epan/dissectors/pidl/samr/samr.cnf cnf_dissect_lsa_BinaryString => lsarpc_dissect_str...
[wireshark-sm.git] / epan / dissectors / packet-mp2t.c
blob0fc346dedf0257f19f19ab656a5a6d238e6e6559
1 /* packet-mp2t.c
3 * Routines for RFC 2250 MPEG2 (ISO/IEC 13818-1) Transport Stream dissection
5 * Copyright 2006, Erwin Rol <erwin@erwinrol.com>
6 * Copyright 2012-2014, Guy Martin <gmsoft@tuxicoman.be>
8 * Wireshark - Network traffic analyzer
9 * By Gerald Combs <gerald@wireshark.org>
10 * Copyright 1998 Gerald Combs
12 * SPDX-License-Identifier: GPL-2.0-or-later
15 #include "config.h"
17 #include <epan/packet.h>
18 #include <wiretap/wtap.h>
20 #include <epan/rtp_pt.h>
22 #include <epan/conversation.h>
23 #include <epan/expert.h>
24 #include <epan/reassemble.h>
25 #include <epan/proto_data.h>
26 #include <epan/exported_pdu.h>
27 #include <epan/tap.h>
28 #include <epan/exceptions.h>
29 #include <epan/show_exception.h>
30 #include "packet-l2tp.h"
31 #include "packet-mp2t.h"
33 void proto_register_mp2t(void);
34 void proto_reg_handoff_mp2t(void);
36 #define MP2T_PID_DOCSIS 0x1FFE
37 #define MP2T_PID_NULL 0x1FFF
39 static dissector_handle_t mp2t_handle;
41 static dissector_handle_t docsis_handle;
42 static dissector_handle_t mpeg_pes_handle;
43 static dissector_handle_t mpeg_sect_handle;
45 static heur_dissector_list_t heur_subdissector_list;
47 static int exported_pdu_tap;
49 static int proto_mp2t;
50 static int ett_mp2t;
51 static int ett_mp2t_header;
52 static int ett_mp2t_af;
53 static int ett_mp2t_analysis;
54 static int ett_stuff;
56 static int hf_mp2t_header;
57 static int hf_mp2t_sync_byte;
58 static int hf_mp2t_tei;
59 static int hf_mp2t_pusi;
60 static int hf_mp2t_tp;
61 static int hf_mp2t_pid;
62 static int hf_mp2t_tsc;
63 static int hf_mp2t_afc;
64 static int hf_mp2t_cc;
66 /* static int hf_mp2t_analysis_flags; */
67 static int hf_mp2t_analysis_skips;
68 static int hf_mp2t_analysis_drops;
70 #define MP2T_SYNC_BYTE_MASK 0xFF000000
71 #define MP2T_TEI_MASK 0x00800000
72 #define MP2T_PUSI_MASK 0x00400000
73 #define MP2T_TP_MASK 0x00200000
74 #define MP2T_PID_MASK 0x001FFF00
75 #define MP2T_TSC_MASK 0x000000C0
76 #define MP2T_AFC_MASK 0x00000030
77 #define MP2T_CC_MASK 0x0000000F
79 #define MP2T_SYNC_BYTE_SHIFT 24
80 #define MP2T_TEI_SHIFT 23
81 #define MP2T_PUSI_SHIFT 22
82 #define MP2T_TP_SHIFT 21
83 #define MP2T_PID_SHIFT 8
84 #define MP2T_TSC_SHIFT 6
85 #define MP2T_AFC_SHIFT 4
86 #define MP2T_CC_SHIFT 0
88 static int hf_mp2t_af;
89 static int hf_mp2t_af_length;
90 static int hf_mp2t_af_di;
91 static int hf_mp2t_af_rai;
92 static int hf_mp2t_af_espi;
93 static int hf_mp2t_af_pcr_flag;
94 static int hf_mp2t_af_opcr_flag;
95 static int hf_mp2t_af_sp_flag;
96 static int hf_mp2t_af_tpd_flag;
97 static int hf_mp2t_af_afe_flag;
99 #define MP2T_AF_DI_MASK 0x80
100 #define MP2T_AF_RAI_MASK 0x40
101 #define MP2T_AF_ESPI_MASK 0x20
102 #define MP2T_AF_PCR_MASK 0x10
103 #define MP2T_AF_OPCR_MASK 0x08
104 #define MP2T_AF_SP_MASK 0x04
105 #define MP2T_AF_TPD_MASK 0x02
106 #define MP2T_AF_AFE_MASK 0x01
108 #define MP2T_AF_DI_SHIFT 7
109 #define MP2T_AF_RAI_SHIFT 6
110 #define MP2T_AF_ESPI_SHIFT 5
111 #define MP2T_AF_PCR_SHIFT 4
112 #define MP2T_AF_OPCR_SHIFT 3
113 #define MP2T_AF_SP_SHIFT 2
114 #define MP2T_AF_TPD_SHIFT 1
115 #define MP2T_AF_AFE_SHIFT 0
117 static int hf_mp2t_af_pcr;
118 static int hf_mp2t_af_opcr;
120 static int hf_mp2t_af_sc;
122 static int hf_mp2t_af_tpd_length;
123 static int hf_mp2t_af_tpd;
125 static int hf_mp2t_af_e_length;
126 static int hf_mp2t_af_e_ltw_flag;
127 static int hf_mp2t_af_e_pr_flag;
128 static int hf_mp2t_af_e_ss_flag;
129 static int hf_mp2t_af_e_reserved;
131 #define MP2T_AF_E_LTW_FLAG_MASK 0x80
132 #define MP2T_AF_E_PR_FLAG_MASK 0x40
133 #define MP2T_AF_E_SS_FLAG_MASK 0x20
135 static int hf_mp2t_af_e_reserved_bytes;
136 static int hf_mp2t_af_stuffing_bytes;
138 static int hf_mp2t_af_e_ltwv_flag;
139 static int hf_mp2t_af_e_ltwo;
141 static int hf_mp2t_af_e_pr_reserved;
142 static int hf_mp2t_af_e_pr;
144 static int hf_mp2t_af_e_st;
145 static int hf_mp2t_af_e_dnau_32_30;
146 static int hf_mp2t_af_e_m_1;
147 static int hf_mp2t_af_e_dnau_29_15;
148 static int hf_mp2t_af_e_m_2;
149 static int hf_mp2t_af_e_dnau_14_0;
150 static int hf_mp2t_af_e_m_3;
152 /* static int hf_mp2t_payload; */
153 static int hf_mp2t_stuff_bytes;
154 static int hf_mp2t_pointer;
156 /* proto data keys. Note that the packet_analysis_data structure is stored
157 * using the layer number, but since that is at wmem_file_scope() while
158 * the stream information is at pinfo->pool, they don't actually clash.
160 #define MP2T_PROTO_DATA_STREAM 1
162 static const value_string mp2t_sync_byte_vals[] = {
163 { MP2T_SYNC_BYTE, "Correct" },
164 { 0, NULL }
167 static const value_string mp2t_pid_vals[] = {
168 { 0x0000, "Program Association Table" },
169 { 0x0001, "Conditional Access Table" },
170 { 0x0002, "Transport Stream Description Table" },
171 { 0x0003, "Reserved" },
172 { 0x0004, "Reserved" },
173 { 0x0005, "Reserved" },
174 { 0x0006, "Reserved" },
175 { 0x0007, "Reserved" },
176 { 0x0008, "Reserved" },
177 { 0x0009, "Reserved" },
178 { 0x000A, "Reserved" },
179 { 0x000B, "Reserved" },
180 { 0x000C, "Reserved" },
181 { 0x000D, "Reserved" },
182 { 0x000E, "Reserved" },
183 { 0x000F, "Reserved" },
184 { 0x0010, "Network Information or Stuffing Table" },
185 { 0x0011, "Service Description or Bouquet Association or Stuffing Table" },
186 { 0x0012, "Event Information or Stuffing or Content Identifier Table" },
187 { 0x0013, "Running Status or Stuffing Table" },
188 { 0x0014, "Time and Date or Time Offset or Stuffing Table" },
189 { 0x0015, "Network Synchronization" },
190 { 0x0016, "Resolution Authority Record Notification Table" },
191 { 0x0017, "Reserved For Future Use" },
192 { 0x0018, "Reserved For Future Use" },
193 { 0x0019, "Reserved For Future Use" },
194 { 0x001A, "Reserved For Future Use" },
195 { 0x001B, "Reserved For Future Use" },
196 { 0x001C, "Inband Signaling" },
197 { 0x001D, "Measurement" },
198 { 0x001E, "Discontinuity Information Table" },
199 { 0x001F, "Selection Information Table" },
200 { 0x1FFE, "DOCSIS Data-over-cable well-known PID" },
201 { 0x1FFF, "Null packet" },
202 { 0, NULL }
206 /* Values below according ETSI ETR 289 */
207 static const value_string mp2t_tsc_vals[] = {
208 { 0, "Not scrambled" },
209 { 1, "Reserved" },
210 { 2, "Packet scrambled with Even Key" },
211 { 3, "Packet scrambled with Odd Key" },
212 { 0, NULL }
215 static const value_string mp2t_afc_vals[] = {
216 { 0, "Reserved" },
217 { 1, "Payload only" },
218 { 2, "Adaptation Field only" },
219 { 3, "Adaptation Field and Payload" },
220 { 0, NULL }
223 static int ett_msg_fragment;
224 static int ett_msg_fragments;
225 static int hf_msg_fragments;
226 static int hf_msg_fragment;
227 static int hf_msg_fragment_overlap;
228 static int hf_msg_fragment_overlap_conflicts;
229 static int hf_msg_fragment_multiple_tails;
230 static int hf_msg_fragment_too_long_fragment;
231 static int hf_msg_fragment_error;
232 static int hf_msg_fragment_count;
233 static int hf_msg_reassembled_in;
234 static int hf_msg_reassembled_length;
236 static int hf_msg_ts_packet_reassembled;
238 static expert_field ei_mp2t_pointer;
239 static expert_field ei_mp2t_cc_drop;
240 static expert_field ei_mp2t_invalid_afc;
242 static const fragment_items mp2t_msg_frag_items = {
243 /* Fragment subtrees */
244 &ett_msg_fragment,
245 &ett_msg_fragments,
246 /* Fragment fields */
247 &hf_msg_fragments,
248 &hf_msg_fragment,
249 &hf_msg_fragment_overlap,
250 &hf_msg_fragment_overlap_conflicts,
251 &hf_msg_fragment_multiple_tails,
252 &hf_msg_fragment_too_long_fragment,
253 &hf_msg_fragment_error,
254 &hf_msg_fragment_count,
255 /* Reassembled in field */
256 &hf_msg_reassembled_in,
257 /* Reassembled length field */
258 &hf_msg_reassembled_length,
259 /* Reassembled data field */
260 NULL,
261 /* Tag */
262 "Message fragments"
266 /* Data structure used for detecting CC drops
268 * conversation + direction
270 * +-> mp2t_analysis_data
272 * +-> pid_table (RB tree) (key: pid)
273 * | |
274 * | +-> pid_analysis_data (per pid)
275 * | +-> pid_analysis_data
276 * | +-> pid_analysis_data
278 * +-> frame_table (RB tree) (key: pinfo->num)
280 * +-> frame_analysis_data (only created if drop detected)
282 * +-> ts_table (RB tree)
284 * +-> ts_analysis_data (per TS subframe)
285 * +-> ts_analysis_data
286 * +-> ts_analysis_data
289 static wmem_map_t *mp2t_stream_hashtable;
291 typedef struct {
292 const conversation_t* conv;
293 int dir;
294 } mp2t_stream_key;
296 /* Hash functions */
297 static int
298 mp2t_stream_equal(const void *v, const void *w)
300 const mp2t_stream_key *v1 = (const mp2t_stream_key *)v;
301 const mp2t_stream_key *v2 = (const mp2t_stream_key *)w;
302 int result;
303 result = (v1->conv == v2->conv && v1->dir == v2->dir);
304 return result;
307 static unsigned
308 mp2t_stream_hash(const void *v)
310 const mp2t_stream_key *key = (const mp2t_stream_key *)v;
311 /* Actually getting multiple streams in opposite directions is
312 * quite unlikely, so to optimize don't include it in the hash */
313 unsigned hash_val = GPOINTER_TO_UINT(key->conv);
314 return hash_val;
317 typedef struct mp2t_analysis_data {
319 /* This structure contains a tree containing data for the
320 * individual pid's, this is only used when packets are
321 * processed sequentially.
