1berry/wireshark
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

epan: various time-related cleanups and impreovements.

Browse Source 
Have routines to calculate, for a frame:

* the time relative to the first frame in the capture;

* the time relative to the previous reference frame or, if there is
  none, the first frame in the capture;

* the time relative to the previous captured frame;

* the time relative to the previous displayed frame.

That centralizes the determination of which frame that is, so that if we
want to change the rule for determining that (e.g., if we decide to
change to "relative to the previous XXX frame *that has a time stamp*),
we only need to change it in one place.

When computing relative times, make sure both the current frame and the
frame from which a relative time is being computed exist, and, if not,
indicate that the relative time is missing (even if we set its value to
zero).

Don't display relative times (whether relative to the first frame, the
most recent reference frame, the previous captured frame, or the
previous displayed frame) that don't, in fact, exists; omit the protocol
tree field, and show a blank in the time column.

Remove a ws_debug message in epan_get_frame_ts() if we can't get the
frame time stamp, as that may just mean it didn't *have* a time stamp.

When sorting columns by time, make non-existent times - which display as
blank - sort to the top.

Note, in comments, some issues found while doing this.

Update tests as appropriate for the first packet not having a "time
since previous packet" value.  This includes adding some packets to
nfs.pcap, from the same file whence they originally came (with times
shifted), with additional time shifting to make all tests doable.
This commit is contained in:
Guy Harris 2025-05-08 16:49:24 -07:00
parent e86a0b0a85
commit c1ce22e7c1
20 changed files with 304 additions and 142 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
epan/column-utils.c
View File

@ -1278,13 +1278,14 @@ col_set_rel_time(const frame_data *fd, column_info *cinfo, const int col)
{
nstime_t del_rel_ts;
if (!fd->has_ts) {
/*
* If there's no relative time for this frame, leave the column blank.
*/
if (!frame_rel_time(cinfo->epan, fd, &del_rel_ts)) {
cinfo->columns[col].col_buf[0] = '\0';
return;
}
frame_delta_abs_time(cinfo->epan, fd, fd->frame_ref_num, &del_rel_ts);
switch (timestamp_get_seconds_type()) {
case TS_SECONDS_DEFAULT:
set_time_seconds(fd, &del_rel_ts, cinfo->columns[col].col_buf);
@ -1307,13 +1308,15 @@ col_set_delta_time(const frame_data *fd, column_info *cinfo, const int col)
{
nstime_t del_cap_ts;
if (!fd->has_ts) {
/*
* If there's no time since the last captured frame, leave the
* column blank.
*/
if (!frame_delta_time_prev_captured(cinfo->epan, fd, &del_cap_ts)) {
cinfo->columns[col].col_buf[0] = '\0';
return;
}
frame_delta_abs_time(cinfo->epan, fd, fd->num - 1, &del_cap_ts);
switch (timestamp_get_seconds_type()) {
case TS_SECONDS_DEFAULT:
set_time_seconds(fd, &del_cap_ts, cinfo->columns[col].col_buf);
@ -1337,13 +1340,15 @@ col_set_delta_time_dis(const frame_data *fd, column_info *cinfo, const int col)
{
nstime_t del_dis_ts;
if (!fd->has_ts) {
/*
* If there's no time since the previous displayed frame, leave the
* column blank.
*/
if (!frame_delta_time_prev_displayed(cinfo->epan, fd, &del_dis_ts)) {
cinfo->columns[col].col_buf[0] = '\0';
return;
}
frame_delta_abs_time(cinfo->epan, fd, fd->prev_dis_num, &del_dis_ts);
switch (timestamp_get_seconds_type()) {
case TS_SECONDS_DEFAULT:
set_time_seconds(fd, &del_dis_ts, cinfo->columns[col].col_buf);
@ -1491,6 +1496,7 @@ col_set_epoch_time(const frame_data *fd, column_info *cinfo, const int col)
void
set_fd_time(const epan_t *epan, frame_data *fd, char *buf)
{
nstime_t del_ts;
switch (timestamp_get_type()) {
case TS_ABSOLUTE:
@ -1506,17 +1512,17 @@ set_fd_time(const epan_t *epan, frame_data *fd, char *buf)
break;
case TS_RELATIVE:
if (fd->has_ts) {
nstime_t del_rel_ts;
frame_delta_abs_time(epan, fd, fd->frame_ref_num, &del_rel_ts);
/*
* If there's no relative time for this frame, leave the
* column blank.
*/
if (frame_rel_time(epan, fd, &del_ts)) {
switch (timestamp_get_seconds_type()) {
case TS_SECONDS_DEFAULT:
set_time_seconds(fd, &del_rel_ts, buf);
set_time_seconds(fd, &del_ts, buf);
break;
case TS_SECONDS_HOUR_MIN_SEC:
set_time_seconds(fd, &del_rel_ts, buf);
set_time_seconds(fd, &del_ts, buf);
break;
default:
ws_assert_not_reached();
@ -1527,17 +1533,17 @@ set_fd_time(const epan_t *epan, frame_data *fd, char *buf)
break;
case TS_DELTA:
if (fd->has_ts) {
nstime_t del_cap_ts;
frame_delta_abs_time(epan, fd, fd->num - 1, &del_cap_ts);
/*
* If there's no time since the previous captured frame, leave the
* column blank.
*/
if (frame_delta_time_prev_captured(epan, fd, &del_ts)) {
switch (timestamp_get_seconds_type()) {
case TS_SECONDS_DEFAULT:
set_time_seconds(fd, &del_cap_ts, buf);
set_time_seconds(fd, &del_ts, buf);
break;
case TS_SECONDS_HOUR_MIN_SEC:
set_time_hour_min_sec(fd, &del_cap_ts, buf, col_decimal_point);
set_time_hour_min_sec(fd, &del_ts, buf, col_decimal_point);
break;
default:
ws_assert_not_reached();
@ -1548,17 +1554,17 @@ set_fd_time(const epan_t *epan, frame_data *fd, char *buf)
break;
case TS_DELTA_DIS:
if (fd->has_ts) {
nstime_t del_dis_ts;
frame_delta_abs_time(epan, fd, fd->prev_dis_num, &del_dis_ts);
/*
* If there is no time since the previous displayed frame, leave the
* column blank.
*/
if (frame_delta_time_prev_displayed(epan, fd, &del_ts)) {
switch (timestamp_get_seconds_type()) {
case TS_SECONDS_DEFAULT:
set_time_seconds(fd, &del_dis_ts, buf);
set_time_seconds(fd, &del_ts, buf);
break;
case TS_SECONDS_HOUR_MIN_SEC:
set_time_hour_min_sec(fd, &del_dis_ts, buf, col_decimal_point);
set_time_hour_min_sec(fd, &del_ts, buf, col_decimal_point);
break;
default:
ws_assert_not_reached();

