Age | Commit message (Collapse) | Author | Files | Lines |
|
Convert ethertype() and dissect_null() to use tvbuff.
svn path=/trunk/; revision=1979
|
|
in tvbuff terminology). This is implemented for TVBUFF_REAL and TVBUFF_SUBSET
so far; support for TVBUFF_COMPOSITE is coming soon.
Throw either ReportedBoundsError or BoundsError.
A ReportedBoundsError is reported as "Malformed Frame" since the protocol
stated that a certain number of bytes should be available but they weren't.
A BoundsError is reported as a "Short Frame" since the snaplen was too short.
Register proto_short (BoundsError) and proto_malformed (ReportedBounds)
so searches can be made on "short" and "malformed".
svn path=/trunk/; revision=1965
|
|
Tethereal was dying on me because err was initialized to some random value.
It was this section of code that would exit even if wtap_loop was successful
(returned TRUE) because err was never initialized or set to anything.
err = load_cap_file(&cf, out_file_type);
if (err != 0) {
dissect_cleanup();
exit(2);
}
<BIGGER sheepish grin>
Fixed even more errors in LLC dissector. I had inadvertantly used the
wrong tvbuff_t* when calling dissect_data_tvb(). There is no way we are going
to be successful in this tvbuff conversion w/o regression testing. I'm
working on setting up a simple Makefile for regression testing tonight.
That's why I'm finding so many bugs in my LLC conversion.
</BIGGER sheepish grin>
svn path=/trunk/; revision=1946
|
|
Fix error in my conversion to tvbuff routines.
Because offset was calculated based on next_tvb, which already knew to
skip 8 bytes, I don't have to use "offset+8" in calls to the next non-tvbuff
dissectors.
</sheepish grin>
svn path=/trunk/; revision=1945
|
|
Non-tvbuff dissectors create a tvbuff when calling dissect_llc()
Changed name of current_proto to match string in COL_PROTO ("FDDI" instead of "fddi")
Changed short text to be: [Short Frame: %s] where %s is current_proto.
svn path=/trunk/; revision=1943
|
|
Add exceptions routines.
Convert proto_tree_add_*() routines to require tvbuff_t* argument.
Convert all dissectors to pass NULL argument ("NullTVB" macro == NULL) as
the tvbuff_t* argument to proto_tree_add_*() routines.
dissect_packet() creates a tvbuff_t, wraps the next dissect call in
a TRY block, will print "Short Frame" on the proto_tree if a BoundsError
exception is caught.
The FDDI dissector is converted to use tvbuff's.
svn path=/trunk/; revision=1939
|
|
for protocols that run inside 802.2 LLC register themselves with it
using "dissector_add()".
Make various dissectors static if they can be, and remove from header
files declarations of those dissectors.
svn path=/trunk/; revision=1872
|
|
FT_UINT16 (that won't break things for U frames, where it's 1 byte).
svn path=/trunk/; revision=1838
|
|
svn path=/trunk/; revision=1831
|
|
svn path=/trunk/; revision=1826
|
|
protocol tree text for the control field - that protocol tree entry is
added by "dissect_xdlc_control()", which uses
"proto_tree_add_uint_format()" - and it's not a simple enumerated field
(which is why "proto_tree_add_uint_format()" is used, to show all the
various bits of the field). Eliminate it.
svn path=/trunk/; revision=1825
|
|
protocol tree text for the control field - that protocol tree entry is
added by "dissect_xdlc_control()", which uses
"proto_tree_add_uint_format()" - and it's not a simple enumerated field
(which is why "proto_tree_add_uint_format()" is used, to more fully
describe the field). Eliminate it.
svn path=/trunk/; revision=1824
|
|
This change allows you to add a new packet-*.c file and not cause a
recompilation of everything that #include's packet.h
Add the plugin_api.[ch] files ot the plugins/Makefile.am packaging list.
