* frameFieldCount() always includes all frame fields whether or not
included in packet
* if an optional field is not included in packet
- FieldName is still returned
- FieldTextValue is returned as "<not-included>"
- FieldBitWidth is 0
- all remaining attributes are QVariant()
These are the existing and desired defaults -
* GUI: recalcCksum = true
* PCAP import test: recalcCksum = false
With the existing implementation, doing PCAP import in 'raw' mode twice
would lead to recalcCksum being checked in the dialog the second time.
This was because we were always forcing it to be true for the GUI case
without checking for anything.
When opening a non-PCAP file, we convert it to intermediate PCAP format.
Use nanosecond pcap format instead of standard microsec pcap format for
higher timestamp resolution.
Updates #238
quint64 has larger range than double so has better accuracy. However,
for calculating packet rate, use floating-point arithmetic since the
packet rate is a double
Updates #238
This was changed so that pcap import test produces minimal diffs like
earlier. However, for user, the import options dialog overrules this
default, so that user default remains recalcCksum as true
The earlier code was trying to reuse the dialog but this was throwing
an unexpected error every time -
External WM_DESTROY received for QWidgetWindow
This commit fixes this error message
Recalculate cksum is now the default.
This behaviour change has been done to facilitate rewriting packet
fields post PCAP import using the new Find & Replace feature. Without
this any change in fields may cause incorrect checksums.
The earlier rationale for retaining the checksums in the PCAP file
during import was to ensure replayed packet was same as the one in the
PCAP file.
User now has a choice with this option.
For UDP encaps like VxLAN or Geneve, which can contain IP as
payload, the UDP checksum was incorrect because when summing
UDP payload (i.e. IP), we skipped the IPv4 checksum field,
which should not be skipped in this case.
Similar issue, for ICMP with IP as payload, ICMP checksum was
incorrect.
Essentially, any protocol which checksums over its payload and
the payload contains protocols with checksum fields.
The frame variable count should be minimum of frame count and frame
length range size.
Unrelated, in case of random payload pattern, reuse
StreamBase::frameCount() which does the same calculation.
Fixes#325
Changed to decimal precision for improved replay accuracy.
For inter packet time > 1s, the integer precision would set up rate as 0
instead of 0.x - this also gets fixed by this change.
Some Wireshark/tshark versions have ip.flags as u16 instead of u8. Code
changed to be able to handle both.
Tested with Wireshark 3.2.4 (u16) and 1.14 (u8)
FieldValue, FieldFrameValue, FieldTextValue were all fixed. This used to
work earlier. I think somewhere across Qt versions, QByteArray() and
QString() changed such that it broke. Or more likely I was using those
incorrectly earlier but output was still correct which is no longer
true.
Anyway, it should be ok going forward (hopefully!)
Looks like starting somewhere in Wireshark 2.x, when we give -x to
tshark, we also need to explicitly give -P to include the one-line
summary of the packet. This one-line summary is used in the diff to find
out which packets experienced a diff.
Also found and fixed another related bug where the loop to check pkt
size for trunc/jumbo ran for frameCount instead of
frameSizeVariableCount() - this change will reduce preflight check time
when frameSizeVariableCount is less than frameCount
Fixes#290
The old mask 009.009.009.009 does not compute to valid for input 1.2.3.4
and the Qt delegate doesn't accept it with Qt5 (not the case with Qt4)
Although the new mask 000.000.000.000 cannot prevent invalid entries
like 1.2.. or 300.400.500.600, I decided it was better to accept invalid
input (which gets converted to 0.0.0.0) instead of unintentionally not
allowing valid entries.
Fixes#292
