/* packet-netmon.c

 * Routines for Network Monitor capture dissection

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 *

 * Network Event Tracing event taken from:

 *

 * https://docs.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_header

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/to_str.h>

#include <epan/expert.h>

#include <epan/tfs.h>

#include <wsutil/array.h>

#include <wiretap/wtap.h>

#include "packet-netmon.h"

void proto_register_netmon(void);

void proto_reg_handoff_netmon(void);

#define EVENT_HEADER_PROPERTY_XML               0x0001

#define EVENT_HEADER_PROPERTY_FORWARDED_XML     0x0002

#define EVENT_HEADER_PROPERTY_LEGACY_EVENTLOG   0x0004

static const value_string event_level_vals[] = {

  { 0,  "Log Always"},

  { 1,  "Critical"},

  { 2,  "Error"},

  { 3,  "Warning"},

  { 4,  "Info"},

  { 5,  "Verbose"},

  { 6,  "Reserved"},

  { 7,  "Reserved"},

  { 8,  "Reserved"},

  { 9,  "Reserved"},

  { 10, "Reserved"},

  { 11, "Reserved"},

  { 12, "Reserved"},

  { 13, "Reserved"},

  { 14, "Reserved"},

  { 15, "Reserved"},

  { 0,  NULL }

};

static const value_string opcode_vals[] = {

  { 0,  "Info"},

  { 1,  "Start"},

  { 2,  "Stop"},

  { 3,  "DC Start"},

  { 4,  "DC Stop"},

  { 5,  "Extension"},

  { 6,  "Reply"},

  { 7,  "Resume"},

  { 8,  "Suspend"},

  { 9,  "Transfer"},

  { 0,  NULL }

};

static const range_string filter_types[] = {

  { 0,  0,  "Display Filter" },

  { 1,  1,  "Capture Filter" },

  { 2,  0xFFFFFFFF, "Display Filter" },

  { 0, 0, NULL }

};

static dissector_table_t provider_id_table;

/* Initialize the protocol and registered fields */

static int proto_netmon_header;

static int proto_netmon_event;

static int proto_netmon_filter;

static int proto_netmon_network_info;

static int proto_netmon_system_trace;

static int proto_netmon_system_config;

static int proto_netmon_process;

static int hf_netmon_header_title_comment;

static int hf_netmon_header_description_comment;

static int hf_netmon_event_size;

static int hf_netmon_event_header_type;

static int hf_netmon_event_flags;

static int hf_netmon_event_flags_extended_info;

static int hf_netmon_event_flags_private_session;

static int hf_netmon_event_flags_string_only;

static int hf_netmon_event_flags_trace_message;

static int hf_netmon_event_flags_no_cputime;

static int hf_netmon_event_flags_32bit_header;

static int hf_netmon_event_flags_64bit_header;

static int hf_netmon_event_flags_classic_header;

static int hf_netmon_event_event_property;

static int hf_netmon_event_event_property_xml;

static int hf_netmon_event_event_property_forwarded_xml;

static int hf_netmon_event_event_property_legacy_eventlog;

static int hf_netmon_event_thread_id;

static int hf_netmon_event_process_id;

static int hf_netmon_event_timestamp;

static int hf_netmon_event_provider_id;

static int hf_netmon_event_event_desc_id;

static int hf_netmon_event_event_desc_version;

static int hf_netmon_event_event_desc_channel;

static int hf_netmon_event_event_desc_level;

static int hf_netmon_event_event_desc_opcode;

static int hf_netmon_event_event_desc_task;

static int hf_netmon_event_event_desc_keyword;

static int hf_netmon_event_kernel_time;

static int hf_netmon_event_user_time;

static int hf_netmon_event_processor_time;

static int hf_netmon_event_activity_id;

static int hf_netmon_event_processor_number;

static int hf_netmon_event_alignment;

static int hf_netmon_event_logger_id;

static int hf_netmon_event_extended_data_count;

static int hf_netmon_event_user_data_length;

static int hf_netmon_event_reassembled;

static int hf_netmon_event_extended_data_reserved;

static int hf_netmon_event_extended_data_type;

static int hf_netmon_event_extended_data_linkage;

static int hf_netmon_event_extended_data_reserved2;

static int hf_netmon_event_extended_data_size;

static int hf_netmon_event_extended_data;

static int hf_netmon_event_user_data;

static int hf_netmon_filter_version;

static int hf_netmon_filter_type;

static int hf_netmon_filter_app_major_version;

static int hf_netmon_filter_app_minor_version;

static int hf_netmon_filter_app_name;

static int hf_netmon_filter_filter;

static int hf_netmon_network_info_version;

static int hf_netmon_network_info_adapter_count;

static int hf_netmon_network_info_computer_name;

static int hf_netmon_network_info_friendly_name;

static int hf_netmon_network_info_description;

static int hf_netmon_network_info_miniport_guid;

static int hf_netmon_network_info_media_type;

static int hf_netmon_network_info_mtu;

static int hf_netmon_network_info_link_speed;

static int hf_netmon_network_info_mac_address;

static int hf_netmon_network_info_ipv4_count;

static int hf_netmon_network_info_ipv6_count;

static int hf_netmon_network_info_gateway_count;

static int hf_netmon_network_info_dhcp_server_count;

static int hf_netmon_network_info_dns_ipv4_count;

static int hf_netmon_network_info_dns_ipv6_count;

