aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2003-04-15Put in a comment noting that the reassembly code assumes subdissectorsGuy Harris1-2/+8
are idempotent, which isn't necessarily the case. svn path=/trunk/; revision=7462
2003-04-15When dissecting a SYSTEM_TIME, include the milliseconds in the top-levelGuy Harris1-5/+6
summary item. svn path=/trunk/; revision=7461
2003-04-15Don't put "[DCE/RPC fragment]" into the Info column if the packet isn'tGuy Harris1-5/+7
fragmented. "PFC_NOT_FRAGMENTED()" is checked early in "dissect_dcerpc_cn_stub()"; there's no need to check it again in either of the code paths after that, as we know it's true in the first code path and false in the second. svn path=/trunk/; revision=7460
2003-04-15From Didier Gautheron: more getserverinfo decoding.Guy Harris1-6/+50
svn path=/trunk/; revision=7459
2003-04-15From Devin Heitmueller: dissect the "List" subtype in the Server StoredGuy Harris1-4/+139
List (SSI) family. svn path=/trunk/; revision=7458
2003-04-14Keep the two sides of a pipe separate when doing DCERPC-over-a-pipeGuy Harris1-6/+19
reassembly. (Perhaps we *shouldn't* see reassembly in progress in both directions, if the protocol is purely request/response, but that doesn't mean you won't see it in a capture, due to bugs or dropped packets or....) svn path=/trunk/; revision=7457
2003-04-14From Anders Broman: dissect user-to-user IEs in ISUP messages as Q.931Guy Harris4-4/+10
UU IE's. svn path=/trunk/; revision=7456
2003-04-14Add a new routine "dissect_file_data_maybe_dcerpc()" to handle fileGuy Harris1-71/+38
read/write data that might, or might not, be DCE RPC information on a pipe, and use that routine rather than duplicating similar code in multiple places. svn path=/trunk/; revision=7455
2003-04-14Fix up some comments.Guy Harris1-6/+16
svn path=/trunk/; revision=7454
2003-04-14Reassembly of DCE/RPC fragments for Request packets was slightly broken.Ronnie Sahlberg1-131/+183
Fixed this and rewrote the fragment reassembly routine to make it cleaner and hopefully easier to read. svn path=/trunk/; revision=7453
2003-04-14The two extra bytes in the write_andx request is only present if bothRonnie Sahlberg1-6/+16
the MEssageStart and the Raw bits are set. svn path=/trunk/; revision=7452
2003-04-14Don't show a string for datastream types other than the ones known toGuy Harris1-7/+21
SPX. For the datastream types known to SPX, display it in the Info column. svn path=/trunk/; revision=7451
2003-04-14Use symbolic names for the various write mode bits.Guy Harris1-14/+28
To test whether a single bit is set, just do "if (mode&bit)", not "if ((mode&bit)==bit)". In the places where read and write data is processed, have both a comment indicating that it's file data and that you can transport DCERPC over SMB just with reads and writes, to indicate why we may call the DCERPC-over-a-pipe dissector. svn path=/trunk/; revision=7450
2003-04-13"dcerpc_fragment_table" is used only in packet-smb-pipe.c, except forGuy Harris3-16/+16
the call to initialize it; move the call to initialize it to the registration routine for the dissector that uses it, move the definition of ""dcerpc_fragment_table" to packet-smb-pipe.c, make it static, and remove the declaration of it from smb.h. Add some casts to squelch compiler complaints. svn path=/trunk/; revision=7449
2003-04-13Update FAQ to April 10thJörg Mayer2-242/+414
svn path=/trunk/; revision=7448
2003-04-13make-manuf:Jörg Mayer3-184/+104
Don't print Cavebear skipped - it makes the output unusable. manuf.tmpl: Remove entries that overwrite identical or similar results from IEEE manuf: Rebuild to reflect the changes in manuf.tmpl and add some new IEEE entries. svn path=/trunk/; revision=7447
2003-04-12Missing file from previous commitRonnie Sahlberg1-29/+165
svn path=/trunk/; revision=7446
2003-04-12Rewrite the DCERPC over SMB reassembly completely.Ronnie Sahlberg2-87/+22
Move the actual reassembly to packet-smb-pipe.c instead of having it inside the packet-smb.b/Write_andX and ReadAndX dissectors. Change the dissector to only call dcerpc dissector from the packet where reassembly was completed instead of always from the first fragment. Add display fiulter field for the other fragments that display which frame the dcerpc pdu was reassembled in. This is needed in order to be able to reassemble the type of dcerpc fragments that are sent between nt4 dc's. The DCERPC fragment reassembly in the dcerpc layer is still broken though, and i think it has been broken for quite some time. That will be addressed shortly. svn path=/trunk/; revision=7445
