aboutsummaryrefslogtreecommitdiffstats
path: root/epan/dissectors/packet-cisco-wids.c
AgeCommit message (Collapse)AuthorFilesLines
2019-07-26HTTPS (almost) everywhere.Guy Harris1-1/+1
Change all wireshark.org URLs to use https. Fix some broken links while we're at it. Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c Reviewed-on: https://code.wireshark.org/review/34089 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-12dissectors: use SPDX identifiers.Dario Lombardo1-13/+1
Change-Id: I92c94448e6641716d03158a5f332c8b53709423a Reviewed-on: https://code.wireshark.org/review/25756 Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-10-13Convert most UDP dissectors to use "auto" preferences.Michael Mann1-29/+5
Similar to the "tcp.port" changes in I99604f95d426ad345f4b494598d94178b886eb67, convert dissectors that use "udp.port". More cleanup done on dissectors that use both TCP and UDP dissector tables, so that less preference callbacks exist. Change-Id: If07be9b9e850c244336a7069599cd554ce312dd3 Reviewed-on: https://code.wireshark.org/review/18120 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-05-20Cisco WIDS wlan frames as sent by standalone APs do not include the QoS controlJoerg Mayer1-1/+1
stuff. Bug: 12421 Change-Id: Idc56bd573b72465e36c8141d3c0736b286ff220a Reviewed-on: https://code.wireshark.org/review/15448 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Jörg Mayer <jmayer@loplof.de>
2016-05-11Decode the first 6 bytes of Unknown1 as Timestamp: Two recorded BeaconsJoerg Mayer1-3/+10
had the identical difference in the timestamp and unknown1 value, and the difference was almost identical to the beacon interval (102398 vs 102400us). Change-Id: Ic3fe8c1b52f3e9852ffdeae0fda79c5cb2e1482b Reviewed-on: https://code.wireshark.org/review/15368 Reviewed-by: Jörg Mayer <jmayer@loplof.de>
2016-03-20Manually add protocol dependencies derived from find_dissector.Michael Mann1-1/+1
Started by grepping call_dissector_with_data, call_dissector_only and call_dissector and traced the handles passed into them to a find_dissector within the dissector. Then replaced find_dissector with find_dissector_add_dependency and added the protocol id from the dissector. "data" dissector was not considered to be a dependency. Change-Id: I15d0d77301306587ef8e7af5876e74231816890d Reviewed-on: https://code.wireshark.org/review/14509 Petri-Dish: Michael Mann <mmann78@netscape.net> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-12-24Refactor 802.11 radio flags.Simon Barber1-1/+2
The use of a flag field here is aesthetically unpleasing when the flags are referred to frequently. Convert these into bitfield entries. Change-Id: I6f47e31558439dfd343ec7f856d04480366a1237 Reviewed-on: https://code.wireshark.org/review/12511 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-12-09new_create_dissector_handle -> create_dissector_handle for dissector directory.Michael Mann1-1/+1
Some of the ASN.1 dissectors still generate a new_create_dissector_handle from the tool itself, so leave those for now. Change-Id: Ic6e5803b1444d7ac24070949f5fd557909a5641f Reviewed-on: https://code.wireshark.org/review/12484 Petri-Dish: Anders Broman <a.broman58@gmail.com> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-11-16create_dissector_handle -> new_create_dissector_handleMichael Mann1-3/+4
Picking off "easy" dissectors that only have one or two exit points at most. Change-Id: Ie514f126352e7598acc4f7c38db9c61d105d5e48 Reviewed-on: https://code.wireshark.org/review/11850 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-06-25Clean up 802.11 radio information handling.Guy Harris1-0/+1