static int hf_netmon_network_info_ipv4;

static int hf_netmon_network_info_subnet;

static int hf_netmon_network_info_ipv6;

static int hf_netmon_network_info_gateway;

static int hf_netmon_network_info_dhcp_server;

static int hf_netmon_network_info_dns_ipv4;

static int hf_netmon_network_info_dns_ipv6;

static int hf_netmon_system_trace_buffer_size;

static int hf_netmon_system_trace_version;

static int hf_netmon_system_trace_provider_version;

static int hf_netmon_system_trace_num_processors;

static int hf_netmon_system_trace_end_time;

static int hf_netmon_system_trace_timer_resolution;

static int hf_netmon_system_trace_max_file_size;

static int hf_netmon_system_trace_log_file_mode;

static int hf_netmon_system_trace_buffers_written;

static int hf_netmon_system_trace_start_buffers;

static int hf_netmon_system_trace_pointers_size;

static int hf_netmon_system_trace_events_lost;

static int hf_netmon_system_trace_cpu_speed;

static int hf_netmon_system_trace_logger_name;

static int hf_netmon_system_trace_log_file_name_ptr;

static int hf_netmon_system_trace_time_zone_info;

static int hf_netmon_system_trace_boot_time;

static int hf_netmon_system_trace_perf_freq;

static int hf_netmon_system_trace_start_time;

static int hf_netmon_system_trace_reserved_flags;

static int hf_netmon_system_trace_buffers_lost;

static int hf_netmon_system_trace_session_name;

static int hf_netmon_system_trace_log_file_name;

static int hf_netmon_system_trace_group_mask1;

static int hf_netmon_system_trace_group_mask2;

static int hf_netmon_system_trace_group_mask3;

static int hf_netmon_system_trace_group_mask4;

static int hf_netmon_system_trace_group_mask5;

static int hf_netmon_system_trace_group_mask6;

static int hf_netmon_system_trace_group_mask7;

static int hf_netmon_system_trace_group_mask8;

static int hf_netmon_system_trace_kernel_event_version;

static int hf_netmon_system_config_mhz;

static int hf_netmon_system_config_num_processors;

static int hf_netmon_system_config_mem_size;

static int hf_netmon_system_config_page_size;

static int hf_netmon_system_config_allocation_granularity;

static int hf_netmon_system_config_computer_name;

static int hf_netmon_system_config_domain_name;

static int hf_netmon_system_config_hyper_threading_flag;

static int hf_netmon_system_config_disk_number;

static int hf_netmon_system_config_bytes_per_sector;

static int hf_netmon_system_config_sectors_per_track;

static int hf_netmon_system_config_tracks_per_cylinder;

static int hf_netmon_system_config_cylinders;

static int hf_netmon_system_config_scsi_port;

static int hf_netmon_system_config_scsi_path;

static int hf_netmon_system_config_scsi_target;

static int hf_netmon_system_config_scsi_lun;

static int hf_netmon_system_config_manufacturer;

static int hf_netmon_system_config_partition_count;

static int hf_netmon_system_config_write_cache_enabled;

static int hf_netmon_system_config_pad;

static int hf_netmon_system_config_boot_drive_letter;

static int hf_netmon_system_config_spare;

static int hf_netmon_system_config_start_offset;

static int hf_netmon_system_config_partition_size;

static int hf_netmon_system_config_size;

static int hf_netmon_system_config_drive_type;

static int hf_netmon_system_config_drive_letter;

static int hf_netmon_system_config_partition_number;

static int hf_netmon_system_config_sectors_per_cluster;

static int hf_netmon_system_config_num_free_clusters;

static int hf_netmon_system_config_total_num_clusters;

static int hf_netmon_system_config_file_system;

static int hf_netmon_system_config_volume_ext;

static int hf_netmon_system_config_physical_addr;

static int hf_netmon_system_config_physical_addr_len;

static int hf_netmon_system_config_ipv4_index;

static int hf_netmon_system_config_ipv6_index;

static int hf_netmon_system_config_nic_description;

static int hf_netmon_system_config_ipaddresses;

static int hf_netmon_system_config_dns_server_addresses;

static int hf_netmon_system_config_memory_size;

static int hf_netmon_system_config_x_resolution;

static int hf_netmon_system_config_y_resolution;

static int hf_netmon_system_config_bits_per_pixel;

static int hf_netmon_system_config_vrefresh;

static int hf_netmon_system_config_chip_type;

static int hf_netmon_system_config_dac_type;

static int hf_netmon_system_config_adapter_string;

static int hf_netmon_system_config_bios_string;

static int hf_netmon_system_config_device_id;

static int hf_netmon_system_config_state_flags;

static int hf_netmon_system_config_process_id;

static int hf_netmon_system_config_service_state;

static int hf_netmon_system_config_sub_process_tag;

static int hf_netmon_system_config_service_name;

static int hf_netmon_system_config_display_name;

static int hf_netmon_system_config_process_name;

static int hf_netmon_system_config_s1;

static int hf_netmon_system_config_s2;

static int hf_netmon_system_config_s3;

static int hf_netmon_system_config_s4;

static int hf_netmon_system_config_s5;

static int hf_netmon_system_config_tcb_table_partitions;

static int hf_netmon_system_config_max_hash_table_size;

static int hf_netmon_system_config_max_user_port;

