[Wireshark-dev] Preferences for a file format.

Hi, What is the best way to save and get a preference for a file format reader ? I would like, to define the number of records to check for the heuristic detection (and probably many more other parameters), as a configurable parameter. But, in the wiretap directory, no one is using preferenc

Re: [Wireshark-dev] [tcpdump-workers] Which versions of pcap files accept pcap_open_offline()?

In the previous version of Wireshark, the conversion from ERF to libpcap was like this: For TYPE_ATM, TYPE_AAL5 WTAP_ENCAP_ATM_PDUS; or WTAP_ENCAP_ATM_RFC1483; or WTAP_ENCAP_ATM_PDUS_UNTRUNCATED; For TYPE_ETH: WTAP_ENCAP_ETHERNET; For TYPE_HDLC_POS: WTAP_ENC

Re: [Wireshark-dev] [Wireshark-commits] rev 23643: /trunk//trunk/epan/dissectors/: packet-tpncp.c /trunk/epan/:Makefile.am Makefile.nmake asm_utils.c asm_utils.hasm_utils_win32_x86.asm proto.c /trunk/

Tomas, You should update the file epan/Makefile.common to add you new files (asm_utils.c and asm_utils.h) and then regenerate the Makefile with autogen.sh and configure (on Unix) Regards Florent Kukosa, Tomas wrote: > I am searching where the problem could be. > > As I have only Windows buil

Re: [Wireshark-dev] Memmory handling problem in ANSI TCAP?

Hi Anders, I think you should replace the memory allocation in packet_ansi_tcap_templace.c ansi_tcap_saved_invokedata = g_malloc(sizeof(ansi_tcap_saved_invokedata)); => ansi_tcap_saved_invokedata = g_malloc(sizeof(struct ansi_tcap_invokedata_t)); And probably replace strcpy by strncpy. Y

Re: [Wireshark-dev] Improve Tcap session management

e feasibility. It also involves >> Changes to CAMEL, INAP, GSM MAP and ANSI MAP. >> >> Does any one have thoughts on the subject? >> Regards >> Anders >> >> -Ursprungligt meddelande- >> Från: [EMAIL PROTECTED] >> [mailto:[EMAIL PROTECTED] För

Re: [Wireshark-dev] Improve Tcap session management

f TCAP transactions that can be used > for filtering, tracing and statistics? > > Luis > > On 7/30/07, Florent Drouin <[EMAIL PROTECTED]> wrote: > >> Hi, >> >> I have found the problem, so I did add the same protection, found in >> expert.c, ag

Re: [Wireshark-dev] Improve Tcap session management

Hi, I have found the problem, so I did add the same protection, found in expert.c, again "read filter" in the tcap tap. Thanks for pointing this bug. I did rename the decoding function for ANSI and ITU as suggested. And by the way, I did correct when a dissector want's to unregister it's ss

Re: [Wireshark-dev] Improve Tcap session management

Hi, Here is the updated patch. Regards Florent Jeff Morriss wrote: Florent Drouin wrote: Hi, Could you apply this patch to improve the Tcap session management, and create the missing version tag in epan/tcap-persistentdata.c and epan/tcap-persistentdata.h ? Unfortunately a

Re: [Wireshark-dev] Improve Tcap session management

Ok, I will do it. Regards Florent Jeff Morriss wrote: > Florent Drouin wrote: > >>Hi, >> >> Could you apply this patch to improve the Tcap session management, >> and create the missing version tag in epan/tcap-persistentdata.c and >> epan/tcap-persiste

Re: [Wireshark-dev] Patch to fix broken compilation

I am using gcc 3.3.5 This is the default C compiler for an old Debian Sarge distribution. << gcc --version gcc (GCC) 3.3.5 (Debian 1:3.3.5-13) Copyright (C) 2003 Free Software Foundation, Inc. >> Jeff Morriss wrote: > Florent Drouin wrote: > [...] > >> generic_deco

[Wireshark-dev] Improve Tcap session management

Hi, Could you apply this patch to improve the Tcap session management, and create the missing version tag in epan/tcap-persistentdata.c and epan/tcap-persistentdata.h ? Thanks. This patch affects the following files: asn1/tcap/tcap.cnf asn1/tcap/packet-tcap-template.c asn1/tcap/packet-tcap-

[Wireshark-dev] Patch to fix broken compilation

Hi, Could someone apply the following patchs in plugins/profinet/packet-dcerpc-pn-io.c and plugins/wimax/mac_hd_generic_decoder.c I have got some errors during compilation, and the Unix buildbot is red. packet-dcerpc-pn-io.c: In function `dissect_PDIRFrameData_block': packet-dcerpc-pn-io.c:

