Re: [Wireshark-dev] ip.addr != 10.0.0.1 (Guy Harris)

2008-01-29 Thread Kenichi Okuyama
Hi, 2008/1/30, Sake Blok <[EMAIL PROTECTED]>: > I think the idea of a pop-up explaining the way the operator > "!=" works on fields with multiple occurences in one packet is > a good way to educate people. But only if there is an option > to "Don't show me this message again" :-) I'll vote on thi

Re: [Wireshark-dev] ip.addr != 10.0.0.1 (Guy Harris)

2008-01-29 Thread Gerald Combs
Sake Blok wrote: I think the idea of a pop-up explaining the way the operator "!=" works on fields with multiple occurences in one packet is a good way to educate people. But only if there is an option to "Don't show me this message again" :-) The attached patch warns the user about "!=" and "

Re: [Wireshark-dev] ip.addr != 10.0.0.1 (Guy Harris)

2008-01-29 Thread Sake Blok
Hi All, Hmmm... although some good ideas have been raised, they all had their disadvantages. Basically I think the way the filters work is fine for people who get used to the way the filters work. It is just a steep learning curve where the information needed to learn to use the display filter s

Re: [Wireshark-dev] ip.addr != 10.0.0.1 (Guy Harris)

2008-01-29 Thread Jaap Keuter
Hi, In this discussion you miss the tunneled protocols, or messages like ICMP Thanx, Jaap Stig Bjørlykke wrote: > 2008/1/29, Sake Blok <[EMAIL PROTECTED]>: >> I would vote for a preference value that defaults to make >> ip != 10.0.0.1 result in !(ip.addr==10.0.0.1). > > For most of the fields i

[Wireshark-dev] First attempts at debugging plugin on Linux... looking for help

2008-01-29 Thread Rich Ayres
I am developing a wireshark plugin and need to start to see things in an IDE. I've been trying to use Eclipse (on Fedora 8), but I've been stuck for a couple of days. If anyone has had success doing similar steps, I would sure appreciate pointers on what I may have done incorrectly. I hope I wi

Re: [Wireshark-dev] Bug 2066: GtkCombo: Conversion Status

2008-01-29 Thread Bill Meier
Anders Broman <[EMAIL PROTECTED]> writes: Bill Meier writes: >> Once that's done, I'll be happy to make the required changes to >> Makefile.nmake and tools/win32-setup.sh > Done - please do the other stuff - got to go... > /Anders Makefile.nmake and etc have been updated. Thanks to everyone f

Re: [Wireshark-dev] ip.addr != 10.0.0.1 (Guy Harris)

2008-01-29 Thread Stig Bjørlykke
2008/1/29, Sake Blok <[EMAIL PROTECTED]>: > I would vote for a preference value that defaults to make > ip != 10.0.0.1 result in !(ip.addr==10.0.0.1). For most of the fields in Wireshark we need the "x!=y" and "!(x==y)" operators as they are, exactly because they have different behavior. I do not

Re: [Wireshark-dev] summary window

2008-01-29 Thread Guy Harris
bijjou2000 wrote: > I work at a dissektor using udp.port = = udp.port xxx and yyy. > I will show the ports Number in the summary window in the info column. If you *don't* have a dissector for the protocol, the UDP dissector will show the port numbers. If you do, the Info column should show mo

Re: [Wireshark-dev] Bug 2066: GtkCombo: Conversion Status

2008-01-29 Thread Anders Broman
-Ursprungligt meddelande- Från: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] För Bill Meier Skickat: den 29 januari 2008 18:25 Till: Developer support list for Wireshark Ämne: Re: [Wireshark-dev] Bug 2066: GtkCombo: Conversion Status Bill Meier wrote: > Hold the press !! > > There's been

Re: [Wireshark-dev] ip.addr != 10.0.0.1

2008-01-29 Thread John McDermott
On Tue, 29 Jan 2008 05:01:13 -0700, Jaap wrote: > > May I offer a different proposal, based on a former colleague's bug > solving method. Since we have two (three actually) ways of expressing > Not Equal, being "!(...)" and ".. != .." and ".. NE ..", why not drop > support for the ".. != .." (and

