Re: [Wireshark-dev] Set capture to TZ blah?

2015-03-14 Thread Guy Harris
On Mar 14, 2015, at 12:34 PM, Jeff Morriss wrote: > On 03/14/2015 02:16 PM, Guy Harris wrote: >> >> On Mar 14, 2015, at 8:00 AM, Niels de Vos wrote: >> >>> When I have captures and logs that do not match the timezone, I use the >>> TZ environment variab

Re: [Wireshark-dev] Set capture to TZ blah?

2015-03-14 Thread Guy Harris
On Mar 14, 2015, at 11:47 AM, Niels de Vos wrote: > Oh, yes indeed. Some people might still run an operating system that > does not support that... A very large fraction of our user base does. I don't know whether it's a plurality or not. (Personally, I wish Windows *would* use the IANA tz d

Re: [Wireshark-dev] Set capture to TZ blah?

2015-03-14 Thread Guy Harris
On Mar 14, 2015, at 8:00 AM, Niels de Vos wrote: > When I have captures and logs that do not match the timezone, I use the > TZ environment variable to read the captures in the timezone of the > logs, like: > >$ TZ=America/New_York tshark -r /path/to/capture.pcap.gz > > or > >$ T

Re: [Wireshark-dev] Set capture to TZ blah?

2015-03-13 Thread Guy Harris
On Mar 13, 2015, at 11:33 AM, Richard Sharpe wrote: > Lots of people use Wireshark to help with problems around the world. > Sometimes they have a capture from another timezone and a log file > from that same timezone. > > The capture has time in UTC while the logs are most likely in local > t

Re: [Wireshark-dev] Allowing display filters during capture

2015-03-13 Thread Guy Harris
On Mar 13, 2015, at 7:22 AM, Jeff Morriss wrote: > That will work for your purpose. The reason the check is there, however, is > that most people seem to expect that applying the display filter would affect > what messages are sent to the output file (udp_all.pcap). (They may have > that ex

Re: [Wireshark-dev] Qt: Convert ProtoTree from QTreeWidget to Model/View

2015-03-09 Thread Guy Harris
On Mar 9, 2015, at 5:25 PM, Gerald Combs wrote: > Why should it? Why yank away useful information just because the user > closes the capture file? Hmm. At that point, one could argue that you still have the capture open, in some sense, even if you don't have a viewer window for it. I'm not s

Re: [Wireshark-dev] Qt: Convert ProtoTree from QTreeWidget to Model/View

2015-03-09 Thread Guy Harris
On Mar 9, 2015, at 1:32 PM, Peter Wu wrote: > As far as I know, you can only have one open capture file. Correct me if > I am wrong. That's currently the case, but let's not wire that assumption in; a "proper" OS X app would use one UI process for all open files. (We might implement that by

Re: [Wireshark-dev] Latest build modifies files?

2015-03-07 Thread Guy Harris
On Mar 7, 2015, at 4:26 PM, Martin Kaiser wrote: > Thus wrote Martin Kaiser (li...@kaiser.cx): > >> I just pushed a change to create the .qm files for Qt's translated texts >> from the corresponding .ts files. My change handles the autotools build. >> I saw that the cmake build already support

Re: [Wireshark-dev] Latest build modifies files?

2015-03-07 Thread Guy Harris
On Mar 7, 2015, at 12:59 PM, Richard Sharpe wrote: > Hi folks, > > After my most recent build I noticed this: > > # On branch master > # Your branch is ahead of 'origin/master' by 1 commit. > # (use "git push" to publish your local commits) > # > # Changes not staged for commit: > # (use "

Re: [Wireshark-dev] Packet editor

2015-03-06 Thread Guy Harris
On Mar 5, 2015, at 11:18 PM, Michal Labedzki wrote: >> WireEdit is similar to what? >> We are not aware of any similar product. > > No Wireshark? The name... look... In the first time I think it is > modified Wireshark. To be fair, we spell it "Chassis Id Subtype" in our LLDP dissector, but th

Re: [Wireshark-dev] WS runtime error

2015-03-04 Thread Guy Harris
On Mar 4, 2015, at 7:29 AM, Joerg Mayer wrote: > When starting Wireshark with a specific trace file (unfortunately > confidential), > I get the following message on startup (git head): > > /home/jmayer/work/wireshark/git/ui/qt/packet_list.cpp:537:13: runtime error: > load of value 9, which is

Re: [Wireshark-dev] Undissected reserved fields

2015-03-01 Thread Guy Harris
On Mar 1, 2015, at 4:58 AM, Michal Labedzki wrote: > Personally, I always dissect reserved fields. Please do not forget > that there are many bit-reserved fields too. This probably implies > that we want to create filter for them (hf items), to keep the same > look for all fields in bitfield. T

Re: [Wireshark-dev] Undissected reserved fields

2015-02-27 Thread Guy Harris
On Feb 27, 2015, at 10:28 AM, Jeff Morriss wrote: > My opinion (which I've voiced on this list many times over the past ~10 > years) is that such fields SHOULD be dissected. Even better they should have > an Expert Info if they are supposed to be 0 and aren't (Guy had suggested on > a bug or

