Re: [Wireshark-dev] Something about how to determine what is real data?(with padding "00")

2013-08-09 Thread Joerg Mayer
On Fri, Aug 09, 2013 at 05:53:08PM +0800, 蔡光宗 wrote: >I am study how to get the data via TCP, but I met some problems. > When I use Wireshark to do some test, I find the reason and I don’t know > how you solved it ? > >When the packet’s length is bigger than 64Bytes, it has no prob

[Wireshark-dev] Domain Name Resolution

2013-08-09 Thread Aaron Gray
Hi, I am new to the development list and am wondering if it is possible to add optional domain names to the source and destination IP addresses with masking of the DNS requests and reply packets. Hope someone is willing to implement this quickly. Many thanks, Aaron _

Re: [Wireshark-dev] Display filter and/or precedence

2013-08-09 Thread Jakub Zawadzki
On Fri, Aug 09, 2013 at 09:46:29PM +0200, Jakub Zawadzki wrote: > On Fri, Aug 09, 2013 at 12:26:53PM -0700, Guy Harris wrote: > > > but +1 for being consistent with the rest of the world. > > > > Yes. > > I'd rather not change grammar, still I think what we need - is some warning: > "suggest pa

Re: [Wireshark-dev] Display filter and/or precedence

2013-08-09 Thread Guy Harris
On Aug 9, 2013, at 12:32 PM, Jakub Zawadzki wrote: > On Fri, Aug 09, 2013 at 11:41:59AM -0700, Gerald Combs wrote: >> Laura Chappell and Sean Walberg recently discovered that logical OR >> takes precedence over logical AND in display filters. Is there any >> reason we shouldn't reverse this so t

Re: [Wireshark-dev] Display filter and/or precedence

2013-08-09 Thread Jakub Zawadzki
On Fri, Aug 09, 2013 at 12:26:53PM -0700, Guy Harris wrote: > > but +1 for being consistent with the rest of the world. > > Yes. I'd rather not change grammar, still I think what we need - is some warning: "suggest parentheses around '&&' within '||'" ___

Re: [Wireshark-dev] Display filter and/or precedence

2013-08-09 Thread Christopher Maynard
Evan Huus writes: > On Fri, Aug 9, 2013 at 2:41 PM, Gerald Combs wrote: > > Laura Chappell and Sean Walberg recently discovered that logical OR > > takes precedence over logical AND in display filters. Is there any > > reason we shouldn't reverse this so that we match the order of > > operations

Re: [Wireshark-dev] Display filter and/or precedence

2013-08-09 Thread Jakub Zawadzki
On Fri, Aug 09, 2013 at 11:41:59AM -0700, Gerald Combs wrote: > Laura Chappell and Sean Walberg recently discovered that logical OR > takes precedence over logical AND in display filters. Is there any > reason we shouldn't reverse this so that we match the order of > operations elsewhere (including

Re: [Wireshark-dev] Display filter and/or precedence

2013-08-09 Thread Guy Harris
On Aug 9, 2013, at 11:46 AM, Evan Huus wrote: > On Fri, Aug 9, 2013 at 2:41 PM, Gerald Combs wrote: >> Laura Chappell and Sean Walberg recently discovered that logical OR >> takes precedence over logical AND in display filters. Is there any >> reason we shouldn't reverse this so that we match t

Re: [Wireshark-dev] Display filter and/or precedence

2013-08-09 Thread Evan Huus
On Fri, Aug 9, 2013 at 2:41 PM, Gerald Combs wrote: > Laura Chappell and Sean Walberg recently discovered that logical OR > takes precedence over logical AND in display filters. Is there any > reason we shouldn't reverse this so that we match the order of > operations elsewhere (including BPF)? T

[Wireshark-dev] Display filter and/or precedence

2013-08-09 Thread Gerald Combs
Laura Chappell and Sean Walberg recently discovered that logical OR takes precedence over logical AND in display filters. Is there any reason we shouldn't reverse this so that we match the order of operations elsewhere (including BPF)? Should we add a bitwise OR as well? __

Re: [Wireshark-dev] Remove hf_ variables

2013-08-09 Thread Jakub Zawadzki
On Wed, Aug 07, 2013 at 08:10:21PM +0200, Jakub Zawadzki wrote: > I wrote some ugly gawk program for hf_ variables. > > Here is one + some patch for epan: > http://www.wireshark.org/~darkjames/proto-new/0001-changes.txt > > Here is convertion of some dissectors (not quite automagic): > http://www

Re: [Wireshark-dev] Seaching in the data pane would be useful ...

2013-08-09 Thread Guy Harris
On Aug 9, 2013, at 7:37 AM, Richard Sharpe wrote: > Hi folks, > > I can across a capture yesterday where there were DNS queries for a > KDC in a Windows AD environment. The query returned 230 KDCs! > > Searching for a particular one was hard. > > It would be nice to have a right click menu it

Re: [Wireshark-dev] Seaching in the data pane would be useful ...

