Re: [Wireshark-dev] HELP: about tshark shared library.

2008-03-25 Thread Guy Harris
Pankaj Yadav wrote: > actully i want tshark library to use tshark tool idependently only > e.g. tshark command tool. What do you mean by "use tshark tool idependently only e.g. tshark command tool"? If you just want to use the TShark command-line tool, just use it - you don't have to recompile

Re: [Wireshark-dev] HELP: about tshark shared library.

2008-03-25 Thread Guy Harris
On Mar 25, 2008, at 3:44 AM, Pankaj Yadav wrote: > I want to create a shared library for tshark (using wireshark-0.99.8). Why? What would you use that library for? Is there something tshark does that libwireshark (which is what both Wireshark and TShark use to dissect packets) and libwiret

Re: [Wireshark-dev] Default stream save format

2008-03-25 Thread Stephen Fisher
On Tue, Mar 25, 2008 at 01:46:53PM -0700, Gerald Combs wrote: > Are there any objections to making the default save format for the > stream window "Raw?" The current default format is "ASCII," which in > our case means "save the data shown in the stream window after GTK and > Wireshark have had

Re: [Wireshark-dev] MIB path not saved with preferences

2008-03-25 Thread Jaap Keuter
Hi, This information is stored in ~/.wireshark/smi_paths and ~/.wireshark/smi_modules Thanx, Jaap Andrew Hood wrote: > Seen in Wireshark HEAD at 24705, but I've observed it before and > expected it to have been picked up. > > If you add additional paths for MIBs in the preferences dialog they

[Wireshark-dev] MIB path not saved with preferences

2008-03-25 Thread Andrew Hood
Seen in Wireshark HEAD at 24705, but I've observed it before and expected it to have been picked up. If you add additional paths for MIBs in the preferences dialog they don't get saved in your prefernces. Or is this only happening because I have a full copy of libsmi and it is expecting to only u

Re: [Wireshark-dev] about concatenating pdu's in wireshark

2008-03-25 Thread Guy Harris
prakash chowbey wrote: > i need to concatenate two pdu's(of type tvbuff_t*). how can i do it? I.e., you have two PDUs and you need to combine all or part of the two PDUs into another block of data that you'd presumably dissect? ___ Wireshark-dev mailin

Re: [Wireshark-dev] modifying the eth-dissector

2008-03-25 Thread Pascal Heude
Hi Valentin, I already developped 2 wireshark plugins (dll) to dissect AFDX payloads included in A380 CMS messages (System Identification Data and Normal Mode) .These 2 plugins are below UDP (like any other AFDX payload) and I use the UDP port number (constant for SID and NM) to call the func

[Wireshark-dev] Default stream save format

2008-03-25 Thread Gerald Combs
Are there any objections to making the default save format for the stream window "Raw?" The current default format is "ASCII," which in our case means "save the data shown in the stream window after GTK and Wireshark have had a chance to mangle it." This seems to be tripping people up.

Re: [Wireshark-dev] modifying the eth-dissector

2008-03-25 Thread Jaap Keuter
Hi, "Yeah, what he said." About the configuration: he's right again. You better have a *very* good reason why this has to be done with an XML file, since we already have too many config/setting/definition/template files in the tree. Thanx, Jaap Maynard, Chris wrote: > Try registering as a heu

Re: [Wireshark-dev] modifying the eth-dissector

2008-03-25 Thread Maynard, Chris
Try registering as a heuristic dissector to packet-eth: "heur_dissector_add("eth", dissect_afdx, proto_afdx);" When handed a frame, your heuristic dissector will scan the MAC to determine if it's a "special address" indicating that it's for your dissector. If so, process it and return true; o

Re: [Wireshark-dev] Getting ACK/SEQ numbers in a dissector

2008-03-25 Thread Maynard, Chris
The packet_info contains a frame_data field which in turn contains a "visited" flag that indicates if the frame has been "visited" or not. This might be of use to you. (Look for examples of "pinfo->fd->flags.visited" in other dissectors.) - Chris -Original Message- From: [EMAIL PROTECTED

[Wireshark-dev] modifying the eth-dissector

2008-03-25 Thread valentin . ecker
Hi all, I would like to write a new dissector for wireshark...but im stuck at some points: My protocol is based on the ARINC AFDX standard which is (more or less) based on Ethernet II frames at layer 2. The difference to this frame type is the MAC-Dest/Source-Address, where a certain address s

Re: [Wireshark-dev] Getting ACK/SEQ numbers in a dissector

2008-03-25 Thread Greg Sinclair
Bummer. Well, in that case, is there a way in Wireshark to keep track of packets that have already been processed (since they seem to get processed twice..once for INFO and one for tree)? The problem I'm facing is that I have a set of static indexes into an encryption array. The first time it's c

Re: [Wireshark-dev] Regarding TShark.dll

2008-03-25 Thread Eloy Paris
On Tue, Mar 25, 2008 at 12:27:37PM +, amol shinde wrote: > I need to create TShark.dll from wireshark. I am customising > wirshark for our project use which is based on GPL. Can > anyone please help me out. I know we need to make changes in > Makefile.nmake under wireshark

[Wireshark-dev] Regarding TShark.dll

2008-03-25 Thread amol shinde
Hi All, I need to create TShark.dll from wireshark. I am customising wirshark for our project use which is based on GPL. Can anyone please help me out. I know we need to make changes in Makefile.nmake under wireshark directory but i am unaware of dll creation. Thanks in advance

[Wireshark-dev] HELP: about tshark shared library.

2008-03-25 Thread Pankaj Yadav
Hi All, I want to create a shared library for tshark (using wireshark-0.99.8). For that, i copied tshark.c as libtshark.c[where i change main() to tshark()] then i add tshark.c [whre i called tshark()] and added tshrk.h Then I did: (1) object file for libtshark.c as: /bin/sh /usr/bin/libtool --