Re: [Wireshark-dev] [Wireshark-commits] rev 20385: /trunk/ /trunk/packaging/nsis/: wireshark.nsi /trunk/: Makefile.am

2007-01-10 Thread Luis Ontanon
We could migrate the EXTRA_DIST macro from trunk/Makefile.am to trunk/Makefile.common and use it to generate the distribution files for windows too. Generating an extra_dist.ini file for nsi if in fact it does support including files? On 1/10/07, Ulf Lamping [EMAIL PROTECTED] wrote: [EMAIL

Re: [Wireshark-dev] [Wireshark-commits] rev 20385: /trunk/ /trunk/packaging/nsis/: wireshark.nsi /trunk/: Makefile.am

2007-01-10 Thread Luis Ontanon
On 1/11/07, Ulf Lamping [EMAIL PROTECTED] wrote: Luis Ontanon wrote: We could migrate the EXTRA_DIST macro from trunk/Makefile.am to trunk/Makefile.common and use it to generate the distribution files for windows too. Generating an extra_dist.ini file for nsi if in fact it does support

[Wireshark-dev] SNMPv3 USM decryption

2007-01-11 Thread Luis Ontanon
Hi folks, in rev 20393 I checked in the code to verify authentication and dercypt SNMPv3 packets. Now, I only have a limited set of SNMP packets against which to test the code, all of them generated by net-snmp. It would be nice if other people could test the feature maybe against something

Re: [Wireshark-dev] [Wireshark-users] If anyone is willing to look at a capture???? TCP out of order segments

2007-01-11 Thread Luis Ontanon
ronnie, You should take a look at this capture. These out-if-order packets look to me more like retransmissions. L, It appears that 192.168.70.42 transmits twice every TCP packet. What's the cause I can't tell but that's certainly a problem of that box. Try disabling the firewall if you

Re: [Wireshark-dev] [Wireshark-bugs] [Bug 1301] New: File Open dialog preview needs 3s for large invalid files and appears dead

2007-01-13 Thread Luis Ontanon
fixed in revision 20424 On 1/14/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1301 Summary: File Open dialog preview needs 3s for large invalid files and appears dead Product: Wireshark

Re: [Wireshark-dev] [PATCH] mem leak in dissect_ip_tcp_options

2007-01-14 Thread Luis Ontanon
ep_alloc allocates a buffer that is freed automatically before passing to the next packet. It is not leaked. see doc/README.malloc and/or epan/emem.h On 1/14/07, Sebastien Tandel [EMAIL PROTECTED] wrote: Hi all, I provide a patch for a memory leak in dissect_ip_tcp_options. Each time a

Re: [Wireshark-dev] [Wireshark-commits] rev 20437: /trunk/ /trunk/epan/dissectors/: packet-ethertype.c packet-frame.c /trunk/epan/: emem.c exceptions.h packet.c /trunk/: file.c

2007-01-15 Thread Luis Ontanon
that's glib2 only, what about select()? On 1/15/07, Stephen Fisher [EMAIL PROTECTED] wrote: On Mon, Jan 15, 2007 at 05:16:15AM +, [EMAIL PROTECTED] wrote: XXX - to prevent a busy wait, I need a portable way to wait for a short time period, like Sleep() for Windows How about

[Wireshark-dev] 120 filters compiled by ncp2222 dissector

2007-01-15 Thread Luis Ontanon
While hacking on the dfilter machinery I noticed that final_registration_ncp() compiles 120 displays filters. What I can't find in the code is what these are used for as no part of the code uses them. Are these realy necessary? Luis -- This information is top security. When you have read

Re: [Wireshark-dev] [Wireshark-commits] rev 20445: /trunk/gtk/ /trunk/gtk/: help_dlg.c

2007-01-15 Thread Luis Ontanon
On 1/15/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=20445 User: ulfl Date: 2007/01/15 10:17 PM Log: Help: - Win32 only: try to load help page from local user-guide.chm (if HHC_DIR is set in config.nmake) and if that

Re: [Wireshark-dev] [Wireshark-commits] rev 20445: /trunk/gtk/ /trunk/gtk/: help_dlg.c

2007-01-15 Thread Luis Ontanon
On 1/16/07, Ulf Lamping [EMAIL PROTECTED] wrote: Luis Ontanon wrote: using file:///usr/local/share/wireshark/wsug/%s could be little less painful than the internet way. Specially if the box is not wired to the wild. Yes, and I would appreciate it. It would have another advantage

Re: [Wireshark-dev] [Wireshark-commits] rev 20442: /trunk/tools/lemon/ /trunk/tools/lemon/: lemon.c

2007-01-16 Thread Luis Ontanon
They commited what we got in rev 20447. As this does not happen to me (I'm running with MallocBadFreeAbort) I would need a a backtrace where the yyminor value passed to DtdParse() shows up. can you -DDEBUG_DTD_PARSER and send in the trace for the parser. Thanks. Luis On 1/16/07, Douglas

Re: [Wireshark-dev] [Wireshark-commits] rev 20442: /trunk/tools/lemon/ /trunk/tools/lemon/: lemon.c

2007-01-16 Thread Luis Ontanon
in order to avoid this one you just have to rename the dtds directory, no dtds directory no dtds get parsed. On 1/16/07, Douglas Pratley [EMAIL PROTECTED] wrote: I get a similar crash under Windows. I'm having trouble reverting back to a good baseline without losing today's work, so it would be

