Re: [Wireshark-dev] Bluetooth SBC codec in RTP Player

2013-03-27 Thread Michal.Labedzki
Hi, Sent: 26 March 2013 22:06 To: Developer support list for Wireshark Subject: Re: [Wireshark-dev] Bluetooth SBC codec in RTP Player Hi, Two questions: 1) Why move codec infrastructure into epan? I don't understand the rationale. Is there other way to handle that? Please feel free to

[Wireshark-dev] Heuristic ethernet payloads

2013-03-27 Thread Evan Huus
The ethernet dissector currently has a heuristic table called eth that passes off the entire packet (including the ethernet header, if any) which is a bit confusing. As per bug #8522 we seem to have need of a heuristic table for the general ethernet payload (without the ethernet header bytes),

Re: [Wireshark-dev] tshark option for reassembled fragment output

2013-03-27 Thread Evan Huus
We just got another bug on what I believe is exactly the same issue: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8529 Do we have at least a rough consensus on what the correct behaviour is? On Sat, Mar 9, 2013 at 7:48 AM, Evan Huus eapa...@gmail.com wrote: On Sat, Mar 9, 2013 at 12:27

Re: [Wireshark-dev] [Wireshark-commits] rev 48570: /trunk/ /trunk/: Makefile.am

2013-03-27 Thread Jeff Morriss
On 03/26/13 17:01, morr...@wireshark.org wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=48570 User: morriss Date: 2013/03/26 02:01 PM Log: Add wsicon128.png to the source distribution. Install some more icon sizes (24x24 and 128x128) when installing desktop files.

Re: [Wireshark-dev] [Wireshark-commits] rev 48562: / /trunk/image/: wireshark.ico wiresharkcapture.ico wiresharkinst.ico wsicon1024.png wsicon128.png wsicon16.png wsicon24.png wsicon256.png wsicon32.p

2013-03-27 Thread Jeff Morriss
On 03/26/13 14:02, ger...@wireshark.org wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=48562 User: gerald Date: 2013/03/26 11:02 AM Log: Add new application icons. Designed by Elliott Aldrich. FWIW I think the new icon looks great in the menu you get when you

Re: [Wireshark-dev] Bluetooth SBC codec in RTP Player

2013-03-27 Thread Hadriel Kaplan
On Mar 27, 2013, at 6:38 AM, michal.labed...@tieto.com wrote: 2) Why destroy the G729/G723 support? Even though it's not in there, they're hooks for having it there. As I know license of this library (G729/G723) does not allow the linking with Wireshark. Instead of there is plugin

Re: [Wireshark-dev] tshark option for reassembled fragment output

2013-03-27 Thread Hadriel Kaplan
On Mar 27, 2013, at 8:52 AM, Evan Huus eapa...@gmail.com wrote: We just got another bug on what I believe is exactly the same issue: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8529 Do we have at least a rough consensus on what the correct behaviour is? I've had a patch sitting

Re: [Wireshark-dev] tshark option for reassembled fragment output

2013-03-27 Thread Evan Huus
On Wed, Mar 27, 2013 at 11:42 AM, Hadriel Kaplan hkap...@acmepacket.com wrote: On Mar 27, 2013, at 8:52 AM, Evan Huus eapa...@gmail.com wrote: We just got another bug on what I believe is exactly the same issue: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8529 Do we have at least a

Re: [Wireshark-dev] tshark option for reassembled fragment output

2013-03-27 Thread Hadriel Kaplan
On Mar 27, 2013, at 12:17 PM, Evan Huus eapa...@gmail.com wrote: That patch is a Very Good Thing. I know we discussed a few tweaks (for example it probably shouldn't imply -2?), but I think those and the actual flag used are bike-shedding at this point. I still want to pick some nits, but

Re: [Wireshark-dev] tshark option for reassembled fragment output

2013-03-27 Thread Evan Huus
Here's an updated proposal for potential 'final' behaviour: === Tshark and wireshark both have -R for read filter and -d for display filter. -R filtering is done on initially reading the file and prevents the rejected packet from being added to the frame data list and other such structures. -d

