Protobuf string type should be treated as a Python unicode string usable
in both Python 2.x and Python 3.x. Since we are now using unicode strings,
force encoding as utf-8.
Protobuf bytes type should be treated as a Python byte string. Use hex
values in byte literal even for printable characters, for a better UX.
escapeString() is no longer being used, but has been retained in the
code.
For same protocol numbers (e.g. IP 4o4), use Outer/Inner as prefix. For
"similar" protocols like VlanStack or IP 4o6, use the protocol name as
the prefix.
If a packet does not have a sign/guid, use an invalid guid instead of 0
as the default, so that these packets get tracked against the invalid
guid which can be excluded while updating the port's stream stats.
* frameFieldCount() always includes all frame fields whether or not
included in packet
* if an optional field is not included in packet
- FieldName is still returned
- FieldTextValue is returned as "<not-included>"
- FieldBitWidth is 0
- all remaining attributes are QVariant()
These are the existing and desired defaults -
* GUI: recalcCksum = true
* PCAP import test: recalcCksum = false
With the existing implementation, doing PCAP import in 'raw' mode twice
would lead to recalcCksum being checked in the dialog the second time.
This was because we were always forcing it to be true for the GUI case
without checking for anything.
When opening a non-PCAP file, we convert it to intermediate PCAP format.
Use nanosecond pcap format instead of standard microsec pcap format for
higher timestamp resolution.
Updates #238
quint64 has larger range than double so has better accuracy. However,
for calculating packet rate, use floating-point arithmetic since the
packet rate is a double
Updates #238
This was changed so that pcap import test produces minimal diffs like
earlier. However, for user, the import options dialog overrules this
default, so that user default remains recalcCksum as true
The earlier code was trying to reuse the dialog but this was throwing
an unexpected error every time -
External WM_DESTROY received for QWidgetWindow
This commit fixes this error message
Recalculate cksum is now the default.
This behaviour change has been done to facilitate rewriting packet
fields post PCAP import using the new Find & Replace feature. Without
this any change in fields may cause incorrect checksums.
The earlier rationale for retaining the checksums in the PCAP file
during import was to ensure replayed packet was same as the one in the
PCAP file.
User now has a choice with this option.
For UDP encaps like VxLAN or Geneve, which can contain IP as
payload, the UDP checksum was incorrect because when summing
UDP payload (i.e. IP), we skipped the IPv4 checksum field,
which should not be skipped in this case.
Similar issue, for ICMP with IP as payload, ICMP checksum was
incorrect.
Essentially, any protocol which checksums over its payload and
the payload contains protocols with checksum fields.
The frame variable count should be minimum of frame count and frame
length range size.
Unrelated, in case of random payload pattern, reuse
StreamBase::frameCount() which does the same calculation.
Fixes#325
Changed to decimal precision for improved replay accuracy.
For inter packet time > 1s, the integer precision would set up rate as 0
instead of 0.x - this also gets fixed by this change.
Some Wireshark/tshark versions have ip.flags as u16 instead of u8. Code
changed to be able to handle both.
Tested with Wireshark 3.2.4 (u16) and 1.14 (u8)
