/* packet-tcp.c
* Routines for TCP packet disassembly
*
- * $Id: packet-tcp.c,v 1.194 2003/05/21 05:43:27 guy Exp $
+ * $Id: packet-tcp.c,v 1.223 2004/02/24 17:49:06 ulfl Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
#include <glib.h>
#include "in_cksum.h"
+#include <epan/packet.h>
#include <epan/resolv.h>
#include "ipproto.h"
+#include "ip_opts.h"
#include "follow.h"
#include "prefs.h"
#include "packet-tcp.h"
static int hf_tcp_analysis_acks_frame = -1;
static int hf_tcp_analysis_ack_rtt = -1;
static int hf_tcp_analysis_retransmission = -1;
+static int hf_tcp_analysis_fast_retransmission = -1;
+static int hf_tcp_analysis_out_of_order = -1;
static int hf_tcp_analysis_lost_packet = -1;
static int hf_tcp_analysis_ack_lost_packet = -1;
static int hf_tcp_analysis_keep_alive = -1;
+static int hf_tcp_analysis_keep_alive_ack = -1;
static int hf_tcp_analysis_duplicate_ack = -1;
static int hf_tcp_analysis_duplicate_ack_num = -1;
static int hf_tcp_analysis_duplicate_ack_frame = -1;
static int hf_tcp_analysis_zero_window = -1;
static int hf_tcp_analysis_zero_window_probe = -1;
static int hf_tcp_analysis_zero_window_violation = -1;
+static int hf_tcp_reassembled_in = -1;
static int hf_tcp_segments = -1;
static int hf_tcp_segment = -1;
static int hf_tcp_segment_overlap = -1;
&hf_tcp_segment_multiple_tails,
&hf_tcp_segment_too_long_fragment,
&hf_tcp_segment_error,
- NULL,
+ &hf_tcp_reassembled_in,
"Segments"
};
/* TCP structs and definitions */
+static void
+process_tcp_payload(tvbuff_t *tvb, volatile int offset, packet_info *pinfo,
+ proto_tree *tree, proto_tree *tcp_tree, int src_port, int dst_port,
+ guint32 nxtseq, gboolean is_tcp_segment);
/* **************************************************************************
* stuff to analyze TCP sequencenumbers for retransmissions, missing segments,
* RTT and reltive sequence numbers.
* **************************************************************************/
-static gboolean tcp_analyze_seq = FALSE;
-static gboolean tcp_relative_seq = FALSE;
+static gboolean tcp_analyze_seq = TRUE;
+static gboolean tcp_relative_seq = TRUE;
static GMemChunk *tcp_unacked_chunk = NULL;
static int tcp_unacked_count = 500; /* one for each packet until it is acked*/
guint32 nextseq;
nstime_t ts;
- /* these are used for detection of duplicate acks and nothing else */
- guint32 ack_frame;
- guint32 ack;
- guint32 num_acks;
-
/* this is to keep track of zero window and zero window probe */
guint32 window;
+
+ guint32 flags;
};
/* Idea for gt: either x > y, or y is much bigger (assume wrap) */
static GMemChunk *tcp_acked_chunk = NULL;
static int tcp_acked_count = 5000; /* one for almost every other segment in the capture */
-#define TCP_A_RETRANSMISSION 0x01
-#define TCP_A_LOST_PACKET 0x02
-#define TCP_A_ACK_LOST_PACKET 0x04
-#define TCP_A_KEEP_ALIVE 0x08
-#define TCP_A_DUPLICATE_ACK 0x10
-#define TCP_A_ZERO_WINDOW 0x20
-#define TCP_A_ZERO_WINDOW_PROBE 0x40
-#define TCP_A_ZERO_WINDOW_VIOLATION 0x80
+#define TCP_A_RETRANSMISSION 0x0001
+#define TCP_A_LOST_PACKET 0x0002
+#define TCP_A_ACK_LOST_PACKET 0x0004
+#define TCP_A_KEEP_ALIVE 0x0008
+#define TCP_A_DUPLICATE_ACK 0x0010
+#define TCP_A_ZERO_WINDOW 0x0020
+#define TCP_A_ZERO_WINDOW_PROBE 0x0040
+#define TCP_A_ZERO_WINDOW_VIOLATION 0x0080
+#define TCP_A_KEEP_ALIVE_ACK 0x0100
+#define TCP_A_OUT_OF_ORDER 0x0200
+#define TCP_A_FAST_RETRANSMISSION 0x0400
struct tcp_acked {
guint32 frame_acked;
nstime_t ts;
- guint8 flags;
+ guint16 flags;
guint32 dupack_num; /* dup ack number */
guint32 dupack_frame; /* dup ack to frame # */
};
struct tcp_rel_seq {
guint32 seq_base;
guint32 ack_base;
+ gint16 win_scale;
};
static GHashTable *tcp_rel_seq_table = NULL;
guint32 base_seq1;
struct tcp_unacked *ual2; /* UnAcked List 2*/
guint32 base_seq2;
+ gint16 win_scale1;
+ gint16 win_scale2;
+ guint32 ack1, ack2;
+ guint32 ack1_frame, ack2_frame;
+ nstime_t ack1_time, ack2_time;
+ guint32 num1_acks, num2_acks;
/* these two lists are used to track when PDUs may start
inside a segment.
