Re: [Wireshark-dev] Is this a bug in display filter engine or something I have done wrong?

2015-08-18 Thread Gilbert Ramirez
Hi Richard. You can use the 'dftest' executable that is built along with Wireshark to convert a display filter string to the byte-code used for the Display Filter Virtual Machine. Do that for for wlan.dmg_params.bss == 1 and compare that to the output for a similar display filter for another

Re: [Wireshark-dev] Is this a bug in display filter engine or something I have done wrong?

2015-08-18 Thread Alexis La Goutte
On Tue, Aug 18, 2015 at 3:51 AM, Richard Sharpe realrichardsha...@gmail.com wrote: Hi folks, I have the following definition (someone else wrote this piece): {hf_ieee80211_ff_dmg_params_bss, {BSS Type, wlan.dmg_params.bss, FT_UINT8, BASE_DEC, VALS(bss_type), 0x03,

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-18 Thread Guy Harris
On Aug 18, 2015, at 9:22 AM, Jim Young jyo...@gsu.edu wrote: Instead of supplying an ethernet header with the mac addresses of all zeros, would it make more sense to supply a NULL/Loopback encapsulation type to packets captured in the Npcap LoopBack Interface? It looks as if the loopback

Re: [Wireshark-dev] Is this a bug in display filter engine or something I have done wrong?

2015-08-18 Thread Richard Sharpe
On Tue, Aug 18, 2015 at 9:04 PM, Richard Sharpe realrichardsha...@gmail.com wrote: On Tue, Aug 18, 2015 at 7:47 PM, Richard Sharpe realrichardsha...@gmail.com wrote: On Tue, Aug 18, 2015 at 5:18 AM, Gilbert Ramirez g...@alumni.rice.edu wrote: Hi Richard. You can use the 'dftest' executable

Re: [Wireshark-dev] Is this a bug in display filter engine or something I have done wrong?

2015-08-18 Thread Richard Sharpe
On Tue, Aug 18, 2015 at 5:18 AM, Gilbert Ramirez g...@alumni.rice.edu wrote: Hi Richard. You can use the 'dftest' executable that is built along with Wireshark to convert a display filter string to the byte-code used for the Display Filter Virtual Machine. Do that for for wlan.dmg_params.bss

Re: [Wireshark-dev] Is this a bug in display filter engine or something I have done wrong?

2015-08-18 Thread Richard Sharpe
On Tue, Aug 18, 2015 at 7:47 PM, Richard Sharpe realrichardsha...@gmail.com wrote: On Tue, Aug 18, 2015 at 5:18 AM, Gilbert Ramirez g...@alumni.rice.edu wrote: Hi Richard. You can use the 'dftest' executable that is built along with Wireshark to convert a display filter string to the

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-18 Thread Yang Luo
Hi Jim, Current fake Ethernet encapsulation of Npcap refers to the Linux implementation (actually is Ubuntu, as I am only familiar with it for a Linux system). I don't own a OS X computer now so I can't test or use it. One question is is NULL/Loopback encapsulation a widespread protocol standard

Re: [Wireshark-dev] RFC: Internally Generated Records

2015-08-18 Thread Roland Knall
Hi Evan Did this approach got implemented? If not, I would like to give it a try. regards, Roland On Tue, Aug 5, 2014 at 12:14 AM, Roland Knall rkn...@gmail.com wrote: Yes, that it what I was saying. Cool, you can look forward to the openSAFETY patch, the minute the change hit the official

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-18 Thread Yang Luo
Hi Pascal, I have analyzed your log and it shows that WSK_CLIENT_DISPATCH::WskSocket function fails with STATUS_ACCESS_DENIED. The result turns out to be a bug: If you launch Wireshark with no Admin right, the WSK code fails to init, so Npcap loopback adapter can't be opened. I think you

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-18 Thread Yang Luo
Hi Jim, The log points to the same issue with Pascal, and please try the latest installer at: https://svn.nmap.org/nmap-exp/yang/NPcap-LWF/npcap-nmap-0.04-r3.exe Cheers, Yang On Tue, Aug 18, 2015 at 1:45 PM, Jim Young jyo...@gsu.edu wrote: SECURITY WARNING: You are receiving a message with an

Re: [Wireshark-dev] RFC: Internally Generated Records

2015-08-18 Thread Michal Labedzki
Hello, I tried to do that, but failed on Qt packet list logic... Idea: add children to packets on packet list. https://code.wireshark.org/review/#/c/10107/1 Please feel free to use it. (let treat is as Public Domain) On 18 August 2015 at 17:04, Roland Knall rkn...@gmail.com wrote: Good, have

Re: [Wireshark-dev] RFC: Internally Generated Records

2015-08-18 Thread Evan Huus
On Tue, Aug 18, 2015 at 10:49 AM, Roland Knall rkn...@gmail.com wrote: Hi Evan Did this approach got implemented? If not, I would like to give it a try. As far as I know nobody is working on it. Feel free to give it a try. Evan regards, Roland On Tue, Aug 5, 2014 at 12:14 AM, Roland

Re: [Wireshark-dev] RFC: Internally Generated Records

2015-08-18 Thread Roland Knall
Good, have some vacation days coming up and will give it a try. regards, Roland On Tue, Aug 18, 2015 at 4:53 PM, Evan Huus eapa...@gmail.com wrote: On Tue, Aug 18, 2015 at 10:49 AM, Roland Knall rkn...@gmail.com wrote: Hi Evan Did this approach got implemented? If not, I would like to

Re: [Wireshark-dev] Is this a bug in display filter engine or something I have done wrong?

2015-08-18 Thread Richard Sharpe
On Tue, Aug 18, 2015 at 6:00 AM, Alexis La Goutte alexis.lagou...@gmail.com wrote: On Tue, Aug 18, 2015 at 3:51 AM, Richard Sharpe realrichardsha...@gmail.com wrote: Hi folks, I have the following definition (someone else wrote this piece): {hf_ieee80211_ff_dmg_params_bss, {BSS

[Wireshark-dev] NEW_PROTO_TREE_API status

2015-08-18 Thread Alexis La Goutte
Hi, What the status of this change ? Because no change from 2 years about this... Revert the code and feature ? or for 2.2 after cleanup proto_tree_add_text ? ;-) Cheers, ___ Sent via:Wireshark-dev mailing list

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-18 Thread Jim Young
Hello Yang, With Npcap 0.04-r3 the Npcap Loopback Adapter is again visible and usable as a sniffable interface to Wireshark. [] I hope to do more extensive testing later today or tomorrow (especially regarding throughput and packet drops). I have a question regarding the encapsulation

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-18 Thread Pascal Quantin
Le 18 août 2015 5:04 PM, Yang Luo hslu...@gmail.com a écrit : Hi Pascal, I have analyzed your log and it shows that WSK_CLIENT_DISPATCH::WskSocket function fails with STATUS_ACCESS_DENIED. The result turns out to be a bug: If you launch Wireshark with no Admin right, the WSK code fails to