[Wireshark-dev] Is there reassembly for the IP fragments?

2007-11-30 Thread prashanth joshi
Hi all, In ethereal, in case of TCP segments we need to implement TCP reassembly issue. I am curious to know whether there is reassembly of the IP datagram at the IP layer. Because an IP datagram may be fragmented in to several fragments and we need to sniff the application level payload on the w

Re: [Wireshark-dev] [Wireshark-commits] rev 23689: /trunk/gtk/ /trunk/gtk/: graph_analysis.c

2007-11-30 Thread Sake Blok
On Sat, Dec 01, 2007 at 12:31:36AM +0100, Stig Bj?rlykke wrote: > On 30. nov.. 2007, at 19.55, [EMAIL PROTECTED] wrote: > > > Log: > > Give the flow graph window the correct title. > > Have a look at r23089 where this title was added. Maybe the title > (VoIP or Flow) should be an input paramet

Re: [Wireshark-dev] [Wireshark-commits] rev 23689: /trunk/gtk/ /trunk/gtk/: graph_analysis.c

2007-11-30 Thread Stig Bjørlykke
On 30. nov.. 2007, at 19.55, [EMAIL PROTECTED] wrote: > Log: > Give the flow graph window the correct title. Hi, Have a look at r23089 where this title was added. Maybe the title (VoIP or Flow) should be an input parameter somewhere? Or is it correct with Flow in both cases? http://anons

Re: [Wireshark-dev] [Wireshark-commits] rev 23560: /trunk/ /trunk/doc/: wireshark.pod /trunk/epan/: prefs.c prefs.h /trunk/gtk/: color_dlg.c compat_macros.h main.c main.h menu.c toolbar.c /trunk/help/

2007-11-30 Thread Ulf Lamping
Sake Blok schrieb: > Hmmm... I'm not sure "Reset Color 1-10" is accurate, as the colors are > not reset, it's the filters used for the colors that are being reset. Then maybe "Reset Coloring 1-10"? >> And maybe put a separator between this entry and the Coloring Rules - >> this is really somethi

Re: [Wireshark-dev] [Wireshark-commits] rev 23691: /trunk/ /trunk/: Makefile.nmake capture-pcap-util.c capture-wpcap.c capture_ui_utils.c config.h.win32 config.nmake version_info.c /trunk/wiretap/: li

2007-11-30 Thread Ulf Lamping
Guy Harris schrieb: > should be including ; is the problem that including > from before other includes is causing problems with > MSVC 2008 I've done these changes some days ago, so I can't remember what the actual problem was. One of the changes was only to add a stdio.h include in one file

Re: [Wireshark-dev] [Wireshark-commits] rev 23560: /trunk/ /trunk/doc/: wireshark.pod /trunk/epan/: prefs.c prefs.h /trunk/gtk/: color_dlg.c compat_macros.h main.c main.h menu.c toolbar.c /trunk/help/

2007-11-30 Thread Sake Blok
On Fri, Nov 30, 2007 at 10:53:52PM +0100, Ulf Lamping wrote: > Sake Blok schrieb: > >>> Maybe "Reset coloring filters 1-10" or "Reset temporary coloring"? > > Maybe simply "Reset Color 1-10"? This makes a relation in terminology of > the menu entries used when the filter was set. I don't think th

Re: [Wireshark-dev] [Wireshark-commits] rev 23691: /trunk/ /trunk/: Makefile.nmake capture-pcap-util.c capture-wpcap.c capture_ui_utils.c config.h.win32 config.nmake version_info.c /trunk/wiretap/: li

2007-11-30 Thread Guy Harris
[EMAIL PROTECTED] wrote: > http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=23691 > > User: ulfl > Date: 2007/11/30 10:01 PM > > Log: > first steps to support MSVC 2008 Express Edition > > Directory: /trunk/ > ChangesPath Action > +3 -0 Makefile.nm

Re: [Wireshark-dev] VS2008 Express compilation attempt

2007-11-30 Thread Ulf Lamping
Kaul schrieb: > The attached change to libpcap.c (re-order the #include statements) > seems to solve it. > There are other places it is required (capture-wpcap.c, for example), > and this simple change didn't work as nicely. I've checked in some changes, so MSVC 2008 EE now at least compiles Wir