35
epan/dissectors/packet-frame.c
View File

@ -1015,33 +1015,28 @@ dissect_frame(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void*
if (proto_field_is_referenced(tree, hf_frame_time_delta)) {
nstime_t del_cap_ts;
/* XXX: pinfo->num - 1 might not *have* a
* timestamp, even if this frame does. Would
* the user prefer to see "delta from previous
* captured frame that has a timestamp"?
*/
frame_delta_abs_time(pinfo->epan, pinfo->fd, pinfo->num - 1, &del_cap_ts);
item = proto_tree_add_time(fh_tree, hf_frame_time_delta, tvb,
0, 0, &(del_cap_ts));
proto_item_set_generated(item);
if (frame_delta_time_prev_captured(pinfo->epan, pinfo->fd, &del_cap_ts)) {
item = proto_tree_add_time(fh_tree, hf_frame_time_delta, tvb,
0, 0, &(del_cap_ts));
proto_item_set_generated(item);
}
}
if (proto_field_is_referenced(tree, hf_frame_time_delta_displayed)) {
nstime_t del_dis_ts;
frame_delta_abs_time(pinfo->epan, pinfo->fd, pinfo->fd->prev_dis_num, &del_dis_ts);
item = proto_tree_add_time(fh_tree, hf_frame_time_delta_displayed, tvb,
0, 0, &(del_dis_ts));
proto_item_set_generated(item);
if (frame_delta_time_prev_displayed(pinfo->epan, pinfo->fd, &del_dis_ts)) {
item = proto_tree_add_time(fh_tree, hf_frame_time_delta_displayed, tvb,
0, 0, &(del_dis_ts));
proto_item_set_generated(item);
}
}
frame_delta_abs_time(pinfo->epan, pinfo->fd, pinfo->fd->frame_ref_num, &rel_ts);
item = proto_tree_add_time(fh_tree, hf_frame_time_relative, tvb,
0, 0, &(rel_ts));
proto_item_set_generated(item);
if (frame_rel_time(pinfo->epan, pinfo->fd, &rel_ts)) {
item = proto_tree_add_time(fh_tree, hf_frame_time_relative, tvb,
0, 0, &(rel_ts));
proto_item_set_generated(item);
}
if (pinfo->fd->ref_time) {
ti = proto_tree_add_item(fh_tree, hf_frame_time_reference, tvb, 0, 0, ENC_NA);

9
epan/epan.c
View File

@ -534,11 +534,10 @@ epan_get_frame_ts(const epan_t *session, uint32_t frame_num)
if (session && session->funcs.get_frame_ts)
abs_ts = session->funcs.get_frame_ts(session->prov, frame_num);
if (!abs_ts) {
/* This can happen if frame_num doesn't have a ts */
ws_debug("!!! couldn't get frame ts for %u !!!\n", frame_num);
}
/* abs_ts will be null if we don't have a session, the session
doesn't have a function to return time stamps, or that
function returns null, e.g. because the frame doesn't
*have* a time stamp. */
return abs_ts;
}

