free(&rtp_req->id);
                                g_free(rtp_req);
                                continue;
                        }
@@ -2507,7 +2456,7 @@ sharkd_session_process_tap(char *buf, const jsmntok_t *tokens, int count)
                        rtp_req->statinfo.first_packet = TRUE;
                        rtp_req->statinfo.reg_pt = PT_UNDEFINED;
 
-                       tap_error = register_tap_listener("rtp", rtp_req, tap_filter, 0, NULL, sharkd_session_packet_tap_rtp_analyse_cb, sharkd_session_process_tap_rtp_analyse_cb);
+                       tap_error = register_tap_listener("rtp", rtp_req, tap_filter, 0, NULL, sharkd_session_packet_tap_rtp_analyse_cb, sharkd_session_process_tap_rtp_analyse_cb, NULL);
 
                        tap_data = rtp_req;
                        tap_free = sharkd_session_process_tap_rtp_free_cb;
@@ -2536,9 +2485,16 @@ sharkd_session_process_tap(char *buf, const jsmntok_t *tokens, int count)
        if (taps_count == 0)
                return;
 
-       printf("{\"taps\":[");
+       json_dumper_begin_object(&dumper);
+
+       sharkd_json_array_open("taps");
        sharkd_retap();
-       printf("null],\"err\":0}\n");
+       sharkd_json_array_close();
+
+       sharkd_json_value_anyf("err", "0");
+
+       json_dumper_end_object(&dumper);
+       json_dumper_finish(&dumper);
 
        for (i = 0; i < taps_count; i++)
        {
@@ -2600,7 +2556,7 @@ sharkd_session_process_follow(char *buf, const jsmntok_t *tokens, int count)
        follow_info = g_new0(follow_info_t, 1);
        /* gui_data, filter_out_filter not set, but not used by dissector */
 
-       tap_error = register_tap_listener(get_follow_tap_string(follower), follow_info, tok_filter, 0, NULL, get_follow_tap_handler(follower), NULL);
+       tap_error = register_tap_listener(get_follow_tap_string(follower), follow_info, tok_filter, 0, NULL, get_follow_tap_handler(follower), NULL, NULL);
        if (tap_error)
        {
                fprintf(stderr, "sharkd_session_process_follow() name=%s error=%s", tok_follow, tap_error->str);
@@ -2611,76 +2567,66 @@ sharkd_session_process_follow(char *buf, const jsmntok_t *tokens, int count)
 
        sharkd_retap();
 
-       printf("{");
+       json_dumper_begin_object(&dumper);
 
-       printf("\"err\":0");
+       sharkd_json_value_anyf("err", "0");
 
        /* Server information: hostname, port, bytes sent */
        host = address_to_name(&follow_info->server_ip);
-       printf(",\"shost\":");
-       json_puts_string(host);
+       sharkd_json_value_string("shost", host);
 
        port = get_follow_port_to_display(follower)(NULL, follow_info->server_port);
-       printf(",\"sport\":");
-       json_puts_string(port);
+       sharkd_json_value_string("sport", port);
        wmem_free(NULL, port);
 
-       printf(",\"sbytes\":%u", follow_info->bytes_written[0]);
+       sharkd_json_value_anyf("sbytes", "%u", follow_info->bytes_written[0]);
 
        /* Client information: hostname, port, bytes sent */
        host = address_to_name(&follow_info->client_ip);
-       printf(",\"chost\":");
-       json_puts_string(host);
+       sharkd_json_value_string("chost", host);
 
        port = get_follow_port_to_display(follower)(NULL, follow_info->client_port);
-       printf(",\"cport\":");
-       json_puts_string(port);
+       sharkd_json_value_string("cport", port);
        wmem_free(NULL, port);
 
-       printf(",\"cbytes\":%u", follow_info->bytes_written[1]);
+       sharkd_json_value_anyf("cbytes", "%u", follow_info->bytes_written[1]);
 
        if (follow_info->payload)
        {
                follow_record_t *follow_record;
                GList *cur;
-               const char *sepa = "";
 
-               printf(",\"payloads\":[");
-
-               for (cur = follow_info->payload; cur; cur = g_list_next(cur))
+               sharkd_json_array_open("payloads");
+               for (cur = g_list_last(follow_info->payload); cur; cur = g_list_previous(cur))
                {
                        follow_record = (follow_record_t *) cur->data;
 
-                       printf("%s{", sepa);
-
-                       printf("\"n\":%u", follow_record->packet_num);
+                       json_dumper_begin_object(&dumper);
 
-                       printf(",\"d\":");
-                       json_print_base64(follow_record->data->data, follow_record->data->len);
+                       sharkd_json_value_anyf("n", "%u", follow_record->packet_num);
+                       sharkd_json_value_base64("d", follow_record->data->data, follow_record->data->len);
 
                        if (follow_record->is_server)
-                               printf(",\"s\":%d", 1);
+                               sharkd_json_value_anyf("s", "%d", 1);
 
-                       printf("}");
-                       sepa = ",";
+                       json_dumper_end_object(&dumper);
                }
-
-               printf("]");
+               sharkd_json_array_close();
        }
 
-       printf("}\n");
+       json_dumper_end_object(&dumper);
+       json_dumper_finish(&dumper);
 
        remove_tap_listener(follow_info);
        follow_info_free(follow_info);
 }
 
 static void
-sharkd_session_process_frame_cb_tree(epan_dissect_t *edt, proto_tree *tree, tvbuff_t **tvbs)
+sharkd_session_process_frame_cb_tree(epan_dissect_t *edt, proto_tree *tree, tvbuff_t **tvbs, gboolean display_hidden)
 {
        proto_node *node;
-       const char *sepa = "";
 
-       printf("[");
+       sharkd_json_array_open(NULL);
        for (node = tree->first_child; node; node = node->next)
        {
                field_info *finfo = PNODE_FINFO(node);
@@ -2688,24 +2634,22 @@ sharkd_session_process_frame_cb_tree(epan_dissect_t *edt, proto_tree *tree, tvbu
                if (!finfo)
                        continue;
 
-               /* XXX, for now always skip hidden */
-               if (FI_GET_FLAG(finfo, FI_HIDDEN))
+               if (!display_hidden && FI_GET_FLAG(finfo, FI_HIDDEN))
                        continue;
 
-               printf("%s{", sepa);
+               json_dumper_begin_object(&dumper);
 
-               printf("\"l\":");
                if (!finfo->rep)
                {
                        char label_str[ITEM_LABEL_LENGTH];
 
                        label_str[0] = '\0';
                        proto_item_fill_label(finfo, label_str);
-                       json_puts_string(label_str);
+                       sharkd_json_value_string("l", label_str);
                }
                else
                {
-                       json_puts_string(finfo->rep->representation);
+                       sharkd_json_value_string("l", finfo->rep->representation);
                }
 
                if (finfo->ds_tvb && tvbs && tvbs[0] != finfo->ds_tvb)
@@ -2716,17 +2660,17 @@ sharkd_session_process_frame_cb_tree(epan_dissect_t *edt, proto_tree *tree, tvbu
                        {
                                if (tvbs[idx] == finfo->ds_tvb)
                                {
-                                       printf(",\"ds\":%d", idx);
+                                       sharkd_json_value_anyf("ds", "%d", idx);
                                        break;
                                }
                        }
                }
 
                if (finfo->start >= 0 && finfo->length > 0)
-                       printf(",\"h\":[%d,%d]", finfo->start, finfo->length);
+                       sharkd_json_value_anyf("h", "[%d,%d]", finfo->start, finfo->length);
 
                if (finfo->appendix_start >= 0 && finfo->appendix_length > 0)
-                       printf(",\"i\":[%d,%d]", finfo->appendix_start, finfo->appendix_length);
+                       sharkd_json_value_anyf("i", "[%d,%d]", finfo->appendix_start, finfo->appendix_length);
 
 
                if (finfo->hfinfo)
@@ -2735,51 +2679,57 @@ sharkd_session_process_frame_cb_tree(epan_dissect_t *edt, proto_tree *tree, tvbu
 
