Re: [Wireshark-dev] Possible New Option for Tshark?

2010-10-22 Thread Guy Harris
On Oct 22, 2010, at 9:43 PM, Stephen Fisher wrote: > On Thu, Oct 21, 2010 at 03:29:36PM -0500, Craig Votava wrote: > >> I wrote a Perl script that feeds pcap data to an instance of tshark >> running in a child process, then takes the decoded output to present >> to the user. >> >> The problem

Re: [Wireshark-dev] Possible New Option for Tshark?

2010-10-22 Thread Stephen Fisher
On Thu, Oct 21, 2010 at 03:29:36PM -0500, Craig Votava wrote: > I wrote a Perl script that feeds pcap data to an instance of tshark > running in a child process, then takes the decoded output to present > to the user. > > The problem is that I don't know when tshark is done sending output > ba

Re: [Wireshark-dev] When I use gdb to debug wireshark,error occurs

2010-10-22 Thread Christopher Maynard
刘昆 writes: > What should I do to debug packet-http.c:dissect_http by using gdb ? dissect_http is in libwireshark.so, not wireshark. After the message indicating "No source file named packet-http.c", you should have also seen a message asking you: Make breakpoint pending on future shared lib

Re: [Wireshark-dev] Seg Fault - Creating new wiretap type

2010-10-22 Thread Alex Lindberg
I have uploaded a patch file and example C and H files to bugzilla that demonstrate the SEG Fault.  I sure that I have overlooked something simple. Bug 5333. Thanks as always.Alex Lindberg --- On Fri, 10/22/10, Stephen Fisher wrote: From: Stephen Fisher Subject: Re: [Wireshark-dev] Seg Fault -

Re: [Wireshark-dev] Seg Fault - Creating new wiretap type

2010-10-22 Thread Stephen Fisher
On Thu, Oct 21, 2010 at 02:42:34PM -0700, Alex Lindberg wrote: > That was my thought, however I used a debugger and printf statements > to watch the file handle passed to the wiretap routines.  The file was > the same in all cases.  This has me stumped. It seems that my string > buffer is not a

Re: [Wireshark-dev] Wireshark software development

2010-10-22 Thread Jaap Keuter
Hi, You can get a head start by watching the SharkFest presentations. For the rest you could contact CACE, or should I say Riverbed. Thanks,Jaap On Fri, 22 Oct 2010 08:24:00 -0400, "Irizarry, Gabriel D." wrote: Good morning.  I am interested in finding out what are the offerings for Wireshark s

Re: [Wireshark-dev] Stripping Dissectors from wireshark.

2010-10-22 Thread Hadriel Kaplan
In wireshark, select "analyze" -> "enabled protocols..." and uncheck everything you don't need. (though you will need to keep the lower layers dissected - e.g., for HTTP you'd need to keep Ethernet, IP, TCP selected, and possibly IPv6, and of course HTTP and possibly SSL, etc) If all you want

[Wireshark-dev] Possible New Option for Tshark?

2010-10-22 Thread Craig Votava
Folks- I wrote a Perl script that feeds pcap data to an instance of tshark running in a child process, then takes the decoded output to present to the user. The problem is that I don't know when tshark is done sending output back to me. This becomes a problem when running on Windows machine

[Wireshark-dev] Wireshark software development

2010-10-22 Thread Irizarry, Gabriel D.
Good morning. I am interested in finding out what are the offerings for Wireshark software development training. Items could cover an introduction of the source/review to more advanced enhancements like adding new dissectors. Please let me know if you would like to discuss further or feel fre

[Wireshark-dev] Stripping Dissectors from wireshark.

2010-10-22 Thread rishab gupta
Hi, I want to speed up wireshark. I am concerned with only the major protocols such as http. Will it be a good idea to remove the dissectors that serve no purpose for me? If so how do I go about it, because every dissector seems to have a lot of dependencies wrapped around it... Any help will be mu

Re: [Wireshark-dev] deprecating check_col()

2010-10-22 Thread Stig Bjørlykke
On Fri, Oct 22, 2010 at 3:44 PM, Jeff Morriss wrote: > Should we discuss the concept of removing all check_col()'s again? In > looking at the PPP dissector, for example, it seems there may be a fair > amount of work saved by keeping them. My intention behind putting this check in all col_* functi

Re: [Wireshark-dev] deprecating check_col()

2010-10-22 Thread Jeff Morriss
bugzilla-dae...@wireshark.org wrote: > https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5325 > > --- Comment #6 from Jeff Morriss 2010-10-22 > 06:31:48 PDT --- > (In reply to comment #5) >> Check col is deprecated and should be removed. > > Well, you know, I don't know. In this dissector it

[Wireshark-dev] When I use gdb to debug wireshark,error occurs

2010-10-22 Thread 刘昆
I want to use gdb to debug wireshark . First ,I download the source code of wireshark to install.And I use "make CFLAGS="-g -O0"" to create symbols to be used by gdb. And when I want to set breakpoint at packet-http.c:dissect_http .I use command "b packet-http.c:dissect_http",however gdb print "N

[Wireshark-dev] buildbot failure in Wireshark (development) on Ubuntu-10.04-x64

2010-10-22 Thread buildbot-no-reply
The Buildbot has detected a new failure of Ubuntu-10.04-x64 on Wireshark (development). Full details are available at: http://buildbot.wireshark.org/trunk/builders/Ubuntu-10.04-x64/builds/659 Buildbot URL: http://buildbot.wireshark.org/trunk/ Buildslave for this Build: ubuntu-10.04-x64 Build R