Re: [Wireshark-dev] Making gcc less pedantic

2015-02-13 Thread Guy Harris
On Feb 13, 2015, at 12:54 PM, Gerald Combs wrote: > Would it make sense to make gcc's "-pedantic" warnings a bit less > pedantic, e.g. with "-std=c99"? C90 says A bit-field shall have a type that is a qualified or unqualified version of one of int, unsigned int, or signed int. Whether

Re: [Wireshark-dev] Failed to build wireshark 1.99.2 under OpenSUSE 11.4 (x86_64)

2015-02-13 Thread Guy Harris
On Feb 13, 2015, at 12:36 PM, mosbah abdelkader wrote: > The configure script fails to find Qt in the system despite there are 2 > versions installed: > - Qt 4.7 installed via rpm. Do you have the qt-devel (or whatever it's called) RPM installed as well? I.e., you need more than the shared

Re: [Wireshark-dev] [Wireshark-commits] master 931807e: Qt: Add the "new packet" window^Wdialog^Wwindow.

2015-02-12 Thread Guy Harris
On Feb 12, 2015, at 3:32 PM, Wireshark code review wrote: > URL: > https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=931807ea61cd9b2729fa06fefa6ce3a09b89ee4b > Submitter: Gerald Combs (ger...@wireshark.org) > Changed: branch: master > Repository: wireshark > > Commits: > >

Re: [Wireshark-dev] [Wireshark-commits] master 0b2c8b0: AMQP: fix declaration of 'index' shadows a global declaration

2015-02-02 Thread Guy Harris
On Feb 2, 2015, at 1:46 PM, Wireshark code review wrote: > 0b2c8b0 by Alexis La Goutte (alexis.lagou...@gmail.com): > >AMQP: fix declaration of 'index' shadows a global declaration > >St*** Mac OS X buildbot... It's probably Ken or Dennis's fault; the original name for The Routine C

Re: [Wireshark-dev] How to call a sub-dissector many times without knowing the exact data size

2015-01-31 Thread Guy Harris
On Jan 31, 2015, at 1:46 PM, wsgd wrote: > I want to call a sub-dissector many times. > I know the total size of my data. > I do NOT know the size to give to the sub-dissector. > The sub-dissector will know (by itself) the size to dissect. > > The corresponding scheme from the parent dissec

Re: [Wireshark-dev] Bluetooth and Miscellaneous menus

2015-01-28 Thread Guy Harris
On Jan 28, 2015, at 12:05 AM, Michal Labedzki wrote: > I want to add new menu in Wireshark for Bluetooth (in February). It > will be menu on the right of "Telephony" in main menu. It will be > named "Bluetooth". For now I have prepared only one entry for this > menu, but I have ideas for another

Re: [Wireshark-dev] Bluetooth and Miscellaneous menus

2015-01-28 Thread Guy Harris
On Jan 28, 2015, at 4:44 AM, Graham Bloice wrote: > I think AirPCap is Windows only, It is. > I'm not sure if it disables or disappears on other platforms. At least > replicating what it does is likely to be a good start. We currently have a different 802.11 toolbar that currently supports

Re: [Wireshark-dev] tuo of trunk fails to build on MAC

2015-01-28 Thread Guy Harris
On Jan 28, 2015, at 9:15 AM, Anders Broman wrote: > ireshark/epan/wslua/lua_bitop.c:85:2: error: "Unknown > number type, check LUA_NUMBER_* in luaconf.h" > #error "Unknown number type, check LUA_NUMBER_* in luaconf.h" > ^ > 1 error generated. macosx-setup.sh installs Lua 5.3 by default,

Re: [Wireshark-dev] Add a new (defaut) coloring rule

2015-01-27 Thread Guy Harris
On Jan 27, 2015, at 2:11 AM, Anil wrote: > Are you sure ? The first line of these files is > > # DO NOT EDIT THIS FILE! It was created by Wireshark The second part of that comment might well be true; somebody might have created it by using Wireshark as the editor. However, it might also hav

Re: [Wireshark-dev] macosx-setup.sh fails now

2015-01-25 Thread Guy Harris
On Jan 25, 2015, at 2:35 PM, Anders Broman wrote: > On the bright side, following Ronalds advice of seeing the path and qt direct > environment variables I now succeeded to run cmake and build eventough the > setupscript didn't complete. Try commenting out the QT_VERSION= line, and run the se

Re: [Wireshark-dev] macosx-setup.sh fails now

2015-01-25 Thread Guy Harris
On Jan 25, 2015, at 12:35 PM, Anders Broman wrote: > Hi, > I’ve just updated to > System Version: OS X 10.10.1 (14B25) > Kernel Version: Darwin 14.0.0 > > xcodebuild -version > Xcode 6.1.1 > Build version 6A2008a If it still fails when building Qt, then the Qt problem might be some

[Wireshark-dev] Open-only-once capture devices and the packet rate spark lines (was Re: nflog in qt and gtk)

