Re: [Wireshark-dev] wireshark to sql

2008-07-25 Thread Saeed Akhtar
Is there any tool for offline scripting On Tue, Jul 22, 2008 at 7:03 PM, Abhik Sarkar <[EMAIL PROTECTED]> wrote: > Hi Saeed, > > This has been discussed before... > http://www.wireshark.org/lists/wireshark-dev/200708/msg00041.html > > You can search the wireshark mailing list archives to

Re: [Wireshark-dev] display filter for expert/tcp analysis info

2008-07-25 Thread Abhik Sarkar
Hi Nathan, Would using the tcp.analysis.lost_segment and other display filters from the tcp.analysis family not meet your requirement? Or do you specifically want to have display filters on expert analysis items for a broader scope? Regards, Abhik. On Fri, Jul 25, 2008 at 7:12 AM, Nathan Jenning

Re: [Wireshark-dev] Windows build for VS 2008

2008-07-25 Thread Bill Meier
Nathan Jennings wrote: > > Just curious if anyone was looking at this or had put any time into it. > > See https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2719 ___ Wireshark-dev mailing list Wireshark-dev@wireshark.org https://wireshark.org/mailm

[Wireshark-dev] buildbot failure in Wireshark (development) on OSX-10.5-x86

2008-07-25 Thread buildbot-no-reply
The Buildbot has detected a new failure of OSX-10.5-x86 on Wireshark (development). Full details are available at: http://buildbot.wireshark.org/trunk/builders/OSX-10.5-x86/builds/446 Buildbot URL: http://buildbot.wireshark.org/trunk/ Buildslave for this Build: osx-10.5-x86 Build Reason: Buil

[Wireshark-dev] packet-dcm.c:960: warning: pointer type mismatch in conditional expression

2008-07-25 Thread Anders Broman
Hi, Could some one help me to fix this one? Regards Anders ___ Wireshark-dev mailing list Wireshark-dev@wireshark.org https://wireshark.org/mailman/listinfo/wireshark-dev

Re: [Wireshark-dev] packet-dcm.c:960: warning: pointer type mismatch in conditional expression

2008-07-25 Thread Martin Mathieson
I'm still getting a build error here about unused statics (dcm_uid_table and dcm_iud_data). They are declared static in the header file, which can't be right, can it? Surely they should be moved into the .c file, or if something will share them, made non-static? Martin On Fri, Jul 25, 2008 at 3:

Re: [Wireshark-dev] Windows build for VS 2008

2008-07-25 Thread Gerald Combs
Nathan Jennings wrote: > Trying to start a capture gets me the generic Windows error dialog where > I can click "Debug" and it takes me into the VS debugger and drops me > into "dbghook.c" with the following in the output window: > > Microsoft Visual Studio C Runtime Library has detected a fatal

Re: [Wireshark-dev] Windows build for VS 2008

2008-07-25 Thread Graham Bloice
Gerald Combs wrote: Nathan Jennings wrote: Trying to start a capture gets me the generic Windows error dialog where I can click "Debug" and it takes me into the VS debugger and drops me into "dbghook.c" with the following in the output window: Microsoft Visual Studio C Runtime Library has

[Wireshark-dev] (no subject)

2008-07-25 Thread samyc
Hi all, I'm trying to figure out if it is possible for wireshark to handle many versions of the same protocol. Ex I wrote a plugin handling v1 of foo protocol, now this protocol has evolved and I need to write a v2 plugin. is it possible for wireshark to handle both version in the same session? tha

Re: [Wireshark-dev] supporting multiple versions of a protocol in one dissector (Was: (no subject))

2008-07-25 Thread Jeff Morriss
[EMAIL PROTECTED] wrote: > Hi all, > I'm trying to figure out if it is possible for wireshark to handle many > versions > of the same protocol. Ex I wrote a plugin handling v1 of foo protocol, now > this > protocol has evolved and I need to write a v2 plugin. is it possible for > wireshark to h

Re: [Wireshark-dev] packet-dcm.c:960: warning: pointer type mismatch in conditional expression

2008-07-25 Thread Jeff Morriss
I moved them to the .c file. Not sure why this dissector even needs a header file, though, as it is the only dissector to include it. Martin Mathieson wrote: > I'm still getting a build error here about unused statics (dcm_uid_table > and dcm_iud_data). They are declared static in the header

Re: [Wireshark-dev] (no subject)

2008-07-25 Thread Abhik Sarkar
I saw something similar in this: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2727 On Fri, Jul 25, 2008 at 7:44 PM, <[EMAIL PROTECTED]> wrote: > Hi all, > I'm trying to figure out if it is possible for wireshark to handle many > versions > of the same protocol. Ex I wrote a plugin handl

Re: [Wireshark-dev] Out of Memory issue

2008-07-25 Thread Kumar, Hemant
Hello I am facing a weird kind of issue. To check if memory issue was with my dissector and creation of trees and subtrees I didn't dissected the messages but just displayed the protocol type for my packets under Protocol column in display pane. And in the details pane , there was no dissection

