[Wireshark-dev] about udp dissector

2007-02-02 Thread Vladimir Zherdenovsky
Hello, I just want to understand how the udp dissector works and have misunderstanding of following codes lines: static e_udphdr udphstruct[4], *udph; static int udph_count=0; udph_count++; if(udph_count=4){ udph_count=0; } udph=udphstruct[udph_count]; Could anybody

Re: [Wireshark-dev] Add checksum validation option for MTP2

2007-02-02 Thread Florent . Drouin
Hello Jeff, In fact, the FCS checksum are not ahead the sequence numbers, but after the payload. So the MTP2 header is not changed, we have just two additional bytes containing the CRC16. I did join somes messages (captured with libpcap) to show the impact of the patch. You can see, that

[Wireshark-dev] Getting Lua dissector to work with the display filter

2007-02-02 Thread Scott Robinson
Similar to this thread, but in lua versus c: http://www.wireshark.org/lists/wireshark-dev/200701/msg01384.html Hi, I'm trying to get a Lua dissector to work with the display filters. I've had partial success. The new protocol and associated fields show up in the Filter Expressions dialog. When

[Wireshark-dev] how to register the dissector

2007-02-02 Thread Vladimir Zherdenovsky
Hi I have FOO protocol which registered as udp.port == 333 for example. I want to write GOO protocol which should be registered as foo.num == 444. I had add register_dissector_table(foo.num, FOO NUMBER, FT_UINT16, BASE_DEC); to proto_register_m2ou function, but it doesn't help - goo dissector

Re: [Wireshark-dev] Multiple pdus atop TCP -- a lie in README.developer?

2007-02-02 Thread Martin Mathieson
Richard, I remember struggling with this when writing the Microsoft Media Server protocol (packet-ms-mms.c), but it did seem to work. It was ideal for me for 2 reasons: (1) tcp_dissect_pdus() doesn't work for new-style dissectors that can reject data (2) in that protocol large PDUs can be

[Wireshark-dev] protocol decoding module

2007-02-02 Thread 김태균
Dear wireshark-dev. I'm going to develop a program that is doing some thing with the captured packets. Now I need a module to decode the protocol like a dissector in wireshark. Is there any way to use the dissector as a library? I found NetBee is one of those, but it's not available. Thank you

Re: [Wireshark-dev] U3 questions/remarks

2007-02-02 Thread Graeme Lunt
Ulf, As I'm a proud owner of an U3 stick now, I can test this ;-) Good news. I think there's only a couple of us using it to date. I find it very useful. Some minor things I've noticed: - All programs I've installed on the stick (OpenOffice, Firefox, Winamp, ...) either shows only the

[Wireshark-dev] Wireshark 0.99.5 is now available

2007-02-02 Thread Gerald Combs
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Wireshark 0.99.5 has been released. What is Wireshark? Wireshark is the world's most popular network protocol analyzer. It is used for troubleshooting, analysis, development, and education. What's New Bug Fixes The following

Re: [Wireshark-dev] Patch to add read support for Shomiti wireless captures

2007-02-02 Thread Clay Jones
Here is a capture in the wireless Shomiti format. This capture is of an association between a Linksys 802.11n client and AP. I am working on some decodes for 802.11n that I will try to send in shortly. In another email you asked what the meaning of the various header fields were. pad[4]

Re: [Wireshark-dev] Patch to add read support for Shomiti wireless captures

2007-02-02 Thread Clay Jones
Premature send on that last email. Bit 8 is the error bit. If set the packet was received with some sort of error Bit 9 is the undecryptable bit. If set the packet was encrypted and the mac was unable to decrypt it rate is a standard 802.11 rate preamble is set if the phy reports that the

Re: [Wireshark-dev] U3 questions/remarks

2007-02-02 Thread Guy Harris
Graeme Lunt wrote: Well, I've just had a quick look at this and it appears to be because the Wireshark icon I put into the manifest has more than 256 colours. This is not a problem for the main launchpad window but it apparently a problem for the More Programs sub menu. To be fair the U3 spec

Re: [Wireshark-dev] U3 questions/remarks

2007-02-02 Thread Gerald Combs
Guy Harris wrote: Graeme Lunt wrote: Well, I've just had a quick look at this and it appears to be because the Wireshark icon I put into the manifest has more than 256 colours. This is not a problem for the main launchpad window but it apparently a problem for the More Programs sub menu. To

[Wireshark-dev] linker error trying to build wireshark with basic dissector code from Dev-guide

2007-02-02 Thread David Bunch
Hi all, I'm trying to build the basic dissector plugin template as found in the developers guide. It compiles fine, however when it tries to link it, i get this linker error: _BEGIN ERROR___ .libs/blksh.la-1.o(.rodata+0x0): In function

Re: [Wireshark-dev] U3 questions/remarks

2007-02-02 Thread Jim Young
Hello Gerald, Gerald Combs [EMAIL PROTECTED] 02/02/07 3:05 PM [snip] The icon files in the contained 64x64, 48x48, 32x32, 24x24, and 16x16 pixel images with 8-bit and 32-bit depths. I've checked in a change removing the 32-bit versions, leaving only 8-bit ones. Can anyone who's having

Re: [Wireshark-dev] U3 questions/remarks

2007-02-02 Thread Guy Harris
On Feb 2, 2007, at 6:50 PM, Jim Young wrote: It looks like Version 0.99.6-SVN-20687 (SVN Rev 20687) fixed the problem with invisable Wireshark icons with *.pcap email attachments in Novell Groupwise. I.e., Groupwise doesn't just ignore the 32-bit-color versions of the icons?

Re: [Wireshark-dev] U3 questions/remarks

2007-02-02 Thread Ulf Lamping
Graeme Lunt wrote: Good news. I think there's only a couple of us using it to date. I find it very useful. I'm still unsure if the ProtableApps approach is just good enough ;-) However, the eject feature is in fact cool. Well of the 5 programs on my U3 device, one is for U3, one is U3

Re: [Wireshark-dev] [PATCH] Multiple pdus atop TCP -- a lie in README.developer?

2007-02-02 Thread Richard van der Hoff
FEH! Now with the attachment. Sorry. Richard van der Hoff wrote: Martin Mathieson wrote: Richard, I remember struggling with this when writing the Microsoft Media Server protocol (packet-ms-mms.c), but it did seem to work. Thanks for that, Martin; however, I've taken a look at it, and I'm

[Wireshark-dev] IS-41 ANSI-MAP

2007-02-02 Thread Andreas Fink
Is there anyone on this list who has access to a ANSI-MAP network who could provide me with a few specific trace files so the MAP decoder could be enhanced for them? Andreas Fink Fink Consulting GmbH Global Networks Schweiz AG BebbiCell AG