Re: [Wireshark-dev] [Wireshark-commits] rev 20442: /trunk/tools/lemon/ /trunk/tools/lemon/: lemon.c

2007-01-16 Thread Luis Ontanon
= 0x8583d38, yy44 = 0x8583d38 smil8=X\b:10, yy59 = 0x8583d38, yy81 = 14568} (gdb) On 1/16/07, Luis Ontanon [EMAIL PROTECTED] wrote: They commited what we got in rev 20447. As this does not happen to me (I'm running with MallocBadFreeAbort) I would need a a backtrace where the yyminor

Re: [Wireshark-dev] [Wireshark-commits] rev 20467: /trunk/ /trunk/epan/dfilter/: Makefile.am Makefile.nmake dfilter-macro.c dfilter-macro.h dfilter.c dfilter_macro_load.l /trunk/gtk/: macros_dlg.c mac

2007-01-17 Thread Luis Ontanon
FYC I added macros to the display filter engine. At startup the df_macros in either userdir or (if not found) datadir will be loaded (if there is one). The GUI dialog is just a dummy allows you to see. the format of the file is as follows, I believe they are self explanatory: -- example

Re: [Wireshark-dev] alias problem

2007-01-18 Thread Luis Ontanon
However to assign many addresses I used to assing entire classes of addresses to a loopback interface (usually lo1) and have routed (rip) announcing routes to them through the wired interfaces that had just one address, If your OS supports it (at least BSDs do) that's cleaner. Luis On 1/18/07,

Re: [Wireshark-dev] Where is dfilter_macro_expand.l

2007-01-18 Thread Luis Ontanon
in the past... I re-wrote the function in C instead of using the lex scanner, What I realy forgot was to remove it from Makefile.nmake. Sorry Luis On 1/18/07, Jaap Keuter [EMAIL PROTECTED] wrote: Hi, Where is dfilter_macro_expand.l The Win32 buildbot needs it. cd .. cd

Re: [Wireshark-dev] Win32: The best way to solve dependencies for user-guide.chm / HHC_DIR?

2007-01-18 Thread Luis Ontanon
However for unix the real issue is to have the html files been built. I thought about parameterized Makefile.am and a catalog.xml.in that overwrite both files from the repo (used by cygwin) if --with-fop=xxx --with-docbook=yyy options are passed to ./configure. What the --with-fop option should

Re: [Wireshark-dev] [Wireshark-commits] rev 20491: /trunk/docbook/ /trunk/docbook/: Makefile

2007-01-18 Thread Luis Ontanon
maybe not, but the following perl command line does the work. # this nativizes eols ${PERL} -ae 'chomp; print $_\n;' # this DOSifies eols ${PERL} -ae 'chomp; print $_\012\015;' # this Unixizes eols ${PERL} -ae 'chomp; print $_\015;' # this OldMacIzes eols ${PERL} -ae 'chomp; print $_\012;'

Re: [Wireshark-dev] [Wireshark-commits] rev 20491: /trunk/docbook/ /trunk/docbook/: Makefile

2007-01-18 Thread Luis Ontanon
oops that would be $(PERL) -ae 'chomp; print $_\015;' infile outfile On 1/19/07, Luis Ontanon [EMAIL PROTECTED] wrote: maybe not, but the following perl command line does the work. # this nativizes eols ${PERL} -ae 'chomp; print $_\n;' # this DOSifies eols ${PERL} -ae 'chomp; print $_\012

Re: [Wireshark-dev] [Wireshark-commits] rev 20514: /trunk/epan/wslua/ /trunk/epan/wslua/: wslua_gui.c

2007-01-21 Thread Luis Ontanon
this should go into 0.99.5 On 1/21/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=20514 User: lego Date: 2007/01/21 05:05 PM Log: fix bug 1320 Directory: /trunk/epan/wslua/ ChangesPath Action +1 -1

Re: [Wireshark-dev] [Wireshark-commits] rev 20515: /trunk/epan/wslua/ /trunk/epan/wslua/: template-init.lua

2007-01-21 Thread Luis Ontanon
Gerald, this should go in 0.99.5 On 1/21/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=20515 User: lego Date: 2007/01/21 05:06 PM Log: fix bug 1321 Directory: /trunk/epan/wslua/ ChangesPath Action

Re: [Wireshark-dev] Using Lua to parse TCP encapsulated IP protocol

2007-01-23 Thread Luis Ontanon
Hi, * Can you test it against 0.99.5pre1? I cannot make it crash (works OK for me), could you send the capture file that does crash? Could you eventually send in also the output of wireshark -v Thanks Luis BTW sub_buf = buffer( 4, buffer:len() - 4 ):tvb() is the same as sub_buf = buffer(4):tvb()

Re: [Wireshark-dev] Warning about radius directory

2007-01-26 Thread Luis Ontanon
The radius dictionary gets loaded way before preferences are evaluated. Giving no warning and then having the packets undecoded isn't elegant. Your patch suppresses the error altoghether which is not a nice solution. What you can do is just add a dummy radius dir and a dummy dictionary: $ cd