148
epan/frame_data.c
View File

@ -44,52 +44,148 @@
#define COMPARE_TS(ts) COMPARE_TS_REAL(fdata1->ts, fdata2->ts)
void
static bool
frame_delta_abs_time(const struct epan_session *epan, const frame_data *fdata, uint32_t prev_num, nstime_t *delta)
{
const nstime_t *prev_abs_ts = (prev_num) ? epan_get_frame_ts(epan, prev_num) : NULL;
if (prev_abs_ts) {
nstime_delta(delta, &fdata->abs_ts, prev_abs_ts);
} else {
/* If we don't have the time stamp of the previous packet,
it's because we have no displayed/captured packets prior to this.
Set the delta time to zero. */
if (!fdata->has_ts) {
/* We don't have a time stamp for this packet. Set the delta time
to zero, and return false. */
nstime_set_zero(delta);
return false;
}
if (prev_num == 0) {
/* The previous frame doesn't exist. Set the delta time to zero,
and return false. */
nstime_set_zero(delta);
return false;
}
/* Ge the previous frame's time stamp, if it has one. */
prev_abs_ts = epan_get_frame_ts(epan, prev_num);
if (prev_abs_ts == NULL) {
/* The previous frame doesn't have a time stamp. Set the delta
time to zero, and return false. */
nstime_set_zero(delta);
return false;
}
/* This frame has a time stamp, the previous frame exists and has a
time stamp; compute the delta between this frame's time stamp and
the previous frame's time stamp, and return true. */
nstime_delta(delta, &fdata->abs_ts, prev_abs_ts);
return true;
}
static int
frame_data_time_delta_compare(const struct epan_session *epan, const frame_data *fdata1, const frame_data *fdata2)
frame_compare_time_deltas(const frame_data *fdata1, bool have_ts1, const nstime_t *ts1,
const frame_data *fdata2, bool have_ts2, const nstime_t *ts2)
{
nstime_t del_cap_ts1, del_cap_ts2;
if (!have_ts1) {
if (!have_ts2) {
/* We don't have either delta time; sort them the same. */
return 0;
}
frame_delta_abs_time(epan, fdata1, fdata1->num - 1, &del_cap_ts1);
frame_delta_abs_time(epan, fdata2, fdata2->num - 1, &del_cap_ts2);
/*
* We don't have ts1 but do have ts2; treat the first
* as sorting lower than the second.
*/
return -1;
}
if (!have_ts2) {
/*
* We have ts1 but don't have ts2; treat the first as
* sorting greater than the second.
*/
return 1;
}
return COMPARE_TS_REAL(del_cap_ts1, del_cap_ts2);
/*
* We have ts1 and ts2; compare them.
*/
return COMPARE_TS_REAL(*ts1, *ts2);
}
bool
frame_rel_first_frame_time(const struct epan_session *epan,
const frame_data *fdata, nstime_t *delta)
{
/*
* Time relative to the first frame in the capture.
*/
return frame_delta_abs_time(epan, fdata, 1, delta);
}
bool
frame_rel_time(const struct epan_session *epan, const frame_data *fdata,
nstime_t *delta)
{
/*
* Time relative to the previous reference frame or, if there is no
* previous reference frame, the first frame in the capture.
*/
return frame_delta_abs_time(epan, fdata,
fdata->frame_ref_num == 0 ? 1 : fdata->frame_ref_num,
delta);
}
static int
frame_data_time_delta_rel_compare(const struct epan_session *epan, const frame_data *fdata1, const frame_data *fdata2)
frame_compare_rel_times(const struct epan_session *epan,
const frame_data *fdata1, const frame_data *fdata2)
{
nstime_t del_rel_ts1, del_rel_ts2;
bool have_del_rel_ts1, have_del_rel_ts2;
frame_delta_abs_time(epan, fdata1, fdata1->frame_ref_num, &del_rel_ts1);
frame_delta_abs_time(epan, fdata2, fdata2->frame_ref_num, &del_rel_ts2);
have_del_rel_ts1 = frame_rel_time(epan, fdata1, &del_rel_ts1);
have_del_rel_ts2 = frame_rel_time(epan, fdata2, &del_rel_ts2);
return COMPARE_TS_REAL(del_rel_ts1, del_rel_ts2);
return frame_compare_time_deltas(fdata1, have_del_rel_ts1, &del_rel_ts1,
fdata2, have_del_rel_ts2, &del_rel_ts2);
}
bool
frame_delta_time_prev_captured(const struct epan_session *epan,
const frame_data *fdata, nstime_t *delta)
{
return frame_delta_abs_time(epan, fdata, fdata->num - 1, delta);
}
static int
frame_data_time_delta_dis_compare(const struct epan_session *epan, const frame_data *fdata1, const frame_data *fdata2)
frame_compare_delta_times_prev_captured(const struct epan_session *epan,
const frame_data *fdata1,
const frame_data *fdata2)
{
nstime_t del_cap_ts1, del_cap_ts2;
bool have_del_cap_ts1, have_del_cap_ts2;
have_del_cap_ts1 = frame_delta_time_prev_captured(epan, fdata1, &del_cap_ts1);
have_del_cap_ts2 = frame_delta_time_prev_captured(epan, fdata2, &del_cap_ts2);
return frame_compare_time_deltas(fdata1, have_del_cap_ts1, &del_cap_ts1,
fdata2, have_del_cap_ts2, &del_cap_ts2);
}
bool
frame_delta_time_prev_displayed(const struct epan_session *epan,
const frame_data *fdata, nstime_t *delta)
{
return frame_delta_abs_time(epan, fdata, fdata->prev_dis_num, delta);
}
static int
frame_compare_delta_times_prev_displayed(const struct epan_session *epan, const frame_data *fdata1, const frame_data *fdata2)
{
nstime_t del_dis_ts1, del_dis_ts2;
bool have_del_dis_ts1, have_del_dis_ts2;
frame_delta_abs_time(epan, fdata1, fdata1->prev_dis_num, &del_dis_ts1);
frame_delta_abs_time(epan, fdata2, fdata2->prev_dis_num, &del_dis_ts2);
have_del_dis_ts1 = frame_delta_time_prev_displayed(epan, fdata1, &del_dis_ts1);
have_del_dis_ts2 = frame_delta_time_prev_displayed(epan, fdata2, &del_dis_ts2);
return COMPARE_TS_REAL(del_dis_ts1, del_dis_ts2);
return frame_compare_time_deltas(fdata1, have_del_dis_ts1, &del_dis_ts1,
fdata2, have_del_dis_ts2, &del_dis_ts2);
}
int
@ -114,13 +210,13 @@ frame_data_compare(const struct epan_session *epan, const frame_data *fdata1, co
return COMPARE_TS(abs_ts);
case TS_RELATIVE:
return frame_data_time_delta_rel_compare(epan, fdata1, fdata2);
return frame_compare_rel_times(epan, fdata1, fdata2);
case TS_DELTA:
return frame_data_time_delta_compare(epan, fdata1, fdata2);
return frame_compare_delta_times_prev_captured(epan, fdata1, fdata2);
case TS_DELTA_DIS:
return frame_data_time_delta_dis_compare(epan, fdata1, fdata2);
return frame_compare_delta_times_prev_displayed(epan, fdata1, fdata2);
case TS_NOT_SET:
return 0;
@ -136,13 +232,13 @@ frame_data_compare(const struct epan_session *epan, const frame_data *fdata1, co
return COMPARE_TS(abs_ts);
case COL_REL_TIME:
return frame_data_time_delta_rel_compare(epan, fdata1, fdata2);
return frame_compare_rel_times(epan, fdata1, fdata2);
case COL_DELTA_TIME:
return frame_data_time_delta_compare(epan, fdata1, fdata2);
return frame_compare_delta_times_prev_captured(epan, fdata1, fdata2);
case COL_DELTA_TIME_DIS:
return frame_data_time_delta_dis_compare(epan, fdata1, fdata2);
return frame_compare_delta_times_prev_displayed(epan, fdata1, fdata2);
case COL_PACKET_LENGTH:
return COMPARE_NUM(pkt_len);

17
epan/frame_data.h
View File

@ -106,8 +106,21 @@ WS_DLL_PUBLIC void frame_data_init(frame_data *fdata, uint32_t num,
const wtap_rec *rec, int64_t offset,
uint32_t cum_bytes);
extern void frame_delta_abs_time(const struct epan_session *epan, const frame_data *fdata,
uint32_t prev_num, nstime_t *delta);
extern bool frame_rel_first_frame_time(const struct epan_session *epan,
const frame_data *fdata,
nstime_t *delta);
extern bool frame_rel_time(const struct epan_session *epan,
const frame_data *fdata, nstime_t *delta);
extern bool frame_delta_time_prev_captured(const struct epan_session *epan,
const frame_data *fdata,
nstime_t *delta);
extern bool frame_delta_time_prev_displayed(const struct epan_session *epan,
const frame_data *fdata,
nstime_t *delta);
/**
* Sets the frame data struct values before dissection.
*/