tcpd=g_mem_chunk_alloc(tcp_analysis_chunk);
tcpd->ual1=NULL;
tcpd->base_seq1=0;
+ tcpd->win_scale1=-1;
+ tcpd->ack1=0;
+ tcpd->ack1_frame=0;
+ tcpd->ack1_time.secs=0;
+ tcpd->ack1_time.nsecs=0;
+ tcpd->num1_acks=0;
tcpd->ual2=NULL;
tcpd->base_seq2=0;
+ tcpd->win_scale2=-1;
+ tcpd->ack2=0;
+ tcpd->ack2_frame=0;
+ tcpd->ack2_time.secs=0;
+ tcpd->ack2_time.nsecs=0;
+ tcpd->num2_acks=0;
tcpd->pdu_seq1=NULL;
tcpd->pdu_seq2=NULL;
*/
}
+/* if we saw a window scaling option, store it for future reference
+*/
+static void
+pdu_store_window_scale_option(packet_info *pinfo, guint8 ws)
+{
+ struct tcp_analysis *tcpd=NULL;
+ int direction;
+
+ /* find(or create if needed) the conversation for this tcp session */
+ tcpd=get_tcp_conversation_data(pinfo);
+
+ /* check direction and get pdu start list */
+ direction=CMP_ADDRESS(&pinfo->src, &pinfo->dst);
+ /* if the addresses are equal, match the ports instead */
+ if(direction==0) {
+ direction= (pinfo->srcport > pinfo->destport)*2-1;
+ }
+ if(direction>=0){
+ tcpd->win_scale1=ws;
+ } else {
+ tcpd->win_scale2=ws;
+ }
+}
+
static void
-tcp_get_relative_seq_ack(guint32 frame, guint32 *seq, guint32 *ack)
+tcp_get_relative_seq_ack(guint32 frame, guint32 *seq, guint32 *ack, guint32 *win)
{
struct tcp_rel_seq *trs;
(*seq) -= trs->seq_base;
(*ack) -= trs->ack_base;
+ if(trs->win_scale!=-1){
+ (*win)<<=trs->win_scale;
+ }
}
static struct tcp_acked *
}
static void
-tcp_analyze_sequence_number(packet_info *pinfo, guint32 seq, guint32 ack, guint32 seglen, guint8 flags, guint16 window)
+tcp_analyze_sequence_number(packet_info *pinfo, guint32 seq, guint32 ack, guint32 seglen, guint8 flags, guint32 window)
{
struct tcp_analysis *tcpd=NULL;
int direction;
struct tcp_unacked *ual1=NULL;
struct tcp_unacked *ual2=NULL;
struct tcp_unacked *ual=NULL;
- guint32 base_seq=0;
- guint32 base_ack=0;
+ guint32 base_seq;
+ guint32 base_ack;
+ guint32 ack1, ack2;
+ guint32 ack1_frame, ack2_frame;
+ nstime_t *ack1_time, *ack2_time;
+ guint32 num1_acks, num2_acks;
+ gint16 win_scale;
struct tcp_next_pdu **tnp=NULL;
/* find(or create if needed) the conversation for this tcp session */
if(direction>=0){
ual1=tcpd->ual1;
ual2=tcpd->ual2;
+ ack1=tcpd->ack1;
+ ack2=tcpd->ack2;
+ ack1_frame=tcpd->ack1_frame;
+ ack2_frame=tcpd->ack2_frame;
+ ack1_time=&tcpd->ack1_time;
+ ack2_time=&tcpd->ack2_time;
+ num1_acks=tcpd->num1_acks;
+ num2_acks=tcpd->num2_acks;
tnp=&tcpd->pdu_seq2;
- base_seq=tcpd->base_seq1;
- base_ack=tcpd->base_seq2;
+ base_seq=(tcp_relative_seq && (ual1==NULL))?seq:tcpd->base_seq1;
+ base_ack=(tcp_relative_seq && (ual2==NULL))?ack:tcpd->base_seq2;
+ win_scale=tcpd->win_scale1;
} else {
ual1=tcpd->ual2;
ual2=tcpd->ual1;
+ ack1=tcpd->ack2;
+ ack2=tcpd->ack1;
+ ack1_frame=tcpd->ack2_frame;
+ ack2_frame=tcpd->ack1_frame;
+ ack1_time=&tcpd->ack2_time;
+ ack2_time=&tcpd->ack1_time;
+ num1_acks=tcpd->num2_acks;
+ num2_acks=tcpd->num1_acks;
tnp=&tcpd->pdu_seq1;
- base_seq=tcpd->base_seq2;
- base_ack=tcpd->base_seq1;
+ base_seq=(tcp_relative_seq && (ual1==NULL))?seq:tcpd->base_seq2;
+ base_ack=(tcp_relative_seq && (ual2==NULL))?ack:tcpd->base_seq1;
+ win_scale=tcpd->win_scale2;
}
- if(tcp_relative_seq){
- if(base_seq==0){
- base_seq=seq;
- }
- if(base_ack==0){
- base_ack=ack;
+ if(!seglen){
+ if(!ack2_frame){
+ ack2_frame=pinfo->fd->num;
+ ack2=ack;
+ ack2_time->secs=pinfo->fd->abs_secs;
+ ack2_time->nsecs=pinfo->fd->abs_usecs*1000;
+ num2_acks=0;
+ } else if(GT_SEQ(ack, ack2)){
+ ack2_frame=pinfo->fd->num;
+ ack2=ack;
+ ack2_time->secs=pinfo->fd->abs_secs;
+ ack2_time->nsecs=pinfo->fd->abs_usecs*1000;
+ num2_acks=0;
}
}
+#ifdef REMOVED
+/* useful debug ouput
+ * it prints the two lists of the sliding window emulation
+ */
+{
+struct tcp_unacked *u=NULL;
+printf("\n");
+printf("analyze_sequence_number(frame:%d seq:%d nextseq:%d ack:%d baseseq:0x%08x baseack:0x%08x)\n",pinfo->fd->num,seq,seq+seglen,ack,base_seq,base_ack);
+printf("UAL1:\n");
+for(u=ual1;u;u=u->next){
+printf(" Frame:%d seq:%d nseq:%d time:%d.%09d ack:%d:%d\n",u->frame,u->seq,u->nextseq,u->ts.secs,u->ts.nsecs,ack1,ack2);
+}
+printf("UAL2:\n");
+for(u=ual2;u;u=u->next){
+printf(" Frame:%d seq:%d nseq:%d time:%d.%09d ack:%d:%d\n",u->frame,u->seq,u->nextseq,u->ts.secs,u->ts.nsecs,ack1,ack2);
+}
+}
+#endif
+
/* To handle FIN, just add 1 to the length.
