ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Enhancement to Flow graph in Wireshark

From: didier <dgautheron@xxxxxxxx>
Date: Tue, 09 Jun 2009 17:29:42 +0200
Hi,
Le mardi 09 juin 2009 à 11:55 +0530, BANDARU, Govindarao (Govindarao) a
écrit :
> Hi All,
> 
>    I have a request for you. I need your help/suggestions for the
> following issue on flow graph in Wireshark. 
> 
>   We have a feature called ‘flow graph’ in wireshark as you know. It
> shows messages in a call flow among each entity with an IP address. We
> can name each IP address with an entity name through hosts file. This
> is fine, where each entity(NE,network element) has single IP address
> for each interface. 
> 
>   But the issue is with when each NE(Network Element) has different IP
> addresses for the interface. For example, one NE (XX) will have
> different IP addresses for different interfaces. So in the Wireshark,
> in the hosts file, even if we define same host name (NE, XX) to
> different IP address  it will not plot a flow showing one
> entity(NE,XX). It will generate a flow showing  different entity (XX).
> Can you please suggest me how to implement this enhancement where we 
You have to modify at least:
gtk/flow_graph.c
gtk/graph_analysis.c
gtk/graph_analysis.h

and maybe files including graph_analysis.h if you changed structures
definition.

You need a new node type, ie hostname and modify the logic each time
you're seeing CMP_ADDRESS, COPY_ADDRESS.
You can get an IP hostname with Wireshark function get_addr_name()

> can see correct flow graph for this? How much time it will take to
> implement this in Wireshark? 
With testing? At most half a day.

>   One more thing is,  can we save flow in a readable format (could be
> in pdf format)?
There's a text output, no idea if it's readable though :)

Didier

>