2015-01-24 Thread Guy Harris
By the way, if I remember correctly, HP-UX, at least at one point, only allowed one open descriptor for a particular network device to be put into either physical promiscuous mode or "SAP promiscuous" (accept all packets, rather than just packets to or from a particular service access point, e.g

Re: [Wireshark-dev] macosx-setup.sh fails now

2015-01-24 Thread Guy Harris
On Jan 24, 2015, at 5:10 AM, Luc Dandoy wrote: > For SDK path detection wouldn't it be possible to use the xcode-select > command? > > Something like this in the configure.ac file should do the trick, It won't do the trick of making macosx-setup.sh work, as that must be run before you can, on

Re: [Wireshark-dev] [Wireshark-commits] master cf142c6: Get Wireshark to compile with afl-gcc.

2015-01-24 Thread Guy Harris
On Jan 24, 2015, at 2:43 PM, Gerald Combs wrote: > These were fixes that had to be made prior to fuzzing. As far as I can > tell they fall into the "squelch a compiler warning" category. afl-gcc > generates an instrumented executable, which you can then run under > afl-fuzz (the actual fuzzer).

Re: [Wireshark-dev] [Wireshark-commits] master cf142c6: Get Wireshark to compile with afl-gcc.

2015-01-24 Thread Guy Harris
On Jan 24, 2015, at 11:14 AM, Wireshark code review wrote: > cf142c6 by Gerald Combs (ger...@wireshark.org): > >Get Wireshark to compile with afl-gcc. > >Fix errors found by American Fuzzy Lop's afl-gcc >(http://lcamtuf.coredump.cx/afl/): > >peektagged.c: >error: 'fileVer

Re: [Wireshark-dev] macosx-setup.sh fails now

2015-01-23 Thread Guy Harris
On Jan 22, 2015, at 8:39 AM, Anders Broman wrote: > Failed to resolve SDK path for 'MacOSX10.10.sdk' > Failed to resolve SDK path for 'MacOSX10.10.sdk' Which version of OS X are you using, and which version of Xcode are you using?

Re: [Wireshark-dev] macosx-setup.sh fails now

2015-01-22 Thread Guy Harris
On Jan 22, 2015, at 9:52 AM, Roland Knall wrote: > CAP or at least SETCAP could be the capabilites utility for Linux, Yes. > I did not need it on Mac. OS X doesn't have the same capability mechanism, nor does it have PF_PACKET sockets for which capabilities would grant access, so it's neithe

Re: [Wireshark-dev] macosx-setup.sh fails now

2015-01-22 Thread Guy Harris
On Jan 22, 2015, at 1:08 AM, Anders Broman wrote: > Hi, > I reran the script and now it fails... > : > Making install in . > ./install-sh -c -d '/usr/local/bin' > /bin/sh ./libtool --mode=install /usr/bin/install -c pkg-config > '/usr/local/bin' > libtool: install: /usr/bin/install -c pkg-

Re: [Wireshark-dev] address to string optimization

2015-01-16 Thread Guy Harris
On Jan 16, 2015, at 11:34 AM, mman...@netscape.net wrote: > I still like the idea of the address types being "centrally registered" (in > epan directory) and not put into the dissector code, mostly because many of > the address types are used in multiple dissector/protocols. Perhaps libwiresha

Re: [Wireshark-dev] address to string optimization

2015-01-16 Thread Guy Harris
es have been figured > out/added. This also seems to be a preferred solution to the current USB > addressing (compare) issues. I think the author of the comment is named "Ronnie Sahlberg+Guy Harris+possibly some others". :-) I.e., I think Ronnie's the author of the first pa

Re: [Wireshark-dev] Change in wireshark[master]: USB: do not take into account implicit structure alignment i...

2015-01-15 Thread Guy Harris
On Jan 15, 2015, at 1:54 PM, "Pascal Quantin (Code Review)" wrote: > Pascal Quantin has uploaded a new change for review. > > https://code.wireshark.org/review/6560 > > Change subject: USB: do not take into account implicit structure alignment in > USB address size > ...

Re: [Wireshark-dev] Bug 6112 - ANSI map/tcap ReturnError can't dissect

2015-01-14 Thread Guy Harris
On Jan 14, 2015, at 4:57 AM, "Reutemann, Alan" wrote: > I’ve recently encountered this bug where all ANSI ReturnError messages are > flagged with malformed packet errors. Has there been any movement towards a > solution? Do you know yet if this is an ASN1 level bug or perhaps something > in

Re: [Wireshark-dev] Trying to write a LUA dissector for wireshark. How's the support?

