Re: [Wireshark-dev] IAX2 and LTE captures

2015-09-02 Thread Tyson Key
Aha - for what it's worth, http://www.ng4t.com/wireshark.html seems pretty promising - although it seems that they're synthetic traces, generated by a simulator. Covers S1AP, NAS-EPS, RANAP, HNBAP, GSM A-I/F DTAP, and a bunch of other interesting protocols, on the cell/eNodeB side (mostly encapsula

Re: [Wireshark-dev] IAX2 and LTE captures

2015-09-02 Thread Tyson Key
Hi Gerald, I don't have any new, original ones to share - although I've seen a few LTE-related traces, whilst digging around in my archives of the Wireshark-Bugs list (bugs #5536, #8303. #5511, and #10699 immediately come to mind), and there's the IAX2_incoming_call.acp trace on the Wiki - but I d

Re: [Wireshark-dev] Npcap 0.03 call for test

2015-08-01 Thread Tyson Key
h. In order to restore network connectivity, I had to disable the "NPcap Loopback Adapter", and a vestigial "KM-TEST Loopback Adaptor", and reboot my PC, though. Tyson. 2015-08-01 17:22 GMT+01:00 Tyson Key : > Also found this, in a dumpcap MiniDump: > > > Microso

Re: [Wireshark-dev] Npcap 0.03 call for test

2015-08-01 Thread Tyson Key
c4b-1ac1-803d-31b7fb0e6e7f} Followup: MachineOwner - 2015-08-01 16:07 GMT+01:00 Tyson Key : > Hi Yang, > > Not sure if these are any use, since I'm still downloading various > symbols, but I've just started looking at some MiniDumps, and spotted these: > > &

Re: [Wireshark-dev] Npcap 0.03 call for test

2015-08-01 Thread Tyson Key
HASH_STRING: km:0xc2_7_ndnd_netio!netiocompleteclonenetbufferlistchain FAILURE_ID_HASH: {ec09700b-3916-f849-b5d5-75c2ba7b02db} Followup: MachineOwner - However, they seem to correlate with your debugging from earlier... Tyson. 2015-08-01 14:30 GMT+01:00 Tyson Key : > Hi Yang, > > T

Re: [Wireshark-dev] Npcap 0.03 call for test

2015-08-01 Thread Tyson Key
mp file. > > Get WinDBG: > > https://msdn.microsoft.com/en-us/windows/hardware/hh852365.aspx?f=255&MSPPError=-2147217396 > > Get Windows symbols: > https://msdn.microsoft.com/en-us/windows/hardware/gg463028.aspx > > > Cheers, > Yang > > On Tue, Jul 28, 2015 at 11:09

Re: [Wireshark-dev] Npcap 0.03 call for test

2015-07-28 Thread Tyson Key
us/kb-articles/Pages/AMDQuickStreamTechnology.aspx . Tyson. 2015-07-28 16:03 GMT+01:00 Tyson Key : > Hi Yang, > > Thanks for looking at these dumps. > > Yup, I think I enabled the verifier, a few months ago, whilst trying to > debug some other issue (probably related to the AppEx thing), and I f

Re: [Wireshark-dev] Npcap 0.03 call for test

2015-07-28 Thread Tyson Key
0` > ` ` : > NETIO!NetioDereferenceNetBufferListChain+0x2d1 > > > STACK_COMMAND: kb > > FOLLOWUP_IP: > NETIO!NetioCompleteCloneNetBufferListChain+1508d > f800`3763083d 90 nop > > SYMBOL_STACK_INDEX: 2 > >

Re: [Wireshark-dev] Npcap 0.03 call for test

2015-07-28 Thread Tyson Key
I just uploaded my MiniDumps to https://dl.dropboxusercontent.com/u/670345/MiniDump.rar, if it makes debugging this easier. Tyson. 2015-07-28 8:08 GMT+01:00 Tyson Key : > Hi Yang, > > Thanks for looking into this. > > I can't remember when/how I installed Win10PCap (gue

Re: [Wireshark-dev] Npcap 0.03 call for test

2015-07-28 Thread Tyson Key
uldn't get us any closer to diagnosing why it fails to work, with my not-so-unique configuration. Tyson. 2015-07-28 7:27 GMT+01:00 Yang Luo : > > > On Mon, Jul 27, 2015 at 10:42 PM, Tyson Key wrote: > >> After rebooting from uninstalling MS NetMon, I restarted Wireshark, and

Re: [Wireshark-dev] Npcap 0.03 call for test

2015-07-27 Thread Tyson Key
01:00 Tyson Key : > After rebooting from uninstalling MS NetMon, I restarted Wireshark, and > got the usual "NPF service not running; no interfaces available" note. This > persists, even if I try "NPFInstall -r", and Wireshark still claims that no > interfaces