static int hf_netmon_system_config_tcp_timed_wait_delay;

static int hf_netmon_system_config_irq_affinity;

static int hf_netmon_system_config_irq_num;

static int hf_netmon_system_config_device_desc_len;

static int hf_netmon_system_config_device_desc;

static int hf_netmon_system_config_device_id_len;

static int hf_netmon_system_config_friendly_name_len;

static int hf_netmon_system_config_friendly_name;

static int hf_netmon_system_config_target_id;

static int hf_netmon_system_config_device_type;

static int hf_netmon_system_config_device_timing_mode;

static int hf_netmon_system_config_location_information_len;

static int hf_netmon_system_config_location_information;

static int hf_netmon_system_config_system_manufacturer;

static int hf_netmon_system_config_system_product_name;

static int hf_netmon_system_config_bios_date;

static int hf_netmon_system_config_bios_version;

static int hf_netmon_system_config_load_order_group;

static int hf_netmon_system_config_svc_host_group;

static int hf_netmon_system_config_irq_group;

static int hf_netmon_system_config_pdo_name;

static int hf_netmon_system_config_nic_name;

static int hf_netmon_system_config_index;

static int hf_netmon_system_config_physical_addr_str;

static int hf_netmon_system_config_ip_address;

static int hf_netmon_system_config_subnet_mask;

static int hf_netmon_system_config_dhcp_server;

static int hf_netmon_system_config_gateway;

static int hf_netmon_system_config_primary_wins_server;

static int hf_netmon_system_config_secondary_wins_server;

static int hf_netmon_system_config_dns_server1;

static int hf_netmon_system_config_dns_server2;

static int hf_netmon_system_config_dns_server3;

static int hf_netmon_system_config_dns_server4;

static int hf_netmon_system_config_data;

static int hf_netmon_process_unique_process_key;

static int hf_netmon_process_process_id;

static int hf_netmon_process_parent_id;

static int hf_netmon_process_session_id;

static int hf_netmon_process_exit_status;

static int hf_netmon_process_directory_table_base;

static int hf_netmon_process_unknown;

static int hf_netmon_process_user_sid_revision;

static int hf_netmon_process_user_sid_subauth_count;

static int hf_netmon_process_user_sid_id;

static int hf_netmon_process_user_sid_authority;

static int hf_netmon_process_image_file_name;

static int hf_netmon_process_command_line;

static int hf_netmon_process_page_directory_base;

static int hf_netmon_process_page_fault_count;

static int hf_netmon_process_handle_count;

static int hf_netmon_process_reserved;

static int hf_netmon_process_peak_virtual_size;

static int hf_netmon_process_peak_working_set_size;

static int hf_netmon_process_peak_page_file_usage;

static int hf_netmon_process_quota_peak_paged_pool_usage;

static int hf_netmon_process_quota_peak_non_paged_pool_usage;

static int hf_netmon_process_virtual_size;

static int hf_netmon_process_workingset_size;

static int hf_netmon_process_pagefile_usage;

static int hf_netmon_process_quota_paged_pool_usage;

static int hf_netmon_process_quota_non_paged_pool_usage;

static int hf_netmon_process_private_page_count;

static int hf_netmon_process_directory_table_base32;

static int ett_netmon_header;

static int ett_netmon_event;

static int ett_netmon_event_desc;

static int ett_netmon_event_flags;

static int ett_netmon_event_property;

static int ett_netmon_event_extended_data;

static int ett_netmon_filter;

static int ett_netmon_network_info;

static int ett_netmon_network_info_list;

static int ett_netmon_network_info_adapter;

static int ett_netmon_system_trace;

static int ett_netmon_event_buffer_context;

static int ett_netmon_process;

static int ett_netmon_sid;

static int ett_netmon_system_config;

static expert_field ei_netmon_process_user_sid;

static dissector_table_t wtap_encap_table;

void

netmon_etl_field(proto_tree *tree, tvbuff_t *tvb, unsigned* offset, int hf, uint16_t flags)

{

  if (flags & EVENT_HEADER_FLAG_64_BIT_HEADER) {

    /* XXX - This seems to be how values are displayed in Network Monitor */

    uint64_t value = tvb_get_letoh64(tvb, *offset) & 0xFFFFFFFF;

    proto_tree_add_uint64(tree, hf, tvb, *offset, 8, value);

    (*offset) += 8;

  } else {

    proto_tree_add_item(tree, hf, tvb, *offset, 4, ENC_LITTLE_ENDIAN);

    (*offset) += 4;

  }

}

void

netmon_sid_field(proto_tree *tree, tvbuff_t *tvb, unsigned* offset, packet_info *pinfo,

        int hf_revision, int hf_subauthority_count, int hf_sid_id, int hf_sid_authority, expert_field* invalid_sid, bool conformant _U_)

{

  proto_item *ti, *sid_item;

  proto_tree *sid_tree;

  int start_offset = *offset;

  uint32_t i, revision, count;

  sid_tree = proto_tree_add_subtree(tree, tvb, *offset, 2, ett_netmon_sid, &sid_item, "SID");

  ti = proto_tree_add_item_ret_uint(sid_tree, hf_revision, tvb, *offset, 1, ENC_LITTLE_ENDIAN, &revision);

  (*offset) += 1;

  if (revision != 1)

  {

    expert_add_info(pinfo, ti, invalid_sid);