2015-01-13 Thread Guy Harris
On Jan 13, 2015, at 11:14 AM, Stephan Arndt wrote: > There seems to be a lack of documentation, for example, the "Wireshark > LUA API Reference Manual"[1] linked in the Wireshark Wiki on the LuaAPI > page[2] is a 404, Hadriel just fixed that. ___

Re: [Wireshark-dev] Packets more than MTU are not getting captured

2015-01-13 Thread Guy Harris
On Jan 12, 2015, at 10:27 PM, Vishnu Bhatt wrote: > I am capturing through tcpdump and then opening the file using Wireshark. But > I can see only frames of 1514 bytes whereas data up to 3000 bytes are present. What do you mean by "data up to 3000 bytes are present"? The maximum *link-layer*

Re: [Wireshark-dev] A description of Wireshark

2015-01-12 Thread Guy Harris
On Jan 12, 2015, at 1:08 PM, Jaap Keuter wrote: > Also dopping the 'network' from 'network protocol analyzer' doesn't feel right > either. They main focus is still, and will certainly be, network packet > analysis. The fact that record based file formats can be read as well, is > just a > nice

Re: [Wireshark-dev] Protocol UPP is not available in wireshark release 1.12.3

2015-01-08 Thread Guy Harris
On Jan 8, 2015, at 3:25 AM, "Manish ." wrote: > I found the UPP custom used for version 1.6.7. > Please find the attached dictionary.kineto & upp.dll files. Below is the > procedure to apply this to 1.6.7 > > 1. Store upp.dll file to $wireshark/plugin/1.6.7(version) directory That won't work

Re: [Wireshark-dev] [Wireshark-users] Wireshark 1.12.3 is now available

2015-01-07 Thread Guy Harris
On Jan 7, 2015, at 8:07 PM, "Manish ." wrote: > I am confused with the two release of wireshark at a time (1.12.3 and 1.10.12) > Can anyone of you please confirm which one is latest and recommended. http://wiki.wireshark.org/Development/LifeCycle "The Wireshark download page lists thre

Re: [Wireshark-dev] Update Windows Build Instructions

2015-01-07 Thread Guy Harris
On Jan 7, 2015, at 5:05 PM, Jeff Morriss wrote: > Funny, when I want to build my normal vi-like editor on Windows/Cygwin I just > extract the tarball, type ./configure, and then "make". Works like a charm. > :-) > > Admittedly the editor has a LOT less requirements/dependencies than > Wires

Re: [Wireshark-dev] Update Windows Build Instructions

2015-01-07 Thread Guy Harris
On Jan 6, 2015, at 10:45 AM, Bálint Réczey wrote: > Today the the best practice (IMO) is _not_ shipping configure, but > requiring autofoo/CMake in source tarballs. And if we're going to require more than just compiler+make to build from source, CMake might be the better of those two choices.

Re: [Wireshark-dev] CMake status

2015-01-06 Thread Guy Harris
On Jan 6, 2015, at 3:26 AM, Graham Bloice wrote: > > • Fix compile warnings. > > Are there compile warnings we're getting from the CMake build that we're not > getting from the nmake build? > > Yes, See the end of the last successful buildbot Cmake build (it appears to > be broken agai

Re: [Wireshark-dev] CMake status

2015-01-05 Thread Guy Harris
On Jan 5, 2015, at 3:11 PM, Graham Bloice wrote: > FWIW my current Windows CMake list of tasks to do (in no particular order): > • Add zlib to build. What remains to be done there? The buildbot Win32 and Win64 builds both appear to be picking up zlib. Or do you mean "build zlib as part

Re: [Wireshark-dev] Improving TCAP session matching

2015-01-03 Thread Guy Harris
On Jan 3, 2015, at 4:32 PM, Luke Mewburn wrote: > I suspect we need special-case handling in find_conversation() (etc) > for PT_TCAP, including possibly a separate hashtable or keeping > the TCAP BEGIN in the conversation_hashtable_no_addr2_or_port2 in > parallel to the entry in conversation_has

Re: [Wireshark-dev] Problem with building fresh on Mac 10.10.1

2014-12-20 Thread Guy Harris
On Dec 20, 2014, at 2:53 AM, Roland Knall wrote: > The setupscript does not seem to work properly. All I get are the following > messages: > > ./macosx-setup.sh: line 578: test: 10.1: integer expression expected > > ./macosx-setup.sh: line 578: test: 10.1: integer expression expected Try th

Re: [Wireshark-dev] [Wireshark-commits] master b736896: Handle floorl() the same way we handle other not-on-all-platforms functions.

2014-12-19 Thread Guy Harris
On Dec 19, 2014, at 7:51 PM, Stephen Fisher wrote: > ui/libui.a(libui_a-time_shift.o): In function `time_string_to_nstime': > /usr/local/src/wireshark/ui/time_shift.c:260: undefined reference to > `floorl' Is it compiling wsutil/floorl.c? Is it linking with -lm? Does the configure script thi

Re: [Wireshark-dev] [Wireshark-commits] master b736896: Handle floorl() the same way we handle other not-on-all-platforms functions.