15
epan/packet.c
View File

@ -684,7 +684,18 @@ dissect_record(epan_dissect_t *edt, int file_type_subtype, wtap_rec *rec,
edt->pi.layers = wmem_list_new(edt->pi.pool);
edt->tvb = NULL;
frame_delta_abs_time(edt->session, fd, 1, &edt->pi.rel_ts);
/*
* This is time relative to the first frame in the capture,
* regardless of what time reference frames precede it.
*
* XXX - should there be a field indicating whether the
* frame *has* a relative time stamp?
*
* XXX - what is pinfo->rel_ts used for? All times are
* relative to some zero point on the t axis, so why
* is pinfo->rel_ts used instead of pinfo->abs_ts?
*/
frame_rel_first_frame_time(edt->session, fd, &edt->pi.rel_ts);
if (rec->ts_rel_cap_valid) {
nstime_copy(&edt->pi.rel_cap_ts, &rec->ts_rel_cap);
@ -784,7 +795,7 @@ dissect_file(epan_dissect_t *edt, wtap_rec *rec,
edt->pi.layers = wmem_list_new(edt->pi.pool);
edt->tvb = NULL;
frame_delta_abs_time(edt->session, fd, 1, &edt->pi.rel_ts);
frame_rel_first_frame_time(edt->session, fd, &edt->pi.rel_ts);
TRY {
/*

29
epan/wslua/wslua_pinfo.c
View File

@ -201,11 +201,32 @@ lua_nstime_to_sec(const nstime_t *nstime)
}
static double
lua_delta_nstime_to_sec(const Pinfo pinfo, const frame_data *fd, uint32_t prev_num)
lua_delta_prev_captured_sec(const Pinfo pinfo, const frame_data *fd)
{
nstime_t del;
frame_delta_abs_time(pinfo->ws_pinfo->epan, fd, prev_num, &del);
/*
* XXX - there's no way to report "there *is* no delta time,
* because either 1) this frame has no time stamp, 2) the
* previous frame doesn't exist, or 2) it exists but *it*
* has no time stamp.
*/
frame_delta_time_prev_captured(pinfo->ws_pinfo->epan, fd, &del);
return lua_nstime_to_sec(&del);
}
static double
lua_delta_prev_displayed_sec(const Pinfo pinfo, const frame_data *fd)
{
nstime_t del;
/*
* XXX - there's no way to report "there *is* no delta time,
* because either 1) this frame has no time stamp, 2) the
* previous frame doesn't exist, or 2) it exists but *it*
* has no time stamp.
*/
frame_delta_time_prev_displayed(pinfo->ws_pinfo->epan, fd, &del);
return lua_nstime_to_sec(&del);
}
@ -229,10 +250,10 @@ WSLUA_ATTRIBUTE_BLOCK_NUMBER_GETTER(Pinfo,abs_ts,lua_nstime_to_sec(&obj->ws_pinf
WSLUA_ATTRIBUTE_BLOCK_NUMBER_GETTER(Pinfo,rel_ts,lua_nstime_to_sec(&obj->ws_pinfo->rel_ts));
/* WSLUA_ATTRIBUTE Pinfo_delta_ts RO Number of seconds passed since the last captured packet. */
WSLUA_ATTRIBUTE_BLOCK_NUMBER_GETTER(Pinfo,delta_ts,lua_delta_nstime_to_sec(obj, obj->ws_pinfo->fd, obj->ws_pinfo->num - 1));
WSLUA_ATTRIBUTE_BLOCK_NUMBER_GETTER(Pinfo,delta_ts,lua_delta_prev_captured_sec(obj, obj->ws_pinfo->fd));
/* WSLUA_ATTRIBUTE Pinfo_delta_dis_ts RO Number of seconds passed since the last displayed packet. */
WSLUA_ATTRIBUTE_BLOCK_NUMBER_GETTER(Pinfo,delta_dis_ts,lua_delta_nstime_to_sec(obj, obj->ws_pinfo->fd, obj->ws_pinfo->fd->prev_dis_num));
WSLUA_ATTRIBUTE_BLOCK_NUMBER_GETTER(Pinfo,delta_dis_ts,lua_delta_prev_displayed_sec(obj, obj->ws_pinfo->fd));
/* WSLUA_ATTRIBUTE Pinfo_curr_proto RO Which Protocol are we dissecting. */
WSLUA_ATTRIBUTE_NAMED_STRING_GETTER(Pinfo,curr_proto,ws_pinfo->current_proto);