2003-04-12From Jeff Morriss: don't put stuff in the Info column if a subdissectorGuy Harris2-15/+38
is called, so that we don't get a mix of M3UA and subdissector stuff. svn path=/trunk/; revision=7444
2003-04-12Some packets (the ones I've seen have a datastream type ofGuy Harris1-1/+2
"End-of-Connection Acknolwedgment") have none of the connection control bits set; describe them as "Data, No Ack Required" rather than "Unknown". svn path=/trunk/; revision=7443
2003-04-12An SPX packet is not a retransmission of an earlier packet unless theGuy Harris1-59/+92
two packets have the same sequence number; use the sequence number in the hash key. The sequence number is not incremented for system packets, and system packets probably don't get ACKed and thus presumably don't get retransmitted, so don't do retransmission checks for system packets. svn path=/trunk/; revision=7442
2003-04-12Fix a typo.Guy Harris1-2/+2
svn path=/trunk/; revision=7441
2003-04-12You can't put an FT_FRAMENUM into the tree with a length of -1, so, forGuy Harris1-2/+7
a retransmitted SPX frame, just put the number of the original frame in as an item not referring to any data (offset and length of 0), and, if there is any remaining data, put it into the tree as a separate item. svn path=/trunk/; revision=7440
2003-04-11From Jeff Morriss: rather than re-initializing the Info column with eachGuy Harris2-6/+54
PDU, just append the message type acronym to the column, so you can see the message types for all the messages in the frame. svn path=/trunk/; revision=7439
2003-04-10From Jeff Morriss: add support for the Chinese ITU variant of SS7.Guy Harris6-183/+319
svn path=/trunk/; revision=7438
2003-04-10From Anders Broman: decode ISUP element User service info as Q.931Guy Harris1-2/+5
Bearer capability. svn path=/trunk/; revision=7437
2003-04-10The NT Security Descriptor revision field is only one byte, not two.Ronnie Sahlberg1-6/+10
Make the dissector decode the first two bytes of the security descriptor as one byte for the revision and the second byte as nothing/should be zero. svn path=/trunk/; revision=7436
2003-04-10Some COL_INFO goodies for SpoolssWritePrinter.Tim Potter1-2/+11
svn path=/trunk/; revision=7435
2003-04-10From David Frascone: use a string constant rather than a global variableGuy Harris1-6/+2
for the full name of the Diameter protocol. svn path=/trunk/; revision=7434
2003-04-09Make the individual flag bits in the Connection Control field of the SPXGuy Harris3-53/+110
header be filterable fields. Don't hand retransmitted SPX frames to subdissectors - just show the payload as a retransmission of the original frame. Instead of handing a retransmission indicator to SPX subdissectors, hand them a structure containing the datastream type (under the assumption that it's data for the protocol running atop SPX, and that the dissector for that protocol might use it) and the state of the end-of-message bit (under the assumption that it's data for the protocol running atop SPX). svn path=/trunk/; revision=7433
2003-04-09Instead of using passing the SPX hash value to subdissectors, attach toGuy Harris3-74/+115
frames that are retransmissions a data structure containing the frame number of the original frame, and pass that to subdissectors (or, if not present, pass NULL). That means we can free the hash values when we're done with the first pass through the packets. svn path=/trunk/; revision=7432
2003-04-09Update for NSIS 2.0Gerald Combs1-5/+10
svn path=/trunk/; revision=7431
2003-04-09Squelch a compiler warning - the problem "should not happen", as aGuy Harris1-2/+2
WriteAndX request should have a full complement of word parameters, but, just in cast it doesn't.... (Should we somehow arrange to throw an exception if there aren't enough word or byte parameters in SMBs, i.e. impose a minimum in some cases?) svn path=/trunk/; revision=7430
2003-04-09From Tom Uijldert: properly decode the packet sequence number in WTPGuy Harris1-2/+2
Negative Ack packets. svn path=/trunk/; revision=7429
2003-04-09Update to WriteAndX request decoding so it can handle the pipe bits properly.Ronnie Sahlberg1-2/+21
If both mode bits MessageStart and WriteRaw are set, then the first two bytes of the byte-field is the total length of the data written to the pipe. svn path=/trunk/; revision=7428