Re: [Wireshark-dev] Warning about radius directory

2007-01-26 Thread Luis Ontanon
that has written such user configurable dissectors so far... I also failed to understand why tshark does not give this warning message. maybe g_warning is handled differently (?) Regards Andrej On Sat, 27.Jan.07 01:55:35 +0100, Luis Ontanon wrote: The radius dictionary gets loaded way before

Re: [Wireshark-dev] [PATCH] Support ALCAP, NBAP over SSCOP in K12xx

2007-01-27 Thread Luis Ontanon
Few thoughts on this see inline On 1/28/07, Martin Mathieson [EMAIL PROTECTED] wrote: On 1/27/07, Kriang Lerdsuwanakij [EMAIL PROTECTED] wrote: With above 3 changes together, dissecting Iub traces are correct for control and signaling planes. I am still investigating user plane frames

Re: [Wireshark-dev] [PATCH] Read K12xx .rf file with extra_len == 0

2007-01-27 Thread Luis Ontanon
Committed revision 20579. On 1/27/07, Kriang Lerdsuwanakij [EMAIL PROTECTED] wrote: Hello I found out the reason Wireshark refuses to read some .rf file I have. Those files have zero extra_len in SRCDEST header structure. See the attached file for example. It was created by selecting some

Re: [Wireshark-dev] [PATCH] Support ALCAP, NBAP over SSCOP in K12xx

2007-01-27 Thread Luis Ontanon
Committed revision 20580. On 1/27/07, Kriang Lerdsuwanakij [EMAIL PROTECTED] wrote: Hello This patch add some capability for reading K12xx .rf5 files. Currently Wireshark has trouble dissecting .rf5 captured from UMTS ATM-based Iub interface. According to example configuration file at:

Re: [Wireshark-dev] Need help about subprotocol

2007-01-27 Thread Luis Ontanon
On 1/27/07, Bingyao Du [EMAIL PROTECTED] wrote: Hi Amit My problem is there are too many fields in only one protocol. So, I want to split the packet into two independent dissectors. I attached it:) Trust me they are not that many... take a look at packet-alcap.c (just one example and see it

[Wireshark-dev] User Accessible Tables, please review

2007-01-28 Thread Luis Ontanon
from uat.h * uat mantains a dynamically allocated table accessible to the user * via a file and/or gui tables. * * the file is located either in userdir(when first read or when writen) or * in datadir for defaults (read only , it will be always written to userdir). * * the behaviour of the

Re: [Wireshark-dev] User Accessible Tables, please review

2007-01-28 Thread Luis Ontanon
On 1/28/07, Ulf Lamping [EMAIL PROTECTED] wrote: [snip] Well, first of all, what problem do you try to solve here? the lack of an uniform way to deal with tables, they are dealt differently when they could be dealt in a single uniform way. I have four diferent examples I wrote myself: four

Re: [Wireshark-dev] dissector registration

2007-01-28 Thread Luis Ontanon
does the foo protocol registers a protocol table (foo.port) in its registration function? (see packet.h:258) On 1/28/07, Vladimir Zherdenovsky [EMAIL PROTECTED] wrote: Hi, I want to write a dissector to a foo protocol inside UDP that includes another goo protocol inside. How can I

Re: [Wireshark-dev] Using Lua to parse TCP encapsulated IP protocol

2007-01-29 Thread Luis Ontanon
for the tip on the sub range creation. I thought that might work, but when the program was crashing, I was a bit leery about going beyond the example code I found. Thanks again for the help. -Scott Date: Tue, 23 Jan 2007 21:42:32 +0100 From: Luis Ontanon [EMAIL PROTECTED] Subject: Re: [Wireshark

Re: [Wireshark-dev] Using Lua to parse TCP encapsulated IP protocol

2007-01-29 Thread Luis Ontanon
No luck, I cannot get it to crash by using that data by itself. could you send me in a capture file with the one packet that caused the crash so I can study that crash? Thanks, Luis On 1/29/07, Luis Ontanon [EMAIL PROTECTED] wrote: Well the Lua API should intercept those conditions that would

[Wireshark-dev] wslua refereance manual

2007-01-29 Thread Luis Ontanon
It's been few days that I got wslua's reference manual into the docbook directory, it's built OK (at least it loos so from here). What's to be done to add it to the distribution? -- This information is top security. When you have read it, destroy yourself. -- Marshall McLuhan

Re: [Wireshark-dev] Add checksum validation option for MTP2

2007-02-05 Thread Luis Ontanon
On 2/5/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: Hello Jeff, Thank you for your comments, I will follow your advices and request a new DLT for MTP2 with FCS. But before, I will, first, ask for the agreement of the board manufacturer. I hope they will not disagree.. In the same

Re: [Wireshark-dev] Add checksum validation option for MTP2

2007-02-05 Thread Luis Ontanon
something ? Best regards Florent Luis Ontanon [EMAIL PROTECTED] To: Developer support list for Wireshark Sent by: wireshark-dev@wireshark.org [EMAIL PROTECTED

Re: [Wireshark-dev] Option to allow processing of unrecognised Data-link level PCAP file

2007-02-05 Thread Luis Ontanon
If the DLT is to be a stadard one why not register it? If it is a private one why not use DLTS USER0..USER15. There's the DLT User A-D dissector in preferences that allow you to specify any given dissector to be used against pcap files with those encapsulations (I often do). Luis On 2/5/07,

