1berry/wireshark
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

stats_tree: Update documentation

Browse Source 
Clarify how the stats_tree flags are used. Some are for the entire
tree, some can be set on nodes, and some are internal use only. All
of them have to not overlap with the generic tapping system flags for
some reason.

Update the README for some recent changes adding tap flags to the
per packet routine and changing the directory separator to being a
double forward slash.

ST_FLG_SORT_DESC had backwards comment text, but has always indicated
that descending order was to be used (at least in the tshark CLI
tap, and in various functions, and in how the preference was interprted,
even if the Qt GUI didn't respect it previously.)

Also, packet-ltp was using the sort ordering incorrectly, and probably
didn't intend for counts to be ascending, so remove it. (It wasn't
doing anything other than actually requesting the tap columns, which
it didn't need, and the default order of descending count was used.)

Fix #20038
This commit is contained in:
John Thacker 2025-02-24 20:25:28 -05:00
parent 1616983542
commit 46eb9a2c92
3 changed files with 50 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
doc/README.stats_tree
View File

@ -71,7 +71,8 @@ extern tap_packet_status
udp_term_stats_tree_packet(stats_tree *st, /* st as it was passed to us */
packet_info *pinfo, /* we'll fetch the addresses from here */
epan_dissect_t *edt _U_, /* unused */
const void *p) /* we'll use this to fetch the ports */
const void *p, /* we'll use this to fetch the ports */
tap_flags_t flags _U_) /* unused */
{
static uint8_t str[128];
e_udphdr* udphdr = (e_udphdr*) p;
@ -97,7 +98,7 @@ WS_DLL_PUBLIC_DEF void plugin_register_tap_listener(void) {
stats_tree_register_plugin("udp", /* the proto we are going to "tap" */
"udp_terms", /* the abbreviation for this tree (to be used as -z udp_terms,tree) */
st_str_udp_term, /* the name of the menu and window (use "/" for sub menus)*/
st_str_udp_term, /* the name of the menu and window (use "//" for sub menus)*/
0, /* tap listener flags for per-packet callback */
udp_term_stats_tree_packet, /* the per packet callback */
udp_term_stats_tree_init, /* the init callback */
@ -122,8 +123,37 @@ stats_tree_set_group(st_config, stat_group);
changes the menu statistics group for a stats tree
stats_tree_parent_id_by_name( st, parent_name)
returns the id of a candidate parent node given its name
returns the id of a candidate parent node given its name
flags
is a bitmask set of flags for the tap listener. Generic tap system flags
(TL_*) described in README.tapping can be used, along with stat tree specific
flags that control the default sorting, six for choosing the column and one
for the order:
ST_SORT_COL_NAME
Sort nodes by node names
ST_SORT_COL_COUNT
Sort nodes by node count
ST_SORT_COL_AVG
Sort nodes by node average
ST_SORT_COL_MIN
Sort nodes by minimum node value
ST_SORT_COL_MAX
Sort nodes by maximum node value
ST_SORT_COL_BURSTRATE
Sort nodes by burst rate
ST_FLG_SORT_DESC
Sort nodes in descending order using the chosen column
The default if only a column is given is to use ascending
order
The sort column flags need to be left shifted by ST_FLG_SRTCOL_SHIFT when
registering. If no sort columns flags are given, values from the preferences
(found in the "Statistics" module) are used for both column and order. The
default preferences are to sort in descending order of node count, i.e.,
(ST_SORT_COL_COUNT << ST_FLG_SRTCOL_SHIFT) | ST_FLG_SORT_DESC
Node functions
==============
@ -214,7 +244,9 @@ stat_node_clear_flags functions. Currently these flags are defined:
ST_FLG_DEF_NOEXPAND: By default the top-level nodes in a tree are
automatically expanded in the GUI. Setting this flag on
such a node prevents the node from automatically
expanding.
expanding. (However, if there are fewer than some fixed
total number of nodes, currently 100, in the tree, then
all the nodes will be expanded anyway.)
ST_FLG_SORT_TOP: Nodes with this flag is sorted separately from nodes
without this flag (in effect partitioning tree into a top
and bottom half. Each half is sorted normally. Top always

2
epan/dissectors/packet-ltp.c
View File

@ -2074,7 +2074,7 @@ proto_reg_handoff_ltp(void)
dissector_add_uint_with_preference("dccp.port", LTP_PORT, ltp_handle);
heur_dissector_add("udp", dissect_ltp_heur_udp, "LTP over UDP", "ltp_udp", proto_ltp, HEURISTIC_DISABLE);
stats_tree_register("ltp", "ltp", "LTP", ST_SORT_COL_COUNT, ltp_stats_tree_packet, ltp_stats_tree_init, NULL);
stats_tree_register("ltp", "ltp", "LTP", 0, ltp_stats_tree_packet, ltp_stats_tree_init, NULL);
}
/*

14
epan/stats_tree.h
View File

@ -24,11 +24,23 @@ extern "C" {
#define STAT_TREE_ROOT "root"
#define STATS_TREE_MENU_SEPARATOR "//"
/* stats_tree specific flags. When registering, these are used together
* with the TL_ flags defined in tap.h, so make sure they don't overlap!
* (Yes, that applies even to the flags that apply to nodes instead of
* the entire tree, and should not be passed in stats_tree_register.
* XXX - Why? These flags should be reworked at some point.)
*/
/* Flags on child nodes for internal use only */
#define ST_FLG_AVERAGE 0x10000000 /* Calculate averages for nodes, rather than totals */
#define ST_FLG_ROOTCHILD 0x20000000 /* This node is a direct child of the root node */
/* Flags set on child nodes via stat_node_set_flags */
#define ST_FLG_DEF_NOEXPAND 0x01000000 /* This node should not be expanded by default */
#define ST_FLG_SORT_DESC 0x00800000 /* When sorting, sort ascending instead of descending */
#define ST_FLG_SORT_TOP 0x00400000 /* When sorting always keep these lines on of list */
/* Flags for the entire stat_tree, set via stats_tree_register[_plugin] */
#define ST_FLG_SORT_DESC 0x00800000 /* When sorting, sort descending instead of ascending */
#define ST_FLG_SRTCOL_MASK 0x000F0000 /* Mask for sort column ID */
#define ST_FLG_SRTCOL_SHIFT 16 /* Number of bits to shift masked result */