Re: [Wireshark-dev] Different wireshark behaviour on Linux as on Windows

2011-03-08 Thread Roland Knall
On Tue, Mar 8, 2011 at 4:41 AM, Chris Maynard wrote: > Roland Knall writes: > >> Ok, now I have a question. >> >> Both dissectors register on a certain Ethernet Frame Type (0x88CD). If >> I disable the SercosIII dissector, in theory, my dissector should get >> called, right? > That would be my ex

Re: [Wireshark-dev] Programming against WireShark pcap processing engine

2011-03-08 Thread Abhik Sarkar
How about exporting the captures to PDML format and then parsing the output XML in Java? I know it is CPU intensive and the PDML files could become quite large, but each layer (SMIL/images etc) would appear as separate entities and by doing some searching you might be able to extract what you want.

Re: [Wireshark-dev] Portable Linux Wireshark with custom dissectors - possible ?

2011-03-08 Thread Maynard, Chris
> There is a Portable Wireshark for the Microsoft operating systems. > Can the same thing happen for Linux ? Apparently somebody already has this working: http://portablelinuxapps.org/ CONFIDENTIALITY NOTICE: The contents of this email are confidential and for the exclusive use of the intended rec

Re: [Wireshark-dev] Eliminate annoying color filter dialog

2011-03-08 Thread Maynard, Chris
Gerald Combs writes: > How about using statusbar_push_temporary_msg (patch attached)? > statusbar_push_temporary_msg shows a message for a few seconds in the > status bar. It doesn't print to stdout, but it probably should. I don't know how many messages one must send through gmane before one of t

[Wireshark-dev] buildbot failure in Wireshark 1.4 on Windows-7-x64

2011-03-08 Thread buildbot-no-reply
The Buildbot has detected a new failure of Windows-7-x64 on Wireshark 1.4. Full details are available at: http://buildbot.wireshark.org/trunk-1.4/builders/Windows-7-x64/builds/206 Buildbot URL: http://buildbot.wireshark.org/trunk-1.4/ Buildslave for this Build: windows-7-x64 Build Reason: The w

Re: [Wireshark-dev] Portable Linux Wireshark with custom dissectors - possible ?

2011-03-08 Thread ronnie sahlberg
You should be able to either build a statically linked version of wireshark, or copy the normally built dynamically linked version as well as the various shared libraries wireshark comes with and just wrap it inside a small shell-script that sets the LD_LIBRARY_PATH so that ld.so can find the wires

[Wireshark-dev] Portable Linux Wireshark with custom dissectors - possible ?

2011-03-08 Thread Dan White
I have been tasked to come up with a Wireshark configuration that can sit on a USB thumb drive and get plugged into a Linux system and run. The building would, obviously, take place on a separate platform. All I would need on the "thumb" is the actual executables. I looked through the offi

Re: [Wireshark-dev] Eliminate annoying color filter dialog

2011-03-08 Thread Chris Maynard
Anders Broman writes: > How about a tick box "Don't show this message again"? or is that to > complicated to implement? Well, I replied much earlier today but I seem to be having some trouble getting messages posted when submitting them via gmane. This is a second attempt at a reply. But basi

Re: [Wireshark-dev] Eliminate annoying color filter dialog

2011-03-08 Thread Gerald Combs
On 3/8/11 12:19 PM, Jeff Morriss wrote: > Chris Maynard wrote: >> I regularly switch between a custom build of Wireshark for analyzing my >> company's protocols and the trunk when doing general Wireshark >> development/testing. Unfortunately, I have lots of custom color >> filters in >> place that

Re: [Wireshark-dev] Eliminate annoying color filter dialog

2011-03-08 Thread Chris Maynard
Jeff Morriss writes: > What about spewing a warning to stdout like we do when we find a > preference we don't know/understand? (Just so there's _some_ log of the > "failure".) My own preference is to just get rid of them altogether, but I guess I can see the potential benefit for others. Tha

Re: [Wireshark-dev] Eliminate annoying color filter dialog

2011-03-08 Thread Anders Broman
Chris Maynard skrev 2011-03-08 21:02: I regularly switch between a custom build of Wireshark for analyzing my company's protocols and the trunk when doing general Wireshark development/testing. Unfortunately, I have lots of custom color filters in place that are invalid for the trunk for obvious

Re: [Wireshark-dev] Eliminate annoying color filter dialog

2011-03-08 Thread Jeff Morriss
Chris Maynard wrote: I regularly switch between a custom build of Wireshark for analyzing my company's protocols and the trunk when doing general Wireshark development/testing. Unfortunately, I have lots of custom color filters in place that are invalid for the trunk for obvious reasons. But ev

Re: [Wireshark-dev] Eliminate annoying color filter dialog

2011-03-08 Thread Stephen Fisher
On Tue, Mar 08, 2011 at 08:02:19PM +, Chris Maynard wrote: > But every time I switch to the trunk, for every custom color filter I > have, I get an annoying dialog telling me, "Could not compile color > filter "blah" from saved filters." I've made a change in my local > sandbox to avoid thi

[Wireshark-dev] Eliminate annoying color filter dialog

2011-03-08 Thread Chris Maynard
I regularly switch between a custom build of Wireshark for analyzing my company's protocols and the trunk when doing general Wireshark development/testing. Unfortunately, I have lots of custom color filters in place that are invalid for the trunk for obvious reasons. But every time I switch to th