Re: [Wireshark-dev] Bug 2066: GtkCombo: Conversion Status

2008-01-29 Thread Bill Meier
Bill Meier wrote: > Hold the press !! > > There's been an update on the GTK bug report that indicates the bug has > been fixed in the "freshly released" GTK 2.12.6. > > I'll check into it. > > Bill > > --- > This problem isn't reproducible in the freshly released GTK+ 2.12.6. Windows > binarie

[Wireshark-dev] summary window

2008-01-29 Thread bijjou2000
hi I work at a dissektor using udp.port = = udp.port xxx and yyy. I will show the ports Number in the summary window in the info column. please help thank bijjou www.jubii.fr c'est une seule interface pour communiquer. Email, téléphone gratuit, messagerie instantanée, 10 Go d'espace de stoc

[Wireshark-dev] FlexLM license server protocol dissector?

2008-01-29 Thread Marton.Nemeth
Hi, do somebody know if there is a dissector for FlexLM license server (http://en.wikipedia.org/wiki/FLEXlm ) protocol? Best regards, Márton Németh Knorr-Bremse Hungária Kft. Software Developer, R/BCE3 Major u. 69., H-1119 Budapest Phone: +36 1 3829-964 Fax: +36 1 3829-960 mailto:[EMAIL

Re: [Wireshark-dev] ip.addr != 10.0.0.1 (Guy Harris)

2008-01-29 Thread yin sun
then the next step could be adding "...!=..." operator back to be equivalent to "!(...)". /sunyin On Jan 29, 2008 3:55 AM, Jaap Keuter <[EMAIL PROTECTED]> wrote: > Hi, > > Well, still not that warm fuzzy feeling about it. I'll give you > something to think about. > > The whole discussion focuses

Re: [Wireshark-dev] Bug 2066: GtkCombo: Conversion Status

2008-01-29 Thread Bill Meier
Hold the press !! There's been an update on the GTK bug report that indicates the bug has been fixed in the "freshly released" GTK 2.12.6. I'll check into it. Bill --- This problem isn't reproducible in the freshly released GTK+ 2.12.6. Windows binaries at http://ftp.gnome.org/pub/GNOME/binari

Re: [Wireshark-dev] Bug 2066: GtkCombo: Conversion Status

2008-01-29 Thread Sake Blok
On Tue, Jan 29, 2008 at 09:31:52AM +0100, Anders Broman wrote: > On Mon, Jan 28, 2008 at 11:14:19AM -0500, Bill Meier wrote: > >> Ulf Lamping wrote: > >> > This seems to be a bug in the GTK libraries, we should simply "go > back" > >> > to the old GTK version that works and put some pressure on th

Re: [Wireshark-dev] ip.addr != 10.0.0.1 (Guy Harris)

2008-01-29 Thread Jaap Keuter
Hi, Well, still not that warm fuzzy feeling about it. I'll give you something to think about. The whole discussion focuses on the use of the != operator, which is the NE operator. We'll need to consider that the same discussion can be held for the LT, LE, GT and GE operators. Imagine this st

Re: [Wireshark-dev] Bug 2066: GtkCombo: Conversion Status

2008-01-29 Thread Anders Broman
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sake Blok Sent: den 29 januari 2008 08:53 To: Developer support list for Wireshark Subject: Re: [Wireshark-dev] Bug 2066: GtkCombo: Conversion Status On Mon, Jan 28, 2008 at 11:14:19AM -0500, Bill Meier wr

Re: [Wireshark-dev] ip.addr != 10.0.0.1 (Guy Harris)

2008-01-29 Thread Sake Blok
On Tue, Jan 29, 2008 at 10:05:27AM +0900, Kenichi Okuyama wrote: > > Sorry to interrupt you. I simply want to make sure. You mean, in > current implementation: > > a) ( ip.addr == 1.2.3.4 ) means (( ip.src == 1.2.3.4 )||( ip.dst == 1.2.3.4 > )). > > b) ( ip.addr != 1.2.3.4 ) means (( ip.src != 1