else the ACK following the FIN-ACK will look like it was
outside the window. */
ual1=g_mem_chunk_alloc(tcp_unacked_chunk);
ual1->next=NULL;
ual1->frame=pinfo->fd->num;
- ual1->ack_frame=0;
- ual1->ack=0;
- ual1->num_acks=0;
- ual1->seq=seq+1;
+ ack1_frame=0;
+ ack2_frame=0;
+ ack1=0;
+ ack2=0;
+ num1_acks=0;
+ num2_acks=0;
+ ual1->seq=seq;
ual1->nextseq=seq+1;
ual1->ts.secs=pinfo->fd->abs_secs;
ual1->ts.nsecs=pinfo->fd->abs_usecs*1000;
ual1->window=window;
+ ual1->flags=0;
if(tcp_relative_seq){
base_seq=seq;
- base_ack=ack;
+ /* if this was an SYN|ACK packet then set base_ack
+ * reflect the start of the sequence, i.e. one less
+ */
+ if(flags&TH_ACK){
+ base_ack=ack-1;
+ } else {
+ base_ack=ack;
+ }
}
goto seq_finished;
}
ual1=g_mem_chunk_alloc(tcp_unacked_chunk);
ual1->next=NULL;
ual1->frame=pinfo->fd->num;
- ual1->ack_frame=0;
- ual1->ack=0;
- ual1->num_acks=0;
ual1->seq=seq;
ual1->nextseq=seq+seglen;
ual1->ts.secs=pinfo->fd->abs_secs;
ual1->ts.nsecs=pinfo->fd->abs_usecs*1000;
ual1->window=window;
+ ual1->flags=0;
if(tcp_relative_seq){
base_seq=seq;
base_ack=ack;
ual=g_mem_chunk_alloc(tcp_unacked_chunk);
ual->next=ual1;
ual->frame=pinfo->fd->num;
- ual->ack_frame=0;
- ual->ack=0;
- ual->num_acks=0;
ual->seq=seq;
ual->nextseq=seq+seglen;
ual->ts.secs=pinfo->fd->abs_secs;
ual->ts.nsecs=pinfo->fd->abs_usecs*1000;
ual->window=window;
+ ual->flags=0;
ual1=ual;
goto seq_finished;
}
- /* keep-alives are empty semgents with a sequence number -1 of what
+ /* keep-alives are empty segments with a sequence number -1 of what
* we would expect.
*
* Solaris is an exception, Solaris does not really use KeepAlives
* , brilliant)
*/
if( (seglen<=1) && EQ_SEQ(seq, (ual1->nextseq-1)) ){
- struct tcp_acked *ta;
-
- ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
- ta->flags|=TCP_A_KEEP_ALIVE;
- goto seq_finished;
+ if(!(flags&TH_FIN)){ /* FIN segments are not keepalives */
+ struct tcp_acked *ta;
+
+ ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
+ ta->flags|=TCP_A_KEEP_ALIVE;
+ ual1->flags|=TCP_A_KEEP_ALIVE;
+ goto seq_finished;
+ }
}
goto seq_finished;
}
- /* check if the sequence number is lower than expected, i.e. retransmission */
+ /* check if the sequence number is lower than expected, i.e. either a
+ * retransmission a fast retransmission or an out of order segment
+ */
if( LT_SEQ(seq, ual1->nextseq )){
- struct tcp_acked *ta;
+ gboolean outoforder;
+ struct tcp_unacked *tu,*ntu;
+
+ /* assume it is a fast retransmission if
+ * 1 we have seen >=3 dupacks in the other direction for this
+ * segment (i.e. >=4 acks)
+ * 2 if this segment is the next unacked segment
+ * 3 this segment came within 10ms of the last dupack
+ * (10ms is arbitrary but should be low enough not to be
+ * confused with a retransmission timeout
+ */
+ if( (num1_acks>=4) && (seq==ack1) ){
+ guint32 t;
- ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
- ta->flags|=TCP_A_RETRANSMISSION;
+ t=(pinfo->fd->abs_secs-ack1_time->secs)*1000000000;
+ t=t+(pinfo->fd->abs_usecs*1000)-ack1_time->nsecs;
+ if(t<10000000){
+ /* has to be a retransmission then */
+ struct tcp_acked *ta;
+
+ ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
+ ta->flags|=TCP_A_FAST_RETRANSMISSION;
+ goto seq_finished;
+ }
+ }
- /* did this segment contain any more data we havent seen yet?
- * if so we can just increase nextseq
+ /* check it is a suspected out of order segment.
+ * we assume it is an out of order segment if
+ * 1 it has not been ACKed yet.
+ * 2 we have not seen the segment before
+ * 3 it arrived within (arbitrary value) 4ms of the
+ * next semgent in the sequence.
+ * 4 there were no dupacks in the opposite direction.
*/
- if(GT_SEQ((seq+seglen), ual1->nextseq)){
- ual1->nextseq=seq+seglen;
- ual1->frame=pinfo->fd->num;
- ual1->ts.secs=pinfo->fd->abs_secs;
- ual1->ts.nsecs=pinfo->fd->abs_usecs*1000;
+ outoforder=TRUE;
+#ifdef REMOVED
+ /* dont do this test. For full-duplex capture devices that
+ * capture in both directions using two NICs it is more common
+ * than one would expect for this to happen since they often
+ * lose the time integrity between the two NICs
+ */
+ /* 1 has it already been ACKed ? */
+ if(LT_SEQ(seq,ack1)){
+ outoforder=FALSE;
+ }
+#endif
+ /* 2 have we seen this segment before ? */
+ for(tu=ual1;tu;tu=tu->next){
+ if((tu->frame)&&(tu->seq==seq)){
+ outoforder=FALSE;
+ }
+ }
+ /* 3 was it received within 4ms of the next segment ?*/
+ ntu=NULL;
+ for(tu=ual1;tu;tu=tu->next){
+ if(LT_SEQ(seq,tu->seq)){
+ if(tu->frame){
+ ntu=tu;
+ }
+ }
+ }
+ if(ntu){
+ if(pinfo->fd->abs_secs>(guint32)(ntu->ts.secs+2)){
+ outoforder=FALSE;
+ } else if((pinfo->fd->abs_secs+2)<(guint32)ntu->ts.secs){
+ outoforder=FALSE;
+ } else {
+ guint32 t;
+
+ t=(ntu->ts.secs-pinfo->fd->abs_secs)*1000000000;
+ t=t+ntu->ts.nsecs-(pinfo->fd->abs_usecs*1000);
+ if(t>4000000){
+ outoforder=FALSE;
+ }
+ }
+ }
+
+
+ if(outoforder) {
+ struct tcp_acked *ta;
+
+ ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
+ ta->flags|=TCP_A_OUT_OF_ORDER;
+ } else {
+ /* has to be a retransmission then */
+ struct tcp_acked *ta;
+
+ ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
+ ta->flags|=TCP_A_RETRANSMISSION;
+
+ /* did this segment contain any more data we havent seen yet?
