Fully Qualified Message ID representing a Request-Response Pair Descriptor (RRPD), used to correlate request and response frames across a conversation. More...

#include <packet-transum.h>

Public Attributes
bool	c2s

uint8_t	ip_proto

uint32_t	stream_no

uint64_t	session_id

uint64_t	msg_id

bool	decode_based

bool	is_retrans

uint32_t	req_first_frame

nstime_t	req_first_rtime

uint32_t	req_last_frame

nstime_t	req_last_rtime

uint32_t	rsp_first_frame

nstime_t	rsp_first_rtime

uint32_t	rsp_last_frame

nstime_t	rsp_last_rtime

unsigned	calculation

uint32_t	req_search_total

uint32_t	rsp_search_total

Detailed Description

Fully Qualified Message ID representing a Request-Response Pair Descriptor (RRPD), used to correlate request and response frames across a conversation.

Member Data Documentation

◆ c2s

bool _RRPD::c2s

True if the associated packet is client-to-service; false if service-to-client. Only valid when this RRPD is embedded in a subpacket structure.

◆ calculation

unsigned _RRPD::calculation

Identifier of the RR calculation method (e.g. GTCP, GUDP, DCERPC) used to detect this pair.

◆ decode_based

bool _RRPD::decode_based

True if APDU boundaries are determined by application-protocol decoding (e.g. DCERPC); false if determined by a stream direction change.

◆ ip_proto

uint8_t _RRPD::ip_proto

IP protocol number (e.g. IPPROTO_TCP, IPPROTO_UDP) for this request-response pair.

◆ is_retrans

bool _RRPD::is_retrans

True if this RRPD was identified as a retransmission and should be excluded from response-time calculations.

◆ msg_id

uint64_t _RRPD::msg_id

Application-layer message identifier uniquely distinguishing this request-response pair within the session.

◆ req_first_frame

uint32_t _RRPD::req_first_frame

Wireshark frame number of the first frame of the request APDU.

◆ req_first_rtime

nstime_t _RRPD::req_first_rtime

Capture-relative timestamp of the first frame of the request APDU.

◆ req_last_frame

uint32_t _RRPD::req_last_frame

Wireshark frame number of the last frame of the request APDU.

◆ req_last_rtime

nstime_t _RRPD::req_last_rtime

Capture-relative timestamp of the last frame of the request APDU.

◆ req_search_total

uint32_t _RRPD::req_search_total

Cumulative number of steps taken backwards through the rrpd_list when matching requests to this entry; used for performance tuning.

◆ rsp_first_frame

uint32_t _RRPD::rsp_first_frame

Wireshark frame number of the first frame of the response APDU.

◆ rsp_first_rtime

nstime_t _RRPD::rsp_first_rtime

Capture-relative timestamp of the first frame of the response APDU.

◆ rsp_last_frame

uint32_t _RRPD::rsp_last_frame

Wireshark frame number of the last frame of the response APDU.

◆ rsp_last_rtime

nstime_t _RRPD::rsp_last_rtime

Capture-relative timestamp of the last frame of the response APDU.

◆ rsp_search_total

uint32_t _RRPD::rsp_search_total

Cumulative number of steps taken backwards through the rrpd_list when matching responses to this entry; used for performance tuning.

◆ session_id

uint64_t _RRPD::session_id

Application-layer session identifier, used by protocols that multiplex sessions over a single stream.

◆ stream_no

uint32_t _RRPD::stream_no

Wireshark transport stream index identifying the TCP or UDP stream carrying this pair.

The documentation for this struct was generated from the following file:

/builds/wireshark/wireshark/plugins/epan/transum/packet-transum.h

Public Attributes