Re: [Wireshark-dev] Wireshark 0.99.5pre2 is now available

2007-01-30 Thread Ulf Lamping
Stephen Fisher wrote: > When I click on Help->Contents, I'm getting the error: > > HTML Help Author Message > - > The window name "Wireshark Help" passed to HH_GET_WIN_TYPE has not been > specified. > > I wasn't getting that when the Windows HTML Help was first introduced.

[Wireshark-dev] Win32 buildbot should switch over to use Makefile.nmake

2007-01-30 Thread Ulf Lamping
Hi! The Win32 buildbot currently fails to generate the docbook docs. This is due to problems with generating the svn_version.xml, and that is due to the known bash CR/NL problems. Instead of trying to fix this, the buildbot should use the new Makefile.nmake (I've recently checked it in) which

Re: [Wireshark-dev] [Wireshark-users] [ANNOUNCE] WinPcap 4.0 hasbeen released

2007-01-30 Thread Gianluca Varenni
- Original Message - From: "Bill Meier" <[EMAIL PROTECTED]> To: "Wireshark Developer mailinglist" Cc: "Wireshark Developer mailinglist" Sent: Tuesday, January 30, 2007 5:58 PM Subject: Re: [Wireshark-dev] [Wireshark-users] [ANNOUNCE] WinPcap 4.0 hasbeen released >> Whoah there! :)

[Wireshark-dev] U3 questions/remarks

2007-01-30 Thread Ulf Lamping
Hi List! As I'm a proud owner of an U3 stick now, I can test this ;-) Some minor things I've noticed: - All programs I've installed on the stick (OpenOffice, Firefox, Winamp, ...) either shows only the program name "Winamp", or the suffix "for U3" like in "Mozilla Firefox for U3". Wireshark s

Re: [Wireshark-dev] [PATCH] New menu items to copy packet data

2007-01-30 Thread Ulf Lamping
Stephen Fisher wrote: > On Mon, Jan 29, 2007 at 10:22:15AM -, Douglas Pratley wrote: > >> Are there any other encodings / decodings it would be worth having >> available (uuencode? zip?). This might be better done as a full >> "Select bytes and decode / encode" feature rather than somethin

Re: [Wireshark-dev] [PATCH] New menu items to copy packet data

2007-01-30 Thread Ulf Lamping
Douglas Pratley wrote: >> 2.) Packet Details / Copy item (only one Copy item in this menu): >> Description >> -- >> Bytes (Offset Hex Text) >> Bytes (Offset Hex) >> Bytes (Printable Text Only) >> -- >> Bytes (Hex Stream) >> Bytes (Binary Stream) >> > I agree

Re: [Wireshark-dev] [Wireshark-commits] rev 20609: /trunk//trunk/:config.h.win32

2007-01-30 Thread Ulf Lamping
Douglas Pratley wrote: > Hi Ulf > > 20614 builds for me. I haven't had a chance to look at it in any more > detail yet. If I get time I will try to test some of the invalid > configurations to see if the logic actually catches the invalid cases! > (I assume you can confirm that it works for the 200

Re: [Wireshark-dev] Compiling for Win32 - small addition

2007-01-30 Thread Ulf Lamping
Mattias Sandstrom wrote: > Thank you for a perfect instruction on how to setup the build env! > :-) > However, I found a needed addition to be able to compile; the HTML Help > Workshop is needed. > Found download at: > http://www.microsoft.com/downloads/details.aspx?familyid=00535334-C8A6-452F

Re: [Wireshark-dev] Problem with uint preference

2007-01-30 Thread Jeff Morriss
Hal Lander wrote: > I registered a boolean preference and it worked. > However, when I try and follow the same process with a uint it fails > when I try and edit the preference and 'apply' the change. The message I > get is; > > "The value for "xxTitle" isn't a valid number." [...] > T

Re: [Wireshark-dev] [Wireshark-users] [ANNOUNCE] WinPcap 4.0 has been released

2007-01-30 Thread Bill Meier
> Whoah there! :) I just copied WinPcap 4.0 into the 0.99.5 trunk, and > plan on releasing 0.99.5pre2 later today. I'll send a message when it's > ready. > > I'm hoping to have 0.99.5 final out on Thursday or Friday. > This may be premature (or not relevant), but just in case: Is there a ne