2013-08-09 Thread Richard Sharpe
On Fri, Aug 9, 2013 at 9:30 AM, ronnie sahlberg wrote: > On Fri, Aug 9, 2013 at 9:02 AM, Richard Sharpe > wrote: >> On Fri, Aug 9, 2013 at 8:52 AM, Christopher Maynard >> wrote: >>> Richard Sharpe writes: >>> I can across a capture yesterday where there were DNS queries for a KDC in a

Re: [Wireshark-dev] bugzilla: allow See-Also to point to 'Ask' questions

2013-08-09 Thread Gerald Combs
On 8/9/13 7:25 AM, Jeff Morriss wrote: > I was trying to add an ask.wireshark.org question to the See-Also list > in a bug but bugzilla wouldn't let me. It said: > >> http://ask.wireshark.org/questions/23002/mate-configuration-trouble is >> not a valid URL to a bug. See Also URLs should point to

Re: [Wireshark-dev] Seaching in the data pane would be useful ...

2013-08-09 Thread Christopher Maynard
Richard Sharpe writes: > Sure, I can do the search, and I did, but the actual info I am > interested in, like the priority, etc, is buried among 230 entries and > I have to patiently scroll until I find it. > > That is hard to do. I see your point. My attempt using tshark didn't produce very g

Re: [Wireshark-dev] Seaching in the data pane would be useful ...

2013-08-09 Thread ronnie sahlberg
On Fri, Aug 9, 2013 at 9:02 AM, Richard Sharpe wrote: > On Fri, Aug 9, 2013 at 8:52 AM, Christopher Maynard > wrote: >> Richard Sharpe writes: >> >>> I can across a capture yesterday where there were DNS queries for a >>> KDC in a Windows AD environment. The query returned 230 KDCs! >>> >>> Sear

Re: [Wireshark-dev] Seaching in the data pane would be useful ...

2013-08-09 Thread ronnie sahlberg
On Fri, Aug 9, 2013 at 8:52 AM, Christopher Maynard wrote: > Richard Sharpe writes: > >> I can across a capture yesterday where there were DNS queries for a >> KDC in a Windows AD environment. The query returned 230 KDCs! >> >> Searching for a particular one was hard. >> >> It would be nice to ha

Re: [Wireshark-dev] Seaching in the data pane would be useful ...

2013-08-09 Thread Richard Sharpe
On Fri, Aug 9, 2013 at 8:52 AM, Christopher Maynard wrote: > Richard Sharpe writes: > >> I can across a capture yesterday where there were DNS queries for a >> KDC in a Windows AD environment. The query returned 230 KDCs! >> >> Searching for a particular one was hard. >> >> It would be nice to ha

Re: [Wireshark-dev] Seaching in the data pane would be useful ...

2013-08-09 Thread Christopher Maynard
Richard Sharpe writes: > I can across a capture yesterday where there were DNS queries for a > KDC in a Windows AD environment. The query returned 230 KDCs! > > Searching for a particular one was hard. > > It would be nice to have a right click menu item in either the details > pane or the data

Re: [Wireshark-dev] bugzilla: allow See-Also to point to 'Ask' questions

2013-08-09 Thread Graham Bloice
As is Trac. On 9 August 2013 15:43, Evan Huus wrote: > Jira and Mantis are other bug tracking systems (Jira is by Atlassian). > > On Fri, Aug 9, 2013 at 10:25 AM, Jeff Morriss > wrote: > > I was trying to add an ask.wireshark.org question to the See-Also list > in a > > bug but bugzilla wouldn'

Re: [Wireshark-dev] bugzilla: allow See-Also to point to 'Ask' questions

2013-08-09 Thread Evan Huus
Jira and Mantis are other bug tracking systems (Jira is by Atlassian). On Fri, Aug 9, 2013 at 10:25 AM, Jeff Morriss wrote: > I was trying to add an ask.wireshark.org question to the See-Also list in a > bug but bugzilla wouldn't let me. It said: > >> http://ask.wireshark.org/questions/23002/mat

[Wireshark-dev] Seaching in the data pane would be useful ...

2013-08-09 Thread Richard Sharpe
Hi folks, I can across a capture yesterday where there were DNS queries for a KDC in a Windows AD environment. The query returned 230 KDCs! Searching for a particular one was hard. It would be nice to have a right click menu item in either the details pane or the data pane where you can search f

Re: [Wireshark-dev] Something about how to determine what is real data?(with padding "00")

2013-08-09 Thread Jeff Morriss
On 08/09/13 05:53, 蔡光宗 wrote: Dear Wireshark Developers: Hi, dear Wireshark Developers, thank you for your work on the Wireshark so we can use this powerful tool nowadays. I am study how to get the data via TCP, but I met some problems. When I use Wireshark to do some test, I fi

[Wireshark-dev] bugzilla: allow See-Also to point to 'Ask' questions

2013-08-09 Thread Jeff Morriss
I was trying to add an ask.wireshark.org question to the See-Also list in a bug but bugzilla wouldn't let me. It said: http://ask.wireshark.org/questions/23002/mate-configuration-trouble is not a valid URL to a bug. See Also URLs should point to one of: show_bug.cgi in a Bugzilla install