[Wireshark-dev] passing custom http header info to heuristic http sub-dissector.

2007-06-18 Thread Ravi Kondamuru
Hi, Is there an existing approach to pass http header info to a http sub-dissector? thanks, Ravi. ___ Wireshark-dev mailing list Wireshark-dev@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-dev

Re: [Wireshark-dev] [Wireshark-commits] rev 22127: /trunk/ /trunk/: configure.in

2007-06-18 Thread Stephen Fisher
Could you do some more testing for this change? It seems to have stopped the inclusion of IPSec ESP support in my Wireshark builds using the same options that included it before. On Mon, Jun 18, 2007 at 03:03:56AM +, [EMAIL PROTECTED] wrote: > http://anonsvn.wireshark.org/viewvc/viewvc.cgi?

Re: [Wireshark-dev] dissector handoff question

2007-06-18 Thread Stephen Fisher
On Mon, Jun 18, 2007 at 04:06:04PM -0700, Yashwant Shitoot wrote: > In my proto_reg_handoff_ntpmgcp(...); when I call > > dissector_add("udp.data", currentPort, ntpmgcp_handle); > > What I am trying to get is reveive all "data" for all udp packets > captured by the filter. This is the only prot

[Wireshark-dev] dissector handoff question

2007-06-18 Thread Yashwant Shitoot
Hello, In my proto_reg_handoff_ntpmgcp(...); when I call dissector_add("udp.data", currentPort, ntpmgcp_handle); What I am trying to get is reveive all "data" for all udp packets captured by the filter. This is the only protocol used to communicate with some ip addresses using udp. Thanks Y

Re: [Wireshark-dev] gzwrite compile error

2007-06-18 Thread Guy Harris
On Jun 18, 2007, at 3:26 PM, Jeff Morriss wrote: > What am I missing here? Compiler bug? I've seen a case where MSVC++ 6 was confused about qualifiers; perhaps GCC is getting confused here, e.g. by the (presumed) typedef "voidp"? What version of GCC is this? ___

[Wireshark-dev] gzwrite compile error

2007-06-18 Thread Jeff Morriss
Hi folks, Trying to compile Wireshark (SVN) on my Solaris 9 system is giving me this error: > gcc -DHAVE_CONFIG_H -I. -I. -I. -I/usr/local/include -I/usr/local/include > -Werror "-D_U_=__attribute__((unused))" -g -O2 -Wall -W > -Wdeclaration-after-statement -Wendif-labels -Wpointer-arith > -

Re: [Wireshark-dev] Wireshark-dev] patch for new encapsulation protocol FCoE FibreChannel over Ethernet

2007-06-18 Thread Joe Eykholt
Thanks very much, Steven! It's very nice to have it in there! Wireshark rocks. Joe Message: 7 Date: Mon, 18 Jun 2007 12:33:43 -0700 From: Stephen Fisher <[EMAIL PROTECTED]> Subject: Re: [Wireshark-dev] patch for new encapsulation protocol FCoE - FibreChannel over Ether

Re: [Wireshark-dev] wireshark-0.99.5 Segmentation fault on displaying packets

2007-06-18 Thread yin sun
Yes I did, it traces back to libpcap_open invalid address then I use ldd /local/scratch/usr/local/bin/wireshark (where my wireshark is installed), it turns out libwiretap.so.0 => /usr/lib/libwiretap.so.0 (0xb7f46000) this is wrong, as I use ./configure --prefix=/local/scratch/usr/local, the libwir

Re: [Wireshark-dev] wireshark-0.99.5 Segmentation fault on displaying packets

2007-06-18 Thread Jaap Keuter
Hi, Can you run Wireshark in DDD so you can get a backtrace? See http://wiki.wireshark.org/Development/Tips Thanx, Jaap yin sun wrote: > Hello, > > I have compiled wireshark from 0.99.5 source on Suse10 Linux > 2.6.16.27-0.9-smp x86. Initial launch is ok, change/save preference is > ok, but f

Re: [Wireshark-dev] gsmmap asn1 directory

2007-06-18 Thread Anders Broman
Hi, I Believe I fixed all exept: >- and one with a Facility with Forward CUG info. For this problem, this >is only a display problem, as the information is correctly decoded, but >a Warning is displayed at the end of the decoding. I see no warning :( Regards Anders -Ursprungligt meddeland

Re: [Wireshark-dev] Error: wireshark.exe is not a valied Win32application

2007-06-18 Thread yin sun
make sure you don't have the problem discribed below in win2k section, http://wiki.wireshark.org/BuildingAndInstalling /Yin On 6/15/07, Alex Lindberg <[EMAIL PROTECTED]> wrote: I have tried both the current GA release 0.99.5 tarball and the "trunk" svn release called 0.99.6 in config.nmake.

