wireshark gpa_hfinfo analysis

1. the definition of gpa_hfinfo is in file wireshark/epan/proto.c

 

/* List which stores protocols and fields that have been registered */ typedef struct _gpa_hfinfo_t { guint32 len; guint32 allocated_len; header_field_info **hfi; } gpa_hfinfo_t; gpa_hfinfo_t gpa_hfinfo; /** information describing a header field */ typedef struct _header_field_info header_field_info; /** information describing a header field */ struct _header_field_info { /* ---------- set by dissector --------- */ const char *name; /**< full name of this field */ const char *abbrev; /**< abbreviated name of this field */ enum ftenum type; /**< field type, one of FT_ (from ftypes.h) */ int display; /**< one of BASE_, or number of field bits for FT_BOOLEAN */ const void *strings; /**< value_string, range_string or true_false_string, typically converted by VALS(), RVALS() or TFS(). If this is an FT_PROTOCOL then it points to the associated protocol_t structure */ guint32 bitmask; /**< bitmask of interesting bits */ const char *blurb; /**< Brief description of field */ /* ------- set by proto routines (prefilled by HFILL macro, see below) ------ */ int id; /**< Field ID */ int parent; /**< parent protocol tree */ int ref_count; /**< is this field referenced by a filter and how often */ int bitshift; /**< bits to shift */ header_field_info *same_name_next; /**< Link to next hfinfo with same abbrev */ header_field_info *same_name_prev; /**< Link to previous hfinfo with same abbrev */ };

 

2. contents dump example when wireshark is up

 

dump gpa_hfinfo, len is 89214, allocate len is 90000 0 : name : Text item abbrev : blurb : (null) 1 : name : Pro-MPEG Code of Practice #3 release 2 FEC Protocol abbrev : 2dparityfec blurb : (null) 2 : name : SNBase low abbrev : 2dparityfec.snbase_low blurb : (null) 3 : name : Length recovery abbrev : 2dparityfec.lr blurb : (null) 4 : name : RFC2733 Extension (E) abbrev : 2dparityfec.e blurb : (null) 5 : name : Payload Type recovery abbrev : 2dparityfec.ptr blurb : (null) 6 : name : Mask abbrev : 2dparityfec.mask blurb : (null) 7 : name : Timestamp recovery abbrev : 2dparityfec.tsr blurb : (null) 8 : name : Pro-MPEG Extension (X) abbrev : 2dparityfec.x blurb : (null) 9 : name : Row FEC (D) abbrev : 2dparityfec.d blurb : (null) 10 : name : Type abbrev : 2dparityfec.type blurb : (null) 11 : name : Index abbrev : 2dparityfec.index blurb : (null) 12 : name : Offset abbrev : 2dparityfec.offset blurb : (null) ... 24519 : name : S1AP protocol cause value abbrev : gtpv2.priv_s1ap_protocol_cause_value blurb : S1AP protocol cause value 24520 : name : S1AP transport cause value abbrev : gtpv2.priv_s1ap_transport_cause_value blurb : S1AP transport cause value 24521 : name : S1AP misc cause value abbrev : gtpv2.priv_s1ap_misc_cause_value blurb : S1AP misc cause value 24522 : name : NAS EMM cause value abbrev : gtpv2.priv_emm_cause_value blurb : NAS EMM cause value 24523 : name : NAS ESM cause value abbrev : gtpv2.priv_esm_cause_value blurb : NAS ESM cause value ...