                        if (finfo->hfinfo->type == FT_PROTOCOL)
                        {
-                               printf(",\"t\":\"proto\"");
+                               sharkd_json_value_string("t", "proto");
                        }
                        else if (finfo->hfinfo->type == FT_FRAMENUM)
                        {
-                               printf(",\"t\":\"framenum\",\"fnum\":%u", finfo->value.value.uinteger);
+                               sharkd_json_value_string("t", "framenum");
+                               sharkd_json_value_anyf("fnum", "%u", finfo->value.value.uinteger);
                        }
                        else if (FI_GET_FLAG(finfo, FI_URL) && IS_FT_STRING(finfo->hfinfo->type))
                        {
                                char *url = fvalue_to_string_repr(NULL, &finfo->value, FTREPR_DISPLAY, finfo->hfinfo->display);
 
-                               printf(",\"t\":\"url\",\"url\":");
-                               json_puts_string(url);
+                               sharkd_json_value_string("t", "url");
+                               sharkd_json_value_string("url", url);
                                wmem_free(NULL, url);
                        }
 
                        filter = proto_construct_match_selected_string(finfo, edt);
                        if (filter)
                        {
-                               printf(",\"f\":");
-                               json_puts_string(filter);
+                               sharkd_json_value_string("f", filter);
                                wmem_free(NULL, filter);
                        }
                }
 
+               if (FI_GET_FLAG(finfo, FI_GENERATED))
+                       sharkd_json_value_anyf("g", "true");
+
+               if (FI_GET_FLAG(finfo, FI_HIDDEN))
+                       sharkd_json_value_anyf("v", "true");
+
                if (FI_GET_FLAG(finfo, PI_SEVERITY_MASK))
                {
                        const char *severity = try_val_to_str(FI_GET_FLAG(finfo, PI_SEVERITY_MASK), expert_severity_vals);
 
                        g_assert(severity != NULL);
 
-                       printf(",\"s\":\"%s\"", severity);
+                       sharkd_json_value_string("s", severity);
                }
 
                if (((proto_tree *) node)->first_child)
                {
                        if (finfo->tree_type != -1)
-                               printf(",\"e\":%d", finfo->tree_type);
-                       printf(",\"n\":");
-                       sharkd_session_process_frame_cb_tree(edt, (proto_tree *) node, tvbs);
+                               sharkd_json_value_anyf("e", "%d", finfo->tree_type);
+
+                       sharkd_json_value_anyf("n", NULL);
+                       sharkd_session_process_frame_cb_tree(edt, (proto_tree *) node, tvbs, display_hidden);
                }
 
-               printf("}");
-               sepa = ",";
+               json_dumper_end_object(&dumper);
        }
-       printf("]");
+       sharkd_json_array_close();
 }
 
 static gboolean
@@ -2799,9 +2749,10 @@ sharkd_follower_visit_layers_cb(const void *key _U_, void *value, void *user_dat
 
                follow_filter = get_follow_conv_func(follower)(pi, &ignore_stream);
 
-               printf(",[\"%s\",", layer_proto);
-               json_puts_string(follow_filter);
-               printf("]");
+               json_dumper_begin_array(&dumper);
+               json_dumper_value_string(&dumper, layer_proto);
+               json_dumper_value_string(&dumper, follow_filter);
+               json_dumper_end_array(&dumper);
 
                g_free(follow_filter);
        }
@@ -2809,6 +2760,11 @@ sharkd_follower_visit_layers_cb(const void *key _U_, void *value, void *user_dat
        return FALSE;
 }
 
+struct sharkd_frame_request_data
+{
+       gboolean display_hidden;
+};
+
 static void
 sharkd_session_process_frame_cb(epan_dissect_t *edt, proto_tree *tree, struct epan_column_info *cinfo, const GSList *data_src, void *data)
 {
@@ -2816,29 +2772,25 @@ sharkd_session_process_frame_cb(epan_dissect_t *edt, proto_tree *tree, struct ep
        frame_data *fdata = pi->fd;
        const char *pkt_comment = NULL;
 
-       (void) data;
+       const struct sharkd_frame_request_data * const req_data = (const struct sharkd_frame_request_data * const) data;
+       const gboolean display_hidden = (req_data) ? req_data->display_hidden : FALSE;
 
-       printf("{");
+       json_dumper_begin_object(&dumper);
 
-       printf("\"err\":0");
+       sharkd_json_value_anyf("err", "0");
 
-       if (fdata->flags.has_user_comment)
+       if (fdata->has_user_comment)
                pkt_comment = sharkd_get_user_comment(fdata);
-       else if (fdata->flags.has_phdr_comment)
-               pkt_comment = pi->phdr->opt_comment;
+       else if (fdata->has_phdr_comment)
+               pkt_comment = pi->rec->opt_comment;
 
        if (pkt_comment)
-       {
-               printf(",\"comment\":");
-               json_puts_string(pkt_comment);
-       }
+               sharkd_json_value_string("comment", pkt_comment);
 
        if (tree)
        {
                tvbuff_t **tvbs = NULL;
 
-               printf(",\"tree\":");
-
                /* arrayize data src, to speedup searching for ds_tvb index */
                if (data_src && data_src->next /* only needed if there are more than one data source */)
                {
@@ -2849,7 +2801,7 @@ sharkd_session_process_frame_cb(epan_dissect_t *edt, proto_tree *tree, struct ep
 
                        for (i = 0; i < count; i++)
                        {
-                               struct data_source *src = (struct data_source *) g_slist_nth_data((GSList *) data_src, i);
+                               const struct data_source *src = (const struct data_source *) g_slist_nth_data((GSList *) data_src, i);
 
                                tvbs[i] = get_data_source_tvb(src);
                        }
@@ -2857,7 +2809,8 @@ sharkd_session_process_frame_cb(epan_dissect_t *edt, proto_tree *tree, struct ep
                        tvbs[count] = NULL;
                }
 
-               sharkd_session_process_frame_cb_tree(edt, tree, tvbs);
+               sharkd_json_value_anyf("tree", NULL);
+               sharkd_session_process_frame_cb_tree(edt, tree, tvbs, display_hidden);
 
                g_free(tvbs);
        }
@@ -2866,20 +2819,32 @@ sharkd_session_process_frame_cb(epan_dissect_t *edt, proto_tree *tree, struct ep
        {
                int col;
 
-               printf(",\"col\":[");
+               sharkd_json_array_open("col");
                for (col = 0; col < cinfo->num_cols; ++col)
                {
                        const col_item_t *col_item = &cinfo->columns[col];
 