+ * if so we can just increase nextseq
+ */
+ if(GT_SEQ((seq+seglen), ual1->nextseq)){
+ ual1->nextseq=seq+seglen;
+ ual1->frame=pinfo->fd->num;
+ ual1->ts.secs=pinfo->fd->abs_secs;
+ ual1->ts.nsecs=pinfo->fd->abs_usecs*1000;
+ }
}
goto seq_finished;
}
ual=g_mem_chunk_alloc(tcp_unacked_chunk);
ual->next=ual1;
ual->frame=pinfo->fd->num;
- ual->ack_frame=0;
- ual->ack=0;
- ual->num_acks=0;
ual->seq=seq;
ual->nextseq=seq+seglen;
ual->ts.secs=pinfo->fd->abs_secs;
ual->ts.nsecs=pinfo->fd->abs_usecs*1000;
ual->window=window;
+ ual->flags=0;
ual1=ual;
seq_finished:
ual2=g_mem_chunk_alloc(tcp_unacked_chunk);
ual2->next=NULL;
ual2->frame=0;
- ual2->ack_frame=0;
- ual2->ack=0;
- ual2->num_acks=0;
ual2->seq=ack;
ual2->nextseq=ack;
ual2->ts.secs=0;
ual2->ts.nsecs=0;
ual2->window=window;
+ ual2->flags=0;
}
/* update the ACK counter and check for
if((!seglen)&&LE_SEQ(ack,ual->seq)){
/* if this is the first ack to keep track of, it is not
a duplicate */
- if(ual->num_acks==0){
- ual->ack=ack;
- ual->ack_frame=pinfo->fd->num;
- ual->num_acks=1;
+ if(num2_acks==0){
+ ack2=ack;
+ ack2_frame=pinfo->fd->num;
+ num2_acks=1;
/* if this ack is different, store this one
instead and forget the previous one(s) */
- } else if(ual->ack!=ack){
- ual->ack=ack;
- ual->ack_frame=pinfo->fd->num;
- ual->num_acks=1;
+ } else if(ack2!=ack){
+ ack2=ack;
+ ack2_frame=pinfo->fd->num;
+ num2_acks=1;
/* this has to be a duplicate ack */
} else {
- ual->num_acks++;
+ num2_acks++;
}
+ /* is this an ACK to a KeepAlive? */
+ if( (ual->flags&TCP_A_KEEP_ALIVE)
+ && (ack==ual->seq) ){
+ struct tcp_acked *ta;
+ ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
+ ta->flags|=TCP_A_KEEP_ALIVE_ACK;
+ ual->flags^=TCP_A_KEEP_ALIVE;
+ } else if(num2_acks>1) {
/* ok we have found a potential duplicate ack */
- if(ual->num_acks>1){
struct tcp_acked *ta;
ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
- ta->flags|=TCP_A_DUPLICATE_ACK;
- ta->dupack_num=ual->num_acks-1;
- ta->dupack_frame=ual->ack_frame;
+ /* keepalives are not dupacks */
+ if( (!(ta->flags&TCP_A_KEEP_ALIVE)) ){
+ ta->flags|=TCP_A_DUPLICATE_ACK;
+ ta->dupack_num=num2_acks-1;
+ ta->dupack_frame=ack2_frame;
+ }
}
}
*/
tcpd->ual1=ual1;
tcpd->ual2=ual2;
+ tcpd->ack1=ack1;
+ tcpd->ack2=ack2;
+ tcpd->ack1_frame=ack1_frame;
+ tcpd->ack2_frame=ack2_frame;
+ tcpd->num1_acks=num1_acks;
+ tcpd->num2_acks=num2_acks;
tcpd->base_seq1=base_seq;
+ tcpd->base_seq2=base_ack;
} else {
tcpd->ual1=ual2;
tcpd->ual2=ual1;
+ tcpd->ack1=ack2;
+ tcpd->ack2=ack1;
+ tcpd->ack1_frame=ack2_frame;
+ tcpd->ack2_frame=ack1_frame;
+ tcpd->num1_acks=num2_acks;
+ tcpd->num2_acks=num1_acks;
tcpd->base_seq2=base_seq;
+ tcpd->base_seq1=base_ack;
}
trs=g_mem_chunk_alloc(tcp_rel_seq_chunk);
trs->seq_base=base_seq;
trs->ack_base=base_ack;
+ trs->win_scale=win_scale;
g_hash_table_insert(tcp_rel_seq_table, (void *)pinfo->fd->num, trs);
}
}
col_prepend_fstr(pinfo->cinfo, COL_INFO, "[TCP Retransmission] ");
}
}
+ if( ta->flags&TCP_A_FAST_RETRANSMISSION ){
+ proto_tree_add_none_format(flags_tree, hf_tcp_analysis_fast_retransmission, tvb, 0, 0, "This frame is a (suspected) fast retransmission");
+ proto_tree_add_none_format(flags_tree, hf_tcp_analysis_retransmission, tvb, 0, 0, "This frame is a (suspected) retransmission");
+ if(check_col(pinfo->cinfo, COL_INFO)){
+ col_prepend_fstr(pinfo->cinfo, COL_INFO, "[TCP Fast Retransmission] ");
+ }
+ }
+ if( ta->flags&TCP_A_OUT_OF_ORDER ){
+ proto_tree_add_none_format(flags_tree, hf_tcp_analysis_out_of_order, tvb, 0, 0, "This frame is a (suspected) out-of-order segment");
+ if(check_col(pinfo->cinfo, COL_INFO)){
+ col_prepend_fstr(pinfo->cinfo, COL_INFO, "[TCP Out-Of-Order] ");
+ }
+ }
if( ta->flags&TCP_A_LOST_PACKET ){
proto_tree_add_none_format(flags_tree, hf_tcp_analysis_lost_packet, tvb, 0, 0, "A segment before this frame was lost");
if(check_col(pinfo->cinfo, COL_INFO)){
col_prepend_fstr(pinfo->cinfo, COL_INFO, "[TCP Keep-Alive] ");
}
}
+ if( ta->flags&TCP_A_KEEP_ALIVE_ACK ){
+ proto_tree_add_none_format(flags_tree, hf_tcp_analysis_keep_alive_ack, tvb, 0, 0, "This is an ACK to a TCP keep-alive segment");
+ if(check_col(pinfo->cinfo, COL_INFO)){
+ col_prepend_fstr(pinfo->cinfo, COL_INFO, "[TCP Keep-Alive ACK] ");
+ }
+ }
if( ta->dupack_num){
if( ta->flags&TCP_A_DUPLICATE_ACK ){
proto_tree_add_none_format(flags_tree, hf_tcp_analysis_duplicate_ack, tvb, 0, 0, "This is a TCP duplicate ack");
tcp_rel_seq_table = NULL;
}
if( tcp_pdu_tracking_table ){
- g_hash_table_foreach_remove(tcp_rel_seq_table,
+ g_hash_table_foreach_remove(tcp_pdu_tracking_table,
free_all_acked, NULL);
g_hash_table_destroy(tcp_pdu_tracking_table);
tcp_pdu_tracking_table = NULL;
contain a continuation of a higher-level PDU.