Re: [Wireshark-dev] Npcap 0.03 call for test

2015-07-27 Thread Tyson Key
eantime, I'm going to upgrade my VMware Player installation to the latest version, and see if it includes newer networking components. Tyson. 2015-07-27 14:46 GMT+01:00 Tyson Key : > Annoying, because Microsoft Network Monitor 3.4 is the only tool that can > capture 802.11 traffic in monitor mod

Re: [Wireshark-dev] Npcap 0.03 call for test

2015-07-27 Thread Tyson Key
the .inf file in "C:\Program Files\Npcap".. Now, I get "The NPF driver isn't running. You may have trouble capturing or listing interfaces", when restarting Wireshark, but at least it doesn't BSoD. I'll try rebooting, and see what happens... 2015-07-27 14:08 GM

Re: [Wireshark-dev] Npcap 0.01 call for test (2nd)

2015-07-19 Thread Tyson Key
why the BSOD occurs in the Kernel Transaction Manager, this time... Tyson. 2015-07-19 19:13 GMT+01:00 Tyson Key : > ...and after rebooting, and reinstalling the various components using > NPFInstall, and launching Wireshark, no interfaces are detected. However, > after trying "sc star

Re: [Wireshark-dev] Npcap 0.01 call for test (2nd)

2015-07-19 Thread Tyson Key
...and after rebooting, and reinstalling the various components using NPFInstall, and launching Wireshark, no interfaces are detected. However, after trying "sc start npf", and waiting a while, I'm greeted with another BSOD, of the same kind as last time: ==

Re: [Wireshark-dev] Npcap 0.01 call for test about Windows loopback traffic capture feature

2015-07-19 Thread Tyson Key
_EXCEPTION, and SYSTEM_THREAD_EXCEPTION_NOT_HANDLED errors. Tyson. 2015-07-17 1:57 GMT+01:00 Yang Luo : > Hi Tyson, > > On Thu, Jul 16, 2015 at 6:10 PM, Tyson Key wrote: > >> Hi Yang, >> >> Come to think of it, I got exactly the same BSoD error as Jim ( >> BAD_POOL_CALLER). >> > >

Re: [Wireshark-dev] Npcap 0.01 call for test (2nd)

2015-07-19 Thread Tyson Key
PS - No joy with manually running "NPFInstall.exe -ul" multiple times, to remove the redundant interfaces, so I had to resort to uninstalling them using Device Manager, and then rebooting. 2015-07-19 15:37 GMT+01:00 Tyson Key : > Hi Yang, > > Just downloaded your latest pac

Re: [Wireshark-dev] Npcap 0.01 call for test (2nd)

2015-07-19 Thread Tyson Key
Hi Yang, Just downloaded your latest package, and here's my experience, so far: After uninstalling the old WinPCap 4.1.3, and installing your new package (without rebooting), I get as far as "NPFInstall.exe - il" (which stalls for a while, but then continues, on my machine), and then continue to

Re: [Wireshark-dev] Npcap 0.01 call for test about Windows loopback traffic capture feature

2015-07-16 Thread Tyson Key
m way and I > still don't know how to reproduce it. > > Cheers, > Yang > > > On Wed, Jul 15, 2015 at 7:03 PM, Tyson Key wrote: > >> Hi Yang, >> >> Thank you for looking into implementing this. Sadly, I tried your package >> on my Win8.1 x86-64 m

Re: [Wireshark-dev] Npcap 0.01 call for test about Windows loopback traffic capture feature

2015-07-15 Thread Tyson Key
Hi Yang, Thank you for looking into implementing this. Sadly, I tried your package on my Win8.1 x86-64 machine, and found that not only did the new NPF service not start after uninstalling "real" WinPCap (running the installation tool manually, with the -il, and -i options didn't seem to do anythi

Re: [Wireshark-dev] On which platforms is there a need for Wireshark to have a "Language" preference?