Re: [Wireshark-dev] [Wireshark-commits] rev 46513: /trunk/ /trunk/doc/: dumpcap.pod tshark.pod /trunk/: dumpcap.c tshark.c

2013-03-27 Thread Maynard, Chris
Wireshark's current goto packet option could be moved from -g to -G, but then Wireshark's new -G (goto packet) will be different from tshark's -G (reports). Should Wireshark also be able to generate reports? If so, then we should reserve -G for that purpose and move goto packet to something

Re: [Wireshark-dev] tshark option for reassembled fragment output

2013-03-27 Thread Christopher Maynard
Evan Huus eapache@... writes: Tshark's current -d is moved to -A (for decode As) to make room for the new -d (which is then consistent with wireshark's -d). Wireshark's -A is for RPCAP password authentication. Should we reserve -A for that? (I assume it would be possible to support this with

Re: [Wireshark-dev] tshark option for reassembled fragment output

2013-03-27 Thread Hadriel Kaplan
On Mar 27, 2013, at 1:57 PM, Evan Huus eapa...@gmail.com wrote: -d filtering is done when displaying, and has no effect on the internal dissection at all (note this does not force 2 passes). Actually I'm pretty sure Wireshark *does* perform two passes when a display filter is applied from

Re: [Wireshark-dev] [Wireshark-commits] rev 46513: /trunk/ /trunk/doc/: dumpcap.pod tshark.pod /trunk/: dumpcap.c tshark.c

2013-03-27 Thread Evan Huus
On 2013-03-27, at 2:21 PM, Maynard, Chris christopher.mayn...@gtech.com wrote: Wireshark's current goto packet option could be moved from -g to -G, but then Wireshark's new -G (goto packet) will be different from tshark's -G (reports). Should Wireshark also be able to generate reports? If

Re: [Wireshark-dev] Heuristic ethernet payloads

2013-03-27 Thread Guy Harris
On Mar 27, 2013, at 5:15 AM, Evan Huus eapa...@gmail.com wrote: The ethernet dissector currently has a heuristic table called eth that passes off the entire packet (including the ethernet header, if any) which is a bit confusing. As per bug #8522 we seem to have need of a heuristic table

Re: [Wireshark-dev] tshark option for reassembled fragment output

2013-03-27 Thread Evan Huus
On Wed, Mar 27, 2013 at 2:27 PM, Christopher Maynard christopher.mayn...@gtech.com wrote: Evan Huus eapache@... writes: Tshark's current -d is moved to -A (for decode As) to make room for the new -d (which is then consistent with wireshark's -d). Wireshark's -A is for RPCAP password

Re: [Wireshark-dev] [Wireshark-commits] rev 48570: /trunk/ /trunk/: Makefile.am

2013-03-27 Thread Gerald Combs
On 3/27/13 6:10 AM, Jeff Morriss wrote: On 03/26/13 17:01, morr...@wireshark.org wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=48570 User: morriss Date: 2013/03/26 02:01 PM Log: Add wsicon128.png to the source distribution. Install some more icon sizes (24x24

Re: [Wireshark-dev] tshark option for reassembled fragment output

2013-03-27 Thread Hadriel Kaplan
On Mar 27, 2013, at 5:44 PM, Evan Huus eapa...@gmail.com wrote: On Wed, Mar 27, 2013 at 2:43 PM, Hadriel Kaplan hkap...@acmepacket.com wrote: On Mar 27, 2013, at 1:57 PM, Evan Huus eapa...@gmail.com wrote: -d filtering is done when displaying, and has no effect on the internal

Re: [Wireshark-dev] tshark option for reassembled fragment output

2013-03-27 Thread Evan Huus
On Wed, Mar 27, 2013 at 7:10 PM, Hadriel Kaplan hkap...@acmepacket.com wrote: On Mar 27, 2013, at 5:44 PM, Evan Huus eapa...@gmail.com wrote: On Wed, Mar 27, 2013 at 2:43 PM, Hadriel Kaplan hkap...@acmepacket.com wrote: On Mar 27, 2013, at 1:57 PM, Evan Huus eapa...@gmail.com wrote: -d