Re: [Wireshark-dev] Display IPv6 extension headers outside of the IPv6 subtree

2015-08-22 Thread Alexis La Goutte
On Sat, Aug 22, 2015 at 8:10 AM, João Valverde < joao.valve...@tecnico.ulisboa.pt> wrote: > I'm not so sure now that I've done some tests with short and long header > chains, I think I'll drop it. > > Can you push your proto ? or add some screenshot to see the different ? > Regards, > > João V.

Re: [Wireshark-dev] Display IPv6 extension headers outside of the IPv6 subtree

2015-08-22 Thread João Valverde
On 08/22/2015 09:29 AM, Alexis La Goutte wrote: On Sat, Aug 22, 2015 at 8:10 AM, João Valverde mailto:joao.valve...@tecnico.ulisboa.pt>> wrote: I'm not so sure now that I've done some tests with short and long header chains, I think I'll drop it. Can you push your proto ? or add som

Re: [Wireshark-dev] Display IPv6 extension headers outside of the IPv6 subtree

2015-08-22 Thread João Valverde
On 08/22/2015 02:28 PM, João Valverde wrote: On 08/22/2015 09:29 AM, Alexis La Goutte wrote: On Sat, Aug 22, 2015 at 8:10 AM, João Valverde mailto:joao.valve...@tecnico.ulisboa.pt>> wrote: I'm not so sure now that I've done some tests with short and long header chains, I think I'l

[Wireshark-dev] Patch: Prepare for some cleanups of 802.11ad

2015-08-22 Thread Richard Sharpe
Hi folks, As part of fixing some problems in the 802.11ad dissector that I am aware of I want to define some constants and a convenience macro in wiretap/wtap.h. Here are the first changes. If anyone has any criticisms let me know. I will likely push this to Gerrit later in the weekend. diff --g

Re: [Wireshark-dev] [Bug 11461] Additional (bogus) expert items with Wireshark compared to tshark

2015-08-22 Thread Joerg Mayer
On Sat, Aug 22, 2015 at 09:53:49AM +, bugzilla-dae...@wireshark.org wrote: > https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11461 > > --- Comment #4 from Alexis La Goutte --- > the expert info is on if(tree) check ? OK, this showed me that I have yet to understand the main disection loo

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-22 Thread Pascal Quantin
2015-08-22 7:55 GMT+02:00 Yang Luo : > Hi list, > > Npcap 0.04 r5 has added the DLT_NULL protocol support, you need to check > the *"Use DLT_NULL protocol as loopback packets' link layer instead of > Ethernet II"* option when installing (default is not checked). The > problem is Wireshark didn't r

Re: [Wireshark-dev] Display IPv6 extension headers outside of the IPv6 subtree

2015-08-22 Thread João Valverde
On 08/22/2015 02:58 PM, João Valverde wrote: On 08/22/2015 02:28 PM, João Valverde wrote: On 08/22/2015 09:29 AM, Alexis La Goutte wrote: On Sat, Aug 22, 2015 at 8:10 AM, João Valverde mailto:joao.valve...@tecnico.ulisboa.pt>> wrote: I'm not so sure now that I've done some tests wi

Re: [Wireshark-dev] Patch: Prepare for some cleanups of 802.11ad

2015-08-22 Thread Guy Harris
On Aug 22, 2015, at 7:46 AM, Richard Sharpe wrote: > As part of fixing some problems in the 802.11ad dissector that I am > aware of Presumably you have 802.11ad captures of some sort. If they have radiotap headers, do they have either an MCS field: http://www.radiotap.org/defined-fiel

Re: [Wireshark-dev] Patch: Prepare for some cleanups of 802.11ad

2015-08-22 Thread Richard Sharpe
On Sat, Aug 22, 2015 at 11:43 AM, Guy Harris wrote: > > On Aug 22, 2015, at 7:46 AM, Richard Sharpe > wrote: > >> As part of fixing some problems in the 802.11ad dissector that I am >> aware of > > Presumably you have 802.11ad captures of some sort. Yes. > If they have radiotap headers, do the

Re: [Wireshark-dev] Patch: Prepare for some cleanups of 802.11ad

2015-08-22 Thread Richard Sharpe
On Sat, Aug 22, 2015 at 12:09 PM, Richard Sharpe wrote: > On Sat, Aug 22, 2015 at 11:43 AM, Guy Harris wrote: >> >> On Aug 22, 2015, at 7:46 AM, Richard Sharpe >> wrote: >> >>> As part of fixing some problems in the 802.11ad dissector that I am >>> aware of >> >> Presumably you have 802.11ad ca

Re: [Wireshark-dev] Patch: Prepare for some cleanups of 802.11ad

2015-08-22 Thread Guy Harris
On Aug 22, 2015, at 12:17 PM, Richard Sharpe wrote: > Hmmm, looking at this again, I wonder if it should not contain an MCS > field, because the radiotap dissector thinks that mean > PHDR_802_11_PHY_11N. Well, *if* there's useful radio information for 802.11ad that isn't provided by the MCS o

