Re: [Wireshark-dev] Enabling/disabling ANY heuristic dissector

2015-07-06 Thread Anders Broman
Den 6 jul 2015 09:12 skrev "Guy Harris" : > > > On Jul 5, 2015, at 9:33 PM, Hadriel Kaplan wrote: > > > My 2 cents: > > > >> On Jul 5, 2015, at 11:32 PM, Guy Harris wrote: > >> > >> "Heuristic Protocol" or "Heuristic Dissector”? > > > > While “Dissector” makes more sense to me personally, do most

Re: [Wireshark-dev] Preparing to Write Dissector for New IPv6 Destination Option

2015-07-06 Thread Nalini Elkins
Thanks.   Now, it works. Let me double check the scaling of the delta times. Will let you know if I run into more issues. Really REALLY appreciate your help! Nalini Elkins Inside Products, Inc. (831) 659-8360 www.insidethestack.com From: Hadriel Kaplan To: Nalini Elkins Cc: Developer su

Re: [Wireshark-dev] Preparing to Write Dissector for New IPv6 Destination Option

2015-07-06 Thread Hadriel Kaplan
You probably need a more recent version of Wireshark. That looks like a bug that was fixed last year. You should be running Wireshark 1.12.x (the current released version). Also, don’t try loading Lua scripts from the Evaluate window - that frequently doesn’t work and isn’t supported - instead,

Re: [Wireshark-dev] Preparing to Write Dissector for New IPv6 Destination Option

2015-07-06 Thread Nalini Elkins
Thanks so much! I will double check: "page 8 says for the Options Length field "This field MUST be set to 16.” But really the field must be set to 12, since that’s the length of the PDM option." When I try to execute the LUA using the "Evaluate" option of Wireshark GUI, I get: Lua: Error Durin

Re: [Wireshark-dev] Preparing to Write Dissector for New IPv6 Destination Option

2015-07-06 Thread Hadriel Kaplan
Try the attached. There is one caveat: it won’t work correctly if you have a IPv6 Destination Options Header with the PDM option but also other option types in that same header. Also, I have no idea if I did the time scaling correctly. BTW, there’s a bug in the draft: page 8 says for the Optio

Re: [Wireshark-dev] Preparing to Write Dissector for New IPv6 Destination Option

2015-07-06 Thread Nalini Elkins
Hadriel, Thanks so much for your help!!! Will be waiting for your changes. Nalini Elkins Inside Products, Inc. (831) 659-8360 www.insidethestack.com From: Hadriel Kaplan To: Nalini Elkins ; Developer support list for Wireshark Sent: Monday, July 6, 2015 8:17 AM Subject: Re: [Wireshark

Re: [Wireshark-dev] Preparing to Write Dissector for New IPv6 Destination Option

2015-07-06 Thread Hadriel Kaplan
If you can wait an hour, I’ll find some free time to look at your script in detail and see if I can send you an updated/corrected one. Some quick comments from skimming the script: The first error you’re seeing is because on line 34 (and lines after) you’re invoking the subtreeitem:add() with t

[Wireshark-dev] Preparing to Write Dissector for New IPv6 Destination Option

2015-07-06 Thread Nalini Elkins
Hello All, Please let me know if I should post this to the user's list. My proposal for a new IPv6 Destination Option was recently adopted by the IP Performance Metrics Working Group of the IETF. It is at: http://datatracker.ietf.org/doc/draft-ietf-ippm-6man-pdm-option/ I have started impl

Re: [Wireshark-dev] Netflow: How should Sequence Number field work?

2015-07-06 Thread Martin Mathieson
Thanks Hadriel, I will pass the release number into the functions that deal with sequence numbers. Will probably hide sequence number analysis behind a preference setting, defaulted to on for now. r10 does sound as though it is back to something identical or similar to flows again. Martin On S

Re: [Wireshark-dev] Enabling/disabling ANY heuristic dissector

2015-07-06 Thread Guy Harris
On Jul 5, 2015, at 9:33 PM, Hadriel Kaplan wrote: > My 2 cents: > >> On Jul 5, 2015, at 11:32 PM, Guy Harris wrote: >> >> "Heuristic Protocol" or "Heuristic Dissector”? > > While “Dissector” makes more sense to me personally, do most users/IT-folks > understand what a “Dissector” is? That'