Re: [Wireshark-dev] Dissecting XML payload

2007-02-06 Thread Luis Ontanon
There's not full DTD support (some features are not implemented, some DTDs need to be massaged) but there's enough to obtain fileds against which to filter from a DTD file. To have your DTD file loaded you can copy it in the dtds/ directory that you can find in the data directory (the one with

Re: [Wireshark-dev] Dissector works with .pcap file but does not work with .pkt file

2007-02-06 Thread Luis Ontanon
The way things work *.pkt can be in any format, wiretap recognizes file types by its contents. Can you be more specific about the file format? If you use capinfos, what it says about it? BTW, In order to have it fixed we need two files that show this behaviour. You could write a bug report on

Re: [Wireshark-dev] User Accessible Tables, please review

2007-02-11 Thread Luis Ontanon
On 2/11/07, Stephen Fisher [EMAIL PROTECTED] wrote: On Mon, Jan 29, 2007 at 04:19:46AM +0100, Luis Ontanon wrote: I plan to write a gui for these tables and the table (or a button to open an editor window) will appear in preference module. I noticed that the UAT editor doesn't have a close

[Wireshark-dev] SCTP retransmissions an RTT

2007-02-13 Thread Luis Ontanon
I need to implement the identification of retransmitted packets and calculation of RTT to the sctp dissector. - Is someone already working on this? - other than RFC 2960 (sec. 6.3) what other rfcs I must read in order to implement these? - are there any caveats I must be aware before starting

Re: [Wireshark-dev] Patch for crash in uat_gui.c

2007-02-14 Thread Luis Ontanon
Committed revision 20813. Thanks! On 2/14/07, Peter Johansson [EMAIL PROTECTED] wrote: Hi! I have provided a patch for a crash that occurs in uat_gui.c if from the Edit preferences... button when you choose Protocols - DLT_USER - the Edit... button - the New button - the Cancel button. The

[Wireshark-dev] help_dlg.c(49) : fatal error C1083: Cannot open include file: 'htmlhelp.h': No such file or directory

2007-02-15 Thread Luis Ontanon
I got stuck at this point while compiling on windows (MSVC6), what am I missing? Thanks, Luis -- This information is top security. When you have read it, destroy yourself. -- Marshall McLuhan ___ Wireshark-dev mailing list Wireshark-dev@wireshark.org

Re: [Wireshark-dev] Problem LUA+H248

2007-02-19 Thread Luis Ontanon
Well, this is an odd one... the way ASN1 elements are added to the tree is somewhat twisted... I'll be investigating how these are made... What you want is h248.id that is a byte-string containing the termination id you are looking for terminationId is something else in the syntax. as a rule of

Re: [Wireshark-dev] [PATCH] New menu items to copy packet data

2007-02-19 Thread Luis Ontanon
That sounds familiar... Just today I noticed that if I enable Lua on windows the Tools menu (that is hidden unless Lua uses it) ends up as a submenu of User Tables. As in your case this infact does not happen on my mac. The reason of the different behaviour is still unknown to me. As I think it

Re: [Wireshark-dev] Cross-compile wireshark, without using gnutls

2007-02-22 Thread Luis Ontanon
--without-gnutls ? On 2/22/07, David Wuertele [EMAIL PROTECTED] wrote: The configure script for wireshark decides that my host has libgnutls, but since I am cross-compiling to a target that does not, I want to disable it. I have tried --disable-libgnutls, LIBGNUTLS_CONFIG=no, and a number

Re: [Wireshark-dev] Cross-compile wireshark, without using gnutls

2007-02-22 Thread Luis Ontanon
/07, David Wuertele [EMAIL PROTECTED] wrote: Luis Ontanon [EMAIL PROTECTED] writes: --without-gnutls ? That was one of the first things I tried. Unfortunately, my host has gnutls installed, and the configure script finds it despite my admonitions not to. I tried the following configure

Re: [Wireshark-dev] [Wireshark-commits] rev 20908: /trunk/ /trunk/epan/dissectors/: packet-h248.c packet-h248.h packet-h248_3gpp.c packet-h248_annex_c.c packet-h248_annex_e.c packet-h248_q1950.c packe

2007-02-23 Thread Luis Ontanon
It's heuristic, not having the setup of the association. I mantain two tables. pl_table conatinig a list of assocs indexed by port_labels a 32bit label out of the ports being used (low_pt 16 | high_pt) and plvt_table indexed by port_label and verification_tag of one direction which I assume to

Re: [Wireshark-dev] [Wireshark-commits] rev 20925: /trunk/ /trunk/: nio-ie5.c

2007-02-25 Thread Luis Ontanon
Couldn't this be made to be an If-Modified-Since request instead? Luis On 2/25/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=20925 User: ulfl Date: 2007/02/25 03:44 PM Log: don't cache the downloaded file, so changes in the

Re: [Wireshark-dev] [Wireshark-commits] rev 20908: /trunk/ /trunk/epan/dissectors/: packet-h248.c packet-h248.h packet-h248_3gpp.c packet-h248_annex_c.c packet-h248_annex_e.c packet-h248_q1950.c packe

