| Wireshark 4.7.0 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
Classes | Macros | Typedefs | Functions | Variables
expert.h File Reference
`#include <epan/proto.h>`
`#include <epan/packet_info.h>`
`#include <wsutil/value_string.h>`
`#include "ws_symbol_export.h"`

Go to the source code of this file.

## Classes
struct | expert_info_s
struct | expert_field
struct | expert_field_info
struct | ei_register_info

## Macros
#define | EI_INIT_EI 0
#define | EI_INIT_HF 0
#define | EI_INIT {EI_INIT_EI, EI_INIT_HF}
#define | EXPFILL
#define | PRE_ALLOC_EXPERT_FIELDS_MEM 5000
#define | EXPERT_CHECKSUM_DISABLED -2
#define | EXPERT_CHECKSUM_UNKNOWN -1
#define | EXPERT_CHECKSUM_GOOD 0
#define | EXPERT_CHECKSUM_BAD 1

## Typedefs
typedef struct expert_info_s | expert_info_t
typedef struct expert_field | expert_field
typedef struct expert_field_info | expert_field_info
typedef struct ei_register_info | ei_register_info
typedef struct expert_module | expert_module_t

## Functions
void | expert_init (void)
void | expert_packet_init (void)
void | expert_cleanup (void)
void | expert_packet_cleanup (void)
WS_DLL_PUBLIC int | expert_get_highest_severity (void)
WS_DLL_PUBLIC void | expert_update_comment_count (uint64_t count)
WS_DLL_PUBLIC proto_item * | expert_add_info (packet_info *pinfo, proto_item *pi, expert_field *eiindex)
WS_DLL_PUBLIC proto_item * | expert_add_info_format (packet_info *pinfo, proto_item *pi, expert_field *eiindex, const char *format,...)
WS_DLL_PUBLIC proto_item * | proto_tree_add_expert (proto_tree *tree, packet_info *pinfo, expert_field *eiindex, tvbuff_t *tvb, unsigned start, unsigned length)
WS_DLL_PUBLIC proto_item * | proto_tree_add_expert_remaining (proto_tree *tree, packet_info *pinfo, expert_field *eiindex, tvbuff_t *tvb, unsigned start)
WS_DLL_PUBLIC proto_item * | proto_tree_add_expert_format (proto_tree *tree, packet_info *pinfo, expert_field *eiindex, tvbuff_t *tvb, unsigned start, unsigned length, const char *format,...)
WS_DLL_PUBLIC proto_item * | proto_tree_add_expert_format_remaining (proto_tree *tree, packet_info *pinfo, expert_field *eiindex, tvbuff_t *tvb, unsigned start, const char *format,...)
WS_DLL_PUBLIC expert_module_t * | expert_register_protocol (int id)
void | expert_deregister_expertinfo (const char *abbrev)
void | expert_deregister_protocol (expert_module_t *module)
void | expert_free_deregistered_expertinfos (void)
WS_DLL_PUBLIC const char * | expert_get_summary (expert_field *eiindex)
WS_DLL_PUBLIC void | expert_register_field_array (expert_module_t *module, ei_register_info *ei, const int num_records)

## Variables
WS_DLL_PUBLIC int | proto_expert
WS_DLL_PUBLIC const value_string | expert_group_vals []
WS_DLL_PUBLIC const value_string | expert_severity_vals []
WS_DLL_PUBLIC const value_string | expert_checksum_vals []

## Detailed Description

Collecting of Expert information.

For further info, see WSDG: 9.3. How to add an expert item: https://www.wireshark.org/docs/wsdg_html/#ChDissectExpertInfo

Wireshark - Network traffic analyzer By Gerald Combs geral.nosp@m.d@wi.nosp@m.resha.nosp@m.rk.o.nosp@m.rg Copyright 1998 Gerald Combs

SPDX-License-Identifier: GPL-2.0-or-later

## Macro Definition Documentation

## ◆ EXPFILL

#define EXPFILL

Value:
0, NULL, 0, NULL, \
{0, {NULL, NULL, FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL}}
HFILL
#define HFILL
Definition proto.h:791
BASE_NONE
@ BASE_NONE
Definition proto.h:682

## Typedef Documentation

## ◆ expert_info_t

typedef struct expert_info_s expert_info_t

only for internal and display use.

## Function Documentation

## ◆ expert_add_info()

WS_DLL_PUBLIC proto_item * expert_add_info | ( | packet_info * | pinfo,
|  | proto_item * | pi,
|  | expert_field * | eiindex
| ) |  |

Add an expert info. Add an expert info tree to a protocol item using registered expert info item

Parameters

  pinfo | Packet info of the currently processed packet. May be NULL if pi is supplied
  pi | Current protocol item (or NULL)
  eiindex | The registered expert info item

Returns
  the newly created expert info tree

## ◆ expert_add_info_format()

WS_DLL_PUBLIC proto_item * expert_add_info_format | ( | packet_info * | pinfo,
|  | proto_item * | pi,
|  | expert_field * | eiindex,
|  | const char * | format,
|  |  | ...
| ) |  |

Add an expert info. Add an expert info tree to a protocol item using registered expert info item, but with a formatted message.