-                       printf("%s\"%s\"", (col) ? "," : "", col_item->col_data);
+                       sharkd_json_value_string(NULL, col_item->col_data);
                }
-               printf("]");
+               sharkd_json_array_close();
+       }
+
+       if (fdata->ignored)
+               sharkd_json_value_anyf("i", "true");
+
+       if (fdata->marked)
+               sharkd_json_value_anyf("m", "true");
+
+       if (fdata->color_filter)
+       {
+               sharkd_json_value_stringf("bg", "%x", color_t_to_rgb(&fdata->color_filter->bg_color));
+               sharkd_json_value_stringf("fg", "%x", color_t_to_rgb(&fdata->color_filter->fg_color));
        }
 
        if (data_src)
        {
                struct data_source *src = (struct data_source *) data_src->data;
-               const char *ds_sepa = NULL;
+               gboolean ds_open = FALSE;
 
                tvbuff_t *tvb;
                guint length;
@@ -2887,70 +2852,277 @@ sharkd_session_process_frame_cb(epan_dissect_t *edt, proto_tree *tree, struct ep
                tvb = get_data_source_tvb(src);
                length = tvb_captured_length(tvb);
 
-               printf(",\"bytes\":");
                if (length != 0)
                {
                        const guchar *cp = tvb_get_ptr(tvb, 0, length);
 
-                       /* XXX pi.fd->flags.encoding */
-                       json_print_base64(cp, length);
+                       /* XXX pi.fd->encoding */
+                       sharkd_json_value_base64("bytes", cp, length);
                }
                else
                {
-                       json_print_base64("", 0);
+                       sharkd_json_value_base64("bytes", "", 0);
                }
 
                data_src = data_src->next;
                if (data_src)
                {
-                       printf(",\"ds\":[");
-                       ds_sepa = "";
+                       sharkd_json_array_open("ds");
+                       ds_open = TRUE;
                }
 
                while (data_src)
                {
                        src = (struct data_source *) data_src->data;
 
+                       json_dumper_begin_object(&dumper);
+
                        {
                                char *src_name = get_data_source_name(src);
 
-                               printf("%s{\"name\":", ds_sepa);
-                               json_puts_string(src_name);
+                               sharkd_json_value_string("name", src_name);
                                wmem_free(NULL, src_name);
                        }
 
                        tvb = get_data_source_tvb(src);
                        length = tvb_captured_length(tvb);
 
-                       printf(",\"bytes\":");
                        if (length != 0)
                        {
                                const guchar *cp = tvb_get_ptr(tvb, 0, length);
 
-                               /* XXX pi.fd->flags.encoding */
-                               json_print_base64(cp, length);
+                               /* XXX pi.fd->encoding */
+                               sharkd_json_value_base64("bytes", cp, length);
                        }
                        else
                        {
-                               json_print_base64("", 0);
+                               sharkd_json_value_base64("bytes", "", 0);
                        }
 
-                       printf("}");
-                       ds_sepa = ",";
+                       json_dumper_end_object(&dumper);
 
                        data_src = data_src->next;
                }
 
                /* close ds, only if was opened */
-               if (ds_sepa != NULL)
-                       printf("]");
+               if (ds_open)
+                       sharkd_json_array_close();
        }
 
-       printf(",\"fol\":[0");
+       sharkd_json_array_open("fol");
        follow_iterate_followers(sharkd_follower_visit_layers_cb, pi);
-       printf("]");
+       sharkd_json_array_close();
+
+       json_dumper_end_object(&dumper);
+       json_dumper_finish(&dumper);
+}
+
+#define SHARKD_IOGRAPH_MAX_ITEMS 250000 /* 250k limit of items is taken from wireshark-qt, on x86_64 sizeof(io_graph_item_t) is 152, so single graph can take max 36 MB */
+
+struct sharkd_iograph
+{
+       /* config */
+       int hf_index;
+       io_graph_item_unit_t calc_type;
+       guint32 interval;
+
+       /* result */
+       int space_items;
+       int num_items;
+       io_graph_item_t *items;
+       GString *error;
+};
+
+static tap_packet_status
+sharkd_iograph_packet(void *g, packet_info *pinfo, epan_dissect_t *edt, const void *dummy _U_)
+{
+       struct sharkd_iograph *graph = (struct sharkd_iograph *) g;
+       int idx;
+       gboolean update_succeeded;
+
+       idx = get_io_graph_index(pinfo, graph->interval);
+       if (idx < 0 || idx >= SHARKD_IOGRAPH_MAX_ITEMS)
+               return TAP_PACKET_DONT_REDRAW;
+
+       if (idx + 1 > graph->num_items)
+       {
+               if (idx + 1 > graph->space_items)
+               {
+                       int new_size = idx + 1024;
+
+                       graph->items = (io_graph_item_t *) g_realloc(graph->items, sizeof(io_graph_item_t) * new_size);
+                       reset_io_graph_items(&graph->items[graph->space_items], new_size - graph->space_items);
+
+                       graph->space_items = new_size;
+               }
+               else if (graph->items == NULL)
+               {
+                       graph->items = (io_graph_item_t *) g_malloc(sizeof(io_graph_item_t) * graph->space_items);
+                       reset_io_graph_items(graph->items, graph->space_items);
+               }
+
+               graph->num_items = idx + 1;
+       }
+
+       update_succeeded = update_io_graph_item(graph->items, idx, pinfo, edt, graph->hf_index, graph->calc_type, graph->interval);
+       /* XXX - TAP_PACKET_FAILED if the item couldn't be updated, with an error message? */
+       return update_succeeded ? TAP_PACKET_REDRAW : TAP_PACKET_DONT_REDRAW;
+}
+
+/**
+ * sharkd_session_process_iograph()
+ *
+ * Process iograph request
+ *
+ * Input:
+ *   (o) interval - interval time in ms, if not specified: 1000ms
+ *   (m) graph0             - First graph request
+ *   (o) graph1...graph9    - Other graph requests
+ *   (o) filter0            - First graph filter
+ *   (o) filter1...filter9  - Other graph filters
+ *
+ * Graph requests can be one of: "packets", "bytes", "bits", "sum:<field>", "frames:<field>", "max:<field>", "min:<field>", "avg:<field>", "load:<field>",
+ * if you use variant with <field>, you need to pass field name in filter request.
+ *
+ * Output object with attributes:
+ *   (m) iograph - array of graph results with attributes:
+ *                  errmsg - graph cannot be constructed
+ *                  items  - graph values, zeros are skipped, if value is not a number it's next index encoded as hex string
+ */
+static void
+sharkd_session_process_iograph(char *buf, const jsmntok_t *tokens, int count)
+{
+       const char *tok_interval = json_find_attr(buf, tokens, count, "interval");
+       struct sharkd_iograph graphs[10];
+       gboolean is_any_ok = FALSE;
+       int graph_count;
+
+       guint32 interval_ms = 1000; /* default: one per second */
+       int i;
+
+       if (tok_interval)
+       {
+               if (!ws_strtou32(tok_interval, NULL, &interval_ms) || interval_ms == 0)
+               {
+                       fprintf(stderr, "Invalid interval parameter: %s.\n", tok_interval);
+                       return;
+               }
+       }
+
+       for (i = graph_count = 0; i < (int) G_N_ELEMENTS(graphs); i++)
+       {
+               struct sharkd_iograph *graph = &graphs[graph_count];
+
+               const char *tok_graph;
+               const char *tok_filter;
+               char tok_format_buf[32];
+               const char *field_name;
+
+               snprintf(tok_format_buf, sizeof(tok_format_buf), "graph%d", i);
+               tok_graph = json_find_attr(buf, tokens, count, tok_format_buf);
+               if (!tok_graph)
+                       break;
+
+               snprintf(tok_format_buf, sizeof(tok_format_buf), "filter%d", i);
+               tok_filter = json_find_attr(buf, tokens, count, tok_format_buf);
+
+               if (!strcmp(tok_graph, "packets"))
+                       graph->calc_type = IOG_ITEM_UNIT_PACKETS;
+               else if (!strcmp(tok_graph, "bytes"))
+                       graph->calc_type = IOG_ITEM_UNIT_BYTES;
+               else if (!strcmp(tok_graph, "bits"))
+                       graph->calc_type = IOG_ITEM_UNIT_BITS;
+               else if (g_str_has_prefix(tok_graph, "sum:"))
+                       graph->calc_type = IOG_ITEM_UNIT_CALC_SUM;
+               else if (g_str_has_prefix(tok_graph, "frames:"))
+                       graph->calc_type = IOG_ITEM_UNIT_CALC_FRAMES;
+               else if (g_str_has_prefix(tok_graph, "fields:"))
+                       graph->calc_type = IOG_ITEM_UNIT_CALC_FIELDS;
+               else if (g_str_has_prefix(tok_graph, "max:"))
+                       graph->calc_type = IOG_ITEM_UNIT_CALC_MAX;
+               else if (g_str_has_prefix(tok_graph, "min:"))
+                       graph->calc_type = IOG_ITEM_UNIT_CALC_MIN;
+               else if (g_str_has_prefix(tok_graph, "avg:"))
+                       graph->calc_type = IOG_ITEM_UNIT_CALC_AVERAGE;
+               else if (g_str_has_prefix(tok_graph, "load:"))
+                       graph->calc_type = IOG_ITEM_UNIT_CALC_LOAD;
+               else
+                       break;
+
+               field_name = strchr(tok_graph, ':');
+               if (field_name)
+                       field_name = field_name + 1;
+
+               graph->interval = interval_ms;
+
+               graph->hf_index = -1;
+               graph->error = check_field_unit(field_name, &graph->hf_index, graph->calc_type);
+
+               graph->space_items = 0; /* TODO, can avoid realloc()s in sharkd_iograph_packet() by calculating: capture_time / interval */
+               graph->num_items = 0;
+               graph->items = NULL;
+
+               if (!graph->error)
+                       graph->error = register_tap_listener("frame", graph, tok_filter, TL_REQUIRES_PROTO_TREE, NULL, sharkd_iograph_packet, NULL, NULL);
+
+               graph_count++;
+
+               if (graph->error == NULL)
+                       is_any_ok = TRUE;
+       }
+
+       /* retap only if we have at least one ok */
+       if (is_any_ok)
+               sharkd_retap();
+
+       json_dumper_begin_object(&dumper);
+
+       sharkd_json_array_open("iograph");
+       for (i = 0; i < graph_count; i++)
+       {
+               struct sharkd_iograph *graph = &graphs[i];
+
+               json_dumper_begin_object(&dumper);
+
+               if (graph->error)
+               {
+                       sharkd_json_value_string("errmsg", graph->error->str);
+                       g_string_free(graph->error, TRUE);
+               }
+               else
+               {
+                       int idx;
+                       int next_idx = 0;
+
+                       sharkd_json_array_open("items");
+                       for (idx = 0; idx < graph->num_items; idx++)
+                       {
+                               double val;
+
+                               val = get_io_graph_item(graph->items, graph->calc_type, idx, graph->hf_index, &cfile, graph->interval, graph->num_items);
 
