Re: [Wireshark-dev] Wireshark and NetMon (was Re: Frame comments in Microsoft Network Monitor)

2012-03-03 Thread Krishnamurthy Mayya
Thanks alot for the wonderful reply Harris..was really useful. And ya, the final question i did not make it very clear. Hardware dependencies in the sense that kind of device drivers ar network adapetrs (NICs) a sustem has. I done really know whether the packet capturing softwares have anything to

[Wireshark-dev] Compiling Wireshark with -pg option

2012-03-03 Thread James dsouza
Hello, I am new to Wireshark and want to use Wireshark with gprof which requires it to be compiled with -pg option. Where should this option be added so gcc would build it with this option? I am not sure in which Make file and where I should add this option. Thanks in advance.

[Wireshark-dev] Wireshark and NetMon (was Re: Frame comments in Microsoft Network Monitor)

2012-03-03 Thread Guy Harris
On Mar 3, 2012, at 7:12 AM, Krishnamurthy Mayya wrote: > Just wanted to understand in what way these 2 (MS network monitor and > Wireshark) differ?? Well, there are several ways in which they differ. Some of them are: 1) Wireshark is released under the GNU Public License; its source c

[Wireshark-dev] Wireshark 1.6.5 : No packet colorization not available

2012-03-03 Thread vijay
Hi, I am using Wireshark 1.6.5 in Ubuntu. Packet colorization is not available when I start Wireshark from command line with "with the interface specified" and along with option "K". ./wireshark -k -i eth3 But when if i select the interface from GUI packet colorization is available. ./wireshark t

Re: [Wireshark-dev] How can I register a link layer protocol?

2012-03-03 Thread ashish goel
Hi Armando, Have you checked if your protocol is registered or not. One way to check this is to type your protocol's name in Wireshark's Display Filter textbox, the textbox's background should turn green. If your protocol is registered and it is not showing as valid protocol while adding to DLT_Us

Re: [Wireshark-dev] How can I register a link layer protocol?

2012-03-03 Thread Armando Vázquez
Thanks ashis! When I tried this my protocol does not show up as a valid protocol, why is that? I tried using my dissector for the header protocol, but it should also disscet 2 trailer bytes, does that represent a problem ? What should I put in the header size field? Besides, I've read that using

Re: [Wireshark-dev] Data not getting formatted for custom columns added

2012-03-03 Thread ashish goel
I guess it isn't. Because I guess I cant use col_add_str() function for my custom columns. or Can I ?? On Sat, Mar 3, 2012 at 10:16 PM, Martin Kaiser wrote: > Thus wrote ashish goel (ashish.kumar.go...@gmail.com): > > > I have defined some custom columns through preferences -> Columns. and I > >

Re: [Wireshark-dev] Data not getting formatted for custom columns added

2012-03-03 Thread Martin Kaiser
Thus wrote ashish goel (ashish.kumar.go...@gmail.com): > I have defined some custom columns through preferences -> Columns. and I > want the data of these columns to be formatted as strings not raw bytes. > I have used VALS() function in my dissector code while registering fields > and it is worki

[Wireshark-dev] Data not getting formatted for custom columns added

2012-03-03 Thread ashish goel
Hi all, I have defined some custom columns through preferences -> Columns. and I want the data of these columns to be formatted as strings not raw bytes. I have used VALS() function in my dissector code while registering fields and it is working fine in the packet details window but in the columns

Re: [Wireshark-dev] Frame comments in Microsoft Network Monitor

2012-03-03 Thread Krishnamurthy Mayya
Hi Harris, Just wanted to understand in what way these 2 (MS network monitor and Wireshark) differ?? I just noticed that wireshark uses winPcap where as the other uses NDIS. Any more thoughts on this?? Is there any other hardware kind of dependencies present?? Purely as a matter of curiosity i am a

Re: [Wireshark-dev] How can I register a link layer protocol?

2012-03-03 Thread ashish goel
Hi Armando, The is a way you can do it through wireshark GUI. Go to preferences -> protocols -> DLT_User. Here click on edit and add your protocol on any of the User DLTs(147 - 162). But make sure that that the pcap file you are using must have defined the same DLT value in its global header. Hop

Re: [Wireshark-dev] Help with Bit Fields

2012-03-03 Thread Mike Morrin
On 02/03/2012 23:14, Alex Lindberg wrote: I have a bit oriented message defined: Where Base defines a base value and NumBits determines the number of bits following (in byte groups). Each bit defines the state of the item # Base+Bit Number. I want to create a display that will have the Item