aboutsummaryrefslogtreecommitdiffstats
path: root/tshark.c
AgeCommit message (Collapse)AuthorFilesLines
2012-01-23From Michael Mann:Anders Broman1-1/+1
help page update (pcapng is now the default file format). https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6551 svn path=/trunk/; revision=40658
2011-12-29Leave it up to dumpcap to determine whether WinPcap was loaded and, ifGuy Harris1-13/+0
it wasn't, whether it matters; that way you can still capture from a pipe (named or "-" for standard input) even if you don't have WinPcap. svn path=/trunk/; revision=40336
2011-12-29Swallow cant_load_winpcap_err() up into capture-wpcap.c, so thatGuy Harris1-1/+0
anything that uses WinPcap can use that message text in its error messages. svn path=/trunk/; revision=40335
2011-12-29Add an additional DONT_HAVE_PCAP return value from get_interface_list()Guy Harris1-0/+1
and capture_interface_list(). Return it if, on Windows, we ask for the interface list but don't have WinPcap installed. Handle it like CANT_GET_INTERFACE_LIST. svn path=/trunk/; revision=40334
2011-12-28Add tshark option '-G heuristic-decodes' to dump heuristic dissector tables.Bill Meier1-0/+3
svn path=/trunk/; revision=40309
2011-12-27Add a "-G ftypes" option, which dumps our supprted FT_… names andGerald Combs1-0/+3
descriptions. Captitalize and fix up the descriptions. Use its output to create the field type list in the wireshark-filter man page. svn path=/trunk/; revision=40306
2011-12-13Rename WTAP_ERR_BAD_RECORD to WTAP_ERR_BAD_FILE; it really reports anyGuy Harris1-2/+2
form of corruption/bogosity in a file, including in a file header as well as in records in the file. Change the error message wtap_strerror() returns for it to reflect that. Use it for some file header problems for which it wasn't already being used - WTAP_ERR_UNSUPPORTED shouldn't be used for that, it should only be used for files that we have no reason to believe are invalid but that have a version number we don't know about or some other non-link-layer-encapsulation-type value we don't know about. svn path=/trunk/; revision=40175
2011-12-13Add the -H and -W options to the "tshark -h" output. Ref: ↵Chris Maynard1-0/+4
http://www.wireshark.org/lists/wireshark-users/201112/msg00044.html svn path=/trunk/; revision=40172
2011-11-19When reporting "sorry, *this* packet can't be written to a file of thatGuy Harris1-14/+57
type" when writing out a capture file (i.e., writing a per-packet-encapsulation capture to a file type that supports it but doesn't support one of the packet's encapsulations), report the packet number and, when doing this in a merge operation, report the file from which it came. When reporting "sorry, that file can't be written to a file of that type, period", show the file type rather than the input file link-layer type that causes the problem. (We could show both. We could be *really* ambitious and iterate through all possible file types and show the ones that will or at least might work....) file_write_error_message() is documented as handling only UNIX-style errnos, and libwireshark should be usable without libwiretap, so leave it up to its callers to handle Wiretap errors such as WTAP_ERR_SHORT_WRITE. Clean up indentation. svn path=/trunk/; revision=39949
2011-11-14Make exit_status volatile to avoid warning.Martin Mathieson1-1/+1
svn path=/trunk/; revision=39825
2011-11-12Catch the OutOfMemoryError exception and print a message.Guy Harris1-22/+49
svn path=/trunk/; revision=39798
2011-11-11Initialize threads at program startup. Hopefully this will fix theGerald Combs1-0/+3
current build test failures. svn path=/trunk/; revision=39790
2011-11-09Try to fix the GLib thread API deprecations listed in bug 6552.Gerald Combs1-6/+10
svn path=/trunk/; revision=39776
2011-09-28Rather than complain and quit if -V is missing when -O <protocols> is used, ↵Chris Maynard1-3/+3
do the user a favor and continue as if -V had been specified. Add explicit documentation of the -O <protocols> option to the man page. svn path=/trunk/; revision=39175
2011-09-27The separator between packets is an output option, not a capture option,Guy Harris1-3/+3
so it should be present even when building without libpcap. svn path=/trunk/; revision=39171
2011-09-27Add a new tshark option for being able to specify an alternate line ↵Chris Maynard1-7/+14
separator between packets. The option chosen was "-S <separator>". The former -S option was renamed to -P, and the former -P option, which was previously undocumented, was renamed to -2. This fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5342. svn path=/trunk/; revision=39168
2011-08-16From Yann via bug 6245:Stig Bjørlykke1-1/+1
Fixed crash in write_preamble(). svn path=/trunk/; revision=38562
2011-08-09Fix https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5608 :Jeff Morriss1-3/+1
getopt() can/should normally be found in unistd.h, so: - When testing for getopt(), define that we HAVE_GETOPT instead of HAVE_GETOPT_H (to avoid confusion). - Don't attempt to include getopt.h: not all OS's have it (for example, Solaris 9 does not). - (All the places which need getopt already include unistd.h (if we have it).) If this breaks things on some OS, we might need (a real) HAVE_GETOPT_H check. svn path=/trunk/; revision=38437
2011-07-05Add some additional routine variants that handle string encodings, andGuy Harris1-2/+0
