packet_provider_funcs Struct Reference

Structure containing pointers to functions supplied by the user of libwireshark. More...

#include <epan.h>

Public Attributes
const nstime_t *(*	get_frame_ts )(struct packet_provider_data *prov, uint32_t frame_num)
	Get the timestamp of a specific frame.
const nstime_t *(*	get_start_ts )(struct packet_provider_data *prov)
	Get the start timestamp of the capture session.
const nstime_t *(*	get_end_ts )(struct packet_provider_data *prov)
	Get the end timestamp of the capture session.
const char *(*	get_interface_name )(struct packet_provider_data *prov, uint32_t interface_id, unsigned section_number)
	Get the name of a capture interface.
const char *(*	get_interface_description )(struct packet_provider_data *prov, uint32_t interface_id, unsigned section_number)
	Get the description of a capture interface.
wtap_block_t(*	get_modified_block )(struct packet_provider_data *prov, const frame_data *fd)
	Get a modified WTAP block for a given frame.
int32_t(*	get_process_id )(struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number)
	Get the process ID associated with a packet.
const char *(*	get_process_name )(struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number)
	Get the name of the process associated with a packet.
const uint8_t *(*	get_process_uuid )(struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number, size_t *uuid_size)
	Get the UUID of the process associated with a packet.
const char *(*	get_process_path )(struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number)
	Get the path of the executable image of a process.
const uint8_t *(*	get_process_cmdline )(struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number, size_t *cmdline_size)
	Get the command line of a process.
bool(*	get_process_parent_id )(struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number, uint32_t *parent_process_id)
	Get the ID of the parent of a process.
bool(*	get_process_user_id )(struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number, uint32_t *user_id)
	Get the numeric ID of the user a process runs as.
const char *(*	get_process_user_name )(struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number)
	Get the name of the user a process runs as.
bool(*	get_process_start_time )(struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number, nstime_t *start_time)
	Get the start time of a process.
bool(*	find_process_info )(struct packet_provider_data *prov, uint32_t process_id, unsigned section_number, const nstime_t *ts, int64_t file_off, uint32_t *process_info_id)
	Find the process information for a process ID.

Detailed Description

Structure containing pointers to functions supplied by the user of libwireshark.

Each function pointer corresponds to a callback that provides specific information about packets, interfaces, or processes during packet processing.

Member Data Documentation

find_process_info

bool(* packet_provider_funcs::find_process_info) (struct packet_provider_data *prov, uint32_t process_id, unsigned section_number, const nstime_t *ts, int64_t file_off, uint32_t *process_info_id)

Find the process information for a process ID.

Parameters

prov	Packet provider context.
process_id	Process ID, as in the pcapng epb_processid_threadid option.
section_number	Capture section number.
ts	Time stamp of the packet, to tell apart processes that reused the ID, or NULL.
file_off	File offset of the packet, to prefer the blocks that precede it, or -1.
process_info_id	Output parameter for the process info identifier.

Returns

true if found, false otherwise.

get_end_ts

const nstime_t *(* packet_provider_funcs::get_end_ts) (struct packet_provider_data *prov)

Get the end timestamp of the capture session.

Parameters

prov	Packet provider context.

Returns

Pointer to the end timestamp, or NULL if unavailable.

get_frame_ts

const nstime_t *(* packet_provider_funcs::get_frame_ts) (struct packet_provider_data *prov, uint32_t frame_num)

Get the timestamp of a specific frame.

Parameters

prov	Packet provider context.
frame_num	Frame number to query.

Returns

Pointer to the timestamp, or NULL if unavailable.

get_interface_description

const char *(* packet_provider_funcs::get_interface_description) (struct packet_provider_data *prov, uint32_t interface_id, unsigned section_number)

Get the description of a capture interface.

Parameters

prov	Packet provider context.
interface_id	Interface identifier.
section_number	Capture section number.

