src/display/display_analysis.c Port names (443 -> HTTPS) in the endpoints and the 'i' details: on in the analysis view only (from includes/hdisplay.h)

Called by: view_begin, view_end

display_hosts

void display_hosts(hostmap_t *hosts)

src/display/display_analysis.c:24 · non-static · both builds

The learned hostnames shown in the 'i' details: the analysis view sets them, NULL hides them (from includes/hdisplay.h)

Called by: view_begin, view_end

ip_category

static const char *ip_category(int1 v6, const uint8_t *ip)

src/display/display_analysis.c:31 · static · both builds

The 5-char category of the app an address belongs to ("SCLNW"), from its learned hostname (analysis view). NULL if it's unknown.

Called by: print_endpoint_port
Calls: app_lookup, hostmap_get

packet_host_app

static const char *packet_host_app(fpacket_t *packet)

src/display/display_analysis.c:43 · static · both builds

The app of the packet's server, from the learned hostnames: the destination first, then the source. NULL if neither is known.

Called by: print_app_info
Calls: app_lookup, hostmap_get

port_index

static int port_index(uint16_t port)

src/display/display_analysis.c:65 · static · both builds

The port_names[] index of a port when port names are on, -1 otherwise

Called by: port_name, print_app_info

port_name

static const char *port_name(uint16_t port)

src/display/display_analysis.c:78 · static · both builds

The 5-char name of a port when port names are on, NULL otherwise

Called by: print_endpoint_port, print_port_info
Calls: port_index

print_host_info

void print_host_info(fpacket_t *packet, int output_buffer)

src/display/display_analysis.c:87 · non-static · both builds

" Source host ..." / " Dest. host ..." in the 'i' details, for the addresses whose hostname was learned (analysis view)

Called by: print_packet_info
Calls: hostmap_get, my_putstr

print_app_info

void print_app_info(fpacket_t *packet, int output_buffer)

src/display/display_analysis.c:115 · non-static · both builds

" Application Minecraft (Java)" in the 'i' details: the app of the packet's server from its hostname, else from its ports (the destination first)

Called by: print_packet_info
Calls: packet_host_app, port_index, my_putstr

print_endpoint_port

int print_endpoint_port(int1 v6, const uint8_t *ip, uint16_t port, int output_buffer)

src/display/display_analysis.c:135 · non-static · both builds

The port in an endpoint: the category of its address's app if it has one, else the port's 5-char name (analysis view), else its number. Returns how many chars it wrote.

Called by: print_endpoint, print_endpoint6
Calls: ip_category, port_name, my_putunbr, my_nlen, my_write

print_port_info

void print_port_info(uint16_t port, int output_buffer)

src/display/display_analysis.c:152 · non-static · both builds

A port in the 'i' details: "443", or "443 (HTTPS)" when it has a name

Called by: print_tcp_header, print_udp_header
Calls: port_name, my_putunbr, my_write

src/display/display_format.c

Printing of the basic values: addresses, MACs, hex, protocol and EtherType names, TCP flags, hexdumps, padded numbers and capture times

print_ipv4_raw

int print_ipv4_raw(uint8_t ip[4], int output_buffer)

src/display/display_format.c:15 · non-static · both builds

Dotted IPv4 address, unpadded. Returns how many chars it wrote.

Called by: print_ipv4, print_arp_party, print_inner_dst, print_endpoint, print_arp_op, print_group, filter_print, local_print, print_address, print_origin, anom_trusted_print, print_addr (anom_report.c), print_addr (anom_stats.c)
Calls: my_putunbr, my_nlen, my_write

print_ipv4

void print_ipv4(uint8_t ip[4], int output_buffer)

src/display/display_format.c:28 · non-static · both builds

IPv4 address padded to 15 chars

Called by: print_ipv4_info
Calls: print_ipv4_raw, my_write

longest_zero_run

static int longest_zero_run(const uint16_t groups[8], int *run_len)

src/display/display_format.c:37 · static · both builds

The first longest run of 2+ zero groups (written "::"): its start, -1 when there is none, and its length in run_len

Called by: format_ipv6

format_group

static int format_group(uint16_t group, char *buf)

src/display/display_format.c:55 · static · both builds

One group of an IPv6 address in lowercase hex, without leading zeros ("db8", "0"). Returns its length.