2014-11-06 Thread Tyson Key
Hi Guy, Right now, iTunes, SoftMaker Office, Shareaza, RealPlayer, and Google Chrome are the most apparent examples (from memory) of relatively-popular applications for Windows that expose a preference in their configuration GUIs, to support changing the program language on-the-fly. I'm sure that

Re: [Wireshark-dev] Qt License Change

2014-08-21 Thread Tyson Key
Hi, I'm not a lawyer - but judging by that post, and the statements "...we are now adding LGPL v3 as a licensing option to Qt 5.4 in addition to LGPL v2.1", and "All modules that existed in Qt 5.3 will still be available under LGPL v2.1. So if you are using Qt under the GPL v2 or LGPL v2.1, nothin

Re: [Wireshark-dev] Difference between wiretap, winpcap and libpcap

2014-04-01 Thread Tyson Key
Hi Vishnu, WinPCap is effectively an external "branch" (not sure if "fork" is the correct term, since the devs track upstream libpcap) of the libpcap library (which is designed to abstract the packet capturing APIs of at least various UNIXesque OSes, and also MS-DOS) for 32-bit, and 64-bit Wind

Re: [Wireshark-dev] Win64 BuildBot down?

2014-01-12 Thread Tyson Key
OS X bots are still alive, just now. No big deal, though. Tyson. 2014/1/12 Pascal Quantin > Hi Tyson, > > numerous buildbots are down, as seen on > http://buildbot.wireshark.org/trunk/waterfall > I can build locally without any problem for win64. > > Pascal. > > >

[Wireshark-dev] Win64 BuildBot down?

2014-01-12 Thread Tyson Key
Hi list, It seems that there haven't been any more Win64 CI builds since the 9th... Please forgive me for asking - but is this since someone accidentally broke the build, or due to infrastructure migration? Thanks, Tyson. -- Fight Internet Censorship!

Re: [Wireshark-dev] Thoughts on disabling an old dissector

2013-12-18 Thread Tyson Key
Hi Evan, Hmm, now that's an interesting dilemma. Couldn't we rename the old dissector to something like "tpncp_old", "tpncpv1", or "tpncp_legacy"? That said, it'd probably be a disservice to completely remove a dissector that folks are probably using to dissect "legacy" TPNCP packets in old trace

Re: [Wireshark-dev] Unused dissector tables

2013-12-12 Thread Tyson Key
Hi Gerald, Although the USB CCID, and packet-rfid-* dissectors invoke others to do payload dissection, I believe that the unused dissector table registration code was a left-over from initial design attempts - so it's probably safe to remove it. I hope that helps, Tyson. -Original Message-

Re: [Wireshark-dev] What is the history and status of PCAP Next Generation?

2013-10-09 Thread Tyson Key
Apologies for the thread hijacking... For what it's worth, I've just had a play with the latest build of CommView (6.5, build 734), and it seems to have basic support for writing PCAP-NG files. (Emits no packet comments, and doesn't use any nifty features like storing application/machine info). S

Re: [Wireshark-dev] reported_length < -1

2013-09-07 Thread Tyson Key
Hi folks, Sorry for hijacking the thread, but come to think of it, would it make more sense to test if it's >0, rather than testing for !=0? Tyson. 2013/9/7 Martin Kaiser > Dear all, > > I stumbled on > > tvb_new_subset(tvb, 10, (tvb_get_guint8(tvb, 1) - 2), (tvb_get_guint8(tvb, > 1) - 2)); >

Re: [Wireshark-dev] Jurassic packets

2013-06-13 Thread Tyson Key
Heh, couldn't you try to install the Open Source version of CDE? Or is that too retro/now ironically incompatible with such an old distribution? Tyson. 2013/6/13 Gerald Combs > On 6/13/13 1:52 PM, Jeff Morriss wrote: > > On 06/13/13 14:09, Gerald Combs wrote: > >> For Monday's Sharkfest keynot

Re: [Wireshark-dev] Icon Poll - is this OK?

2013-04-10 Thread Tyson Key
Hmm, what about a cassette tape? Tyson. 2013/4/10 Shawn T Carroll > What dimensions are you shooting for with the icon? Is there a set __ x __ > pixels? > > My wife is a professional graphic designer, and is called upon regularly > to design or redesign icons. If the goal is to figure out way

Re: [Wireshark-dev] Cannot launch newly-built SVN "tshark" binaries under Ubuntu 11.10

2013-02-04 Thread Tyson Key
2013/1/20 Jaap Keuter > WIRESHARK_RUN_FROM_BUILD_DIRECTORY=1 ./wireshark & > -- Fight Internet Censorship! http://www.eff.org http://vmlemon.wordpress.com | Twitter/FriendFeed/Skype: vmlemon | 00447934365844 __

Re: [Wireshark-dev] WhatsApp dissector

2013-02-02 Thread Tyson Key
Hi David, That sounds like a pretty interesting dissector, to me. In order to kick-start the contribution process, I recommend doing the following: - Registering at http://bugs.wireshark.org - Converting your code into a "build-in" dissector (a relatively trivial process that involves re

[Wireshark-dev] Cannot launch newly-built SVN "tshark" binaries under Ubuntu 11.10

