[Wireshark-dev] Connecting to router

2009-04-27 Thread Rohan Solanki
Hi all, While i was searching on the web of how to connect wireshark to a router, I found the following link http://www.plus.net/support/broadband/troubleshooting/wireshark.shtml In this link, in the 3rd step, in the 3rd sub-step, it states that Select the relevant network interface from the

[Wireshark-dev] [Full-disclosure] SniffJoke 0.3 release and request for feedback (forw)

2009-04-27 Thread Joerg Mayer
Should it be considered a bug if WS can be fooled by a tool like Sniffjoke to incorrectly reassemble a TCP stream? The webpage has two sample traces that seem to be handeled incorrectly by HEAD indeed. Ciao Joerg - Forwarded message from vecna ve...@s0ftpj.org - Delivered-To:

Re: [Wireshark-dev] [Full-disclosure] SniffJoke 0.3 release and requestfor feedback (forw)

2009-04-27 Thread Sake Blok
As the purpose of Wireshark is to display network traffic to analyse problems, I see no use in competing in a race to cloak and uncloak traffic with Sniffjoke. That would put Wireshark in the list of cracking tools which might have a negative effect on the places where it is allowed to be used.

[Wireshark-dev] Re : Tr : Dissector preferences reuse

2009-04-27 Thread yvanmmailbox-web
Hi, thanks for this help, Jeff, sharing variable is a good idea. I tried with a range_t used for user-defined udp ports like that: in packet-plugin1.h: extern range_t *bite_udp_range; in packet-plugin1.c: #include packet-plugin1.h ... range_t *bite_udp_range; ... /*in

[Wireshark-dev] buildbot failure in Wireshark (development) on OSX-10.5-ppc

2009-04-27 Thread buildbot-no-reply
The Buildbot has detected a new failure of OSX-10.5-ppc on Wireshark (development). Full details are available at: http://buildbot.wireshark.org/trunk/builders/OSX-10.5-ppc/builds/1003 Buildbot URL: http://buildbot.wireshark.org/trunk/ Buildslave for this Build: osx-10.5-ppc Build Reason:

Re: [Wireshark-dev] [Full-disclosure] SniffJoke 0.3 release and requestfor feedback (forw)

2009-04-27 Thread Sébastien Tandel
SniffJoke has a nice/interesting characteristic : It is *only* used by the sender *not* by the receiver. SniffJoke, thanks to some tricks - which *does not* have impact on the receiver's TCP/IP stack (for all OSes?) -, is able fool sniffers and some others network tools. I would expect

Re: [Wireshark-dev] [Full-disclosure] SniffJoke 0.3 release and requestfor feedback (forw)

2009-04-27 Thread Tamazov, Artem
Hello Sebastien, If you consider there is a bug in wireshark, please create relevant bug in BugZilla. Please see [http://wiki.wireshark.org/ReportingBugs] for instructions. I believe every WS developer will appreciate that. thanks, artem// From:

Re: [Wireshark-dev] [Full-disclosure] SniffJoke 0.3 releaseandrequestfor feedback (forw)

2009-04-27 Thread Sake Blok
Hi Sebastien, Unfortunately SniffJoke does a lot more (sending RST with bogus seq numbers, sending SYN/FIN/RST frames, etc, I have not looked at all the frames yet). It would take quite some effort and code to analyse the frames and consider the context to disregard them when doing a follow

[Wireshark-dev] IEC dissectors

2009-04-27 Thread Roman Lisagor
Hi guys, Came across an Ethereal-based analyzer for IEC61850, IEC60870-6 TASE.2 (ICCP), MMS, UCA2, and IEEE C.37-118. First link on this page: http://www.sisconet.com/techinfo.htm Looks like I can download the binaries but the source is missing. Those dissectors also don't seem to be part of

Re: [Wireshark-dev] Parsing array and its size in EcDoRpcExt2

2009-04-27 Thread ronnie sahlberg
There are a number of places where the length variable comes after the array. I think there are even places where there are other variables separating the length and the array apart in some places. This is all allowed in DCE/RPC and the reason for this is that length is just a normal variable.