Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-06 Thread Martin Mathieson
Could you possibly post a capture file that includes the RTSP signalling? We should be configuring the RTP stream with the dynamic payload type so that it can be displayed properly... On Wed, Mar 5, 2008 at 11:08 PM, Fabiana moreno <[EMAIL PROTECTED]> wrote: > Well it's my final year project and

[Wireshark-users] Distinguishing Ethernet II and 802.3 frames

2008-03-06 Thread Marcus Better
Hi, I'm looking at some traffic in our LAN, and think I have some problems with Ethernet II vs 802.3 framing. Wireshark shows lots of Ethernet II frames with "unknown" frame type 0x05ec (=1516 decimal). Since that is less than 0x0600, the limit for Ethernet frames, shouldn't Wireshark interpret t

Re: [Wireshark-users] Distinguishing Ethernet II and 802.3 frames

2008-03-06 Thread Guy Harris
Marcus Better wrote: > I'm looking at some traffic in our LAN, and think I have some problems with > Ethernet II vs 802.3 framing. > > Wireshark shows lots of Ethernet II frames with "unknown" frame type 0x05ec > (=1516 decimal). Since that is less than 0x0600, the limit for Ethernet > frames, sh

Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-06 Thread Fabiana moreno
If you dont want to open any attachment..then this is a sample of what i see when im capturing 94 0.695962192.168.123.100 192.168.123.101 TCP Interleaved channel 0x00, 1356 bytes 95 0.696016192.168.123.101 192.168.123.100 TCP bcs-broker > rtsp [ACK] Seq=1 Ack=6

Re: [Wireshark-users] Distinguishing Ethernet II and 802.3 frames

2008-03-06 Thread Marcus Better
Guy Harris wrote: > maxValidFrame is 1500, so if the length/type field has a value in the > range 1501 through 1535, 802.3-2005 doesn't specify how to interpret the > frame. I see, thanks for the explanation. > Unfortunately, OS X doesn't follow in the footsteps of > {Free,Net,Open,DragonFly}BSD

Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-06 Thread Martin Mathieson
When we set up RTP streams (including passing information about dynamic payload types), we assume that its over UDP. It would be good to fix this. But in the meantime, can't you configure your RTSP server or client to use UDP/RTP transport for the media? On Thu, Mar 6, 2008 at 11:10 AM, Fabiana

Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-06 Thread Fabiana moreno
When i decode to udp and hence to rtp to analyse the jitter, and the delays then i get that problem of unknowns that i mentioned On 06/03/2008, Fabiana moreno <[EMAIL PROTECTED]> wrote: > > If you dont want to open any attachment..then this is a sample of what i > see when im capturing > > 94

Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-06 Thread Fabiana moreno
Thanks!! i do think i need that! On 06/03/2008, Martin Mathieson <[EMAIL PROTECTED]> wrote: > > When we set up RTP streams (including passing information about dynamic > payload types), we assume that its over UDP. It would be good to fix this. > > But in the meantime, can't you configure your RT

[Wireshark-users] dissector colse/cleanup function

2008-03-06 Thread Ravid Gabbay
Can my dissector register a cleanup function that will be called upon tshark termination? ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users

Re: [Wireshark-users] IO Graphs cumulative plot

2008-03-06 Thread Michele Pedrolli
Il giorno 05/mar/08, alle ore 22:13, Stig Bjørlykke ha scritto: > If this should work I suppose we should add yet another cumulative > bytes counter. Discussion moved to wireshark-dev. -- Michele ___ Wireshark-users mailing list Wire

Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-06 Thread Martin Mathieson
In order to help get this implemented, could you please create an enhancement request at http://bugs.wireshark.org and attach a sample trace showing the problem? I don't know how soon I or someone else might find time to work on this, so I would suggest pursuing the UDP/RTP route, if possible On

Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-06 Thread Martin Mathieson
Yes, but have you tried to configure preferences in the RTSP client or server to encourage it to use RTP over UDP instead (the RTSP protocol allows this). On Thu, Mar 6, 2008 at 10:52 AM, Fabiana moreno <[EMAIL PROTECTED]> wrote: > That´s is the thing... i am not seeing any udp packets in my capt

[Wireshark-users] Bug report - Follow TCP Stream conversation selection incorrect

