| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
"pinfo->{len,captured_len}"-adjusting currently done by the IP
dissector, make the IP dissector call that rather than doing the work
itself, make the IPv6 dissector call that rather than just adjusting the
tvbuff length itself, and make the IPX dissector call that rather than
just adjusting "pi.{len,captured_len}" itself.
This cleans things up a bit, and causes trailers to be properly reported
in IPX-over-Ethernet frames.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3621 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
Joerg Mayer.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3578 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
"header_field_info" structure, including the ones that are later set by
the routines to register fields.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3561 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
PDU.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3527 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
"reassemble.h", and remove IPv4 dependencies from it.
Use it for OSI CLNP segment reassembly as well.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3525 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
"ip.fragment", and "ip.fragments" fields, so make them FT_NONE, not
FT_STRING. (Otherwise, if you try to do a "Match Selected" on them, we
dump core because the value is a null pointer and we try to dereference
it.)
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3512 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3436 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3426 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3324 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
"ipproto.h" header file.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3313 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
"proto_tree_add_item_hidden()", to add the "checksum bad" flags to
packets; the value should be "TRUE", not the numerical value of the
checksum field.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3202 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
than, well, dissecting the header length field), just show the packet
has having a bogus IP header length.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3198 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
DLT_HDLC to it.
Make a separate dissector for Cisco HDLC, and add a dissector for Cisco
SLARP. Have the PPP dissector call the Cisco HDLC dissector if the
address field is the Cisco HDLC unicast or multicast address. Use the
Cisco HDLC dissector for the Cisco HDLC Wiretap encapsulation type.
Add a new dissector table "chdlctype", for Cisco HDLC packet types
(they're *almost* the same as Ethernet types, but 0x8035 is SLARP, not
Reverse ARP, and 0x2000 is the Cisco Discovery protocol, for example),
replacing "fr.chdlc".
Have a "chdlctype()" routine, similar to "ethertype()", used both by the
Cisco HDLC and Frame Relay dissectors. Have a "chdlc_vals[]"
"value_string" table for Cisco HDLC types and protocol names. Split the
packet type field in the Frame Relay dissector into separate SNAP and
Cisco HDLC fields, and give them the Ethernet type and Cisco HDLC type
"value_string" tables, respectively.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3133 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
both of them as dissected by the IP dissector.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3105 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
Initialize the "hf_" value for "icmp.checksum_bad" to -1, the way all
other "hf_" values are initialized, and declare it and "ip.checksum_bad"
to have base BASE_NONE, not 4.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3087 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3064 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
the IP or ICMP checksum is bad.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3063 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
statements.
Move the setting of the Protocol column in various dissectors before
anything is fetched from the packet, and also clear the Info column at
that point in those and some other dissectors, so that if an exception
is thrown, the columns don't reflect the previous protocol.
Make the IP dissector static, as it's called only via dissector tables
or dissector handles. Also make the "dissect the TOS field as the
DiffServ DS field" flag static, as it's not referred to outside of
"packet-ip.c".
In the NCP dissector, refer to the port type through "pinfo" rather than
through the global "pi", as it's a tvbuffified dissector.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2929 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
dissectors for protcools that can be encapsulated inside GRE in that
table.
Fix a bug in the handling of WCCPv2 IP encapsulation (it was
constructing the next tvbuff before, rather than after, advancing the
offset past the redirection header).
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2893 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
its own; it's used not only by LLC, but by Frame Relay with RFC 2427 and
ATM with RFC 2684.
Support for RFC 2427-encapsulation Frame Relay packets, from Paul
Ionescu.
Get rid of the CISCO_IP PPP protocol type - Cisco HDLC uses, in most
cases, Ethernet packet types, so use ETHERTYPE_IP instead (they're both
0x0800).
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2854 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
"{old_}heur_dissector_add()", "{old_}conv_dissector_add()", and
"register_dissector()", so that an entry in those tables has associated
with it the protocol index of the protocol the dissector handles (or -1,
if there is no protocol index for it).
