Re: [Wireshark-dev] Need Help of on IPV4

2009-08-05 Thread Satish Chandra
Hi, It is because Dissect T-PDU option must be enabled in the GTP protocol preference. If you disable this option, you will get the former addresses. You can do following: Edit menu -> preferences -> protocols -> GTP -> disable dissect T-PDU Hope this resolves your problem. Thanks Regards, Sat

[Wireshark-dev] Need Help of on IPV4

2009-08-05 Thread tulip neo
Hi List, Good Morning. I have bit confusion in IPV4 addressing.In the attached capture u would find the data goes through ethernet->IPV4->UDP->GTP->IPV4->UDP->SIP.so IPv4 is at top of ethernet as well GTP.IPV4 on top of ethernet has source and destination address as follows:   172.18.160.57 and

Re: [Wireshark-dev] Browse field in the preferences

2009-08-05 Thread Guy Harris
On Aug 5, 2009, at 3:30 PM, Aurélien Decagny wrote: > For the field part, you are right. But my question was more about > how to > make easily the browse button, so that the user don't need to write > all > the path for the data. And also how to get this path. Currently, there is no way to d

Re: [Wireshark-dev] Segmentation fault on startup of wireshark

2009-08-05 Thread Guy Harris
On Aug 4, 2009, at 4:53 PM, Rich Alderson wrote: > Thanks for the debugging help. Installing the updated libraries > required for > wireshark caused Emacs to stop working, which is a major problem > since I have > been using Emacs for more than 30 years (starting with the original > MIT TE

Re: [Wireshark-dev] custom decryption function

2009-08-05 Thread didier
Hi, Le mercredi 05 août 2009 à 15:27 -0400, Travis Tyler a écrit : > Hello, > I have recently written my first custom wireshark dissector. I > now successfully have wireshark separating the headers and such from > the payload. I now need to find a way to take the payload from each > packet an

Re: [Wireshark-dev] Browse field in the preferences

2009-08-05 Thread Stephen Fisher
On Thu, Aug 06, 2009 at 12:30:37AM +0200, Aurélien Decagny wrote: > For the field part, you are right. But my question was more about how > to make easily the browse button, so that the user don't need to write > all the path for the data. And also how to get this path. The best way may to be c

Re: [Wireshark-dev] Browse field in the preferences

2009-08-05 Thread Aurélien Decagny
Hi, thank you. For the field part, you are right. But my question was more about how to make easily the browse button, so that the user don't need to write all the path for the data. And also how to get this path. I also have another question, which has no link with the first one, but I won't

[Wireshark-dev] custom decryption function

2009-08-05 Thread Travis Tyler
Hello, I have recently written my first custom wireshark dissector. I now successfully have wireshark separating the headers and such from the payload. I now need to find a way to take the payload from each packet and decrypt it using a custom function. I am trying to watch a conversation be

[Wireshark-dev] Suggested changes to h248 package handling

2009-08-05 Thread Alex Lindberg
I need to add support for some custom h248 (MEGACO) packages to the wireshark h248 disector.  After working on the issue for sometime I would like to suggest the following changes to asn1/h248/packet-h248-template.c The general goal is to make the decoding of the package details separate from t

[Wireshark-dev] Library for converting *.pcap to PDML/PSML

2009-08-05 Thread kahou lei
Hi, Is it possible to use wireshark API (library, dll, etc) to convert *.pcap file to a PDML file? The reason is that I would like to use wireshark dll on my application instead of using the executable to do the conversion. Thanks, Kahou ___

Re: [Wireshark-dev] Time references

2009-08-05 Thread Jeff Morriss
John McHugh wrote: > I am working with network data from various sources, captured at > various locations. Most of the tools I use allow (or require) me to > display the times as UTC, allowing easy comparisons as well as > discussions with colleagues who are working in other time zones. >

[Wireshark-dev] Time references

2009-08-05 Thread John McHugh
I am working with network data from various sources, captured at various locations. Most of the tools I use allow (or require) me to display the times as UTC, allowing easy comparisons as well as discussions with colleagues who are working in other time zones. Why is it not possible to set

Re: [Wireshark-dev] Browse field in the preferences

2009-08-05 Thread xourciere.ext
Hello Aurelien, Perhaps you can use the "Follow TCP/UDP stream" feature then save the result. Regarding your idea about having a file setting inside the preferences it should be possible, but I do not know how to use it properly. Here are some sources I use in my dissector templates to let th

[Wireshark-dev] Browse field in the preferences

2009-08-05 Thread Aurélien Decagny
Hi, I am building a dissector for Wireshark, and I would like to give the user the possibility to save directly all the data my plugin decoded into a text file. So the only thing I need is the path to where I can save the text file. Do I have the possibility to implement directly a "browse" fi