Called by: format_ipv6

format_ipv6

static int format_ipv6(uint8_t ip[16], char *buf)

src/display/display_format.c:68 · static · both builds

Compressed IPv6 address (RFC 5952: lowercase, no leading zeros, the first longest run of 2+ zero groups as "::") into buf, which must hold 39 chars. Returns its length.

Called by: format_ip_text, print_ipv6_raw
Calls: longest_zero_run, format_group

format_ip_text

int format_ip_text(int1 v6, const uint8_t *ip, char *out)

src/display/display_format.c:93 · non-static · both builds

An address as the list prints it ("192.0.2.103", "fe80::1") into out (40 bytes), '\0'-terminated. Returns its length. (from includes/hdisplay.h)

Called by: local_sync_renames, addr_len
Calls: format_ipv6

print_ipv6_raw

int print_ipv6_raw(uint8_t ip[16], int output_buffer)

src/display/display_format.c:118 · non-static · both builds

Compressed IPv6 address, unpadded. Returns how many chars it wrote.

Called by: print_ipv6_info, print_inner_dst, print_endpoint6, print_group, filter_print, local_print, print_address, print_origin, anom_trusted_print, print_addr (anom_report.c), print_addr (anom_stats.c)
Calls: format_ipv6, my_write

print_proto

void print_proto(uint8_t proto, int output_buffer)

src/display/display_format.c:128 · non-static · both builds

IPv4 protocol field (IANA numbers), always printed on 4 chars

Called by: print_ipv4_info, print_ipv6_info, print_ipv4_line, print_ipv6_line
Calls: my_write

print_hex

void print_hex(unsigned int nbr, int digits, int output_buffer)

src/display/display_format.c:138 · non-static · both builds

Writes nbr as digits lowercase hex digits, zero-padded

Called by: print_mac, print_hexdump, print_tcp_header, print_udp_header, print_link_info, print_ipv6_info, print_mcast_info
Calls: my_write

print_mac

void print_mac(uint8_t mac[6], int output_buffer)

src/display/display_format.c:150 · non-static · both builds

"a4:83:e7:9a:bc:de", always 17 chars

Called by: print_link_info, print_arp_party, print_arp_op, print_mac_line, filter_print, print_arp_subject
Calls: print_hex, my_write

ethertype_name

const char *ethertype_name(uint16_t type)

src/display/display_format.c:161 · non-static · both builds

NULL when unknown. Values up to 1500 are 802.3 lengths, not types: those frames carry an LLC header.

Called by: print_ethertype, print_link_info, print_etype_value

ethertype_from_name

int ethertype_from_name(const char *name)

src/display/display_format.c:173 · non-static · both builds

The EtherType of a name of that table ("arp", "IPv6"... any case), -1 if it's not one (from includes/hdisplay.h)

Called by: parse_etype

print_ethertype

void print_ethertype(uint16_t type, int output_buffer)

src/display/display_format.c:191 · non-static · both builds

EtherType name padded to 4 chars, "????" when unknown

Called by: print_mac_line
Calls: ethertype_name, my_putstr, my_strlen, my_write

print_hexdump

void print_hexdump(const uint8_t *data, uint16_t len, int output_buffer)

src/display/display_format.c:203 · non-static · both builds

16 bytes per line: offset, bytes in hex, then printable ASCII 0000 45 00 00 54 ... |E..T............|

Called by: print_packet_info, log_print
Calls: print_hex, my_write

print_tcp_flags

void print_tcp_flags(uint8_t flags, int output_buffer)

src/display/display_format.c:230 · non-static · both builds

"SYN,ACK", or "none"