Returns

Interface description string, or NULL if unavailable.

get_interface_name

const char *(* packet_provider_funcs::get_interface_name) (struct packet_provider_data *prov, uint32_t interface_id, unsigned section_number)

Get the name of a capture interface.

Parameters

prov	Packet provider context.
interface_id	Interface identifier.
section_number	Capture section number.

Returns

Interface name string, or NULL if unavailable.

get_modified_block

wtap_block_t(* packet_provider_funcs::get_modified_block) (struct packet_provider_data *prov, const frame_data *fd)

Get a modified WTAP block for a given frame.

Parameters

prov	Packet provider context.
fd	Frame metadata.

Returns

Modified WTAP block, or NULL if unchanged.

get_process_cmdline

const uint8_t *(* packet_provider_funcs::get_process_cmdline) (struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number, size_t *cmdline_size)

Get the command line of a process.

Parameters

prov	Packet provider context.
process_info_id	Process info identifier.
section_number	Capture section number.
cmdline_size	Output parameter for the size of the command line.

Returns

Pointer to the command line, its arguments separated by NULs, or NULL if unavailable.

get_process_id

int32_t(* packet_provider_funcs::get_process_id) (struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number)

Get the process ID associated with a packet.

Parameters

prov	Packet provider context.
process_info_id	Process info identifier.
section_number	Capture section number.

Returns

Process ID, or -1 if unavailable.

get_process_name

const char *(* packet_provider_funcs::get_process_name) (struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number)

Get the name of the process associated with a packet.

Parameters

prov	Packet provider context.
process_info_id	Process info identifier.
section_number	Capture section number.

Returns

Process name string, or NULL if unavailable.

get_process_parent_id

bool(* packet_provider_funcs::get_process_parent_id) (struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number, uint32_t *parent_process_id)

Get the ID of the parent of a process.

Parameters

prov	Packet provider context.
process_info_id	Process info identifier.
section_number	Capture section number.
parent_process_id	Output parameter for the parent process ID.

Returns

true if available, false otherwise.

get_process_path

const char *(* packet_provider_funcs::get_process_path) (struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number)

Get the path of the executable image of a process.

Parameters

prov	Packet provider context.
process_info_id	Process info identifier.
section_number	Capture section number.

Returns

Path string, or NULL if unavailable.

get_process_start_time

bool(* packet_provider_funcs::get_process_start_time) (struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number, nstime_t *start_time)

Get the start time of a process.

Parameters

prov	Packet provider context.
process_info_id	Process info identifier.
section_number	Capture section number.
start_time	Output parameter for the start time.

Returns

true if available, false otherwise.

get_process_user_id

bool(* packet_provider_funcs::get_process_user_id) (struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number, uint32_t *user_id)

Get the numeric ID of the user a process runs as.

Parameters

prov	Packet provider context.
process_info_id	Process info identifier.
section_number	Capture section number.
user_id	Output parameter for the user ID.

Returns

true if available, false otherwise.

get_process_user_name

const char *(* packet_provider_funcs::get_process_user_name) (struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number)

Get the name of the user a process runs as.

Parameters

prov	Packet provider context.
process_info_id	Process info identifier.
section_number	Capture section number.

Returns

User name string, or NULL if unavailable.

get_process_uuid

const uint8_t *(* packet_provider_funcs::get_process_uuid) (struct packet_provider_data *prov, uint32_t process_info_id, unsigned section_number, size_t *uuid_size)

Get the UUID of the process associated with a packet.

Parameters

prov	Packet provider context.
process_info_id	Process info identifier.
section_number	Capture section number.
uuid_size	Output parameter for the size of the UUID.

Returns

Pointer to the UUID byte array, or NULL if unavailable.

get_start_ts

const nstime_t *(* packet_provider_funcs::get_start_ts) (struct packet_provider_data *prov)

Get the start timestamp of the capture session.

Parameters

prov	Packet provider context.

Returns

Pointer to the start timestamp, or NULL if unavailable.

---

The documentation for this struct was generated from the following file:

• /builds/wireshark/wireshark/epan/epan.h