summaryrefslogtreecommitdiff
path: root/tshark.c
AgeCommit message (Collapse)AuthorFilesLines
2013-11-17Move the epan/filesystem.c routines to wsutil; they're not specific toGuy Harris1-1/+1
packet dissection, they're specific to the entire Wireshark suite of programs. svn path=/trunk/; revision=53377
2013-11-10Add missing includes in order to remove exceptions.h from proto.h (next commit).Jakub Zawadzki1-0/+2
svn path=/trunk/; revision=53230
2013-11-08The "file types" we have are actually combinations of types andGuy Harris1-18/+21
subtypes, e.g. Network Monitor version 1 and Network Monitor version 2 are separate "file types", even though they both come from Network Monitor. Rename various functions, #defines, and variables appropriately. svn path=/trunk/; revision=53166
2013-11-06Add support for displaying dates as year and day-of-year (1-origin).Guy Harris1-9/+21
In the process, fix various man page descriptions of the -t flag, and add support for UTC absolute times in the iousers and iostat TShark taps. svn path=/trunk/; revision=53114
2013-10-25Display the frame number on the packet summary line if it's one of the ↵Chris Maynard1-15/+0
configured columns. Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9317 #BACKPORT(1.10,1.8) svn path=/trunk/; revision=52838
2013-10-20tshark: use epan_dissect_reset()Jakub Zawadzki1-84/+120
svn path=/trunk/; revision=52709
2013-10-15From Ed Beroset via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9272Chris Maynard1-18/+23
Add tshark -G column-formats report and document the missing ftypes, heuristic-decodes and plugins reports. From me: Sort the reports. Add modelines to epan/column.c. Minor whitespace changes. svn path=/trunk/; revision=52627
2013-10-15Micro-optimize print_columns(): replace g_snprintf() & g_strlcat() with ↵Jakub Zawadzki1-22/+53
memcpy(). svn path=/trunk/; revision=52625
2013-10-10Fix the core dump reported in ↵Jeff Morriss1-0/+1
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9258 : After calling wtap_close(), set the wth to NULL so we don't try to close it again later. (The core only happens when tshark isn't keeping up with dumpcap's file rotation.) Wireshark still has a problem but it's a different one. svn path=/trunk/; revision=52493
2013-10-09Make column "filter name" prefixed with _ws. to be the same as other "*shark ↵Michael Mann1-1/+1
application filters" created in r52462. svn path=/trunk/; revision=52474
2013-09-04Fix one small memory leak.Evan Huus1-0/+2
svn path=/trunk/; revision=51747
2013-08-28Fully deprecate read filter (-R) without two-pass (-2). It does exactly the sameEvan Huus1-16/+12
thing as the display filter (-Y) in that case except with more confusing semantics. This also lets us fix -c in the single-pass case to unconditionally count packets. This isn't the old behaviour (which counted them only if they passed the read filter) but is more consistent with two-pass mode where they are counted even if they pass the display filter, since they are counted on the first pass and the display filter is applied on the second pass. Anyone who wants to use -c to limit packet count conditionally on them passing a filter should use it in tandem with -2 and -R: the read filter is applied on the first pass before the count. Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9048 svn path=/trunk/; revision=51556
2013-08-23Output a warning about kernel BPF JIT compiler beeing activated.Anders Broman1-0/+8
svn path=/trunk/; revision=51488
2013-08-22Move a brace outside an #ifdef, it was confusing vim's folding.Evan Huus1-2/+3
svn path=/trunk/; revision=51461
2013-08-22Don't look at packet or byte limits during the second pass of two-pass analysis.Evan Huus1-12/+0
The limits are enforced during the first pass, and frames that get dropped from the first pass for this reason aren't available to the second pass at all, so checking again is redundant. svn path=/trunk/; revision=51460
2013-08-14I guess Solaris's getopt_long() "struct option" declaration doesn't haveGuy Harris1-1/+1
enough cowbell^wconst; throw in a comment to squelch warnings. svn path=/trunk/; revision=51351
2013-08-13As suggested in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9033Evan Huus1-0/+1