Re: [Wireshark-dev] Out of Memory issue

2008-07-25 Thread Jeff Morriss
Kumar, Hemant wrote: > Hello > > My dissector runs in to out of memory problem after dissecting certain > number of packets. > > The maximum size of packet which I am dissecting is 1082KB. > > Some of the fields in the packets are *buffers* which I have added to > the display tree also. >

Re: [Wireshark-dev] Out of Memory issue

2008-07-25 Thread Guy Harris
On Jul 24, 2008, at 5:12 PM, Kumar, Hemant wrote: > It dies out in following TRY statement:-- > > TRY { > read_packet(cf, dfcode, data_offset); > } > CATCH(OutOfMemoryError) { > > | > | > | > | > } > ENDTRY; > } Presumably that's the statement in cf_read() in file.c (i.

Re: [Wireshark-dev] packet-dcm.c:960: warning: pointer type mismatch in conditional expression (Jeff Morriss)

2008-07-25 Thread david_aggeler
Thanks for all the check-in work and sorry for some of the headache. I will follow up on the issues left and supply a patch promptly. Since the static definition will grow soon (+100kB), is there a recommended way outside the main .c file or should I merge before submitting the patch? A few thi

Re: [Wireshark-dev] Plugin Dissector with multiple .c files

2008-07-25 Thread Jason Dick
Thanks for the guidance. It seems to be working. Now let me go fix the rest of my bad form and clean up the header file. - Original Message From: Guy Harris <[EMAIL PROTECTED]> To: Developer support list for Wireshark Sent: Thursday, July 24, 2008 10:35:53 PM Subject: Re: [Wireshar

Re: [Wireshark-dev] packet-dcm.c:960: warning: pointer type mismatch in conditional expression

2008-07-25 Thread Jeff Morriss
Actually the header file is used--by gtk/export_object_dicom.c Jeff Morriss wrote: > > I moved them to the .c file. Not sure why this dissector even needs a > header file, though, as it is the only dissector to include it. > > Martin Mathieson wrote: >> I'm still getting a build error here ab

Re: [Wireshark-dev] Out of Memory issue

2008-07-25 Thread Kumar, Hemant
Hello Harris Below is the code section from my packet_myprotocol.c. I was able to finally locate the memory issue with code snippet;-- If I comment this, everything works fine. So am I wrong in allocating memory for the string which I want to display in INFO section for the message in displ

Re: [Wireshark-dev] Out of Memory issue

2008-07-25 Thread Kumar, Hemant
Even if I comment as shown below and add a simple printf statement it fails but if I just keep the first line ep_alloc() and comment everything With no printf addition then it works.:-- if (check_col(pinfo->cinfo,COL_INFO)) { temp_str =

Re: [Wireshark-dev] Out of Memory issue

2008-07-25 Thread didier
Hi, Le vendredi 25 juillet 2008 à 15:23 -0700, Kumar, Hemant a écrit : > Even if I comment as shown below and add a simple printf statement it > fails but if I just keep the first line ep_alloc() and comment > everything > > With no printf addition then it works.:-- > if (check

Re: [Wireshark-dev] Out of Memory issue

2008-07-25 Thread Guy Harris
On Jul 25, 2008, at 3:23 PM, Kumar, Hemant wrote: > Even if I comment as shown below and add a simple printf statement > it fails but if I just keep the first line ep_alloc() and comment > everything > With no printf addition then it works.:-- > > if (check_col(pinfo->cinfo

Re: [Wireshark-dev] display filter for expert/tcp analysis info

2008-07-25 Thread Nathan Jennings
Yes, this is exactly what I was looking for. Thanks! I had forgotten I could use tshark to output the trace in pdml and then look for the field names. Thanks again, -Nathan On 7/25/2008 7:00 AM, Abhik Sarkar wrote: > Hi Nathan, > > Would using the tcp.analysis.lost_segment and other display f

Re: [Wireshark-dev] wireshark to sql

2008-07-25 Thread Nathan Jennings
On 7/25/2008 4:02 AM, Saeed Akhtar wrote: > Is there any tool for offline scripting > You may want to have a look at CoMo: http://como.sourceforge.net/ From the "Publications" section: http://como.sourceforge.net/pubs/fastproto.pam2006.pdf I suppose it depends on your requirements a

Re: [Wireshark-dev] Windows build for VS 2008

2008-07-25 Thread Nathan Jennings
On 7/25/2008 11:50 AM, Graham Bloice wrote: > Gerald Combs wrote: >> >> According to >> http://kobyk.wordpress.com/2007/07/20/dynamically-linking-with-msvcrtdll-using-visual-c-2005/ >> >> >> it's possible to use newer versions of Visual C++ to link against the >> "classic" >> msvcrt.dll instead