2
test/baseline/dhcp-raw.ek
View File

File diff suppressed because one or more lines are too long

2
test/baseline/dhcp.ek
View File

@ -1,5 +1,5 @@
{"index":{"_index":"packets-2004-12-05"}}
{"timestamp":"1102274184317","layers":{"dhcp":{"dhcp_dhcp_option_requested_ip_address":"0.0.0.0","dhcp_dhcp_hw_type":["0x01","0x01"],"dhcp_dhcp_ip_your":"0.0.0.0","dhcp_dhcp_flags":"0x0000","dhcp_dhcp_option_value":["01","01:00:0b:82:01:fc:42","00:00:00:00","01:03:06:2a"],"dhcp_dhcp_hw_len":"6","dhcp_dhcp_option_length":["1","7","4","4"],"dhcp_dhcp_flags_bc":false,"dhcp_dhcp_id":"0x00003d1d","dhcp_dhcp_hw_mac_addr":["00:0b:82:01:fc:42","00:0b:82:01:fc:42"],"dhcp_dhcp_ip_client":"0.0.0.0","dhcp_dhcp_secs":"0","dhcp_dhcp_server":"","dhcp_dhcp_hw_addr_padding":"00:00:00:00:00:00:00:00:00:00","dhcp_dhcp_option_type":["53","61","50","55","0"],"dhcp_dhcp_hops":"0","dhcp_dhcp_file":"","dhcp_dhcp_ip_server":"0.0.0.0","dhcp_dhcp_option_dhcp":"1","dhcp_dhcp_option_request_list_item":["1","3","6","42"],"dhcp_dhcp_cookie":"99.130.83.99","dhcp_dhcp_option_padding":"00:00:00:00:00:00:00","dhcp_dhcp_ip_relay":"0.0.0.0","dhcp_dhcp_type":"1","dhcp_dhcp_flags_reserved":"0x0000","dhcp_dhcp_option_end":"255"},"udp":{"udp_udp_time_delta":"0.000000000","udp_udp_dstport":"67","udp_udp_checksum":"0x591f","udp_udp_stream_pnum":"1","udp_udp_checksum_status":"2","udp_udp_port":["68","67"],"udp_udp_stream":"0","udp_udp_length":"280","text":"Timestamps","udp_udp_srcport":"68","udp_udp_payload":"01:01:06:00:00:00:3d:1d:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:0b:82:01:fc:42:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:63:82:53:63:35:01:01:3d:07:01:00:0b:82:01:fc:42:32:04:00:00:00:00:37:04:01:03:06:2a:ff:00:00:00:00:00:00:00","udp_udp_time_relative":"0.000000000"},"ip":{"ip_ip_flags_rb":false,"ip_ip_addr":["0.0.0.0","255.255.255.255"],"ip_ip_dsfield_ecn":"0","ip_ip_frag_offset":"0","ip_ip_hdr_len":"20","ip_ip_id":"0xa836","ip_ip_version":"4","ip_ip_dst":"255.255.255.255","ip_ip_host":["0.0.0.0","255.255.255.255"],"ip_ip_flags":"0x00","ip_ip_src_host":"0.0.0.0","ip_ip_flags_df":false,"ip_ip_stream":"0","ip_ip_len":"300","ip_ip_checksum_status":"2","ip_ip_dst_host":"255.255.255.255","ip_ip_src":"0.0.0.0","ip_ip_ttl":"250","ip_ip_flags_mf":false,"ip_ip_checksum":"0x178b","ip_ip_proto":"17","ip_ip_dsfield_dscp":"0","ip_ip_dsfield":"0x00"},"frame":{"frame_frame_len":"314","frame_frame_marked":false,"frame_frame_number":"1","frame_frame_time_epoch":"2004-12-05T19:16:24.317453000Z","frame_frame_time":"2004-12-05T19:16:24.317453000Z","frame_frame_time_relative":"0.000000000","frame_frame_encap_type":"1","frame_frame_offset_shift":"0.000000000","frame_frame_time_delta_displayed":"0.000000000","frame_frame_time_utc":"2004-12-05T19:16:24.317453000Z","frame_frame_ignored":false,"frame_frame_cap_len":"314","frame_frame_time_delta":"0.000000000","frame_frame_protocols":"eth:ethertype:ip:udp:dhcp"},"eth":{"eth_eth_src_lg":false,"eth_eth_dst":"ff:ff:ff:ff:ff:ff","eth_eth_lg":[true,false],"eth_eth_dst_resolved":"Broadcast","eth_eth_addr_oui":["16777215","2946"],"eth_eth_stream":"0","eth_eth_src_resolved":"GrandstreamN_01:fc:42","eth_eth_addr_oui_resolved":"Grandstream Networks, Inc.","eth_eth_src_oui_resolved":"Grandstream Networks, Inc.","eth_eth_src_oui":"2946","eth_eth_addr_resolved":["Broadcast","GrandstreamN_01:fc:42"],"eth_eth_type":"0x0800","eth_eth_src":"00:0b:82:01:fc:42","eth_eth_addr":["ff:ff:ff:ff:ff:ff","00:0b:82:01:fc:42"],"eth_eth_dst_ig":true,"eth_eth_dst_lg":true,"eth_eth_src_ig":false,"eth_eth_ig":[true,false],"eth_eth_dst_oui":"16777215"}}}
{"timestamp":"1102274184317","layers":{"dhcp":{"dhcp_dhcp_option_requested_ip_address":"0.0.0.0","dhcp_dhcp_hw_type":["0x01","0x01"],"dhcp_dhcp_ip_your":"0.0.0.0","dhcp_dhcp_flags":"0x0000","dhcp_dhcp_option_value":["01","01:00:0b:82:01:fc:42","00:00:00:00","01:03:06:2a"],"dhcp_dhcp_hw_len":"6","dhcp_dhcp_option_length":["1","7","4","4"],"dhcp_dhcp_flags_bc":false,"dhcp_dhcp_id":"0x00003d1d","dhcp_dhcp_hw_mac_addr":["00:0b:82:01:fc:42","00:0b:82:01:fc:42"],"dhcp_dhcp_ip_client":"0.0.0.0","dhcp_dhcp_secs":"0","dhcp_dhcp_server":"","dhcp_dhcp_hw_addr_padding":"00:00:00:00:00:00:00:00:00:00","dhcp_dhcp_option_type":["53","61","50","55","0"],"dhcp_dhcp_hops":"0","dhcp_dhcp_file":"","dhcp_dhcp_ip_server":"0.0.0.0","dhcp_dhcp_option_dhcp":"1","dhcp_dhcp_option_request_list_item":["1","3","6","42"],"dhcp_dhcp_cookie":"99.130.83.99","dhcp_dhcp_option_padding":"00:00:00:00:00:00:00","dhcp_dhcp_ip_relay":"0.0.0.0","dhcp_dhcp_type":"1","dhcp_dhcp_flags_reserved":"0x0000","dhcp_dhcp_option_end":"255"},"udp":{"udp_udp_time_delta":"0.000000000","udp_udp_dstport":"67","udp_udp_checksum":"0x591f","udp_udp_stream_pnum":"1","udp_udp_checksum_status":"2","udp_udp_port":["68","67"],"udp_udp_stream":"0","udp_udp_length":"280","text":"Timestamps","udp_udp_srcport":"68","udp_udp_payload":"01:01:06:00:00:00:3d:1d:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:0b:82:01:fc:42:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:63:82:53:63:35:01:01:3d:07:01:00:0b:82:01:fc:42:32:04:00:00:00:00:37:04:01:03:06:2a:ff:00:00:00:00:00:00:00","udp_udp_time_relative":"0.000000000"},"ip":{"ip_ip_flags_rb":false,"ip_ip_addr":["0.0.0.0","255.255.255.255"],"ip_ip_dsfield_ecn":"0","ip_ip_frag_offset":"0","ip_ip_hdr_len":"20","ip_ip_id":"0xa836","ip_ip_version