2007-02-25 Thread Luis Ontanon
[EMAIL PROTECTED] wrote: Hi Luis, see my comments in-line. Best regards Michael On Feb 23, 2007, at 11:14 PM, Luis Ontanon wrote: It's heuristic, not having the setup of the association. I mantain two tables. pl_table conatinig a list of assocs indexed by port_labels a 32bit label out

Re: [Wireshark-dev] [Wireshark-commits] rev 20908: /trunk/ /trunk/epan/dissectors/: packet-h248.c packet-h248.h packet-h248_3gpp.c packet-h248_annex_c.c packet-h248_annex_e.c packet-h248_q1950.c packe

2007-02-26 Thread Luis Ontanon
TSN values are different (by far) for every direction on every association. Is there any reason why this should not work? n 2/24/07, Michael Tuexen [EMAIL PROTECTED] wrote: Hi Luis, see my comments in-line. Best regards Michael On Feb 23, 2007, at 11:14 PM, Luis Ontanon wrote: It's

Re: [Wireshark-dev] [Wireshark-commits] rev 20947: /trunk/epan/dissectors/ /trunk/epan/dissectors/: packet-sctp.c

2007-02-28 Thread Luis Ontanon
On 2/28/07, Michael Tuexen [EMAIL PROTECTED] wrote: On Feb 28, 2007, at 2:09 PM, [EMAIL PROTECTED] wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=20947 User: lego Date: 2007/02/28 02:09 PM Log: SCTP TSN analysis part 1. Up and running. As it is

Re: [Wireshark-dev] WireShark + LUA

2007-03-03 Thread Luis Ontanon
As I'm the one that wrote both the Lua interface and a good part of the h248 dissector I think I can help you... There are probably two bugs that cause this crash: one I know already regarding the way rethrown exceptions are mis-handled in windows which is the cause of the actual crash. I'm still

Re: [Wireshark-dev] WireShark + LUA

2007-03-04 Thread Luis Ontanon
Before sending in a huge file can you try a buidbot build = 20972 from http://www.wireshark.org/download/automated/ I checked in a fix that might solve your issue. Luis On 3/4/07, Luis Ontanon [EMAIL PROTECTED] wrote: As I'm the one that wrote both the Lua interface and a good part

Re: [Wireshark-dev] [SPAM] - Re: WireShark + LUA - Email found in subject

2007-03-05 Thread Luis Ontanon
of confidentiality. I'm working for a society whichs works with phone companies and this capture comes from one of them. I hope you can still help me. Joseph Verrière -Message d'origine- De : [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] la part de Luis Ontanon Envoyé : dimanche 4 mars 2007 17

Re: [Wireshark-dev] Ronnie's SVN 20251 looks quite strange to me - is there a reason?

2007-03-05 Thread Luis Ontanon
On 3/5/07, ronnie sahlberg [EMAIL PROTECTED] wrote: Feel free to reverse that change. It was part of an effort to start refactoring the code so that it would eventually become possible to multithread wireshark, but the work required to implement everything required is just too massive to

Re: [Wireshark-dev] Plugin?

2007-03-05 Thread Luis Ontanon
I think that unless you explain a little better what you are trying to do no one will be able to help you. On 3/5/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: Hi, i have start an plugin for wireshark 0.99.5 so i need a bit support to complete the plugin my packet-foo.c is based at the void

Re: [Wireshark-dev] private development and syncing process ...

2007-03-09 Thread Luis Ontanon
Hi, If you want to discuss about how to write a dissector, how to fix a bug, about adding a new feature or similar development issues this is the right forum. If you ever want your patch applied to the trunk so it is made available to everyone with the rest of wireshark this is the right place to

Re: [Wireshark-dev] [PATCH][UPDATE] ptvcursor : one step further?

2007-03-11 Thread Luis Ontanon
On 3/11/07, Sebastien Tandel [EMAIL PROTECTED] wrote: Hi Jeff, Thanx for reviewing it ... I had forgot about this one :) I will write the README section soon. About the memory leak with g_renew, you're right of course. Unfortunately there is no ep_realloc ... is there any reasons to

Re: [Wireshark-dev] problem :)

2007-03-14 Thread Luis Ontanon
Try http://www.wireshark.org/download/automated/win32/wireshark-setup-0.99.6-SVN-21025.exe and see if the problem has been fixed. and, Please try to explain the problem. On 3/14/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: Hi I am working for a company and we used your source MEGACO/

Re: [Wireshark-dev] crypt-sha1

2007-03-16 Thread Luis Ontanon
If they are in the hmac code that's probably my fault when I put it back in the repo. I don't think it will be causing any problems, as we do not run in any 16 bit platform guint is either equal to guint32 or larger (64) and the way the code is written is protected from both endianity and word

Re: [Wireshark-dev] TFO Package problem

2007-03-16 Thread Luis Ontanon
I added several packages (and Tandem Free Operation was one of those) after 0.99.5 was released. If you try the latest development versions you'll find it decoded. you can download a build of the latest development version from http://www.wireshark.org/download/automated/ . On 3/16/07, melike

Re: [Wireshark-dev] crypt-sha1

2007-03-16 Thread Luis Ontanon
in the hmac function. Regards, Sebastien Tandel Luis Ontanon wrote: If they are in the hmac code that's probably my fault when I put it back in the repo. I don't think it will be causing any problems, as we do not run in any 16 bit platform guint is either equal to guint32 or larger

Re: [Wireshark-dev] Prevent compiler warnings by using stop on warnings/treat warnings as errors compiler option?