323 wmem_tree_t *pid_table;
325 /* When detecting a CC drop, store that information for the
326 * given frame. This info is needed, when clicking around in
327 * wireshark, as the pid table data only makes sense during
328 * sequential processing. The flag pinfo->fd->visited is
329 * used to tell the difference.
332 wmem_tree_t *frame_table;
334 /* Total counters per conversation / multicast stream */
335 uint32_t total_skips;
336 uint32_t total_discontinuity;
338 } mp2t_analysis_data_t;
340 enum pid_payload_type {
341 pid_pload_unknown,
342 pid_pload_docsis,
343 pid_pload_pes,
344 pid_pload_sect,
345 pid_pload_null
348 typedef struct subpacket_analysis_data {
349 uint32_t frag_cur_pos;
350 uint32_t frag_tot_len;
351 bool fragmentation;
352 uint32_t frag_id;
353 } subpacket_analysis_data_t;
355 typedef struct packet_analysis_data {
357 /* Contain information for each MPEG2-TS packet in the current big packet */
358 wmem_tree_t *subpacket_table;
359 } packet_analysis_data_t;
361 /* Analysis TS frame info needed during sequential processing */
362 typedef struct pid_analysis_data {
363 uint16_t pid;
364 int8_t cc_prev; /* Previous CC number */
365 enum pid_payload_type pload_type;
366 wmem_tree_t *stream_types;
368 /* Fragments information used for first pass */
369 bool fragmentation;
370 uint32_t frag_cur_pos;
371 uint32_t frag_tot_len;
372 uint32_t frag_id;
373 } pid_analysis_data_t;
375 /* Analysis info stored for a TS frame */
376 typedef struct ts_analysis_data {
377 uint16_t pid;
378 int8_t cc_prev; /* Previous CC number */
379 uint8_t skips; /* Skips between Ccs max 14 */
380 } ts_analysis_data_t;
383 typedef struct frame_analysis_data {
385 /* As each frame has several pid's, thus need a pid data
386 * structure per TS frame.
388 wmem_tree_t *ts_table;
390 } frame_analysis_data_t;
392 static mp2t_analysis_data_t *
393 init_mp2t_conversation_data(void)
395 mp2t_analysis_data_t *mp2t_data;
397 mp2t_data = wmem_new0(wmem_file_scope(), struct mp2t_analysis_data);
399 mp2t_data->pid_table = wmem_tree_new(wmem_file_scope());
401 mp2t_data->frame_table = wmem_tree_new(wmem_file_scope());
403 mp2t_data->total_skips = 0;
404 mp2t_data->total_discontinuity = 0;
406 return mp2t_data;
409 static mp2t_analysis_data_t *
410 get_mp2t_conversation_data(mp2t_stream_key *key)
412 mp2t_stream_key *new_key;
413 mp2t_analysis_data_t *mp2t_data;
415 mp2t_data = (mp2t_analysis_data_t *)wmem_map_lookup(mp2t_stream_hashtable, key);
416 if (!mp2t_data) {
417 new_key = wmem_new(wmem_file_scope(), mp2t_stream_key);
418 *new_key = *key;
419 mp2t_data = init_mp2t_conversation_data();
420 wmem_map_insert(mp2t_stream_hashtable, new_key, mp2t_data);
423 return mp2t_data;
426 static frame_analysis_data_t *
427 init_frame_analysis_data(mp2t_analysis_data_t *mp2t_data, packet_info *pinfo)
429 frame_analysis_data_t *frame_analysis_data_p;
431 frame_analysis_data_p = wmem_new0(wmem_file_scope(), struct frame_analysis_data);
432 frame_analysis_data_p->ts_table = wmem_tree_new(wmem_file_scope());
433 /* Insert into mp2t tree */
434 wmem_tree_insert32(mp2t_data->frame_table, pinfo->num,
435 (void *)frame_analysis_data_p);
437 return frame_analysis_data_p;
441 static frame_analysis_data_t *
442 get_frame_analysis_data(mp2t_analysis_data_t *mp2t_data, packet_info *pinfo)
444 frame_analysis_data_t *frame_analysis_data_p;
445 frame_analysis_data_p = (frame_analysis_data_t *)wmem_tree_lookup32(mp2t_data->frame_table, pinfo->num);
446 return frame_analysis_data_p;
449 static pid_analysis_data_t *
450 get_pid_analysis(mp2t_analysis_data_t *mp2t_data, uint32_t pid)
452 pid_analysis_data_t *pid_data;
454 pid_data = (pid_analysis_data_t *)wmem_tree_lookup32(mp2t_data->pid_table, pid);
455 if (!pid_data) {
456 pid_data = wmem_new0(wmem_file_scope(), struct pid_analysis_data);
457 pid_data->cc_prev = -1;
458 pid_data->pid = pid;
459 pid_data->stream_types = wmem_tree_new(wmem_file_scope());
460 pid_data->frag_id = (pid << (32 - 13)) | 0x1;
462 wmem_tree_insert32(mp2t_data->pid_table, pid, (void *)pid_data);
464 return pid_data;
467 /* Structure to handle packets, spanned across
468 * multiple MPEG packets
471 /* Reassembly functions */
472 typedef struct _mp2t_fragment_key {
473 uint32_t conv_index; /* Just use the unique index */
474 int dir;
475 uint32_t id;
476 } mp2t_fragment_key;
478 static unsigned
479 mp2t_fragment_hash(const void *k)
481 const mp2t_fragment_key* key = (const mp2t_fragment_key*) k;
482 unsigned hash_val;
484 hash_val = 0;
486 /* In most captures there is only one conversation so optimize on
487 * only using the id for the hash. */
488 // hash_val += (key->conv_index << 2) + key->dir;
490 hash_val ^= key->id;
492 return hash_val;
495 static int
496 mp2t_fragment_equal(const void *k1, const void *k2)
498 const mp2t_fragment_key* key1 = (const mp2t_fragment_key*) k1;
499 const mp2t_fragment_key* key2 = (const mp2t_fragment_key*) k2;
501 /* Compare the id first since it's the most likely to differ */
502 return (key1->id == key2->id) &&
503 (key1->conv_index == key2->conv_index) &&
504 (key1->dir == key2->dir);
508 * Create a fragment key for permanent use; we are only copying ints,
509 * so our temporary keys are the same as permanent ones.
