Age | Commit message (Collapse) | Author | Files | Lines |
|
Prepare/Match/FindFrame similar to chat the ConversationList has.
Only enabled for SMB and ONC-RPC at this point
svn path=/trunk/; revision=8391
|
|
"proto_item_append_text()" (they have the same value, and the same
underlying type, but it's cleaner).
Even if there already is a conversation when we're dissecting a call,
make the conversation dissector for the conversation the RPC dissector -
the conversation might've been created by the TCP dissector, or by us in
order to do fragment reassembly.
svn path=/trunk/; revision=8354
|
|
The heuristic for RPC detection sometimes mistakenly decodes something as RPC when in reality it is payload.
Since the heuristics is based on the PDU suze as specified in the record marker
make this limit settable from the preferences.
Arbitrary limit of 256kb is choosen as default instead of the original limit of 2mb.
(face it, the largest common oncrpc pdus are those for nfs read/write anyway and these seldom go above 32kb.)
svn path=/trunk/; revision=8250
|
|
Add more text to the COL_INFO line as well as the protocol trees for NFS and RPC
svn path=/trunk/; revision=8179
|
|
Only cosmetic changes, no functionality change.
svn path=/trunk/; revision=8090
|
|
and were thus not always filterable.
At the same time, change the dup fields to be placed visibly in the tree and point to the original of the dup.
svn path=/trunk/; revision=8064
|
|
svn path=/trunk/; revision=8037
|
|
tokens can be handled.
Really, dissect-spnego-krb5 or whatever, should be renamed to something like
dissect-gssapi-tokens or dissect-gssapi-rfc1964 ...
svn path=/trunk/; revision=7724
|
|
svn path=/trunk/; revision=7718
|
|
of secinfo flavors returned.
svn path=/trunk/; revision=7717
|
|
Fixes a mistake I introduced ...
I am still seeing malformed packets on secinfo stuff, which I hope to fix
soon.
svn path=/trunk/; revision=7715
|
|
routine ...
I am not happy with the signature for it as yet, though.
svn path=/trunk/; revision=7702
|
|
to do a "proto_tree_add_string_hidden()" to add the string data to the
protocol tree, given that we explicitly add it as a non-hidden item
(regardless of whether it's string data or binary data).
svn path=/trunk/; revision=7697
|
|
svn path=/trunk/; revision=7696
|
|
svn path=/trunk/; revision=7695
|
|
svn path=/trunk/; revision=7694
|
|
Replace "proto_item_set_len()" with "proto_item_set_end()", and get rid
of the "old_offset" variables the "proto_item_set_len()" calls required.
svn path=/trunk/; revision=7634
|
|
svn path=/trunk/; revision=7544
|
|
dissector - including the ONC RPC-over-TCP record marking code, which is
also used by NDMP.
That means that the NDMP dissector can, like the ONC RPC dissector, put
into the Info column items for all the NDMP messages dissected for a
frame; make it do so.
svn path=/trunk/; revision=7516
|
|
null) to the "fragment_items" structure, and don't pass that value into
"process_reassembled_data()", just have it use the value in the
"fragment_items" structure passed to it.
Make "process_reassembled_data()" capable of handling reassembly done by
"fragment_add_seq_check()", and use it in the ATP and 802.11 dissectors;
give them "reassembled_in" fields. Make "process_reassembled_data()"
handle only the case of a completed reassembly (fd_head != NULL) so that
we can use it in those dissectors without gunking the code up too much.
svn path=/trunk/; revision=7513
|
|
fragment having been added already. In protocols using the ONC
RPC-over-TCP record-marking mechanism (RPC-over-TCP and NDMP), there can
be more than one record-marking-layer fragment in a single TCP segment,
and thus can be more than one fragment in a frame being added to a given
higher-level packet.
svn path=/trunk/; revision=7508
|
|
if the PDU was short.
This was most noticeable in NFS Read Replies not generating tap events and
thus NFS RTT statistics did not count the Read procedure.
svn path=/trunk/; revision=7490
|
|
ONC-RPC/PORTMAPPER
The reason for doing this is to allow a user to pick RPC as a protocol offered
by DecodeAs...
Why:
If ethereal has tcp-reseembly enabled, the heuristic dissector for rpc will not even attempt to find RPC packets.
If no PORTMAPPER/GETPORT are available either in the capture there is
currently no way for ethereal to know/learn that the conversation is ONC-RPC.
This at least will allow users to manually tell ethereal that such a conversation is ONC-RPC.
svn path=/trunk/; revision=7470
|
|
Modified a patch originally contained in the SuSE distro
to do the conversions via glib macros.
svn path=/trunk/; revision=7330
|
|
they're put into the tree with "proto_tree_add_uint_format()", with the
frame number as the value.
svn path=/trunk/; revision=6824
|
|
frame number, which is always decimal. If you select an FT_FRAMENUM
field, there are menu items that let you go to the frame whose frame
number appears in that field.
Add FT_FRAMENUM fields for the ONC RPC "matching request is in this
frame" and "matching reply is in this frame" protocol tree items.
svn path=/trunk/; revision=6802
|
|
often get TCP to collapse multiple RPC PDUs into a MSS TCP segment.
This changes the RPC dissector so that it will put one entry on COL_INFO
for each PDU in the segment, (as the SMB dissector does for multiple AndX calls in one SMB PDU)
and just one entry for the first/last RPC PDU.
svn path=/trunk/; revision=6751
|
|
qualifiers as necessary to ensure that we don't have to.
"strcmp()", "strcasecmp()", and "memcmp()" don't return booleans; don't
test their results as if they did.