This is for future use in a number of places.
(Arguably, "proto_register_protocol()" should take a dissector pointer
as an argument, but
1) it'd have to handle both regular and heuristic dissectors;
2) making it take either a "dissector_t" or a union of that and
a "heur_dissector_t" introduces some painful header-file
interdependencies
so I'm punting on that for now. As with other Ethereal internal APIs,
these APIs are subject to change in the future, at least until Ethereal
1.0 comes out....)
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2849 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
with not terminating their arrays because they knew the limits of the
value used to look up strings in the value_string array, but the
dfilter_expr_dlg does not know these limits and must rely on the terminating
{0, NULL} record.
Also, in SNA fixed a bug in which a field should have been defined as FT_UINT8
but was defined as FT_BOOLEAN.
In WTP, fixed a value string which had duplicate keys.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2817 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
"prefs_register_module()" except that it takes a protocol index as
returned by "proto_register_protocol()" as its first argument, rather
than taking two character strings as arguments as its first two
arguments, and uses the protocol's abbreviation as the name to use for
preferences in the preferences file and the "-o" flag and uses the
protocol's short name as the name to use in the tabs in the
"Edit->Preferences" window.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2812 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
protocols, in addition to adding structures to the list of filterable
fields. Give it an extra argument that specifies a "short name" for the
protocol, for use in such places as
pinfo->current_proto;
the dialog box for constructing filters;
the preferences tab for the protocol;
and so on (although we're not yet using it in all those places).
Make the preference name that appears in the preferences file and the
command line for the DIAMETER protocol "diameter", not "Diameter"; the
convention is that the name in question be all-lower-case.
Make some routines and variables that aren't exported static.
Update a comment in the ICP dissector to make it clear that the
dissector won't see fragments other than the first fragment of a
fragmented datagram.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2810 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
or "[Malformed Frame]" to the Info column.
Make some dissectors set the Protocol column and clear the Info column
before fetching anything from the tvbuff they were handed, so that if
the frame is short or malformed, it'll be marked as being the right
top-level protocol, and the Info column won't have cruft left over from
the previous protocol.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2800 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2758 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
add FCS checking;
support Cisco HDLC format in the PPP dissector;
handle MPLS-over-PPP.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2754 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2753 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
(unlikely, perhaps even forbidden, but not impossible).
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2752 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
replace the existing checksummer with a modified version of the BSD
checksumming code. Add a flag to the "packet_info" structure to
indicate that a packet is the first fragment of a fragmented datagram,
so that the checksummers won't try to checksum those.
(It doesn't seem to add a lot of CPU overhead, so we don't introduce a
flag to disable it, yet. Further checks may be necessary to see whether
the overhead is just swamped by other overheads when scanning through a
capture dissecting all frames, or if it truly is negligible.)
Make the Boolean preference option controlling whether to make the
top-level protocol tree item for TCP display a packet summary static to
the TCP dissector (it doesn't need to be accessible outside the TCP
dissector).
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2751 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2747 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
doesn't just seem to be a profiling artifact) that, at least on FreeBSD
3.4, it's significantly more efficient to clear out a column by stuffing
a '\0' into the first byte of the column data than to do so by copying a
null string (I guess when copying one byte, the fixed overhead of the
procedure call and of "strcpy()" is significant).
Have the TCP dissector set the Protocol column, and clear the Info
column, before doing anything that might cause an exception to be
thrown, so that if we *do* get an exception thrown, the frame at least
shows up as TCP.
Instead of, in the TCP dissector, constructing a string and then
stuffing it into the Info column, just append to the Info column, which
avoids one string copy.
Pass a "frame_data" pointer to dissectors for TCP and IP (and PPP)
options, so they can use it to append to the Info column.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2744 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
can be put, and a pointer to the string for the column, which might or
might not point to that buffer.
