[Wireshark-dev] tshark abort

2008-07-13 Thread Romel Khan
Is anyone familiar with the below problem? It seems that there is no issue when run as root on the same file with same filter. [EMAIL PROTECTED] ~]$ tshark -r temp.enc -R "ip.addr == 208.131.182.37" -w out2.enc tshark: ldap-nss.c:1193: do_init: Assertion `cfg->ldc_uris[__session.ls_current_u

Re: [Wireshark-dev] Dissector - how to reject packets

2008-07-13 Thread Barnes, Pat
The application whose traffic I'm interested uses only Modbus messages 0x03 and 0x17, with register addresses above 1000. Each packet is similar to an RPC call or response. The mbtcp dissector claims to intrepret the entire packet, but part of the relevant data I want to show is claimed by the dis

Re: [Wireshark-dev] Dissector - how to reject packets

2008-07-13 Thread Guy Harris
On Jul 13, 2008, at 5:30 PM, Barnes, Pat wrote: > The application whose traffic I'm interested uses only Modbus messages > 0x03 and 0x17, with register addresses above 1000. Each packet is > similar to an RPC call or response. > > The mbtcp dissector claims to intrepret the entire packet, but par

Re: [Wireshark-dev] Dissector - how to reject packets

2008-07-13 Thread Barnes, Pat
Not displayed in the sense that packet-mbtcp.c does this: proto_tree_add_text(modbus_tree, tvb, payload_start + 1, byte_cnt, "Data"); That would be the latter, I guess. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Guy Harris Sent: Monday, 14 July 2008

Re: [Wireshark-dev] tshark abort

2008-07-13 Thread Jaap Keuter
Hi, Version? Thanx, Jaap Romel Khan wrote: > Is anyone familiar with the below problem? It seems that there is no > issue when run as root on the same file with same filter. > > > > [EMAIL PROTECTED] ~]$ tshark -r temp.enc -R "ip.addr == 208.131.182.37" -w > out2.enc > > tshark: ldap-n