  }

  proto_tree_add_item_ret_uint(sid_tree, hf_subauthority_count, tvb, *offset, 1, ENC_LITTLE_ENDIAN, &count);

  (*offset) += 1;

  if (count > 15)

  {

    expert_add_info(pinfo, ti, invalid_sid);

  }

  proto_tree_add_item(sid_tree, hf_sid_id, tvb, *offset, 6, ENC_NA);

  (*offset) += 6;

  for (i = 0; i < count; i++)

  {

    proto_tree_add_item(sid_tree, hf_sid_authority, tvb, *offset, 4, ENC_LITTLE_ENDIAN);

    (*offset) += 4;

  }

  proto_item_set_len(sid_item, (*offset)-start_offset);

}

/* Code to actually dissect the packets */

static int

dissect_netmon_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

  proto_item *ti;

  proto_tree *header_tree;

  union wtap_pseudo_header temp_header;

  char *comment;

  ti = proto_tree_add_item(tree, proto_netmon_header, tvb, 0, 0, ENC_NA);

  header_tree = proto_item_add_subtree(ti, ett_netmon_header);

  if (pinfo->pseudo_header->netmon.title != NULL) {

    ti = proto_tree_add_string(header_tree, hf_netmon_header_title_comment, tvb, 0, 0, (char*)pinfo->pseudo_header->netmon.title);

    proto_item_set_generated(ti);

  }

  if (pinfo->pseudo_header->netmon.description != NULL) {

    /* Description comment is only ASCII.  However, it's

     * RTF, not raw text.

     */

    /* Ensure string termination */

    comment = wmem_strndup(pinfo->pool, (char*)pinfo->pseudo_header->netmon.description, pinfo->pseudo_header->netmon.descLength);

    ti = proto_tree_add_string(header_tree, hf_netmon_header_description_comment, tvb, 0, 0, comment);

    proto_item_set_generated(ti);

  }

  /* Save the pseudo header data to a temp variable before it's copied to

   * real pseudo header

   */

  switch (pinfo->pseudo_header->netmon.sub_encap)

  {

  case WTAP_ENCAP_ATM_PDUS:

    memcpy(&temp_header.atm, &pinfo->pseudo_header->netmon.subheader.atm, sizeof(temp_header.atm));

    memcpy(&pinfo->pseudo_header->atm, &temp_header.atm, sizeof(temp_header.atm));

    break;

  case WTAP_ENCAP_ETHERNET:

    memcpy(&temp_header.eth, &pinfo->pseudo_header->netmon.subheader.eth, sizeof(temp_header.eth));

    memcpy(&pinfo->pseudo_header->eth, &temp_header.eth, sizeof(temp_header.eth));

    break;

  case WTAP_ENCAP_IEEE_802_11_NETMON:

    memcpy(&temp_header.ieee_802_11, &pinfo->pseudo_header->netmon.subheader.ieee_802_11, sizeof(temp_header.ieee_802_11));

    memcpy(&pinfo->pseudo_header->ieee_802_11, &temp_header.ieee_802_11, sizeof(temp_header.ieee_802_11));

    break;

  }

  if (!dissector_try_uint_with_data(wtap_encap_table,

    pinfo->pseudo_header->netmon.sub_encap, tvb, pinfo, tree, true,

    (void *)pinfo->pseudo_header)) {

    call_data_dissector(tvb, pinfo, tree);

  }

  return tvb_captured_length(tvb);

}

static int

dissect_netmon_event(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

  proto_item *ti, *extended_data_item;

  proto_tree *event_tree, *event_desc_tree, *extended_data_tree, *buffer_context_tree;

  int offset = 0, extended_data_count_offset;

  uint32_t i, thread_id, process_id, extended_data_count, extended_data_size, user_data_size;

  tvbuff_t *provider_id_tvb;

  guid_key provider_guid;

  struct netmon_provider_id_data provider_id_data;

  static int * const event_flags[] = {

    &hf_netmon_event_flags_extended_info,

    &hf_netmon_event_flags_private_session,

    &hf_netmon_event_flags_string_only,

    &hf_netmon_event_flags_trace_message,

    &hf_netmon_event_flags_no_cputime,

    &hf_netmon_event_flags_32bit_header,

    &hf_netmon_event_flags_64bit_header,

    &hf_netmon_event_flags_classic_header,

    NULL

  };

  static int * const event_property[] = {

    &hf_netmon_event_event_property_xml,

    &hf_netmon_event_event_property_forwarded_xml,

    &hf_netmon_event_event_property_legacy_eventlog,

    NULL

  };

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "NetMon Event");

  /* Clear out stuff in the info column */

  col_clear(pinfo->cinfo, COL_INFO);

  memset(&provider_id_data, 0, sizeof(provider_id_data));

  ti = proto_tree_add_item(tree, proto_netmon_event, tvb, offset, -1, ENC_NA);

  event_tree = proto_item_add_subtree(ti, ett_netmon_event);

  proto_tree_add_item(event_tree, hf_netmon_event_size, tvb, offset, 2, ENC_LITTLE_ENDIAN);

  offset += 2;

  proto_tree_add_item(event_tree, hf_netmon_event_header_type, tvb, offset, 2, ENC_LITTLE_ENDIAN);

  offset += 2;

  provider_id_data.event_flags = tvb_get_letohs(tvb, offset);