Add a routine "col_set_str()", which sets the string for the column to
the string passed to it as an argument; it should only be handed a
static string (a string constant would be ideal). It doesn't do any
copying, so it's faster than "col_add_str()".
Make the routines that append to columns check whether the pointer to
the string for the column points to the buffer for the column and, if
not, copy the string for the column to the buffer for the column so that
you can append to it (so you can use "col_set_str()" and then use
"col_append_str()" or "col_append_fstr()").
Convert a bunch of "col_add_str()" calls that take a string constant as
an argument to "col_set_str()" calls.
Convert some "col_add_fstr()" calls that take a string constant as the
only argument - i.e., the format string doesn't have any "%" slots into
which to put strings for subsequent arguments to "col_set_str()" calls
(those calls are just like "col_add_str()" calls).
Replace an END_OF_FRAME reference in a tvbuffified dissector with a
"tvb_length(tvb)" call.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2670 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2658 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
the BSD AF_ type values it uses into an "aftypes.h" header file for
dissectors that register themselves in that dissector table include.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2653 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
fragmented IP datagram, although that's probably extremely unlikely.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2522 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
Ulrich Kiermayr <kie@thp.univie.ac.at>
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2441 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
the following:
It is now possible to enable/disable a particular protocol decoding
(i.e. the protocol dissector is void or not). When a protocol
is disabled, it is displayed as Data and of course, all linked
sub-protocols are disabled as well.
Disabling a protocol could be interesting:
- in case of buggy dissectors
- in case of wrong heuristics
- for performance reasons
- to decode the data as another protocol (TODO)
Currently (if I am not wrong), all dissectors but NFS can be disabled
(and dissectors that do not register protocols :-)
I do not like the way the RPC sub-dissectors are disabled (in the
sub-dissectors) since this could be done in the RPC dissector itself,
knowing the sub-protocol hfinfo entry (this is why, I've not modified
the NFS one yet).
Two functions are added in proto.c :
gboolean proto_is_protocol_enabled(int n);
void proto_set_decoding(int n, gboolean enabled);
and two MACROs which can be used in dissectors:
OLD_CHECK_DISPLAY_AS_DATA(index, pd, offset, fd, tree)
CHECK_DISPLAY_AS_DATA(index, tvb, pinfo, tree)
See also the XXX in proto_dlg.c and proto.c around the new functions.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2267 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
- add <stdarg.h> or <varargs.h> in snprintf.h
and remove those inclusions in the other #ifdef NEED_SNPRINTF_H codes
- remove the check of multiple inclusions in source (.c) code
(there is a bit loss of _cpp_ performance, but I prefer the gain of
code reading and maintenance; and nowadays, disk caches and VM are
correctly optimized ;-).
- protect all (well almost) header files against multiple inclusions
- add header (i.e. GPL license) in some include files
- reorganize a bit the way header files are included:
First:
#include <system_include_files>
#include <external_package_include_files (e.g. gtk, glib etc.)>
Then
#include "ethereal_include_files"
with the correct HAVE_XXX or NEED_XXX protections.
- add some HAVE_XXX checks before including some system header files
- add the same HAVE_XXX in wiretap as in ethereal
Please forgive me, if I break something (I've only compiled and regression
tested on Linux).
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2254 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
dissectors to be registered as dissectors for particular ports,
registered as heuristic dissectors, and registered as dissectors for
conversations, and have routines to be used both by old-style and
new-style dissectors to call registered dissectors.
Have the code that calls those dissectors translate the arguments as
necessary. (For conversation dissectors, replace
"find_conversation_dissector()", which just returns a pointer to the
dissector, with "old_try_conversation_dissector()" and
"try_conversation_dissector()", which actually call the dissector, so
that there's a single place at which we can do that translation. Also
make "dissector_lookup()" static and, instead of calling it and, if it
returns a non-null pointer, calling that dissector, just use
"old_dissector_try_port()" or "dissector_try_port()", for the same
reason.)