Re: [Wireshark-dev] Wireshark 0.99.5pre2 is now available

2007-01-30 Thread Jeff Morriss
Stephen Fisher wrote: > On Tue, Jan 30, 2007 at 04:48:33PM -0800, Gerald Combs wrote: > >> Wireshark 0.99.5pre2 is now available for testing. Source code and a >> Windows installer can be downloaded immediately from > > When I click on Help->Contents, I'm getting the error: > > HTML Help Aut

Re: [Wireshark-dev] Wireshark 0.99.5pre2 is now available

2007-01-30 Thread Stephen Fisher
On Tue, Jan 30, 2007 at 04:48:33PM -0800, Gerald Combs wrote: > Wireshark 0.99.5pre2 is now available for testing. Source code and a > Windows installer can be downloaded immediately from When I click on Help->Contents, I'm getting the error: HTML Help Author Message -

Re: [Wireshark-dev] how to extract field value from tethereal using edt

2007-01-30 Thread Jeff Morriss
Himanshu Nayak wrote: > *how to extract field value from tethereal using edt* > > Q.my question: > The below shows the output of pdml generated by tethereal. > how can i find out the value=85(red line) from the below using e

[Wireshark-dev] Use ethereal as a proprietary protocol parser; no ethernet/IP decoding

2007-01-30 Thread Tom McLaughlin
Hello, I work for a company that build proprietary communication systems for the utility industry. We have a proprietary communcation protocol that can be wrapped in several standard protocols. I would like to build a log parser that looks like Ethereal for our protocol if possible. This woul

[Wireshark-dev] Compiling for Win32 - small addition

2007-01-30 Thread Mattias Sandstrom
Thank you for a perfect instruction on how to setup the build env! However, I found a needed addition to be able to compile; the HTML Help Workshop is needed. Found download at: http://www.microsoft.com/downloads/details.aspx?familyid=00535334-C8A6-452F-9AA0-D597D16580CC&displaylang=en Cheers, /

[Wireshark-dev] Wireshark 0.99.5pre2 is now available

2007-01-30 Thread Gerald Combs
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Wireshark 0.99.5pre2 is now available for testing. Source code and a Windows installer can be downloaded immediately from http://www.wireshark.org/download/prerelease/wireshark-0.99.5pre2.tar.gz http://www.wireshark.org/download/prerelease/wireshark-

Re: [Wireshark-dev] [PATCH] Fixup for a segfault with gtk1.2

2007-01-30 Thread Ulf Lamping
Stephen Fisher wrote: > On Tue, Jan 23, 2007 at 12:14:05AM +0100, Sebastien Tandel wrote: > > >>I was wondering whether it couldn't be easier to replace the >> g_strsplit of gtk1.2 by the one implemented in gtk2. It will be far >> more easier to avoid problems in the current dissectors and

Re: [Wireshark-dev] [Wireshark-commits] rev 20627: /trunk/docbook/ /trunk/docbook/: Makefile

2007-01-30 Thread Ulf Lamping
[EMAIL PROTECTED] wrote: > http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=20627 > > User: jake > Date: 2007/01/30 06:06 PM > > Log: > Based on suggestion from Guy Harris. > Trying to get things working on Win32 (cygwin) and GNU/Linux etc. > > I've recently checked in a Makefi

[Wireshark-dev] "Cisco format" MAC addresses in display filters?

2007-01-30 Thread Stephen Fisher
How hard would it be to allow the display filter to accept "Cisco format" MAC addresses (..) and still match the usual format (xx:xx:xx:xx:xx:xx)? Where would I change this? Steve ___ Wireshark-dev mailing list Wireshark-dev@wireshark.or

Re: [Wireshark-dev] What about a universal XML parsing dissector

2007-01-30 Thread Guy Harris
On Jan 30, 2007, at 11:07 AM, John R. wrote: > Sequence, iteration, algorithms, > etc. are more naturally handled in code than XML document (that didn't > stop the abomination that is XSLT though ;-) ). Nor did it stop NetPDL: http://www.nbee.org/Docs/NetPDL/Version0.1/NetPDL.htm

Re: [Wireshark-dev] What about a universal XML parsing dissector

2007-01-30 Thread Gerald Combs
John R. wrote: > NetPDL or things like it are the way to do this. However, it is not > realistic to think that you will never need to have hooks in the XML > descriptors for custom code. For example, say Protocol X uses some > funny encoding for a field that no one else uses (beyond just shifts >

Re: [Wireshark-dev] [PATCH] update wiretap and USB dissector

2007-01-30 Thread Guy Harris
Paolo Abeni wrote: > I also updated the wiki USB page: > > http://wiki.wireshark.org/USB It currently says > For linux kernel version less then 2.6.21 the usb data is provided by > the means of a 'text' API, which limit the storage for captured data to > 32 bytes. This kind of API requires deb