Re: [Wireshark-dev] Patch: Prepare for some cleanups of 802.11ad

2015-08-22 Thread Richard Sharpe
On Sat, Aug 22, 2015 at 12:53 PM, Guy Harris wrote: > > On Aug 22, 2015, at 12:17 PM, Richard Sharpe > wrote: > >> Hmmm, looking at this again, I wonder if it should not contain an MCS >> field, because the radiotap dissector thinks that mean >> PHDR_802_11_PHY_11N. > > Well, *if* there's useful

Re: [Wireshark-dev] Patch: Prepare for some cleanups of 802.11ad

2015-08-22 Thread Guy Harris
On Aug 22, 2015, at 1:09 PM, Richard Sharpe wrote: > Also, I now see that sections 9.7.5a.4 and 9.7.5a.5 imply that MCS > headers are appropriate for an 802.11ad capture, I'm not so sure about that. 802.11ad-2012 has Clause 21, which says: The DMG PHY supports three modulation methods

Re: [Wireshark-dev] Patch: Prepare for some cleanups of 802.11ad

2015-08-22 Thread Richard Sharpe
On Sat, Aug 22, 2015 at 1:32 PM, Guy Harris wrote: > > On Aug 22, 2015, at 1:09 PM, Richard Sharpe > wrote: > >> Also, I now see that sections 9.7.5a.4 and 9.7.5a.5 imply that MCS >> headers are appropriate for an 802.11ad capture, > > I'm not so sure about that. > > 802.11ad-2012 has Clause 21,

Re: [Wireshark-dev] Patch: Prepare for some cleanups of 802.11ad

2015-08-22 Thread Guy Harris
On Aug 22, 2015, at 1:44 PM, Richard Sharpe wrote: > On Sat, Aug 22, 2015 at 1:32 PM, Guy Harris wrote: > >> No, I'd add a DMG field to radiotap, containing, among other values, an mcs >> subfield, with a Clause 21 MCS value in it. > > Yes, in an ideal world. However, there will likely be ca

Re: [Wireshark-dev] Patch: Prepare for some cleanups of 802.11ad

2015-08-22 Thread Guy Harris
On Aug 22, 2015, at 2:30 PM, Guy Harris wrote: > So software that reads radiotap captures and that cares about 11ad > information needs to have a workaround wherein frames lacking a DMG field > (which means "all frames", currently, as there isn't yet a DMG field) and > having a channel freque

Re: [Wireshark-dev] Patch: Prepare for some cleanups of 802.11ad

2015-08-22 Thread Guy Harris
On Aug 22, 2015, at 7:46 AM, Richard Sharpe wrote: > diff --git a/wiretap/wtap.h b/wiretap/wtap.h > index 8de0c30..11d460d 100644 > --- a/wiretap/wtap.h > +++ b/wiretap/wtap.h > @@ -571,6 +571,7 @@ struct p2p_phdr { > #define PHDR_802_11_PHY_11G6 /* 802.11g */ > #define PHDR_802_11_P

Re: [Wireshark-dev] Patch: Prepare for some cleanups of 802.11ad

2015-08-22 Thread Guy Harris
On Aug 22, 2015, at 2:30 PM, Guy Harris wrote: > So software that reads radiotap captures and that cares about 11ad > information needs to have a workaround wherein frames lacking a DMG field > (which means "all frames", currently, as there isn't yet a DMG field) and > having a channel freque

Re: [Wireshark-dev] Patch: Prepare for some cleanups of 802.11ad

2015-08-22 Thread Richard Sharpe
On Sat, Aug 22, 2015 at 4:57 PM, Guy Harris wrote: > > On Aug 22, 2015, at 2:30 PM, Guy Harris wrote: > >> So software that reads radiotap captures and that cares about 11ad >> information needs to have a workaround wherein frames lacking a DMG field >> (which means "all frames", currently, as

Re: [Wireshark-dev] Display IPv6 extension headers outside of the IPv6 subtree

2015-08-22 Thread João Valverde
On 08/21/2015 05:45 PM, João Valverde wrote: Hi, I would like to propose a patch to remove IPv6 extension headers from the IPv6 subtree and display them as normal IP protocols in the UI. Arguments for: a) The current behaviour really, really, (really) hurts legibility b) It would be consiste

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-22 Thread Guy Harris
On Aug 21, 2015, at 10:55 PM, Yang Luo wrote: > Npcap 0.04 r5 has added the DLT_NULL protocol support, you need to check the > "Use DLT_NULL protocol as loopback packets' link layer instead of Ethernet > II" option when installing (default is not checked). The problem is Wireshark > didn't re

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-22 Thread Guy Harris
On Aug 22, 2015, at 11:07 AM, Pascal Quantin wrote: > DLT_NULL does not work as expected because Npcap is still providing a > linktype of type Ethernet instead of Null. I was able to fix the > encapsulation of a captue by running editcap -T null dlt_null.pcapng > dlt_null_fixed.pcapng. OK, t

[Wireshark-dev] The 'in' display filter operation

2015-08-22 Thread Jeffrey Smith
I decided to try my hand implementing the 'in' operator. I used the syntax 'x in {a,b,c}' (with commas). In code I created a set type that contains a GSList of stnode_t's. At the gencode layer, I effectively generate an OR-ed series of equality operations, but I cut out the redundant existence o