2008-03-06 Thread Guy Bruneau
Hi, I would like to report a new bug affecting the "Follow TCP Stream". Since version 99.7 (99.8 has this issue as well), both Linux and Windows versions show the wrong conversation when selecting the client or server. While in the "Follow TCP Stream" window, the Entire conversation is fine but wh

Re: [Wireshark-users] Bug report - Follow TCP Stream conversation selection incorrect

2008-03-06 Thread Jaap Keuter
Hi, We've created a nice database to make sure none of these reports go missing. Please visit bugs.wireshark.org and file your bug there. Thanx, Jaap Guy Bruneau wrote: > Hi, > I would like to report a new bug affecting the "Follow TCP Stream". > Since version 99.7 (99.8 has this issue as well)

Re: [Wireshark-users] Distinguishing Ethernet II and 802.3 frames

2008-03-06 Thread Stephen Fisher
On Thu, Mar 06, 2008 at 11:28:51AM +0100, Marcus Better wrote: > I'm running Wireshark on Linux 2.6.24 though (mac80211 stack). Can it > give me the 802.11 frames? Try looking through this page http://wiki.wireshark.org/CaptureSetup/WLAN Steve ___ W

Re: [Wireshark-users] Bug report - Follow TCP Stream conversation selection incorrect

2008-03-06 Thread Stephen Fisher
On Thu, Mar 06, 2008 at 08:08:17AM -0500, Guy Bruneau wrote: > I would like to report a new bug affecting the "Follow TCP Stream". > Since version 99.7 (99.8 has this issue as well), both Linux and > Windows versions show the wrong conversation when selecting the client > or server. While in t

Re: [Wireshark-users] Distinguishing Ethernet II and 802.3 frames

2008-03-06 Thread Guy Harris
Marcus Better wrote: > I'm running Wireshark on Linux 2.6.24 though (mac80211 stack). Can it give > me the 802.11 frames? That probably depends on the adapter, but, as you're using the mac80211 stack, the driver for the adapter is probably reasonably modern, so, if the adapter supports monitor

[Wireshark-users] Tshark -Tfields output

2008-03-06 Thread Rob MacKenzie
The tshark app has the ability to output custom fields with -Tfields, but only specific protocol data is available to be output. Is there a way to access the "Information" field, such as that displayed by default in the packet list in Wireshark? If not, I can work with dev to perhaps add it to th

Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-06 Thread Fabiana moreno
Hey Martin i configured my client to listen to port 7070(udp) So, now in my captures i just see udp packets..that's fine But when i try to decode to rtp...there's the same error... i should be able to decode udp to rtp smoothly right? On 06/03/2008, Martin Mathieson <[EMAIL PROTECTED]> wrote: > >

Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-06 Thread Martin Mathieson
Did you turn on the RTP heuristic dissector in the RTP dissector preferences? Could you possibly send a capture file? On Thu, Mar 6, 2008 at 9:02 PM, Fabiana moreno <[EMAIL PROTECTED]> wrote: > Hey Martin i configured my client to listen to port 7070(udp) > So, now in my captures i just see udp

Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-06 Thread Fabiana moreno
no i havent done sowhere is the rtp dissector preferences??? thanks On 06/03/2008, Martin Mathieson <[EMAIL PROTECTED]> wrote: > > Did you turn on the RTP heuristic dissector in the RTP dissector > preferences? > > Could you possibly send a capture file? > > > On Thu, Mar 6, 2008 at 9:02 PM, F

Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-06 Thread Martin Mathieson
Its in Edit | Preferences | Protocols | RTP | 'Try to decode RTP outside of a conversation'. Reading your very first post, however, shows that you've already seen these decoded as RTP... Can you post a UDP capture? On Thu, Mar 6, 2008 at 9:37 PM, Fabiana moreno <[EMAIL PROTECTED]> wrote: > no i

Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-06 Thread Fabiana moreno
that capture is just udp without decoding to RTP.. On 06/03/2008, Fabiana moreno <[EMAIL PROTECTED]> wrote: > > the first post was when i already had decoded udp data into rtp... > here's my capture > > On 06/03/2008, Martin Mathieson <[EMAIL PROTECTED]> wrote: > > > > Its in Edit | Preferences |