Re: [Wireshark-dev] [Patch] SCSI persistent reserve out

2007-01-30 Thread Stephen Fisher
On Thu, Jan 25, 2007 at 12:56:39PM +0100, Patrick vd Lageweg wrote: > The PERSISTENT REVERVE OUT dissectors uses the table of the PERSISTENT > REVERVE IN command to decode the Service Action field which is > obviously not correct. This patch fixes the problem. I have checked in your patch as SV

Re: [Wireshark-dev] [PATCH] New menu items to copy packet data

2007-01-30 Thread Stephen Fisher
On Mon, Jan 29, 2007 at 10:04:20AM -, Douglas Pratley wrote: > Try this - the tar / gzip tools I have on Windows seem to be a bit > tempermental, which is why I have been avoiding them, but if Outlook > is going to mangle the files... I got the images but not the patch this time ;). The do

Re: [Wireshark-dev] [REPOST][PATCH] update USB dissector

2007-01-30 Thread Guy Harris
Paolo Abeni wrote: On Fri, 2007-01-26 at 23:39 -0500, Charles Lepple wrote: One problem is that the proto_tree_add_* calls set the little_endian flag to true regardless of the endianness of the host. This is a bug. Thanks for pointing it out. The attached patch should solve it. I renew the

Re: [Wireshark-dev] [PATCH] update wiretap and sub dissector

2007-01-30 Thread Guy Harris
Charles Lepple wrote: > For instance, if I create a .pcap file with "text2pcap -l 189 ..." on > a big-endian machine, then the .pcap file seems not to have the > byte-swapped flag set. There's no byte-swapped flag in a libpcap file. There's only a magic number, which is written out in host byte

Re: [Wireshark-dev] How do I get my dissector to work in the Display Filter

2007-01-30 Thread Stephen Fisher
On Tue, Jan 30, 2007 at 01:02:33AM -0900, Hal Lander wrote: > My plugin heuristic dissector foo seems to work fine, except I cannot > filter on it. If I type foo in the filter box the box goes pink. > However if I type foo.len (one of my fields), the box goes green. If I > click the 'Expression

Re: [Wireshark-dev] Dissecting Objects

2007-01-30 Thread Stephen Fisher
On Thu, Jan 25, 2007 at 02:30:43AM -0800, David Dugoujon wrote: > I am writing a plugin for several protocols (Tier2 architecture) that > share common object types. I have to analyse these objects before I > can determine their size. I would like to know what is the best method > to dissect the

Re: [Wireshark-dev] [Wireshark-commits] rev 20608: /trunk/gtk/ /trunk/gtk/: sctp_assoc_analyse.c sctp_stat.c sctp_stat.h sctp_stat_dlg.c

2007-01-30 Thread Gerald Combs
Done. Michael Tuexen wrote: > Gerald, > > could you please copy this over to 0.99.5 tree? These are bugfixes which > improves the handling of some SCTP trace captured in real life > traces. > > Best regards > Michael > On Jan 29, 2007, at 8:45 PM, [EMAIL PROTECTED] wrote: > >> http://anonsvn.wi

Re: [Wireshark-dev] [PATCH] Fixup for a segfault with gtk1.2

2007-01-30 Thread Stephen Fisher
On Tue, Jan 23, 2007 at 12:14:05AM +0100, Sebastien Tandel wrote: >I was wondering whether it couldn't be easier to replace the > g_strsplit of gtk1.2 by the one implemented in gtk2. It will be far > more easier to avoid problems in the current dissectors and in the > future. > > Write a n

Re: [Wireshark-dev] [PATCH] New menu items to copy packet data

2007-01-30 Thread Stephen Fisher
On Mon, Jan 29, 2007 at 10:22:15AM -, Douglas Pratley wrote: > > - Removed base64 encoding support as we discussed. This leaves > > room for a base64 decoder as a future feature. > > Could you give an example of how you might see this working, perhaps > with a capture file? > Some initial

Re: [Wireshark-dev] What about a universal XML parsing dissector

2007-01-30 Thread John R.
On 1/30/07, Mark H. Wood <[EMAIL PROTECTED]> wrote: > ASN.1 was designed specifically for that sort of thing. Not really. ASN.1 is a standard description format for new protocols. It is not designed to, nor is it capable of describing arbitrary existing protocols. If a new encoding were arrived at

