Re: [Wireshark-dev] Query regarding pdus

2006-11-19 Thread Andrew Schweitzer
prashanth joshi wrote: Hi , I wanted to know what exactly is a PDU. Where is the length of the pdu defined in the PDU. I believe a PDU is a Protocol Data Unit. I believe it is the application layer packet that has been wrapped into TCP or UDP, or the payload of TCP or UDP. It's length

Re: [Wireshark-dev] Problem with tcp_dissect_pdus

2006-11-19 Thread Andrew Schweitzer
John R. wrote: Insofar as I have a workaround, I described it in the bug report. hm didn't seem to work in my case. I still lose two packets maybe I screwed something up. I made these changes: packet-tcp.c tcp_dissect_pdus() //COMMENTED OUT: // pinfo-desegment_len

Re: [Wireshark-dev] Problem with tcp_dissect_pdus

2006-11-19 Thread Andrew Schweitzer
Andrew Schweitzer wrote: John R. wrote: Insofar as I have a workaround, I described it in the bug report. hm didn't seem to work in my case. I still lose two packets maybe I screwed something up. Hey it works if I use 100 rather than -1! Cool. I made these changes: packet

Re: [Wireshark-dev] Problem with tcp_dissect_pdus

2006-11-19 Thread Andrew Schweitzer
Andrew Schweitzer wrote: Andrew Schweitzer wrote: John R. wrote: Insofar as I have a workaround, I described it in the bug report. hm didn't seem to work in my case. I still lose two packets maybe I screwed something up. Hey it works if I use 100 rather than -1! hm... now

Re: [Wireshark-dev] Problem with tcp_dissect_pdus

2006-11-19 Thread Andrew Schweitzer
I reduced my header length to 2 and turned off tcp checksum validation, and things seem to be working much better. At the moment... no problems! :) Thanks Andy ___ Wireshark-dev mailing list Wireshark-dev@wireshark.org

[Wireshark-dev] Problem with tcp_dissect_pdus

2006-11-18 Thread Andrew Schweitzer
I'm having problems using tcp_disscet_pdus with a proprietary protocol. Wireshark appears to be losing packets (not parsing them with application level dissector) in cases where relatively large amounts of packets are sent from one end. I believe this is similar to the problems reported here:

[Wireshark-dev] inttypes.h not found when building catapult_dct2000.c

2006-11-17 Thread Andrew Schweitzer
Any idea where this file is supposed to live and why I can't find it? Thanks Andy Compiler output: cl -DWIN32 -DNULL=0 -D_MT -D_DLL -DHAVE_CONFIG_H /Ie:\wireshark-win32-libs\glib\include\glib-2.0 /Ie:\wireshark-win32-libs\glib\lib\glib-2.0\include

Re: [Wireshark-dev] inttypes.h not found when building catapult_dct2000.c

2006-11-17 Thread Andrew Schweitzer
Ulf Lamping wrote: Andrew Schweitzer wrote: Any idea where this file is supposed to live and why I can't find it? Thanks Andy Compiler output: cl -DWIN32 -DNULL=0 -D_MT -D_DLL -DHAVE_CONFIG_H /Ie:\wireshark-win32-libs\glib\include\glib-2.0 /Ie:\wireshark-win32-libs\glib\lib\glib-2.0

Re: [Wireshark-dev] Why am I getting a BoundsError?

2006-10-28 Thread Andrew Schweitzer
So do you have an idea where the problem lies? A bug in my code? An error in my design? An incorrect call to wireshark functions? Here's some output from my program, printing info from pinfo before call to tcp_dissect_pdus, in each get length call, and in each each dissector: //before call to

Re: [Wireshark-dev] Why am I getting a BoundsError?

2006-10-26 Thread Andrew Schweitzer
Guy Harris wrote: Andrew Schweitzer wrote: Maybe I don't understand tcp_dissect_pdus. If a user message overruns an ethernet frame, tcp_dissect_pdus is supposed to allocate enough space to hold the entire user message, and only call the user's dissector when the entire message has been

[Wireshark-dev] Why am I getting a BoundsError?

2006-10-25 Thread Andrew Schweitzer
I'm writing a dissector for a proprietary protocol and using tcp_dissect_pdus. Our packets can be 2k, and sometimes I seem to get incorrectly parsed messages in the gui. I see the text in the gui Packet size limited during capture. I found this in packet-frame.c, and apparently I'm getting a

Re: [Wireshark-dev] Why am I getting a BoundsError?

2006-10-25 Thread Andrew Schweitzer
Guy Harris wrote: Andrew Schweitzer wrote: Thanks. In a packet that gets a BoundsError, what are the captured length and (actual) length in the Frame section of the packet detail pane? hm it seemed like it captured a full ethernet packet. 1514, if I understand you: Frame 1

Re: [Wireshark-dev] Why am I getting a BoundsError?

2006-10-25 Thread Andrew Schweitzer
Maybe I don't understand tcp_dissect_pdus. If a user message overruns an ethernet frame, tcp_dissect_pdus is supposed to allocate enough space to hold the entire user message, and only call the user's dissector when the entire message has been received... right? So if we get a frame with user

Re: [Wireshark-dev] display filter on a field that appears more than once in a message

2006-09-07 Thread Andrew Schweitzer
Guy Harris wrote: ronnie sahlberg wrote: The difference is the difference between the upside down A (==For ALL it is true) and the mirrored E (==there EXISTS at least one) I.e.: payload.packet.a_field != 1 means there exists at least one instance of payload.packet.a_field in

Re: [Wireshark-dev] newbie question about dissecting protocol with many message subtypes

2006-09-02 Thread Andrew Schweitzer
Guy Harris wrote: The common practice, however, is to define one array, even with protocols that have one data structure per message. There is no practical difference between calling proto_register_field_array() once and calling it multiple times, other than the latter being slightly less

Re: [Wireshark-dev] newbie building on cygwin, windows... can't find pcap

2006-08-29 Thread Andrew Schweitzer
Graeme Lunt wrote: On 8/28/06, Andrew Schweitzer [EMAIL PROTECTED] wrote: Does anyone out there use Cygwin only for windows development? I did all my development under cygwin only for the last 12 months. However recently a number of patches have broken it and I was spending too much

[Wireshark-dev] newbie building on cygwin, windows... can't find pcap

2006-08-28 Thread Andrew Schweitzer
I'm trying to build Wireshark on a Windows PC, but I only have VC7, which as far as I can tell, won't work. So I am trying to build everything purely under cygwin. Does anyone do that? Or do must people install VC6 and cobble together the right tools? When I try to build, configure discovers

Re: [Wireshark-dev] newbie building on cygwin, windows... can't find pcap

2006-08-28 Thread Andrew Schweitzer
Ulf Lamping wrote: -Ursprüngliche Nachricht- Von: Developer support list for Wireshark wireshark-dev@wireshark.org Gesendet: 28.08.06 16:50:12 An: wireshark-dev@wireshark.org Betreff: [Wireshark-dev] newbie building on cygwin, windows... can't find pcap I'm trying to build Wireshark

Re: [Wireshark-dev] newbie building on cygwin, windows... can't find pcap

2006-08-28 Thread Andrew Schweitzer
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andrew Schweitzer Sent: Monday, August 28, 2006 12:43 PM To: wireshark-dev@wireshark.org Subject: Re: [Wireshark-dev] newbie building on cygwin,windows... can't find pcap Ulf Lamping wrote: -Ursprüngliche