  proto_tree_add_bitmask(event_tree, tvb, offset, hf_netmon_event_flags, ett_netmon_event_flags, event_flags, ENC_LITTLE_ENDIAN);

  offset += 2;

  proto_tree_add_bitmask(event_tree, tvb, offset, hf_netmon_event_event_property, ett_netmon_event_property, event_property, ENC_LITTLE_ENDIAN);

  offset += 2;

  proto_tree_add_item_ret_uint(event_tree, hf_netmon_event_thread_id, tvb, offset, 4, ENC_LITTLE_ENDIAN, &thread_id);

  offset += 4;

  proto_tree_add_item_ret_uint(event_tree, hf_netmon_event_process_id, tvb, offset, 4, ENC_LITTLE_ENDIAN, &process_id);

  offset += 4;

  proto_tree_add_item(event_tree, hf_netmon_event_timestamp, tvb, offset, 8, ENC_TIME_WINDOWS|ENC_LITTLE_ENDIAN);

  offset += 8;

  proto_tree_add_item(event_tree, hf_netmon_event_provider_id, tvb, offset, 16, ENC_LITTLE_ENDIAN);

  /* Save the GUID to use in dissector table */

  tvb_memcpy(tvb, &provider_guid.guid, offset, 16);

  provider_guid.ver = 0; //version field not used

  offset += 16;

  col_add_fstr(pinfo->cinfo, COL_INFO, "Thread ID: %d, Process ID: %d, Provider ID: %s",

                    thread_id, process_id, guid_to_str(pinfo->pool, &provider_guid.guid));

  event_desc_tree = proto_tree_add_subtree(event_tree, tvb, offset, 16, ett_netmon_event_desc, NULL, "Event Descriptor");

  proto_tree_add_item_ret_uint(event_desc_tree, hf_netmon_event_event_desc_id, tvb, offset, 2, ENC_LITTLE_ENDIAN, &provider_id_data.event_id);

  offset += 2;

  provider_id_data.event_version = tvb_get_uint8(tvb, offset);

  proto_tree_add_item(event_desc_tree, hf_netmon_event_event_desc_version, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  offset += 1;

  proto_tree_add_item(event_desc_tree, hf_netmon_event_event_desc_channel, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  offset += 1;

  proto_tree_add_item(event_desc_tree, hf_netmon_event_event_desc_level, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  offset += 1;

  provider_id_data.opcode = tvb_get_uint8(tvb, offset);

  proto_tree_add_item(event_desc_tree, hf_netmon_event_event_desc_opcode, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  offset += 1;

  proto_tree_add_item(event_desc_tree, hf_netmon_event_event_desc_task, tvb, offset, 2, ENC_LITTLE_ENDIAN);

  offset += 2;

  proto_tree_add_item_ret_uint64(event_desc_tree, hf_netmon_event_event_desc_keyword, tvb, offset, 8, ENC_LITTLE_ENDIAN, &provider_id_data.keyword);

  offset += 8;

  if (provider_id_data.event_flags & (EVENT_HEADER_FLAG_PRIVATE_SESSION | EVENT_HEADER_FLAG_NO_CPUTIME))

  {

    /* Kernel and User time are a union with processor time */

    proto_tree_add_item(event_tree, hf_netmon_event_kernel_time, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(event_tree, hf_netmon_event_user_time, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

  }

  else

  {

    proto_tree_add_item(event_tree, hf_netmon_event_processor_time, tvb, offset, 8, ENC_LITTLE_ENDIAN);

    offset += 8;

  }

  proto_tree_add_item(event_tree, hf_netmon_event_activity_id, tvb, offset, 16, ENC_LITTLE_ENDIAN);

  offset += 16;

  buffer_context_tree = proto_tree_add_subtree(event_tree, tvb, offset, 4, ett_netmon_event_buffer_context, NULL, "BufferContext");

  proto_tree_add_item(buffer_context_tree, hf_netmon_event_processor_number, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  offset += 1;

  proto_tree_add_item(buffer_context_tree, hf_netmon_event_alignment, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  offset += 1;

  proto_tree_add_item(buffer_context_tree, hf_netmon_event_logger_id, tvb, offset, 2, ENC_LITTLE_ENDIAN);

  offset += 2;

  proto_tree_add_item_ret_uint(event_tree, hf_netmon_event_extended_data_count, tvb, offset, 2, ENC_LITTLE_ENDIAN, &extended_data_count);

  offset += 2;

  proto_tree_add_item_ret_uint(event_tree, hf_netmon_event_user_data_length, tvb, offset, 2, ENC_LITTLE_ENDIAN, &user_data_size);

  offset += 2;

  proto_tree_add_item(event_tree, hf_netmon_event_reassembled, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  offset += 1;

  for (i = 1; i <= extended_data_count; i++)

  {

    extended_data_count_offset = offset;

    extended_data_tree = proto_tree_add_subtree_format(event_tree, tvb, offset, 4, ett_netmon_event_extended_data, &extended_data_item, "Extended Data Item #%d", i);

    proto_tree_add_item(extended_data_tree, hf_netmon_event_extended_data_reserved, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    proto_tree_add_item(extended_data_tree, hf_netmon_event_extended_data_type, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    proto_tree_add_item(extended_data_tree, hf_netmon_event_extended_data_linkage, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    proto_tree_add_item(extended_data_tree, hf_netmon_event_extended_data_reserved2, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    proto_tree_add_item_ret_uint(extended_data_tree, hf_netmon_event_extended_data_size, tvb, offset, 2, ENC_LITTLE_ENDIAN, &extended_data_size);

    offset += 2;

    proto_tree_add_item(extended_data_tree, hf_netmon_event_extended_data, tvb, offset, extended_data_size, ENC_NA);

    offset += extended_data_size;

    proto_item_set_len(extended_data_item, offset-extended_data_count_offset);