Re: [Wireshark-dev] wireshark-setup-0.99.5pre2-20620.exe large icon missing

2007-01-30 Thread Jaap Keuter
Hi, Ehh, subversion says on trunk/image/wireshark.ico: svn-mimetype image/image/x-icon Thanx, Jaap On Tue, 30 Jan 2007, Gerald Combs wrote: > Jaap Keuter wrote: > > Hi list, > > > > When downloading the Win32 installer on WinXP SP2 and looking at the > > properties of it, there's no icon. I see

Re: [Wireshark-dev] wireshark-setup-0.99.5pre2-20620.exe large icon missing

2007-01-30 Thread Gerald Combs
Jaap Keuter wrote: > Hi list, > > When downloading the Win32 installer on WinXP SP2 and looking at the > properties of it, there's no icon. I see that the icon used if the > bevelled one, I don't know what the firefox download window and the > properties tab uses. Can you check the properties for

Re: [Wireshark-dev] What about a universal XML parsing dissector

2007-01-30 Thread Guy Harris
Mark H. Wood wrote: > ASN.1 was designed specifically for that sort of thing. Could we invent encoding rules that would allow, for example, TCP and IP to be represented in ASN.1? If not, it wouldn't be universal. ___ Wireshark-dev mailing list Wireshar

Re: [Wireshark-dev] [Wireshark-users] [ANNOUNCE] WinPcap 4.0 has been released

2007-01-30 Thread Gerald Combs
Whoah there! :) I just copied WinPcap 4.0 into the 0.99.5 trunk, and plan on releasing 0.99.5pre2 later today. I'll send a message when it's ready. I'm hoping to have 0.99.5 final out on Thursday or Friday. Jaap Keuter wrote: > Hi List, > > On the back of WinPCap 4.0 our fearless leader has

Re: [Wireshark-dev] [PATCH] New menu items to copy packet data

2007-01-30 Thread Douglas Pratley
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Ulf Lamping > Sent: 28 January 2007 04:40 > To: wireshark-dev@wireshark.org > Subject: Re: [Wireshark-dev] [PATCH] New menu items to copy > packet data > > Nice work! Thanks > > As usual some GU

Re: [Wireshark-dev] [Wireshark-commits] rev 20609: /trunk//trunk/:config.h.win32

2007-01-30 Thread Douglas Pratley
Hi Ulf 20614 builds for me. I haven't had a chance to look at it in any more detail yet. If I get time I will try to test some of the invalid configurations to see if the logic actually catches the invalid cases! (I assume you can confirm that it works for the 2005 build). I have a feeling that p

Re: [Wireshark-dev] What about a universal XML parsing dissector

2007-01-30 Thread Mark H. Wood
ASN.1 was designed specifically for that sort of thing. -- Mark H. Wood, Lead System Programmer [EMAIL PROTECTED] Typically when a software vendor says that a product is "intuitive" he means the exact opposite. pgpTtZfELiK8u.pgp Description: PGP signature

Re: [Wireshark-dev] What about a universal XML parsing dissector

2007-01-30 Thread Wiese, Hendrik
Looks nice... is it already implemented into Wireshark, somewhere? > How about NetPDL? > http://www.nbee.org/Docs/NetPDL/Version0.1/NetPDL.htm > > Thanx, > Jaap > > On Tue, 30 Jan 2007, Wiese, Hendrik wrote: > > > Hello list members, > > > > what do you think, is it possible to write some kind

Re: [Wireshark-dev] What about a universal XML parsing dissector

2007-01-30 Thread Jaap Keuter
Hi, How about NetPDL? http://www.nbee.org/Docs/NetPDL/Version0.1/NetPDL.htm Thanx, Jaap On Tue, 30 Jan 2007, Wiese, Hendrik wrote: > Hello list members, > > what do you think, is it possible to write some kind of a dissector that > parses a bunch of XML based "protocol description files" and ad

Re: [Wireshark-dev] RFC2733 implications for the RTP header extension (X) bit

2007-01-30 Thread Jaap Keuter
Hi, The problem with the current RTP dissector is that it is unaware of the profile being used for the session. Therefor it has no knowledge how to interpret the various fields in various circumstances. A number of bugs have been filed just because of this reason. Adding generic profile support wo

Re: [Wireshark-dev] [Wireshark-commits] rev 20609: /trunk/ /trunk/:config.h.win32

2007-01-30 Thread Ulf Lamping
Douglas Pratley wrote: > The logic of this looks wrong to me in one sense - the message tells you > that your compiler is 14.00 when it is not (I'm still using 12.00). I > would have thought it should be reversed, so that given a compiler > number, it checks that the variant is one of the accepted

[Wireshark-dev] Adding SHIM6 (IPv6 extension header)

2007-01-30 Thread Matthijs Mekking
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello, I am currently working on adding SHIM6 dissection. I put this on the ML, to inform you about this, so that if somebody else is working on the same subject, double work can be avoided. So far, I haven't found anybody yet, that is doing the same.