Re: [Wireshark-dev] [Wireshark-commits] rev 23560: /trunk/ /trunk/doc/: wireshark.pod /trunk/epan/: prefs.c prefs.h /trunk/gtk/: color_dlg.c compat_macros.h main.c main.h menu.c toolbar.c /trunk/help/

2007-11-30 Thread Ulf Lamping
Sake Blok schrieb: > For example, right-click the icmp dentifier in the packet-details pane > and find out that you can easily colorize one ping session amongst > others ;-) > Ah, got it! >>> Maybe "Reset coloring filters 1-10" or "Reset temporary coloring"? >>> Maybe simply "Reset Color

Re: [Wireshark-dev] [Wireshark-commits] rev 23560: /trunk/ /trunk/doc/: wireshark.pod /trunk/epan/: prefs.c prefs.h /trunk/gtk/: color_dlg.c compat_macros.h main.c main.h menu.c toolbar.c /trunk/help/

2007-11-30 Thread Sake Blok
On Fri, Nov 30, 2007 at 09:45:10PM +0100, Ulf Lamping wrote: > Sake Blok schrieb: > > Yes it is, it makes sense to me to be able to clear previously used > > temporary coloring after closing a file and before loading a new one. > > > > Of course I could make "File - Close" clear these coloring rule

Re: [Wireshark-dev] Wireshark 0.99.7pre2 is now available

2007-11-30 Thread Maynard, Chris
Personally, I really like the way autoscroll works now. But Ulf makes a good suggestion in that it may also be nice to stop the autoscroll if you click on a packet of interest. Then resume the same way as now. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behal

Re: [Wireshark-dev] [Wireshark-commits] rev 23560: /trunk/ /trunk/doc/: wireshark.pod /trunk/epan/: prefs.c prefs.h /trunk/gtk/: color_dlg.c compat_macros.h main.c main.h menu.c toolbar.c /trunk/help/

2007-11-30 Thread Ulf Lamping
Sake Blok schrieb: > Yes it is, it makes sense to me to be able to clear previously used > temporary coloring after closing a file and before loading a new one. > > Of course I could make "File - Close" clear these coloring rules, but > then again, maybe someone likes to keep them for the next file

Re: [Wireshark-dev] Wireshark 0.99.7pre2 is now available

2007-11-30 Thread Gerald Combs
Ulf Lamping wrote: > Jim Young schrieb: >> I think autoscroll behavior was changed (augmented?). >> >> My observation is that auto-scrolling now stops if you scroll UP in the >> packet summary pane. You can restore auto-scrolling by simply scrolling >> to the bottom-most (i.e. most recent) item

Re: [Wireshark-dev] RPC RQUOTA protocol

2007-11-30 Thread ronnie sahlberg
As jaap said, the interface description for ONC-RPC services can often be found in /usr/include/rpcsvc Here is a link to an interface description that defines both version 1 and version2 of rquota http://ninna.tom.sfc.keio.ac.jp/sa/sources/quota-tools/rquota.x It should be fairly straightforward

Re: [Wireshark-dev] [Wireshark-commits] rev 23560: /trunk/ /trunk/doc/: wireshark.pod /trunk/epan/: prefs.c prefs.h /trunk/gtk/: color_dlg.c compat_macros.h main.c main.h menu.c toolbar.c /trunk/help/

2007-11-30 Thread Sake Blok
On Fri, Nov 30, 2007 at 02:38:07AM +0100, Ulf Lamping wrote: > Sake Blok schrieb: > >> There are some other usability things that really needs to be solved: > >> > >> - if no capture file is loaded, both "View/Colorize Conversation" and > >> "View/Reset Coloring" are active and can be clicked - bu

Re: [Wireshark-dev] How to playback the AMR in RTP packet

2007-11-30 Thread Luis EG Ontanon
You are right. But in the case of AMR which is a codec to be used on not-very-reliable channels there's more than just the jitter/packet-loss every packet transporting AMR encoded audio (almost always) carries three different streams a high-quality/high-bandwidth (12.2 kbps) one, a medium one (7.40

Re: [Wireshark-dev] How to playback the AMR in RTP packet

2007-11-30 Thread Jaap Keuter
Hi, Isn't this a problem for every audio stream. The RTP player has a configurable jitter buffer, but the actual endpoint usually has a dynamic one. Also packet loss concealment can improve the perception at the endpoint considerably. So the RTP player is nice, but isn't really relevant for the

