Re: [Wireshark-dev] Dissecting pcapng local block types

2023-02-08 Thread Martin Mathieson via Wireshark-dev
https://gitlab.com/wireshark/wireshark/-/merge_requests/9688 has been merged. On Sat, Feb 4, 2023 at 11:11 PM Martin Mathieson < martin.r.mathie...@googlemail.com> wrote: > Have changed the file name (compromise: file-pcapng-darwin.c). > > There are some Darwin-related options for the Enhanced

Re: [Wireshark-dev] Dissecting pcapng local block types

2023-02-04 Thread Martin Mathieson via Wireshark-dev
Have changed the file name (compromise: file-pcapng-darwin.c). There are some Darwin-related options for the Enhanced Packet Block type, that I didn't try to move to file-pcapng-darwin.c. Is it likely to be common for local packet block definitions to also have options for Enhanced Packet Block (

Re: [Wireshark-dev] Dissecting pcapng local block types

2023-02-04 Thread Martin Mathieson via Wireshark-dev
Yes, if there are likely no other similar types. On Sat, 4 Feb 2023, 16:56 chuck c, wrote: > file-pcapng_darwin_process_event.c > > I guess it's not as bad as the filenames with a "+" in the names, but > would file-darwin.c be enough? > > On Sat, Feb 4, 2023 at 10:48 AM Martin Mathieson via Wire

Re: [Wireshark-dev] Dissecting pcapng local block types

2023-02-04 Thread chuck c
file-pcapng_darwin_process_event.c I guess it's not as bad as the filenames with a "+" in the names, but would file-darwin.c be enough? On Sat, Feb 4, 2023 at 10:48 AM Martin Mathieson via Wireshark-dev < wireshark-dev@wireshark.org> wrote: > Please see https://gitlab.com/wireshark/wireshark/-/m

Re: [Wireshark-dev] Dissecting pcapng local block types

2023-02-04 Thread Martin Mathieson via Wireshark-dev
Please see https://gitlab.com/wireshark/wireshark/-/merge_requests/9688 I have yet to port my (genuinely) local block type, but would like to see if this approach looks OK. More thought might be needed to stay safe while dealing with block types that don't have options. On Fri, Feb 3, 2023 at 11:

Re: [Wireshark-dev] Dissecting pcapng local block types

2023-02-03 Thread Martin Mathieson via Wireshark-dev
On Fri, Feb 3, 2023 at 7:25 AM Guy Harris wrote: > On Feb 1, 2023, at 12:58 AM, Joakim wrote: > > > if you manage to add a dissector table that would be great! I believe my > company too will implement non-standard blocks so it would be very > convenient to have it available. > > Note that what'

Re: [Wireshark-dev] Dissecting pcapng local block types

2023-02-03 Thread Martin Mathieson via Wireshark-dev
On Fri, Feb 3, 2023 at 7:05 AM Guy Harris wrote: > On Jan 28, 2023, at 3:19 PM, Martin Mathieson via Wireshark-dev < > wireshark-dev@wireshark.org> wrote: > > > I have 5 non-standardised/local block types that are in-use within my > company, that are in the 'local' range 0x8000-0x. >

Re: [Wireshark-dev] Dissecting pcapng local block types

2023-02-02 Thread Guy Harris
On Feb 1, 2023, at 12:58 AM, Joakim wrote: > if you manage to add a dissector table that would be great! I believe my > company too will implement non-standard blocks so it would be very convenient > to have it available. Note that what's being discussed here would *only* handle dissecting the

Re: [Wireshark-dev] Dissecting pcapng local block types

2023-02-02 Thread Guy Harris
On Jan 28, 2023, at 3:19 PM, Martin Mathieson via Wireshark-dev wrote: > I have 5 non-standardised/local block types that are in-use within my > company, that are in the 'local' range 0x8000-0x. > > My first thought was to add a dissector table (pcapng.block-types ?) by > 'Block

Re: [Wireshark-dev] Dissecting pcapng local block types

2023-02-02 Thread Martin Mathieson via Wireshark-dev
I am aiming to try, maybe this weekend. My plan is to leave the 'darwin process' type in file-pcapng.c but make it register in the table, and also convert and move to a separate file one that I've written for the most complicated example (i.e. involves options) that I have. Regards, Martin On We

Re: [Wireshark-dev] Dissecting pcapng local block types

2023-02-01 Thread Joakim
Hi, if you manage to add a dissector table that would be great! I believe my company too will implement non-standard blocks so it would be very convenient to have it available. //Joakim On Sun, 29 Jan 2023 at 00:19, Martin Mathieson via Wireshark-dev < wireshark-dev@wireshark.org> wrote: > I ha

[Wireshark-dev] Dissecting pcapng local block types

2023-01-28 Thread Martin Mathieson via Wireshark-dev
I have 5 non-standardised/local block types that are in-use within my company, that are in the 'local' range 0x8000-0x. My first thought was to add a dissector table (pcapng.block-types ?) by 'Block Type Code' in file-pcapng.c, then have dissectors register by adding themselves to the