-       printf("}\n");
+                               /* if it's zero, don't display */
+                               if (val == 0.0)
+                                       continue;
+
+                               /* cause zeros are not printed, need to output index */
+                               if (next_idx != idx)
+                                       sharkd_json_value_stringf(NULL, "%x", idx);
+
+                               sharkd_json_value_anyf(NULL, "%f", val);
+                               next_idx = idx + 1;
+                       }
+                       sharkd_json_array_close();
+               }
+               json_dumper_end_object(&dumper);
+
+               remove_tap_listener(graph);
+               g_free(graph->items);
+       }
+       sharkd_json_array_close();
+
+       json_dumper_end_object(&dumper);
+       json_dumper_finish(&dumper);
 }
 
 /**
@@ -2992,7 +3164,6 @@ sharkd_session_process_intervals(char *buf, const jsmntok_t *tokens, int count)
 
        guint32 interval_ms = 1000; /* default: one per second */
 
-       const char *sepa = "";
        unsigned int framenum;
        gint64 idx;
        gint64 max_idx = 0;
@@ -3008,9 +3179,12 @@ sharkd_session_process_intervals(char *buf, const jsmntok_t *tokens, int count)
 
        if (tok_filter)
        {
-               filter_data = sharkd_session_filter_data(tok_filter);
-               if (!filter_data)
+               const struct sharkd_filter_item *filter_item;
+
+               filter_item = sharkd_session_filter_data(tok_filter);
+               if (!filter_item)
                        return;
+               filter_data = filter_item->filtered;
        }
 
        st_total.frames = 0;
@@ -3021,7 +3195,8 @@ sharkd_session_process_intervals(char *buf, const jsmntok_t *tokens, int count)
 
        idx = 0;
 
-       printf("{\"intervals\":[");
+       json_dumper_begin_object(&dumper);
+       sharkd_json_array_open("intervals");
 
        start_ts = (cfile.count >= 1) ? &(sharkd_get_frame(1)->abs_ts) : NULL;
 
@@ -3043,8 +3218,7 @@ sharkd_session_process_intervals(char *buf, const jsmntok_t *tokens, int count)
                {
                        if (st.frames != 0)
                        {
-                               printf("%s[%" G_GINT64_FORMAT ",%u,%" G_GUINT64_FORMAT "]", sepa, idx, st.frames, st.bytes);
-                               sepa = ",";
+                               sharkd_json_value_anyf(NULL, "[%" G_GINT64_FORMAT ",%u,%" G_GUINT64_FORMAT "]", idx, st.frames, st.bytes);
                        }
 
                        idx = new_idx;
@@ -3064,11 +3238,16 @@ sharkd_session_process_intervals(char *buf, const jsmntok_t *tokens, int count)
 
        if (st.frames != 0)
        {
-               printf("%s[%" G_GINT64_FORMAT ",%u,%" G_GUINT64_FORMAT "]", sepa, idx, st.frames, st.bytes);
-               /* sepa = ","; */
+               sharkd_json_value_anyf(NULL, "[%" G_GINT64_FORMAT ",%u,%" G_GUINT64_FORMAT "]", idx, st.frames, st.bytes);
        }
+       sharkd_json_array_close();
+
+       sharkd_json_value_anyf("last", "%" G_GINT64_FORMAT, max_idx);
+       sharkd_json_value_anyf("frames", "%u", st_total.frames);
+       sharkd_json_value_anyf("bytes", "%" G_GUINT64_FORMAT, st_total.bytes);
 
-       printf("],\"last\":%" G_GINT64_FORMAT ",\"frames\":%u,\"bytes\":%" G_GUINT64_FORMAT "}\n", max_idx, st_total.frames, st_total.bytes);
+       json_dumper_end_object(&dumper);
+       json_dumper_finish(&dumper);
 }
 