  }

  provider_id_tvb = tvb_new_subset_remaining(tvb, offset);

  if (!dissector_try_guid_with_data(provider_id_table, &provider_guid, provider_id_tvb, pinfo, tree, true, &provider_id_data))

  {

    proto_tree_add_item(event_tree, hf_netmon_event_user_data, tvb, offset, user_data_size, ENC_NA);

    offset += user_data_size;

  }

  proto_item_set_len(ti, offset);

  return tvb_captured_length(tvb);

}

static int

dissect_netmon_filter(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

  proto_item *ti;

  proto_tree *filter_tree;

  unsigned offset = 0;

  unsigned length;

  const uint8_t* filter;

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "NetMon Filter");

  /* Clear out stuff in the info column */

  col_clear(pinfo->cinfo, COL_INFO);

  ti = proto_tree_add_item(tree, proto_netmon_filter, tvb, offset, -1, ENC_NA);

  filter_tree = proto_item_add_subtree(ti, ett_netmon_filter);

  proto_tree_add_item(filter_tree, hf_netmon_filter_version, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  proto_tree_add_item(filter_tree, hf_netmon_filter_type, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  proto_tree_add_item(filter_tree, hf_netmon_filter_app_major_version, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  proto_tree_add_item(filter_tree, hf_netmon_filter_app_minor_version, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  length = tvb_unicode_strsize(tvb, offset);

  proto_tree_add_item(filter_tree, hf_netmon_filter_app_name, tvb, offset, length, ENC_LITTLE_ENDIAN|ENC_UTF_16);

  offset += length;

  length = tvb_unicode_strsize(tvb, offset);

  proto_tree_add_item_ret_string(filter_tree, hf_netmon_filter_filter, tvb, offset, length, ENC_LITTLE_ENDIAN|ENC_UTF_16,

                  pinfo->pool, &filter);

  col_add_fstr(pinfo->cinfo, COL_INFO, "Filter: %s", filter);

  return tvb_captured_length(tvb);

}

static int

dissect_netmon_network_info(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

  proto_item *ti, *list_item, *adapter_item;

  proto_tree *network_info_tree, *list_tree, *adapter_tree;

  int offset = 0, list_start_offset, adapter_start_offset;

  unsigned adapter, adapter_count, length;

  uint64_t link_speed;

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "NetMon Network Info");

  /* Clear out stuff in the info column */

  col_clear(pinfo->cinfo, COL_INFO);

  ti = proto_tree_add_item(tree, proto_netmon_network_info, tvb, offset, -1, ENC_NA);

  network_info_tree = proto_item_add_subtree(ti, ett_netmon_network_info);

  proto_tree_add_item(network_info_tree, hf_netmon_network_info_version, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  proto_tree_add_item_ret_uint(network_info_tree, hf_netmon_network_info_adapter_count, tvb, offset, 2, ENC_BIG_ENDIAN, &adapter_count);

  offset += 2;

  col_add_fstr(pinfo->cinfo, COL_INFO, "Adapter count: %d", adapter_count);

  length = tvb_unicode_strsize(tvb, offset);

  proto_tree_add_item(network_info_tree, hf_netmon_network_info_computer_name, tvb, offset, length, ENC_LITTLE_ENDIAN|ENC_UTF_16);

  offset += length;

  if (adapter_count > 0)

  {

    list_start_offset = offset;

    list_tree = proto_tree_add_subtree(network_info_tree, tvb, offset, 1, ett_netmon_network_info_list, &list_item, "NetworkInfo");

    for (adapter = 1; adapter <= adapter_count; adapter++)

    {

      uint32_t loop, ipv4_count, ipv6_count, gateway_count, dhcp_server_count, dns_ipv4_count, dns_ipv6_count;

      adapter_start_offset = offset;

      adapter_tree = proto_tree_add_subtree_format(list_tree, tvb, offset, 1, ett_netmon_network_info_adapter, &adapter_item, "Adapter #%d", adapter);

      length = tvb_unicode_strsize(tvb, offset);

      proto_tree_add_item(adapter_tree, hf_netmon_network_info_friendly_name, tvb, offset, length, ENC_LITTLE_ENDIAN|ENC_UTF_16);

      offset += length;

      length = tvb_unicode_strsize(tvb, offset);

      proto_tree_add_item(adapter_tree, hf_netmon_network_info_description, tvb, offset, length, ENC_LITTLE_ENDIAN|ENC_UTF_16);

      offset += length;

      length = tvb_unicode_strsize(tvb, offset);

      proto_tree_add_item(adapter_tree, hf_netmon_network_info_miniport_guid, tvb, offset, length, ENC_LITTLE_ENDIAN|ENC_UTF_16);

      offset += length;

      proto_tree_add_item(adapter_tree, hf_netmon_network_info_media_type, tvb, offset, 4, ENC_BIG_ENDIAN);

      offset += 4;

      proto_tree_add_item(adapter_tree, hf_netmon_network_info_mtu, tvb, offset, 4, ENC_BIG_ENDIAN);

      offset += 4;

      link_speed = tvb_get_ntoh64(tvb, offset);

      if (link_speed == 0xFFFFFFFFFFFFFFFF)