2007-03-20 Thread Luis Ontanon
Inline comments... On 3/20/07, Martin Mathieson [EMAIL PROTECTED] wrote: Currently, you don't tend to even notice new warnings that you introduce on your own platform, as they get lost in the general compilation noise. Part of the problem (when working from the command-line at least) is

Re: [Wireshark-dev] Prevent compiler warnings by using stop on warnings/treat warnings as errors compiler option?

2007-03-20 Thread Luis Ontanon
On 3/21/07, Guy Harris [EMAIL PROTECTED] wrote: On Mar 20, 2007, at 5:21 PM, ronnie sahlberg wrote: How do you mean? Emacs is the only true editor! No, it's not: http://www.gnu.org/fun/jokes/ed.msg.html There *must* be an ed mode for emacs. so the point is that... After some

Re: [Wireshark-dev] [Wireshark-commits] rev 21077: /trunk/gtk/ /trunk/gtk/: voip_calls.c voip_calls.h voip_calls_dlg.c

2007-03-21 Thread Luis Ontanon
That's odd because I checked in changes to packet-sccp.h before those to voip_calls*.[ch] see http://anonsvn.wireshark.org/viewvc/viewvc.py/trunk/epan/dissectors/packet-sccp.h?r1=21076r2=21075pathrev=21076diff_format=l In fact the buildbot seems happy with it. On 3/21/07, Ulf Lamping [EMAIL

Re: [Wireshark-dev] Are tap-listeners called for malformed packets?

2007-03-21 Thread Luis Ontanon
It depends on when it goes malformed and whether or not the call to tap_queue_packet() was made or not. On 3/21/07, Lars Ruoff [EMAIL PROTECTED] wrote: Hi, if i have a tap listener registered for protocol X, will it be called also for a malformed packet of protocol X ? (I.e. a packet which

Re: [Wireshark-dev] Looking for a definition document matching a dissector/plugin.

2007-03-22 Thread Luis Ontanon
Simple dissector: packet-udp.[ch] implements RFC 768 Somewhat complex dissector: packet-sctp.[ch] implements RFC 2960 and others Very complex dissector: packet-xml.[ch] impelements (parts of) http://www.w3.org/XML/ as a rule of thumb most dissectors can be found in epan/dissectors and

Re: [Wireshark-dev] Addition of basic SRTP/SRTCP support

2007-03-22 Thread Luis Ontanon
On 3/22/07, Neil Piercy [EMAIL PROTECTED] wrote: Attached are patches which provide a basic dissection of Secure RTP/RTCP profile: - display of the fields used in the SRTP SRTCP payloads - deliberate prevention of the normal dissection of the encrypted payloads - addition of a callable

Re: [Wireshark-dev] Display column additions for SCCP

2007-03-22 Thread Luis Ontanon
I got it in my tree, it will be checked in with other changes I have that I haven't commited yet. I'll make it optional as the BSSAP, RANAP, TCAP, etc strings are appended and the column will have the payload's strings out of the screen. I'll remove the commas and the parenthesis as well. 789

Re: [Wireshark-dev] Addition of basic SRTP/SRTCP support

2007-03-22 Thread Luis Ontanon
srtp and mickey to have mickey setup srtp conversations much like sdp does with plain rtp. L. On 3/22/07, Neil Piercy [EMAIL PROTECTED] wrote: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Luis Ontanon What about heuristics? is there some

Re: [Wireshark-dev] Display column additions for SCCP

2007-03-22 Thread Luis Ontanon
Commited with the aforementioned changes in rev 21126 (with a whole lot of other stuff). On 3/22/07, Luis Ontanon [EMAIL PROTECTED] wrote: I got it in my tree, it will be checked in with other changes I have that I haven't commited yet. I'll make it optional as the BSSAP, RANAP, TCAP, etc

Re: [Wireshark-dev] [Wireshark-commits] rev 21130: /trunk/epan/dfilter/ /trunk/epan/dfilter/: Makefile.am

2007-03-22 Thread Luis Ontanon
Which warning? is it unique to grammar.c or it appears in other lemon generated parsers? On 3/23/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=21130 User: sfisher Date: 2007/03/22 11:28 PM Log: Remove -Werror under gcc

Re: [Wireshark-dev] [Wireshark-commits] rev 21131: /trunk/gtk/ /trunk/gtk/: voip_calls.c

2007-03-22 Thread Luis Ontanon
Sorry about that one... On 3/23/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=21131 User: ulfl Date: 2007/03/22 11:29 PM Log: fix new warnings Directory: /trunk/gtk/ ChangesPathAction +3 -3

Re: [Wireshark-dev] [Wireshark-commits] rev 21130: /trunk/epan/dfilter/ /trunk/epan/dfilter/: Makefile.am

2007-03-22 Thread Luis Ontanon
gone with rev 21134 On 3/23/07, Luis Ontanon [EMAIL PROTECTED] wrote: Which warning? is it unique to grammar.c or it appears in other lemon generated parsers? On 3/23/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=21130

Re: [Wireshark-dev] [Wireshark-commits] rev 21130: /trunk/epan/dfilter/ /trunk/epan/dfilter/: Makefile.am

