capture_process_info.h File Reference

#include <wireshark.h>
#include <wsutil/process_lookup.h>

Go to the source code of this file.

Typedefs
typedef struct capture_process_info	capture_process_info_t
typedef GList *(*	capture_process_info_iface_list_func) (int *err, char **err_str)

Functions
capture_process_info_t *	capture_process_info_new (capture_process_info_iface_list_func get_iface_list, ws_process_detail_t detail, char **err_msg)
	Set up to attribute packets to processes.
void	capture_process_info_free (capture_process_info_t *cpi)
bool	capture_process_info_linktype_supported (int linktype)
	Whether packets with a link-layer header type can be attributed.
unsigned	capture_process_info_lookup (capture_process_info_t *cpi, int linktype, const uint8_t *data, size_t len, GPtrArray *processes)
	Find the processes that sent or received a packet.
void	capture_process_info_new_file (capture_process_info_t *cpi)
	Forget which processes the output file already describes.
bool	capture_process_info_needs_description (capture_process_info_t *cpi, const ws_process_info_t *process)
	Whether a process still has to be described in the output file.

Detailed Description

Attribute captured packets to the processes on this host that sent or received them, by looking their sockets up while capturing.

Wireshark - Network traffic analyzer By Gerald Combs geral.nosp@m.d@wi.nosp@m.resha.nosp@m.rk.o.nosp@m.rg Copyright 1998 Gerald Combs

SPDX-License-Identifier: GPL-2.0-or-later

Typedef Documentation

capture_process_info_iface_list_func

typedef GList *(* capture_process_info_iface_list_func) (int *err, char **err_str)

A function that lists the capture interfaces, with their addresses, as capture_options.get_iface_list does.

Function Documentation

capture_process_info_linktype_supported()

bool capture_process_info_linktype_supported ( int linktype )

extern

Whether packets with a link-layer header type can be attributed.

Parameters

linktype

The LINKTYPE_ value of the interface.

capture_process_info_lookup()

unsigned capture_process_info_lookup ( capture_process_info_t * cpi, int linktype, const uint8_t * data, size_t len, GPtrArray * processes )

extern

Find the processes that sent or received a packet.

They are the processes that have a socket matching the end of the packet that is on this host: one of its addresses or, for the destination, a broadcast or multicast address. Both ends of a loopback packet are.

Parameters

cpi	The context.
linktype	The LINKTYPE_ value of the packet.
data	The packet data.
len	The number of bytes captured.
processes	What is known about each process is appended, as const ws_process_info_t pointers valid until the context is freed.

Returns

The number of processes appended.

capture_process_info_needs_description()

bool capture_process_info_needs_description ( capture_process_info_t * cpi, const ws_process_info_t * process )

extern

Whether a process still has to be described in the output file.

Returns

true the first time it is called for a process since the file was started; the process then counts as described.

capture_process_info_new()

capture_process_info_t * capture_process_info_new ( capture_process_info_iface_list_func get_iface_list, ws_process_detail_t detail, char ** err_msg )

extern

Set up to attribute packets to processes.

Parameters

get_iface_list	Lists this host's interfaces; their addresses say which end of a packet is on this host.
detail	How much to find out about the processes.
err_msg	Set to a g_malloc()ed message if this fails.

Returns

The context, or NULL if process information is not available.

capture_process_info_new_file()

void capture_process_info_new_file ( capture_process_info_t * cpi )

extern

Forget which processes the output file already describes.

Call when starting a new output file.