[Wireshark-dev] wireshark-0.99.5 Segmentation fault on displaying packets

2007-06-18 Thread yin sun
Hello, I have compiled wireshark from 0.99.5 source on Suse10 Linux 2.6.16.27-0.9-smp x86. Initial launch is ok, change/save preference is ok, but failed at displaying packet with Segmentation fault. When I tried the same pcap file with tshark, it is OK. So it must be some gui related problem. Ca

Re: [Wireshark-dev] patch for new encapsulation protocol FCoE - FibreChannel over Ethernet

2007-06-18 Thread Stephen Fisher
On Tue, May 29, 2007 at 09:58:41AM -0700, Joe Eykholt wrote: > Here's an additional patch that gets rid of the preference for > ethertype. I'll put add a description and sample capture to the wiki > today. Thanks for your additional patch to remove the preference. I've committed the patch as

Re: [Wireshark-dev] Armagetronad dissector update

2007-06-18 Thread Stephen Fisher
On Tue, May 22, 2007 at 06:59:30PM +0200, Guillaume Chazarain wrote: > Please find attached a patch to fix some bugs in the armagetronad > dissector. More specifically: > > * Update the descriptors to armagetronad-0.2.8.2.1, the file > src/network/Makefile.in does not exist anymore in the armage

Re: [Wireshark-dev] [PATCH] MySQL cosmetic change

2007-06-18 Thread Stephen Fisher
On Sun, Jun 10, 2007 at 07:23:38PM +0100, Martin Warnes wrote: > Attached is a small patch that adds a preference option to allow the > SQL Query string to be appended to the INFO column display. This makes > life a little bit easier when scanning a trace to find the packet > associated with a

Re: [Wireshark-dev] [PATCH] MySQL decode OK-Packet improvement

2007-06-18 Thread Stephen Fisher
On Sun, Jun 10, 2007 at 07:16:29PM +0100, Martin Warnes wrote: > Currently the MySQL dissector assumes that an OK-Packet Response > contains the Server_Status field. Having checked the MySQL protocol > page I can't say conclusively whether it should or it shouldn't, > however I've come across a

Re: [Wireshark-dev] X.25, LAPB, PLP Decoding

2007-06-18 Thread Jaap Keuter
Hi Mirko, Please refer to http://wiki.wireshark.org/Development/LibpcapFileFormat about this subject. Thanx, Jaap [EMAIL PROTECTED] wrote: > Hi, > > I’ve been making Protocol Analyzer based on Sangoma S5142A synch serial > card and WireShark. Capturing of X.25 LAPB and PLP layers is done by

Re: [Wireshark-dev] edonkey

2007-06-18 Thread Jaap Keuter
Hi, Committed in revision 22128 after a few changes: - replaced C++ with C comments - replaced "%llu" format string by "%" G_GINT64_MODIFIER "u" Thanx, Jaap Łukasz M. wrote: > Hi. > > I'm new here, so hello everyone. :) > > I added 5 new packets to packet-edonkey.c and improve 2. Diffs in > at

Re: [Wireshark-dev] X.25, LAPB, PLP Decoding

2007-06-18 Thread Guy Harris
[EMAIL PROTECTED] wrote: > I think that I should define proprietary “DLT_LAPB” value and do > whatever necessary steps in wtap (WireShark) in order to recognize my > DLT_LAPB type form libpcap file header. After that I should be able to > see LAPB frames and PLP packets in the WireShark. Nobod

[Wireshark-dev] edonkey

2007-06-18 Thread M.
Hi. I'm new here, so hello everyone. :) I added 5 new packets to packet-edonkey.c and improve 2. Diffs in attachment. This part of wireshark (decoding emule packets) it's not finish as I see :) I try to do it, meybe... :) best regards. lukasz. packet-edonkey.c.patch.gz Description: GNU Zip com

[Wireshark-dev] X.25, LAPB, PLP Decoding

2007-06-18 Thread Mirko.Karanovic
Hi, I've been making Protocol Analyzer based on Sangoma S5142A synch serial card and WireShark. Capturing of X.25 LAPB and PLP layers is done by Sangoma card/driver. Storing into file is done by socket based code. File format is libpcap file format. I've seen that WireShark ( wtap) has decod

[Wireshark-dev] Voip Calls with 16.000 Hz

2007-06-18 Thread g . reismueller
Hi there, I wonder if it is possible to decode 16 kHz Voip RTP Streams (Payload Type PCMA (120)) with wireshark. With the RTP Player in wireshark I had no success. Regards, Guido___ Wireshark-dev mailing list Wireshark-dev@wireshark.org http://www.wire

Re: [Wireshark-dev] gsmmap asn1 directory

2007-06-18 Thread Florent Drouin
Hi Anders, Thank you for your correction. It is working now with the new syntax. I did launch some tests, and found new problems. For the Cancel Location message, you can replace the old_CancelLocationArgV2 by the Identity message. So the old syntax for Cancel Location is not used anymore.

Re: [Wireshark-dev] [PATCH] MySQL cosmetic change

2007-06-18 Thread Martin Warnes
Stephen Fisher wrote the following on 06/18/2007 03:28 AM: On Sun, Jun 10, 2007 at 07:23:38PM +0100, Martin Warnes wrote: Attached is a small patch that adds a preference option to allow the SQL Query string to be appended to the INFO column display. This makes life a little bit easier when sc