2014-12-19 Thread Guy Harris
On Dec 19, 2014, at 7:08 PM, Stephen Fisher wrote: > Thanks for correcting this. I see now that there are other functions > defined the way you re-defined floorl(). The example I randomly picked > to follow was wsutil/tempfile.[ch], which is done with just > AC_CHECK_FUNCS() and #ifndef HAV

Re: [Wireshark-dev] Feedback about Multipath TCP support

2014-12-19 Thread Guy Harris
On Dec 19, 2014, at 4:24 PM, Matt wrote: > I believe wireshark may need to implement some data structures/GUIs > helping with upcoming multipath protocols such as TRILL, SCTP, LISP, > MPTCP... This is not new. For example, there's a certain protocol developed back in the mid 1980's in which "

Re: [Wireshark-dev] What Wireshark base version to use for customization

2014-12-10 Thread Guy Harris
On Dec 10, 2014, at 11:02 AM, Graham Bloice wrote: > A Wireshark plugin links with the main body of the program and thus is > covered by the licence of the main program. >From the GPL FAQ: http://www.gnu.org/licenses/gpl-faq.html#GPLAndPlugins "If I write a plug-in to use with a GPL-

Re: [Wireshark-dev] [Wireshark-commits] master 3147087: Fix ranlib "has no symbols" errors in the codecs directory.

2014-12-09 Thread Guy Harris
On Dec 9, 2014, at 1:25 PM, Wireshark code review wrote: > URL: > https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=3147087de323c0294b51006f97b641fc408f1b06 > Submitter: Gerald Combs (ger...@wireshark.org) > Changed: branch: master > Repository: wireshark > > Commits: > > 3

Re: [Wireshark-dev] Doubt regarding absolute time in wireshark

2014-12-09 Thread Guy Harris
On Dec 9, 2014, at 1:04 AM, Vishnu Bhatt wrote: > Suppose I capture a pcap file in country ‘A’ and the the pcap file is being > seen in some other machine in country ‘B’. What “absolute time” should > Wireshark display? I’ve seen ambiguous behavior, in some cases A’s time zone > is displayed

Re: [Wireshark-dev] The possibility of a curses based Wireshark

2014-11-28 Thread Guy Harris
On Nov 28, 2014, at 2:23 PM, Stephen Fisher wrote: > Now that we've gone ahead and allowed C++ code into Wireshark after > years of resistance:), will we always require the user to have a C++ > compiler available? That would simplify refactoring the code to call > GTK vs. Qt vs. any other UI

Re: [Wireshark-dev] Crash in capture dialog, monitor changed callback (bug 10685)

2014-11-28 Thread Guy Harris
On Nov 28, 2014, at 8:13 AM, Peter Wu wrote: > I came across a duplicated piece of code by grepping for the string "DLT > n" which I originally found in ui/gtk/capture_dlg.c. Two questions: > > - Can somebody reduce the duplication (two occurrences in > ui/gtk/capture_dlg.c, one in ui/qt/mana

Re: [Wireshark-dev] The possibility of a curses based Wireshark

2014-11-28 Thread Guy Harris
On Nov 28, 2014, at 11:26 AM, Stephen Fisher wrote: > On a similar note: GLib has many non-GUI features that we use and Qt > provides similar functionality. Are we going to move everything to Qt's > way of doing things, or keep Glib around even if we don't use GTK or > roll our own utility f

Re: [Wireshark-dev] The possibility of a curses based Wireshark

2014-11-28 Thread Guy Harris
On Nov 28, 2014, at 11:23 AM, Stephen Fisher wrote: > I've started tinkering with the possibility of making a curses text > based GUI for Wireshark (cshark, I suppose). I started by making a new > directory under ui/ for it and creating dummy functions for things that > the main code base ru

Re: [Wireshark-dev] Custom link layer type for logging additional data

2014-11-26 Thread Guy Harris
On Nov 26, 2014, at 11:43 PM, Michal Labedzki wrote: > How about use "LINKTYPE/DLT WIRESHARK_UPPER_PDU"? With this one > (+extcap) "wiretap" is complete replacement of libpcap ("Wiretap is a > library that is being developed as a future replacement for > libpcap" - wiretap/README). The README i

Re: [Wireshark-dev] Custom link layer type for logging additional data

2014-11-26 Thread Guy Harris
On Nov 26, 2014, at 11:34 PM, Anil wrote: > Thanks for your reply. I will follow the procedure when I have to checkin the > code (I have not done that as of now). > > My question is more about, 'is it right to use another link type to log > additional information about the packet ?' . The add

Re: [Wireshark-dev] Custom link layer type for logging additional data

2014-11-26 Thread Guy Harris
On Nov 26, 2014, at 8:18 PM, Anil wrote: > Hi, > > During packet capture, I want to log additional data other than what's in the > ethernet packet and the per packet pcap header. So, I have created a custom > header and am logging additional information into this. > > I have modified pcap_

Re: [Wireshark-dev] --without-gtk3 doesn't imply --with-qt

2014-11-26 Thread Guy Harris
On Nov 26, 2014, at 10:01 AM, Stephen Fisher wrote: > Is there any reason a user would have both GTK3 and GTK2 installed and > not want to use GTK3 for wireshark-gtk builds? They're a developer and want to either 1) make sure that a change they're doing won't break GTK 2 or

Re: [Wireshark-dev] --without-gtk3 doesn't imply --with-qt

2014-11-25 Thread Guy Harris
On Nov 25, 2014, at 7:09 PM, Jeff Morriss wrote: > On 11/25/2014 06:09 PM, Stephen Fisher wrote: >> I decided to stop building my local Wireshark with GTK3 support by >> adding --without-gtk3 (or --with-gtk3=no) assuming that this would still >> imply that I wanted it built with qt (--with-qt or

Re: [Wireshark-dev] How to register a UDP src port for one protocol and dst port for another?