511 static void *
512 mp2t_fragment_persistent_key(const packet_info *pinfo _U_, const uint32_t id, const void *data)
514 mp2t_fragment_key *key = g_slice_new(mp2t_fragment_key);
515 DISSECTOR_ASSERT(data);
516 mp2t_stream_key *stream = (mp2t_stream_key *)data;
518 key->conv_index = stream->conv->conv_index;
519 key->dir = stream->dir;
520 key->id = id;
522 return (void *)key;
525 static void
526 mp2t_fragment_free_persistent_key(void *ptr)
528 mp2t_fragment_key *key = (mp2t_fragment_key *)ptr;
529 g_slice_free(mp2t_fragment_key, key);
532 static const reassembly_table_functions
533 mp2t_reassembly_table_functions = {
534 mp2t_fragment_hash,
535 mp2t_fragment_equal,
536 mp2t_fragment_persistent_key,
537 mp2t_fragment_persistent_key,
538 mp2t_fragment_free_persistent_key,
539 mp2t_fragment_free_persistent_key
542 static reassembly_table mp2t_reassembly_table;
544 void
545 mp2t_add_stream_type(packet_info *pinfo, uint32_t pid, uint32_t stream_type)
547 mp2t_stream_key *stream;
549 stream = (mp2t_stream_key *)p_get_proto_data(pinfo->pool, pinfo, proto_mp2t, MP2T_PROTO_DATA_STREAM);
550 if (!stream) {
551 return;
554 mp2t_analysis_data_t *mp2t_data = get_mp2t_conversation_data(stream);
555 pid_analysis_data_t *pid_data = get_pid_analysis(mp2t_data, pid);
557 if (!pid_data->stream_types) {
558 pid_data->stream_types = wmem_tree_new(wmem_file_scope());
561 wmem_tree_insert32(pid_data->stream_types, pinfo->num, GUINT_TO_POINTER(stream_type));
564 static void
565 mp2t_dissect_packet(tvbuff_t *tvb, const pid_analysis_data_t *pid_analysis,
566 packet_info *pinfo, proto_tree *tree)
568 switch (pid_analysis->pload_type) {
569 case pid_pload_docsis:
570 call_dissector(docsis_handle, tvb, pinfo, tree);
571 break;
572 case pid_pload_pes:
573 call_dissector_with_data(mpeg_pes_handle, tvb, pinfo, tree, wmem_tree_lookup32_le(pid_analysis->stream_types, pinfo->num));
574 break;
575 case pid_pload_sect:
576 call_dissector(mpeg_sect_handle, tvb, pinfo, tree);
577 break;
578 default:
579 /* Should not happen */
580 call_data_dissector(tvb, pinfo, tree);
581 break;
585 /* Determine the length of a payload packet. If there aren't enough
586 * bytes to determine the length, returns -1. This will usually be
587 * called on the first fragment of a packet, but will be called
588 * on the second fragment if it returned -1 previously. (Returning
589 * -1 a second time indicates issues with dropped packets, etc.)
591 static unsigned
592 mp2t_get_packet_length(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
593 uint32_t frag_id, enum pid_payload_type pload_type)
595 mp2t_stream_key *stream;
596 fragment_head *frag_head;
597 fragment_item *frag = NULL;
598 tvbuff_t *len_tvb = NULL, *frag_tvb = NULL, *data_tvb = NULL;
599 int pkt_len = 0;
600 unsigned remaining_len;
602 stream = (mp2t_stream_key *)p_get_proto_data(pinfo->pool, pinfo, proto_mp2t, MP2T_PROTO_DATA_STREAM);
603 if (pinfo->fd->visited) {
604 frag_head = fragment_get_reassembled_id(&mp2t_reassembly_table, pinfo, frag_id);
605 if (frag_head) {
606 len_tvb = frag_head->tvb_data;
607 offset = 0;
608 } else {
609 /* Not reassembled on the first pass. There are two possibilities:
610 * 1) An entire packet contained within a TSP, so it never was
611 * put in the table.
612 * 2) Dangling fragments at the end of the capture.
614 frag_head = fragment_get(&mp2t_reassembly_table, pinfo, frag_id, stream);
615 if (!frag_head) {
616 /* This is the entire packet */
617 len_tvb = tvb;
618 } else {
619 /* Dangling packets at the end that failed to reassemble the
620 * first time around, so don't bother this time
622 return -1;
625 } else {
626 frag_head = fragment_get(&mp2t_reassembly_table, pinfo, frag_id, stream);
627 if (frag_head) {
628 frag = frag_head->next;
631 if (!frag) { /* First frame */
632 len_tvb = tvb;
633 } else {
634 /* Create a composite tvb out of the two */
635 frag_tvb = tvb_new_subset_remaining(frag->tvb_data, 0);
636 len_tvb = tvb_new_composite();
637 tvb_composite_append(len_tvb, frag_tvb);
639 data_tvb = tvb_new_subset_remaining(tvb, offset);
640 tvb_composite_append(len_tvb, data_tvb);
641 tvb_composite_finalize(len_tvb);
643 offset = frag->offset;
647 /* Get the next packet's size if possible; if not, return -1 */
648 remaining_len = tvb_reported_length_remaining(len_tvb, offset);
649 /* Normally the only time we would not enough info to determine the size
650 * of the encapsulated packet is when the first fragment is at the very end
651 * of a TSP, but prevent exceptions in the case of dropped and OOO frames.
653 switch (pload_type) {
654 case pid_pload_docsis:
655 if (remaining_len < 4)
656 return -1;
657 pkt_len = tvb_get_ntohs(len_tvb, offset + 2) + 6;
658 break;
659 case pid_pload_pes:
660 if (remaining_len < 6)
661 return -1;
662 pkt_len = tvb_get_ntohs(len_tvb, offset + 4);
663 if (pkt_len) /* A size of 0 means size not bounded */
664 pkt_len += 6;
665 break;
666 case pid_pload_sect:
667 if (remaining_len < 3)
668 return -1;
669 pkt_len = (tvb_get_ntohs(len_tvb, offset + 1) & 0xFFF) + 3;
670 break;
671 default:
672 /* Should not happen */
673 break;
676 return pkt_len;
679 static void
680 mp2t_fragment_handle(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
681 proto_tree *tree, uint32_t frag_id,
682 unsigned frag_offset, unsigned frag_len,
683 bool fragment_last, const pid_analysis_data_t *pid_analysis)
685 fragment_head *frag_msg;
686 proto_item *ti;
687 tvbuff_t *new_tvb;
688 const char *save_proto;
689 mp2t_stream_key *stream;
690 bool save_fragmented;
692 save_fragmented = pinfo->fragmented;
693 pinfo->fragmented = true;
694 /* It's possible that a fragment in the same packet set an address already
695 * (e.g., with MPE), which is why we use the conversation and direction not
696 * the addresses in the packet_info to reassemble.
699 stream = (mp2t_stream_key *)p_get_proto_data(pinfo->pool, pinfo, proto_mp2t, MP2T_PROTO_DATA_STREAM);
700 /* check length; send frame for reassembly */
701 frag_msg = fragment_add_check(&mp2t_reassembly_table,
702 tvb, offset, pinfo, frag_id, stream,
703 frag_offset,
704 frag_len,
705 !fragment_last);
707 /* We only want to call subdissectors on the last fragment.
708 * processed_reassembled_data checks the frame number and layer number,
709 * but when there is more than one TSP in a frame, the fragment at the
710 * end of one TSP and the first fragment of the next have the same layer
711 * number. So use our own information about whether this is the last
712 * fragment to avoid calling subdissectors early and often.
714 if (fragment_last) {
715 new_tvb = process_reassembled_data(tvb, offset, pinfo,
716 "Reassembled MP2T",
717 frag_msg, &mp2t_msg_frag_items,
718 NULL, tree);
719 } else {
720 new_tvb = NULL;
721 if (frag_msg != NULL) {
722 ti = proto_tree_add_uint(tree, hf_msg_reassembled_in, tvb, 0, 0, frag_msg->reassembled_in);
723 proto_item_set_generated(ti);
727 if (new_tvb) {
728 proto_tree_add_item(tree, hf_msg_ts_packet_reassembled, tvb, 0, 0, ENC_NA);
729 save_proto = pinfo->current_proto;
731 * Dissect the reassembled packet.
733 * Because there isn't an explicit fragment ID (other than one
734 * we've made ourselves) if frames were dropped or out of order
735 * it's quite likely that a subdissector throws an exception.
736 * However, that doesn't mean we must stop dissecting, since we have
737 * the pointer to where the next upper level packet begins in the
738 * TSP begins. (Also, we want to make sure we increment our fragment
739 * ID and store the packet analysis data, which happens after this
740 * back in the calling function.)
742 TRY {
743 mp2t_dissect_packet(new_tvb, pid_analysis, pinfo, tree);
745 CATCH_NONFATAL_ERRORS {
746 show_exception(tvb, pinfo, tree, EXCEPT_CODE, GET_MESSAGE);
748 pinfo->current_proto = save_proto;
750 ENDTRY;
751 } else {
752 col_set_str(pinfo->cinfo, COL_INFO, "[MP2T fragment of a reassembled packet]");
755 pinfo->fragmented = save_fragmented;
760 * Reassembly of various payload types.
762 * DOCSIS MAC frames, PES packets, etc. may begin anywhere within an MPEG-TS
763 * packet or span multiple MPEG packets.
765 * The payload_unit_start_indicator bit in the MPEG-TS header, and the pointer
766 * field, are used to reassemble fragmented frames from MPEG-TS packets.
768 * If that bit is set, a higher-level packet begins in this MPEG-TS
769 * packet, and the MPEG-TS header is followed by a 1-octet pointer field.
770 * The value of the pointer field indicates at which byte the higher-
771 * level packet begins. If that bit is not set, the packet begun in
772 * an earlier MPEG-TS packet continues in this packet, with the data
773 * in the payload going after the data in the previous MPEG-TS packet
774 * (there can be more than one continuing packet).
776 * If the pointer field is non-zero, this MPEG-TS packet contains
777 * the conclusion of one higher-level packet and the beginning of
778 * the next packet.
780 * As the MPEG-TS packets are of a fixed size, stuff bytes are used
781 * as padding before the first byte of a higher-level packet as
782 * necessary.
784 * This diagram is from Data-Over-Cable Service Interface Specifications,
785 * Downstream RF Interface Specification, CM-SP-DRFI-I16-170111, section 7
786 * "DOWNSTREAM TRANSMISSION CONVERGENCE SUBLAYER", and shows how the
787 * higher-level packets are transported over the MPEG Transport Stream:
789 *+--------------------------------------------------------------------------------+
790 *|MPEG Header | pointer_field | stuff_bytes | Start of Packet #1 |
791 *|(PUSI = 1) | (= 0) | (0 or more) | (up to 183 bytes) |
792 *+--------------------------------------------------------------------------------+
793 *+--------------------------------------------------------------------------------+
794 *|MPEG Header | Continuation of Packet #1 |
795 *|(PUSI = 0) | (up to 183 bytes) |
796 *+--------------------------------------------------------------------------------+
797 *+---------------------------------------------------------------------------------+
798 *|MPEG Header | pointer_field |Tail of Packet #1 | stuff_bytes |Start of Packet #2 |
799 *|(PUSI = 1) | (= M) |(M bytes) | (0 or more) |(N bytes) |
800 *+---------------------------------------------------------------------------------+
802 * For PES and PSI, see ISO/IEC 13818-1 / ITU-T Rec. H.222.0 (05/2006),
803 * section 2.4.3.3 "Semantic definition of fields in Transport Stream packet
804 * layer", which says much the same thing.