 /**
@@ -3082,7 +3261,9 @@ sharkd_session_process_intervals(char *buf, const jsmntok_t *tokens, int count)
  *   (o) prev_frame - previously displayed frame number
  *   (o) proto - set if output frame tree
  *   (o) columns - set if output frame columns
+ *   (o) color - set if output color-filter bg/fg
  *   (o) bytes - set if output frame bytes
+ *   (o) hidden - set if output hidden tree fields
  *
  * Output object with attributes:
  *   (m) err   - 0 if succeed
@@ -3099,6 +3280,8 @@ sharkd_session_process_intervals(char *buf, const jsmntok_t *tokens, int count)
  *                  ds- data src index
  *                  url  - only for t:'url', url
  *                  fnum - only for t:'framenum', frame number
+ *                  g - if field is generated by Wireshark
+ *                  v - if field is hidden
  *
  *   (o) col   - array of column data
  *   (o) bytes - base64 of frame bytes
@@ -3107,6 +3290,10 @@ sharkd_session_process_intervals(char *buf, const jsmntok_t *tokens, int count)
  *   (o) fol   - array of follow filters:
  *                  [0] - protocol
  *                  [1] - filter string
+ *   (o) i   - if frame is ignored
+ *   (o) m   - if frame is marked
+ *   (o) bg  - color filter - background color in hex
+ *   (o) fg  - color filter - foreground color in hex
  */
 static void
 sharkd_session_process_frame(char *buf, const jsmntok_t *tokens, int count)
@@ -3114,11 +3301,10 @@ sharkd_session_process_frame(char *buf, const jsmntok_t *tokens, int count)
        const char *tok_frame = json_find_attr(buf, tokens, count, "frame");
        const char *tok_ref_frame = json_find_attr(buf, tokens, count, "ref_frame");
        const char *tok_prev_frame = json_find_attr(buf, tokens, count, "prev_frame");
-       int tok_proto   = (json_find_attr(buf, tokens, count, "proto") != NULL);
-       int tok_bytes   = (json_find_attr(buf, tokens, count, "bytes") != NULL);
-       int tok_columns = (json_find_attr(buf, tokens, count, "columns") != NULL);
 
        guint32 framenum, ref_frame_num, prev_dis_num;
+       guint32 dissect_flags = SHARKD_DISSECT_FLAG_NULL;
+       struct sharkd_frame_request_data req_data;
 
        if (!tok_frame || !ws_strtou32(tok_frame, NULL, &framenum) || framenum == 0)
                return;
@@ -3131,7 +3317,18 @@ sharkd_session_process_frame(char *buf, const jsmntok_t *tokens, int count)
        if (tok_prev_frame && (!ws_strtou32(tok_prev_frame, NULL, &prev_dis_num) || prev_dis_num >= framenum))
                return;
 
-       sharkd_dissect_request(framenum, ref_frame_num, prev_dis_num, &sharkd_session_process_frame_cb, tok_bytes, tok_columns, tok_proto, NULL);
+       if (json_find_attr(buf, tokens, count, "proto") != NULL)
+               dissect_flags |= SHARKD_DISSECT_FLAG_PROTO_TREE;
+       if (json_find_attr(buf, tokens, count, "bytes") != NULL)
+               dissect_flags |= SHARKD_DISSECT_FLAG_BYTES;
+       if (json_find_attr(buf, tokens, count, "columns") != NULL)
+               dissect_flags |= SHARKD_DISSECT_FLAG_COLUMNS;
+       if (json_find_attr(buf, tokens, count, "color") != NULL)
+               dissect_flags |= SHARKD_DISSECT_FLAG_COLOR;
+
+       req_data.display_hidden = (json_find_attr(buf, tokens, count, "v") != NULL);
+
+       sharkd_dissect_request(framenum, ref_frame_num, prev_dis_num, &sharkd_session_process_frame_cb, dissect_flags, &req_data);
 }
 
 /**
@@ -3141,17 +3338,22 @@ sharkd_session_process_frame(char *buf, const jsmntok_t *tokens, int count)
  *
  * Input:
  *   (o) filter - filter to be checked
+ *   (o) field - field to be checked
  *
  * Output object with attributes:
  *   (m) err - always 0
  *   (o) filter - 'ok', 'warn' or error message
+ *   (o) field - 'ok', or 'notfound'
  */
 static int
 sharkd_session_process_check(char *buf, const jsmntok_t *tokens, int count)
 {
        const char *tok_filter = json_find_attr(buf, tokens, count, "filter");
+       const char *tok_field = json_find_attr(buf, tokens, count, "field");
+
+       json_dumper_begin_object(&dumper);
+       sharkd_json_value_anyf("err", "0");
 
-       printf("{\"err\":0");
        if (tok_filter != NULL)
        {
                char *err_msg = NULL;
@@ -3161,21 +3363,29 @@ sharkd_session_process_check(char *buf, const jsmntok_t *tokens, int count)
                {
                        const char *s = "ok";
 
-                       if (dfilter_deprecated_tokens(dfp))
+                       if (dfp && dfilter_deprecated_tokens(dfp))
                                s = "warn";
 
-                       printf(",\"filter\":\"%s\"", s);
+                       sharkd_json_value_string("filter", s);
                        dfilter_free(dfp);
                }
                else
                {
-                       printf(",\"filter\":");
-                       json_puts_string(err_msg);
+                       sharkd_json_value_string("filter", err_msg);
                        g_free(err_msg);
                }
        }
 
-       printf("}\n");
+       if (tok_field != NULL)
+       {
+               header_field_info *hfi = proto_registrar_get_byname(tok_field);
+
+               sharkd_json_value_string("field", (hfi) ? "ok" : "notfound");
+       }
+
+       json_dumper_end_object(&dumper);
+       json_dumper_finish(&dumper);
+
        return 0;
 }
 
@@ -3183,7 +3393,6 @@ struct sharkd_session_process_complete_pref_data
 {
        const char *module;
        const char *pref;
-       const char *sepa;
 };
 
 static guint
@@ -3194,8 +3403,10 @@ sharkd_session_process_complete_pref_cb(module_t *module, gpointer d)
        if (strncmp(data->pref, module->name, strlen(data->pref)) != 0)
                return 0;
 
-       printf("%s{\"f\":\"%s\",\"d\":\"%s\"}", data->sepa, module->name, module->title);
-       data->sepa = ",";
+       json_dumper_begin_object(&dumper);
+       sharkd_json_value_string("f", module->name);
+       sharkd_json_value_string("d", module->title);
+       json_dumper_end_object(&dumper);
 
        return 0;
 }
@@ -3210,8 +3421,10 @@ sharkd_session_process_complete_pref_option_cb(pref_t *pref, gpointer d)
        if (strncmp(data->pref, pref_name, strlen(data->pref)) != 0)
                return 0;
 
-       printf("%s{\"f\":\"%s.%s\",\"d\":\"%s\"}", data->sepa, data->module, pref_name, pref_title);
-       data->sepa = ",";
+       json_dumper_begin_object(&dumper);
+       sharkd_json_value_stringf("f", "%s.%s", data->module, pref_name);
+       sharkd_json_value_string("d", pref_title);
+       json_dumper_end_object(&dumper);
 
        return 0; /* continue */
 }
@@ -3241,7 +3454,9 @@ sharkd_session_process_complete(char *buf, const jsmntok_t *tokens, int count)
        const char *tok_field = json_find_attr(buf, tokens, count, "field");
        const char *tok_pref  = json_find_attr(buf, tokens, count, "pref");
 