      {

          proto_tree_add_uint64_format_value(adapter_tree, hf_netmon_network_info_link_speed, tvb, offset, 8, link_speed, "(Unknown)");

      }

      else if (link_speed >= 1000 * 1000 * 1000)

      {

          proto_tree_add_uint64_format_value(adapter_tree, hf_netmon_network_info_link_speed, tvb, offset, 8, link_speed, "%" PRIu64 " Gbps", link_speed/(1000*1000*1000));

      }

      else if (link_speed >= 1000 * 1000)

      {

          proto_tree_add_uint64_format_value(adapter_tree, hf_netmon_network_info_link_speed, tvb, offset, 8, link_speed, "%" PRIu64 " Mbps", link_speed/(1000*1000));

      }

      else if (link_speed >= 1000)

      {

          proto_tree_add_uint64_format_value(adapter_tree, hf_netmon_network_info_link_speed, tvb, offset, 8, link_speed, "%" PRIu64 " Kbps", link_speed/1000);

      }

      else

      {

          proto_tree_add_uint64_format_value(adapter_tree, hf_netmon_network_info_link_speed, tvb, offset, 8, link_speed, "%" PRIu64 " bps", link_speed);

      }

      offset += 8;

      proto_tree_add_item(adapter_tree, hf_netmon_network_info_mac_address, tvb, offset, 6, ENC_NA);

      offset += 6;

      proto_tree_add_item_ret_uint(adapter_tree, hf_netmon_network_info_ipv4_count, tvb, offset, 2, ENC_BIG_ENDIAN, &ipv4_count);

      offset += 2;

      proto_tree_add_item_ret_uint(adapter_tree, hf_netmon_network_info_ipv6_count, tvb, offset, 2, ENC_BIG_ENDIAN, &ipv6_count);

      offset += 2;

      proto_tree_add_item_ret_uint(adapter_tree, hf_netmon_network_info_gateway_count, tvb, offset, 2, ENC_BIG_ENDIAN, &gateway_count);

      offset += 2;

      proto_tree_add_item_ret_uint(adapter_tree, hf_netmon_network_info_dhcp_server_count, tvb, offset, 2, ENC_BIG_ENDIAN, &dhcp_server_count);

      offset += 2;

      proto_tree_add_item_ret_uint(adapter_tree, hf_netmon_network_info_dns_ipv4_count, tvb, offset, 2, ENC_BIG_ENDIAN, &dns_ipv4_count);

      offset += 2;

      proto_tree_add_item_ret_uint(adapter_tree, hf_netmon_network_info_dns_ipv6_count, tvb, offset, 2, ENC_BIG_ENDIAN, &dns_ipv6_count);

      offset += 2;

      for (loop = 0; loop < ipv4_count; loop++)

      {

        proto_tree_add_item(adapter_tree, hf_netmon_network_info_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN);

        offset += 4;

      }

      for (loop = 0; loop < ipv4_count; loop++)

      {

        proto_tree_add_item(adapter_tree, hf_netmon_network_info_subnet, tvb, offset, 4, ENC_BIG_ENDIAN);

        offset += 4;

      }

      for (loop = 0; loop < ipv6_count; loop++)

      {

        proto_tree_add_item(adapter_tree, hf_netmon_network_info_ipv6, tvb, offset, 16, ENC_NA);

        offset += 16;

      }

      for (loop = 0; loop < gateway_count; loop++)

      {

        proto_tree_add_item(adapter_tree, hf_netmon_network_info_gateway, tvb, offset, 4, ENC_BIG_ENDIAN);

        offset += 4;

      }

      for (loop = 0; loop < dhcp_server_count; loop++)

      {

        proto_tree_add_item(adapter_tree, hf_netmon_network_info_dhcp_server, tvb, offset, 4, ENC_BIG_ENDIAN);

        offset += 4;

      }

      for (loop = 0; loop < dns_ipv4_count; loop++)

      {

        proto_tree_add_item(adapter_tree, hf_netmon_network_info_dns_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN);

        offset += 4;

      }

      for (loop = 0; loop < dns_ipv6_count; loop++)

      {

        proto_tree_add_item(adapter_tree, hf_netmon_network_info_dns_ipv6, tvb, offset, 16, ENC_NA);

        offset += 16;

      }

      proto_item_set_len(adapter_item, offset-adapter_start_offset);

    }

    proto_item_set_len(list_item, offset-list_start_offset);

  }

  return tvb_captured_length(tvb);

}

static int

dissect_netmon_system_trace(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

  proto_item *ti;

  proto_tree *system_tree;

  unsigned offset = 0;

  struct netmon_provider_id_data *provider_id_data = (struct netmon_provider_id_data*)data;

  unsigned length;

  nstime_t timestamp = NSTIME_INIT_ZERO;

  uint64_t raw_timestamp;

  DISSECTOR_ASSERT(provider_id_data != NULL);

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "NetMon System Trace");

  col_clear(pinfo->cinfo, COL_INFO);

  ti = proto_tree_add_item(tree, proto_netmon_system_trace, tvb, 0, -1, ENC_NA);

  system_tree = proto_item_add_subtree(ti, ett_netmon_system_trace);

  switch (provider_id_data->opcode)