Have a field that holds the PHY type but nothing else. Have a union with structures holding PHY-type-specific information, as a bunch of attributes are PHY-specific. If we have a channel and band, but don't have the frequency, attempt to calculate the frequency, and add that to the radio information if we succeed. If we have the frequency, but don't have the channel, attempt to calculate the channel, and add that to the radio information if we succeed. Handle FHSS information, 11a "half/quarter-clocked" and turbo information, 11g normal vs. Super G, additional 11n and 11ac information, and the "short preamble" flag for 11b and 11g. Add a PHY type for 11 legacy DSSS and detect it if possible. Clean up the AVS dissector - make all fields wlancap. fields (if you want generic fields, use the wlan_radio. fields). Set more fields when writing out Commview Wi-Fi files. Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69 Reviewed-on: https://code.wireshark.org/review/9146 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-20Call the "802.11 radio information" dissector for radio headers.Guy Harris1-3/+12
Have dissectors of various forms of radio information headers in the packets fill in a struct ieee_802_11_phdr with radio information as appropriate, and call the "802.11 radio information" dissector rather than the raw 802.11 dissector. This means that the radio information can be found in a protocol-independent and encapsulation-independent form when you're looking at the packet; that information can be presented in a form somewhat easier to read than the raw metadata header format. It also enables having a single "radio information" tap that allows statistics to handle all different sorts of radio information encapsulation. In addition, it lets us clean up some of the arguments passed to the common 802.11 dissector routine, by having it pull that information from the struct ieee_802_11_phdr. Ensure that the right structure gets passed to that routine, and that all the appropriate parts of that structure are filled in. Rename the 802.11 radio protocol to "wlan_radio", rather than just "radio", as it's 802.11-specific. Give all its fields "wlan_radio." names rather than "wlan." names. Change-Id: I78d79afece0ce0cf5fc17293c1e29596413b31c8 Reviewed-on: https://code.wireshark.org/review/8992 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-04-16Replace deprecated tvb_length APIsAndersBroman1-1/+1
Change-Id: Idfd3bed012e823de544fe4de483c8f095fc7c65d Reviewed-on: https://code.wireshark.org/review/8086 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-12-22First batch of unincludes. Last attempt...Martin Mathieson1-1/+0
Change-Id: I3681462aeb98ca62ed3ec5eb226b2553317391a9 Reviewed-on: https://code.wireshark.org/review/5997 Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com> Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2014-12-21Cleanup use of #includes in non-generated epan/dissector/*.cBill Meier1-1/+0
Specifically: - Set packet.h to be the first wireshark #include after config.h and "system" #includes. packet.h added as an #include in some cases when missing. - Remove some #includes included (directly/indirectly) in packet.h. E.g., glib.h. (Done only for those files including packet.h). - As needed, move "system" #includes to be after config.h and before wireshark #includes. - Rework various #include file specifications for consistency. - Misc. Change-Id: Ifaa1a14b50b69fbad38ea4838a49dfe595c54c95 Reviewed-on: https://code.wireshark.org/review/5923 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-11-26Remove the use of pinfo->private_data from dissectors that just save it to ↵Michael Mann1-7/+0
restore it. Change-Id: I13197cc48068bb35ee12a7023cfe5f76bbc4e264 Reviewed-on: https://code.wireshark.org/review/5486 Petri-Dish: Michael Mann <mmann78@netscape.net> Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-09-30Add editor modelines; Adjust whitespace; Remove boilerplate commentsBill Meier1-0/+12
Change-Id: I1f5f83ed441f6009125cf2cbe5023af04986898a Reviewed-on: https://code.wireshark.org/review/4392 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-08-03Eliminate proto_tree_add_text from some dissectors.Michael Mann1-10/+10
Change-Id: I398e9cf4f6882e76644aa758e12c39a39159e95f Reviewed-on: https://code.wireshark.org/review/3319 Petri-Dish: Michael Mann <mmann78@netscape.net> Petri-Dish: Evan Huus <eapache@gmail.com> Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-06-20Rename dissector_add_handle() to dissector_add_for_decode_as().Guy Harris1-1/+1