2007-03-22 Thread Luis Ontanon
; conversion supplied grammar.c(981) : warning C4761: integral size mismatch in argument; conversion supplied On 3/23/07, Luis Ontanon [EMAIL PROTECTED] wrote: gone with rev 21134 On 3/23/07, Luis Ontanon [EMAIL PROTECTED] wrote: Which warning? is it unique to grammar.c or it appears in other lemon

Re: [Wireshark-dev] [Wireshark-commits] rev 21185: /trunk/wiretap/ /trunk/wiretap/: mpeg.c

2007-03-25 Thread Luis Ontanon
This should put an end to the buildbot lamenting about files that are not being considered as mpeg files. However I'm certain I was way too conservative when choosing what's a MPEG file (I had just MP3s), please add more types if you are aware of them. On 3/25/07, [EMAIL PROTECTED] [EMAIL

Re: [Wireshark-dev] [Wireshark-commits] rev 21191: /trunk/ /trunk/epan/dissectors/: Makefile.common packet-megaco.c /trunk/asn1/h248/: Makefile /trunk/plugins/megaco/: packet-megaco.c /trunk/plugins/:

2007-03-25 Thread Luis Ontanon
Some changes slipped through without me noticing: Good thing: changes to asn1/ranap, that were commited already with packet-ranap.[ch] Neutral thing: changes to makefiles of asn1/snmp and asn1/h248 to add a target to test compilation. No bad things Luis On 3/25/07, [EMAIL PROTECTED]

Re: [Wireshark-dev] preference tree for SS7

2007-03-26 Thread Luis Ontanon
Now I have to type [Ctrl-Shift-P][p][r][o][RET][fw-arrow][t][c][TAB] and I can modify TCAP's prefs. Tomorrow I'll have to: [Ctrl-Shift-P][p][r][o][RET][fw-arrow][s][s][RET][fw-arrow][t][c][TAB] for a keyboard animal like me that's a loss... On the other hand I know that TCAP is an SS7 protocol

Re: [Wireshark-dev] preference tree for SS7

2007-03-26 Thread Luis Ontanon
On 3/26/07, Ulf Lamping [EMAIL PROTECTED] wrote: Hi list, I finally had a chance to look at the new feature from revision 21066: http://anonsvn.wireshark.org/viewvc/viewvc.py?view=revrevision=21066 and see what it looks like if I put, say, all the SS7 dissectors' preferences in

Re: [Wireshark-dev] [Patch] pragma warning

2007-03-28 Thread Luis Ontanon
On 3/28/07, ronnie sahlberg [EMAIL PROTECTED] wrote: On 3/28/07, Ulf Lamping [EMAIL PROTECTED] wrote: ronnie sahlberg wrote: I dont think it is really realistic to have all autogenerated files always compile without any warnings. Maybe we should instead split Makefile.common up into

Re: [Wireshark-dev] [Patch] pragma warning

2007-03-28 Thread Luis Ontanon
On 3/28/07, Sebastien Tandel [EMAIL PROTECTED] wrote: I dont think it is really realistic to have all autogenerated files always compile without any warnings. Maybe we should instead split Makefile.common up into three parts : First part : normal dissectors Second part : ANS2WRS

Re: [Wireshark-dev] use Global Title as address in SCCP/SUA?

2007-03-28 Thread Luis Ontanon
though, how do you think it will help? On 3/28/07, Luis Ontanon [EMAIL PROTECTED] wrote: There still be the IP addresses in net_src/net_dst. It would be much like M3UA does that replaces ip src and ip dst by the opc and dpc (which I do not doubt it is ok). What I wonder about is whether

Re: [Wireshark-dev] [Wireshark-commits] rev 21303: /trunk/wiretap/ /trunk/wiretap/: k12.c

2007-04-02 Thread Luis Ontanon
On 4/3/07, Guy Harris [EMAIL PROTECTED] wrote: On Apr 2, 2007, at 3:17 PM, [EMAIL PROTECTED] wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=21303 User: lego Date: 2007/04/02 10:17 PM Log: There are odd packet records in k15 generated files where the

Re: [Wireshark-dev] The war against warnings - mission accomplished!

2007-04-03 Thread Luis Ontanon
I do not think other lex than flex would actually work with all our lexers. As far as the generated dissectors are delivered in the src tarballs there's no problem, as the source will compile anyway on any POSIX system. Windows builds require flex and a make clean. On the other side if I

Re: [Wireshark-dev] The war against warnings - mission accomplished!

2007-04-03 Thread Luis Ontanon
On 4/3/07, Luis Ontanon [EMAIL PROTECTED] wrote: I do not think other lex than flex would actually work with all our lexers. Few minutes later, Luis Ontanon [EMAIL PROTECTED] writes: Now I'm sure they won't: from http://www.gnu.org/software/flex/manual/html_chapter/flex_20.html The following

Re: [Wireshark-dev] [Wireshark-commits] rev 21325: /trunk/epan/ /trunk/epan/: uat.c

2007-04-03 Thread Luis Ontanon
oops! compiling on windows! On 4/3/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=21325 User: richardv Date: 2007/04/03 07:53 PM Log: fix an 'unused parameter' warning Directory: /trunk/epan/ ChangesPath

[Wireshark-dev] 1 packet triggers 4 bugs, is it a record?