  {

  case 0:

    proto_tree_add_item(system_tree, hf_netmon_system_trace_buffer_size, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_provider_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_num_processors, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    // TODO: Replace with a time_value_string

    raw_timestamp = tvb_get_letoh64(tvb, offset);

    if (raw_timestamp != 0)

    {

      proto_tree_add_item(system_tree, hf_netmon_system_trace_end_time, tvb, offset, 8, ENC_TIME_WINDOWS|ENC_LITTLE_ENDIAN);

    }

    else

    {

      proto_tree_add_time_format_value(system_tree, hf_netmon_system_trace_end_time, tvb, offset, 8, &timestamp, "(None)");

    }

    offset += 8;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_timer_resolution, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_max_file_size, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_log_file_mode, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_buffers_written, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_start_buffers, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_pointers_size, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_events_lost, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_cpu_speed, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    netmon_etl_field(system_tree, tvb, &offset, hf_netmon_system_trace_logger_name, provider_id_data->event_flags);

    netmon_etl_field(system_tree, tvb, &offset, hf_netmon_system_trace_log_file_name_ptr, provider_id_data->event_flags);

    proto_tree_add_item(system_tree, hf_netmon_system_trace_time_zone_info, tvb, offset, 176, ENC_NA);

    offset += 176;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_boot_time, tvb, offset, 8, ENC_TIME_WINDOWS|ENC_LITTLE_ENDIAN);

    offset += 8;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_perf_freq, tvb, offset, 8, ENC_LITTLE_ENDIAN);

    offset += 8;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_start_time, tvb, offset, 8, ENC_TIME_WINDOWS|ENC_LITTLE_ENDIAN);

    offset += 8;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_reserved_flags, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_buffers_lost, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    length = tvb_unicode_strsize(tvb, offset);

    proto_tree_add_item(system_tree, hf_netmon_system_trace_session_name, tvb, offset, length, ENC_LITTLE_ENDIAN|ENC_UTF_16);

    offset += length;

    length = tvb_unicode_strsize(tvb, offset);

    proto_tree_add_item(system_tree, hf_netmon_system_trace_log_file_name, tvb, offset, length, ENC_LITTLE_ENDIAN|ENC_UTF_16);

    break;

  case 5:

  case 32:

    proto_tree_add_item(system_tree, hf_netmon_system_trace_group_mask1, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_group_mask2, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_group_mask3, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_group_mask4, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_group_mask5, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_group_mask6, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_group_mask7, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_group_mask8, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(system_tree, hf_netmon_system_trace_kernel_event_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    break;

  case 8: // EventTrace_RDComplete

    break;

  }

  return tvb_captured_length(tvb);

}

static int

dissect_netmon_system_config(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

  proto_item *ti;

  proto_tree *system_tree;

  unsigned offset = 0;

  struct netmon_provider_id_data *provider_id_data = (struct netmon_provider_id_data*)data;

  unsigned length;

  uint32_t field1, field2;

  const uint8_t *str_field1, *str_field2, *str_field3, *str_field4;

  DISSECTOR_ASSERT(provider_id_data != NULL);

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "NetMon System Config");

  col_clear(pinfo->cinfo, COL_INFO);

  ti = proto_tree_add_item(tree, proto_netmon_system_config, tvb, 0, -1, ENC_NA);

  system_tree = proto_item_add_subtree(ti, ett_netmon_system_config);

  switch (provider_id_data->event_version)

  {

  // SystemConfig_V0

  case 0:

    switch (provider_id_data->opcode)

    {

    case 10:

      proto_tree_add_item_ret_uint(system_tree, hf_netmon_system_config_mhz, tvb, offset, 4, ENC_LITTLE_ENDIAN, &field1);

      offset += 4;

      proto_tree_add_item_ret_uint(system_tree, hf_netmon_system_config_num_processors, tvb, offset, 4, ENC_LITTLE_ENDIAN, &field2);

      offset += 4;

      col_add_fstr(pinfo->cinfo, COL_INFO, "Processors: %u, (%u MHz)", field2, field1);

      proto_tree_add_item(system_tree, hf_netmon_system_config_mem_size, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item(system_tree, hf_netmon_system_config_page_size, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item(system_tree, hf_netmon_system_config_allocation_granularity, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item(system_tree, hf_netmon_system_config_computer_name, tvb, offset, 512, ENC_LITTLE_ENDIAN|ENC_UTF_16);

      offset += 512;

      proto_tree_add_item(system_tree, hf_netmon_system_config_domain_name, tvb, offset, 264, ENC_LITTLE_ENDIAN|ENC_UTF_16);

      offset += 264;

      netmon_etl_field(system_tree, tvb, &offset, hf_netmon_system_config_hyper_threading_flag, provider_id_data->event_flags);

      break;

    case 11:

      proto_tree_add_item(system_tree, hf_netmon_system_config_disk_number, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item(system_tree, hf_netmon_system_config_bytes_per_sector, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item(system_tree, hf_netmon_system_config_sectors_per_track, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item(system_tree, hf_netmon_system_config_tracks_per_cylinder, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item(system_tree, hf_netmon_system_config_cylinders, tvb, offset, 8, ENC_LITTLE_ENDIAN);

      offset += 8;

      proto_tree_add_item(system_tree, hf_netmon_system_config_scsi_port, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;