[Wireshark-users] allocate p2p traffic

2008-03-17 Thread Pilugin Alexander
Hello, Please advise how can i separate p2p data packets (bittorent) from all other packets with header eth:ip:tcp:data. Thank you! -- Best regards, Alexander Pilugin mailto:[EMAIL PROTECTED] ___ Wireshark-users mailing list

[Wireshark-users] Re-assembling a RTP packet stream into a video

2008-03-17 Thread Scott Morgan
First time post, so I'm not exactly sure on the etiquette/formatting, etc. I am trying to save an mms stream, into a video. I have captured the required packets, but am not sure where to go from there. I'm fairly sure this is possible, as I remember reading a document about it back before the swi

Re: [Wireshark-users] Setting up fields with little endianess for a custom dissector

2008-03-17 Thread Guy Harris
On Mar 17, 2008, at 11:25 AM, Leandro Lucarella wrote: > But I still can't find a way to tell (looked at FT_* and BASE_* > constants) wireshark to interpret the field as little endian. The byte order is *NOT* a property of the field; there exist protocols (X11 and DCE RPC, to name two) where a

Re: [Wireshark-users] tshark -Ttext output

2008-03-17 Thread Sake Blok
On Mon, Mar 17, 2008 at 03:47:57PM -0400, Rob MacKenzie wrote: > Great app, quick question. > > I am using tshark as part of a larger program, and I need the packet > summaries from a pcap file. > > I am getting the format I need by piping out from > > tshark -r myfile.pcap -Ttext > outfile.txt

[Wireshark-users] tshark -Ttext output

2008-03-17 Thread Rob MacKenzie
Great app, quick question. I am using tshark as part of a larger program, and I need the packet summaries from a pcap file. I am getting the format I need by piping out from tshark -r myfile.pcap -Ttext > outfile.txt My questions are: 1: is there no way to get tshark to output not to standard

[Wireshark-users] Setting up fields with little endianess for a custom dissector

2008-03-17 Thread Leandro Lucarella
Hi! I'm making a custom wireshark dissector (in LUA), but I have a problem. The protocol is for a TIPC cluster, so it uses the host byte order (little endian in our case) but when I add fields to the protocol tree it seems that all the fields are interpreted as big endian. Is there any way to

[Wireshark-users] windows script to convert snoop to pcap

2008-03-17 Thread miguel olivares varela
Hi everybody i try to do it an script in windows to convert .snoop files to .pcap, to do it i can use the command "tchark" but i really don't how to do it for a lot of files. Does anybody can help me? i have an idea but it doen't works propoerly @echo offsetlocal ENABLEDELAYEDEXPA

Re: [Wireshark-users] No decoder

2008-03-17 Thread Marc Quibell
I already posted the relevent portions of the debug file in a previous post, but here it is again: ssl_init keys string: 127.0.0.1,9443,ssl,E:\SSL_monitoring\key-cleartext.pem;192.168.122.9,9443,ssl,E:\SSL_monitoring\key-cleartext.pem;172.24.2.31,9443,ssl,E:\SSL_monitoring\key-cleartext.pem; ssl_i