2013-01-18 Thread Tyson Key
Hi list, Apologies if it sounds as if I'm doing something stupid, or missing something obvious; and for the verbosity of this e-mail. Over the past day or so, I've ended up upgrading one of my Ubuntu installations from 11.04, to 11.10, as a result of some problems regarding building against the G

Re: [Wireshark-dev] Skype protocol dissector

2012-08-09 Thread Tyson Key
Hi Matthias, I'll admit that project sounds pretty cool - and I don't want to discourage you from working on it; but I suspect that implementing that sort of functionality in Wireshark might open a giant can of worms, legally. (Especially since MS now own Skype's developers). ;) Anyway, for getti

Re: [Wireshark-dev] RFD: New language to write dissectors

2012-07-25 Thread Tyson Key
Hmm, I did briefly think that if we ever moved all dissectors into plug-in form (which would be unlikely, given the drive to make as many built-in as possible), we could package them according to protocol family/purpose, so that users could select only the ones that were necessary - but many have c

Re: [Wireshark-dev] NPL to Wireshark compiler/converter

2012-07-21 Thread Tyson Key
Hi Richard, That sounds fairly impressive - even if it doesn't do much, right now. I don't know if you've already seen them; or even if they're helpful, but have you had a look at http://nmparsers.codeplex.com/SourceControl/list/changesets for examples of parser code? (I believe that most files a

Re: [Wireshark-dev] RFD: New language to write dissectors

2012-07-15 Thread Tyson Key
Hmm, What about implementing a compiler that generates C dissector source code, from NPLt m, or WSGD dissector code? Or would that be overkill for what we're trying to do? Just my 0.02p... Tyson. 2012/7/15 Jakub Zawadzki > On Sat, Jul 14, 2012 at 03:31:06PM -0700, Guy Harris wrote: > > > > On

Re: [Wireshark-dev] 1.8 branch + release schedule

2012-06-08 Thread Tyson Key
For what it's worth, MS have decided to renege on their "Metro development only" plans for the next version of Visual Studio Express, if http://blogs.msdn.com/b/visualstudio/archive/2012/06/08/visual-studio-express-2012-for-windows-desktop.aspx is to be believed. I haven't had chance to investigat

Re: [Wireshark-dev] Make "giop plugins" built in dissectors?

2012-06-05 Thread Tyson Key
Hi Jeff, I've also noticed that with a modern x86-64-based machine (with 3GB of RAM, and a triple-core AMD Phenom II CPU), and a recent-ish version of GCC running under *buntu. It certainly seems like a good stress test for any compiler/OS/machine combination. With that in mind, just what is pack

Re: [Wireshark-dev] Add new plugin in trunk

2012-06-02 Thread Tyson Key
Hi Alexis, Out of curiosity - whilst we're thinking of absorbing externally-developed dissectors, do you think that investigating http://code.google.com/p/wireshark-nfc/ (which is currently being developed by Google - and I don't know what their plans for upstreaming are), and https://git.ring0.de

Re: [Wireshark-dev] SVN HEAD not building

2012-05-27 Thread Tyson Key
Hi Akos, I haven't looked at that portion of the codebase (so I don't know how they've integrated the new UI code), but from experience with Qt development, that header file is supposed to be automatically generated, if I remember correctly. Tyson. 2012/5/27 Akos Vandra > Yep, that helped, tha

Re: [Wireshark-dev] New developer - how to start?

2012-05-25 Thread Tyson Key
Hi Dipanjan, There isn't really a formal registration process, but registering at http://bugs.wireshark.org/ is a good place to start. As for "tasks" - there isn't a formal list of mandatory activities (but there is a wishlist on the wiki, which might be vaguely interesting); and things are fairly

Re: [Wireshark-dev] Store selected Wireshark prefs in pcapng capture file ?

2012-03-05 Thread Tyson Key
Hi Bill, I don't know if the format's developers ever contemplated that use case - although they designed it to be fairly extensible, and I'm sure that someone could design a new type of block that stores serialised application preferences (in compressed XML, JSON, or some other format?), after re

Re: [Wireshark-dev] Query

2012-03-01 Thread Tyson Key
Hi Krishnamurthy, Whilst I'm not a core developer, I don't see why that would be a problem. (In fact, that's how I submitted some of my own dissectors). Tyson. On 1 March 2012 03:01, Krishnamurthy Mayya wrote: > Hi all, > Is it ok if we create a new bug in wireshark bugzilla to say that we are

Re: [Wireshark-dev] Regression in SVN revision ~41162?