Call the normal subdissector.
*/
- decode_tcp_ports(tvb, offset, pinfo, tree,
- sport, dport, 0);
+ process_tcp_payload(tvb, offset, pinfo, tree, tcp_tree,
+ sport, dport, 0, FALSE);
called_dissector = TRUE;
/* Did the subdissector ask us to desegment some more data
tcpinfo->is_reassembled = TRUE;
/* call subdissector */
- decode_tcp_ports(next_tvb, 0, pinfo, tree,
- sport, dport, 0);
+ process_tcp_payload(next_tvb, 0, pinfo, tree,
+ tcp_tree, sport, dport, 0, FALSE);
called_dissector = TRUE;
/*
}
if (!called_dissector || pinfo->desegment_len != 0) {
+ if (ipfd_head != NULL && ipfd_head->reassembled_in != 0) {
+ /*
+ * We know what frame this PDU is reassembled in;
+ * let the user know.
+ */
+ proto_tree_add_uint(tcp_tree, hf_tcp_reassembled_in,
+ tvb, 0, 0, ipfd_head->reassembled_in);
+ }
+
/*
* Either we didn't call the subdissector at all (i.e.,
* this is a segment that contains the middle of a
offset, optlen, ws, "%s: %u (multiply by %u)",
optp->name, ws, 1 << ws);
tcp_info_append_uint(pinfo, "WS", ws);
+ if(!pinfo->fd->flags.visited && tcp_analyze_seq && tcp_relative_seq){
+ pdu_store_window_scale_option(pinfo, ws);
+ }
}
static void
#define N_TCP_OPTS (sizeof tcpopts / sizeof tcpopts[0])
-/* Determine if there is a sub-dissector and call it. This has been */
-/* separated into a stand alone routine to other protocol dissectors */
-/* can call to it, ie. socks */
+/* Determine if there is a sub-dissector and call it; return TRUE
+ if there was a sub-dissector, FALSE otherwise.
-void
+ This has been separated into a stand alone routine to other protocol
+ dissectors can call to it, e.g., SOCKS. */
+
+static gboolean try_heuristic_first = FALSE;
+
+gboolean
decode_tcp_ports(tvbuff_t *tvb, int offset, packet_info *pinfo,
- proto_tree *tree, int src_port, int dst_port, guint32 nxtseq)
+ proto_tree *tree, int src_port, int dst_port)
{
tvbuff_t *next_tvb;
int low_port, high_port;
-/*qqq see if it is an unaligned PDU */
- if(nxtseq && tcp_analyze_seq && (!tcp_desegment)){
- guint32 seq;
- seq=nxtseq-tvb_reported_length_remaining(tvb, offset);
- offset=scan_for_next_pdu(pinfo, offset, seq, nxtseq);
- }
-
-
next_tvb = tvb_new_subset(tvb, offset, -1, -1);
/* determine if this packet is part of a conversation and call dissector */
/* for the conversation if available */
if (try_conversation_dissector(&pinfo->src, &pinfo->dst, PT_TCP,
- src_port, dst_port, next_tvb, pinfo, tree))
- goto end_decode_tcp_ports;
+ src_port, dst_port, next_tvb, pinfo, tree)){
+ pinfo->want_pdu_tracking -= !!(pinfo->want_pdu_tracking);
+ return TRUE;
+ }
+
+ if (try_heuristic_first) {
+ /* do lookup with the heuristic subdissector table */
+ if (dissector_try_heuristic(heur_subdissector_list, next_tvb, pinfo, tree)){
+ pinfo->want_pdu_tracking -= !!(pinfo->want_pdu_tracking);
+ return TRUE;
+ }
+ }
/* Do lookups with the subdissector table.
We try the port number with the lower value first, followed by the
high_port = dst_port;
}
if (low_port != 0 &&
- dissector_try_port(subdissector_table, low_port, next_tvb, pinfo, tree))
- goto end_decode_tcp_ports;
-
+ dissector_try_port(subdissector_table, low_port, next_tvb, pinfo, tree)){
+ pinfo->want_pdu_tracking -= !!(pinfo->want_pdu_tracking);
+ return TRUE;
+ }
if (high_port != 0 &&
- dissector_try_port(subdissector_table, high_port, next_tvb, pinfo, tree))
- goto end_decode_tcp_ports;
-
- /* do lookup with the heuristic subdissector table */
- if (dissector_try_heuristic(heur_subdissector_list, next_tvb, pinfo, tree))
- goto end_decode_tcp_ports;
+ dissector_try_port(subdissector_table, high_port, next_tvb, pinfo, tree)){
+ pinfo->want_pdu_tracking -= !!(pinfo->want_pdu_tracking);
+ return TRUE;
+ }
+ if (!try_heuristic_first) {
+ /* do lookup with the heuristic subdissector table */
+ if (dissector_try_heuristic(heur_subdissector_list, next_tvb, pinfo, tree)){
+ pinfo->want_pdu_tracking -= !!(pinfo->want_pdu_tracking);
+ return TRUE;
+ }
+ }
/* Oh, well, we don't know this; dissect it as data. */
call_dissector(data_handle,next_tvb, pinfo, tree);
- return;
-end_decode_tcp_ports:
- /* if !visited, check want_pdu_tracking and store it in table */
- /* XXX fix nxtseq so that it always has valid content and skip the ==0 check */
- if((!pinfo->fd->flags.visited) && nxtseq && tcp_analyze_seq && pinfo->want_pdu_tracking){
- pdu_store_sequencenumber_of_next_pdu(pinfo, nxtseq+pinfo->bytes_until_next_pdu);
- }
+ pinfo->want_pdu_tracking -= !!(pinfo->want_pdu_tracking);
+ return FALSE;
+}
+static void
+process_tcp_payload(tvbuff_t *tvb, volatile int offset, packet_info *pinfo,
+ proto_tree *tree, proto_tree *tcp_tree, int src_port, int dst_port,
+ guint32 nxtseq, gboolean is_tcp_segment)
+{
+ pinfo->want_pdu_tracking=0;
+
+ TRY {
+ if(is_tcp_segment){
+ /*qqq see if it is an unaligned PDU */
+ if(tcp_analyze_seq && (!tcp_desegment)){
+ guint32 seq;
+ seq=nxtseq-tvb_reported_length_remaining(tvb,
+ offset);
+ offset=scan_for_next_pdu(pinfo, offset, seq,
+ nxtseq);
+ }
+ }
+ if (decode_tcp_ports(tvb, offset, pinfo, tree, src_port,
+ dst_port)) {
+ /*
+ * We succeeded in handing off to a subdissector.