Hopefully that name makes it clear what the routiner's purpose is, and will encourage people to use it rather than using dissector_add_uint() with a bogus integer value. Change-Id: Ic5be456d0ad40b176aab01712ab7b13aed5de2a8 Reviewed-on: https://code.wireshark.org/review/2483 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-06-19Revert "Fixup: tvb_* -> tvb_captured"Michael Mann1-1/+1
https://www.wireshark.org/lists/wireshark-dev/201406/msg00131.html This reverts commit 246fe2ca4c67d8c98caa84e2f57694f6322e2f96. Change-Id: Ib24bae0198c13a84bd7f731bf4af921212109a8f Reviewed-on: https://code.wireshark.org/review/2430 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-06-18Fixup: tvb_* -> tvb_capturedDario Lombardo1-1/+1
Change-Id: I9209c1271967405c34c1b6fa43e1726a4d3a5a3f Reviewed-on: https://code.wireshark.org/review/2377 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-06-07tvb_new_subset -> tvb_new_subset_length when length parameters are equal.Michael Mann1-3/+3
tvb_new_subset -> tvb_new_subset_remaining it appears that's what the intention is. Change-Id: I2334bbf3f10475b3c22391392fc8b6864454de2d Reviewed-on: https://code.wireshark.org/review/1999 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2014-05-29Introduce 802.11 dissectors with wired-in "FCS present" indications.Guy Harris1-1/+1
For a number of protocols that encapsulate 802.11 frames inside packets, whether the frame includes an FCS or not is specified by the protocol, not by whether the link-layer frame carrying the packets *itself* includes an FCS. As we've done with Ethernet, add "_withfcs" and "_withoutfcs" dissectors, which *don't* check the pseudo-header FCS length indication, and call those, rather than dissectors that check the pseudo-header length indication, from the dissectors for those protocols. Change-Id: Ib8c8ecdd872e1782fdfc66e7573415d91911a62e Reviewed-on: https://code.wireshark.org/review/1866 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2013-11-10Add missing includes in order to remove exceptions.h from proto.h (next commit).Jakub Zawadzki1-0/+1
svn path=/trunk/; revision=53230
2013-02-27Move show_exception() and show_reported_bounds_error() toGuy Harris1-8/+3
epan/show_exception.c, as it's used outside epan/dissectors/packet-frame.c. Update their callers to include <epan/show_exception.h> to get their declaration. Add a CATCH_NONFATAL_ERRORS macro that catches all exceptions that, if there's more stuff in the packet to dissect after the dissector call that threw the exception, doesn't mean you shouldn't go ahead and dissect that stuff. Use it in all those cases, including ones where BoundsError was inappropriately being caught (you want those passed up to the top level, so that the packet is reported as having been cut short in the capture process). Add a CATCH_BOUNDS_ERRORS macro that catches all exceptions that correspond to running past the end of the data for a tvbuff; use it rather than explicitly catching those exceptions individually, and rather than just catching all exceptions (the only place that DissectorError should be caught, for example, is at the top level, so dissector bugs show up in the protocol tree). Don't catch and then immediately rethrow exceptions without doing anything else; just let the exceptions go up to the final catcher. Use show_exception() to report non-fatal errors, rather than doing it yourself. If a dissector is called from Lua, catch all non-fatal errors and use show_exception() to report them rather than catching only ReportedBoundsError and adding a proto_malformed item. Don't catch exceptions when constructing a trailer tvbuff in packet-ieee8023.c - just construct it after the payload has been dissected, and let whatever exceptions that throws be handled at the top level. Avoid some TRY/CATCH/ENDTRY cases by using checks such as tvb_bytes_exist() before even looking in the tvbuff. svn path=/trunk/; revision=47924
2012-09-20We always HAVE_CONFIG_H so don't bother checking whether we have it or not.Jeff Morriss1-3/+1
svn path=/trunk/; revision=45017