806 * When the payload is PES packet data, note that there is no pointer_field;
807 * if the PUSI is 1 then the TS payload "will commence with the first byte
808 * of a PES packet" and "one and only one PES packet starts in this Transport
809 * Stream packet". Furthermore, section 2.4.3.5 "Semantic definition of
810 * fields in adaptation field" mentions that stuffing in an adaptation field
811 * is "the only method of stuffing allowed for Transport Stream packets
812 * carrying PES packets." Thus stuff_bytes is not relevant for MPEG-TS payloads
813 * carrying PES. (It is possible to have stuffing *inside* the PES packet,
814 * as seen in section 2.4.3.6 "PES packet" and 2.4.3.7 "Semantic definition
815 * of fields in PES packet", which is handled in the MPEG PES dissector.)
817 * For MPEG-TS packets carrying PSI (which includes private data sections), an
818 * alternative stuffing method is allowed. This method involves stuff bytes
819 * at the end of a MPEG-TS packet after the last section contained within
820 * (similar to the stuff_bytes that may appear after a continued section
821 * before the byte referenced by pointer_field). According to Section 2.4.4
822 * "Program specific information", once a packet stuffing byte 0xFF appears,
823 * "all bytes until the end of the Transport Stream packet shall also be
824 * stuffing bytes of value 0xFF." In other words, as section C.3 "The Mapping
825 * of Sections into Transport Stream Packets" elaborates, while multiple
826 * entire sections are allowed within a TS packet, "no gaps between sections
827 * within a Transport Stream packet are allowed by the syntax".
829 * However, this function is permissive in what it accepts to the extent
830 * possible; it will allow multiple PES packets in the same TS packet and
831 * stuffing bytes to follow PES packets (at least those that indicate their
832 * length) and will allow stuffing bytes between complete PSI sections.
834 static void
835 mp2t_process_fragmented_payload(tvbuff_t *tvb, int offset, unsigned remaining_len, packet_info *pinfo,
836 proto_tree *tree, proto_tree *header_tree, uint32_t pusi_flag,
837 pid_analysis_data_t *pid_analysis)
839 tvbuff_t *next_tvb;
840 uint8_t pointer = 0;
841 proto_item *pi;
842 unsigned stuff_len = 0;
843 proto_tree *stuff_tree;
844 packet_analysis_data_t *pdata = NULL;
845 subpacket_analysis_data_t *spdata = NULL;
846 uint32_t frag_cur_pos = 0, frag_tot_len = 0;
847 bool fragmentation = false;
848 uint32_t frag_id = 0;
850 if (pusi_flag && pid_analysis->pload_type == pid_pload_unknown
851 && remaining_len > 3) {
852 /* We should already have identified if it was a DOCSIS packet
853 * Remaining possibility is PES or SECT */
854 if (tvb_get_ntoh24(tvb, offset) == 0x000001) {
855 /* Looks like a PES packet to me ... */
856 pid_analysis->pload_type = pid_pload_pes;
857 } else {
858 /* Most probably a SECT packet */
859 pid_analysis->pload_type = pid_pload_sect;
863 /* Unable to determine the payload type, do nothing */
864 if (pid_analysis->pload_type == pid_pload_unknown)
865 return;
867 /* PES packet don't have pointer fields, others do */
868 if (pusi_flag && pid_analysis->pload_type != pid_pload_pes) {
869 pointer = tvb_get_uint8(tvb, offset);
870 pi = proto_tree_add_item(header_tree, hf_mp2t_pointer, tvb, offset, 1, ENC_BIG_ENDIAN);
871 offset++;
872 remaining_len--;
873 if (pointer > remaining_len) {
874 /* Bogus pointer */
875 expert_add_info_format(pinfo, pi, &ei_mp2t_pointer,
876 "Pointer value is too large (> remaining data length %u)",
877 remaining_len);
881 if (!pinfo->fd->visited) {
882 /* Get values from our current PID analysis */
883 frag_cur_pos = pid_analysis->frag_cur_pos;
884 frag_tot_len = pid_analysis->frag_tot_len;
885 fragmentation = pid_analysis->fragmentation;
886 frag_id = pid_analysis->frag_id;
887 pdata = (packet_analysis_data_t *)p_get_proto_data(wmem_file_scope(), pinfo, proto_mp2t, pinfo->curr_layer_num);
888 if (!pdata) {
889 pdata = wmem_new0(wmem_file_scope(), packet_analysis_data_t);
890 pdata->subpacket_table = wmem_tree_new(wmem_file_scope());
891 /* Since the subpacket data is indexed by offset in the tvb,
892 * lacking a fragment id transmitted in the protocol,
893 * we need a different table for each mp2t layer.
895 p_add_proto_data(wmem_file_scope(), pinfo, proto_mp2t, pinfo->curr_layer_num, pdata);
897 } else {
898 spdata = (subpacket_analysis_data_t *)wmem_tree_lookup32(pdata->subpacket_table, offset);
901 if (!spdata) {
902 spdata = wmem_new0(wmem_file_scope(), subpacket_analysis_data_t);
903 /* Save the info into pdata from pid_analysis */
904 spdata->frag_cur_pos = frag_cur_pos;
905 spdata->frag_tot_len = frag_tot_len;
906 spdata->fragmentation = fragmentation;
907 spdata->frag_id = frag_id;
908 wmem_tree_insert32(pdata->subpacket_table, offset, (void *)spdata);
910 } else {
911 /* Get saved values */
912 pdata = (packet_analysis_data_t *)p_get_proto_data(wmem_file_scope(), pinfo, proto_mp2t, pinfo->curr_layer_num);
913 if (!pdata) {
914 /* Occurs for the first packets in the capture which cannot be reassembled */
915 return;
918 spdata = (subpacket_analysis_data_t *)wmem_tree_lookup32(pdata->subpacket_table, offset);
919 if (!spdata) {
920 /* Occurs for the first sub packets in the capture which cannot be reassembled */
921 return;
924 frag_cur_pos = spdata->frag_cur_pos;
925 frag_tot_len = spdata->frag_tot_len;
926 fragmentation = spdata->fragmentation;
927 frag_id = spdata->frag_id;
930 if (frag_tot_len == (unsigned)-1) {
931 /* We couldn't determine the total length of the reassembly from
932 * the first fragment (too short), so get it now that we have the
933 * second fragment.
935 frag_tot_len = mp2t_get_packet_length(tvb, offset, pinfo, frag_id, pid_analysis->pload_type);
937 if (frag_tot_len == (unsigned)-1) {
938 /* We still don't have enough to determine the length; this can
939 * only happen with dropped or out of order packets. Bail out.
940 * XXX: This just skips the packet and tries the next one, but
941 * there are probably better ways to handle it, especially if
942 * the PUSI flag is set in this packet.
944 return;
948 /* The beginning of a new packet is present */
949 if (pusi_flag) {
950 if (pointer > remaining_len) {
952 * Quit, so we don't use the bogus pointer value;
953 * that could cause remaining_len to become
954 * "negative", meaning it becomes a very large
955 * positive value.
957 return;
960 /* "pointer" contains the number of bytes until the
961 * start of the new section
963 * if the new section does not start immediately after the
964 * pointer field (i.e. pointer>0), the remaining bytes before the
965 * start of the section are another fragment of the
966 * current packet
968 * if pointer is 0, a new upper-layer packet starts at the
969 * beginning of this TS packet
970 * if we have pending fragments, the last TS packet contained the
971 * last fragment and at the time we processed it, we couldn't figure
972 * out that it is the last fragment
973 * this is the case e.g. for PES packets with a 0 length field
974 * ("unbounded length")
975 * to handle this case, we add an empty fragment (pointer==0)
976 * and reassemble, then we process the current TS packet as
977 * usual
979 if (fragmentation) {
980 mp2t_fragment_handle(tvb, offset, pinfo, tree, frag_id, frag_cur_pos,
981 pointer, true, pid_analysis);
982 frag_id++;
985 offset += pointer;
986 remaining_len -= pointer;
987 fragmentation = false;
988 frag_cur_pos = 0;
989 frag_tot_len = 0;
991 if (!remaining_len) {
992 /* Shouldn't happen */
993 goto save_state;
996 while (remaining_len > 0) {
997 /* Don't let subsequent packets overwrite the Info column */
998 col_append_str(pinfo->cinfo, COL_INFO, " ");
999 col_set_fence(pinfo->cinfo, COL_INFO);
1001 /* Skip stuff bytes */
1002 stuff_len = 0;
1003 while ((tvb_get_uint8(tvb, offset + stuff_len) == 0xFF)) {
1004 stuff_len++;
1005 if (stuff_len >= remaining_len) {
1006 remaining_len = 0;
1007 break;
1011 if (stuff_len) {
1012 stuff_tree = proto_tree_add_subtree_format(tree, tvb, offset, stuff_len, ett_stuff, NULL, "Stuffing");
1013 proto_tree_add_item(stuff_tree, hf_mp2t_stuff_bytes, tvb, offset, stuff_len, ENC_NA);
1014 offset += stuff_len;
1015 if (stuff_len >= remaining_len) {
1016 goto save_state;
1018 remaining_len -= stuff_len;
1021 /* Get the next packet's size if possible */
1022 frag_tot_len = mp2t_get_packet_length(tvb, offset, pinfo, frag_id, pid_analysis->pload_type);
1023 if (frag_tot_len == (unsigned)-1 || !frag_tot_len) {
1024 mp2t_fragment_handle(tvb, offset, pinfo, tree, frag_id, 0, remaining_len, false, pid_analysis);
1025 fragmentation = true;
1026 /*offset += remaining_len;*/
1027 frag_cur_pos += remaining_len;
1028 goto save_state;
1031 /* Check for full packets within this TS frame */
1032 if (frag_tot_len <= remaining_len) {
1033 next_tvb = tvb_new_subset_length(tvb, offset, frag_tot_len);
1034 mp2t_dissect_packet(next_tvb, pid_analysis, pinfo, tree);
1035 remaining_len -= frag_tot_len;
1036 offset += frag_tot_len;
1037 frag_tot_len = 0;
1038 frag_id++;
1039 } else {
1040 break;
1044 if (remaining_len == 0) {
1045 pid_analysis->frag_cur_pos = 0;
1046 pid_analysis->frag_tot_len = 0;
1047 goto save_state;
1053 /* There are remaining bytes. Add them to the fragment list */
1055 if (frag_tot_len && frag_cur_pos + remaining_len > frag_tot_len) {
1056 /* The case where PUSI was 0, a continuing SECT ended, and stuff
1057 * bytes follow. */
1058 stuff_len = frag_cur_pos + remaining_len - frag_tot_len;
1059 mp2t_fragment_handle(tvb, offset, pinfo, tree, frag_id, frag_cur_pos, remaining_len - stuff_len, true, pid_analysis);
1060 offset += remaining_len - stuff_len;
1061 frag_id++;
1062 fragmentation = false;
1063 frag_cur_pos = 0;
1064 frag_tot_len = 0;
1065 stuff_tree = proto_tree_add_subtree_format(tree, tvb, offset, stuff_len, ett_stuff, NULL, "Stuffing");
1066 proto_tree_add_item(stuff_tree, hf_mp2t_stuff_bytes, tvb, offset, stuff_len, ENC_NA);
1067 } else if ((frag_tot_len && frag_cur_pos + remaining_len == frag_tot_len) || (!frag_tot_len && pusi_flag)) {
1068 mp2t_fragment_handle(tvb, offset, pinfo, tree, frag_id, frag_cur_pos, remaining_len, true, pid_analysis);
1069 frag_id++;
1070 fragmentation = false;
1071 frag_cur_pos = 0;
1072 frag_tot_len = 0;
1073 } else {
1074 mp2t_fragment_handle(tvb, offset, pinfo, tree, frag_id, frag_cur_pos, remaining_len, false, pid_analysis);
1075 fragmentation = true;
1076 frag_cur_pos += remaining_len;
1079 /* XXX: Ideally this would be handled with a TRY...FINALLY or
1080 * similar, with more care taken to keep things consistent even
1081 * with fatal errors in subdissectors.