+ *
+ * Is this a TCP segment or a reassembled chunk of
+ * TCP payload?
+ */
+ if(is_tcp_segment){
+ /* if !visited, check want_pdu_tracking and
+ store it in table */
+ if((!pinfo->fd->flags.visited) &&
+ tcp_analyze_seq && pinfo->want_pdu_tracking){
+ pdu_store_sequencenumber_of_next_pdu(
+ pinfo,
+ nxtseq+pinfo->bytes_until_next_pdu);
+ }
+ }
+ }
+ }
+ CATCH_ALL {
+ /* We got an exception. At this point the dissection is
+ * completely aborted and execution will be transfered back
+ * to (probably) the frame dissector.
+ * Here we have to place whatever we want the dissector
+ * to do before aborting the tcp dissection.
+ */
+ /*
+ * Is this a TCP segment or a reassembled chunk of TCP
+ * payload?
+ */
+ if(is_tcp_segment){
+ /*
+ * It's from a TCP segment.
+ *
+ * Handle TCP seq# analysis, print any extra SEQ/ACK
+ * data for this segment.
+ */
+ if(tcp_analyze_seq){
+ tcp_print_sequence_number_analysis(pinfo, tvb, tcp_tree);
+ }
+ /*
+ * if !visited, check want_pdu_tracking and store it
+ * in table
+ */
+ if((!pinfo->fd->flags.visited) && tcp_analyze_seq && pinfo->want_pdu_tracking){
+ pdu_store_sequencenumber_of_next_pdu(pinfo,
+ nxtseq+pinfo->bytes_until_next_pdu);
+ }
+ }
+ RETHROW;
+ }
+ ENDTRY;
}
+void
+dissect_tcp_payload(tvbuff_t *tvb, packet_info *pinfo, int offset, guint32 seq,
+ guint32 nxtseq, guint32 sport, guint32 dport,
+ proto_tree *tree, proto_tree *tcp_tree)
+{
+ gboolean save_fragmented;
+
+ /* Can we desegment this segment? */
+ if (pinfo->can_desegment) {
+ /* Yes. */
+ desegment_tcp(tvb, pinfo, offset, seq, nxtseq, sport, dport, tree,
+ tcp_tree);
+ } else {
+ /* No - just call the subdissector.
+ Mark this as fragmented, so if somebody throws an exception,
+ we don't report it as a malformed frame. */
+ save_fragmented = pinfo->fragmented;
+ pinfo->fragmented = TRUE;
+ process_tcp_payload(tvb, offset, pinfo, tree, tcp_tree, sport, dport,
+ nxtseq, TRUE);
+ pinfo->fragmented = save_fragmented;
+ }
+}
static void
dissect_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
guint length_remaining;
gboolean desegment_ok;
struct tcpinfo tcpinfo;
- gboolean save_fragmented;
static struct tcpheader tcphstruct[4], *tcph;
static int tcph_count=0;
tcph_count=0;
}
tcph=&tcphstruct[tcph_count];
- /* XXX add to ipv6 so this works for that protocol as well */
- tcph->ip_header=pinfo->private_data;
+ SET_ADDRESS(&tcph->ip_src, pinfo->src.type, pinfo->src.len, pinfo->src.data);
+ SET_ADDRESS(&tcph->ip_dst, pinfo->dst.type, pinfo->dst.len, pinfo->dst.data);
if (check_col(pinfo->cinfo, COL_PROTOCOL))
col_set_str(pinfo->cinfo, COL_PROTOCOL, "TCP");
/*
* If we've been handed an IP fragment, we don't know how big the TCP
* segment is, so don't do anything that requires that we know that.
+ *
+ * The same applies if we're part of an error packet. (XXX - if the
+ * ICMP and ICMPv6 dissectors could set a "this is how big the IP
+ * header says it is" length in the tvbuff, we could use that; such
+ * a length might also be useful for handling packets where the IP
+ * length is bigger than the actual data available in the frame; the
+ * dissectors should trust that length, and then throw a
+ * ReportedBoundsError exception when they go past the end of the frame.)
+ *
+ * We also can't determine the segment length if the reported length
+ * of the TCP packet is less than the TCP header length.
*/
reported_len = tvb_reported_length(tvb);
- if (!pinfo->fragmented) {
- /* Compute the length of data in this segment. */
- tcph->th_seglen = reported_len - tcph->th_hlen;
+ if (!pinfo->fragmented && !pinfo->in_error_pkt) {
+ if (reported_len < tcph->th_hlen) {
+ proto_tree_add_text(tcp_tree, tvb, offset, 0,
+ "Short segment. Segment/fragment does not contain a full TCP header"
+ " (might be NMAP or someone else deliberately sending unusual packets)");
+ tcph->th_have_seglen = FALSE;
+ } else {
+ /* Compute the length of data in this segment. */
+ tcph->th_seglen = reported_len - tcph->th_hlen;
+ tcph->th_have_seglen = TRUE;
- if (tree) { /* Add the seglen as an invisible field */
+ if (tree) { /* Add the seglen as an invisible field */
- proto_tree_add_uint_hidden(ti, hf_tcp_len, tvb, offset, 4, tcph->th_seglen);
+ proto_tree_add_uint_hidden(ti, hf_tcp_len, tvb, offset, 4, tcph->th_seglen);
- }
+ }
- /* handle TCP seq# analysis parse all new segments we see */
- if(tcp_analyze_seq){
- if(!(pinfo->fd->flags.visited)){
- tcp_analyze_sequence_number(pinfo, tcph->th_seq, tcph->th_ack, tcph->th_seglen, tcph->th_flags, tcph->th_win);
- }
- if(tcp_relative_seq){
- tcp_get_relative_seq_ack(pinfo->fd->num, &(tcph->th_seq), &(tcph->th_ack));
- }
- }
+ /* handle TCP seq# analysis parse all new segments we see */
+ if(tcp_analyze_seq){
+ if(!(pinfo->fd->flags.visited)){
+ tcp_analyze_sequence_number(pinfo, tcph->th_seq, tcph->th_ack, tcph->th_seglen, tcph->th_flags, tcph->th_win);
+ }
+ if(tcp_relative_seq){
