Re: [Wireshark-dev] tshark fails to capture packet on IB interface

2006-09-20 Thread Guy Harris
Guy Harris wrote: No, because I don't have the Linux kernel source handy at present, but what you want to do is edit net/core/dev.c, look for case SIOCGIFHWADDR: somewhere around line 2362, and change the code to do Actually, the existing code already refuses to copy more than sizeof

Re: [Wireshark-dev] Fwd: And again BER errors while decoding H248packets

2006-09-20 Thread Oleg Kostenko
Hello Anders, Here is the fragment from the ASN.1 specification for H.248. TerminationStateDescriptor ::= SEQUENCE { propertyParms SEQUENCE OF PropertyParm, eventBufferControl EventBufferControl OPTIONAL, serviceStateServiceState OPTIONAL, ... } As I understand, SEQUENCE

[Wireshark-dev] Patch to packet-tcp.h

2006-09-20 Thread Peter Johansson
This is a resend of a patch I sent September 8th, it seems to have been misplaced somwhere ;) / Regards, Peter ---BeginMessage--- Hi, the attached patch adds a missing inlude to packet-tcp.h / Regards, Peter Index: C:/wireshark-win32-libs/epan/dissectors/packet-tcp.h

Re: [Wireshark-dev] New radius attributes (RFC 4590)

2006-09-20 Thread Jaap Keuter
Hi, Too bad, since the patch doesn't match RFC 4590 table 2. Care to fix it? Thanx, Jaap On Wed, 20 Sep 2006, Joerg Mayer wrote: Did anyone fix this? Committed revision 19266. Thanks! Joerg ___ Wireshark-dev mailing list

Re: [Wireshark-dev] New radius attributes (RFC 4590)

2006-09-20 Thread Joerg Mayer
On Wed, Sep 20, 2006 at 04:27:43PM +0200, Jaap Keuter wrote: Too bad, since the patch doesn't match RFC 4590 table 2. Care to fix it? The only thing I could do is to revert the patch. Should I do that? Ciao Joerg -- Joerg Mayer [EMAIL PROTECTED]

Re: [Wireshark-dev] New radius attributes (RFC 4590)

2006-09-20 Thread Jaap Keuter
Hi, No need, already patched the patch ;) Thanx, Jaap On Wed, 20 Sep 2006, Joerg Mayer wrote: On Wed, Sep 20, 2006 at 04:27:43PM +0200, Jaap Keuter wrote: Too bad, since the patch doesn't match RFC 4590 table 2. Care to fix it? The only thing I could do is to revert the patch. Should I

Re: [Wireshark-dev] WireShark crashes when I try to use a filter on my plugin dissector

2006-09-20 Thread Bill Fassler
You nailed it Gilbert! My string value array was missing the last necessary record of :{ 0, NULL }wThe reason I removed it was because we identify a NOP command as 0x00. I put this final record in and I no longer get a run time fatal error and crash. It looks like my filters are working. My

[Wireshark-dev] Should we check value_strings f or NULL termination while registering?

2006-09-20 Thread Ulf Lamping
Hi List! It seems to be a common mistake to forget the terminating zero entry in a value_string, I've done this myself before and it's hard to track it down if you don't have a clue what's going wrong. Even worse, this mistake might not make any problems for a long time as usually the values

Re: [Wireshark-dev] Should we check value_strings for NULL termination while registering?

2006-09-20 Thread Gilbert Ramirez
I believe we do this in the build-bot testing, by doing: tshark -G values Since that operation iterates across all the value_string arrays, a non-terminated array will result in an error or at least it should. Is that enough testing? --gilbert On 9/20/06, Ulf Lamping [EMAIL PROTECTED]

[Wireshark-dev] EtherCAT Plugin

2006-09-20 Thread Richard Kümmel
Hello, i have written a Parser for the Realtime Ethernet Protocol EhterCAT devolped by Beckhoff Automation GbmH as plugin in wireshark. I tested the plugin with windows and with the linux suse distribution.Information to EtheCAT can be found on ethercat.org. I would like this plugin

