2 * Definitions for packet info structures and routines
6 * Ethereal - Network traffic analyzer
7 * By Gerald Combs <gerald@ethereal.com>
8 * Copyright 1998 Gerald Combs
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version 2
13 * of the License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
25 #ifndef __PACKET_INFO_H__
26 #define __PACKET_INFO_H__
28 #include "frame_data.h"
32 #define P2P_DIR_UNKNOWN -1
33 #define P2P_DIR_SENT 0
34 #define P2P_DIR_RECV 1
36 #define MTP2_ANNEX_A_USED_UNKNOWN -1
37 #define MTP2_ANNEX_A_NOT_USED 0
38 #define MTP2_ANNEX_A_USED 1
40 #define PINFO_SOF_FIRST_FRAME 0x1
41 #define PINFO_SOF_SOFF 0x2
42 #define PINFO_EOF_LAST_FRAME 0x80
43 #define PINFO_EOF_INVALID 0x40
44 #define MAX_NUMBER_OF_PPIDS 2
46 typedef struct _packet_info {
47 const char *current_proto; /* name of protocol currently being dissected */
48 column_info *cinfo; /* Column formatting information */
50 union wtap_pseudo_header *pseudo_header;
51 GSList *data_src; /* Frame data sources */
52 address dl_src; /* link-layer source address */
53 address dl_dst; /* link-layer destination address */
54 address net_src; /* network-layer source address */
55 address net_dst; /* network-layer destination address */
56 address src; /* source address (net if present, DL otherwise )*/
57 address dst; /* destination address (net if present, DL otherwise )*/
58 guint32 ethertype; /* Ethernet Type Code, if this is an Ethernet packet */
59 guint32 ipproto; /* IP protocol, if this is an IP packet */
60 guint32 ipxptype; /* IPX packet type, if this is an IPX packet */
61 circuit_type ctype; /* type of circuit, for protocols with a VC identifier */
62 guint32 circuit_id; /* circuit ID, for protocols with a VC identifier */
63 const char *noreassembly_reason; /* reason why reassembly wasn't done, if any */
64 gboolean fragmented; /* TRUE if the protocol is only a fragment */
65 gboolean in_error_pkt; /* TRUE if we're inside an {ICMP,CLNP,...} error packet */
66 port_type ptype; /* type of the following two port numbers */
67 guint32 srcport; /* source port */
68 guint32 destport; /* destination port */
70 const char *match_string; /* Subdissectors with string dissector tables use this */
71 guint16 can_desegment; /* >0 if this segment could be desegmented.
72 A dissector that can offer this API (e.g.
73 TCP) sets can_desegment=2, then
74 can_desegment is decremented by 1 each time
75 we pass to the next subdissector. Thus only
76 the dissector immediately above the
77 protocol which sets the flag can use it*/
78 guint16 saved_can_desegment; /* Value of can_desegment before current
79 dissector was called. Supplied so that
80 dissectors for proxy protocols such as
81 SOCKS can restore it, allowing the
82 dissectors that they call to use the
83 TCP dissector's desegmentation (SOCKS
84 just retransmits TCP segments once it's
85 finished setting things up, so the TCP
86 desegmentor can desegment its payload). */
87 int desegment_offset; /* offset to stuff needing desegmentation */
88 guint32 desegment_len; /* requested desegmentation additional length */
89 guint16 want_pdu_tracking; /* >0 if the subdissector has specified
90 a value in 'bytes_until_next_pdu'.
91 When a dissector detects that the next PDU
92 will start beyond the start of the next
93 segment, it can set this value to 2
94 and 'bytes_until_next_pdu' to the number of
95 bytes beyond the next segment where the
98 If the protocol dissector below this
99 one is capable of PDU tracking it can
100 use this hint to detect PDUs that starts
101 unaligned to the segment boundaries.
102 The TCP dissector is using this hint from
103 (some) protocols to detect when a new PDU
104 starts in the middle of a tcp segment.
106 There is intelligence in the glue between
107 dissector layers to make sure that this
108 request is only passed down to the protocol
109 immediately below the current one and not
112 guint32 bytes_until_next_pdu;
117 int p2p_dir; /* Packet was captured as an
118 outbound (P2P_DIR_SENT)
119 inbound (P2P_DIR_RECV)
120 unknown (P2P_DIR_UNKNOWN) */
121 guint16 oxid; /* next 2 fields reqd to identify fibre */
122 guint16 rxid; /* channel conversations */
123 guint8 r_ctl; /* R_CTL field in Fibre Channel Protocol */
124 guint8 sof_eof; /* FC's SOF/EOF encoding passed to FC decoder
125 * Bit 7 set if Last frame in sequence
126 * Bit 6 set if invalid frame content
128 * Bit 1 set if first frame in sequence
130 guint16 src_idx; /* Source port index (Cisco MDS-specific) */
131 guint16 dst_idx; /* Dest port index (Cisco MDS-specific) */
132 guint16 vsan; /* Fibre channel/Cisco MDS-specific */
134 /* Extra data for DCERPC handling and tracking of context ids */
135 guint16 dcectxid; /* Context ID (DCERPC-specific) */
136 int dcetransporttype; /* Transport type
137 * Value -1 means "not a DCERPC packet"
139 guint16 dcetransportsalt; /* fid: if transporttype==DCE_CN_TRANSPORT_SMBPIPE */
141 /* Extra data for handling of decryption of GSSAPI wrapped tvbuffs.
142 Caller sets decrypt_gssapi_tvb if this service is requested.
143 If gssapi_encrypted_tvb is NULL, then the rest of the tvb data following
144 the gssapi blob itself is decrypted othervise the gssapi_encrypted_tvb
145 tvb will be decrypted (DCERPC has the data before the gssapi blob)
146 If, on return, gssapi_data_encrypted is FALSE, the wrapped tvbuff
147 was signed (i.e., an encrypted signature was present, to check
148 whether the data was modified by a man in the middle) but not sealed
149 (i.e., the data itself wasn't encrypted).
151 #define DECRYPT_GSSAPI_NORMAL 1
152 #define DECRYPT_GSSAPI_DCE 2
153 guint16 decrypt_gssapi_tvb;
154 tvbuff_t *gssapi_wrap_tvb;
155 tvbuff_t *gssapi_encrypted_tvb;
156 tvbuff_t *gssapi_decrypted_tvb;
157 gboolean gssapi_data_encrypted;
159 guint32 ppid[MAX_NUMBER_OF_PPIDS]; /* The first NUMBER_OF_PPIDS PPIDS which are present
162 void *private_data; /* pointer to data passed from one dissector to another */
163 GString *layer_names; /* layers of each protocol */
168 #endif /* __PACKET_INFO_H__ */