-       printf("{\"err\":0");
+       json_dumper_begin_object(&dumper);
+       sharkd_json_value_anyf("err", "0");
+
        if (tok_field != NULL && tok_field[0])
        {
                const size_t filter_length = strlen(tok_field);
@@ -3250,9 +3465,8 @@ sharkd_session_process_complete(char *buf, const jsmntok_t *tokens, int count)
                void *proto_cookie;
                void *field_cookie;
                int proto_id;
-               const char *sepa = "";
 
-               printf(",\"field\":[");
+               sharkd_json_array_open("field");
 
                for (proto_id = proto_get_first_protocol(&proto_cookie); proto_id != -1; proto_id = proto_get_next_protocol(&proto_cookie))
                {
@@ -3269,16 +3483,13 @@ sharkd_session_process_complete(char *buf, const jsmntok_t *tokens, int count)
 
                        if (strlen(protocol_filter) >= filter_length && !g_ascii_strncasecmp(tok_field, protocol_filter, filter_length))
                        {
-                               printf("%s{", sepa);
+                               json_dumper_begin_object(&dumper);
                                {
-                                       printf("\"f\":");
-                                       json_puts_string(protocol_filter);
-                                       printf(",\"t\":%d", FT_PROTOCOL);
-                                       printf(",\"n\":");
-                                       json_puts_string(protocol_name);
+                                       sharkd_json_value_string("f", protocol_filter);
+                                       sharkd_json_value_anyf("t", "%d", FT_PROTOCOL);
+                                       sharkd_json_value_string("n", protocol_name);
                                }
-                               printf("}");
-                               sepa = ",";
+                               json_dumper_end_object(&dumper);
                        }
 
                        if (!filter_with_dot)
@@ -3291,26 +3502,23 @@ sharkd_session_process_complete(char *buf, const jsmntok_t *tokens, int count)
 
                                if (strlen(hfinfo->abbrev) >= filter_length && !g_ascii_strncasecmp(tok_field, hfinfo->abbrev, filter_length))
                                {
-                                       printf("%s{", sepa);
+                                       json_dumper_begin_object(&dumper);
                                        {
-                                               printf("\"f\":");
-                                               json_puts_string(hfinfo->abbrev);
+                                               sharkd_json_value_string("f", hfinfo->abbrev);
 
                                                /* XXX, skip displaying name, if there are multiple (to not confuse user) */
                                                if (hfinfo->same_name_next == NULL)
                                                {
-                                                       printf(",\"t\":%d", hfinfo->type);
-                                                       printf(",\"n\":");
-                                                       json_puts_string(hfinfo->name);
+                                                       sharkd_json_value_anyf("t", "%d", hfinfo->type);
+                                                       sharkd_json_value_string("n", hfinfo->name);
                                                }
                                        }
-                                       printf("}");
-                                       sepa = ",";
+                                       json_dumper_end_object(&dumper);
                                }
                        }
                }
 
-               printf("]");
+               sharkd_json_array_close();
        }
 
        if (tok_pref != NULL && tok_pref[0])
@@ -3320,10 +3528,8 @@ sharkd_session_process_complete(char *buf, const jsmntok_t *tokens, int count)
 
                data.module = tok_pref;
                data.pref = tok_pref;
-               data.sepa = "";
-
-               printf(",\"pref\":[");
 
+               sharkd_json_array_open("pref");
                if ((dot_sepa = strchr(tok_pref, '.')))
                {
                        module_t *pref_mod;
@@ -3341,12 +3547,12 @@ sharkd_session_process_complete(char *buf, const jsmntok_t *tokens, int count)
                {
                        prefs_modules_foreach(sharkd_session_process_complete_pref_cb, &data);
                }
-
-               printf("]");
+               sharkd_json_array_close();
        }
 
+       json_dumper_end_object(&dumper);
+       json_dumper_finish(&dumper);
 
-       printf("}\n");
        return 0;
 }
 
@@ -3380,7 +3586,8 @@ sharkd_session_process_setcomment(char *buf, const jsmntok_t *tokens, int count)
                return;
 
        ret = sharkd_set_user_comment(fdata, tok_comment);
-       printf("{\"err\":%d}\n", ret);
+
+       sharkd_json_simple_reply(ret, NULL);
 }
 
 /**
@@ -3411,21 +3618,14 @@ sharkd_session_process_setconf(char *buf, const jsmntok_t *tokens, int count)
        ws_snprintf(pref, sizeof(pref), "%s:%s", tok_name, tok_value);
 
        ret = prefs_set_pref(pref, &errmsg);
-       printf("{\"err\":%d", ret);
-       if (errmsg)
-       {
-               /* Add error message for some syntax errors. */
-               printf(",\"errmsg\":");
-               json_puts_string(errmsg);
-       }
-       printf("}\n");
+
+       sharkd_json_simple_reply(ret, errmsg);
        g_free(errmsg);
 }
 
 struct sharkd_session_process_dumpconf_data
 {
        module_t *module;
-       const char *sepa;
 };
 
 static guint
@@ -3434,49 +3634,51 @@ sharkd_session_process_dumpconf_cb(pref_t *pref, gpointer d)
        struct sharkd_session_process_dumpconf_data *data = (struct sharkd_session_process_dumpconf_data *) d;
        const char *pref_name = prefs_get_name(pref);
 
-       printf("%s\"%s.%s\":{", data->sepa, data->module->name, pref_name);
+       char json_pref_key[512];
+
+       snprintf(json_pref_key, sizeof(json_pref_key), "%s.%s", data->module->name, pref_name);
+       json_dumper_set_member_name(&dumper, json_pref_key);
+       json_dumper_begin_object(&dumper);
 
        switch (prefs_get_type(pref))
        {
                case PREF_UINT:
                case PREF_DECODE_AS_UINT:
-                       printf("\"u\":%u", prefs_get_uint_value_real(pref, pref_current));
+                       sharkd_json_value_anyf("u", "%u", prefs_get_uint_value_real(pref, pref_current));
                        if (prefs_get_uint_base(pref) != 10)
-                               printf(",\"ub\":%u", prefs_get_uint_base(pref));
+                               sharkd_json_value_anyf("ub", "%u", prefs_get_uint_base(pref));
                        break;
 
                case PREF_BOOL:
-                       printf("\"b\":%s", prefs_get_bool_value(pref, pref_current) ? "1" : "0");
+                       sharkd_json_value_anyf("b", prefs_get_bool_value(pref, pref_current) ? "1" : "0");
                        break;
 
                case PREF_STRING:
                case PREF_SAVE_FILENAME:
                case PREF_OPEN_FILENAME:
                case PREF_DIRNAME:
-                       printf("\"s\":");
-                       json_puts_string(prefs_get_string_value(pref, pref_current));
+                       sharkd_json_value_string("s", prefs_get_string_value(pref, pref_current));
                        break;
 
                case PREF_ENUM:
                {
                        const enum_val_t *enums;
-                       const char *enum_sepa = "";
 
-                       printf("\"e\":[");
+                       sharkd_json_array_open("e");
                        for (enums = prefs_get_enumvals(pref); enums->name; enums++)
                        {
-                               printf("%s{\"v\":%d", enum_sepa, enums->value);
+                               json_dumper_begin_object(&dumper);
+
+                               sharkd_json_value_anyf("v", "%d", enums->value);
 
