Re: [Wireshark-dev] Is there a good way of handling "per pdu" info ?

2007-11-12 Thread Stephen Fisher
On Mon, Nov 12, 2007 at 06:05:38PM -, Neil Piercy wrote: > I know there is per-packet info, but is there a way of > adding/retrieving per PDU info which copes with multiple PDUs in a > packet ? How does a dissector even know if it is handfling the first, > second etc PDU in a packet ? This ha

Re: [Wireshark-dev] PortableApps Wireshark feedback

2007-11-12 Thread Ulf Lamping
Maynard, Chris schrieb: > UPX indicates "very fast decompression", but there's bound to be some time > penalty vs. not compressing the executable. Nevertheless, it seems worth > doing to me as well - at least trying it out to compare the difference in > installation time, space, etc. And if th

[Wireshark-dev] Donating to support development?

2007-11-12 Thread John Morrissey
[Sorry if this is the wrong list for this; I was torn between -users and -dev.] The WebSphere MQ dissector really saved my bacon a few weeks ago - thank you to whomever implemented it! A fair bit of my spare time is consumed by other Open Source projects, so I don't have much time to donate. Ins

Re: [Wireshark-dev] Register dissector to MAC address

2007-11-12 Thread Maynard, Chris
At first glance, packet-eth.c seems to have heuristic support, but it doesn't appear to work, at least not how I expected it to. For example, originally for the WOL dissector, I registered as I do for UDP, namely: heur_dissector_add("eth", dissect_wol, proto_wol); But registering it that w

Re: [Wireshark-dev] startup error with my dissector

2007-11-12 Thread Pascal Heude
I got the same problem after having built my own dissector. I had to build my own executable file of wireshark (version 0.99.7 not yet frozen), and then copy the disector dll in the plugin subdirectory. For that I followed this great article : http://www.codeproject.com/useritems/custom_dissect

Re: [Wireshark-dev] Register dissector to MAC address

2007-11-12 Thread Stephen Fisher
On Mon, Nov 12, 2007 at 12:37:10PM -0500, Maynard, Chris wrote: > Can anyone think of a reason NOT to add heuristic dissection support > to packet-eth.c? Or does anyone have a better/alternate way to solve > this? My first thought is that the original poster's dissector could be a heuristic that

[Wireshark-dev] Is there a good way of handling "per pdu" info ?

2007-11-12 Thread Neil Piercy
And another "Is there question"... I know there is per-packet info, but is there a way of adding/retrieving per PDU info which copes with multiple PDUs in a packet ? How does a dissector even know if it is handfling the first, second etc PDU in a packet ? Neil

[Wireshark-dev] Is there a good way of handling bitfields with different bitmask offsets ?

2007-11-12 Thread Neil Piercy
If the protocol has bitfields they can be defined in the hf structs, but what is the best way to cope if these fields can be at different bit offsets within the byte ? E.g. a 4 bit field which can occur as the lower 4 bits or the upper 4 bits of a byte. The more I think about it, the general way w

Re: [Wireshark-dev] startup error with my dissector

2007-11-12 Thread Andy Lawman
Amit, A general way to get more information about what's wrong is to start tshark up from a comand line. When doing this (on Windows) the same error message as with Wireshark appears on the console, but a more detailed one appears in a pop-up window. In this case I think it will name the module

[Wireshark-dev] SQL-interface

2007-11-12 Thread sfayssal
Hello: I am still working on the SQL interface. If I am currently saving the data in csv format in several file and creating a ring. I am having a scheduling problem, can anybody help me in better idea to push the data to SQL without destortion? Thanks for any help, Sam

Re: [Wireshark-dev] Register dissector to MAC address

2007-11-12 Thread Maynard, Chris
As far as I know, it's not possible to do currently. I ran into a similar problem with the recently added "Wake On LAN" dissector. WOL isn't specific to any Ethertype, but since ether-wake uses Ethertype 0x0842, I registered that. What I think is really needed, in both cases, is to be able

[Wireshark-dev] Register dissector to MAC address

2007-11-12 Thread HPfrommer
Hi, I have an application where I receive specially formed frames from a specific unique MAC address. Is it possible to register my dissector to a MAC address? All I was able to do was registering a dissector to an ethertype like follows: dissector_add("ethertype", 0x88ff, test_dissector

Re: [Wireshark-dev] Wireshark Bug 1964 Status

2007-11-12 Thread Anders Broman
Hi, The patch is outdated and needs to be reworked - MGCP is now built in, not a plugin. If possible I think the abillity to decode "ASCII TPKT" should be added to packet-tpkt.c not As a separate dissector. Regards Anders -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTE

Re: [Wireshark-dev] The COPYING file (our license) is a mess!

2007-11-12 Thread Joerg Mayer
One of the core reasons why the explanations were added was a rather regular stream of questions regarding the use of Wireshark. It started with me adding a section that emphasizes that libwireshark is covered by the GPL, not LGPL. Later on other stuff was added and I think that the amount of quest

[Wireshark-dev] startup error with my dissector

2007-11-12 Thread Amit Khullar
Hi, After I copy a privately built dissector (dll) in the plugin directory of the wireshark, I get following error on wireshark.exe startup: Couldn't load module C:\Program Files\Wireshark\plugins\0.99.6\ppci.dll: The specified module could not be found. Here ppci is my own dissector b

[Wireshark-dev] Wireshark Bug 1964 Status

2007-11-12 Thread Harmeet Sawhney
Hi, I had created a bug (ID: 1964) to support MGCP over TCP with ASCII TPKT header. I had also proposed a patch for the bug for release 0.99.7, but I have not recevied any feedback on the patch. Please let me know if the patch is going to be incorporated in future releases of wireshark. Regards,

Re: [Wireshark-dev] The COPYING file (our license) is a mess!

2007-11-12 Thread Sébastien Tandel
On Nov 11, 2007 7:59 PM, Stephen Fisher <[EMAIL PROTECTED]> wrote: > On Sun, Nov 11, 2007 at 10:25:18PM +0100, Ulf Lamping wrote: > > > While i was updating the NSIS installer, I had a look at the current > > COPYING file and was pretty sad reading the following preamble to the > > GPL: > > > Unfor