Add #define YY_NO_UNPUT 1 to the lex source so that the yyunput symbol
is not defined, squelching a compiler complaint when compiling the generated
C file.
svn path=/trunk/; revision=1637
|
|
least as I remember the ANSI C standard, but I guess they're warning you
that you might've intended to return the return value of a function but
forgot to put a parameter list after the function name).
svn path=/trunk/; revision=1626
|
|
with Cisco's "wacky proprietary protocols atop LLC/SNAP" OUI, and put in
"#if 0"ed out code for Cisco's DRiP.
svn path=/trunk/; revision=1604
|
|
svn path=/trunk/; revision=1603
|
|
svn path=/trunk/; revision=1601
|
|
http://www.optimized.com/COMPENDI/REF-SAP.htm
svn path=/trunk/; revision=1529
|
|
frames; rename "XDLC_HAS_PAYLOAD()" to "XDLC_IS_INFORMATION()", and if
the frame isn't an "information" frame, dissect its payload (if any) as
data.
svn path=/trunk/; revision=1528
|
|
the frame has a payload or not.
Note in a comment that in one capture there's a U frame with a function
of TEST, rather than UI, that appears to have a payload.
svn path=/trunk/; revision=1527
|
|
whether we're building a protocol tree or not.
Make "dissect_eth()" use "BYTES_ARE_IN_FRAME()" to see if we have a full
Ethernet header - it can be called with a non-zero offset, if Ethernet
frames are encapsulated inside other frames (e.g., ATM LANE).
Make capture routines take an "offset" argument if the corresponding
dissect routine takes one (for symmetry, and for Cisco ISL or any other
protocol that encapsulates Ethernet or Token-Ring frames inside other
frames).
Pass the frame lengths to capture routines via the "pi" structure,
rather than as an in-line argument, so that they can macros such as
"BYTES_ARE_IN_FRAME()" the way the corresponding dissect routines do.
Make capture routines update "pi.len" and "pi.captured_len" the same way
the corresponding diseect routines do, if the capture routines then call
other capture routines.
Make "capture_vlan()" count as "other" frames that are too short, the
way other capture routines do.
svn path=/trunk/; revision=1525
|
|
IOS 9.0 and bridged frame relay and update packet-llc.c accordingly. Add
CDP handler to capture_llc() in packet-llc.c.
svn path=/trunk/; revision=1524
|
|
constructing a protocol tree.
Don't add the protocol ID for unknown OUIs unless we're constructing a
protocol tree.
svn path=/trunk/; revision=1453
|
|
0x00000c and a protocol ID of 0x2000 - we used to recognize those as CDP
because we ignored the OUI and treated all LLC packets as
SNAP-encapsulated packets, and treated 0x2000 as an Ethertype, but we
now treat only encapsulated-Ethernet and Apple packets as
SNAP-encapsulated (and arguably we should handle Apple separately).
svn path=/trunk/; revision=1452
|
|
svn path=/trunk/; revision=1437
|
|
"value_string" array for OUIs.
Add the OUI for the ATM Forum to that list.
Handle the OUI for the ATM Forum in the layer 3 information for ISO TR
9577 in a Broadband Low Layer Information information element (for ATM
LANE).
Add an initial version of the dissection of TLV values in LANE LE
Control frames (I have no frames with TLV values against which to test
it, alas).
svn path=/trunk/; revision=1385
|
|
svn path=/trunk/; revision=1325
|
|
Command/Response bit in the SSAP, and the mask that extracts the rest of
the {D,S}SAP.
svn path=/trunk/; revision=1316
|
|
Handle figuring out correct dsap/ssap if the last bit is 0/1
svn path=/trunk/; revision=1315
|
|
packets as SNAP-encapsulated Ethernet; instead, they use one of their
*own* OUIs, followed by the Ethernet packet type for AppleTalk. (Even
more oddly, they *do* use SNAP-encapsulated Ethernet for AARP....)
Dissect OUI 08-00-07 the same way we dissect the SNAP-encapsulated
Ethernet OUI of 00-00-00, and identify it as an Apple OUI.
Add checks to make sure we actually have a full LLC header and, if it's
a SNAP frame, that we have a full SNAP header as well.
For non-SNAP frames, list both the DSAP and the SSAP in the Info column,
and, for SNAP frames, list the OUI and PID.
svn path=/trunk/; revision=1220
|
|
svn path=/trunk/; revision=1218
|
|
frames with an OUI of 00-00-00 as SNAP-encapsulated Ethernet, and, for
other SNAP frames, display the protocol ID as hex and dissect the
payload as data.
svn path=/trunk/; revision=1217
|
|
svn path=/trunk/; revision=1173
|
|
dynamically-assigned "ett_" integer values, assigned by
"proto_register_subtree_array()"; this:
obviates the need to update "packet.h" whenever you add a new
subtree type - you only have to add a call to
"proto_register_subtree_array()" to a "register" routine and an
array of pointers to "ett_", if they're not already there, and
add a pointer to the new "ett_" variable to the array, if they
are there;
would allow run-time-loaded dissectors to allocate subtree types
when they're loaded.
svn path=/trunk/; revision=1043
|
|
header, under the assumption that the address field was two octets.