Re: [Wireshark-dev] Statistics->Summary enhancements

2007-11-30 Thread Ulf Lamping
Stig Bjørlykke schrieb: > But if I don't have any display filter the column for displayed > packages is empty, which is a bit odd I think, because I do have > displayed packages. Should this column have the same values as the > captured column, as this values are equal, instead of just be empty? >

Re: [Wireshark-dev] autogen.sh and svn

2007-11-30 Thread Gerald Combs
Adam Sulmicki wrote: > Also, I prefer to read the list on the web site, rather than clutter > my mailbox, but lately I'm getting this error: > > HTTP is just about the most godawful worst possible way to mirror this site > > I might have hit refersh a little bit often, but nothing like wget! > An

[Wireshark-dev] autogen.sh and svn

2007-11-30 Thread Adam Sulmicki
Hello, Perhaps the INSTALL file should be updated to say that you should use autogen.sh rather than to suggest to invoke autoconf and automake manually. It would be less confusing this way. Also, I prefer to read the list on the web site, rather than clutter my mailbox, but lately I'm getting thi

Re: [Wireshark-dev] Decoding raw SCCP packets using Wireshark

2007-11-30 Thread James Lee
That's exactly what I was looking for, and does the trick. Thanks! On 30/11/2007, Luis EG Ontanon <[EMAIL PROTECTED]> wrote: > > You could use a user dlt and assign sccp to it. > > See http://wiki.wireshark.org/HowToDissectAnything > > > On Nov 30, 2007 1:50 AM, James Lee <[EMAIL PROTECTED]> wrot

Re: [Wireshark-dev] How to playback the AMR in RTP packet

2007-11-30 Thread Luis EG Ontanon
Just note: Most AMR codec/decoders take all three streams and choose the best one they can use but what you would hear as a middleman might not be what someone in the other side of a radio link is hearing. That is if we feed a codec in the middle we probably feed them good frames and it will use th

Re: [Wireshark-dev] How to playback the AMR in RTP packet

2007-11-30 Thread Anders Broman
Hi, AMR is a licensed codec so it can't be provided with Wireshark but a plugin interface exists to add your own codecs you'll have to do it yourself though. See also some other recent posts with AMR in the subject line. Regards Anders From: [EMAIL PROTECTED] [mai

Re: [Wireshark-dev] Filtering using DHCP and SSDP throws error

2007-11-30 Thread Stig Bjørlykke
2007/11/29, Didier <[EMAIL PROTECTED]>: > The filter value somewhere in the Protocol hierarchy stat would be nice too. You should try svn r23686 or later :) -- Stig Bjørlykke ___ Wireshark-dev mailing list Wireshark-dev@wireshark.org http://www.wiresha

[Wireshark-dev] How to playback the AMR in RTP packet

2007-11-30 Thread Sanghee Lee
Hi, I know "VOIP calls" in Wireshark for playing the RTP packet. But, the VOIP calls only can play the G.711. I'd like to play the AMR payload. Thanks in advance, Leo ___ Wireshark-dev mailing list Wireshark-dev@wireshark.org http://www.wireshark

Re: [Wireshark-dev] Statistics->Summary enhancements

2007-11-30 Thread Stig Bjørlykke
2007/11/30, Ulf Lamping <[EMAIL PROTECTED]>: > Hiding stuff on the GUI is generally a bad idea, because if the users > seen this dialog before, he won't expect new stuff in the dialog > depending on the packets selected. You are right. I will revert to the old behaviour. But if I don't have any

Re: [Wireshark-dev] How to playback the AMR in RTP packet

2007-11-30 Thread Kukosa, Tomas
I would put example plugins and plugin stubs (without licenced code) for licensed codecs/library into the svn plugin directory. (in the similar way how the OPAL and H323plus projects have it done) What dou you think? Tomas From: [EMAIL PROTECTED] [m

Re: [Wireshark-dev] Wireshark 0.99.7pre2 is now available

2007-11-30 Thread Ulf Lamping
Jim Young schrieb: > I think autoscroll behavior was changed (augmented?). > > My observation is that auto-scrolling now stops if you scroll UP in the > packet summary pane. You can restore auto-scrolling by simply scrolling > to the bottom-most (i.e. most recent) item of the summary pane. > > Y