Called by: print_tcp_header, print_packet_line
Calls: my_putstr, my_write

digit_count

static int digit_count(uint32_t nbr)

src/display/display_format.c:248 · static · both builds

Digits of nbr in decimal

Called by: print_padded, print_rel_time

print_padded

void print_padded(uint32_t nbr, int width, char fill, int output_buffer)

src/display/display_format.c:259 · non-static · both builds

nbr, left-padded with fill up to width chars (from includes/hdisplay.h)

Called by: print_rel_time, print_capture_time, print_ms
Calls: digit_count, my_putunbr, my_write

print_rel_time

void print_rel_time(uint64_t ts_us, uint64_t base_us, int width, int output_buffer)

src/display/display_format.c:266 · non-static · both builds

The time from base_us to ts_us in seconds with 6 decimals ("12.345678", "-0.000120" when ts_us comes first), the seconds right-aligned in width chars (sign included, 0: not padded) (from includes/hdisplay.h)

Called by: print_capture_time, print_packet_line, anomaly_print, print_totals (anom_stats.c), print_flows
Calls: digit_count, print_padded, my_putunbr, my_write

src/display/display_info.c

A packet's details, layer by layer (the 'i' command)

print_tcp_header

static void print_tcp_header(tcp_header_t *tcph, int output_buffer)

src/display/display_info.c:13 · static · both builds

Called by: print_packet_info
Calls: print_port_info, print_hex, print_tcp_flags, my_putunbr, my_putstr, my_write

print_udp_header

static void print_udp_header(udp_header_t *udph, int output_buffer)

src/display/display_info.c:36 · static · both builds

Called by: print_packet_info
Calls: print_port_info, print_hex, my_putunbr, my_putstr, my_write

print_link_info

static void print_link_info(fpacket_t *packet, int output_buffer)

src/display/display_info.c:49 · static · both builds

Called by: print_packet_info
Calls: print_hex, print_mac, ethertype_name, my_putstr, my_write

print_ipv4_info

static void print_ipv4_info(ipv4_header_t *ipv4, int output_buffer)

src/display/display_info.c:69 · static · both builds

Called by: print_ip_info
Calls: print_ipv4, print_proto, my_putunbr, my_putstr, my_write

print_ipv6_info

static void print_ipv6_info(ipv6_header_t *ipv6, int output_buffer)

src/display/display_info.c:84 · static · both builds

Called by: print_ip_info
Calls: print_ipv6_raw, print_proto, print_hex, my_putunbr, my_putstr, my_write

print_arp_party

static void print_arp_party(char *label, uint8_t mac[6], uint8_t ip[4], int output_buffer)

src/display/display_info.c:114 · static · both builds

One " <label> <mac> <ip>" line of the ARP details

Called by: print_arp_info
Calls: print_ipv4_raw, print_mac, my_putstr, my_write

print_arp_info

static void print_arp_info(arp_header_t *arp, int output_buffer)

src/display/display_info.c:124 · static · both builds

Called by: print_ip_info
Calls: print_arp_party, my_putunbr, my_putstr

print_ip_info

static void print_ip_info(fpacket_t *packet, int output_buffer)

src/display/display_info.c:140 · static · both builds

IP layer details, by IP version. Nothing without one: the link layer (print_link_info) already shows the MACs.

Called by: print_packet_info
Calls: print_ipv4_info, print_ipv6_info, print_arp_info, print_mcast_info

print_capture_time

static void print_capture_time(uint64_t ts_us, uint64_t base_us, int output_buffer)

src/display/display_info.c:154 · static · both builds

" Captured 2026-10-13 14:03:22.127342 (+0.004211 s)": local date, then the time since base_us (the list's first packet), as in 'l'