Make epan_free a no-op if the pointer is NULL. This fixes 99% of the cases causing problems for wmem_leave_file_scope() - remove that XXX comment and add back the assertion. Remove the cleanup_dissection call from epan_cleanup, it doesn't make sense there. init_dissection is only called from epan_new, so cleanup_dissection should only be called from epan_free. Add one missing epan_free call to tshark revealed by the above changes. svn path=/trunk/; revision=51342
2013-08-09Don't print the packet counter when capturing if we're also printingGuy Harris1-13/+33
packet information to a terminal (which we assume is the same terminal as the one to which the packet counts are being printed), as they get in the way of each other. Don't print it if we're sending the standard error to a terminal, or if -q is specified, either. Put all the setting of print_packet_counts together; it looks as if the default value of print_packet_counts may have been changed to TRUE and the code to handle -q wasn't changed to set it to FALSE if -q was specified rather than setting it to TRUE if it wasn't specified. svn path=/trunk/; revision=51227
2013-08-02Now that we're using getopt_long(), and have some options available onlyGuy Harris1-1/+2
as long options, and thus identified with numbers rather than option letters as the return value of getopt_long(), we now have to include capture_opts.h even if we're *not* building with libpcap, to provide #defines for those numbers. svn path=/trunk/; revision=51115
2013-08-01fix buildbot error on OSX-10.6-x64Martin Kaiser1-0/+1
include capture_opts.h svn path=/trunk/; revision=51099
2013-08-01pass --capture-comment from tshark to dumpcapMartin Kaiser1-0/+15
handle error cases in tshark svn path=/trunk/; revision=51094
2013-08-01add --capture-comment to tshark's print_usage() functionMartin Kaiser1-0/+3
make it clear that a capture comment can only be added when we create a new file svn path=/trunk/; revision=51091
2013-08-01Remove fdata->opt_comment, add pkt_comment to pinfoJakub Zawadzki1-0/+1
Original (read from file) comments can be accessed by pkthdr->opt_comment Keep user comments in seperated BST, add new method for epan session to get it. svn path=/trunk/; revision=51090
2013-08-01add --capture-comment to tsharkMartin Kaiser1-2/+10
make sure that getopt() does not permute tshark's argv[] array svn path=/trunk/; revision=51089
2013-08-01use getopt_long() in tsharkMartin Kaiser1-1/+5
svn path=/trunk/; revision=51087
2013-08-01simplify argument checking for tsharkMartin Kaiser1-13/+9
if a capture file is read, do all corresponding checks in one place svn path=/trunk/; revision=51086
2013-07-23Make some functions not used outside tshark.c static.Guy Harris1-2/+2
svn path=/trunk/; revision=50858
2013-07-22Abuse epan_t more: add callback to get interface name.Jakub Zawadzki1-0/+1
svn path=/trunk/; revision=50794
2013-07-21Replace relative timestamp with reference frame number. Saves 16B per frame.Jakub Zawadzki1-5/+21
svn path=/trunk/; revision=50772
2013-07-21Add helper function to epan_session which can be used to get absolute ↵Jakub Zawadzki1-5/+36
timestamp of given frame. Remove ->prev_cap, for testing purpose also replace ->prev_dis with number of previously displayed frame number. This patch reduce size of frame_data by 8B (amd64) This is what (I think) was suggested by Guy in comment 13 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5821#c13) svn path=/trunk/; revision=50765
2013-07-21Some work on multi file dissectionJakub Zawadzki1-11/+9
- make init_dissection/cleanup_dissection private for libwireshark - implement epan_new(), epan_free() - pass epan_t to epan_dissect* svn path=/trunk/; revision=50761
2013-07-12Move the print modules into epan.Jeff Morriss1-2/+2
svn path=/trunk/; revision=50526
2013-07-12Move disabled_protos.{h,c} into epan.Jeff Morriss1-1/+1
svn path=/trunk/; revision=50521
2013-07-11packet dissection now takes pointer to tvb instead of guint8 dataJakub Zawadzki1-3/+4
implement frame_tvbuff, right now almost a copy of 'real' tvb. svn path=/trunk/; revision=50497
2013-07-08From Jim Young via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8906 :Jeff Morriss1-3/+4
This patch augments Wireshark's and tshark's augument usage reports (-? and -t?) and the Wireshark and tshark man pages to list all available timestamp options available for the -t option. svn path=/trunk/; revision=50445
2013-07-06Fix the last remnant of https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8160Evan Huus1-5/+8
Correctly calculate delta-displayed time when using two-pass dissection with a display filter. svn path=/trunk/; revision=50397