Re: [Wireshark-dev] EtherCAT Plugin

2006-09-20 Thread Jaap Keuter
Hi, Well, make it a regular dissector first, since you're going public anyway. Then post a patch adding the dissector to the current tree. Then duck for all the comments flying your way ;) Thanx, Jaap On Wed, 20 Sep 2006, [iso-8859-1] Richard K?mmel wrote: Hello, i have written a Parser for

Re: [Wireshark-dev] WireShark crashes when I try to use a filter on my plugin dissector

2006-09-20 Thread Guy Harris
Bill Fassler wrote: My concern now is that the first and last entries are zero. Could this create any run time problems? {0x00, No Operation} . . . {0, NULL} No, that won't cause a problem. It's the null string pointer that's the key, not the 0 value.

Re: [Wireshark-dev] Crash after Init dissectors (was newbie build problem)

2006-09-20 Thread Shelly Cadora
Alas, I have arrived at the same place. If I understand MSVC's debugging function correctly (questionable), then it's crashing at an fgetline call in libwireshark.dll. libwireshark.dll!fgetline(char * * buf=0x0012fc20, int * size=0x0012fc1c, _iobuf * fp=0x77c5fce0) Line 588 + 0xa bytesC That's

Re: [Wireshark-dev] Official registration of ethernet type with IANA

2006-09-20 Thread Stephen Fisher
On Wed, Sep 20, 2006 at 11:36:13AM -0700, Bill Fassler wrote: Apparently my company has not yet officially registered their self selected ethernet type designation with IANA (or whoever it is supposed to be registered with). Can anyone give me some advice on the least painful method of

Re: [Wireshark-dev] Crash after Init dissectors (read_hosts_file)

2006-09-20 Thread Shelly Cadora
Maybe I'm getting alittle closer here... It looks like fgetline is failing when it tries to read from the hosts file. The file pointer returned by eth_fopen(hostspath, "r") in the read_hosts_file function is bad. I don't understand why...hostspath is correct

Re: [Wireshark-dev] Crash after Init dissectors (read_hosts_file)

2006-09-20 Thread Guy Harris
Shelly Cadora wrote: Maybe I'm getting a little closer here... It looks like fgetline is failing when it tries to read from the hosts file. The file pointer returned by eth_fopen(hostspath, r) in the read_hosts_file function is bad. Bad in what sense? If it's null, the open failed -

Re: [Wireshark-dev] Crash after Init dissectors (read_hosts_file)

2006-09-20 Thread Shelly Cadora
Guy Harris [EMAIL PROTECTED] wrote:Shelly Cadora wrote: Maybe I'm getting a little closer here... It looks like fgetline is failing when it tries to read from the hosts file. The file pointer returned by eth_fopen(hostspath, "r") in the read_hosts_file function is bad."Bad" in what

Re: [Wireshark-dev] http_dissector_add

2006-09-20 Thread Brian Vandenberg
I have a small request: Can http_dissector_add (from packet-http.c) be added to libwireshark.def? I'm writing a dissector in a plugin, and I'd like to use this function, but since that symbol isn't exported, I have to make a new [custom] build of wireshark (which I'm trying to avoid) for

Re: [Wireshark-dev] question(s) on the use of heur_dissector_add

2006-09-20 Thread Guy Harris
Brian Vandenberg wrote: As far as I can tell, basically, I can't use a heuristic dissector to dissect anything http has already looked at if another dissector has registered itself as a subdissector for the given port. Is that about accurate? Yes. The same problem exists with TCP or

Re: [Wireshark-dev] Patch to packet-tcp.h

2006-09-20 Thread Anders Broman
Hi, The last time this was asked it was answered: http://www.ethereal.com/lists/ethereal-dev/200604/msg00097.html Hi, There doesn't seem to be a coding rule within the Ethereal code base that states that a header file itself must include the header files it depends on. If it is we have a whole