2014-11-25 Thread Guy Harris
On Nov 24, 2014, at 5:39 PM, Andy Howell wrote: > I'm writing some dissectors for a set of UDP based protocols that use the > same port number > as the source port in one direction, and the destination port in the other > direction. Its > a different protocol going each way. > > It seems that

Re: [Wireshark-dev] removed functions fast way to find substitutes?

2014-11-21 Thread Guy Harris
On Nov 21, 2014, at 12:48 AM, Semjon wrote: > One of my current problems is with > > tvb_get_faked_unicode(...) > > which isn't available anymore. > In my Protocol I have some Ascii-encoded String but which comes as two > bytes per character. Example: > {0x0031, 0x0032, 0x0033, 0x0034, 0x}

Re: [Wireshark-dev] Can't get nsecs info form lua srcript ?

2014-11-20 Thread Guy Harris
On Nov 20, 2014, at 2:43 PM, John Sullivan wrote: > The second part of the answer involves the meaning of a nanosecond > precision packet timestamp. Especially given that there isn't necessarily a guarantee that the time stamps reflect the exact arrival time of the first bit - or the last bit

Re: [Wireshark-dev] Can't get nsecs info form lua srcript ?

2014-11-20 Thread Guy Harris
On Nov 20, 2014, at 8:07 AM, 徐鸿 wrote: > Is it possible to get accurate nanosecond info for lua script ? For the > same packet , I got pinfo.abs_ts == 1416493696.7953 in lua script , but in > main window the time show as "1416493696.795345000",is it possible to got > the accurate nan

Re: [Wireshark-dev] Building under OSX Yosemite using cmake

2014-11-10 Thread Guy Harris
On Nov 10, 2014, at 6:18 PM, David Ameiss wrote: > Not sure. However, on a Mavericks system with Xcode 6.1, it was NOT in the > makefiles. Which likely means it’s something with dependencies (differing > between 10.9 and 10.10), or some odd difference between the command line > tools for 10.9

Re: [Wireshark-dev] Building under OSX Yosemite using cmake

2014-11-10 Thread Guy Harris
On Nov 10, 2014, at 7:02 PM, Guy Harris wrote: > I'll look further to see where that's coming from. For some reason, CMake seems to think that libm requires it; the output of "cmake ../wireshark" included: -- Found M: /usr/lib/libm.dylib M FOUND -- M includes: /Sy

Re: [Wireshark-dev] Building under OSX Yosemite using cmake

2014-11-10 Thread Guy Harris
On Nov 10, 2014, at 6:18 PM, David Ameiss wrote: >> On Nov 10, 2014, at 8:10 PM, Guy Harris wrote: >> >> On Nov 10, 2014, at 12:43 PM, David Ameiss wrote: >> >>> - With the Xcode 6.1 command-line tools for Yosemite, for some reason >>> "-I/Sys

Re: [Wireshark-dev] Building under OSX Yosemite using cmake

2014-11-10 Thread Guy Harris
On Nov 10, 2014, at 12:43 PM, David Ameiss wrote: > I've run into some issues building on OSX Yosemite with Xcode 6.1 and cmake. > Fortunately, I seem to have solved them... > > - Qt 5.2.1 doesn't build properly on Yosemite (can't recall the specific > error offhand), but Qt 5.3.2 builds (and

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-07 Thread Guy Harris
On Nov 7, 2014, at 12:10 PM, Alexis La Goutte wrote: > You need to fix this issue... actually, it is possible to translate > the list of language... Is there any good reason why having a list of language that, for example, goes English French ... rather than

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-07 Thread Guy Harris
On Nov 7, 2014, at 12:23 PM, Guy Harris wrote: > On Nov 7, 2014, at 12:10 PM, Alexis La Goutte > wrote: > >> You need to fix this issue... actually, it is possible to translate >> the list of language... > > Is there any good reason why having a list of langu

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-07 Thread Guy Harris
On Nov 7, 2014, at 5:30 AM, Fulko Hew wrote: > Here's my take on the subject (not that it happens often) ... > > Sometimes I may find myself having to use someone else's computer in > some other country. That machine has been set to the local country and > language and keyboard. As an English

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-07 Thread Guy Harris
On Nov 6, 2014, at 10:59 PM, Michal Labedzki wrote: > Ability to change language is needed. But the real question is those > names should be translated or not. For example KDE do that. Do you mean that all the languages' names are translated into the *current* language? If so, that's absolute