[Wireshark-dev] Add subtree for messages (like ApplyCharging) in Camel

Hi, Additionally to the fix of bug 1699, could you apply this patch on the camel asn1 dissector. The patch - add a subtree to the ApplyChargingXX Report - add a subtree to ReleaseCall and ReleaseSMS - synchronize Unix and Windows makefile. Thanks in advance Regards Florent asn1_camel.diff

Re: [Wireshark-dev] gsmmap asn1 directory

Hi, Thanks again for the corrections. You said the gsm_sms dissector is called to decode the SM-RP-UI on your build for mo-ForwardSM. But is is only because the ForwardSM message is displayed as mo-ForwardSM. In the gsmmap.cnf, the call to the sms dissector is not added for MO-ForwardSM-Arg

Re: [Wireshark-dev] gsmmap asn1 directory

Hi, Thank's again for the correction. I do not see the warning anymore, but the display of the Facility is not bellow the facility itself, but at the end of the tree. It's not a problem, but it looks strange.. I found an other problem with a recent correction of the "Forward SM" message. T

Re: [Wireshark-dev] gsmmap asn1 directory

d dissection of the PLMN container work previously? Regards Anders -Ursprungligt meddelande- Från: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] För Florent Drouin Skickat: den 15 juni 2007 18:50 Till: Developer support list for Wireshark Ämne: Re: [Wireshark-dev] gsmmap asn1 directory It's

Re: [Wireshark-dev] gsmmap asn1 directory

support list for Wireshark > Ämne: Re: [Wireshark-dev] gsmmap asn1 directory > > Hi, > Will try to fix it this evening. > Regards > Anders > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Florent Drouin > Sent: den

[Wireshark-dev] gsmmap asn1 directory

Hello, I wanted to make a change in the gsmmap template files, for the SendAuthentication InfoArgOld. But I can not generate the files again from the ASN1 directory. I did update the Unix Makefile to have the same inputs as the windows one, but it doesn't work. I think the gsmmap.cnf is not

Re: [Wireshark-dev] asn1_ctx_t introduced in more BER functions

Hi, I did fuzztest again with a lot of protocol based on the BER decoder, and check manually a lot of Traces. Everything is OK. Best regards Florent

Re: [Wireshark-dev] asn1_ctx_t introduced in more BER functions

Hi Anders, I have done some tests (gsm_map,bssmap,camel,inap,gsm_ss), and I see a problem in gsm_ss_dissect (asn1/gsm_ss/packet-gsm_ss-template.c) To decode an USSD string, you have to give the actx pointer, when you call the decoding function (as this is done in Notify SS). Else, there is

Re: [Wireshark-dev] [PATCH] 64-bit Linux "All Warnings are Errors" Fixes

Hello Mike, Thank you for the patch. I did check it and I have some proposal changes: 1) In epan/packet.c, epan/stream.c and wiretap/catapult_dct2000.c Change GPOINTER_TO_INT to GPOINTER_TO_UINT 2) In gtk/dcerpc_stat.c I did add a cast, (guint) to compile with a 32 bits linux system (s

Re: [Wireshark-dev] User information in the packet

You can have a look to the following message. I think it should help you. (See attached file: interrogate_ss.cap.gz) Regards Florent <[EMAIL

Re: [Wireshark-dev] local operation code in MAP

Right, I did check the encoding of an integer value: Integer Value Ber Encoding 0 02 01 00 127 02 01 7F 128 02 02 00 80 256 02 02 01 00 -128 02 01 80 Regards Florent

Re: [Wireshark-dev] local operation code in MAP

Hi, You said: "Hex value shown, in the bytes pane is 99." Is this value field by yourself, or by an ASN1 compiler ? I think, It could be a problem of long form encoding. Could you try to use H'81 H'99 instead of H'99 for the operation code in the message to decode ? Regards Florent

[Wireshark-dev] Patch for GTK version in simple_dialog.c

This patch add a test on the GTK version to avoid a warning with the "gtk-label-select-on-focus" configuration parameter, introduced in GTK-2.9.0. (See attached file: simple_dialog.c.diff) Regards Florent simple_dialog.c.diff Description: Binary data

[Wireshark-dev] Function to decode messages when several encoding can be used

This patch provide a new function to decode messages when several ASN1 encoding can be used. This is the case, for example, when a same message has different encoding according to the MAP version, or in case of ASN1 encoder optimization. At the same time, I did remove the configuration variable "o

Re: [Wireshark-dev] Patch to decode ERF type 5 record

I am still working on the subject, but I think it will not be a new WTAP_ENCAP. I tried to introduce a kind of extension for the linktype to give more information, like FCS presence. Concerning the different formats stored in the ERF record with type MC_HDLC, I have no other details. Personnally,