Called by: print_packet_info
Calls: print_padded, print_rel_time, my_putstr, my_write, local_date, local_date

print_packet_info

void print_packet_info(fpacket_t *packet, uint32_t id, uint64_t base_us, const anomalies_t *anom, const uint8_t *payload, int output_buffer)

src/display/display_info.c:182 · non-static · both builds

src/display/display_info.c payload: the packet's decompressed payload (payload_len bytes), NULL when it can't be read back. base_us: as for print_packet_line. anom: the anomalies the packet is part of get a line each. (from includes/hdisplay.h)

Called by: info_command
Calls: print_host_info, print_app_info, print_hexdump, print_tcp_header, print_udp_header, print_link_info, print_ip_info, print_capture_time, print_l7_info, anomaly_print_packet, my_putunbr, my_putstr

src/display/display_l7.c

The application layer facts of a packet (DNS, ICMP, HTTP): the 'l' tags ("[NXDOMAIN]", "[port unreachable ...]", "[HTTP 404]") and the 'i' details

icmp_name

const char *icmp_name(int1 v6, uint8_t type, uint8_t code)

src/display/display_l7.c:18 · non-static · both builds

src/display/display_l7.c The name of an ICMP / ICMPv6 message ("port unreachable"), NULL if it's not in icmp_names[] (from includes/hdisplay.h)

Called by: print_icmp_tag

dns_type_name

static const char *dns_type_name(uint16_t type)

src/display/display_l7.c:27 · static · both builds

Called by: print_dns_type

print_dns_type

static void print_dns_type(uint16_t type, int output_buffer)

src/display/display_l7.c:35 · static · both builds

Called by: print_l7_tag, print_qname
Calls: dns_type_name, my_putunbr, my_putstr

print_rcode

static void print_rcode(uint8_t rcode, int output_buffer)

src/display/display_l7.c:47 · static · both builds

Called by: print_l7_tag, print_l7_info
Calls: my_putunbr, my_putstr

http_reason

static const char *http_reason(uint16_t status)

src/display/display_l7.c:57 · static · both builds

Called by: print_l7_info

print_inner_dst

static void print_inner_dst(const l7_info_t *l7, int output_buffer)

src/display/display_l7.c:67 · static · both builds

"192.0.2.10:514/udp", the destination of the packet an ICMP error is about

Called by: print_icmp_tag
Calls: print_ipv4_raw, print_ipv6_raw, my_putunbr, my_putstr

print_icmp_tag

static void print_icmp_tag(const l7_info_t *l7, int1 v6, int output_buffer)

src/display/display_l7.c:85 · static · both builds

Called by: print_l7_tag, print_l7_info
Calls: icmp_name, print_inner_dst, my_putunbr, my_putstr

print_l7_tag

void print_l7_tag(fpacket_t *packet, int output_buffer)

src/display/display_l7.c:103 · non-static · both builds

The 'l' tag of the packet's DNS / ICMP / HTTP facts, nothing without (from includes/hdisplay.h)

Called by: print_packet_line
Calls: print_dns_type, print_rcode, print_icmp_tag, my_putunbr, my_putstr

print_qname

static void print_qname(fpacket_t *packet, const uint8_t *payload, int output_buffer)

src/display/display_l7.c:138 · static · both builds

The question name, read again from the decompressed payload

Called by: print_l7_info
Calls: dns_read_name, print_dns_type, my_putstr

print_l7_info

void print_l7_info(fpacket_t *packet, const uint8_t *payload, int output_buffer)

src/display/display_l7.c:160 · non-static · both builds

Their 'i' lines; payload (decompressed, or NULL) gives the DNS name (from includes/hdisplay.h)

Called by: print_packet_info
Calls: print_rcode, http_reason, print_icmp_tag, print_qname, my_putunbr, my_putstr

src/display/display_list.c

One line per packet (the 'l' list) and the enabled interfaces

print_endpoint

static void print_endpoint(uint8_t ip[4], uint16_t port, int1 has_port, int output_buffer)

src/display/display_list.c:14 · static · both builds

"address:port" (or just the address when has_port is 0), padded to ENDPOINT_WIDTH chars