Re: [Wireshark-dev] Packet Storage

2011-03-08 Thread Guy Harris
On Mar 8, 2011, at 6:58 AM, Jeff Morriss wrote: > Different file types allow different things. PCAP files can contain only one > DLT value. ...but can contain multiple Ethernet type values, if by "ethernet types" he's referring to the type values used in the type/length field in the Ethernet

Re: [Wireshark-dev] Packet Storage

2011-03-08 Thread Guy Harris
On Mar 8, 2011, at 2:06 AM, Tharaneedharan Vilwanathan wrote: > The .pcap format allows the packets to be of the same ethernet type, > right? If so, what is the best way to store the packets of different > ethernet types in a file? The pcap format requires that all packets have the same type of

Re: [Wireshark-dev] Using a tap to make a dissector work?

2011-03-08 Thread Gerald Combs
On 3/8/11 8:02 AM, Sake Blok wrote: > True again. I thought it also has an effect on the automated builds, but I > see that the windows bots have a whole different issue... > @Gerald, what's with the win-bots? They were down earlier due to network maintenance. The 64-bit builder is back up but i

Re: [Wireshark-dev] Programming against WireShark pcap processing engine

2011-03-08 Thread Jeff Morriss
Per Steffensen wrote: Hi I am writing a Java program that has process a lot of pcap files to extract certain data - in phase one I have to extract MMS's from those pcaps. If I put some of my example pcap files into WireShare it shows me that there is an MMS and I am able to extract the differ

Re: [Wireshark-dev] Using a tap to make a dissector work?

2011-03-08 Thread Sake Blok
On 8 mrt 2011, at 16:53, Jeff Morriss wrote: > Sake Blok wrote: >> On 8 mrt 2011, at 15:55, Jeff Morriss wrote: >>> This issue is tracked in >>> https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5445 . There, Guy >>> suggested: >>> The trick might be to have multiple types of taps, such

Re: [Wireshark-dev] Using a tap to make a dissector work?

2011-03-08 Thread Jeff Morriss
Sake Blok wrote: On 8 mrt 2011, at 15:55, Jeff Morriss wrote: Sake Blok wrote: Hi, The buildbots are failing on the test.sh script because: sake@macsake-wifi:~/Wireshark/trunk/test$ ../tshark -r dhcp.pcap -w - > tmp.cap tshark: Taps aren't supported when saving to a pipe. sake@macsake-wifi:~/W

Re: [Wireshark-dev] Using a tap to make a dissector work?

2011-03-08 Thread Sake Blok
On 8 mrt 2011, at 15:55, Jeff Morriss wrote: > Sake Blok wrote: >> Hi, >> The buildbots are failing on the test.sh script because: >> sake@macsake-wifi:~/Wireshark/trunk/test$ ../tshark -r dhcp.pcap -w - > >> tmp.cap >> tshark: Taps aren't supported when saving to a pipe. >> sake@macsake-wifi:~/W

Re: [Wireshark-dev] BASH script to automate Wireshark install in OS X 10.6

2011-03-08 Thread Chris Maynard
Rob Gage writes: > Just thought > I would share this to make for anyone who is attempting to install Wireshark on 10.6 and needs a little > assistance. Most people I know don't really know how to install it > correctly. Thanks for the script Rob. Maybe it would make sense for you to post thi

Re: [Wireshark-dev] Programming against WireShark pcap processing engine

2011-03-08 Thread Per Steffensen
No one? Really? The important part is not that I have to use java. Any input on how to program against the WireShark pcap processing engine is very welcome, no matter the language. I will make the java wrapper myself. Regards, Steff

Re: [Wireshark-dev] Packet Storage

2011-03-08 Thread Jeff Morriss
Tharaneedharan Vilwanathan wrote: Hi All, I have a quick question. The .pcap format allows the packets to be of the same ethernet type, right? If so, what is the best way to store the packets of different ethernet types in a file? Sorry if this is a common question and/or this has been asked a

Re: [Wireshark-dev] Using a tap to make a dissector work?

2011-03-08 Thread Jeff Morriss
Sake Blok wrote: Hi, The buildbots are failing on the test.sh script because: sake@macsake-wifi:~/Wireshark/trunk/test$ ../tshark -r dhcp.pcap -w - > tmp.cap tshark: Taps aren't supported when saving to a pipe. sake@macsake-wifi:~/Wireshark/trunk/test$ I tracked this down to http://anonsvn.wi

[Wireshark-dev] Using a tap to make a dissector work?

2011-03-08 Thread Sake Blok
Hi, The buildbots are failing on the test.sh script because: sake@macsake-wifi:~/Wireshark/trunk/test$ ../tshark -r dhcp.pcap -w - > tmp.cap tshark: Taps aren't supported when saving to a pipe. sake@macsake-wifi:~/Wireshark/trunk/test$ I tracked this down to http://anonsvn.wireshark.org/viewvc?

[Wireshark-dev] Packet Storage

2011-03-08 Thread Tharaneedharan Vilwanathan
Hi All, I have a quick question. The .pcap format allows the packets to be of the same ethernet type, right? If so, what is the best way to store the packets of different ethernet types in a file? Sorry if this is a common question and/or this has been asked already. Any help appreciated. Than