+ tcp_get_relative_seq_ack(pinfo->fd->num, &(tcph->th_seq), &(tcph->th_ack), &(tcph->th_win));
+ }
+ }
- /* Compute the sequence number of next octet after this segment. */
- nxtseq = tcph->th_seq + tcph->th_seglen;
- }
+ /* Compute the sequence number of next octet after this segment. */
+ nxtseq = tcph->th_seq + tcph->th_seglen;
+ }
+ } else
+ tcph->th_have_seglen = FALSE;
if (check_col(pinfo->cinfo, COL_INFO) || tree) {
for (i = 0; i < 8; i++) {
if (tree) {
if (tcp_summary_in_tree) {
proto_item_append_text(ti, ", Ack: %u", tcph->th_ack);
- if (!pinfo->fragmented)
+ if (tcph->th_have_seglen)
proto_item_append_text(ti, ", Len: %u", tcph->th_seglen);
}
proto_item_set_len(ti, tcph->th_hlen);
- if (!pinfo->fragmented) {
+ if (tcph->th_have_seglen) {
if (nxtseq != tcph->th_seq) {
proto_tree_add_uint(tcp_tree, hf_tcp_nxtseq, tvb, offset, 0, nxtseq);
}
proto_tree_add_uint(tcp_tree, hf_tcp_window_size, tvb, offset + 14, 2, tcph->th_win);
}
- /* Supply the sequence number of the first byte. */
+ /* Supply the sequence number of the first byte and of the first byte
+ after the segment. */
tcpinfo.seq = tcph->th_seq;
+ tcpinfo.nxtseq = nxtseq;
/* Assume we'll pass un-reassembled data to subdissectors. */
tcpinfo.is_reassembled = FALSE;
} else
tcpinfo.urgent = FALSE;
- if (!pinfo->fragmented) {
+ if (tcph->th_have_seglen) {
if (check_col(pinfo->cinfo, COL_INFO))
col_append_fstr(pinfo->cinfo, COL_INFO, " Len=%u", tcph->th_seglen);
}
/* Decode TCP options, if any. */
- if (tree && tcph->th_hlen > TCPH_MIN_LEN) {
+ if (tcph->th_hlen > TCPH_MIN_LEN) {
/* There's more than just the fixed-length header. Decode the
options. */
optlen = tcph->th_hlen - TCPH_MIN_LEN; /* length of options, in bytes */
- tf = proto_tree_add_text(tcp_tree, tvb, offset + 20, optlen,
- "Options: (%u bytes)", optlen);
- field_tree = proto_item_add_subtree(tf, ett_tcp_options);
+ if (tcp_tree != NULL) {
+ tf = proto_tree_add_text(tcp_tree, tvb, offset + 20, optlen,
+ "Options: (%u bytes)", optlen);
+ field_tree = proto_item_add_subtree(tf, ett_tcp_options);
+ } else
+ field_tree = NULL;
dissect_ip_tcp_options(tvb, offset + 20, optlen,
tcpopts, N_TCP_OPTS, TCPOPT_EOL, pinfo, field_tree);
}
(it could be an ACK-only packet) */
length_remaining = tvb_length_remaining(tvb, offset);
- if (!pinfo->fragmented) {
+ if (tcph->th_have_seglen) {
if( data_out_file ) {
reassemble_tcp( tcph->th_seq, /* sequence number */
tcph->th_seglen, /* data length */
}
}
+ /*
+ * XXX - what, if any, of this should we do if this is included in an
+ * error packet? It might be nice to see the details of the packet
+ * that caused the ICMP error, but it might not be nice to have the
+ * dissector update state based on it.
+ * Also, we probably don't want to run TCP taps on those packets.
+ */
if (length_remaining != 0) {
if (tcph->th_flags & TH_RST) {
/*
"Reset cause: %s",
tvb_format_text(tvb, offset, length_remaining));
} else {
- /* Can we desegment this segment? */
- if (pinfo->can_desegment) {
- /* Yes. */
- desegment_tcp(tvb, pinfo, offset, tcph->th_seq, nxtseq, tcph->th_sport, tcph->th_dport, tree, tcp_tree);
- } else {
- /* No - just call the subdissector.
- Mark this as fragmented, so if somebody throws an exception,
- we don't report it as a malformed frame. */
- save_fragmented = pinfo->fragmented;
- pinfo->fragmented = TRUE;
- decode_tcp_ports(tvb, offset, pinfo, tree, tcph->th_sport, tcph->th_dport, nxtseq);
- pinfo->fragmented = save_fragmented;
- }
+ dissect_tcp_payload(tvb, pinfo, offset, tcph->th_seq, nxtseq,
+ tcph->th_sport, tcph->th_dport, tree, tcp_tree);
}
}
{ "Fin", "tcp.flags.fin", FT_BOOLEAN, 8, TFS(&flags_set_truth), TH_FIN,
"", HFILL }},
+ /* 32 bits so we can present some values adjusted to window scaling */
{ &hf_tcp_window_size,
- { "Window size", "tcp.window_size", FT_UINT16, BASE_DEC, NULL, 0x0,
+ { "Window size", "tcp.window_size", FT_UINT32, BASE_DEC, NULL, 0x0,
"", HFILL }},
{ &hf_tcp_checksum,
{ "Retransmission", "tcp.analysis.retransmission", FT_NONE, BASE_NONE, NULL, 0x0,
"This frame is a suspected TCP retransmission", HFILL }},
+ { &hf_tcp_analysis_fast_retransmission,
+ { "Fast Retransmission", "tcp.analysis.fast_retransmission", FT_NONE, BASE_NONE, NULL, 0x0,
+ "This frame is a suspected TCP fast retransmission", HFILL }},
+
+ { &hf_tcp_analysis_out_of_order,
+ { "Out Of Order", "tcp.analysis.out_of_order", FT_NONE, BASE_NONE, NULL, 0x0,
+ "This frame is a suspected Out-Of-Order segment", HFILL }},
+
{ &hf_tcp_analysis_lost_packet,
{ "Previous Segment Lost", "tcp.analysis.lost_segment", FT_NONE, BASE_NONE, NULL, 0x0,
"A segment before this one was lost from the capture", HFILL }},
{ "Keep Alive", "tcp.analysis.keep_alive", FT_NONE, BASE_NONE, NULL, 0x0,
"This is a keep-alive segment", HFILL }},
+ { &hf_tcp_analysis_keep_alive_ack,
+ { "Keep Alive ACK", "tcp.analysis.keep_alive_ack", FT_NONE, BASE_NONE, NULL, 0x0,