":"4","ip_ip_dst":"255.255.255.255","ip_ip_host":["0.0.0.0","255.255.255.255"],"ip_ip_flags":"0x00","ip_ip_src_host":"0.0.0.0","ip_ip_flags_df":false,"ip_ip_stream":"0","ip_ip_len":"300","ip_ip_checksum_status":"2","ip_ip_dst_host":"255.255.255.255","ip_ip_src":"0.0.0.0","ip_ip_ttl":"250","ip_ip_flags_mf":false,"ip_ip_checksum":"0x178b","ip_ip_proto":"17","ip_ip_dsfield_dscp":"0","ip_ip_dsfield":"0x00"},"frame":{"frame_frame_len":"314","frame_frame_marked":false,"frame_frame_number":"1","frame_frame_time_epoch":"2004-12-05T19:16:24.317453000Z","frame_frame_time":"2004-12-05T19:16:24.317453000Z","frame_frame_time_relative":"0.000000000","frame_frame_encap_type":"1","frame_frame_offset_shift":"0.000000000","frame_frame_time_utc":"2004-12-05T19:16:24.317453000Z","frame_frame_ignored":false,"frame_frame_cap_len":"314","frame_frame_protocols":"eth:ethertype:ip:udp:dhcp"},"eth":{"eth_eth_src_lg":false,"eth_eth_dst":"ff:ff:ff:ff:ff:ff","eth_eth_lg":[true,false],"eth_eth_dst_resolved":"Broadcast","eth_eth_addr_oui":["16777215","2946"],"eth_eth_stream":"0","eth_eth_src_resolved":"GrandstreamN_01:fc:42","eth_eth_addr_oui_resolved":"Grandstream Networks, Inc.","eth_eth_src_oui_resolved":"Grandstream Networks, Inc.","eth_eth_src_oui":"2946","eth_eth_addr_resolved":["Broadcast","GrandstreamN_01:fc:42"],"eth_eth_type":"0x0800","eth_eth_src":"00:0b:82:01:fc:42","eth_eth_addr":["ff:ff:ff:ff:ff:ff","00:0b:82:01:fc:42"],"eth_eth_dst_ig":true,"eth_eth_dst_lg":true,"eth_eth_src_ig":false,"eth_eth_ig":[true,false],"eth_eth_dst_oui":"16777215"}}}
{"index":{"_index":"packets-2004-12-05"}}
{"timestamp":"1102274184317","layers":{"dhcp":{"dhcp_dhcp_option_dhcp_server_id":"192.168.0.1","dhcp_dhcp_hw_type":"0x01","dhcp_dhcp_ip_your":"192.168.0.10","dhcp_dhcp_flags":"0x0000","dhcp_dhcp_option_ip_address_lease_time":"3600","dhcp_dhcp_option_value":["02","ff:ff:ff:00","00:00:07:08","00:00:0c:4e","00:00:0e:10","c0:a8:00:01"],"dhcp_dhcp_hw_len":"6","dhcp_dhcp_option_length":["1","4","4","4","4","4"],"dhcp_dhcp_flags_bc":false,"dhcp_dhcp_id":"0x00003d1d","dhcp_dhcp_hw_mac_addr":"00:0b:82:01:fc:42","dhcp_dhcp_ip_client":"0.0.0.0","dhcp_dhcp_secs":"0","dhcp_dhcp_server":"","dhcp_dhcp_option_end":"255","dhcp_dhcp_hw_addr_padding":"00:00:00:00:00:00:00:00:00:00","dhcp_dhcp_option_type":["53","1","58","59","51","54","0"],"dhcp_dhcp_hops":"0","dhcp_dhcp_file":"","dhcp_dhcp_ip_server":"192.168.0.1","dhcp_dhcp_option_dhcp":"2","dhcp_dhcp_option_subnet_mask":"255.255.255.0","dhcp_dhcp_cookie":"99.130.83.99","dhcp_dhcp_option_renewal_time_value":"1800","dhcp_dhcp_ip_relay":"0.0.0.0","dhcp_dhcp_type":"2","dhcp_dhcp_flags_reserved":"0x0000","dhcp_dhcp_option_padding":"00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00","dhcp_dhcp_option_rebinding_time_value":"3150"},"udp":{"udp_udp_time_delta":"0.000000000","udp_udp_dstport":"68","udp_udp_checksum":"0x2233","udp_udp_stream_pnum":"1","udp_udp_checksum_status":"2","udp_udp_port":["67","68"],"udp_udp_stream":"1","udp_udp_length":"308","text":"Timestamps","udp_udp_srcport":"67","udp_udp_payload":"02:01:06:00:00:00:3d:1d:00:00:00:00:00:00:00:00:c0:a8:00:0a:c0:a8:00:01:00:00:00:00:00:0b:82:01:fc:42:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:63:82:53:63:35:01:02:01:04:ff:ff:ff:00:3a:04:00:00:07:08:3b:04:00:00:0c:4e:33:04:00:00:0e:10:36:04:c0:a8:00:01:ff:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00","udp_udp_time_relative":"0.000000000"},"ip":{"ip_ip_flags_rb":false,"ip_ip_addr":["192.168.0.1","192.168.0.10"],"ip_ip_dsfield_ecn":"0","ip_ip_frag_offset":"0","ip_ip_hdr_len":"20","ip_ip_id":"0x0445","ip_ip_version":"4","ip_ip_dst":"192.168.0.10","ip_ip_host":["192.168.0.1","192.168.0.10"],"ip_ip_flags":"0x00","ip_ip_src_host":"192.168.0.1","ip_ip_flags_df":false,"ip_ip_stream":"1","ip_ip_len":"328","ip_ip_checksum_status":"2","ip_ip_dst_host":"192.168.0.10","ip_ip_src":"192.168.0.1","ip_ip_ttl":"128","ip_ip_flags_mf":false,"ip_ip_checksum":"0x0000","ip_ip_proto":"17","ip_ip_dsfield_dscp":"0","ip_ip_dsfield":"0x00"},"frame":{"frame_frame_len":"342","frame_frame_marked":false,"frame_frame_number":"2","frame_frame_time_epoch":"2004-12-05T19:16:24.317748000Z","frame_frame_time":"2004-12-05T19:16:24.317748000Z","frame_frame_time_relative":"0.000295000","frame_frame_encap_type":"1","frame_frame_offset_shift":"0.000000000","frame_frame_time_delta_displayed":"0.000295000","frame_frame_time_utc":"2004-12-05T19:16:24.317748000Z","frame_frame_ignored":false,"frame_frame_cap_len":"342","frame_frame_time_delta":"0.000295000","frame_frame_protocols":"eth:ethertype:ip:udp:dhcp"},"eth":{"eth_eth_src_lg":false,"eth_eth_dst":"00:0b:82:01:fc:42","eth_eth_lg":[false,false],"eth_eth_dst_resolved":"GrandstreamN_01:fc:42","eth_eth_addr_oui":["2946","2164"],"eth_eth_src_ig":false,"eth_eth_src_resolved":"Dell_ad:f1:9b","eth_eth_addr_oui_resolved":["Grandstream Networks, Inc.","Dell Inc."],"eth_eth_src_oui":"2164","eth_eth_src_oui_resolved":"Dell Inc.","eth_eth_addr_resolved":["GrandstreamN_01:fc:42","Dell_ad:f1:9b"],"eth_eth_stream":"1","eth_eth_type":"0x0800","eth_eth_src":"00:08:74:ad:f1:9b","eth_eth_addr":["00:0b:82:01:fc:42","00:08:74:ad:f1:9b"],"eth_eth_dst_ig":false,"eth_eth_dst_oui_resolved":"Grandstream Networks, Inc.","eth_eth_dst_lg":false,"eth_eth_ig":[false,false],"eth_eth_dst_oui":"2946"}}}
{"index":{"_index":"packets-2004-12-05"}}