2012-02-23 Thread Tyson Key
h well. Tyson. On 23 February 2012 15:08, Jeff Morriss wrote: > Tyson Key wrote: >> >> Hi list, >> >> It seems that as of revision 41162 (or maybe a few before?), I am no >> longer able to completely compile and link the EPAN/dissectors portion >> of the c

[Wireshark-dev] Regression in SVN revision ~41162?

2012-02-23 Thread Tyson Key
Hi list, It seems that as of revision 41162 (or maybe a few before?), I am no longer able to completely compile and link the EPAN/dissectors portion of the codebase under Ubuntu. I suspect that recent modifications to the MPEG-related dissectors may have caused this, given by the errors from the l

[Wireshark-dev] User-Customisable Payload Dissection

2012-02-06 Thread Tyson Key
Hi, Now that the GSM SIM/ISO 7816 protocol dissector has been integrated, it might be useful to provide a "Payload Protocol" option for the CCID dissector - so that users can switch appropriately between treating payloads as either plain data, or as GSM SIM/ISO 7816 packets. With that in mind, pl

Re: [Wireshark-dev] Iteration in dissectors?

2012-01-23 Thread Tyson Key
it. Thanks once again, Tyson. On 22 January 2012 21:41, Tyson Key wrote: > Thanks Chris, > > If I remember correctly, apart from an annoying, misleading "malformed > packet" error, I eventually managed to dump all of the block IDs (1-4) > using either : > > /*

Re: [Wireshark-dev] Iteration in dissectors?

2012-01-22 Thread Tyson Key
l successfully" and obtain nothing - since the conditions being tested are contradictory (e.g. the number of blocks is less than the position - therefore, we don't move the cursor). Tyson. On 22 January 2012 18:16, Chris Maynard wrote: > Tyson Key writes: > >> My (partially wor

[Wireshark-dev] Iteration in dissectors?

2012-01-22 Thread Tyson Key
Hi, I'm currently working on a dissector for Sony's FeliCa application layer protocol; and things seem to be progressing nicely. However, I'm facing some issues surrounding iterating through list data structures in a non-standard manner. The data structure in question is a list of memory block ID

Re: [Wireshark-dev] Affix bluetooth stack

2011-10-31 Thread Tyson Key
eason. In this case, your best bet would be to install the "libbluetooth-dev" package, and build a non-crippled version of LibPCap (and Wireshark?) from source, with the appropriate "./configure" argument specified. Sorry for disappointing you, Tyson. On 31 October 2

Re: [Wireshark-dev] Affix bluetooth stack

2011-10-31 Thread Tyson Key
gt; > I need to do a live capture on Bluetooth traffic does wireshark support > capture with BLueZ stack in linux ? > > Vijay > > > On Mon, Oct 31, 2011 at 3:10 AM, Tyson Key wrote: > >> Hi Vijay, >> >> There's no need to install Affix under KUbuntu (

Re: [Wireshark-dev] Affix bluetooth stack

2011-10-31 Thread Tyson Key
Hi Vijay, There's no need to install Affix under KUbuntu (although installing other stuff from the repositories related to Bluetooth wouldn't hurt). Just enable Bluetooth connectivity as normal, and connect your adapter if necessary. Tyson. On 31 October 2011 08:03, vijay wrote: > Hi, > > I no

Re: [Wireshark-dev] Feature Request - Comments attached to a packet

2011-08-11 Thread Tyson Key
Right. Feel free to disregard my previous e-mail, then. :) Sorry for the inconvenience/false hope, Tyson. On 11 August 2011 19:24, Guy Harris wrote: > > On Aug 11, 2011, at 11:16 AM, Tyson Key wrote: > > > Whilst no-one's looking into implementing support for attaching c

Re: [Wireshark-dev] Feature Request - Comments attached to a packet

2011-08-11 Thread Tyson Key
Hi Alex, Whilst no-one's looking into implementing support for attaching comments to packets (as far as I'm aware); someone recently wrote a patch to enable reading comments from pcap-ng/NTAR files, and attached it to bug #6229. Tyson. On 11 August 2011 19:04, Alex Lindberg wrote: > Has anyone

Re: [Wireshark-dev] Duplicating TCP dissector

2011-06-30 Thread Tyson Key
Hi Randy, Whilst it's probably not the best way, you might want to investigate the technique that I used when developing a dissector for Apple's USBMUX protocol (which is used to transport TCP data over USB, without IP framing of any kind). See bug #6045 on bugs.wireshark.org for the code, and fe

[Wireshark-dev] Handing off payloads to the TCP dissector?