+ "This is an ACK to a keep-alive segment", HFILL }},
+
{ &hf_tcp_analysis_duplicate_ack,
{ "Duplicate ACK", "tcp.analysis.duplicate_ack", FT_NONE, BASE_NONE, NULL, 0x0,
"This is a duplicate ACK", HFILL }},
{ &hf_tcp_analysis_zero_window,
{ "Zero Window", "tcp.analysis.zero_window", FT_NONE, BASE_NONE, NULL, 0x0,
- "This is a Zero-Window", HFILL }},
+ "This is a zero-window", HFILL }},
{ &hf_tcp_len,
{ "TCP Segment Len", "tcp.len", FT_UINT32, BASE_DEC, NULL, 0x0,
{ &hf_tcp_segments,
{ "TCP Segments", "tcp.segments", FT_NONE, BASE_NONE, NULL, 0x0,
"TCP Segments", HFILL }},
+
+ { &hf_tcp_reassembled_in,
+ { "Reassembled PDU in frame", "tcp.reassembled_in", FT_FRAMENUM, BASE_NONE, NULL, 0x0,
+ "The PDU that starts but doesn't end in this segment is reassembled in this frame", HFILL }},
+
{ &hf_tcp_option_mss,
{ "TCP MSS Option", "tcp.options.mss", FT_BOOLEAN,
BASE_NONE, NULL, 0x0, "TCP MSS Option", HFILL }},
+
{ &hf_tcp_option_mss_val,
{ "TCP MSS Option Value", "tcp.options.mss_val", FT_UINT16,
BASE_DEC, NULL, 0x0, "TCP MSS Option Value", HFILL}},
+
{ &hf_tcp_option_wscale,
{ "TCP Window Scale Option", "tcp.options.wscale",
FT_BOOLEAN,
BASE_NONE, NULL, 0x0, "TCP Window Option", HFILL}},
+
{ &hf_tcp_option_wscale_val,
{ "TCP Windows Scale Option Value", "tcp.options.wscale_val",
FT_UINT8, BASE_DEC, NULL, 0x0, "TCP Window Scale Value",
HFILL}},
+
{ &hf_tcp_option_sack_perm,
{ "TCP Sack Perm Option", "tcp.options.sack_perm",
FT_BOOLEAN,
BASE_NONE, NULL, 0x0, "TCP Sack Perm Option", HFILL}},
+
{ &hf_tcp_option_sack,
{ "TCP Sack Option", "tcp.options.sack", FT_BOOLEAN,
BASE_NONE, NULL, 0x0, "TCP Sack Option", HFILL}},
+
{ &hf_tcp_option_sack_sle,
{"TCP Sack Left Edge", "tcp.options.sack_le", FT_UINT32,
BASE_DEC, NULL, 0x0, "TCP Sack Left Edge", HFILL}},
+
{ &hf_tcp_option_sack_sre,
{"TCP Sack Right Edge", "tcp.options.sack_re", FT_UINT32,
BASE_DEC, NULL, 0x0, "TCP Sack Right Edge", HFILL}},
+
{ &hf_tcp_option_echo,
{ "TCP Echo Option", "tcp.options.echo", FT_BOOLEAN,
BASE_NONE, NULL, 0x0, "TCP Sack Echo", HFILL}},
+
{ &hf_tcp_option_echo_reply,
{ "TCP Echo Reply Option", "tcp.options.echo_reply",
FT_BOOLEAN,
BASE_NONE, NULL, 0x0, "TCP Echo Reply Option", HFILL}},
+
{ &hf_tcp_option_time_stamp,
{ "TCP Time Stamp Option", "tcp.options.time_stamp",
FT_BOOLEAN,
BASE_NONE, NULL, 0x0, "TCP Time Stamp Option", HFILL}},
+
{ &hf_tcp_option_cc,
{ "TCP CC Option", "tcp.options.cc", FT_BOOLEAN, BASE_NONE,
NULL, 0x0, "TCP CC Option", HFILL}},
+
{ &hf_tcp_option_ccnew,
{ "TCP CC New Option", "tcp.options.ccnew", FT_BOOLEAN,
BASE_NONE, NULL, 0x0, "TCP CC New Option", HFILL}},
+
{ &hf_tcp_option_ccecho,
{ "TCP CC Echo Option", "tcp.options.ccecho", FT_BOOLEAN,
BASE_NONE, NULL, 0x0, "TCP CC Echo Option", HFILL}},
+
{ &hf_tcp_option_md5,
{ "TCP MD5 Option", "tcp.options.md5", FT_BOOLEAN, BASE_NONE,
NULL, 0x0, "TCP MD5 Option", HFILL}},
tcp_module = prefs_register_protocol(proto_tcp, NULL);
prefs_register_bool_preference(tcp_module, "summary_in_tree",
"Show TCP summary in protocol tree",
-"Whether the TCP summary line should be shown in the protocol tree",
+ "Whether the TCP summary line should be shown in the protocol tree",
&tcp_summary_in_tree);
prefs_register_bool_preference(tcp_module, "check_checksum",
"Check the validity of the TCP checksum when possible",
-"Whether to check the validity of the TCP checksum",
+ "Whether to check the validity of the TCP checksum",
&tcp_check_checksum);
prefs_register_bool_preference(tcp_module, "desegment_tcp_streams",
"Allow subdissector to desegment TCP streams",
-"Whether subdissector can request TCP streams to be desegmented",
+ "Whether subdissector can request TCP streams to be desegmented",
&tcp_desegment);
prefs_register_bool_preference(tcp_module, "analyze_sequence_numbers",
"Analyze TCP sequence numbers",
"Make the TCP dissector analyze TCP sequence numbers to find and flag segment retransmissions, missing segments and RTT",
&tcp_analyze_seq);
prefs_register_bool_preference(tcp_module, "relative_sequence_numbers",
- "Use relative sequence numbers",
- "Make the TCP dissector use relative sequence numbers instead of absolute ones. To use this option you must also enable \"Analyze TCP sequence numbers\".",
+ "Relative sequence numbers and window scaling",
+ "Make the TCP dissector use relative sequence numbers instead of absolute ones. "
+ "To use this option you must also enable \"Analyze TCP sequence numbers\". "
+ "This option will also try to track and adjust the window field according to any TCP window scaling options seen.",
&tcp_relative_seq);
+ prefs_register_bool_preference(tcp_module, "try_heuristic_first",
+ "Try heuristic sub-dissectors first",
+ "Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to a specific port",
+ &try_heuristic_first);
register_init_routine(tcp_analyze_seq_init);
register_init_routine(tcp_desegment_init);
git.samba.org / obnox / wireshark / wip.git / blobdiff