Function explorer

Every function of NetOtter: what it does, who calls it and what it calls.

• Interactive explorer: https://fg.water-source.ovh/pages/NetOtter/. Search, filter by module or build, and walk the call tree up and down.
• In this wiki: one page per module below. Each function has its signature, its source comment, a link to the code, and its callers and callees as links.

The call edges come from GCC's -fcallgraph-info on both the Linux and the Windows (MinGW) builds, so they are what the compiler saw. The one call through a function table (net_parsers[]) is added from the table.

729 functions (345 non-static) in 87 C files, 1564 internal calls, 18385 lines including headers.

Modules

An arrow means at least one function of a module calls one of the other. Every module also uses Utils and the static tables, left out to keep the picture readable.

flowchart TB
  entry["Entry point"]
  commands["Interactive commands"]
  parsers["Parsers"]
  display["Display"]
  filters["Filters"]
  analysis["Analysis"]
  anomaly["Anomaly detection"]
  save["Save files"]
  helpers["Packet helpers"]
  linux["Linux backend"]
  windows["Windows backend"]
  analysis --> display
  analysis --> filters
  analysis --> linux
  analysis --> parsers
  analysis --> windows
  anomaly --> analysis
  anomaly --> display
  anomaly --> filters
  anomaly --> linux
  anomaly --> windows
  commands --> analysis
  commands --> anomaly
  commands --> display
  commands --> filters
  commands --> helpers
  commands --> linux
  commands --> parsers
  commands --> save
  commands --> windows
  display --> analysis
  display --> anomaly
  display --> linux
  display --> parsers
  display --> windows
  entry --> analysis
  entry --> anomaly
  entry --> commands
  entry --> display
  entry --> filters
  entry --> helpers
  entry --> linux
  entry --> parsers
  entry --> save
  entry --> windows
  filters --> analysis
  filters --> anomaly
  filters --> display
  filters --> linux
  filters --> windows
  helpers --> anomaly
  helpers --> display
  helpers --> filters
  helpers --> linux
  helpers --> windows
  parsers --> analysis
  parsers --> anomaly
  parsers --> helpers
  parsers --> linux
  parsers --> save
  parsers --> windows
  save --> analysis
  save --> filters
  save --> helpers

Module	Files	What it holds
Entry point	main.c, netotter.c	main() and netotter(): the startup sequence, the CLI and interactive loops, the exit cleanup.
Interactive commands	cmd_analysis.c, cmd_display.c, cmd_filter.c, cmd_io.c, keys.c	What each key of the interactive mode does.
Parsers	args_parser.c, classify.c, filter_args.c, host_parsers.c, parse_l7.c, parse_link.c, parse_proto.c, parse_transport.c, quic.c, quic_crypto.c, quic_flows.c, quic_frames.c, raw_to_f.c	The command line, and the decoding of frames: link, network, transport, the application facts (DNS, ICMP, HTTP) and payload classes, then DNS, TLS and QUIC for hostnames.
Display	display_analysis.c, display_format.c, display_info.c, display_l7.c, display_list.c, display_mcast.c	The l list line with its capture times, the i details (application facts, IGMP / MLD), and the formatting of addresses, flags and hexdumps.
Filters	filter_match.c, filter_parse.c, filter_print.c, filters.c, local.c	The display filters: the active list, parsing, matching, printing, and the machine's own addresses.
Analysis	apps.c, hosts.c, renames.c, reverse.c, reverse_dns.c, reverse_log.c, reverse_queue.c, reverse_store.c, view.c	The analysis view: renamings, the hostname map, apps, and the reverse DNS lookups (the only packets NetOtter sends).
Anomaly detection	anom_alerts.c, anom_arp.c, anom_content.c, anom_detect.c, anom_errors.c, anom_net.c, anom_report.c, anom_stats.c, anom_table.c, anom_timing.c, anomaly.c	Flows, hosts, services and ARP pairs fed by every packet, the detectors (scans, sweeps, floods, failed and refused connections, DNS and HTTP errors, beacons, traffic spikes, protocol / port mismatches, DNS tunnels, ARP changes...), the live alerts, the w report and the s statistics with the packets-per-second chart.
Save files	save_io.c, save_load.c, save_names.c, save_record.c, save_sections.c, save_write.c	Writing and reading .nto files.
Packet helpers	fpacket.c, packet_list.c, packet_utils.c, payload_store.c, queue.c	The packet list, the frame queue, packet structures and the compressed payload store.
Utils	if_tab.c, lz_compress.c, lz_decompress.c, lz_range.c, my_puts.c, my_strtok.c, my_utils.c, my_write.c, ut_core.c	OS-neutral helpers: output (my_write), strings, the interface list, the LZ compressor.
Linux backend	linux_addresses.c, linux_common_functions.c, linux_input.c, linux_lib.c, linux_network.c, linux_resolver.c, linux_spool.c	The common_lib.h functions on Linux: AF_PACKET sockets and their TPACKET_V3 ring, getifaddrs, poll, resolv.conf.
Windows backend	windows_adapters.c, windows_addresses.c, windows_common_functions.c, windows_input.c, windows_lib.c, windows_network.c, windows_pcap.c, windows_resolver.c, windows_spool.c	The common_lib.h functions on Windows: Npcap loaded at runtime, adapters, Winsock, the console.

Regenerating

These pages and the explorer are generated: edit the source comments, not the pages. From the repository:

make docs    # writes docs/build/wiki/ and docs/build/pages/

It builds the Linux and the Windows objects with -fcallgraph-info in obj/codemap/ (your normal build is left alone), so it needs x86_64-w64-mingw32-gcc and Python 3. Then copy docs/build/wiki/* into the wiki repository and docs/build/pages/index.html into the pages branch.