1083 save_state:
1084 pid_analysis->fragmentation = fragmentation;
1085 pid_analysis->frag_cur_pos = frag_cur_pos;
1086 pid_analysis->frag_tot_len = frag_tot_len;
1087 pid_analysis->frag_id = frag_id;
1092 /* Calc the number of skipped CC numbers. Note that this can easy
1093 * overflow, and a value above 7 indicate several network packets
1094 * could be lost.
1096 static uint32_t
1097 calc_skips(int32_t curr, int32_t prev)
1099 int res;
1101 /* Only count the missing TS frames in between prev and curr.
1102 * The "prev" frame CC number seen is confirmed received, it's
1103 * the next frames CC counter which is the first known missing
1104 * TS frame
1106 prev += 1;
1108 /* Calc missing TS frame 'skips' */
1109 res = curr - prev;
1111 /* Handle wrap around */
1112 if (res < 0)
1113 res += 16;
1115 return res;
1118 #define KEY(pid, cc) ((pid << 4)|cc)
1120 static uint32_t
1121 detect_cc_drops(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo,
1122 uint32_t pid, int32_t cc_curr, mp2t_analysis_data_t *mp2t_data)
1124 int32_t cc_prev = -1;
1125 pid_analysis_data_t *pid_data = NULL;
1126 ts_analysis_data_t *ts_data = NULL;
1127 frame_analysis_data_t *frame_analysis_data_p = NULL;
1128 proto_item *flags_item;
1130 bool detected_drop = false;
1131 uint32_t skips = 0;
1133 /* The initial sequential processing stage */
1134 if (!pinfo->fd->visited) {
1135 /* This is the sequential processing stage */
1136 pid_data = get_pid_analysis(mp2t_data, pid);
1138 cc_prev = pid_data->cc_prev;
1139 pid_data->cc_prev = cc_curr;
1141 /* Null packet always have a CC value equal 0 */
1142 if (pid == 0x1fff)
1143 return 0;
1145 /* Its allowed that (cc_prev == cc_curr) if adaptation field */
1146 if (cc_prev == cc_curr)
1147 return 0;
1149 /* Have not seen this pid before */
1150 if (cc_prev == -1)
1151 return 0;
1153 /* Detect if CC is not increasing by one all the time */
1154 if (cc_curr != ((cc_prev+1) & MP2T_CC_MASK)) {
1155 detected_drop = true;
1157 skips = calc_skips(cc_curr, cc_prev);
1159 mp2t_data->total_skips += skips;
1160 mp2t_data->total_discontinuity++;
1161 /* TODO: if (skips > 7) signal_loss++; ??? */
1165 /* Save the info about the dropped packet */
1166 if (detected_drop && !pinfo->fd->visited) {
1167 /* Lookup frame data, contains TS pid data objects */
1168 frame_analysis_data_p = get_frame_analysis_data(mp2t_data, pinfo);
1169 if (!frame_analysis_data_p)
1170 frame_analysis_data_p = init_frame_analysis_data(mp2t_data, pinfo);
1172 /* Create and store a new TS frame pid_data object.
1173 This indicate that we have a drop
1175 ts_data = wmem_new0(wmem_file_scope(), struct ts_analysis_data);
1176 ts_data->cc_prev = cc_prev;
1177 ts_data->pid = pid;
1178 ts_data->skips = skips;
1179 wmem_tree_insert32(frame_analysis_data_p->ts_table, KEY(pid, cc_curr),
1180 (void *)ts_data);
1183 /* See if we stored info about drops */
1184 if (pinfo->fd->visited) {
1186 /* Lookup frame data, contains TS pid data objects */
1187 frame_analysis_data_p = get_frame_analysis_data(mp2t_data, pinfo);
1188 if (!frame_analysis_data_p)
1189 return 0; /* No stored frame data -> no drops*/
1190 else {
1191 ts_data = (struct ts_analysis_data *)wmem_tree_lookup32(frame_analysis_data_p->ts_table,
1192 KEY(pid, cc_curr));
1194 if (ts_data) {
1195 if (ts_data->skips > 0) {
1196 detected_drop = true;
1197 cc_prev = ts_data->cc_prev;
1198 skips = ts_data->skips;
1204 /* Add info to the proto tree about drops */
1205 if (detected_drop) {
1206 expert_add_info_format(pinfo, tree, &ei_mp2t_cc_drop,
1207 "Detected %d missing TS frames before this (last_cc:%d total skips:%d discontinuity:%d)",
1208 skips, cc_prev,
1209 mp2t_data->total_skips,
1210 mp2t_data->total_discontinuity
1213 flags_item = proto_tree_add_uint(tree, hf_mp2t_analysis_skips,
1214 tvb, 0, 0, skips);
1215 proto_item_set_generated(flags_item);
1217 flags_item = proto_tree_add_uint(tree, hf_mp2t_analysis_drops,
1218 tvb, 0, 0, 1);
1219 proto_item_set_generated(flags_item);
1221 return skips;
1224 static int
1225 dissect_mp2t_adaptation_field(tvbuff_t *tvb, int offset, proto_tree *tree)
1227 int af_start_offset;
1228 proto_item *hi;
1229 proto_tree *mp2t_af_tree;
1230 uint8_t af_length;
1231 uint8_t af_flags;
1232 int stuffing_len;
1234 af_length = tvb_get_uint8(tvb, offset);
1235 proto_tree_add_item(tree, hf_mp2t_af_length, tvb, offset, 1, ENC_BIG_ENDIAN);
1236 offset += 1;
1237 /* fix issues where afc==3 but af_length==0
1238 * Adaptaion field...spec section 2.4.3.5: The value 0 is for inserting a single
1239 * stuffing byte in a Transport Stream packet. When the adaptation_field_control
1240 * value is '11', the value of the adaptation_field_length shall be in the range 0 to 182.
