Wireshark 2.9.0-477-g68ec514b The Wireshark network protocol analyzer

- Main Page
- Related Pages
- Modules
- Namespaces
- Classes
- Files

- Class List
- Class Index
- Class Hierarchy
- Class Members

Public Attributes | List of all members
_packet_info Struct Reference
Packet Data and Metadata

## Public Attributes
const char * | current_proto
struct epan_column_info * | cinfo
guint32 | presence_flags
guint32 | num
nstime_t | abs_ts
nstime_t | rel_ts
frame_data * | fd
union wtap_pseudo_header * | pseudo_header
wtap_rec * | rec
GSList * | data_src
address | dl_src
address | dl_dst
address | net_src
address | net_dst
address | src
address | dst
guint32 | vlan_id
const char * | noreassembly_reason
gboolean | fragmented
struct {
guint32 in_error_pkt:1
guint32 in_gre_pkt:1
} | flags
port_type | ptype
guint32 | srcport
guint32 | destport
guint32 | match_uint
const char * | match_string
gboolean | use_endpoint
struct endpoint * | conv_endpoint
guint16 | can_desegment
guint16 | saved_can_desegment
int | desegment_offset
guint32 | desegment_len
guint16 | want_pdu_tracking
guint32 | bytes_until_next_pdu
int | p2p_dir
GHashTable * | private_table
wmem_list_t * | layers
guint8 | curr_layer_num
guint16 | link_number
guint16 | clnp_srcref
guint16 | clnp_dstref
int | link_dir
GSList * | proto_data
GSList * | dependent_frames
GSList * | frame_end_routines
wmem_allocator_t * | pool
struct epan_session * | epan
const gchar * | heur_list_name

## Member Data Documentation

nstime_t _packet_info::abs_ts

Packet absolute time stamp

guint16 _packet_info::can_desegment

>0 if this segment could be desegmented. A dissector that can offer this API (e.g. TCP) sets can_desegment=2, then can_desegment is decremented by 1 each time we pass to the next subdissector. Thus only the dissector immediately above the protocol which sets the flag can use it

struct epan_column_info* _packet_info::cinfo

Column formatting information

guint16 _packet_info::clnp_dstref

clnp/cotp destination reference (can't use dstport, this would confuse tpkt)

guint16 _packet_info::clnp_srcref

clnp/cotp source reference (can't use srcport, this would confuse tpkt)

struct endpoint* _packet_info::conv_endpoint

Data that can be used for conversations

guint8 _packet_info::curr_layer_num

The current "depth" or layer number in the current frame

const char* _packet_info::current_proto

name of protocol currently being dissected

GSList* _packet_info::data_src

Frame data sources

GSList* _packet_info::dependent_frames

A list of frames which this one depends on

guint32 _packet_info::desegment_len

requested desegmentation additional length or DESEGMENT_ONE_MORE_SEGMENT: Desegment one more full segment (warning! only partially implemented) DESEGMENT_UNTIL_FIN: Desgment all data for this tcp session until the FIN segment.

int _packet_info::desegment_offset

offset to stuff needing desegmentation

guint32 _packet_info::destport

destination port

address _packet_info::dl_dst

link-layer destination address

address _packet_info::dl_src

link-layer source address

address _packet_info::dst

destination address (net if present, DL otherwise )

gboolean _packet_info::fragmented

TRUE if the protocol is only a fragment

const gchar* _packet_info::heur_list_name

name of heur list if this packet is being heuristically dissected

guint32 _packet_info::in_error_pkt

TRUE if we're inside an {ICMP,CLNP,...} error packet

guint32 _packet_info::in_gre_pkt

TRUE if we're encapsulated inside a GRE packet

wmem_list_t* _packet_info::layers

layers of each protocol

int _packet_info::link_dir

3GPP messages are sometime different UP link(UL) or Downlink(DL)

const char* _packet_info::match_string

matched string for calling subdissector from table

guint32 _packet_info::match_uint

matched uint for calling subdissector from table

address _packet_info::net_dst

network-layer destination address

address _packet_info::net_src

network-layer source address

const char* _packet_info::noreassembly_reason

reason why reassembly wasn't done, if any

guint32 _packet_info::num

Frame number

int _packet_info::p2p_dir

Packet was captured as an outbound (P2P_DIR_SENT) inbound (P2P_DIR_RECV) unknown (P2P_DIR_UNKNOWN)

wmem_allocator_t* _packet_info::pool

Memory pool scoped to the pinfo struct

guint32 _packet_info::presence_flags

Presence flags for some items

GHashTable* _packet_info::private_table

a hash table passed from one dissector to another

GSList* _packet_info::proto_data

Per packet proto data

port_type _packet_info::ptype

type of the following two port numbers

wtap_rec* _packet_info::rec

Record metadata

nstime_t _packet_info::rel_ts

Relative timestamp (yes, it can be negative)

guint16 _packet_info::saved_can_desegment

Value of can_desegment before current dissector was called. Supplied so that dissectors for proxy protocols such as SOCKS can restore it, allowing the dissectors that they call to use the TCP dissector's desegmentation (SOCKS just retransmits TCP segments once it's finished setting things up, so the TCP desegmentor can desegment its payload).

address _packet_info::src

source address (net if present, DL otherwise )

guint32 _packet_info::srcport

source port

gboolean _packet_info::use_endpoint

TRUE if endpoint member should be used for conversations

guint32 _packet_info::vlan_id

First encountered VLAN Id if present otherwise 0

guint16 _packet_info::want_pdu_tracking

>0 if the subdissector has specified a value in 'bytes_until_next_pdu'. When a dissector detects that the next PDU will start beyond the start of the next segment, it can set this value to 2 and 'bytes_until_next_pdu' to the number of bytes beyond the next segment where the next PDU starts.

If the protocol dissector below this one is capable of PDU tracking it can use this hint to detect PDUs that starts unaligned to the segment boundaries. The TCP dissector is using this hint from (some) protocols to detect when a new PDU starts in the middle of a tcp segment.

There is intelligence in the glue between dissector layers to make sure that this request is only passed down to the protocol immediately below the current one and not any further.

The documentation for this struct was generated from the following file:

- /home/wireshark/builders/wireshark-master/ubuntu-16.04-x64/build/epan/packet_info.h