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-06 Thread Guy Harris
On Nov 6, 2014, at 10:49 AM, Guy Harris wrote: > If the vast majority of users would always use their system-wide language > setting, with the users who don't being, for example, developers working on > translations, and there's a way to, for example, override it wit

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-06 Thread Guy Harris
On Nov 6, 2014, at 2:47 PM, Pascal Quantin wrote: > 2014-11-06 21:58 GMT+01:00 Guy Harris : > >> I'm *really* trying to understand the reasons why an additional "select the >> language" option, over and above a system "select the language" option

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-06 Thread Guy Harris
On Nov 6, 2014, at 11:44 AM, Pascal Quantin wrote: > 2014-11-06 20:33 GMT+01:00 Guy Harris : > >> On Nov 6, 2014, at 11:04 AM, Pascal Quantin wrote: >> >>> And as I said in an earlier email, letting a user manually select the >>> language in an appli

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-06 Thread Guy Harris
On Nov 6, 2014, at 11:04 AM, Pascal Quantin wrote: > And as I said in an earlier email, letting a user manually select the > language in an application is common practice on Windows. So what are some examples of applications that support this? __

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-06 Thread Guy Harris
On Nov 6, 2014, at 3:57 AM, Michal Labedzki wrote: > I have LC_ALL=en_GB.UTF8, but KDE and Firefox set to Polish. So > Wireshark needs to be set to Polish too. > So some applications I have in Polish, other in English. So why do you work in a "mixed mode" like that? > I think it is common case

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-06 Thread Guy Harris
On Nov 6, 2014, at 5:58 AM, Alexis La Goutte wrote: > What the problem to have a setting for select language ? It's One More Setting, and clutters the preferences GUI. If the vast majority of users would always use their system-wide language setting, with the users who don't being, for exampl

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-06 Thread Guy Harris
references application in OS X, the "Locale" pane in "System Settings" in KDE, and the "Region and Language" pane in the Control Panel in Windows 7. > It will be big problem for users. > > I check some applications: > assistant, designer works in Guy Harr

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-06 Thread Guy Harris
On Nov 6, 2014, at 1:32 AM, Alexis La Goutte wrote: > Like other no English people, i want to have the choose to select the > language on Gui. > For me, it is a not a problem to have a option to choose the language > (there is a lot of option/preference on Wireshark...) Perhaps it shouldn't hav

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-05 Thread Guy Harris
On Nov 5, 2014, at 2:12 AM, Michal Labedzki wrote: >> Please run "LC_ALL=it_IT wireshark" > > Does it work on Windows? I do not remember to know anyone GUI > application without option to change language by GUI. So how do developers on Windows who have their system configured for one language

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-05 Thread Guy Harris
On Nov 5, 2014, at 2:30 AM, Pascal Quantin wrote: >> 2014-11-05 11:12 GMT+01:00 Michal Labedzki : >>> Please run "LC_ALL=it_IT wireshark" >> >> Does it work on Windows? I do not remember to know anyone GUI >> application without option to change language by GUI. Do you know how >> to change loc

Re: [Wireshark-dev] Compilation error in ws_mempbrk_sse42.c

2014-11-04 Thread Guy Harris
On Nov 4, 2014, at 2:32 PM, Stephen Fisher wrote: > On Tue, Nov 04, 2014 at 12:34:36PM -0800, Guy Harris wrote: > >> int8_t is a C99 datatype; older versions of various UN*Xes might not >> support it, and, even on those that do, you might have to include >> . G

Re: [Wireshark-dev] Compilation error in ws_mempbrk_sse42.c

2014-11-04 Thread Guy Harris
On Nov 4, 2014, at 12:05 PM, Stephen Fisher wrote: > On Mon, Nov 03, 2014 at 04:14:15PM -0700, Stephen Fisher wrote: > >> I haven't done Wireshark development in a while, so I'm not familiar >> with some of the new code, such as wsutil/ws_mempbrk_sse42.c. On >> FreeBSD 10.0-RELEASE on amd64

[Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-04 Thread Guy Harris
I.e., are there reasons, on any platforms, to set the Language preference to anything other than Auto-Detect? As far as I know, on all supported platforms (Windows, OS X, UN*Xes other than OS X) the Qt system locale gets the locale information from the appropriate place on the OS. Is there eve

Re: [Wireshark-dev] ctype.h calls

2014-10-28 Thread Guy Harris
On Oct 28, 2014, at 10:56 AM, Jeff Morriss wrote: > Just catching up on 3 weeks of traffic on the the -commits list... > > Is there any reason the remaining ctype.h calls in master shouldn't be > removed [and the functions put on the prohibited list in checkAPIs.pl]? The remaining calls in Wi

Re: [Wireshark-dev] TCP: Retrieving connection initiator as well as looping through connections

2014-10-27 Thread Guy Harris
On Oct 27, 2014, at 6:47 AM, Matt wrote: > I am trying to improve the MPTCP support in the TCP dissector. To > provide expert infos, I need to identify which host initiated the > connection (ie sent the SYN). I wonder how to do that, I could use > tcp_analysis::server_port if ports were guarante

