Commit graph

10 commits

Author SHA1 Message Date
Tim Wojtulewicz
54752ef9a1 Deprecate the internal int/uint types in favor of the cstdint types they were based on 2019-08-12 13:50:07 -07:00
Vern Paxson
9c8ad11d92 Refined state machine update placement to (1) properly deal with gaps capped
by clean FIN handshakes, and (1) fix failure to detect split routing.

Fixed typo flagged by Pierre Lalet.
2019-04-22 09:13:23 -07:00
Vern Paxson
915189a06a added 'g' $history character for content gaps 2019-04-17 14:20:48 -07:00
Jon Siwek
5804c940f1 Merge remote-tracking branch 'origin/topic/vern/perf-history'
* origin/topic/vern/perf-history:
  only generate history threshold events for > 1 instance mention those events in NEWS
  a different sort of history update
  'W' for zero window implemented; logarithmic 'T'/'C'/'W' history repetitions

I reverted a change that made TCP window tracking unconditional (possibly
accepting out-of-order packets) until further verification of test suite
changes.
2018-08-01 16:37:10 -05:00
Vern Paxson
73349362a3 'W' for zero window implemented; logarithmic 'T'/'C'/'W' history repetitions 2018-07-09 13:05:10 -07:00
Robin Sommer
394b16e1f2 Flagging retransmissions in connection history.
This adds a t/T letter for the first TCP payload retransmission from
originator or responder, respectively.

Addresses BIT-977.
2016-07-06 15:01:16 -07:00
Robin Sommer
bd64e52782 Fixing compiler warnings. 2014-04-24 18:14:18 -07:00
Robin Sommer
116ed370a2 Merge remote-tracking branch 'origin/topic/jsiwek/bit-348'
* origin/topic/jsiwek/bit-348:
  Update SNMP analyzer's DeliverPacket method signature.
  Fix reassembly of data w/ sizes beyond 32-bit capacities (BIT-348).

Conflicts:
	src/analyzer/protocol/file/File.cc
	src/analyzer/protocol/file/File.h
2014-04-24 18:14:04 -07:00
Jon Siwek
2b3c2bd394 Fix reassembly of data w/ sizes beyond 32-bit capacities (BIT-348).
The main change is that reassembly code (e.g. for TCP) now uses
int64/uint64 (signedness is situational) data types in place of int
types in order to support delivering data to analyzers that pass 2GB
thresholds.  There's also changes in logic that accompany the change in
data types, e.g. to fix TCP sequence space arithmetic inconsistencies.

Another significant change is in the Analyzer API: the *Packet and
*Undelivered methods now use a uint64 in place of an int for the
relative sequence space offset parameter.
2014-04-09 13:03:24 -05:00
Robin Sommer
4bc2ba60c9 Rename analyzer/protocols -> analyzer/protocol 2013-04-19 15:50:57 -07:00
Renamed from src/analyzer/protocols/tcp/TCP_Endpoint.h (Browse further)