Re: [Wireshark-dev] 0.99.7 release?

2007-11-08 Thread Andrew Hood
Ulf Lamping wrote: Gerald Combs schrieb: It's been a while since 0.99.6 was released (Holy crap! July 5!), so it would probably be a good idea to push 0.99.7 out the door. I'd like to make a prerelease on the 19th or 20th, with a final release a week later. I had the same idea recently.

Re: [Wireshark-dev] Startup speed up - assembler usage

2007-11-08 Thread Guy Harris
Kukosa, Tomas wrote: E.g. I was able (with about 80 lines in assembler) to reduce time spent in libwireshark.dll during startup from cca 2600ms to 1300ms on my PC. Which code did you change from C to assembler to get that speedup? ___ Wireshark-dev

Re: [Wireshark-dev] Missing Interface Name on Windows Vista forwireshark

2007-11-08 Thread coolusee
Hi , I have attached the ipconfig -a output. Sorry its in Norwegian but the `PPP-kort Nokia 6680 GGSN PH3` is not displayed at all. Can anyone trace on a interface that is not listed by wireshark I mean using a MAC address or something ? Can wireshark display hidden interfaces ? Microsoft

Re: [Wireshark-dev] Missing Interface Name on Windows Vistaforwireshark

2007-11-08 Thread Gianluca Varenni
- Original Message - From: [EMAIL PROTECTED] To: Developer support list for Wireshark wireshark-dev@wireshark.org Sent: Thursday, November 08, 2007 5:11 AM Subject: Re: [Wireshark-dev] Missing Interface Name on Windows Vistaforwireshark Hi , I have attached the ipconfig -a output.

Re: [Wireshark-dev] 0.99.7 release?

2007-11-08 Thread Luis EG Ontanon
MIB-RFC1213 is already in the default smi_modules file... I am aware that asking libSMI to reload a MIB already loaded (even if renamed) causes a crash (I see oids.c:572 in the stack but that's a debugger issue I guess). But I do not know a simple solution to avoid reloading a MIB that is already

Re: [Wireshark-dev] Codec plugin

2007-11-08 Thread Joerg Mayer
Hello Tomas, On Thu, Nov 08, 2007 at 03:34:38PM +0100, Tomas Kukosa wrote: I am sending it again from standard mail. Thanks - that was readable :-) I'll do it later today (GMT-5). Maybe you can provide a small README that explains where to find the Codes etc? Ciao Joerg -- Joerg Mayer

Re: [Wireshark-dev] Codec plugin

2007-11-08 Thread Kukosa, Tomas
Short description: - extract easy_codec.zip into the plugins/easy_codec directory - download codec libraries (EasyG723.1, EasyG729A, EasyG722) from http://www.imtelephone.com/ - extract downloaded libraries with headers into following directories: plugins/easy_codec/EasyG7231

[Wireshark-dev] my added dissectors don't appear in the Makefile

2007-11-08 Thread Fulko Hew
Im just wrapping up development on my enhancements and new dissectors for wireshark, and while preparing my patch set, I'm testing it by applying it to a virgin tarball. The developer instructions say I just had to add my src files to epan/dissectors/Makefile.common, and then I run 'configure'

[Wireshark-dev] SMB and lost NBSS streams

2007-11-08 Thread Andrew Leung
Hi, I am analyzing SMB traces from CIFS and NetBIOS ports. All packets use the session layer NBSS protocol to determine application level (SMB) packet boundaries. In some cases we drop packets (heavy I/O periods usually) and can lose the end of a NBSS stream and the beginning of the next.

[Wireshark-dev] Alignment warnings - don't ignore them!

2007-11-08 Thread Guy Harris
[EMAIL PROTECTED] wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=23401 User: morriss Date: 2007/11/08 07:13 PM Log: Don't cast pinfo-src.data to (const mtp3_addr_pc_t *) unless we *know* it's an MTP3 PC in there (else we get a bus error on SPARC systems). Yup,

Re: [Wireshark-dev] why there is no frame check sequence field in ethernet frame

2007-11-08 Thread Jeff Morriss
zhou rui wrote: hi all seems it is very confused that there is no frame check sequencefield in the ethernet frame captured by wireshark,while the other sniffer has that Because most hardware (NICs) don't provide the checksum to the capturing engine. Specialized (sniffer) hardware

Re: [Wireshark-dev] my added dissectors don't appear in the Makefile

2007-11-08 Thread Jeff Morriss
Fulko Hew wrote: Im just wrapping up development on my enhancements and new dissectors for wireshark, and while preparing my patch set, I'm testing it by applying it to a virgin tarball. The developer instructions say I just had to add my src files to epan/dissectors/Makefile.common,

Re: [Wireshark-dev] Small performance improvements to packet-http.c

2007-11-08 Thread Kaul
I've fixed ep_strndup - se_stnrdup, patch attached. From subjective testings, it seems that there is some measurable performance improvement - 5-10 percent on my test pcap file (~ you are not just avoiding a strncmp(), but also the char-by-char search for the space that follows the method (as well

Re: [Wireshark-dev] Small performance improvements to packet-http.c

2007-11-08 Thread Kaul
This time, with the patch attached. On Nov 8, 2007 9:56 PM, Kaul [EMAIL PROTECTED] wrote: I've fixed ep_strndup - se_stnrdup, patch attached. From subjective testings, it seems that there is some measurable performance improvement - 5-10 percent on my test pcap file (~ you are not just

Re: [Wireshark-dev] Alignment warnings - don't ignore them!

2007-11-08 Thread Jeff Morriss
Guy Harris wrote: [EMAIL PROTECTED] wrote: http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=revrevision=23401 User: morriss Date: 2007/11/08 07:13 PM Log: Don't cast pinfo-src.data to (const mtp3_addr_pc_t *) unless we *know* it's an MTP3 PC in there (else we get a bus error on

Re: [Wireshark-dev] [Wireshark-commits] rev 23395: /trunk/ /trunk/epan/: prefs.c prefs.h /trunk/gtk/: layout_prefs.c toolbar.c

2007-11-08 Thread Stephen Fisher
On Thu, Nov 08, 2007 at 05:30:40AM +0100, Ulf Lamping wrote: The problem with such preferences is: there will be too much of them. Having lot's of preferences makes it hard to get an idea what they are all about. So, I'd vote to simply remove this preference, Thanks.. I removed the

Re: [Wireshark-dev] Network Sorcery and protocol documentation

2007-11-08 Thread Stephen Fisher
On Tue, Nov 06, 2007 at 11:47:04PM -0500, Maynard, Chris wrote: I was reminded of a very handy web site for protocol documentation that I reference quite often, namely http://www.networksorcery.com/enp/Protocol.htm. Anyway, I personally think the format is somewhat superior to the current

Re: [Wireshark-dev] Network Sorcery and protocol documentation

2007-11-08 Thread Joerg Mayer
On Thu, Nov 08, 2007 at 08:57:19PM -0700, Stephen Fisher wrote: that I reference quite often, namely http://www.networksorcery.com/enp/Protocol.htm. The network sorcery pages are a wonderful reference. Our protocol pages should be geared more toward how the protocol is dissected in

[Wireshark-dev] PortableApps Wireshark feedback

2007-11-08 Thread Maynard, Chris
FYI: I was finally able to build test a PortableApps version of Wireshark. The SVN version I used was 23398. Initially when I built it and tried to run it off a USB flash drive, it failed due to some unspecified error. I had tried to save some time by not running a distclean first, but in