Called by: print_ipv4_line
Calls: print_endpoint_port, print_ipv4_raw, my_write

print_endpoint6

static void print_endpoint6(uint8_t ip[16], uint16_t port, int1 has_port, int output_buffer)

src/display/display_list.c:29 · static · both builds

"[address]:port" (or just the address when has_port is 0), padded to ENDPOINT6_WIDTH chars so every IPv6 line of the list aligns

Called by: print_ipv6_line
Calls: print_endpoint_port, print_ipv6_raw, my_write

print_arp_op

static void print_arp_op(arp_header_t *arp, int output_buffer)

src/display/display_list.c:48 · static · both builds

"who-has 192.0.2.2 tell 192.0.2.1", "192.0.2.2 is-at 00:00:5e:00:53:02", "announce 192.0.2.1" (gratuitous ARP), or "op 3" for the other operations

Called by: print_packet_line
Calls: print_ipv4_raw, print_mac, my_putunbr, my_putstr
Library and system calls: memcmp

print_ipv4_line

static void print_ipv4_line(fpacket_t *packet, int1 has_port, int output_buffer)

src/display/display_list.c:69 · static · both builds

List columns for IPv4: endpoints, ttl, protocol

Called by: print_ip
Calls: print_proto, print_endpoint, my_putunbr, my_putstr, my_nlen, my_write

print_ipv6_line

static void print_ipv6_line(fpacket_t *packet, int1 has_port, int output_buffer)

src/display/display_list.c:85 · static · both builds

List columns for IPv6: like IPv4 with wider endpoint columns (ENDPOINT6_WIDTH), the hop limit in the ttl column

Called by: print_ip
Calls: print_proto, print_endpoint6, my_putunbr, my_putstr, my_nlen, my_write

print_mac_line

static void print_mac_line(fpacket_t *packet, int output_buffer)

src/display/display_list.c:102 · static · both builds

List columns without an IP layer: MAC addresses (dashes on links without a header), the empty ttl column, then the EtherType

Called by: print_ip
Calls: print_mac, print_ethertype, my_write

print_ip

static void print_ip(fpacket_t *packet, int output_buffer)

src/display/display_list.c:121 · static · both builds

Middle columns of the list, by IP version: IPv4 or IPv6 endpoints, MAC addresses when there is no IP layer

Called by: print_packet_line
Calls: print_ipv4_line, print_ipv6_line, print_mac_line

print_packet_line

void print_packet_line(fpacket_t *packet, uint32_t id, uint64_t base_us, const anomalies_t *anom, int output_buffer)

src/display/display_list.c:136 · non-static · both builds

One line of the packet list: id, interface, the seconds since base_us, the print_ip() columns, the payload size, then the TCP flags ("[SYN,ACK]") for TCP packets and the anomaly tags ("!scan")

Called by: display_packets
Calls: print_tcp_flags, print_rel_time, print_l7_tag, print_arp_op, print_ip, print_mcast_op, anomaly_print_tags, my_putunbr, my_putstr, my_nlen, my_write

display_enabled_itrf

void display_enabled_itrf(interface_t **itrfs)

src/display/display_list.c:175 · non-static · both builds

"Enabled interfaces: 1 - lo, 5 - wlan0", for the ones -i turned on.

Called by: run_interactive
Calls: my_putunbr, my_putstr

src/display/display_mcast.c

IGMP / MLD (multicast group membership) in the list and the 'i' details

mcast_name

static const char *mcast_name(int1 v6, const uint8_t *group)

src/display/display_mcast.c:16 · static · both builds

The name of a multicast group, NULL if it's not a known one. IPv6 solicited-node groups (ff02::1:ffXX:XXXX, one per address) match on their first 13 bytes.

