[Wireshark-dev] Is 'mark all packets' functionality widely used (or is it useful?)?

2009-03-22 Thread yami
Hi dev, I can not figure out why marking all packets is a useful functionality. Could anyone kindly give some use cases? Asking such a question is because marking all packets is really slow even if the capture size is not that big. If it is not that useful, or not widely used, perhaps we can

Re: [Wireshark-dev] one possible way to speed up filtering

2009-03-22 Thread ronnie sahlberg
Another way to greatly speed up filtering would be to pick up and clomplete the work to make it possible to use ep_* memory for all field types when dissecting a packet. When wireshark dissects a packet it performs a massive amount of malloc()/free(). This was partially addressed when I added

Re: [Wireshark-dev] Is 'mark all packets' functionality widely used (or is it useful?)?

2009-03-22 Thread Stephen Fisher
On Sun, Mar 22, 2009 at 03:08:05PM +0800, yami wrote: I can not figure out why marking all packets is a useful functionality. Could anyone kindly give some use cases? You can mark all packets, then unmark certain ones before saving. Steve

Re: [Wireshark-dev] Is 'mark all packets' functionality widely used (or is it useful?)?

2009-03-22 Thread yami
I see. Thanks! Of course we can mark the excluded ones and save 'unmarked packets' for this scenario, however I feel 'saving unmarked' is not intuitive for end users. On Sun, Mar 22, 2009 at 3:51 PM, Stephen Fisher st...@stephen-fisher.comwrote: On Sun, Mar 22, 2009 at 03:08:05PM +0800, yami

[Wireshark-dev] complie fail on WinXP 32bit

2009-03-22 Thread Andreas Heise
Hi list, I followed the developers guide to build wireshark from trunk rev 27814 on WinXP. complie is running long time, so the basics should setup correctly, but then it fails during make of *tshark-tap-register.c* environment: WinXP SP3 32bit Microsoft Visual C++ 2008 Express Edition Python

Re: [Wireshark-dev] Unable to Display Simple Protocol Tree

2009-03-22 Thread wsgd
1) is proto_x2d well initialized ? 2) why use static for your variables ? 3) take the AMIN example and modify it step by step, you will find the problem 4) I have no idea Olivier Dix, Steven E a écrit : I've been trying to get dissector plugin that I'm coding to display subtree information

Re: [Wireshark-dev] Is 'mark all packets' functionality widely used(or is it useful?)?

2009-03-22 Thread Sake Blok
When you have filtered frames using a display filter, Mark All will mark all the displayed items. You can then use a different diplay filter to match some other packets, mark them and so on. Then you can save all the marked frames without having to use a super-complex display filter to match

Re: [Wireshark-dev] Is 'mark all packets' functionality widely used(or is it useful?)?

2009-03-22 Thread Maynard, Chris
Mark all packets doesn't necessarily mark all packets in the capture file. It only marks all currently displayed packets, which could be any subset depending on the display filter applied. From: wireshark-dev-boun...@wireshark.org [mailto:wireshark-dev-boun...@wireshark.org] On Behalf Of

Re: [Wireshark-dev] complie fail on WinXP 32bit

2009-03-22 Thread Bill Meier
Andreas Heise wrote: Hi list, I followed the developers guide to build wireshark from trunk rev 27814 on WinXP. complie is running long time, so the basics should setup correctly, but then it fails during make of *tshark-tap-register.c* environment: WinXP SP3 32bit Microsoft

Re: [Wireshark-dev] complie fail on WinXP 32bit

2009-03-22 Thread Andreas Heise
Hi Bill, thanks for your reply, if I called directly from cygwin bash it's OK... ahe...@83888ab05d01485 /cygdrive/c/wireshark $ bash -o igncr ahe...@83888ab05d01485 /cygdrive/c/wireshark $ grep '^register_tap_listener_[a-z_0-9A-Z]* *(' \tap-rtp.c 2/dev/null | \ grep -v ';' | \ sed -e

Re: [Wireshark-dev] complie fail on WinXP 32bit

2009-03-22 Thread Andreas Heise
yes, I always used make distclean before make all regards, Andreas 2009/3/22 Anders Broman a.bro...@telia.com Did you try distclean before building, if you downloaded a tar ball? Regards Anders -- *Från:* wireshark-dev-boun...@wireshark.org [mailto:

Re: [Wireshark-dev] g_snprintf() and sizeof

2009-03-22 Thread Jakub Zawadzki
On Thu, Mar 19, 2009 at 08:06:55PM +0100, Jakub Zawadzki wrote: On Thu, Mar 19, 2009 at 11:12:03AM -0700, Guy Harris wrote: Warning: g_snprintf()'s function signature has an annoying botch in it - the size argument is a gulong, not a gsize. Not a problem in the UN*X and Windows ILP32

Re: [Wireshark-dev] Unable to Display Simple Protocol Tree

2009-03-22 Thread Dix, Steven E
1) I think it is. Within my proto_register_x2d routine, I call as follows to register: if (-1 == proto_x2d) { proto_x2d = proto_register_protocol (X2D Protocol, X2D, x2d); } Variable proto_x2d is a static int, initialized to -1. After the

Re: [Wireshark-dev] one possible way to speed up filtering

2009-03-22 Thread didier
Hi, Le dimanche 22 mars 2009 à 02:13 +0800, yami a écrit : Hi Didier, Thank you for trying the patch :) and all the good comments given. I've attached a new patch to the wiki. Please see my detailed reply below. - If compiled without NDEBUG defined I get a failed

Re: [Wireshark-dev] complie fail on WinXP 32bit

2009-03-22 Thread Bill Meier
Andreas Heise wrote: Hi Bill, thanks for your reply, if I called directly from cygwin bash it's OK... $ bash -o igncr $ grep '^register_tap_listener_[a-z_0-9A-Z]* *(' \tap-rtp.c 2/dev/null | \ grep -v ';' | \ sed -e 's/(.*//' register_tap_listener_rtp_streams $ any other

Re: [Wireshark-dev] complie fail on WinXP 32bit

2009-03-22 Thread Joerg Mayer
On Sun, Mar 22, 2009 at 06:48:30PM -0400, Bill Meier wrote: thanks for your reply, if I called directly from cygwin bash it's OK... ... any other idea? Seems to be a problem of variables $... ?! I'm not sure what you mean by a problem of variables $... . I didn't follow this thread (as

Re: [Wireshark-dev] one possible way to speed up filtering

2009-03-22 Thread yami
Hi, On Mon, Mar 23, 2009 at 5:24 AM, didier dgauthe...@magic.fr wrote: I'll try to merge it with http://wiki.wireshark.org/Development/Optimization , this version is already able to find 2000 DNS packets inside 7 millions packets in 1 second. Amazing! It looks that you've done several big