2007-04-03 Thread Luis Ontanon
If you take a look to the attachment http://bugs.wireshark.org/bugzilla/attachment.cgi?id=605 of bug http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1342 You'll have a perfect example of an evil packet (not malicious but certainly evil) that causes 4(3?) bugs to be triggered. This malformed

Re: [Wireshark-dev] Track Context in H248

2007-04-07 Thread Luis Ontanon
Depends, once the context is set up lower, higher addresses and context-id. if the contextid is choose it uses another table with the transactionid instead to bind the first transaction. in current svn the code used to track the context is in epan/gcp.[ch] it was in packet-h248.c till the last

Re: [Wireshark-dev] BCD ?

2007-04-10 Thread Luis Ontanon
That applies to ISUP as well, I've always wondered about the reason behind this oddity. On 4/10/07, Michael Lum [EMAIL PROTECTED] wrote: It's probably even worse than that! In both GSM and CDMA protocols packed BCD can be represented as: digit2 digit1 digit4 digit3 such that two octets:

Re: [Wireshark-dev] Track Context in H248

2007-04-11 Thread Luis Ontanon
H.248.1 p. 8.3 (Messages) states: An H.248.1 entity (MG/MGC) must consistently use the same MID in all messages it originates for the duration of control association with the peer (MGC/MG). But using the MID only might not suffice as we'll know only the message sender, there's no simple way to

Re: [Wireshark-dev] [Patch] native little endian ipv4 decoding function for the lua plugin

2007-04-11 Thread Luis Ontanon
On 4/11/07, Guy Harris [EMAIL PROTECTED] wrote: Balint Reczey (IJ/ETH) wrote: The attached patch adds ability of reading Little Endian encoded IPv4 addresses to the Lua plugin. What exactly are the semantics of TvbRange_get_ipv4() and TvbRange_get_le_ipv4() supposed to be? The current

Re: [Wireshark-dev] [Patch] native little endian ipv4 decoding function for the lua plugin

2007-04-11 Thread Luis Ontanon
] wrote: Luis Ontanon wrote: Please verify this assumption: I should not do any processing on the bytes of an IPv4 address because regardless of endianity it is always interpreted as a guint8[4] where [0] contains the first byte. so that 10.11.12.13 would always be stored regardless

Re: [Wireshark-dev] Next release?

2007-04-12 Thread Luis Ontanon
Other than these I think http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1531 should be addressed as well, Although its consequences aren't fatal It looks very ugly. On 4/12/07, Anders Broman [EMAIL PROTECTED] wrote: Hi, As Luis noted: Everyone that has touched the dfilter engine

Re: [Wireshark-dev] [Patch] native little endian ipv4 decoding function for the lua plugin

2007-04-12 Thread Luis Ontanon
before SET_ADDRESS(). Could you commit it, too? Regards, Balint From: Luis Ontanon [EMAIL PROTECTED] Date: Wed, 11 Apr 2007 21:27:48 +0200 Well I replaced tvb_get_ntohs() with tvb_get_ipv4(). Balint: Can you test the changes to tvbrange:get_ipv4() in your code and verify

Re: [Wireshark-dev] redback dissector update

2007-04-13 Thread Luis Ontanon
Can you gzip the patches, some MUAs (e.g. google mail) mangle the text attachments in a way that patches become unusable. Luis. On 4/13/07, Florian Lohoff [EMAIL PROTECTED] wrote: Hi, i took the time to polish the redback dissector a little and decode some more protocols: Index:

Re: [Wireshark-dev] [PATCH] Added lower case treatment for Megaco messages

2007-04-13 Thread Luis Ontanon
Thanks, However equivalent changes were already made (among others) in revision 21337. Other than that, the file was moved into epan/dissectors in r21191 . http://anonsvn.wireshark.org/viewvc/viewvc.py/trunk/epan/dissectors/packet-megaco.c?r1=21337r2=21336pathrev=21337 On 4/13/07, Maurizio

[Wireshark-dev] Problems with Exception Handling on Windows.

2007-04-16 Thread Luis Ontanon
I been fighting for quite a while, TRYing to figure out a way to have both exception handling mechanisms that are used in windows. First and mostly we use our macros based on kazlib's exception code (which build arround ANSI's setjmp and longjmp). Then for catching exceptional exceptions

Re: [Wireshark-dev] [Wireshark-commits] rev 21452: /trunk/epan/dissectors/ /trunk/epan/dissectors/: packet-ieee80211.c

2007-04-18 Thread Luis Ontanon
svn up svn up -r 12345 file On 4/18/07, Martin Mathieson [EMAIL PROTECTED] wrote: It does look like the same problem. Their report says that a problem of this kind was fixed in gcc-3.4.4-2{,.fc3}, so either its the same problem not fixed in vanilla gcc-3.4.6 or another problem with similar

Re: [Wireshark-dev] [Wireshark-commits] rev 21556: /trunk/epan/ /trunk/epan/: proto.c proto.h

2007-04-24 Thread Luis Ontanon
There's a function in packet-iuup.c (by the same name) which has (what i believe to be) a more consistent signature with the rest of proto_tree_add_* functions should that be used instead? Other than that the one for iuup allows for bit strings not aligned to the octet boundary. On 4/24/07,

  1   2   >