Re: [Wireshark-dev] Sub_dissectors assertion failed

2010-05-21 Thread Scott
On Fri, May 21, 2010 at 3:18 PM, Guy Harris wrote: > > So what protocols does your custom protocol run on top of? For now the custom protocol is a dummy protocol that only contains a 32-bit int and rides on top of the IP protocol rider (*it*). I got the custom protocol to show up in the packet

Re: [Wireshark-dev] Sub_dissectors assertion failed

2010-05-21 Thread Guy Harris
On May 21, 2010, at 12:49 PM, Scott wrote: > I killed the original error of > ERROR:packet.c:709:dissector_add: assertion failed: (sub_dissectors) > by calling register_dissector_table() in proto_register_..(). Apparently I > didn't know I needed to do that, but it makes sense. Yes. As indica

Re: [Wireshark-dev] [Wireshark-users] tshark or dumpcap ring buffer limitations

2010-05-21 Thread Jeff Morriss
Gerald Combs wrote: > Jaap Keuter wrote: >> On Thu, 20 May 2010 12:05:09 -0400, Jeff Morriss >>> This appeared in rev 7912 and it appears that the max # of files limit >>> was there originally because *ethereal kept the old files open so we >>> would (prior to that commit) run out of fds. >>> >>>

Re: [Wireshark-dev] reduce the size of packet_info

2010-05-21 Thread Jakub Zawadzki
Hi, On Fri, May 21, 2010 at 10:52:50PM +0300, Kaul wrote: > I've just looked at packet_info structure (epan/packet_info.h) and it's huge > - everybody keeps something there. > 1. I wonder how many times its allocated/de-allocated in a capture - > reducing its size (and perhaps creating a pool of p

[Wireshark-dev] reduce the size of packet_info

2010-05-21 Thread Kaul
I've just looked at packet_info structure (epan/packet_info.h) and it's huge - everybody keeps something there. 1. I wonder how many times its allocated/de-allocated in a capture - reducing its size (and perhaps creating a pool of pinfo's) might help in performance. I suspect we have 1 per packet,

Re: [Wireshark-dev] Sub_dissectors assertion failed

2010-05-21 Thread Scott
Thanks for the reply Guy! I have some followup questions. I killed the original error of ERROR:packet.c:709:dissector_add: assertion failed: (sub_dissectors) by calling register_dissector_table() in proto_register_..(). Apparently I didn't know I needed to do that, but it makes sense. To answer

Re: [Wireshark-dev] [Wireshark-users] tshark or dumpcap ring buffer limitations

2010-05-21 Thread Gerald Combs
Jaap Keuter wrote: > On Thu, 20 May 2010 12:05:09 -0400, Jeff Morriss >> This appeared in rev 7912 and it appears that the max # of files limit >> was there originally because *ethereal kept the old files open so we >> would (prior to that commit) run out of fds. >> >> Any reason not to just take

Re: [Wireshark-dev] [Wireshark-users] tshark or dumpcap ring buffer limitations

2010-05-21 Thread Sake Blok
On 20 mei 2010, at 23:24, Jaap Keuter wrote: > On Thu, 20 May 2010 12:05:09 -0400, Jeff Morriss > wrote: >> [Redirecting to -dev for this question.] >> >> Jaap Keuter wrote: >>> On 05/19/2010 07:38 PM, Joseph Laibach wrote: All, I’m running a continuous capture of data. I’m trying

Re: [Wireshark-dev] Getting started example on how to use BASE_CUSTOM ?

2010-05-21 Thread Maynard, Chris
Maybe one of these will help you? grep -l BASE_CUSTOM epan/dissectors/packet-*.c epan/dissectors/packet-ipmi-app.c epan/dissectors/packet-ipmi-chassis.c epan/dissectors/packet-ipmi-picmg.c epan/dissectors/packet-ipmi-se.c epan/dissectors/packet-ipmi-storage.c epan/dissectors/packet-ipmi-transport.

[Wireshark-dev] Getting started example on how to use BASE_CUSTOM ?

2010-05-21 Thread Delporte Frank
Hello, I'm developing a dissector and already have a good working version. I want to further refine it with good readable tree items so I was thinking to use BASE_CUSTOM for some of them. As I'm rather new to C and Wireshark-coding, I'm looking to some kind of "getting started" for the use of