2011-06-18 Thread Tyson Key
Hi folks, I'm currently in the process of writing a dissector for Apple's USBMUX protocol (which encapsulates TCP frames with a non-IP-based 8 byte header), as used by their seemingly ubiquitous iProduct family. So far, I've managed to dissect the "TCP port" and packet length portions of the head

Re: [Wireshark-dev] Problems with capturing on multiple interfaces

2011-05-20 Thread Tyson Key
Hmm, wouldn't using "any" was a means of nullifying other interfaces break concurrent capturing on both the "any interface" and Bluetooth or USB interfaces? Still, I agree with Chris's suggestions, with regards to weak emulation of an "any interface" under Windows; and "speculative capturing" (i.e

[Wireshark-dev] Extending the USB dissector with subclass/protocol ID annotations?

2011-05-12 Thread Tyson Key
Hi folks, Over the past few hours, I've been reading version 1.2 of the USB Forum's Communications Device Class and Ethernet Control Model Subclass specifications; and now I'm left wondering what the best/most lightweight way to annotate the *bInterfaceSubClass* and *bInterfaceProtocol* fields of

Re: [Wireshark-dev] Any interest in a USB-encapsulated AT/Hayes Commands dissector?

2011-04-28 Thread Tyson Key
Right, so I've just added the latest revisions of the source files to a new bug report (5868). Please feel free to play with the code, and provide comments/criticism/suggestions for improvement. Tyson. On 28 April 2011 15:42, Chris Maynard wrote: > Stephen Fisher writes: > > > > If there's an

[Wireshark-dev] Any interest in a USB-encapsulated AT/Hayes Commands dissector?

2011-04-26 Thread Tyson Key
Hi folks, I've just stumbled upon an old, experimental plug-in dissector that I wrote to dissect "raw" AT/Hayes commands in USB traces, during the process of working on another, otherwise unrelated dissector. (See https://bitbucket.org/vmlemon/usb_isi_dissector_for_wireshark/src/eec3bf16fedf/at-ha

Re: [Wireshark-dev] IMSI Dissection API?

2011-01-06 Thread Tyson Key
Probably bad form to reply to my own post, but I've found that adding " -g -D_U_="__attribute__((unused))"" to the end of my CFLAGS line in my Makefile, without the surrounding quotes makes things build successfully when including epan/dissectors/packet-gsm_map.h. I hope that helps others. ___

Re: [Wireshark-dev] IMSI Dissection API?

2011-01-06 Thread Tyson Key
Hi Anders, Thanks for the suggestion. Sadly, it seems that there's still no joy, after including the epan/asn1.h header. (I receive the same compilation error as previously). I've also briefly tried to adapt the implementation from packet-gtpv2.c, to no avail. I'll keep trying to see if I can co

[Wireshark-dev] IMSI Dissection API?

2011-01-06 Thread Tyson Key
Hi, I'm currently working on enhancing an *external dissector for Nokia's Intelligent Service Interface protocol. So far, pretty much everything seems to work nicely, although I'm struggling to find the best way to dissect the IMSI strings in certain packets produced by the SIM resource, such as

Re: [Wireshark-dev] wireless nic is not showing in wireshark

2010-10-02 Thread Tyson Key
Hi Nikhil, Under Windows 7, the 802.11 interface is simply named "Microsoft" for some unfathomable reason. Unfortunately, because WinPCap (and by extension Wireshark) does not utilise the new APIs/mechanisms for capturing raw 802.11 frames that are provided by NDIS 6, you'll only see synthetic Et

Re: [Wireshark-dev] get some information to develop a new protocol

2010-09-17 Thread Tyson Key
P.S. I neglected to mention in my previous e-mail that there's a *dbus-monitor *utility which listens on either the system bus, or the session bus and dumps a textual copy of traffic to the shell. You might want to reverse-engineer the mechanisms used by that for capturing, and re-implement them in

Re: [Wireshark-dev] get some information to develop a new protocol

2010-09-17 Thread Tyson Key
Hi Thomas, If I remember correctly*, there is a method of forcing the D-BUS server and client to use TCP over the loopback interface for various purposes. When I was interested in working with IPC systems, about a year ago, I managed to build a reasonably large library of trace files that way (al

Re: [Wireshark-dev] Unable to Compile Wireshark from SVN on Fedora 11

2009-08-24 Thread Tyson Key
Hi Bill, On another note, I've discovered an unrelated issue when trying to build an RPM from an SVN snapshot - during RPM creation, the rpmbuild tool chokes on the hyphens in the version information, as written in the .spec file. I'm unsure of the best way to fix that, though, short of changing th

