Hi,
This would be my first contribution to ethereal. I'm not sure
whether all dissectors only include things listed in the RFC's.
But in the field I often have to follow http-streams even when
they have passed a proxy or load-balancer. Filtering on client
ip-addresses therefor is not possible anymore. Often the
client-ip-address is listed in the http-header in the following
format: "X-Forwarded-For: 123.123.123.123". Searching on this
string is possible, but it would be great to be able to filter
on it, therefor I patched the "packet-http.c" to include a
http.x_forwarded_for field. Could this patch be included in
the sources?
Thanks a lot, cheers,
Sake
(the diff is against 0.10.14-SVN-17329)
--- packet-http.c.orig Fri Feb 17 07:52:20 2006
+++ packet-http.c Sun Feb 19 14:40:07 2006
@@ -91,6 +91,7 @@
static int hf_http_location = -1;
static int hf_http_set_cookie = -1;
static int hf_http_last_modified = -1;
+static int hf_http_x_forwarded_for = -1;
static gint ett_http = -1;
static gint ett_http_ntlmssp = -1;
@@ -1603,6 +1604,7 @@
{ "Location", &hf_http_location, HDR_NO_SPECIAL },
{ "Set-Cookie", &hf_http_set_cookie, HDR_NO_SPECIAL },
{ "Last-Modified", &hf_http_last_modified, HDR_NO_SPECIAL },
+ { "X-Forwarded-For", &hf_http_x_forwarded_for, HDR_NO_SPECIAL },
};
static void
@@ -2006,6 +2008,10 @@
{ "Last-Modified", "http.last_modified",
FT_STRING, BASE_NONE, NULL, 0x0,
"HTTP Last Modified", HFILL }},
+ { &hf_http_x_forwarded_for,
+ { "X-Forwarded-For", "http.x_forwarded_for",
+ FT_STRING, BASE_NONE, NULL, 0x0,
+ "HTTP X-Forwarded-For", HFILL }},
};
static gint *ett[] = {
&ett_http,