Re: [Wireshark-dev] Unsupported ERF format

Hello, I did post a patch for ERF type 5, in the past days. ( http://www.wireshark.org/lists/wireshark-dev/200702/msg00299.html ) There is still an open discussion if this patch has to be reworked or not, but you can try it in a private view if you are using ERF type 5. If you are using a

[Wireshark-dev] Update camel dissector

Hello, I did update the Camel dissector to have the same structure as the gsm map dissector. Now the dissector correctly handles the Tcap return error component. Some improvement have been made for ApplyChargingReport too. (See attached file: camel.diff.gz) Regards Florent camel.diff.gz

[Wireshark-dev] Update gsmmap to V7.5.0 Rel 7

Hello, Here is a patch to update the gsm map definition up to 3GPP TS 29.002 V7.5.0 (2006-09) Release 7 There is a little impact on the GTP dissector, because I had to change the name of the Local ErrorCode in the gsm map asn1 definition due to a conflict with the Camel dissector. If you h

Re: [Wireshark-dev] Add checksum validation option for MTP2

Thanks, I will try to do something similar with 2 registered dissectors. Best regards Florent "Luis Ontanon"

Re: [Wireshark-dev] Add checksum validation option for MTP2

Hi luis, Right, it seems the problem with the FCS is not only a problem of Datalink. Up to now, if you read a K12 file, and if the record/file for the stack is pointing to mtp2, the MTP2 dissector is called. With the current MTP2 dissector, there is no problem with .rf5 record, because the

Re: [Wireshark-dev] Add checksum validation option for MTP2

Hello Jeff, Thank you for your comments, I will follow your advices and request a new DLT for MTP2 with FCS. But before, I will, first, ask for the agreement of the board manufacturer. I hope they will not disagree.. In the same time, if someone has samples of use for the MTP2 DLT, it co

Re: [Wireshark-dev] Patch to decode ERF type 5 record

No, the ERF type 5 record has a different header than the PCAP header, but MTP2 part is not affected. In fact, the MTP2 (FCS) is not specific to the ERF format, I would say, MTP2 (FCS) is the standart MTP2, but the checksums are present in the 2 last bytes of the frame. I could use a new DLT, but

Re: [Wireshark-dev] Add checksum validation option for MTP2

Hello Jeff, In fact, the FCS checksum are not ahead the sequence numbers, but after the payload. So the MTP2 header is not changed, we have just two additional bytes containing the CRC16. I did join somes messages (captured with libpcap) to show the impact of the patch. You can see, that

[Wireshark-dev] Patch to decode ERF type 5 record

This patch add the decoding of ERF files using the type "Multi Channel HDLC". (See attached file: wiretap_erf.diff.gz) Best regards Florent wiretap_erf.diff.gz Description: Binary data ___ Wireshark-dev mailing list Wireshark-dev@wireshark.org http://

[Wireshark-dev] Add checksum validation option for MTP2

Hello, This patch add an option to validate the MTP2 Frame Check Sequence. You can activate this option if you are using a capture device on PCM links, and if you want to identify malformed Packet, or noise. If you are reading rf5 files, you must not activate the checksum validation, as t

[Wireshark-dev] Patch for Bug771, link layer header type selection

Hello, Here is a patch for Bug 771 (repost). It solves the problem of datalink header selection, when the interface has more than one. And now, when we reopen the dialog window, the datalink submenu is restored to the last used value. The patch uses gtk_option_menu_set_history, which is dep

[Wireshark-dev] Update Camel ASN1 definition to 3GPP TS 29.078 7.3.0 Release 7

Hello, Here is a patch to update the Camel ASN1 definition to version 3GPP TS 29.078 7.3.0 Release 7. Some definitions for element SIZE have been replaced to use the capSpecificBound variables, and some decoding problemes, like for Establish temporary connection have been solved. I did noti

[Wireshark-dev] Add Expert info in BER dissector

Hello, I did introduce the support for "expert info" in the BER decoding module. It is usefull if you have to analyze long capture files, containing few malformed messages. (See attached file: packet-ber.c.diff.gz) Best regards Florent packet-ber.c.diff.gz Description: Binary data _

Re: [Wireshark-dev] COPY_ADDRESS and g_malloc()

Hello, If you modify the COPY_ADDRESS, could you have a look at this bug ? http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1113 As the conversation structure has been se_allocated, it is not possible to free the data "key->addr1.data", because the structure was released by "se_free_all

Re: [Wireshark-dev] Add camel statistics, for counter, and delay time.

