[Wireshark-dev] Problem with a flag in a 32 bit field

2010-10-14 Thread Graham Bloice
I'm having trouble picking out a bit flag from a 32 bit field. Can anyone point out where I'm going wrong? The field is transmitted on the wire in little endian order; b0 b1 b2 b3, bits 0 - 30 are a block number and the flag I'm interested is bit 31, the top bit of b3. I add the item to the

Re: [Wireshark-dev] Problem with a flag in a 32 bit field

2010-10-14 Thread Christopher Maynard
Graham Bloice graham.blo...@... writes: and the hf def is:   { hf_item,   { A flag, dissector.flag, FT_BOOLEAN, 32, TFS(tfs_set_notset), 0x8000, A flag, HFILL }},   Does this work? { hf_item, { A flag, dissector.flag, FT_BOOLEAN, 32,

Re: [Wireshark-dev] How to add a wtap encapsulation?

2010-10-14 Thread Yo Mismo
I haven't got #define WTAP_ENCAP_IEEE802_15_4_NOFCS127 in wtap.h :(I have been reading pcap-common.c, I haven't asked for a new DLT_ value because my dissector and the encapsulation are for academic purpose only and wont be used in future. I don't know if this is your problem

[Wireshark-dev] dissector-plugins

2010-10-14 Thread Lange Jan-Erik
Hello, there is the posibility in wireshark to create a dissector-plugin. I want to dissect a packet which is not even conform to the ethernet protocol. Is it possible to create such a dissector plugin in this low level? Best regards Jan

Re: [Wireshark-dev] Problem with a flag in a 32 bit field

2010-10-14 Thread Graham Bloice
On 14/10/2010 15:05, Christopher Maynard wrote: Graham Bloice graham.blo...@... writes: and the hf def is: { hf_item, { A flag, dissector.flag, FT_BOOLEAN, 32, TFS(tfs_set_notset), 0x8000, A flag, HFILL }}, Does this work? { hf_item, { A

Re: [Wireshark-dev] How to add a wtap encapsulation?

2010-10-14 Thread Guy Harris
On Oct 13, 2010, at 8:48 AM, Yo Mismo wrote: I haven't got #define WTAP_ENCAP_IEEE802_15_4_NOFCS127 in wtap.h :( You probably have an older version of Wireshark. I have been reading pcap-common.c, I haven't asked for a new DLT_ value because my dissector and the

Re: [Wireshark-dev] dissector-plugins

2010-10-14 Thread Jaap Keuter
On 10/14/2010 04:12 PM, Lange Jan-Erik wrote: Hello, there is the posibility in wireshark to create a dissector-plugin. I want to dissect a packet which is not even conform to the ethernet protocol. Is it possible to create such a dissector plugin in this low level? Best regards Jan Hi,

Re: [Wireshark-dev] Need help with decrypting wireshark data....

2010-10-14 Thread Al
I am pretty sure i am on the right server since the key is loaded and i checked netstat and found the ip of the webservice... but still from wire shark the client basically does handshake and cert check with server and then afterwards server just sends fin and ends it really not sure whats

[Wireshark-dev] buildbot failure in Wireshark (development) on Solaris-10-SPARC

2010-10-14 Thread buildbot-no-reply
The Buildbot has detected a new failure of Solaris-10-SPARC on Wireshark (development). Full details are available at: http://buildbot.wireshark.org/trunk/builders/Solaris-10-SPARC/builds/995 Buildbot URL: http://buildbot.wireshark.org/trunk/ Buildslave for this Build: solaris-10-sparc Build

[Wireshark-dev] buildbot failure in Wireshark (development) on Ubuntu-10.04-x64

2010-10-14 Thread buildbot-no-reply
The Buildbot has detected a new failure of Ubuntu-10.04-x64 on Wireshark (development). Full details are available at: http://buildbot.wireshark.org/trunk/builders/Ubuntu-10.04-x64/builds/629 Buildbot URL: http://buildbot.wireshark.org/trunk/ Buildslave for this Build: ubuntu-10.04-x64 Build

[Wireshark-dev] Diameter xml files, duplication of an AVP

2010-10-14 Thread Tamás Regõs
Hello, My question is about handling duplicated AVPs. Let's say I'd like to change an AVP type from Octetstring to UTF8String. I can do it easily with changing it in the xml file: From: avp name=3GPP-CG-IPv6-Address code=14 mandatory=must may-encrypt=yes protected=may vendor-bit=must