2013-06-27get main_window_update out of the way... pass an update_cb to the ↵Luis Ontanon1-10/+3
capture_sync stuff ... as per the XXX comment removed from tshark.c this was a mess to keep the linker happy... I couldn't! I did this without even understanding whether calling main_window_update was realy necessary in most cases. I guess nothing or more specific update cbs would be best. svn path=/trunk/; revision=50188
2013-06-16Have the seek-read routines take a Buffer rather than a guint8 pointerGuy Harris1-7/+9
as the "where to put the packet data" argument. This lets more of the libwiretap code be common between the read and seek-read code paths, and also allows for more flexibility in the "fill in the data" path - we can expand the buffer as needed in both cases. svn path=/trunk/; revision=49949
2013-06-05Allow tshark to read a pcap file and either save it as a new pcap file or ↵Chris Maynard1-3/+7
for packets to be read from the original pcap file, possibly filtered, then sent to stdout and piped to either tshark or wireshark, which can then read those filtered packets from stdin. Patch submitted by me in bug 2868, although it doesn't actually fix that bug. #BACKPORT(1.10) svn path=/trunk/; revision=49780
2013-05-24Fix https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8714 :Jeff Morriss1-1/+7
If we're not doing dissection (in 2-pass mode) then don't try to mark frames as depended upon: in that case epan has not been initialized so we shouldn't be looking in the edt (and anyway without dissection there won't be any dependent frames). (I'm not convinced there's any reason to run 2-pass mode without dissection, however...) svn path=/trunk/; revision=49554
2013-05-22No capture options if no libpcap.Guy Harris1-1/+1
svn path=/trunk/; revision=49519
2013-05-22AAAAAArgh. The capture_input_new_XXX routines are called fromGuy Harris1-3/+4
capture_sync.c, not from capture.c, so they should be declared in capture_sync.h, so callers that use the capture_sync.c stuff but not the capture.c stuff - such as TShark - get the declarations and get their implementations compared with the signatures that they should have. Doing so points out that some of them in TShark *don't*, so fix that. svn path=/trunk/; revision=49517
2013-05-22Another Win32-only fix.Guy Harris1-1/+1
svn path=/trunk/; revision=49501
2013-05-22Pull the capture-session state information out of capture_opts and putGuy Harris1-19/+23
it into a separate capture_session structure. capture_opts should contain only user-specified option information (and stuff directly derived from it, such as the "capturing from a pipe" flag). svn path=/trunk/; revision=49493
2013-05-22Rename capture_opts_trim_iface() toGuy Harris1-3/+3
capture_opts_default_iface_if_necessary(), to reflect what it actually does. svn path=/trunk/; revision=49491
2013-04-25Send the output of the -D and -L options to the standard output ratherGuy Harris1-21/+0
than the standard error. In Wireshark on Windows, create a console before doing so and destroy it before exiting. Don't do that in TShark or dumpcap, as those are console-mode programs on Windows. This should fix bug 8609 and still allow "wireshark -D" and "wireshark -L" to work when the standard output isn't redirected. svn path=/trunk/; revision=49025
2013-04-05Coalesce "-G fields2" and "-G fields3" into "-G fields", as discussed on -dev.Chris Maynard1-10/+3
See: http://www.wireshark.org/lists/wireshark-dev/201304/msg00015.html svn path=/trunk/; revision=48753
2013-03-30Update -2, -R and -Y to behave consistently as per the concensus reached onEvan Huus1-92/+38
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8223 Mention the new -Y flag and associated changes in the release notes. svn path=/trunk/; revision=48654
2013-03-27From Hadriel Kaplan via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8223Evan Huus1-23/+126
Add a 2-pass display-filter flag to tshark so that reassembly and other forward- looking dissections can be used with filters. It's a bit of a hack, but this entire area of 2-pass analysis etc. is a giant pile of hacks to begin with and needs cleaning up. For now just having this feature is a big enough win. svn path=/trunk/; revision=48589
2013-03-20 From beroset:Bill Meier1-6/+6
remove C++ incompatibilities https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8416 attachment #10397 svn path=/trunk/; revision=48438
generated by cgit v1.2.1 (git 2.18.0) at 2024-07-07 04:39:19 +0000