2
test/baseline/dhcp.json
View File

@ -10,8 +10,6 @@
"frame.time_utc": "2004-12-05T19:16:24.317453000Z",
"frame.time_epoch": "2004-12-05T19:16:24.317453000Z",
"frame.offset_shift": "0.000000000",
"frame.time_delta": "0.000000000",
"frame.time_delta_displayed": "0.000000000",
"frame.time_relative": "0.000000000",
"frame.number": "1",
"frame.len": "314",

16
test/baseline/dhcp.jsonraw
View File

@ -53,22 +53,6 @@
25,
0
],
"frame.time_delta_raw": [
"",
0,
0,
0,
25,
0
],
"frame.time_delta_displayed_raw": [
"",
0,
0,
0,
25,
0
],
"frame.time_relative_raw": [
"",
0,

2
test/baseline/ff-ts-usec-pcap-direct.txt
View File

@ -1,4 +1,4 @@
1 1102274184.317453000 0.000000000
1 1102274184.317453000
2 1102274184.317748000 0.000295000
3 1102274184.387484000 0.069736000
4 1102274184.387798000 0.000314000

BIN
test/captures/nfs.pcap
View File

Binary file not shown.

36
test/lua/nstime.lua
View File

@ -121,13 +121,43 @@ function tap.packet(pinfo,tvb,frame)
now = fi_now()
if testlib.getPktCount(FRAME) == 1 then
testlib.test(PER_FRAME,"__eq-1", begin == fi_delta())
testlib.test(PER_FRAME,"NSTime.secs-1", fi_delta().secs == 0)
testlib.test(PER_FRAME,"NSTime.nsecs-1", fi_delta().nsecs == 0)
--
-- This is the first frame, so begin should be set to its time
-- stamp.
--
begin = fi_now()
--
-- And the delta time should not exist.
--
testlib.test(PER_FRAME,"__eq-1", nil == fi_delta)
--
-- And the time relative to the first frame should be zero.
--
testlib.test(PER_FRAME,"NSTime.secs-1", fi_rel().secs == 0)
testlib.test(PER_FRAME,"NSTime.nsecs-1", fi_rel().nsecs == 0)
begin = fi_now()
else
--
-- Thss is not the first frame, so the time relative to the
-- previous frame should be the difference between this frame's
-- time stamp and the previous frame's time stamp.
--
testlib.test(PER_FRAME,"__sub__eq-1", now - previous == fi_delta())
--
-- And the time relative to the first frame should be the
-- difference between this frame's time stamp and the first
-- frame's time stamp.
--
testlib.test(PER_FRAME,"__sub__eq-2", now - begin == fi_rel())
--
-- And it should also be the sum of the time difference between
-- the previous frame and the first frame and the time difference
-- between this frame and the previous frame.
--
testlib.test(PER_FRAME,"__add-1", (previous - begin) + (now - previous) == fi_rel())
end
previous = now

2
test/suite_dfilter/group_integer.py
View File

@ -197,7 +197,7 @@ class TestDfilterUint64:
def test_uint64_1(self, checkDFilterCount):
dfilter = "nfs.fattr3.size == 264032"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_uint64_2(self, checkDFilterCount):
dfilter = "nfs.fattr3.size == 264000"