[Wireshark-dev] Problem with uint preference

2007-01-30 Thread Hal Lander
I registered a boolean preference and it worked. However, when I try and follow the same process with a uint it fails when I try and edit the preference and 'apply' the change. The message I get is; "The value for "xxTitle" isn't a valid number." If I comment out the call to prefs_regi

Re: [Wireshark-dev] bootstrapping SVN checkout

2007-01-30 Thread Luis Ontanon
svn co ... && have you called ./autogen.sh before configure? sh ./autogen.sh On 1/30/07, Andreas Fink <[EMAIL PROTECTED]> wrote: > Hello, > > I've just done a SVN checkout of the sources into a new directory. > I have troubles to "bootstrap" this version as there is no "configure" file. > So I

Re: [Wireshark-dev] Problem testing patch on Fedora

2007-01-30 Thread Douglas Pratley
Problem solved. User error - didn't clean up properly after doing a revert. D'oh. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Douglas Pratley Sent: 30 January 2007 11:14 To: Developer support list for Wireshark

[Wireshark-dev] Problem testing patch on Fedora

2007-01-30 Thread Douglas Pratley
Hi guys I've developed a patch on Windows that includes some new code files. I created the patch using Tortoise / Create Patch, copied across to a Fedora core version 6 box and applied it using patch -p0 < mypatch.patch. The problem is that for the new files the original file contents appears thr

[Wireshark-dev] What about a universal XML parsing dissector

2007-01-30 Thread Wiese, Hendrik
Hello list members, what do you think, is it possible to write some kind of a dissector that parses a bunch of XML based "protocol description files" and adds the corresponding protocols to the list? This would make dissector development much easier. Just a crazy idea from a guy who's starting in

[Wireshark-dev] How do I get my dissector to work in the Display Filter

2007-01-30 Thread Hal Lander
My plugin heuristic dissector foo seems to work fine, except I cannot filter on it. If I type foo in the filter box the box goes pink. However if I type foo.len (one of my fields), the box goes green. If I click the 'Expression...' button I can see my protocol and all the fields I declared. I m

[Wireshark-dev] RFC2733 implications for the RTP header extension (X) bit

2007-01-30 Thread Mark Lewis
RFC2733 "An RTP Payload Format for Generic Forward Error Correction" requires the RTP header extension (X) bit to be used in an otherwise non-standard way. The header extension is never present, independent of the value of the X bit. The X bit contains the result of the FEC protection operation as

Re: [Wireshark-dev] [Wireshark-commits] rev 20609: /trunk/ /trunk/:config.h.win32

2007-01-30 Thread Douglas Pratley
The logic of this looks wrong to me in one sense - the message tells you that your compiler is 14.00 when it is not (I'm still using 12.00). I would have thought it should be reversed, so that given a compiler number, it checks that the variant is one of the accepted values. More importantly, I tr

Re: [Wireshark-dev] How to represent range values using range_string

2007-01-30 Thread Francesco Fondelli
On 1/26/07, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > > > Hi , Hi, > I had mailed to the forum regarding how to use range_string, > but not received any reply yet . As far as I know Sebastien Tandel's patch is not yet checked in: http://www.wireshark.org/lists/wireshark-dev/200701/msg003

[Wireshark-dev] wireshark-setup-0.99.5pre2-20620.exe large icon missing

2007-01-30 Thread Jaap Keuter
Hi list, When downloading the Win32 installer on WinXP SP2 and looking at the properties of it, there's no icon. I see that the icon used if the bevelled one, I don't know what the firefox download window and the properties tab uses. Thanx, Jaap ___ Wi

[Wireshark-dev] [REPOST][PATCH] update USB dissector (was: update wiretap and sub dissector)

2007-01-30 Thread Paolo Abeni
On Fri, 2007-01-26 at 23:39 -0500, Charles Lepple wrote: > One problem is that the proto_tree_add_* calls set the little_endian > flag to true regardless of the endianness of the host. This is a bug. Thanks for pointing it out. The attached patch should solve it. I renew the pledge for reviewing