2012-08-11Revert r44441: pinfo may be NULL only when pi is not NULLPascal Quantin1-1/+1
svn path=/trunk/; revision=44445
2012-08-11After commit r44435: pinfo -> NULLJörg Mayer1-1/+1
svn path=/trunk/; revision=44441
2012-06-28Update Free Software Foundation address.Jakub Zawadzki1-1/+1
(COPYING will be updated in next commit) svn path=/trunk/; revision=43536
2011-10-21For proto_tree_add_item(..., proto_xxx, ...)use ENC_NA as the encoding arg.Bill Meier1-1/+1
Also: remove trailing whitespace for a number of files. svn path=/trunk/; revision=39503
2011-10-04Use ENC_NA as encoding for proto_tree_add_item() calls which directly ↵Bill Meier1-3/+3
reference an hf item (in hf[] with types: FT_NONE FT_BYTES FT_IPV6 FT_IPXNET FT_OID Note: Encoding field set to ENC_NA only if the field was previously TRUE|FALSE|ENC_LITTLE_ENDIAN|ENC_BIG_ENDIAN svn path=/trunk/; revision=39260
2011-09-26Get rid of check_col, while at it set ENC.Anders Broman1-5/+3
svn path=/trunk/; revision=39147
2011-09-19Since the call to proto_tree_add_text() was #if 0'd out, there's no need to ↵Chris Maynard1-2/+3
assign the return value of tvb_new_subset to wlan_tvb. Actually, there's probably no need to call tvb_new_subset() in the first place, but for now let's just tackle the unused value warning and leave the FIXME for someone who knows more about this. Fixes Coverity CID 864. svn path=/trunk/; revision=39055
2011-08-26Replace TRUE/FALSE with the new ENCAP stuff where appropriateJörg Mayer1-8/+8
svn path=/trunk/; revision=38746
2011-04-18Removed some unneeded assignments.Stig Bjørlykke1-2/+1
Found by clang. svn path=/trunk/; revision=36698
2010-12-20Rename the routines that handle dissector tables with unsigned integerGuy Harris1-2/+2
keys to have _uint in their names, to match the routines that handle dissector tables with string keys. (Using _port can confuse people into thinking they're intended solely for use with TCP/UDP/etc. ports when, in fact, they work better for things such as Ethernet types, where the binding of particular values to particular protocols are a lot stronger.) svn path=/trunk/; revision=35224
2010-10-08Restore pinfo->private_data after an exception was thrown by a subdissector.Jeff Morriss1-4/+12
This is necessary in case a subdissector had changed it but was unable to restore it (due to the exception). Remove check_col(). svn path=/trunk/; revision=34436
2009-09-23Don't col_clear() followed by col_set_str(). A col_set_str() will clear ↵Kovarththanan Rajaratnam1-2/+0
(replace) any existing string (the fence still needs to be respected though) svn path=/trunk/; revision=30086
2009-08-09Don't guard col_set_str (COL_INFO/COL_PROTOCOL) with col_checkKovarththanan Rajaratnam1-3/+1
svn path=/trunk/; revision=29345
2009-08-09Don't guard col_clear with col_checkKovarththanan Rajaratnam1-2/+1
svn path=/trunk/; revision=29344
2009-08-09Don't guard col_set_str (COL_PROTOCOL) with col_checkKovarththanan Rajaratnam1-2/+1
svn path=/trunk/; revision=29340
2008-09-12Small revisions related to proto_reg_handoff ....Bill Meier1-8/+20
svn path=/trunk/; revision=26185
2007-10-23Apply the small performance enhancment patches for:Anders Broman1-1/+1
- if offset is 0, tvb_length is the same as tvb_length_remaining, just faster. Replace - col_append_fstr() with faster col_append_str() - col_add_str() with col_set_str() when it's safe svn path=/trunk/; revision=23252
2007-04-13Fix various warningsStephen Fisher1-1/+1
Move packet-cops.c out of clean dissectors due to a #define conflict in the headers of net-snmp with our config.h svn path=/trunk/; revision=21398
2006-07-25One of the bytes in the cisco header is the channel number thatJörg Mayer1-23/+31
the AP received the frame. svn path=/trunk/; revision=18790
2006-07-09Start declaring the proto_reg... functions to fix 'warning: no previous ↵Jörg Mayer1-4/+5
declaration' svn path=/trunk/; revision=18691
2006-07-06New dissector for the cisco wireless ids communication protocolJörg Mayer1-0/+198
(name invented by me, better suggenstions welcome). svn path=/trunk/; revision=18671
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-21 08:30:12 +0000