Use "guint8", not "guchar", for a pointer to (one or more) 8-bit bytes.
Update Michael Tuexen's e-mail address.
svn path=/trunk/; revision=6726
|
|
header.
svn path=/trunk/; revision=6667
|
|
dissect_rpc_opaque_data() the actual bytes into the dissector data tree
(improves searching). But if we only give the string "<DATA>" to the
proto_tree_add_* functions and tell it at the same time, that we have indeed
string_length_copy bytes, this leads to problems.
Correction: give the pointer into the real data and not the pointer to the
print string to the proto_tree_add_string_format() and
proto_tree_add_bytes_format() functions.
The correction was found by Martin Regner.
svn path=/trunk/; revision=6655
|
|
fixed-length opaque data to be dissected, and add support for SGI's
variant of the ONC RPC mount protocol.
svn path=/trunk/; revision=6620
|
|
sequence numbers or offsets and are thus assumed to be received in order
with no duplicates or dropped fragments (e.g., for NetBIOS Frame, where
802.2 LLC guarantees in-order delivery to NetBIOS with no duplicates or
dropped fragments).
"show_fragment_tree()' and "show_fragment_seq_tree()" don't modify the
"fragment_items" to which the "fit" argument points, so make that
argument a "const fragment_items *".
Make all the "fragment_items" tables "static" (as they're not used
outside the modules defining them) and "const" (as they're not
modified).
Add support for reassembly of NetBIOS fragmented requests and responses.
Get rid of an unnecessary include of "packet-tr.c" in the NetBIOS
dissector, and make its table of dissection function pointers static.
Fix some typos in the AppleTalk and NetBIOS dissectors.
svn path=/trunk/; revision=6491
|
|
given version before fetching that value.
svn path=/trunk/; revision=6490
|
|
value for a field to be used for the procedure number for that version
of the protocol; use that field, if specified, instead of just putting
in a generic "rpc.procedure" field.
Have the ypserv dissector register those fields and supply them to
"rpc_init_proc_table()". Supply -1 for other RPC programs (for now),
meaning "no such field exists".
svn path=/trunk/; revision=6486
|
|
One example extension is rpcstat.
Try -Z rpc,rtt,100003,3 as argument to tethereal when reading a capture
containing NFSv3 packets.
tap-rpcstat.[ch] is intended to demonstrate the api and can be used to
base other extensions on.
svn path=/trunk/; revision=6175
|
|
winapi_cleanup tool written by Patrik Stridvall for the wine
project.
svn path=/trunk/; revision=6117
|
|
(unencrypted) request data.
svn path=/trunk/; revision=6068
|
|
For the "GSS Data", put the un-rounded length into the protocol tree, as
that's the value extracted from the packet.
svn path=/trunk/; revision=6067
|
|
GSS-API tokens in RPCSEC_GSS_INIT and RPCSEC_GSS_CONTINUE_INIT arguments
and results.
svn path=/trunk/; revision=6051
|
|
call that for GSS-API tokens in ONC RPC calls.
svn path=/trunk/; revision=6050
|
|
equivalents for the toplevel directory. The removal of winsock2.h will
hopefully not cause any problems under MSVC++, as those files using
struct timeval still include wtap.h, which still includes winsock2.h.
svn path=/trunk/; revision=5932
|
|
but for stuff reassembled with "fragment_add_seq()" or
"fragment_add_seq_check()".
Add a "fragment tag" string to the "fragment_items", so that packets
with fragmentation errors can be properly flagged as having "Illegal
fragments" or "Illegal segments" depending on the term used with the
protocol in question.
Make all the dissectors that can use "show_fragment_tree()" or
"show_fragment_seq_tree()", and don't already use them, do so.
svn path=/trunk/; revision=5644
|
|
fregment trees.
svn path=/trunk/; revision=5627
|
|
in the "packet_info" structure instead, as we don't need a pointer for
every single frame in the capture file, just for each frame for which we
currently have an open "epan_dissect_t".
svn path=/trunk/; revision=5614
|
|
When this ption is enabled in Protocols/NFS displayfilters for fhandle fields
such as nfs.fh.{hash|name|full_name} will find both the request and matching
response packets even if the fhandle is only present in one of the packets.
The option supports all NFS and related protocols which use nfs fhandles
including async NLM.
The option will not work with nfs packets containing multiple fhandles in
one PDU, nor will it work if tcp collapses multiple segments/pdus into
one larger segment.
It only works for async NLM if one first enables the MSG/RES stateful
matching for async NLM.
svn path=/trunk/; revision=5515
|
|
protocol reply if:
we got anything other than SUCCESS for MSG_ACCEPTED;
we got MSG_DENIED;
we got anything other than MSG_ACCEPTED or MSG_DENIED;
as there isn't a protocol reply in there.
Just use "-1, -1" as arguments to "tvb_new_subset()" if you want the new
tvbuff to run to the end of the packet - there's no need to call
"tvb_reported_length_remaining()".
svn path=/trunk/; revision=5483
|
|
RPC-over-everything-else dissectors, one registered by name and one
anonymous, just fetch the handles for the registered dissectors.
svn path=/trunk/; revision=5445
|
|
When we see PRTOMAP GETPORT calls for UDP, make sure all further UDP packets to or from
this port goes to the ONC-RPC dissector regardless of the port on the other side.
We need this because if there is ONC-RPC traffic going between the ONC-RPC Program port to a port which has a normal ethereal dissector, ethereal would dissect the traffic as the protocol associated with the other port instead.
svn path=/trunk/; revision=5430
|
|
svn path=/trunk/; revision=5090
|
|
svn path=/trunk/; revision=5076
|