Re: [Wireshark-dev] q on catching error in sub-dissectors.

2020-01-21 Thread Christian Hopps
João Valverde writes: On 21/01/20 16:06, João Valverde wrote: On 21/01/20 16:01, Jeff Morriss wrote: We've been having fun with multiple PDUs in a single IP frame with SCTP for years. While there's room for improvement it's worked pretty well. Maybe I didn't explain well, but that's com

Re: [Wireshark-dev] q on catching error in sub-dissectors.

2020-01-21 Thread João Valverde
On 21/01/20 16:06, João Valverde wrote: On 21/01/20 16:01, Jeff Morriss wrote: We've been having fun with multiple PDUs in a single IP frame with SCTP for years.  While there's room for improvement it's worked pretty well. Maybe I didn't explain well, but that's completely different to m

Re: [Wireshark-dev] Support Opus in WireShark

2020-01-21 Thread Jiří Novák
Dear Peter, > I have Uploaded lots of RTP captures in various formats to > https://wiki.wireshark.org/SampleCaptures#SIP_and_RTP > Note that while Opus supports multiple settings, there is only one fixed > setting there. I'm aware of such samples, but they are too simple from my point of view. iL

Re: [Wireshark-dev] Q about reassembly.

2020-01-21 Thread João Valverde
On 20/01/20 21:33, Christian Hopps wrote: So with IPTFS (https://tools.ietf.org/html/draft-ietf-ipsecme-iptfs-00) I've got basically a packet stream inside an IPsec/ESP datagram packet stream. I've built various data structures to track out of order etc fragments as I get called for dissectin

Re: [Wireshark-dev] q on catching error in sub-dissectors.

2020-01-21 Thread João Valverde
On 21/01/20 16:01, Jeff Morriss wrote: We've been having fun with multiple PDUs in a single IP frame with SCTP for years.  While there's room for improvement it's worked pretty well. Maybe I didn't explain well, but that's completely different to multiple IP packets encapsulated in a single

Re: [Wireshark-dev] q on catching error in sub-dissectors.

2020-01-21 Thread Jeff Morriss
We've been having fun with multiple PDUs in a single IP frame with SCTP for years. While there's room for improvement it's worked pretty well. On Tue, Jan 21, 2020 at 9:58 AM João Valverde < joao.valve...@tecnico.ulisboa.pt> wrote: > By the way usually a tunnel encapsulates a single packet. I'm

Re: [Wireshark-dev] q on catching error in sub-dissectors.

2020-01-21 Thread Christian Hopps
> On Jan 21, 2020, at 9:46 AM, João Valverde > wrote: > > > > On 21/01/20 14:33, Christian Hopps wrote: >> So I've got a payload of packets in a single frame. I'm calling >> dissector_try_uint_new() to dissect each payload (typically IPv4 packets). >> Some of these packets are considered "

Re: [Wireshark-dev] q on catching error in sub-dissectors.

2020-01-21 Thread Christian Hopps
> On Jan 21, 2020, at 10:24 AM, Anders Broman via Wireshark-dev > wrote: > > > > -Original Message- > From: Wireshark-dev On Behalf Of João > Valverde > Sent: den 21 januari 2020 15:47 > To: wireshark-dev@wireshark.org > Subject: Re: [Wireshark-dev] q on catching error in sub-disse

Re: [Wireshark-dev] q on catching error in sub-dissectors.

2020-01-21 Thread Anders Broman via Wireshark-dev
-Original Message- From: Wireshark-dev On Behalf Of João Valverde Sent: den 21 januari 2020 15:47 To: wireshark-dev@wireshark.org Subject: Re: [Wireshark-dev] q on catching error in sub-dissectors. On 21/01/20 14:33, Christian Hopps wrote: > So I've got a payload of packets in a sing

Re: [Wireshark-dev] q on catching error in sub-dissectors.

2020-01-21 Thread João Valverde
By the way usually a tunnel encapsulates a single packet. I'm not aware of any other protocol multiplexing at the IP level. I would assume Wireshark requires some replumbing to handle that. Something like TFS being treated as a framing layer. Just food for thought. On 21/01/20 14:46, João Valv

Re: [Wireshark-dev] q on catching error in sub-dissectors.

2020-01-21 Thread João Valverde
On 21/01/20 14:33, Christian Hopps wrote: So I've got a payload of packets in a single frame. I'm calling dissector_try_uint_new() to dissect each payload (typically IPv4 packets). Some of these packets are considered "malformed" by wireshark (e.g., created by scapy/trex with some bogus value

[Wireshark-dev] q on catching error in sub-dissectors.

2020-01-21 Thread Christian Hopps
So I've got a payload of packets in a single frame. I'm calling dissector_try_uint_new() to dissect each payload (typically IPv4 packets). Some of these packets are considered "malformed" by wireshark (e.g., created by scapy/trex with some bogus values). The problem I'm hitting is that the firs