                                if (enums->value == prefs_get_enum_value(pref, pref_current))
-                                       printf(",\"s\":1");
+                                       sharkd_json_value_anyf("s", "1");
 
-                               printf(",\"d\":");
-                               json_puts_string(enums->description);
+                               sharkd_json_value_string("d", enums->description);
 
-                               printf("}");
-                               enum_sepa = ",";
+                               json_dumper_end_object(&dumper);
                        }
-                       printf("]");
+                       sharkd_json_array_close();
                        break;
                }
 
@@ -3484,7 +3686,7 @@ sharkd_session_process_dumpconf_cb(pref_t *pref, gpointer d)
                case PREF_DECODE_AS_RANGE:
                {
                        char *range_str = range_convert_range(NULL, prefs_get_range_value_real(pref, pref_current));
-                       printf("\"r\":\"%s\"", range_str);
+                       sharkd_json_value_string("r", range_str);
                        wmem_free(NULL, range_str);
                        break;
                }
@@ -3494,31 +3696,25 @@ sharkd_session_process_dumpconf_cb(pref_t *pref, gpointer d)
                        uat_t *uat = prefs_get_uat_value(pref);
                        guint idx;
 
-                       printf("\"t\":[");
+                       sharkd_json_array_open("t");
                        for (idx = 0; idx < uat->raw_data->len; idx++)
                        {
                                void *rec = UAT_INDEX_PTR(uat, idx);
                                guint colnum;
 
-                               if (idx)
-                                       printf(",");
-
-                               printf("[");
+                               sharkd_json_array_open(NULL);
                                for (colnum = 0; colnum < uat->ncols; colnum++)
                                {
                                        char *str = uat_fld_tostr(rec, &(uat->fields[colnum]));
 
-                                       if (colnum)
-                                               printf(",");
-
-                                       json_puts_string(str);
+                                       sharkd_json_value_string(NULL, str);
                                        g_free(str);
                                }
 
-                               printf("]");
+                               sharkd_json_array_close();
                        }
 
-                       printf("]");
+                       sharkd_json_array_close();
                        break;
                }
 
@@ -3531,12 +3727,10 @@ sharkd_session_process_dumpconf_cb(pref_t *pref, gpointer d)
        }
 
 #if 0
-       printf(",\"t\":");
-       json_puts_string(prefs_get_title(pref));
+       sharkd_json_value_string("t", prefs_get_title(pref));
 #endif
 
-       printf("}");
-       data->sepa = ",";
+       json_dumper_end_object(&dumper);
 
        return 0; /* continue */
 }
@@ -3583,11 +3777,16 @@ sharkd_session_process_dumpconf(char *buf, const jsmntok_t *tokens, int count)
                struct sharkd_session_process_dumpconf_data data;
 
                data.module = NULL;
-               data.sepa = "";
 
-               printf("{\"prefs\":{");
+               json_dumper_begin_object(&dumper);
+
+               sharkd_json_value_anyf("prefs", NULL);
+               json_dumper_begin_object(&dumper);
                prefs_modules_foreach(sharkd_session_process_dumpconf_mod_cb, &data);
-               printf("}}\n");
+               json_dumper_end_object(&dumper);
+
+               json_dumper_end_object(&dumper);
+               json_dumper_finish(&dumper);
                return;
        }
 
@@ -3606,11 +3805,16 @@ sharkd_session_process_dumpconf(char *buf, const jsmntok_t *tokens, int count)
                        struct sharkd_session_process_dumpconf_data data;
 
                        data.module = pref_mod;
-                       data.sepa = "";
 
-                       printf("{\"prefs\":{");
+                       json_dumper_begin_object(&dumper);
+
+                       sharkd_json_value_anyf("prefs", NULL);
+                       json_dumper_begin_object(&dumper);
                        sharkd_session_process_dumpconf_cb(pref, &data);
-                       printf("}}\n");
+                       json_dumper_end_object(&dumper);
+
+                       json_dumper_end_object(&dumper);
+                       json_dumper_finish(&dumper);
                }
 
                return;
@@ -3622,17 +3826,22 @@ sharkd_session_process_dumpconf(char *buf, const jsmntok_t *tokens, int count)
                struct sharkd_session_process_dumpconf_data data;
 
                data.module = pref_mod;
-               data.sepa = "";
 
-               printf("{\"prefs\":{");
+               json_dumper_begin_object(&dumper);
+
+               sharkd_json_value_anyf("prefs", NULL);
+               json_dumper_begin_object(&dumper);
                prefs_pref_foreach(pref_mod, sharkd_session_process_dumpconf_cb, &data);
-               printf("}}\n");
+               json_dumper_end_object(&dumper);
+
+               json_dumper_end_object(&dumper);
+               json_dumper_finish(&dumper);
        }
 }
 
 struct sharkd_download_rtp
 {
-       struct sharkd_rtp_match rtp;
+       rtpstream_id_t id;
        GSList *packets;
        double start_time;
 };
@@ -3667,10 +3876,6 @@ sharkd_rtp_download_decode(struct sharkd_download_rtp *req)
        unsigned channels = 0;
        unsigned sample_rate = 0;
 
-       int i;
-       int base64_state1 = 0;
-       int base64_state2 = 0;
-
        GSList *l;
 
        for (l = req->packets; l; l = l->next)
@@ -3727,8 +3932,7 @@ sharkd_rtp_download_decode(struct sharkd_download_rtp *req)
                        memcpy(&wav_hdr[36], "data", 4);
                        memcpy(&wav_hdr[40], "\xFF\xFF\xFF\xFF", 4); /* XXX, unknown */
 
-                       for (i = 0; i < (int) sizeof(wav_hdr); i++)
-                               json_print_base64_step(&wav_hdr[i], &base64_state1, &base64_state2);
+                       json_dumper_write_base64(&dumper, wav_hdr, sizeof(wav_hdr));
                }
 
                // Write samples to our file.
@@ -3772,19 +3976,16 @@ sharkd_rtp_download_decode(struct sharkd_download_rtp *req)
                }
 
                /* Write the decoded, possibly-resampled audio */
-               for (i = 0; i < write_bytes; i++)
-                       json_print_base64_step(&write_buff[i], &base64_state1, &base64_state2);
+               json_dumper_write_base64(&dumper, write_buff, write_bytes);
 
                g_free(decode_buff);
        }
 
-       json_print_base64_step(NULL, &base64_state1, &base64_state2);
-
        g_free(resample_buff);
        g_hash_table_destroy(decoders_hash_);
 }
 
-static gboolean
+static tap_packet_status
 sharkd_session_packet_download_tap_rtp_cb(void *tapdata, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data)
 {
        const struct _rtp_info *rtp_info = (const struct _rtp_info *) data;
@@ -3792,9 +3993,9 @@ sharkd_session_packet_download_tap_rtp_cb(void *tapdata, packet_info *pinfo, epa
 
        /* do not consider RTP packets without a setup frame */
        if (rtp_info->info_setup_frame_num == 0)
-               return FALSE;
+               return TAP_PACKET_DONT_REDRAW;
 
-       if (sharkd_rtp_match_check(&req_rtp->rtp, pinfo, rtp_info))
+       if (rtpstream_id_equal_pinfo_rtp_info(&req_rtp->id, pinfo, rtp_info))
        {
                rtp_packet_t *rtp_packet;
 