Parameters

  pinfo | Packet info of the currently processed packet. May be NULL if pi is supplied
  pi | Current protocol item (or NULL)
  eiindex | The registered expert info item
  format | Printf-style format string for additional arguments

Returns
  the newly created expert info tree

## ◆ expert_deregister_expertinfo()

void expert_deregister_expertinfo | ( | const char * | abbrev | ) |

Deregister a expert info.

## ◆ expert_deregister_protocol()

void expert_deregister_protocol | ( | expert_module_t * | module | ) |

Deregister expert info from a protocol.

## ◆ expert_free_deregistered_expertinfos()

void expert_free_deregistered_expertinfos | ( | void |  | ) |

Free deregistered expert infos.

## ◆ expert_get_summary()

WS_DLL_PUBLIC const char * expert_get_summary | ( | expert_field * | eiindex | ) |

Get summary text of an expert_info field. This is intended for use in expert_add_info_format or proto_tree_add_expert_format to get the "base" string to then append additional information

## ◆ expert_register_field_array()

WS_DLL_PUBLIC void expert_register_field_array | ( | expert_module_t * | module,
|  | ei_register_info * | ei,
|  | const int | num_records
| ) |  |

Register a expert field array.

Parameters

  module | the protocol handle from expert_register_protocol()
  ei | the ei_register_info array
  num_records | the number of records in exp

## ◆ proto_tree_add_expert()

WS_DLL_PUBLIC proto_item * proto_tree_add_expert | ( | proto_tree * | tree,
|  | packet_info * | pinfo,
|  | expert_field * | eiindex,
|  | tvbuff_t * | tvb,
|  | unsigned | start,
|  | unsigned | length
| ) |  |

Add an expert info associated with some byte data Add an expert info tree to a protocol item using registered expert info item. This function is intended to replace places where a "text only" proto_tree_add_xxx API + expert_add_info would be used.

Parameters

  tree | Current protocol tree (or NULL)
  pinfo | Packet info of the currently processed packet. May be NULL if tree is supplied
  eiindex | The registered expert info item
  tvb | the tv buffer of the current data
  start | start of data in tvb
  length | length of data in tvb

Returns
  the newly created item above expert info tree

## ◆ proto_tree_add_expert_format()

WS_DLL_PUBLIC proto_item * proto_tree_add_expert_format | ( | proto_tree * | tree,
|  | packet_info * | pinfo,
|  | expert_field * | eiindex,
|  | tvbuff_t * | tvb,
|  | unsigned | start,
|  | unsigned | length,
|  | const char * | format,
|  |  | ...
| ) |  |

Add an expert info associated with some byte data Add an expert info tree to a protocol item, using registered expert info item, but with a formatted message. Add an expert info tree to a protocol item using registered expert info item. This function is intended to replace places where a "text only" proto_tree_add_xxx API + expert_add_info_format would be used.

Parameters

  tree | Current protocol tree (or NULL)
  pinfo | Packet info of the currently processed packet. May be NULL if tree is supplied
  eiindex | The registered expert info item
  tvb | the tv buffer of the current data
  start | start of data in tvb
  format | Printf-style format string for additional arguments

Returns
  the newly created item above expert info tree

## ◆ proto_tree_add_expert_format_remaining()

WS_DLL_PUBLIC proto_item * proto_tree_add_expert_format_remaining | ( | proto_tree * | tree,
|  | packet_info * | pinfo,
|  | expert_field * | eiindex,
|  | tvbuff_t * | tvb,
|  | unsigned | start,
|  | const char * | format,
|  |  | ...
| ) |  |

Same as proto_tree_add_expert_format but without the length parameter, length will be sret to end of the tvb. Add an expert info associated with some byte data Add an expert info tree to a protocol item, using registered expert info item, but with a formatted message. Add an expert info tree to a protocol item using registered expert info item. This function is intended to replace places where a "text only" proto_tree_add_xxx API + expert_add_info_format would be used.

Parameters

  tree | Current protocol tree (or NULL)
  pinfo | Packet info of the currently processed packet. May be NULL if tree is supplied
  eiindex | The registered expert info item
  tvb | the tv buffer of the current data
  start | start of data in tvb
  format | Printf-style format string for additional arguments

Returns
  the newly created item above expert info tree

## ◆ proto_tree_add_expert_remaining()

WS_DLL_PUBLIC proto_item * proto_tree_add_expert_remaining | ( | proto_tree * | tree,
|  | packet_info * | pinfo,
|  | expert_field * | eiindex,
|  | tvbuff_t * | tvb,
|  | unsigned | start
| ) |  |

Add an expert info associated with some byte data Add an expert info tree to a protocol item using registered expert info item. This function is intended to replace places where a "text only" proto_tree_add_xxx API + expert_add_info would be used. Length will be to the end of the tvb.

Parameters

  tree | Current protocol tree (or NULL)
  pinfo | Packet info of the currently processed packet. May be NULL if tree is supplied
  eiindex | The registered expert info item
  tvb | the tv buffer of the current data
  start | start of data in tvb

Returns
  the newly created item above expert info tree