[Wireshark-dev] Capturing data from Visual Studio .NET 2005

2006-12-02 Thread metasharp
Hello, I am trying to capture HTTP data from Visual C# express 2005. I'm after the PHPSESSID that transit through cookies in web requests but which is not stored locally on the client side file cookie. The scenario is this one: - i visit a website (which uses php sessions) - i capture the

Re: [Wireshark-dev] Trying to add computed value

2006-12-02 Thread Hal Lander
Thanks for the solution, I had the same problem. Its probably a good idea to also put; item=proto_tree_add_uint(my_tree, hf_my_item, tvb, offset, length, my_item_value); PROTO_ITEM_SET_GENERATED(item); That way Wireshark puts square brackets round the field to show it is calculated. If you

Re: [Wireshark-dev] Should I create virtual fields for use in display filters

2006-12-02 Thread Hal Lander
Very helpful feedback, but I have three questions; The actual size could be obtained from tvb_length(tvb). That's not guaranteed to be the actual size of the packet. tvb_length() returns the amount of data in the tvbuff; because a capture can be made with a snapshot length less than the

Re: [Wireshark-dev] Should I create virtual fields for use in display filters

2006-12-02 Thread Guy Harris
Hal Lander wrote: How does tvb_reported_length() know the actual length of the packet if the full packet was not captured? Because the full packet was received; it was just cut short in the process of supplying it to the capture mechanism (i.e., all the packet data was available, but only