@@ -3814,7 +4015,7 @@ sharkd_session_packet_download_tap_rtp_cb(void *tapdata, packet_info *pinfo, epa
                req_rtp->packets = g_slist_append(req_rtp->packets, rtp_packet);
        }
 
-       return FALSE;
+       return TAP_PACKET_DONT_REDRAW;
 }
 
 /**
@@ -3864,13 +4065,12 @@ sharkd_session_process_download(char *buf, const jsmntok_t *tokens, int count)
                        const char *mime     = (eo_entry->content_type) ? eo_entry->content_type : "application/octet-stream";
                        const char *filename = (eo_entry->filename) ? eo_entry->filename : tok_token;
 
-                       printf("{\"file\":");
-                       json_puts_string(filename);
-                       printf(",\"mime\":");
-                       json_puts_string(mime);
-                       printf(",\"data\":");
-                       json_print_base64(eo_entry->payload_data, (size_t)(eo_entry->payload_len));
-                       printf("}\n");
+                       json_dumper_begin_object(&dumper);
+                       sharkd_json_value_string("file", filename);
+                       sharkd_json_value_string("mime", mime);
+                       sharkd_json_value_base64("data", eo_entry->payload_data, (size_t) eo_entry->payload_len);
+                       json_dumper_end_object(&dumper);
+                       json_dumper_finish(&dumper);
                }
        }
        else if (!strcmp(tok_token, "ssl-secrets"))
@@ -3882,13 +4082,12 @@ sharkd_session_process_download(char *buf, const jsmntok_t *tokens, int count)
                        const char *mime     = "text/plain";
                        const char *filename = "keylog.txt";
 
-                       printf("{\"file\":");
-                       json_puts_string(filename);
-                       printf(",\"mime\":");
-                       json_puts_string(mime);
-                       printf(",\"data\":");
-                       json_print_base64(str, strlen(str));
-                       printf("}\n");
+                       json_dumper_begin_object(&dumper);
+                       sharkd_json_value_string("file", filename);
+                       sharkd_json_value_string("mime", mime);
+                       sharkd_json_value_base64("data", str, strlen(str));
+                       json_dumper_end_object(&dumper);
+                       json_dumper_finish(&dumper);
                }
                g_free(str);
        }
@@ -3898,13 +4097,13 @@ sharkd_session_process_download(char *buf, const jsmntok_t *tokens, int count)
                GString *tap_error;
 
                memset(&rtp_req, 0, sizeof(rtp_req));
-               if (!sharkd_rtp_match_init(&rtp_req.rtp, tok_token + 4))
+               if (!sharkd_rtp_match_init(&rtp_req.id, tok_token + 4))
                {
                        fprintf(stderr, "sharkd_session_process_download() rtp tokenizing error %s\n", tok_token);
                        return;
                }
 
-               tap_error = register_tap_listener("rtp", &rtp_req, NULL, 0, NULL, sharkd_session_packet_download_tap_rtp_cb, NULL);
+               tap_error = register_tap_listener("rtp", &rtp_req, NULL, 0, NULL, sharkd_session_packet_download_tap_rtp_cb, NULL, NULL);
                if (tap_error)
                {
                        fprintf(stderr, "sharkd_session_process_download() rtp error=%s", tap_error->str);
@@ -3920,17 +4119,17 @@ sharkd_session_process_download(char *buf, const jsmntok_t *tokens, int count)
                        const char *mime     = "audio/x-wav";
                        const char *filename = tok_token;
 
-                       printf("{\"file\":");
-                       json_puts_string(filename);
-                       printf(",\"mime\":");
-                       json_puts_string(mime);
+                       json_dumper_begin_object(&dumper);
+                       sharkd_json_value_string("file", filename);
+                       sharkd_json_value_string("mime", mime);
 
-                       printf(",\"data\":");
-                       putchar('"');
+                       sharkd_json_value_anyf("data", NULL);
+                       json_dumper_begin_base64(&dumper);
                        sharkd_rtp_download_decode(&rtp_req);
-                       putchar('"');
+                       json_dumper_end_base64(&dumper);
 
-                       printf("}\n");
+                       json_dumper_end_object(&dumper);
+                       json_dumper_finish(&dumper);
 
                        g_slist_free_full(rtp_req.packets, sharkd_rtp_download_free_items);
                }
@@ -3977,7 +4176,7 @@ sharkd_session_process(char *buf, const jsmntok_t *tokens, int count)
                buf[tokens[i + 1].end] = '\0';
 
                /* unescape only value, as keys are simple strings */
-               if (tokens[i + 1].type == JSMN_STRING && !json_unescape_str(&buf[tokens[i + 1].start]))
+               if (tokens[i + 1].type == JSMN_STRING && !json_decode_string_inplace(&buf[tokens[i + 1].start]))
                {
                        fprintf(stderr, "sanity check(3b): [%d] cannot unescape string\n", i + 1);
                        return;
@@ -4011,6 +4210,8 @@ sharkd_session_process(char *buf, const jsmntok_t *tokens, int count)
                        sharkd_session_process_tap(buf, tokens, count);
                else if (!strcmp(tok_req, "follow"))
                        sharkd_session_process_follow(buf, tokens, count);
+               else if (!strcmp(tok_req, "iograph"))
+                       sharkd_session_process_iograph(buf, tokens, count);
                else if (!strcmp(tok_req, "intervals"))
                        sharkd_session_process_intervals(buf, tokens, count);
                else if (!strcmp(tok_req, "frame"))
@@ -4029,7 +4230,7 @@ sharkd_session_process(char *buf, const jsmntok_t *tokens, int count)
                        fprintf(stderr, "::: req = %s\n", tok_req);
 
                /* reply for every command are 0+ lines of JSON reply (outputed above), finished by empty new line */
-               printf("\n");
+               json_dumper_finish(&dumper);
 
                /*
                 * We do an explicit fflush after every line, because
@@ -4058,14 +4259,21 @@ sharkd_session_main(void)
 
        fprintf(stderr, "Hello in child.\n");
 
+       dumper.output_file = stdout;
+
        filter_table = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, sharkd_session_filter_free);
 
+#ifdef HAVE_MAXMINDDB
+       /* mmdbresolve was stopped before fork(), force starting it */
+       uat_get_table_by_name("MaxMind Database Paths")->post_update_cb();
+#endif
+
        while (fgets(buf, sizeof(buf), stdin))
        {
                /* every command is line seperated JSON */
                int ret;
 
-               ret = wsjsmn_parse(buf, NULL, 0);
+               ret = json_parse(buf, NULL, 0);
                if (ret < 0)
                {
                        fprintf(stderr, "invalid JSON -> closing\n");
@@ -4083,13 +4291,17 @@ sharkd_session_main(void)
 
                memset(tokens, 0, ret * sizeof(jsmntok_t));
 
-               ret = wsjsmn_parse(buf, tokens, ret);
+               ret = json_parse(buf, tokens, ret);
                if (ret < 0)
                {
                        fprintf(stderr, "invalid JSON(2) -> closing\n");
                        return 2;
                }
 
+#if defined(HAVE_C_ARES) || defined(HAVE_MAXMINDDB)
+               host_name_lookup_process();
+#endif
+
                sharkd_session_process(buf, tokens, ret);
        }