1242 if (af_length == 0)
1243 return offset;
1245 af_start_offset = offset;
1247 hi = proto_tree_add_item( tree, hf_mp2t_af, tvb, offset, af_length, ENC_NA);
1248 mp2t_af_tree = proto_item_add_subtree( hi, ett_mp2t_af );
1250 af_flags = tvb_get_uint8(tvb, offset);
1251 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_di, tvb, offset, 1, ENC_BIG_ENDIAN);
1252 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_rai, tvb, offset, 1, ENC_BIG_ENDIAN);
1253 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_espi, tvb, offset, 1, ENC_BIG_ENDIAN);
1254 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_pcr_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
1255 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_opcr_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
1256 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_sp_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
1257 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_tpd_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
1258 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_afe_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
1259 offset += 1;
1261 if (af_flags & MP2T_AF_PCR_MASK) {
1262 uint64_t pcr_base;
1263 uint16_t pcr_ext;
1265 /* 33 bit PCR base, 6 bit reserved, 9 bit PCR ext */
1266 pcr_base = tvb_get_ntoh48(tvb, offset) >> (48-33);
1267 pcr_ext = (uint16_t)(tvb_get_ntoh48(tvb, offset) & 0x1FF);
1269 proto_tree_add_uint64(mp2t_af_tree, hf_mp2t_af_pcr, tvb, offset, 6,
1270 pcr_base*300 + pcr_ext);
1272 offset += 6;
1275 if (af_flags & MP2T_AF_OPCR_MASK) {
1276 uint64_t opcr_base;
1277 uint16_t opcr_ext;
1279 /* the same format as PCR above */
1280 opcr_base = tvb_get_ntoh48(tvb, offset) >> (48-33);
1281 opcr_ext = (uint16_t)(tvb_get_ntoh48(tvb, offset) & 0x1FF);
1283 proto_tree_add_uint64(mp2t_af_tree, hf_mp2t_af_opcr, tvb, offset, 6,
1284 opcr_base*300 + opcr_ext);
1286 offset += 6;
1289 if (af_flags & MP2T_AF_SP_MASK) {
1290 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_sc, tvb, offset, 1, ENC_BIG_ENDIAN);
1291 offset += 1;
1294 if (af_flags & MP2T_AF_TPD_MASK) {
1295 uint8_t tpd_len;
1297 tpd_len = tvb_get_uint8(tvb, offset);
1298 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_tpd_length, tvb, offset, 1, ENC_BIG_ENDIAN);
1299 offset += 1;
1301 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_tpd, tvb, offset, tpd_len, ENC_NA);
1302 offset += tpd_len;
1305 if (af_flags & MP2T_AF_AFE_MASK) {
1306 uint8_t e_len;
1307 uint8_t e_flags;
1308 int e_start_offset = offset;
1309 int reserved_len = 0;
1311 e_len = tvb_get_uint8(tvb, offset);
1312 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_length, tvb, offset, 1, ENC_BIG_ENDIAN);
1313 offset += 1;
1315 e_flags = tvb_get_uint8(tvb, offset);
1316 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_ltw_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
1317 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_pr_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
1318 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_ss_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
1319 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_reserved, tvb, offset, 1, ENC_BIG_ENDIAN);
1320 offset += 1;
1322 if (e_flags & MP2T_AF_E_LTW_FLAG_MASK) {
1323 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_ltwv_flag, tvb, offset, 2, ENC_BIG_ENDIAN);
1324 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_ltwo, tvb, offset, 2, ENC_BIG_ENDIAN);
1325 offset += 2;
1328 if (e_flags & MP2T_AF_E_PR_FLAG_MASK) {
1329 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_pr_reserved, tvb, offset, 3, ENC_BIG_ENDIAN);
1330 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_pr, tvb, offset, 3, ENC_BIG_ENDIAN);
1331 offset += 3;
1334 if (e_flags & MP2T_AF_E_SS_FLAG_MASK) {
1335 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_st, tvb, offset, 1, ENC_BIG_ENDIAN);
1336 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_dnau_32_30, tvb, offset, 1, ENC_BIG_ENDIAN);
1337 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_m_1, tvb, offset, 1, ENC_BIG_ENDIAN);
1338 offset += 1;
1339 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_dnau_29_15, tvb, offset, 2, ENC_BIG_ENDIAN);
1340 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_m_2, tvb, offset, 2, ENC_BIG_ENDIAN);
1341 offset += 2;
1342 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_dnau_14_0, tvb, offset, 2, ENC_BIG_ENDIAN);
1343 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_m_3, tvb, offset, 2, ENC_BIG_ENDIAN);
1344 offset += 2;
1347 reserved_len = (e_len + 1) - (offset - e_start_offset);
1348 if (reserved_len > 0) {
1349 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_e_reserved_bytes, tvb, offset, reserved_len, ENC_NA);
1350 offset += reserved_len;
1354 stuffing_len = af_length - (offset - af_start_offset);
1355 if (stuffing_len > 0) {
1356 proto_tree_add_item( mp2t_af_tree, hf_mp2t_af_stuffing_bytes, tvb, offset, stuffing_len, ENC_NA);
1357 offset += stuffing_len;
1360 return offset;
1363 static void
1364 dissect_tsp(tvbuff_t *tvb, int offset, packet_info *pinfo,
1365 proto_tree *tree, mp2t_analysis_data_t *mp2t_data)
1367 uint32_t header;
1368 unsigned afc;
1369 int start_offset = offset;
1370 int payload_len;
1371 pid_analysis_data_t *pid_analysis;
1373 uint32_t skips;
1374 uint32_t pid;
1375 uint32_t cc;
1376 uint32_t pusi_flag;
1378 uint32_t tsc;
1380 proto_item *ti;
1381 proto_item *hi;
1382 proto_item *item = NULL;
1383 proto_tree *mp2t_tree;
1384 proto_tree *mp2t_header_tree;
1385 proto_tree *mp2t_analysis_tree;
1386 proto_item *afci;
1388 ti = proto_tree_add_item( tree, proto_mp2t, tvb, offset, MP2T_PACKET_SIZE, ENC_NA );
1389 mp2t_tree = proto_item_add_subtree( ti, ett_mp2t );
1391 header = tvb_get_ntohl(tvb, offset);
1392 pusi_flag = (header & 0x00400000);
1393 pid = (header & MP2T_PID_MASK) >> MP2T_PID_SHIFT;
1394 tsc = (header & MP2T_TSC_MASK);
1395 afc = (header & MP2T_AFC_MASK) >> MP2T_AFC_SHIFT;
1396 cc = (header & MP2T_CC_MASK) >> MP2T_CC_SHIFT;
1398 proto_item_append_text(ti, " PID=0x%x CC=%d", pid, cc);
1399 col_set_str(pinfo->cinfo, COL_PROTOCOL, "MPEG TS");
1401 hi = proto_tree_add_item( mp2t_tree, hf_mp2t_header, tvb, offset, 4, ENC_BIG_ENDIAN);
1402 mp2t_header_tree = proto_item_add_subtree( hi, ett_mp2t_header );
1404 proto_tree_add_item( mp2t_header_tree, hf_mp2t_sync_byte, tvb, offset, 4, ENC_BIG_ENDIAN);
1405 proto_tree_add_item( mp2t_header_tree, hf_mp2t_tei, tvb, offset, 4, ENC_BIG_ENDIAN);
1406 proto_tree_add_item( mp2t_header_tree, hf_mp2t_pusi, tvb, offset, 4, ENC_BIG_ENDIAN);
1407 proto_tree_add_item( mp2t_header_tree, hf_mp2t_tp, tvb, offset, 4, ENC_BIG_ENDIAN);
1408 proto_tree_add_item( mp2t_header_tree, hf_mp2t_pid, tvb, offset, 4, ENC_BIG_ENDIAN);
1409 proto_tree_add_item( mp2t_header_tree, hf_mp2t_tsc, tvb, offset, 4, ENC_BIG_ENDIAN);
1410 afci = proto_tree_add_item( mp2t_header_tree, hf_mp2t_afc, tvb, offset, 4, ENC_BIG_ENDIAN);
1411 proto_tree_add_item( mp2t_header_tree, hf_mp2t_cc, tvb, offset, 4, ENC_BIG_ENDIAN);
1413 pid_analysis = get_pid_analysis(mp2t_data, pid);
1415 if (pid_analysis->pload_type == pid_pload_unknown) {
1416 if (pid == MP2T_PID_NULL) {
1417 pid_analysis->pload_type = pid_pload_null;
1418 } else if (pid == MP2T_PID_DOCSIS) {
1419 pid_analysis->pload_type = pid_pload_docsis;
1423 if (pid_analysis->pload_type == pid_pload_docsis && (afc != 1)) {
1424 /* DOCSIS packets should not have an adaptation field */
1425 expert_add_info_format(pinfo, afci, &ei_mp2t_invalid_afc,
1426 "Adaptation Field Control for DOCSIS packets must be 0x01");
1429 if (pid_analysis->pload_type == pid_pload_null) {
1430 col_set_str(pinfo->cinfo, COL_INFO, "NULL packet");
1431 if (afc != 1) {
1432 expert_add_info_format(pinfo, afci, &ei_mp2t_invalid_afc,
1433 "Adaptation Field Control for NULL packets must be 0x01");
1435 /* Nothing more to do */
1436 return;
1439 offset += 4;
1441 /* Create a subtree for analysis stuff */
1442 mp2t_analysis_tree = proto_tree_add_subtree_format(mp2t_tree, tvb, offset, 0, ett_mp2t_analysis, &item, "MPEG2 PCR Analysis");
1443 proto_item_set_generated(item);
1445 skips = detect_cc_drops(tvb, mp2t_analysis_tree, pinfo, pid, cc, mp2t_data);
1447 if (skips > 0)
1448 proto_item_append_text(ti, " skips=%d", skips);
1450 if (afc == 2 || afc == 3)
1451 offset = dissect_mp2t_adaptation_field(tvb, offset, mp2t_tree);
1453 if ((offset - start_offset) < MP2T_PACKET_SIZE)
1454 payload_len = MP2T_PACKET_SIZE - (offset - start_offset);
1455 else
1456 payload_len = 0;
1458 if (!payload_len)
1459 return;
1461 if (afc == 2) {
1462 col_set_str(pinfo->cinfo, COL_INFO, "Adaptation field only");
1463 /* The rest of the packet is stuffing bytes */
1464 proto_tree_add_item( mp2t_tree, hf_mp2t_stuff_bytes, tvb, offset, payload_len, ENC_NA);
1465 offset += payload_len;
1468 if (!tsc) {
1469 mp2t_process_fragmented_payload(tvb, offset, payload_len, pinfo, tree, mp2t_tree, pusi_flag, pid_analysis);
1470 } else {
1471 /* Payload is scrambled */
1472 col_set_str(pinfo->cinfo, COL_INFO, "Scrambled TS payload");
1476 static void
1477 export_pdu(tvbuff_t *tvb, packet_info *pinfo)
1479 if (have_tap_listener(exported_pdu_tap)) {
1480 exp_pdu_data_t *exp_pdu_data = wmem_new0(pinfo->pool, exp_pdu_data_t);
1482 exp_pdu_data->tvb_captured_length = tvb_captured_length(tvb);
1483 exp_pdu_data->tvb_reported_length = tvb_reported_length(tvb);
1484 exp_pdu_data->pdu_tvb = tvb;
1485 tap_queue_packet(exported_pdu_tap, pinfo, exp_pdu_data);
1489 static int
1490 dissect_mp2t( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_ )
1492 volatile unsigned offset = 0;
1493 conversation_t *conv;
1494 mp2t_stream_key *stream;
1495 mp2t_analysis_data_t *mp2t_data;
1496 const char *saved_proto;
1498 conv = find_or_create_conversation(pinfo);
1499 stream = wmem_new(pinfo->pool, mp2t_stream_key);
1500 stream->conv = conv;
1501 /* Conversations on UDP, etc. are bidirectional, but in the odd case
1502 * that we have two MP2T streams in the opposite directions, we have to
1503 * separately track their Continuity Counters, manage their fragmentation
1504 * status information, etc.