Hi Anders, I did compile from Scratch the latest SVN version, and the camel statistics are working now. Thank you very much for your help. You can check with this small sample. (See attached file: camel_testSRT.pcap) Best regards Florent camel_testSRT.pcap Description: Binary data

Re: [Wireshark-dev] Add camel statistics, for counter, and delay time.

Hello Ulf, Sorry for the undefined external symbols in tap-camelsrt.c I did remove the two unknown symbols "gtcap_StatSRT" and "gcamel_StatSRT" in the files ./tap-camelsrt.c ./epan/camel-persistentdata.c and ./epan/camel-persistentdata.c in the following patches. (See attached file: tcap

[Wireshark-dev] Improve Tcap oid management

Hello, I did improve the OID management in the tcap dissector. Now, when a tcap message is reveived, without upper layer, the ACN is saved in the TCAP context, and can be used for the next messages of the dialogue. It is used only when the upper layer session is opened with Tcap only messag

[Wireshark-dev] Repost a patch for tap-iostat.c to have new output format

Hello, I repost a patch to have a new output format for the dates in the statistics. << This patch provide new date formats for the statistics generated with tshark. If you are capturing multiple files, you can merge the stats to generate a gnuplot graph. http://www.wireshark.org/lists/wi

[Wireshark-dev] Patch for gtk/capture_dlg.c (Bug 771)

Hello Could you apply this patch to correct the Bug 771. The patch has been synchronized with SVN19401, and has been tested under linux (not Windows) There are still 2 existing drawbacks: - the menu history is not implemented, so when you reopen the dialog window, you have lost your configu

[Wireshark-dev] Add camel statistics, for counter, and delay time.

Hello, Please find two new TAP for Camel Statistics. The first one updates counters related to camel operations. It is located in the GSM submenu. The second one , named Camel Service Response Time, gives the time ellapsed between a couple of camel specifics operations. (For example Initia

[Wireshark-dev] Add Tcap_context to the TCAP dissector

Hello, Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages.

[Wireshark-dev] Add Camel GPRS reference decoding

Hi, Here is a patch to implement the decoding of the GPRS reference. The specific oid for the CAP-GPRS-ReferenceNumber is attached to a decoding function in the camel module. I do not know if this is the standart method to proceed or if it should be made in the ASN1 definition ?? Moreover,

[Wireshark-dev] New date format for the iostat dissector to merge multiple files

Hello, This patch provide new date formats for the statistics generated with tshark. If you are capturing multiple files, you can merge the stats to generate a gnuplot graph. The format of the date is determined with the "-t" option. The default format is the relativ one. For relative:

[Wireshark-dev] Loop in packet-q2931.c

Hello, I found a loop in the q2931 dissector, whereas I was dissecting Ranap Traces with a bad wireshark configuration. Wireshark did crash, after eating all the memory. Here is a small patch to solve this issue << svn diff epan/dissectors/packet-q2931.c Index: epan/dissectors/packet-q2931

Re: [Wireshark-dev] Patch for "Channel needed" in bssmap Paging

Hello, Currently, I have no Traces for LSA, but I will try to find one. Best regards Florent << Checked in With some further changes to APDU and LSA Identifier dissection. Could you verify the LSA dissection? If you could donate some traces with APDu:s included perhaps dissection of the

[Wireshark-dev] RP-Cause for Release SMS (Camel)

Hello, This patch introduce the decoding of the RP-Cause element in the Release SMS message for Camel. (See attached file: packet-camel-template.c.diff.gz)(See attached file: camel.asn.diff.gz)(See attached file: camel.cnf.diff.gz)(See attached file: Camel_ReleaseSMS.rf5) To check the rf

[Wireshark-dev] Patch for "Channel needed" in bssmap Paging

Hello, This patch provide a correction for the element "Channel Needed" in the Paging message. and some improvements for the display of AUTH,SRES,RAND etc.. (See attached file: Paging_channel_needed.rf5)(See attached file: packet-gsm_a.c.diff.gz) Regards Florent Paging_channel_needed.r

[Wireshark-dev] gtk/menu.c #ifdef missing ??

Hello, Since version 18928, there is a GTK warning at wireshark startup. I think a #ifdef HAVE_AIRPCAP is missing in ./gtk/menu.c (See attached file: menu.c.diff.gz) Regards Florent menu.c.diff.gz Description: Binary data ___ Wireshark-dev mai

[Wireshark-dev] Patch to change SSN for bssap dissector

Hello, This patch allow to change the value of the SSN associated to the bssap dissector. (See attached file: packet-bssap.c.diff.gz) Regards Florent packet-bssap.c.diff.gz Description: Binary data ___ Wireshark-dev mailing list Wireshark-dev@