2003-04-09Added new field reassembled_in to the fragment data structure.Ronnie Sahlberg2-3/+11
This field gets set to the frame number when this pdu was first completely reassembled. This is useful since it will allow us to do reassembly properly in say packet-ip.c instead of printing the full pdu for every fragment and thus making NFSoverUDP rpc-rtt statistics less than useful. A dissector using fragment_add() can tehn choose to only dissect the reassembled PDU only for the frame where it was first reassembled. svn path=/trunk/; revision=7427
2003-04-09Fix some spelling/punctuation/capitalization/etc. errors.Guy Harris1-12/+12
svn path=/trunk/; revision=7426
2003-04-09Don't create a protocol tree or do anything to the columns beforeGuy Harris2-32/+37
calling "tcp_dissect_pdus()", so that if we don't have the final segment of a multi-segment packet, we don't change the columns or put in an empty protocol tree item for NDPS. Rename "ndps.desegment_ndps" to "ndps.desegment_tcp" - the "ndps." is sufficient to indicate that it's for desegmenting NDPS, but we now have a flag for desegmenting NDPS-over-SPX, so we should indicate that the other flag is for desegmenting NDPS-over-TCP. svn path=/trunk/; revision=7425
2003-04-09Clean up the handling of the completion code.Guy Harris1-7/+8
svn path=/trunk/; revision=7424
2003-04-08Add "proto_tree_add_none_format()" to the set of functions exported toGuy Harris5-5/+10
plugins. svn path=/trunk/; revision=7423
2003-04-08make-manuf:Jörg Mayer3-6191/+278
Sometimes printed a \n too much manuf.tmpl: Remove most manual Mappings to Cisco because that's what gets used anyway (all except Racal and Newpoint) manuf: Update to represent changes in make-manuf, manuf.tmpl and IEEE svn path=/trunk/; revision=7422
2003-04-08When dissecting a reply, don't put the frame number of the correspondingGuy Harris1-6/+5
request into the protocol tree if we haven't seen the request. svn path=/trunk/; revision=7421
2003-04-08"ndps_req_hash_cleanup()" doesn't need to do anything (the dataGuy Harris1-15/+5
structure it frees has no pointers to anything), so eliminate it. The XID argument to "dissect_ndps_request()" isn't used, so eliminate it. svn path=/trunk/; revision=7420
2003-04-08Get rid of unused "ddp_dissector_table" variable.Guy Harris1-14/+16
For replies, correctly put the frame number of the corresponding request into the protocol tree; don't put it in as if it were the XID. That means we don't need to pass the XID as an argument to "dissect_ndps_reply()". svn path=/trunk/; revision=7419
2003-04-08Move the definition of the structure constructed for each SPXGuy Harris4-79/+95
transmission (and shared by all retransmissions), and passed to SPX subdissectors, to "packet-ipx.h", and use the same structure in the SPX dissector and the NDPS dissector. Set up conversations and those structures without checking whether we've seen the packet before or not; just check whether we find the conversation before creating a new one, and check whether we find a structure for the packet before creating a new one. Pass it to the subdissector regardless of whether we've seen the packet before or not, and check it in the NDPS dissector regardless of whether we've seen it before or not. Don't store a "retransmission" flag in the structure - the initial transmission and the retransmissions all share a single data structure, but they don't all have the same value for the "retransmission" flag, and you can tell whether a packet is a retransmission or not by comparing its frame number with the frame number from the structure; if they're different, it's a retransmission. svn path=/trunk/; revision=7418
2003-04-08From Greg Morris: update the introductory comment, add defragmentationGuy Harris2-974/+7041
support, fix various bugs, and finish up the NDPS decodes. svn path=/trunk/; revision=7417
2003-04-08From Greg Morris: update the introductory comment, fix the handlingGuy Harris1-6/+9
of the completion code, and tweak the description of continuation fragments. svn path=/trunk/; revision=7416
2003-04-08From Greg Morris: update the introductory comment.Guy Harris1-1/+5
svn path=/trunk/; revision=7415
2003-04-08From Greg Morris: update the introductory comment, and flag SPXGuy Harris1-6/+185
retransmissions in the Info column. svn path=/trunk/; revision=7414
2003-04-08From Greg Morris: update the introductory comment.Guy Harris1-1/+5
svn path=/trunk/; revision=7413
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-23 02:45:52 +0000