1506 if (addresses_equal(&pinfo->src, conversation_key_addr1(conv->key_ptr))) {
1507 stream->dir = P2P_DIR_SENT;
1508 } else if (addresses_equal(&pinfo->dst, conversation_key_addr1(conv->key_ptr))) {
1509 stream->dir = P2P_DIR_RECV;
1510 } else {
1511 /* DVB Base Band Frames, or some other endpoint that doesn't set the
1512 * address, presumably unidirectional.
1514 stream->dir = P2P_DIR_SENT;
1517 p_add_proto_data(pinfo->pool, pinfo, proto_mp2t, MP2T_PROTO_DATA_STREAM, stream);
1519 for (; tvb_reported_length_remaining(tvb, offset) >= MP2T_PACKET_SIZE; offset += MP2T_PACKET_SIZE) {
1521 * Dissect the TSP.
1523 * If it gets an error that means there's no point in
1524 * dissecting any more TSPs, rethrow the exception in
1525 * question.
1527 * If it gets any other error, report it and continue, as that
1528 * means that TSP got an error, but that doesn't mean we should
1529 * stop dissecting TSPs within this frame or chunk of reassembled
1530 * data.
1532 saved_proto = pinfo->current_proto;
1533 export_pdu(tvb_new_subset_length(tvb, offset, MP2T_PACKET_SIZE), pinfo);
1534 TRY {
1535 mp2t_data = get_mp2t_conversation_data(stream);
1536 dissect_tsp(tvb, offset, pinfo, tree, mp2t_data);
1538 CATCH_NONFATAL_ERRORS {
1539 show_exception(tvb, pinfo, tree, EXCEPT_CODE, GET_MESSAGE);
1542 * Restore the saved protocol as well; we do this after
1543 * show_exception(), so that the "Malformed packet" indication
1544 * shows the protocol for which dissection failed.
1546 pinfo->current_proto = saved_proto;
1548 ENDTRY;
1550 return tvb_captured_length(tvb);
1553 static bool
1554 heur_dissect_mp2t( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_ )
1556 int length;
1557 unsigned offset = 0;
1559 length = tvb_reported_length_remaining(tvb, offset);
1560 if (length == 0) {
1561 /* Nothing to check for */
1562 return false;
1564 if ((length % MP2T_PACKET_SIZE) != 0) {
1565 /* Not a multiple of the MPEG-2 transport packet size */
1566 return false;
1567 } else {
1568 while (tvb_offset_exists(tvb, offset)) {
1569 if (tvb_get_uint8(tvb, offset) != MP2T_SYNC_BYTE) {
1570 /* No sync byte at the appropriate offset */
1571 return false;
1573 offset += MP2T_PACKET_SIZE;
1577 dissect_mp2t(tvb, pinfo, tree, data);
1578 return true;
1582 void
1583 proto_register_mp2t(void)
1585 static hf_register_info hf[] = {
1586 { &hf_mp2t_header, {
1587 "Header", "mp2t.header",
1588 FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL
1589 } } ,
1590 { &hf_mp2t_sync_byte, {
1591 "Sync Byte", "mp2t.sync_byte",
1592 FT_UINT32, BASE_HEX, VALS(mp2t_sync_byte_vals), MP2T_SYNC_BYTE_MASK, NULL, HFILL
1593 } } ,
1594 { &hf_mp2t_tei, {
1595 "Transport Error Indicator", "mp2t.tei",
1596 FT_UINT32, BASE_DEC, NULL, MP2T_TEI_MASK, NULL, HFILL
1597 } } ,
1598 { &hf_mp2t_pusi, {
1599 "Payload Unit Start Indicator", "mp2t.pusi",
1600 FT_UINT32, BASE_DEC, NULL, MP2T_PUSI_MASK, NULL, HFILL
1601 } } ,
1602 { &hf_mp2t_tp, {
1603 "Transport Priority", "mp2t.tp",
1604 FT_UINT32, BASE_DEC, NULL, MP2T_TP_MASK, NULL, HFILL
1605 } } ,
1606 { &hf_mp2t_pid, {
1607 "PID", "mp2t.pid",
1608 FT_UINT32, BASE_HEX, VALS(mp2t_pid_vals), MP2T_PID_MASK, NULL, HFILL
1609 } } ,
1610 { &hf_mp2t_tsc, {
1611 "Transport Scrambling Control", "mp2t.tsc",
1612 FT_UINT32, BASE_HEX, VALS(mp2t_tsc_vals), MP2T_TSC_MASK, NULL, HFILL
1613 } } ,
1614 { &hf_mp2t_afc, {
1615 "Adaptation Field Control", "mp2t.afc",
1616 FT_UINT32, BASE_HEX, VALS(mp2t_afc_vals) , MP2T_AFC_MASK, NULL, HFILL
1617 } } ,
1618 { &hf_mp2t_cc, {
1619 "Continuity Counter", "mp2t.cc",
1620 FT_UINT32, BASE_DEC, NULL, MP2T_CC_MASK, NULL, HFILL
1621 } } ,
1622 #if 0
1623 { &hf_mp2t_analysis_flags, {
1624 "MPEG2-TS Analysis Flags", "mp2t.analysis.flags",
1625 FT_NONE, BASE_NONE, NULL, 0x0,
1626 "This frame has some of the MPEG2 analysis flags set", HFILL
1627 } } ,
1628 #endif
1629 { &hf_mp2t_analysis_skips, {
1630 "TS Continuity Counter Skips", "mp2t.analysis.skips",
1631 FT_UINT8, BASE_DEC, NULL, 0x0,
1632 "Missing TS frames according to CC counter values", HFILL
1633 } } ,
1634 { &hf_mp2t_analysis_drops, {
1635 "Some frames dropped", "mp2t.analysis.drops",
1636 FT_UINT8, BASE_DEC, NULL, 0x0,
1637 "Discontinuity: A number of TS frames were dropped", HFILL
1638 } } ,
1639 { &hf_mp2t_af, {
1640 "Adaptation Field", "mp2t.af",
1641 FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL
1642 } } ,
1643 { &hf_mp2t_af_length, {
1644 "Adaptation Field Length", "mp2t.af.length",
1645 FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL
1646 } } ,
1647 { &hf_mp2t_af_di, {
1648 "Discontinuity Indicator", "mp2t.af.di",
1649 FT_UINT8, BASE_DEC, NULL, MP2T_AF_DI_MASK, NULL, HFILL
1650 } } ,
1651 { &hf_mp2t_af_rai, {
1652 "Random Access Indicator", "mp2t.af.rai",
1653 FT_UINT8, BASE_DEC, NULL, MP2T_AF_RAI_MASK, NULL, HFILL
1654 } } ,
1655 { &hf_mp2t_af_espi, {
1656 "Elementary Stream Priority Indicator", "mp2t.af.espi",
1657 FT_UINT8, BASE_DEC, NULL, MP2T_AF_ESPI_MASK, NULL, HFILL
1658 } } ,
1659 { &hf_mp2t_af_pcr_flag, {
1660 "PCR Flag", "mp2t.af.pcr_flag",
1661 FT_UINT8, BASE_DEC, NULL, MP2T_AF_PCR_MASK, NULL, HFILL
1662 } } ,
1663 { &hf_mp2t_af_opcr_flag, {
1664 "OPCR Flag", "mp2t.af.opcr_flag",
1665 FT_UINT8, BASE_DEC, NULL, MP2T_AF_OPCR_MASK, NULL, HFILL
1666 } } ,
1667 { &hf_mp2t_af_sp_flag, {
1668 "Splicing Point Flag", "mp2t.af.sp_flag",
1669 FT_UINT8, BASE_DEC, NULL, MP2T_AF_SP_MASK, NULL, HFILL
1670 } } ,
1671 { &hf_mp2t_af_tpd_flag, {
1672 "Transport Private Data Flag", "mp2t.af.tpd_flag",
1673 FT_UINT8, BASE_DEC, NULL, MP2T_AF_TPD_MASK, NULL, HFILL
1674 } } ,
1675 { &hf_mp2t_af_afe_flag, {
1676 "Adaptation Field Extension Flag", "mp2t.af.afe_flag",
1677 FT_UINT8, BASE_DEC, NULL, MP2T_AF_AFE_MASK, NULL, HFILL
1678 } } ,
1679 { &hf_mp2t_af_pcr, {
1680 "Program Clock Reference", "mp2t.af.pcr",
1681 FT_UINT64, BASE_HEX, NULL, 0, NULL, HFILL
1682 } } ,
1683 { &hf_mp2t_af_opcr, {
1684 "Original Program Clock Reference", "mp2t.af.opcr",
1685 FT_UINT64, BASE_HEX, NULL, 0, NULL, HFILL
1686 } } ,
1687 { &hf_mp2t_af_sc, {
1688 "Splice Countdown", "mp2t.af.sc",
1689 FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL
1690 } } ,
1691 { &hf_mp2t_af_tpd_length, {
1692 "Transport Private Data Length", "mp2t.af.tpd_length",
1693 FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL
1694 } } ,
1695 { &hf_mp2t_af_tpd, {
1696 "Transport Private Data", "mp2t.af.tpd",
1697 FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL
1698 } } ,
1699 { &hf_mp2t_af_e_length, {
1700 "Adaptation Field Extension Length", "mp2t.af.e_length",
1701 FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL
1702 } } ,
1703 { &hf_mp2t_af_e_ltw_flag, {
1704 "LTW Flag", "mp2t.af.e.ltw_flag",
1705 FT_UINT8, BASE_DEC, NULL, MP2T_AF_E_LTW_FLAG_MASK, NULL, HFILL
1706 } } ,
1707 { &hf_mp2t_af_e_pr_flag, {
1708 "Piecewise Rate Flag", "mp2t.af.e.pr_flag",
1709 FT_UINT8, BASE_DEC, NULL, MP2T_AF_E_PR_FLAG_MASK, NULL, HFILL
1710 } } ,
1711 { &hf_mp2t_af_e_ss_flag, {