It should return the length of the *control* field, and leave it up to
its caller to add in the length of the address field. (The address
field appears to be one byte in SNA, not two bytes.)
svn path=/trunk/; revision=1006
|
|
the base for numbers to be displayed in, bitmasks for bitfields, and blurbs
(which are one or two sentences describing the field).
proto_tree_add*() routines now automatically handle bitfields. You tell
it which header field you are adding, and just pass it the value of the
entire field, and the proto_tree routines will do the masking and shifting
for you.
This means that bitfields are more naturally filtered via dfilter now.
Added Phil Techau's support for signed integers in dfilters/proto_tree.
Added the beginning of the SNA dissector. It's not complete, but I'm
committing it now because it has example after example of how to use
bitfields with the new header_field_info struct and proto_tree routines.
It was the impetus to change how header_field_info works.
svn path=/trunk/; revision=815
|
|
svn path=/trunk/; revision=790
|
|
tree to anything other than 0, as we're going to change it to the right
value once the control field has been parsed and we know the right value.
svn path=/trunk/; revision=731
|
|
svn path=/trunk/; revision=728
|
|
xDLC control field, so that its caller can not only determine from it
whether the frame has a payload, but can also determine how long the
control field is. Put macros in "xdlc.h" to determine both of those.
Have "capture_llc()" and "dissect_llc()" use that information
appropriately.
svn path=/trunk/; revision=727
|
|
Boolean indicating whether the frame has any payload to dissect or not.
svn path=/trunk/; revision=556
|
|
if the SAPs are SNAP, based on their ethertype are I frames and UI
frames; others don't have payload to be dissected as belonging to other
protocols.
svn path=/trunk/; revision=555
|
|
LLC, the original NetBIOS encapsulation).
svn path=/trunk/; revision=466
|
|
SDLC-derived protocols such as HDLC and derivatives of it such as LAPB,
IEEE 802.2 LLC, and so on. Have the LLC and LAPB dissectors use it.
Make "dissect_numeric_bitfield()" put the low-order bit of the bitfield
in the low-order bit of an integer when printing it, so that the right
value is printed.
svn path=/trunk/; revision=434
|
|
allowing users to filter on the existence of these protocols. I also
added packet-clip.c to the Nmake makefile.
svn path=/trunk/; revision=402
|
|
suggestion, this new method using a static array should use less memory
and be faster. It also has a nice side-effect of making the source-code
more readble, IMHO.
Changed the print routines to look for protocol proto_data instead of
looking at the text label as they did before, hoping that the data hex
dump field item starts with "Data (".
Added the -G keyword to ethereal to make it dump a glossary of display
filter keywords to stdout and exit. This data is then formatted with
the doc/dfilter2pod perl program to pod format, which is combined
with doc/ethereal.pod.template to create doc/ethereal.pod, from which
the ethereal manpage is created. This way we can keep the manpage up-to-date
with a list of fields that can be filtered on.
svn path=/trunk/; revision=364
|
|
mechanism that is built into ethereal. Wiretap is now used to read all
file formats. Libpcap is used only for capturing.
svn path=/trunk/; revision=342
|
|
reference the protocol tree with struct proto_tree and struct proto_item
objects. That way, the packet decoding source code file can be used with
non-gtk packet decoders, like a curses-based ethereal, e.g. I also re-arranged
some of the information in packet.h to more appropriate places (like other
packet-*.[ch] files).
svn path=/trunk/; revision=223
|
|
just had to make "sap_capture_func()" return NULL if it didn't find an
entry for the SAP it was passed.
svn path=/trunk/; revision=220
|
|
"dissect_data"; if you call "dissect_data()" with an argument list of
the type expected by a "capture_XXX()" routine, it won't do the right
thing (and may do the wrong thing, e.g. crash).
Have "sap_capture_func()" (and "sap_dissect_func()") return function
pointers rather than "void *"s, so that I don't make a mistake like the
above in the future....
svn path=/trunk/; revision=219
|