42
test/suite_dfilter/group_ipv4.py
View File

@ -11,7 +11,7 @@ class TestDfilterIpv4:
def test_eq_1(self, checkDFilterCount):
dfilter = "ip.src == 172.25.100.14"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_eq_2(self, checkDFilterCount):
dfilter = "ip.src == 255.255.255.255"
@ -19,11 +19,11 @@ class TestDfilterIpv4:
def test_ne_1(self, checkDFilterCount):
dfilter = "ip.src != 172.25.100.14"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_ne_2(self, checkDFilterCount):
dfilter = "ip.src != 255.255.255.255"
checkDFilterCount(dfilter, 2)
checkDFilterCount(dfilter, 4)
def test_gt_1(self, checkDFilterCount):
dfilter = "ip.dst > 198.95.230.200"
@ -35,7 +35,7 @@ class TestDfilterIpv4:
def test_gt_3(self, checkDFilterCount):
dfilter = "ip.dst > 198.95.230.10"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_ge_1(self, checkDFilterCount):
dfilter = "ip.dst >= 198.95.230.200"
@ -43,15 +43,15 @@ class TestDfilterIpv4:
def test_ge_2(self, checkDFilterCount):
dfilter = "ip.dst >= 198.95.230.20"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_ge_3(self, checkDFilterCount):
dfilter = "ip.dst >= 198.95.230.10"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_lt_1(self, checkDFilterCount):
dfilter = "ip.src < 172.25.100.140"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_lt_2(self, checkDFilterCount):
dfilter = "ip.src < 172.25.100.14"
@ -63,11 +63,11 @@ class TestDfilterIpv4:
def test_le_1(self, checkDFilterCount):
dfilter = "ip.src <= 172.25.100.140"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_le_2(self, checkDFilterCount):
dfilter = "ip.src <= 172.25.100.14"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_le_3(self, checkDFilterCount):
dfilter = "ip.src <= 172.25.100.10"
@ -75,39 +75,39 @@ class TestDfilterIpv4:
def test_cidr_eq_1(self, checkDFilterCount):
dfilter = "ip.src == 172.25.100.14/32"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_cidr_eq_2(self, checkDFilterCount):
dfilter = "ip.src == 172.25.100.0/24"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_cidr_eq_3(self, checkDFilterCount):
dfilter = "ip.src == 172.25.0.0/16"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_cidr_eq_4(self, checkDFilterCount):
dfilter = "ip.src == 172.0.0.0/8"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_cidr_ne_1(self, checkDFilterCount):
dfilter = "ip.src != 172.25.100.14/32"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_cidr_ne_2(self, checkDFilterCount):
dfilter = "ip.src != 172.25.100.0/24"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_cidr_ne_3(self, checkDFilterCount):
dfilter = "ip.src != 172.25.0.0/16"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_cidr_ne_4(self, checkDFilterCount):
dfilter = "ip.src != 200.0.0.0/8"
checkDFilterCount(dfilter, 2)
checkDFilterCount(dfilter, 4)
def test_slice_1(self, checkDFilterCount):
dfilter = "ip.src[0:2] == ac:19"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_slice_2(self, checkDFilterCount):
dfilter = "ip.src[0:2] == 00:00"
@ -115,7 +115,7 @@ class TestDfilterIpv4:
def test_slice_3(self, checkDFilterCount):
dfilter = "ip.src[2:2] == 64:0e"
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 2)
def test_slice_4(self, checkDFilterCount):
dfilter = "ip.src[2:2] == ff:ff"
@ -123,8 +123,8 @@ class TestDfilterIpv4:
def test_count_1(self, checkDFilterCount):
dfilter = "count(ip.src) == 1"
checkDFilterCount(dfilter, 2)
checkDFilterCount(dfilter, 4)
def test_count_2(self, checkDFilterCount):
dfilter = "count(ip.addr) == 2"
checkDFilterCount(dfilter, 2)
checkDFilterCount(dfilter, 4)

8
test/suite_dfilter/group_macro.py
View File

@ -26,15 +26,15 @@ class TestDfilterMacroZeroArg:
def test_macro_1(self, checkDFilterCount):
dfilter = "$nfs()"
checkDFilterCount(dfilter, 2)
checkDFilterCount(dfilter, 4)
def test_macro_2(self, checkDFilterCount):
dfilter = "${nfs}"
checkDFilterCount(dfilter, 2)
checkDFilterCount(dfilter, 4)
def test_macro_3(self, checkDFilterCount):
dfilter = "${nfs:}"
checkDFilterCount(dfilter, 2)
checkDFilterCount(dfilter, 4)
def test_macro_wrong_count_1(self, checkDFilterFail):
dfilter = "${private_ipv4}"
@ -53,7 +53,7 @@ class TestDfilterMacroNullArg:
def test_macro_works(self, checkDFilterCount):
dfilter = "$ip(198.95.230.20, 2049)"
checkDFilterCount(dfilter, 2)
checkDFilterCount(dfilter, 4)
def test_macro_null_1(self, checkDFilterFail):
dfilter = "$ip(198.95.230.20,)"

11
test/suite_dfilter/group_membership.py
View File

@ -70,9 +70,18 @@ class TestDfilterMembership:
dfilter = 'tcp.port in {1 .. 79,81 .. 3266,3268 .. 65535}'
checkDFilterCount(dfilter, 0)
#
# XXX - http.pcap is a one-packet file, which now means that there
# is no "time relative to the previous packet" value in it.
#
# Even when we said the time relative to the previous packet is
# 0 if there is no previous packet, this wasn't checking the
# behavior with negative field values, as the value was zero,
# not negative.
#
def test_membership_5_negative_range_float(self, checkDFilterCount):
dfilter = 'frame.time_delta in {-2.0 .. 0.0}'
checkDFilterCount(dfilter, 1)
checkDFilterCount(dfilter, 0)
def test_membership_6_both_negative_range_float(self, checkDFilterCount):
dfilter = 'frame.time_delta in {-20 .. -0.7}'

2
test/suite_dfilter/group_time.py
View File

@ -110,7 +110,7 @@ class TestDfilterTimeRelative:
def test_relative_time_2(self, checkDFilterCount):
dfilter = "frame.time_delta > 0.7"
checkDFilterCount(dfilter, 0)
checkDFilterCount(dfilter, 1)
def test_relative_time_3(self, checkDFilterCount):
dfilter = "frame.time_delta < 0.7"

2
test/suite_sharkd.py
View File

@ -231,7 +231,7 @@ class TestSharkd:
{"jsonrpc":"2.0","id":1,"result":{"status":"OK"}},
{"jsonrpc":"2.0","id":2,"result":
[
{"c":["0.000000000","0.000000000","0.000000000"],"num":1,"bg":"feffd0","fg":"12272e"},
{"c":["0.000000000","",""],"num":1,"bg":"feffd0","fg":"12272e"},
{"c":["191.872111000","0.193716000","191.872111000"],"num":800,"bg":"feffd0","fg":"12272e"},
],
},