Re: [Wireshark-dev] File Seek Change

2014-10-25 Thread Guy Harris
On Oct 25, 2014, at 1:50 PM, Evan Huus wrote: > https://code.wireshark.org/review/527 has been bouncing around since > March; I think the current version is ready to go (and it's only a > handful of lines changed) but I'd appreciate if somebody else could > take a look before it falls off the ed

Re: [Wireshark-dev] Installing on Ubuntu 12.04.5

2014-10-23 Thread Guy Harris
On Oct 22, 2014, at 8:43 PM, Tracy Hockenhull wrote: > I'm fairly new to Linux, and new to Wireshark, and I'm having problems with > the ./configure part of the process to install Wireshark. On Ubuntu, the standard process to install a program is "fire up Synaptics Package Manager, search for

Re: [Wireshark-dev] Functioning of FCS checkbox in IEE802.11 prot

2014-10-17 Thread Guy Harris
On Oct 17, 2014, at 8:25 AM, "Emburey Samrex Edward -X (emedward - EMBED UR SYSTEMS at Cisco)" wrote: > This is regd the FCS representation in the 802.11 frames. > > Most of the Cisco APs do have the last 4-byte of FCS, which is rightly > represented in the wireshark captures. > > Whereas,

Re: [Wireshark-dev] ARM Build

2014-10-16 Thread Guy Harris
On Oct 15, 2014, at 11:03 AM, Alexis La Goutte wrote: > packet-mac-lte.c: In function 'dissect_mac_lte': > packet-mac-lte.c:5334:39: error: 'rapid_description' may be used > uninitialized in this function [-We > rror=maybe-uninitialized] > expert_add_info_format(pinfo, ti, >

Re: [Wireshark-dev] ARM Build

2014-10-16 Thread Guy Harris
On Oct 16, 2014, at 4:50 AM, Graham Bloice wrote: > Visual Studio (VS2013 at least) as 32 & 64 bit ARM compilers. http://msdn.microsoft.com/en-us/library/0w6ke344.aspx "Type char Visual Studio 2013 Other Versions 1 out of 1 rated this helpful - Rate this topic The char

Re: [Wireshark-dev] ARM Build

2014-10-16 Thread Guy Harris
On Oct 15, 2014, at 11:43 AM, Guy Harris wrote: >> I have try to build lasted trunk/master of wireshark (to test speed..) >> but don't build : >> >> ftype-pcre.c: In function 'raw_flag_needed': >> ftype-pcre.c:64:13: error: comparison is alw

Re: [Wireshark-dev] ARM Build

2014-10-15 Thread Guy Harris
On Oct 15, 2014, at 11:03 AM, Alexis La Goutte wrote: > Hi, > > I have try to build wireshark on ARM(v7) Machine ...which may be running a compiler in which "char" is unsigned; I seem to remember that issue coming up with some software in the past couple of months (possibly Wireshark, possi

Re: [Wireshark-dev] Packaging up a source tarball

2014-10-14 Thread Guy Harris
On Oct 14, 2014, at 11:11 AM, "Eric W. Anderson" wrote: > Sorry, I wasn't clear. Autogen worked fine. *just* running autogen, and then > tar-ing up the resulting files didn't build properly in my particular odd > environment (cross-compiling under OpenWRT). No, that wouldn't work. You need

Re: [Wireshark-dev] Packaging up a source tarball

2014-10-14 Thread Guy Harris
On Oct 14, 2014, at 10:57 AM, "Eric W. Anderson" wrote: > Thanks. I tried just running autogen and it sort of worked and sort of > didn't. Then that's a separate problem, which you're going to have to fix if you want to run the configure script. What didn't work? __

Re: [Wireshark-dev] Packaging up a source tarball

2014-10-14 Thread Guy Harris
On Oct 14, 2014, at 10:33 AM, "Eric W. Anderson" wrote: > Is there a script or standard procedure for making a "releasable" tarball from > Git? I want to make a tarball (that's ready to run configure on) "...ready to run configure on" implies autotools, so try doing "make dist" to make the ta

Re: [Wireshark-dev] DCERPC (idl2wrs & pidl)

2014-10-10 Thread Guy Harris
On Oct 10, 2014, at 5:08 AM, Alexis La Goutte wrote: > i have a major question about idl2wrs and Pidl : > There is 2 different tools to generate Wireshark dissector for idl file : > * idl2wrs (in epan/dissectors/dcerpc folder) > * Pidl (in tools and epan/dissectors/pidl). > > Somebody known, wh

Re: [Wireshark-dev] Change in wireshark[master]: Overhaul the filterability of packet-ansi_683.c

2014-10-07 Thread Guy Harris
On Oct 7, 2014, at 5:03 AM, "Michael Mann (Code Review)" wrote: > Michael Mann has uploaded a new change for review. > > https://code.wireshark.org/review/4521 > > Change subject: Overhaul the filterability of packet-ansi_683.c Note, BTW, that this does more than just improve the filterabil

<    5   6   7   8   9   10   11   12   13   14   >