Re: [Wireshark-dev] Unable to Compile Wireshark from SVN on Fedora 11

2009-08-23 Thread Tyson Key
ce code itself, my C knowledge isn't all that great, so I have no idea about where I should begin, as far as fixing the defective code goes. Tyson. On Sun, Aug 23, 2009 at 9:24 PM, Bill Meier wrote: > Tyson Key wrote: >> Hi, >> I'm unsure if this is the best venue to r

[Wireshark-dev] Unable to Compile Wireshark from SVN on Fedora 11

2009-08-23 Thread Tyson Key
Hi, I'm unsure if this is the best venue to report the issue, but is anyone else having problems building a current SVN snapshot of Wireshark on Fedora 11? Currently, I'm able to complete most of the "make" process, before attempting to build the ICMPv6 dissector fails with the following: cc1: war

Re: [Wireshark-dev] Help

2009-08-12 Thread Tyson Key
Hi, Divya. You'll want to run ./wireshark in the directory that you've built it in. It should then launch, if it was built fully. Tyson. On Wed, Aug 12, 2009 at 5:15 PM, divya kothapally wrote: > > Hello, > Iam trying to launch wireshark by just doing a make on it. It is giving me > following err

[Wireshark-dev] A Mini-Challenge/A Feature Request: Support for Dissecting Bluetooth HCI Frames over USB?

2009-06-28 Thread Tyson Key
Hi, I have just captured* a session of using a connecting and initialising a USB Bluetooth adapter, before performing pairing/authentication, and receiving a file over OBEX from a mobile phone. It appears that the Bluetooth (HCI H1? HCI H4?) frames are carried over either URB_BULK or URB_INTERRUPT

Re: [Wireshark-dev] offline dissection of network protocols

2009-05-29 Thread Tyson Key
Hi Selçuk, if you're doing anything involving multiple link types and Wireshark/dumpcap, you'll want to check out the enhanced pcap-ng file format support in the latest SVN versions of Wireshark. So it seems, mergecap doesn't support merging multiple link-layer types in pcap-ng files yet, although

Re: [Wireshark-dev] get a pcapNG file

2009-05-27 Thread Tyson Key
Hi Soltani. The latest SVN versions of Wireshark support multiple link types in pcap-ng files, although to capture on non-Ethernet link types you have to use dumpcap. There was an issue where pcap-ng files created by earlier versions of Wireshark weren't being handled by newer versions, and vice-ve

Re: [Wireshark-dev] writing non-Ethernet pcapng files

2009-05-22 Thread Tyson Key
te several pcapng files and read the > resulting file. > So it is not a limitation of pcapng, but of its current implementation > in Wireshark. > > Best regards > Michael > > On May 22, 2009, at 1:27 PM, Tyson Key wrote: > > > Hi. > > Out of interest, are there

Re: [Wireshark-dev] writing non-Ethernet pcapng files

2009-05-22 Thread Tyson Key
Hi. Out of interest, are there supposed to be issues with Ethernet Pcap-NG files/packets appended to other Pcap-NG files generated with Wireshark 1.0.7 having an unrecognised link type in later (SVN) versions of Wireshark? At the same time, it seems that 1.0.7 has issues reading packets in Pcap-NG

[Wireshark-dev] Cannot Capture Bluetooth Traffic as of SVN r28436

2009-05-21 Thread Tyson Key
Hi, it seems that as of Wireshark SVN revision 28436 (with libpcap 1.1-PRE-CVS), I am unable to properly capture Bluetooth H4 traffic from a USB-connected Bluetooth radio. When trying to perform a capture, it appears that data is not being written to the capture file, and the packet counter is not

Re: [Wireshark-dev] capturing on multiple interfaces

2009-05-21 Thread Tyson Key
Hi Michael, I've sent you some samples off-list. I hope they're of use. Thanks, Tyson On Thu, May 21, 2009 at 7:54 PM, Michael Tüxen < michael.tue...@lurchi.franken.de> wrote: > On May 21, 2009, at 8:01 PM, Tyson Key wrote: > > > Hi. I'm not sure what the p

Re: [Wireshark-dev] capturing on multiple interfaces

2009-05-21 Thread Tyson Key
lthough it's probably a known issue)), if anyone's interested. Thanks, Tyson. On Thu, May 21, 2009 at 6:51 PM, Michael Tüxen < michael.tue...@lurchi.franken.de> wrote: > On May 21, 2009, at 7:24 PM, Tyson Key wrote: > > > Hi again, Michael. Probably a stupid question,

