Wireshark - 0.99.7 Guide de l'utilisateur télécharger pdf (Page 126)

{

fragment_table_init(&msg_fragment_table);

reassembled_table_init(&msg_reassembled_table);

}

First a couple of hash tables are declared, and these are initialised in the protocol initialisation

routine. Following that, a fragment_items structure is allocated and filled in with a series of ett

items, hf data items, and a string tag. The ett and hf values should be included in the relevant tables

like all the other variables your protocol may use. The hf variables need to be placed in the structure

something like the following. Of course the names may need to be adjusted.

Example 9.18. Reassembling fragments - Data

...

static int hf_msg_fragments = -1;

static int hf_msg_fragment = -1;

static int hf_msg_fragment_overlap = -1;

static int hf_msg_fragment_overlap_conflicts = -1;

static int hf_msg_fragment_multiple_tails = -1;

static int hf_msg_fragment_too_long_fragment = -1;

static int hf_msg_fragment_error = -1;

static int hf_msg_reassembled_in = -1;

...

static gint ett_msg_fragment = -1;

static gint ett_msg_fragments = -1;

...

static const fragment_items msg_frag_items = {

/* Fragment subtrees */

&ett_msg_fragment,

&ett_msg_fragments,

/* Fragment fields */

&hf_msg_fragments,

&hf_msg_fragment,

&hf_msg_fragment_overlap,

&hf_msg_fragment_overlap_conflicts,

&hf_msg_fragment_multiple_tails,

&hf_msg_fragment_too_long_fragment,

&hf_msg_fragment_error,

/* Reassembled in field */

&hf_msg_reassembled_in,

/* Tag */

"Message fragments"

};

...

static hf_register_info hf[] =

{

...

{&hf_msg_fragments,

{"Message fragments", "msg.fragments",

FT_NONE, BASE_NONE, NULL, 0x00, NULL, HFILL } },

{&hf_msg_fragment,

{"Message fragment", "msg.fragment",

FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL } },

{&hf_msg_fragment_overlap,

{"Message fragment overlap", "msg.fragment.overlap",

FT_BOOLEAN, BASE_NONE, NULL, 0x00, NULL, HFILL } },

{&hf_msg_fragment_overlap_conflicts,

{"Message fragment overlapping with conflicting data",

"msg.fragment.overlap.conflicts",

FT_BOOLEAN, BASE_NONE, NULL, 0x00, NULL, HFILL } },

{&hf_msg_fragment_multiple_tails,

{"Message has multiple tail fragments",

"msg.fragment.multiple_tails",

FT_BOOLEAN, BASE_NONE, NULL, 0x00, NULL, HFILL } },

{&hf_msg_fragment_too_long_fragment,

{"Message fragment too long", "msg.fragment.too_long_fragment",

FT_BOOLEAN, BASE_NONE, NULL, 0x00, NULL, HFILL } },

{&hf_msg_fragment_error,

{"Message defragmentation error", "msg.fragment.error",

FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL } },

{&hf_msg_reassembled_in,

{"Reassembled in", "msg.reassembled.in",

FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL } },

...

static gint *ett[] =

{

...

Packet dissection

112

1 2 ... 121 122 123 124 125 126 127 128 129 130 131 ... 146 147

Commentaires sur ces manuels

Pas de commentaire

Wireshark - 0.99.7 Guide de l'utilisateur Page 126

Commentaires sur ces manuels