1712 "Seamless Splice Flag", "mp2t.af.e.ss_flag",
1713 FT_UINT8, BASE_DEC, NULL, MP2T_AF_E_SS_FLAG_MASK, NULL, HFILL
1714 } } ,
1715 { &hf_mp2t_af_e_reserved, {
1716 "Reserved", "mp2t.af.e.reserved",
1717 FT_UINT8, BASE_DEC, NULL, 0x1F, NULL, HFILL
1718 } } ,
1719 { &hf_mp2t_af_e_reserved_bytes, {
1720 "Reserved", "mp2t.af.e.reserved_bytes",
1721 FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL
1722 } } ,
1723 { &hf_mp2t_af_stuffing_bytes, {
1724 "Stuffing", "mp2t.af.stuffing_bytes",
1725 FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL
1726 } } ,
1727 { &hf_mp2t_af_e_ltwv_flag, {
1728 "LTW Valid Flag", "mp2t.af.e.ltwv_flag",
1729 FT_UINT16, BASE_DEC, NULL, 0x8000, NULL, HFILL
1730 } } ,
1731 { &hf_mp2t_af_e_ltwo, {
1732 "LTW Offset", "mp2t.af.e.ltwo",
1733 FT_UINT16, BASE_DEC, NULL, 0x7FFF, NULL, HFILL
1734 } } ,
1735 { &hf_mp2t_af_e_pr_reserved, {
1736 "Reserved", "mp2t.af.e.pr_reserved",
1737 FT_UINT24, BASE_DEC, NULL, 0xC00000, NULL, HFILL
1738 } } ,
1739 { &hf_mp2t_af_e_pr, {
1740 "Piecewise Rate", "mp2t.af.e.pr",
1741 FT_UINT24, BASE_DEC, NULL, 0x3FFFFF, NULL, HFILL
1742 } } ,
1743 { &hf_mp2t_af_e_st, {
1744 "Splice Type", "mp2t.af.e.st",
1745 FT_UINT8, BASE_DEC, NULL, 0xF0, NULL, HFILL
1746 } } ,
1747 { &hf_mp2t_af_e_dnau_32_30, {
1748 "DTS Next AU[32...30]", "mp2t.af.e.dnau_32_30",
1749 FT_UINT8, BASE_DEC, NULL, 0x0E, NULL, HFILL
1750 } } ,
1751 { &hf_mp2t_af_e_m_1, {
1752 "Marker Bit", "mp2t.af.e.m_1",
1753 FT_UINT8, BASE_DEC, NULL, 0x01, NULL, HFILL
1754 } } ,
1755 { &hf_mp2t_af_e_dnau_29_15, {
1756 "DTS Next AU[29...15]", "mp2t.af.e.dnau_29_15",
1757 FT_UINT16, BASE_DEC, NULL, 0xFFFE, NULL, HFILL
1758 } } ,
1759 { &hf_mp2t_af_e_m_2, {
1760 "Marker Bit", "mp2t.af.e.m_2",
1761 FT_UINT16, BASE_DEC, NULL, 0x0001, NULL, HFILL
1762 } } ,
1763 { &hf_mp2t_af_e_dnau_14_0, {
1764 "DTS Next AU[14...0]", "mp2t.af.e.dnau_14_0",
1765 FT_UINT16, BASE_DEC, NULL, 0xFFFE, NULL, HFILL
1766 } } ,
1767 { &hf_mp2t_af_e_m_3, {
1768 "Marker Bit", "mp2t.af.e.m_3",
1769 FT_UINT16, BASE_DEC, NULL, 0x0001, NULL, HFILL
1770 } } ,
1771 #if 0
1772 { &hf_mp2t_payload, {
1773 "Payload", "mp2t.payload",
1774 FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL
1775 } } ,
1776 #endif
1777 { &hf_mp2t_stuff_bytes, {
1778 "Stuffing", "mp2t.stuff_bytes",
1779 FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL
1780 } },
1781 { &hf_mp2t_pointer, {
1782 "Pointer", "mp2t.pointer",
1783 FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL
1784 } },
1785 { &hf_msg_fragments, {
1786 "Message fragments", "mp2t.msg.fragments",
1787 FT_NONE, BASE_NONE, NULL, 0x00, NULL, HFILL
1788 } },
1789 { &hf_msg_fragment, {
1790 "Message fragment", "mp2t.msg.fragment",
1791 FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL
1792 } },
1793 { &hf_msg_fragment_overlap, {
1794 "Message fragment overlap", "mp2t.msg.fragment.overlap",
1795 FT_BOOLEAN, BASE_NONE, NULL, 0x00, NULL, HFILL
1796 } },
1797 { &hf_msg_fragment_overlap_conflicts, {
1798 "Message fragment overlapping with conflicting data",
1799 "mp2t.msg.fragment.overlap.conflicts",
1800 FT_BOOLEAN, BASE_NONE, NULL, 0x00, NULL, HFILL
1801 } },
1802 { &hf_msg_fragment_multiple_tails, {
1803 "Message has multiple tail fragments",
1804 "mp2t.msg.fragment.multiple_tails",
1805 FT_BOOLEAN, BASE_NONE, NULL, 0x00, NULL, HFILL
1806 } },
1807 { &hf_msg_fragment_too_long_fragment, {
1808 "Message fragment too long", "mp2t.msg.fragment.too_long_fragment",
1809 FT_BOOLEAN, BASE_NONE, NULL, 0x00, NULL, HFILL
1810 } },
1811 { &hf_msg_fragment_error, {
1812 "Message defragmentation error", "mp2t.msg.fragment.error",
1813 FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL
1814 } },
1815 { &hf_msg_fragment_count, {
1816 "Message fragment count", "mp2t.msg.fragment.count",
1817 FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL
1818 } },
1819 { &hf_msg_reassembled_in, {
1820 "Reassembled in", "mp2t.msg.reassembled.in",
1821 FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL
1822 } },
1823 { &hf_msg_reassembled_length, {
1824 "Reassembled MP2T length", "mp2t.msg.reassembled.length",
1825 FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL
1826 } },
1827 { &hf_msg_ts_packet_reassembled, {
1828 "MPEG TS Packet (reassembled)", "mp2t.ts_packet_reassembled",
1829 FT_NONE, BASE_NONE, NULL, 0x00, NULL, HFILL
1830 } },
1833 static int *ett[] =
1835 &ett_mp2t,
1836 &ett_mp2t_header,
1837 &ett_mp2t_af,
1838 &ett_mp2t_analysis,
1839 &ett_stuff,
1840 &ett_msg_fragment,
1841 &ett_msg_fragments
1844 static ei_register_info ei[] = {
1845 { &ei_mp2t_pointer, { "mp2t.pointer_too_large", PI_MALFORMED, PI_ERROR, "Pointer value is too large", EXPFILL }},
1846 { &ei_mp2t_cc_drop, { "mp2t.cc.drop", PI_SEQUENCE, PI_ERROR, "Detected missing TS frames", EXPFILL }},
1847 { &ei_mp2t_invalid_afc, { "mp2t.afc.invalid", PI_PROTOCOL, PI_WARN,
1848 "Adaptation Field Control contains an invalid value", EXPFILL }}
1851 expert_module_t* expert_mp2t;
1853 proto_mp2t = proto_register_protocol("ISO/IEC 13818-1", "MP2T", "mp2t");
1855 mp2t_handle = register_dissector("mp2t", dissect_mp2t, proto_mp2t);
1857 proto_register_field_array(proto_mp2t, hf, array_length(hf));
1858 proto_register_subtree_array(ett, array_length(ett));
1859 expert_mp2t = expert_register_protocol(proto_mp2t);
1860 expert_register_field_array(expert_mp2t, ei, array_length(ei));
1862 heur_subdissector_list = register_heur_dissector_list_with_description("mp2t.pid", "Unused", proto_mp2t);
1863 /* Register init of processing of fragmented DEPI packets */
1864 reassembly_table_register(&mp2t_reassembly_table,
1865 &mp2t_reassembly_table_functions);
1867 mp2t_stream_hashtable = wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(), mp2t_stream_hash, mp2t_stream_equal);
1869 exported_pdu_tap = register_export_pdu_tap_with_encap("MP2T", WTAP_ENCAP_MPEG_2_TS);
1874 void
1875 proto_reg_handoff_mp2t(void)
1877 heur_dissector_add("udp", heur_dissect_mp2t, "MP2T over UDP", "mp2t_udp", proto_mp2t, HEURISTIC_ENABLE);
1879 dissector_add_uint("rtp.pt", PT_MP2T, mp2t_handle);
1880 dissector_add_for_decode_as_with_preference("tcp.port", mp2t_handle);
1881 dissector_add_for_decode_as_with_preference("udp.port", mp2t_handle);
1882 heur_dissector_add("usb.bulk", heur_dissect_mp2t, "MP2T USB bulk endpoint", "mp2t_usb_bulk", proto_mp2t, HEURISTIC_ENABLE);
1883 dissector_add_uint("wtap_encap", WTAP_ENCAP_MPEG_2_TS, mp2t_handle);
1884 dissector_add_uint("l2tp.pw_type", L2TPv3_PW_DOCSIS_DMPT, mp2t_handle);
1885 dissector_add_string("media_type", "video/mp2t", mp2t_handle);
1887 docsis_handle = find_dissector("docsis");
1888 mpeg_pes_handle = find_dissector("mpeg-pes");
1889 mpeg_sect_handle = find_dissector("mpeg_sect");
1893 * Editor modelines - https://www.wireshark.org/tools/modelines.html
1895 * Local variables:
1896 * c-basic-offset: 4
1897 * tab-width: 8
1898 * indent-tabs-mode: nil
1899 * End:
1901 * vi: set shiftwidth=4 tabstop=8 expandtab:
1902 * :indentSize=4:tabSize=8:noTabs=true: