kPluginMsg_Load

Peek sends this message to an analysis module when it is first loaded. The analysis module should return its API version, name, ID, attributes, supported and default actions, and supported ProtoSpecs. The analysis module should initialize whatever global data it may need on handling this message. See the description of the kPluginMsg_ReadPrefs message if you need to load preferences.

PluginLoadParam

This structure accompanies the kPluginMsg_Load message.

typedef struct PluginLoadParam
{
	UInt32           fAPIVersion;
	UInt32           fAppCapabilities;
	TCHAR*           fName;
	PluginID         fID;
	UInt16           fAttributes;
	UInt16           fSupportedActions;
	UInt16           fDefaultActions;
	UInt32           fSupportedCount;
	UInt32*          fSupportedProtoSpecs;
	ClientAppDataPtr fClientAppData;
	void*            fAppContextData;
	TCHAR*           fLoadErrorMessage;
	LCID             fLocaleId;
	UInt64           fAttributesEx;
 } PluginLoadParam;

The following values are defined for the fAppCapabilities field.

enum
{
	kAppCapability_Unicode     = 0x00000001,
	kAppCapability_Pro         = 0x00000002,
	kAppCapability_RemoteAgent = 0x00000004,
	kAppCapability_Beta        = 0x00000008,
	kAppCapability_Demo        = 0x00000010,
	kAppCapability_Eval        = 0x00000020,
	kAppCapability_VoIP        = 0x00000040
};

kPluginMsg_Unload

Peek sends this message to an analysis module when it is unloaded. Free any additional memory and generally cleanup after the analysis module.

This message has no associated parameter structure.

kPluginMsg_CreateContext

Peek sends this message when a new context needs to be created for your analysis module. Each analysis module has one global context, one context for each open capture window, and one context for each open packet file window. This is the means by which analysis modules can, with relatively little work, support separate sets of statistics for each capture window and packet file window. Your analysis module should allocate memory for a context and return it to Peek. All subsequent context-related calls to your analysis module will include the appropriate analysis module context.

PluginCreateContextParam

This structure accompanies the kPluginMsg_CreateContext message.

typedef struct PluginCreateContextParam
{
	PluginContext*         fContextPtr;
	PluginCaptureContext   fCaptureContext;
	PluginContextData      fContextData;
	PluginContextFlags     fContextFlags;
} PluginCreateContextParam;

The following values are defined for the fContextFlags field.

enum
{
	kContextType_Global,
	kContextType_CaptureWindow,
	kContextType_FileWindow,
	kContextType_RemoteCaptureWindow,
	kContextType_RemoteFileWindow
};

kPluginMsg_DisposeContext

Peek sends this message to an analysis module when a context needs to be disposed. This happens when capture windows and packet file windows are closed. It also happens once just before the analysis module is unloaded (to dispose of the global context). Analysis modules should free the memory that was allocated in response to the kPluginMsg_CreateContext message.

PluginDisposeContextParam

This structure accompanies the kPluginMsg_DisposeContext message.

typedef struct PluginDisposeContextParam
{
	PluginContext fContext;
} PluginDisposeContextParam;

kPluginMsg_ProcessPacket

This message is sent to an analysis module when Peek has a packet for it to process. This happens when Peek has captured a packet from the network or when a packet file is loaded. Analysis modules should handle the message as quickly as possible because any delay slows overall packet processing for Peek.

This message will only be sent if the analysis module has set the kPluginAttr_ProcessPackets attribute during handling of the kPluginMsg_Load message, and only for packets that match one of the ProtoSpecs the analysis module requested.

PluginProcessPacketParam

This structure accompanies the kPluginMsg_ProcessPacket message.

typedef struct PluginProcessPacketParam
{
	const PluginPacket* fPacket;
	const UInt8*        fPacketData;
	UInt64              fPacketNumber;
	UInt8               fMediaType;
	UInt8               fMediaSubType;
	UInt32              fProtoSpecMatched;
	PluginContext       fContext;
} PluginProcessPacketParam;

kPluginMsg_GetPacketString, kPluginMsg_GetPacketAnalysis

These messages are sent to an analysis module when Peek needs to display text for a packet in the Summary or Expert columns of the packet list, respectively. The messages will only be sent if the analysis module has set the kPluginAttr_GetPacketString or kPluginAttr_ProvidesAnalysis attributes during handling of the kPluginMsg_Load message, and only for packets that match one of the ProtoSpecs the analysis module requested.

These messages are sent when a packet comes into view. Analysis modules should handle these messages as quickly as possible because any delay slows display of packets.

Peek calls each analysis module (that supports the ProtoSpec of the packet, of course) and uses the first non-empty string returned. Because all analysis modules are given the opportunity to provide strings for these columns, there may be contention. If this is undesirable, the analysis module may choose to supply its own custom column. See the SetPacketListColumnProc callback for more on that.

PluginGetPacketStringParam

This structure is accompanies both the kPluginMsg_GetPacketString and kPluginMag_GetPacketAnalysis messages.

typedef struct PluginGetPacketStringParam
{
	const PluginPacket* fPacket;
	const UInt8*        fPacketData;
	UInt64              fPacketNumber;
	UInt8               fMediaType;
	UInt8               fMediaSubType;
	UInt32              fProtoSpecMatched;
	TCHAR*              fString;
	PluginColor         fColor;
	PluginContext       fContext;
} PluginGetPacketStringParam;

kPluginMsg_Apply

This message is passed when the user selects a packet in Peek's main packet list and chooses the Apply Analysis Module command. Typically, an analysis module will perform the same tasks as during the kPluginMsg_ProcessPacket but will not increment any summary statistics.

This message will only be sent if the analysis module has enabled the kPluginAttr_HandlesApply attribute during handling of the kPluginMsg_Load message.

The message is passed in three stages, indicated by the fCommand field in the accompanying PluginApplyParam structure:

1. The analysis module initially receives the kApplyMsg_Start command. It may display a dialog and/or save additional information in the fPrivateData field of the PluginApplyParam structure. Analysis modules should return a non-zero value to cancel the operation or zero to continue.
2. Each selected packet is then sent with the kApplyMsg_Packet command. Analysis modules should return zero if the packets is used, non-zero otherwise.
3. Finally, the analysis module is sent the kApplyMsg_End command in order to clean up, including any data stored in fPrivateData.

PluginApplyParam

This structure is passed with the kPluginMsg_Apply message.

typedef struct PluginApplyParam
{
	const PluginPacket* fPacket;
	const UInt8*        fPacketData;
	UInt64              fPacketNumber;
	UInt8               fMediaType;
	UInt8               fMediaSubType;
	UInt32              fProtoSpecMatched;
	UInt16              fCommand;
	UInt32              fPrivateData;
	PluginContext       fContext;
} PluginApplyParam;

The following values are defined for the fCommand field.

enum
{
	kApplyMsg_Start  = 1,
	kApplyMsg_End    = 2,
	kApplyMsg_Packet = 3
};

kPluginMsg_Select

This message is passed when the user chooses to use the analysis module in Peek's Select dialog.

This message will only be sent if the analysis module has enabled the kPluginAttr_HandlesSelection attribute during handling of the kPluginMsg_Load message.

The message is passed in three stages, indicated by the fCommand field in the accompanying PluginSelectParam structure:

1. The analysis module initially receives the kSelectMsg_Start command. It may display a dialog and/or save additional information in the fPrivateData field of the PluginSelectParam structure. Analysis modules should return a non-zero value to cancel the operation or zero to continue.
2. Every packet is then sent with the kSelectMsg_Packet command. Analysis modules should return zero if the packet should be selected, non-zero otherwise.
3. Finally, the analysis module is sent the kSelectMsg_End command in order to clean up, including any data stored in fPrivateData.

PluginSelectParam

This structure is passed with the kPluginMsg_Select message.

typedef struct PluginSelectParam
{
	const PluginPacket* fPacket;
	const UInt8*        fPacketData;
	UInt64              fPacketNumber;
	UInt8               fMediaType;
	UInt8               fMediaSubType;
	UInt32              fProtoSpecMatched;
	UInt16              fCommand;
	UInt32              fPrivateData;
	PluginContext       fContext;
} PluginSelectParam;

The following values are defined for the fCommand field.

enum
{
	kSelectMsg_Start  = 1,
	kSelectMsg_End    = 2,
	kSelectMsg_Packet = 3
};

kPluginMsg_Reset

This message is sent by Peek when a packet buffer is cleared. Your analysis module should clear out all accumulated statistics contained within its context.

PluginResetParam

This structure is passed with the kPluginMsg_Reset message.

typedef struct PluginResetParam
{
	PluginContext fContext;
	const TCHAR*  fPluginAdapterID;
} PluginResetParam;

kPluginMsg_StartCapture

This message is sent by Peek to notify analysis modules of when packet capture is started.

PluginStartCaptureParam

This structure is passed with the kPluginMsg_StartCapture message.

typedef struct PluginStartCaptureParam
{
	PluginContext fContext;
} PluginStartCaptureParam;

kPluginMsg_StopCapture

This message is sent by Peek to notify analysis modules of when packet capture is stopped.

PluginStopCaptureParam

This structure is passed with the kPluginMsg_StopCapture message.

typedef struct PluginStopCaptureParam
{
	PluginContext fContext;
} PluginStopCaptureParam;

kPluginMsg_PacketsLoaded

This message is sent by Peek when after a packet file has completed loading.

PluginPacketsLoadedParam

This structure is passed with the kPluginMsg_PacketsLoaded message.

typedef struct PluginPacketsLoadedParam
{
	PluginContext fContext;
} PluginPacketsLoadedParam;

kPluginMsg_About

Peek sends this message to an analysis module when the user selects the analysis module in Peek's Analysis Module dialog and clicks the About button. The analysis module should display a dialog or message box with author information, the purpose of the analysis module and instructions on its use.

This message has no accompanying parameter data structure.

kPluginMsg_Options

Peek sends this message to an analysis module when the user selects the analysis module in Peek's Analysis Module dialog and clicks the Options button. Analysis modules should display a dialog box in which the user can set preferences supported by the analysis module.

Peek will only enable the Options button if the analysis module has the kPluginAttr_HasOptions attribute.

There is no accompanying parameter data structure for this message.

kPluginMsg_ReadPrefs

Peek sends this message to an analysis module right after it's loaded (during Peek launch). The analysis module can take this opportunity to load any user preferences specific to the analysis module. Use the PrefsGetValueProc and/or PrefsGetPrefsPathProc callbacks to retrieve your preferences.

This message has no accompanying parameter data structure.

kPluginMsg_WritePrefs

Peek sends this message to an analysis module right before it's unloaded (during Peek quit). The analysis module can take this opportunity to save any user preferences specific to the analysis module. Use the PrefsSetValueProc and/or PrefsGetPrefsPathProc callbacks to store your preferences.

This message has no accompanying parameter data structure.

kPluginMsg_Summary

This message is sent by Peek when it is time to update the values in the summary statistics. If your analysis module keeps track of any values for the summary statistics, it should use the SummaryModifyEntryProc and SummaryGetEntryProc callbacks as appropriate.

The message will only be passed if the analysis module has set the kPluginAttr_HandlesSummaries attribute during handling of the kPluginMsg_Load message.

PluginSummaryParam

This structure is passed with the kPluginMsg_Summary message.

typedef struct PluginSummaryParam
{
	PluginContext fContext;
} PluginSummaryParam;

kPluginMsg_Filter

This message is passed when a packet is being evaluated by a filter that contains an analysis module filter node. Analysis modules should evaluate the packet passed in the associated PluginFilterParam parameter and determine if the packet should be accepted or rejected. If the packet should be accepted, your analysis module should return PLUGIN_RESULT_SUCCESS. If the packet should be rejected, return a value less than zero. You may specify a slice length for the packet by setting the value of the fBytesAccepted field to the number of bytes to slice to. You can use the constant PLUGIN_ACCEPT_WHOLE_PACKET to accept the entire packet without having to specify the packet's actual length. If this packet is accepted into a buffer which also has a slice length specified, slicing will occur at the smallest slice length specified.

This message will only be passed if the analysis module has set the kPluginAttr_Filters attribute during handling of the kPluginMsg_Load message.

It is very important to make the handling of this message as fast as possible to avoid degrading Peek's capture performance.

PluginFilterParam

This structure is passed with the kPluginMsg_Filter message.

typedef struct PluginFilterParam
{
	const PluginPacket* fPacket;
	const UInt8*        fPacketData;
	UInt8               fMediaType;
	UInt8               fMediaSubType;
	UInt16              fProtoSpecMatched;
	SInt16              fBytesAccepted;
	PluginContext       fContext;
} PluginFilterParam;

kPluginMsg_FilterOptions

Peek sends this message when the user is configuring an advanced filter containing an analysis module node. In response to this message, an analysis module should present a dialog box that allows the user to adjust its filtering parameters.

Similar to the kPluginMsg_Filter message, an analysis module must set the kPluginAttr_Filters attribute during handling of the kPluginMsg_Load message.

This message has no accompanying parameter data structure.

kPluginMsg_NameTableUpdate

This message is sent by Peek when a change is made to the Name Table. Analysis modules should update any references or caches of name table entries. There are three types of name table changes: additions, edits, and deletions. Which one is being sent is indicated by the fCommand field in the PluginNameTableUpdateParam structure.

Analysis modules only receive name table notifications if the kPluginAttr_NameTableUpdates attribute was set during the handling of the kPluginMsg_Load message.

Although the associated PluginNameTableUpdateParam structure contains the fContext field, this message is not particular to any single context, and is not sent for each context. In fact, the fContext field always references the context created while handling the kPluginMsg_CreateContext message for the global context.

PluginNameTableUpdateParam

This structure is a parameter to the kPluginMsg_NameTableUpdate message.

typedef struct PluginNameTableUpdateParam
{
	PluginContext        fContext;
	PluginNameTableEntry fEntry;
	UInt16               fCommand;
} PluginNameTableUpdateParam

The fCommand field may contain the following values.

enum
{
	kNameTableUpdateMsg_Add,
	kNameTableUpdateMsg_Edit,
	kNameTableUpdateMsg_Delete
};

kPluginMsg_CreateNewAdapter

Peek sends this message to an analysis module to instruct the module to create a new capture adapter. This occurs when the user double-clicks the "New Remote Adapter" item under the module in the Adapter section of the Capture Options dialog.

The message will only be passed if the analysis module has set the kPluginAttr_PluginAdapter attribute during handling of the kPluginMsg_Load message.

PluginCreateNewAdapterParam

This structure is a parameter to the kPluginMsg_CreateNewAdapter message.

typedef struct PluginCreateNewAdapterParam
{
	TCHAR* fOutSelectedAdapterTag;
	UInt16 fInMaxLength;
} PluginCreateNewAdapterParam;

kPluginMsg_GetAdapterList

Peek sends this message to an analysis module to retrieve the current list of adapters available for this capture module.

The message will only be passed if the analysis module has set the kPluginAttr_PluginAdapter attribute during handling of the kPluginMsg_Load message.

PluginGetAdapterListParam

This structure is passed with the kPluginMsg_GetAdapterList message.

typedef struct PluginGetAdapterListParam
{
	const TCHAR* fOutXMLAdapterList;
	UInt32       fOutXMLStreamLength;
} PluginGetAdapterListParam;

kPluginMsg_DeleteAdapter

Peek sends this message to an analysis module to instruct the module to delete an adapter from it's list. This occurs when the user right-click an adapter and chooses "Delete".

The message will only be passed if the analysis module has set the kPluginAttr_PluginAdapter attribute during handling of the kPluginMsg_Load message.

PluginDeleteAdapterParam

This structure is passed with the kPluginMsg_DeleteAdapter message.

typedef struct PluginDeleteAdapterParam
{
	const TCHAR* fInDeleteID;
} PluginDeleteAdapterParam;

kPluginMsg_SetAdapterAttribs

Peek sends this message to an analysis module to instruct the module to set the attributes of one of it's adapters.

kPluginMsg_GetAdapterAttribs

Peek sends this message to an analysis module to retrieve the attributes of one of it's adapters.

These messages will only be passed if the analysis module has set the kPluginAttr_PluginAdapter attribute during handling of the kPluginMsg_Load message.

PluginAdapterAttribsParam

This structure is passed with the kPluginMsg_SetAdapterAttribs and kPluginMsg_GetAdapterAttribs messages.

typedef struct PluginAdapterAttribsParam
{
	const TCHAR* fAdapterID;
	const TCHAR* fInParamTagStream;
	UInt32       fInParamTagStreamLen;
	const TCHAR* fOutParamTagStream;
	UInt32       fOutParamTagStreamLen;
} PluginAdapterAttribsParam;

kPluginMsg_AdapterProperties

Peek sends this message to an analysis module to allow it to display properties for its adapters.

The message will only be passed if the analysis module has set the kPluginAttr_PluginAdapter attribute during handling of the kPluginMsg_Load message.

PluginAdapterPropertiesParam

This structure is passed with the kPluginMsg_AdapterProperties message.

typedef struct PluginAdapterPropertiesParam
{
	const TCHAR* fInAdapterID;
} PluginAdapterPropertiesParam;

kPluginMsg_DecodePacket

Peek sends this message to an analysis module to inform it that the application is about to decode a packet.

The message will only be passed if the analysis module has set the kPluginAttr_DecodePacket attribute during handling of the kPluginMsg_Load message.

PluginDecodePacketParam

This structure is passed with the kPluginMsg_DecodePacket message.

typedef struct PluginDecodePacketParam
{
	const PluginPacket* fPacket;
	const UInt8*        fPacketData;
	UInt64              fPacketNumber;
	UInt8               fMediaType;
	UInt8               fMediaSubType;
	UInt32              fProtoSpecMatched;
	PluginContext       fContext;
} PluginDecodePacketParam;

kPluginMsg_UserDecode⁽¹¹⁾

Peek sends this message to an analysis module to decode the packet specified.

PluginUserDecodeParam⁽¹¹⁾

This structure is passed with the kPluginMsg_UserDecode message.

typedef struct PluginUserDecodeParam {
	const PluginPacket* fPacket;
	const UInt8*        fPacketData;
	UInt64              fPacketNumber;
	UInt8               fMediaType;
	UInt8               fMediaSubType;
	UInt32              fProtoSpecMatched;
	PluginContext       fContext;
	TCHAR*              fFunctionName;
	PluginContext       fDecodeContext;
	PluginContext       fDecodeState;
} PluginUserDecodeParam;

kPluginMsg_DecodersLoaded⁽¹¹⁾

Peek sends this message to an analysis module when the decoders have been loaded.

This message has no accompanying parameter structure.

kPluginMsg_IsMediaSupported

Peek sends this message to an analysis module to inquire if the analysis module supports the media being used for the capture or for the packet file. The analysis module should return PLUGIN_RESULT_SUCCESS if it supports the media, otherwise the analysis module is not loaded.

The message will only be passed if the analysis module has set the kPluginAttr_MediaSpecific attribute during handling of the kPluginMsg_Load message. Otherwise it is assumed that all medias are supported by the analysis module.

PluginMediaSupportedParam

This structure is passed with the kPluginMsg_IsMediaSupported message.

typedef struct PluginMediaSupportedParam
{
	UInt8 fMediaType;
	UInt8 fMediaSubType;
} PluginMediaSupportedParam;

kPluginMsg_ProcessPluginMessage⁽¹¹⁾

Peek sends this message to an analysis module when it receives a response from a SendPluginMessageProc call to a remote engine. The analysis module should return PLUGIN_RESULT_SUCCESS if it received the message.

The message will only be passed if the analysis module has set the kPluginAttr_ProcessPluginMessages attribute set during the handling of the kPluginMsg_Load message.

PluginProcessPluginMessageParam⁽¹¹⁾

This structure is passed with the kPluginMsg_ProcessPluginMessage message.

typedef struct PluginProcessPluginMessageParam
{
	const UInt8*  fData;
	UInt32        fDataLen;
	UInt32        fResult;
	PluginContext fContext;
} PluginProcessPluginMessageParam;

kPluginMsg_HandleNotify⁽¹¹⁾

Peek sends this message to an analysis module when Peek is handling a notification.

The message will only be passed if the analysis module set the kPluginAttr_HandlesNotify attribute during the handling of the kPluginMsg_Load message.

PluginHandleNotifyParam⁽¹¹⁾

This structure is passed with the kPluginMsg_HandleNotify message.

typedef struct PluginHandleNotifyParam
{
	UInt64        fTimeStamp;
	UInt8         fSeverity;
	const TCHAR*  fShortMessage;
	const TCHAR*  fLongMessage;
	UInt32        fFlags;
	PluginContext fContext;
} PluginHandleNotifyParam;

The fSeverity field may take one of the following severity levels:

enum
{
	kNotifySeverity_Informational,
	kNotifySeverity_Minor,
	kNotifySeverity_Major,
	kNotifySeverity_Severe
};

kPluginMsg_GetTextForPacketListCell⁽¹²⁾

Peek sends this message to an analysis module when Peek needs a textual representation for a custom packet list column cell. The textual representation is typically only requested when exporting the packets list, such as to a text file or to the Windows clipboard. This message is sent for each packet/row being exported.

The analysis module should return PLUGIN_RESULT_SUCCESS if a textual representation is supported, even if the cell is empty. If the column does not support a textual representation, then PLUGIN_RESULT_ERROR should be returned. Whichever value is returned, it must be consistent for all packets/rows because it is used to determine whether to include the cell in a packet/row's delimited output. If that is not consistent, then the resulting delimited text will be ragged.

This message will only be sent if the analysis module previously added a custom column by invoking the SetPacketListColumnProc callback.

PluginGetTextForPacketListCellParam⁽¹²⁾

This structure is passed with the kPluginMsg_GetTextForPacketListCell message.

typedef struct PluginGetTextForPacketListCellParam
{
	PluginContext                     fInContext;
	const PluginPacketProcessingInfo* fInPacketProcessingInfo;
	const PluginID*                   fInColumnID;
	TCHAR*                            fOutCellText;
	UInt32                            fInCellTextMaxLength;
} PluginGetTextForPacketListCellParam;

kPluginMsg_MeasurePacketListCell⁽¹²⁾

Peek sends this message to an analysis module when the contents of a custom packet list column cell must be measured. This is typically only requested when the user double-clicks on the column header's divider to invoke an auto-size operation on the column. This message is sent for each packet/row being measured.

The analysis module should return PLUGIN_RESULT_SUCCESS if measurement of the column's cells is supported. If the column does not support auto-sizing, then PLUGIN_RESULT_ERROR should be returned, in which case the column will remain its current size.

An analysis module has the option of calculating the size itself or, if the column contains just a single line of text, letting Peek perform the measurement based on the cell's text.

• If the analysis module chooses to calculate the size, it must set the fOutCellContentsSize dimensions (not including any padding/margin between the contents and the cell borders, as Peek will automatically incorporate whitespace for a consistent appearance across all cells) and set the fOutDefaultMeasure field to false.
• If the analysis module wishes to allow Peek to perform the measurement for it, it must supply Peek with the cell's text in the fOutCellText buffer and set the fOutDefaultMeasure field true.

This message will only be sent if the analysis module previously added a custom column by invoking the SetPacketListColumnProc callback.

PluginMeasurePacketListCellParam⁽¹²⁾

This structure is passed with the kPluginMsg_MeasurePacketListCell message.

typedef struct PluginMeasurePacketListCellParam
{
	PluginContext                     fInContext;
	const PluginPacketProcessingInfo* fInPacketProcessingInfo;
	const PluginID*                   fInColumnID;
	TCHAR*                            fOutCellText;
	UInt32                            fInCellTextMaxLength;
	PluginDrawingHandle               fInDrawingHandle;
	UInt32                            fIoDrawingStates;
	PluginSize                        fOutCellContentSize;
	bool                              fOutDefaultMeasure;
} PluginGetTextForPacketListCellParam;

The fIoDrawingStates field may take a combination of the following flags. kDrawingState_Selected and kDrawingState_Focused are not applied for this message because they are for appearances only should not have an impact on cell sizes. Should the analysis module choose to let Peek measure the cell's text (by setting fOutDefaultMeasure to true), kDrawingState_Italic can be set by the analysis module to force the italic font to be used for the calculation.

enum
{
	kDrawingState_Selected = 0x00000001,
	kDrawingState_Focused  = 0x00000002,
	kDrawingState_Italic   = 0x00000004
};

kPluginMsg_DrawPacketListCell⁽¹²⁾

Peek sends this message to an analysis module when the contents of a custom packet list column cell must be rendered. This message is sent for each packet/row being measured and should be handled as quickly as possible to prevent slowing down the refreshing of the packet list view.

An analysis module has the option of drawing the cell contents itself or, if the column contains just a single line of text, letting Peek render the cell's text.

• If the analysis module chooses to draw the contents, it must set do so using the device context handle in the fInDrawingHandle and set the fOutDefaultDraw field to false.
• If the analysis module wishes to have Peek perform the rendering, it must supply Peek with the cell's text in the fOutCellText buffer and set the fOutDefaultDraw field true. The analysis module may still customize the text's appearance by setting the cell's foreground and background colors, and by indicating whether the text should be italicized.

This message will only be sent if the analysis module previously added a custom column by invoking the SetPacketListColumnProc callback.

PluginDrawPacketListCellParam⁽¹²⁾

This structure is passed with the kPluginMsg_DrawPacketListCell message.

typedef struct PluginPacketListCellDrawingInfo
{
	PluginRect  fInBounds;
	PluginRect  fInContentRect;
	PluginColor fIoForeColor;
	PluginColor fIoBackColor;
} PluginPacketListCellDrawingInfo;
	
typedef struct PluginDrawPacketListCellParam
{
	PluginContext                     fInContext;
	const PluginPacketProcessingInfo* fInPacketProcessingInfo;
	const PluginID*                   fInColumnID;
	TCHAR*                            fOutCellText;
	UInt32                            fInCellTextMaxLength;
	PluginDrawingHandle               fInDrawingHandle;
	UInt32                            fIoDrawingStates;
	PluginPacketListCellDrawingInfo*  fInCellDrawingInfo;
	bool                              fOutDefaultDraw;
} PluginGetTextForPacketListCellParam;

The fIoDrawingStates field may take a combination of the following flags. kDrawingState_Selected and kDrawingState_Focused are applied according to whether the packet/row is highlighted and/or focused. Should the analysis module choose to let Peek measure the cell's text (by setting fOutDefaultDraw to true), kDrawingState_Italic can be set by the analysis module to force the italic font to be used for drawing the text.

enum
{
	kDrawingState_Selected = 0x00000001,
	kDrawingState_Focused  = 0x00000002,
	kDrawingState_Italic   = 0x00000004
};

kPluginMsg_ContextOptions⁽¹²⁾

Peek sends this message to an analysis module when its options are to be configured for a particular file/capture context. Specifically, when the user is viewing the Analysis Modules page of the Capture Options dialog, highlights an analysis module, and then clicks the Options... button. Analysis modules typically present a modal dialog to the user in response and return the configuration back to Peek as XML.

An analysis module must set the kPluginAttr_HasContextOptions attribute during handling of the kPluginMsg_Load message in order to receive this message.

This message is sent in two situations:

• The capture is about to be created and the user is editing capture options beforehand. In this case, the analysis module context has not yet been associated with the capture (kPluginMsg_CreateContext has not yet been sent and the fContext field will be NULL). The analysis module will present an options dialog and then return the resulting configuration XML to Peek via the fOutNewPrefs field. At a later time, once the capture has been created, the configuration XML will be handed back sometime later along with the kPluginMsg_SetContextPrefs message once so that the associated context options can be properly applied.
• The capture has already been created and the user is editing capture options afterward. There will be an analysis module context associated with the capture (in the fContext field). The analysis module must apply the configuration changes to its context directly, as no subsequent kPluginMsg_SetContextPrefs message will be sent. The configuration XML should still be returned to Peek via the fOutNewPrefs field though.

PluginContextOptionsParam

This structure is passed with the kPluginMsg_ContextOptions message.

typedef struct PluginContextOptionsParam
{
	const wchar_t*  fInOldPrefs;
	UInt32          fInOldPrefsLength;
	wchar_t*        fOutNewPrefs;
	UInt32          fOutNewPrefsLength;
	PluginContext   fContext;
} PluginContextOptionsParam;

kPluginMsg_SetContextPrefs⁽¹²⁾

Peek sends this message to an analysis module when its options should be changed for a particular file/capture context. The analysis module must parse the incoming XML and apply the configuration.

kPluginMsg_GetContextPrefs⁽¹²⁾

Peek sends this message to an analysis module when to get its options for a particular file/capture context. The analysis module must create and return XML representing the configuration.

Both messages require that an analysis module sets the kPluginAttr_HasContextOptions attribute during handling of the kPluginMsg_Load message in order to be received.

PluginContextPrefsParam

This structure is passed with the kPluginMsg_SetContextPrefs and kPluginMsg_GetContextPrefs messages.

typedef struct PluginContextPrefsParam
{
	UInt32        fFlags;
	TCHAR*        fIoPrefs;
	UInt32        fIoPrefsLength;
	PluginContext fContext;
} PluginContextPrefsParam;

kPluginMsg_ProcessTime⁽¹²⁾

Peek sends this message to an analysis module at one second intervals. These messages are sent even when plugins are disabled from the Performance tab.

This messages require that an analysis module sets the kPluginAttr_HandlesProcessTime attribute during handling of the kPluginMsg_Load message in order to be received.

PluginProcessTimeParam

This structure is passed with the kPluginMsg_ProcessTime message.

typedef struct PluginProcessTimeParam
{
	PluginContext fContext;
} PluginProcessTimeParam;