Re: [Wireshark-dev] Intro and lua question

2016-10-21 Thread Peter Wu
On Fri, Oct 21, 2016 at 01:24:52PM -0700, Jerry White wrote: > Hi, [..] > Advanced packet > > > > > > This packet has three application transactions in it. The first 8 bytes of > the MyProto header are always the same, and I can count from there into the > packet to parse out the fields I need

Re: [Wireshark-dev] Lua file io

2016-10-21 Thread Jerry White
Yes, but I was too stupid to realize its relevance. I'll give another look. :) On Fri, Oct 21, 2016 at 2:04 PM, Michael Mann wrote: > Have you checked https://wiki.wireshark.org/Lua/Examples? I believe > there is an example there (https://wiki.wireshark.org/ > Lua/Examples#dumping_to_multiple_f

Re: [Wireshark-dev] Problem with val_to_str inside BASE_CUSTOM callback function

2016-10-21 Thread Thomas Wiens
On 21.10.2016 22:49, Michael Mann wrote: > > Depending on what you're doing, you could go with > proto_tree_add_xxx_format_value. I think that's how most dissectors > end up avoiding the need for BASE_CUSTOM callback. Maybe one of you has another solution for what I want to realize. In my prot

Re: [Wireshark-dev] Lua file io

2016-10-21 Thread Michael Mann
Have you checked https://wiki.wireshark.org/Lua/Examples? I believe there is an example there (https://wiki.wireshark.org/Lua/Examples#dumping_to_multiple_files) -Original Message- From: Jerry White To: wireshark-dev Sent: Fri, Oct 21, 2016 4:55 pm Subject: [Wireshark-dev] Lua fil

[Wireshark-dev] Lua file io

2016-10-21 Thread Jerry White
Does anyone have a sample lua script that writes to a file? I'd like to dissect a packet and write some of the data into a text file. Thanks, Jerry ___ Sent via:Wireshark-dev mailing list Archives:https://www.wireshar

Re: [Wireshark-dev] Problem with val_to_str inside BASE_CUSTOM callback function

2016-10-21 Thread Michael Mann
Depending on what you're doing, you could go with proto_tree_add_xxx_format_value. I think that's how most dissectors end up avoiding the need for BASE_CUSTOM callback. -Original Message- From: Thomas Wiens To: Developer support list for Wireshark Sent: Fri, Oct 21, 2016 4:45 pm

Re: [Wireshark-dev] Problem with val_to_str inside BASE_CUSTOM callback function

2016-10-21 Thread Thomas Wiens
On 21.10.2016 22:17, Guy Harris wrote: > On Oct 21, 2016, at 1:08 PM, Jaap Keuter wrote: > >> For my understanding, would this be covered by using >> val_to_str_wmem(wmem_file_scope(), val, vs, fmt); > > Yes, but the strings will remain allocated until the capture file is closed, > even if that

Re: [Wireshark-dev] Intro and lua question

2016-10-21 Thread Michael Mann
Does your protocol give the length of your variable data within the fixed header? If so, tcp_dissect_pdus would be for you, but I don't immediately see how that's implemented in Lua (IANALP - I am not a Lua programmer). I did a quick search through Bugzilla because I remember it being talked

[Wireshark-dev] Intro and lua question

2016-10-21 Thread Jerry White
Hi, Quick intro: I'm Jerry White, live in the SF Bay Area. I've been a Wireshark user since the ethereal days. Also have pretty good experience with Riverbed SteelCentral Transaction Analyzer (aka ATX.) I used to work for OPNET/Riverbed. So Gerald Combs and I were co-workers. And Laura Chappell is

Re: [Wireshark-dev] Problem with val_to_str inside BASE_CUSTOM callback function

2016-10-21 Thread Guy Harris
On Oct 21, 2016, at 1:08 PM, Jaap Keuter wrote: > For my understanding, would this be covered by using > val_to_str_wmem(wmem_file_scope(), val, vs, fmt); Yes, but the strings will remain allocated until the capture file is closed, even if that's not necessary. _

Re: [Wireshark-dev] Problem with val_to_str inside BASE_CUSTOM callback function

2016-10-21 Thread Jaap Keuter
On 21-10-16 19:47, Guy Harris wrote: > On Oct 21, 2016, at 9:57 AM, Thomas Wiens wrote: > >> This happens only when calling val_to_str inside the callback function. >> When outside, then all is Ok (getting formatted result string on failure). >> When I'm calling try_val_to_str_idx with a non exis

Re: [Wireshark-dev] Linking on OSX Sierra

2016-10-21 Thread Francisco Javier Sanchez-Roselly
hi Jaap, > On 21 Oct 2016, at 14:28, Jaap Keuter wrote: > > Hi Francisco, > > That looks to me that the Wireshark splash image isn’t properly packed. There > are two version of it, one standard (called wssplash.png) which is used in > the released versions, and one development (called wssplas

Re: [Wireshark-dev] VoIP Calls dialog enhancements

2016-10-21 Thread Erik de Jong
The column for call duration would be an addition to the VoIP calls dialog, ideally on the right side of the end time column. From experience I think it might be something that is useful to detect calls that are terminated after getting picked up, typically a sign of interop issues. It would allow

Re: [Wireshark-dev] Problem with val_to_str inside BASE_CUSTOM callback function

2016-10-21 Thread Guy Harris
On Oct 21, 2016, at 9:57 AM, Thomas Wiens wrote: > This happens only when calling val_to_str inside the callback function. > When outside, then all is Ok (getting formatted result string on failure). > When I'm calling try_val_to_str_idx with a non existing value, then I > get -1 as index and NUL

[Wireshark-dev] Problem with val_to_str inside BASE_CUSTOM callback function

2016-10-21 Thread Thomas Wiens
Hi, I'am using fieldtype BASE_CUSTOM and a callback function in my own dissector. Works well, but when I am calling val_to_str with a value which is not inside the value_string list, then wireshark crashes. This happens only when calling val_to_str inside the callback function. When outside, then

Re: [Wireshark-dev] VoIP Calls dialog enhancements

2016-10-21 Thread Jaap Keuter
Hi Erik, Glad you liked Sharkfest Europe, we enjoyed it too. As for your ideas, you should have a peek at the other diagrams being used in Wireshark to see how these handle timestamp related items. Usually these kept generic, so (design) could be reused). A checkbox would probably be the way to

Re: [Wireshark-dev] Linking on OSX Sierra

2016-10-21 Thread Jaap Keuter
Hi Francisco, That looks to me that the Wireshark splash image isn’t properly packed. There are two version of it, one standard (called wssplash.png) which is used in the released versions, and one development (called wssplash_dev.png) which is used in the development versions. Somehow the appl

Re: [Wireshark-dev] VoIP Calls dialog enhancements

2016-10-21 Thread Anders Broman
Patches are very welcome, the void call stuff might need some love :-) Regards Anders Den 20 okt. 2016 8:04 em skrev "Erik de Jong" : > After a very exciting Sharkfest Europe I've decided to participate a bit > in the development of Wireshark! > > Some enhancements for the VoIP calls dialog would