This allows some dissectors that took old-style arguments and
immediately translated them to new-style arguments to just take
new-style arguments; make them do so. It also allows some new-style
dissectors not to have to translate arguments before calling routines to
look up and call dissectors; make them not do so.
Get rid of checks for too-short frames in new-style dissectors - the
tvbuff code does those checks for you.
Give the routines to register old-style dissectors, and to call
dissectors from old-style dissectors, names beginning with "old_", with
the routines for new-style dissectors not having the "old_". Update the
dissectors that use those routines appropriately.
Rename "dissect_data()" to "old_dissect_data()", and
"dissect_data_tvb()" to "dissect_data()".
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2218 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
packet, not just the first 4 bytes of the ICMP packet.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2211 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
"ip_checksum_shouldbe()" compute the correct checksum given the computed
whole-packet checksum and the value of the checksum field; that scheme
can be better extended in the future to handle checksums other than the
IP header checksum, e.g. ICMP, UDP, and TCP checksums (although we'd
want a somewhat more optimized checksumming routine for that, and
perhaps have an option to control whether to do checksum checking on TCP
and UDP packets, as that could be expensive).
That requires that we remember the value of the computed checksum, not
just check it against 0; that renders "ip_checksum_state()"
uninteresting, as we can just compare the value against 0 in line.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2210 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
have "ip_checksum()" compute the checksum of the IP header;
have "ip_checksum_state()" call "ip_checksum()" and then return
TRUE if the result is 0 and FALSE otherwise;
have "ip_checksum_shouldbe()" save the current value of the
checksum field in the header, set that field to 0, call
"ip_checksum()" to get the checksum, restore the value of the
checksum field in the header to the saved value, and then return
what "ip_checksum()" returned;
rather than having duplicated code to compute checksums.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2206 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
From "Johannes Hennecke" <Johannes.Hennecke@elsa.de>
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2202 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
same directory as the "manuf" file ("/etc" or "/usr/local/etc", most
likely).
Add a mechanism to allow modules (e.g., dissectors) to register
preference values, which:
can be put into the global or the user's preference file;
can be set from the command line, with arguments to the "-o"
flag;
can be set from tabs in the "Preferences" dialog box.
Use that mechanism to register the "Decode IPv4 TOS field as DiffServ
field" variable for IP as a preference.
Stuff that still needs to be done:
documenting the API for registering preferences;
documenting the "-o" values in the man page (probably needs a
flag similar to "-G", and a Perl script to turn the output into
documentation as is done with the list of field);
handling error checking for numeric values (range checking,
making sure that if the user changes the variable from the GUI
they change it to a valid numeric value);
using the callbacks to, for example, update the display when
preferences are changed (could be expensive);
panic if the user specifies a numeric value with a base other
than 10, 8, or 16.
We may also want to clean up the existing wired-in preferences not to
take effect the instant you tweak the widget, and to add an "Apply"
button to the "Preferences" dialog.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2117 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
packet-ip.c.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2082 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2064 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
special case for it. dissect_ah() is registered with the "ip.proto"
handoff table, and dissect_ah() calls the next dissector using this
same "ip.proto" handoff table.
The old dissect_ah() is kept as dissect_ah_old() since dissect_ipv6()
still uses it. I need to convert some more functions before I can
get rid of dissect_ah_old().
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2039 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2037 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
a particular type, rather than taking a varargs list, along the lines of
the "proto_tree_add_XXX_format()" routines.
Replace most calls to "proto_tree_add_item()" and
"proto_tree_add_item_hidden()" with calls to those routines.
Rename "proto_tree_add_item()" and "proto_tree_add_item_hidden()" to
"proto_tree_add_item_old()" and "proto_tree_add_item_hidden_old()", and
add new "proto_tree_add_item()" and "proto_tree_add_item_hidden()"
routines that don't take the item to be added as an argument - instead,
they fetch the argument from the packet whose tvbuff was handed to them,
from the offset handed to them.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@2031 f5534014-38df-0310-8fa8-9805f1628bb7
|