Called by: print_group
Library and system calls: memcmp

print_group

static void print_group(int1 v6, uint8_t *group, int1 named, int output_buffer)

src/display/display_mcast.c:30 · static · both builds

Called by: print_query_op, print_group_op, print_mcast_record, print_mcast_info
Calls: print_ipv4_raw, print_ipv6_raw, mcast_name, my_putstr

mcast_is_query

static int mcast_is_query(mcast_header_t *m)

src/display/display_mcast.c:43 · static · both builds

Called by: print_mcast_op, mcast_type_name, print_mcast_info

mcast_is_records

static int mcast_is_records(mcast_header_t *m)

src/display/display_mcast.c:49 · static · both builds

v3 IGMP / v2 MLD report: group records instead of one group

Called by: print_mcast_op, print_mcast_info

mcast_is_leave

static int mcast_is_leave(mcast_header_t *m)

src/display/display_mcast.c:55 · static · both builds

v2 IGMP leave / v1 MLD done

Called by: print_mcast_op, mcast_type_name

group_is_zero

static int group_is_zero(mcast_header_t *m, uint8_t *group)

src/display/display_mcast.c:60 · static · both builds

Called by: print_query_op, print_mcast_info

print_count

static void print_count(uint32_t n, char *one, char *many, int output_buffer)

src/display/display_mcast.c:69 · static · both builds

"3 sources" / "1 source": n, then the word that fits it

Called by: print_sources, print_mcast_op, print_mcast_record, print_mcast_info
Calls: my_putunbr, my_putstr

print_sources

static void print_sources(uint32_t sources, int output_buffer)

src/display/display_mcast.c:77 · static · both builds

", 3 sources" after a query's group, nothing when it has none

Called by: print_query_op, print_mcast_info
Calls: print_count, my_write

print_query_op

static void print_query_op(mcast_header_t *m, int output_buffer)

src/display/display_mcast.c:86 · static · both builds

"query" (general query), or "query G" / "query G, N sources"

Called by: print_mcast_op
Calls: print_group, group_is_zero, print_sources, my_putstr, my_write

record_op

static char *record_op(mcast_record_t *rec)

src/display/display_mcast.c:98 · static · both builds

What a report's only record does: joining is "exclude no source", leaving "include no source", anything else is a plain report

Called by: print_mcast_op

print_group_op

static void print_group_op(char *op, int1 v6, uint8_t *group, int output_buffer)

src/display/display_mcast.c:108 · static · both builds

"join G", "leave G", "report G"

Called by: print_mcast_op
Calls: print_group, my_putstr

print_mcast_op

void print_mcast_op(mcast_header_t *m, int output_buffer)

src/display/display_mcast.c:117 · non-static · both builds

The 'l' suffix: "query", "query G, N sources", "join G", "leave G", "report G" or "N groups"

Called by: print_packet_line
Calls: mcast_is_query, mcast_is_records, mcast_is_leave, print_count, print_query_op, record_op, print_group_op

mcast_max_resp_ms

static uint32_t mcast_max_resp_ms(mcast_header_t *m)

src/display/display_mcast.c:135 · static · both builds

The max response time in milliseconds: IGMP sends tenths of a second (an exponential code from 128 on in v3), MLD milliseconds (exponential from 32768 on in v2)

Called by: print_mcast_info

mcast_type_name

static const char *mcast_type_name(mcast_header_t *m)

src/display/display_mcast.c:148 · static · both builds

Called by: print_mcast_info
Calls: mcast_is_query, mcast_is_leave

print_mcast_record

static void print_mcast_record(mcast_header_t *m, mcast_record_t *rec, int output_buffer)

src/display/display_mcast.c:157 · static · both builds

Called by: print_mcast_info
Calls: print_group, print_count, my_putstr

print_mcast_info

void print_mcast_info(mcast_header_t *m, int output_buffer)

src/display/display_mcast.c:168 · non-static · both builds

Called by: print_ip_info
Calls: print_hex, print_group, mcast_is_query, mcast_is_records, group_is_zero, print_count, print_sources, mcast_max_resp_ms, mcast_type_name, print_mcast_record, my_putunbr, my_putstr, my_write

NetOtter

User guide

Developer documentation

Learning