Re: [Wireshark-dev] capturing on multiple interfaces

2009-05-21 Thread Tyson Key
irectory other than the default one (/tmp), even as root, and when a directory has it's permission bits set to 777? Thanks in advance, Tyson. On Thu, May 21, 2009 at 5:24 PM, Michael Tüxen < michael.tue...@lurchi.franken.de> wrote: > On May 21, 2009, at 5:17 PM, Tyson Key wrote:

Re: [Wireshark-dev] capturing on multiple interfaces

2009-05-21 Thread Tyson Key
gt; >> interfaces available using "dumpcap". > > This is what I'm working on. The capture file will be stored > > in .pcapng format... > > Saving in .pcapng is already available in the svn version. Use the -n > > option. > > Testing it is highly appreciated... &g

Re: [Wireshark-dev] capturing on multiple interfaces

2009-05-18 Thread Tyson Key
Hi, Chandra. Assuming that all the devices you want to capture on uses the same link type, there's an "any" pseudo-device on Linux that you can use. Sadly, it doesn't store information about the devices involved, and the link type-specific headers are transformed into a "Cooked" format. You might w

Re: [Wireshark-dev] GeoIP support added

2008-10-27 Thread Tyson Key
Hi Gerald, sounds like a very cool and useful feature to have. Any idea about which SVN revision this is in? Thanks. On Mon, Oct 27, 2008 at 4:56 AM, Gerald Combs <[EMAIL PROTECTED]> wrote: > I've just added initial support for the GeoIP library. Using different > database files, GeoIP can map IP

Re: [Wireshark-dev] WLAN Traffic Statistics

2008-02-12 Thread Tyson Key
Hi Stig. Just tried the new SVN version, and the WLAN Traffic stats option seems very useful. Thanks. On Feb 12, 2008 2:19 PM, Stig Bjørlykke <[EMAIL PROTECTED]> wrote: > Hi. > > I have just added "Statistics->WLAN Traffic..." with some basic > wireless traffic statistics. Have a look at revisi

Re: [Wireshark-dev] ethernet over USB

2008-02-01 Thread Tyson Key
Hi, assuming that you're referring to USB Communications Device Class, or ATM-over-USB devices (e.g. some consumer ADSL routers), everything gets sent as a generic URB_BULK(?) transmission, if I remember correctly, which Wireshark can't currently analyze. I'm not sure myself why it constantly sends

Re: [Wireshark-dev] pcap-ng support

2008-01-21 Thread Tyson Key
Hi, sorry to hijack the thread, but does anyone know if there will be a link type code available for Bluetooth in pcap-ng? Thanks, Tyson. On Jan 18, 2008 7:01 AM, Ulf Lamping <[EMAIL PROTECTED]> wrote: > Gianluca Varenni schrieb: > > FYI today I tried opening a pcap-ng file with wireshark rev 24

Re: [Wireshark-dev] wimaxintel.dll

2007-10-22 Thread Tyson Key
Hi, as far as I know, CACE Technologies provide commercial support for Wireshark. There is no closed-source or commercial license version of Wireshark, nor royalties or license fees required for its use, whatsoever. Hope that helps. Etay Luz wrote: > > (Please ignore my previous post – sorry ab

Re: [Wireshark-dev] SVN Commit With IPMB Support?

2007-08-31 Thread Tyson Key
Hi, the patch is attached, as I originally found it on the mailing list. Thanks. Stephen Fisher wrote: On Fri, Aug 31, 2007 at 12:32:34AM +0100, Tyson Key wrote: Also, does anyone know where the ZigBee/IEEE 802.15.4 dissector is? I have the patch that was sent to the mailing list, but it

Re: [Wireshark-dev] SVN Commit With IPMB Support?

2007-08-31 Thread Tyson Key
think any code has been submitted. > Regards > Anders > > -Ursprungligt meddelande- > Från: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] För Tyson Key > Skickat: den 31 augusti 2007 01:33 > Till: Developer support list for Wireshark > Ämne: Re: [Wireshark-dev] S

Re: [Wireshark-dev] SVN Commit With IPMB Support?

2007-08-30 Thread Tyson Key
page. Also, does anyone know where the ZigBee/IEEE 802.15.4 dissector is? I have the patch that was sent to the mailing list, but it doesn't seem to compile. Thanks. Stephen Fisher wrote: > On Thu, Aug 30, 2007 at 11:42:37PM +0100, Tyson Key wrote: > > >> Hi. I'm no

[Wireshark-dev] SVN Commit With IPMB Support?

2007-08-30 Thread Tyson Key
Hi. I'm not sure if this is the right place to ask, but does anyone know if the supposed SVN commit/patch for IPMB dissecting support has been checked in or has been made available somewhere? I've been checking the SVN commits every few hours, and haven't come across it, nor can I find the supp