make FT_STRING and FT_UINT_STRING handle string encodings. Get rid of FT_EBCDIC in favor of FT_STRING with ENC_EBCDIC. Add some URLs for DRDA. Clean up some stuff in TN3270 and TN5250, including using ENC_ values for proto_tree_add_item(). svn path=/trunk/; revision=37909
2011-07-04From Michael Mann:Anders Broman1-1/+7
Added ability to display UTC time or UTC time with date. I liked having the difference between UTC and local time, not just setting local=UTC. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2629 svn path=/trunk/; revision=37898
2011-06-28Replace all strerror() with g_strerror().Stig Bjørlykke1-15/+11
Remove our local strerror implementation. Mark strerror as locale unsafe API. This fixes bug 5715. svn path=/trunk/; revision=37812
2011-06-28Use the filter argument as the capture filter for all interfaces.Michael Tüxen1-2/+6
Signal an error if another capture filter is provided using the -f option. svn path=/trunk/; revision=37811
2011-06-27Put variable under the correct #ifdef.Michael Tüxen1-2/+2
svn path=/trunk/; revision=37807
2011-06-27Fix the bug reported by Guy. NowMichael Tüxen1-0/+10
tshark -i en0 icmpp returns a correct error message. svn path=/trunk/; revision=37806
2011-06-27Improve the report of illegal capture filters. Also show the interface ↵Michael Tüxen1-2/+2
description. svn path=/trunk/; revision=37802
2011-06-27Use the interface description instead of the interface name whenMichael Tüxen1-2/+2
reporting an error. svn path=/trunk/; revision=37799
2011-06-27Get rid of old non-interface specific settings which are now interfaceMichael Tüxen1-10/+13
specifc. This finalizes the change of the infrastructure. This patch is based on work by Irene Ruengeler. svn path=/trunk/; revision=37794
2011-06-20Have mergecap, tshark, and editcap write pcap-ng files by default. ThisGerald Combs1-3/+11
is mainly an attempt to fix the currently-broken "test.sh" step on the XP buildbot. If this causes too many problems we might want to have suite-capture.sh:capture_step_snapshot pass "-P" to dumpcap instead. svn path=/trunk/; revision=37736
2011-06-15See if this squelches some compiler warnings.Guy Harris1-2/+2
svn path=/trunk/; revision=37670
2011-06-01Show the plugin paths in Help→About→Plugins. Add a "-G plugins" optionGerald Combs1-0/+2
to TShark which dumps a list of plugins. svn path=/trunk/; revision=37512
2011-05-31Get rid of has_cfilter to simplify the handling of multiple interfaces.Michael Tüxen1-3/+2
svn path=/trunk/; revision=37478
2011-05-24Don't print hidden columns.Guy Harris1-0/+3
svn path=/trunk/; revision=37374
2011-05-24Move the Windows argument list conversion code to a common routine.Gerald Combs1-10/+2
svn path=/trunk/; revision=37372
2011-05-19From Dirk Jagdmann via bug 5875:Gerald Combs1-1/+1
My attachment adds a link to a XSLT file to the preamble of the PDML. The XSLT will transform the PDML to a HTML page, and the HTML page features a look similar to Wireshark. See http://cubic.org/~doj/ebay/a.pdml for an example. The patch also contains a small perl program which converts the Wireshark colortable into javascript code which is used in the XSLT file. If you want to use a different color scheme you would execute the perl program and insert the generated javascript function into your XSLT file. To view the HTML you could either place the PDML and XSLT file on your webserver and verify that your webserver sends the PDML file as "text/xml". Then your webbrowser will find the linked XSLT file, download that as well and convert the PDML to HTML on the fly. You could also use an XSLT processor like xsltproc to convert the PDML and XSLT into a static HTML file. From me: Minor fixups. svn path=/trunk/; revision=37298
2011-05-19Remove unused define.Michael Tüxen1-2/+0
svn path=/trunk/; revision=37288
2011-05-18Don't print too many interface names...Michael Tüxen1-9/+22
svn path=/trunk/; revision=37253
2011-05-18Support multiple interfaces when used with -L option.Michael Tüxen1-21/+45
Show multiple interfaces when capturing from them. svn path=/trunk/; revision=37249
2011-05-13Get -L and -d working with multiple interface. Internally get some functionsMichael Tüxen1-1/+1
using the array of interface data. Improve output of -L by printing the interface name. svn path=/trunk/; revision=37120
2011-05-12Fix the test.sh failures based on Guy's suggestion in ↵Jeff Morriss1-3/+3
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5445#c15 : Add a new tap flag to indicate that a tap listener is just a "dissector helper", that is, a tap which is used by a dissector to help it do its dissection but does not, itself, require dissection. Use this new flag in the dissectors which register taps. Remove the (now-unused) have_tap_listeners() function. svn path=/trunk/; revision=37069
2011-05-03Wrap text of description for -O.Chris Maynard1-1/+2
svn path=/trunk/; revision=36976
2011-04-29UntabifyStig Bjørlykke1-3/+3
svn path=/trunk/; revision=36948
2011-04-29From Edwin Groothuis via bug 5870:Stig Bjørlykke1-1/+20
The supplied patch adds a new option -O, which specifies a list of protocols (names can be found with the "-G protocols" option) to be fully decoded while the others only show the layer header. svn path=/trunk/; revision=36947
2011-04-27Create a new frame_data_sequence data type; it represents a denseGuy Harris1-10/+10
sequence of frame_data structures, indexed by the frame number. Extract the relevant bits of the capture_file data structure and move them to the frame_data_sequence, and move the relevant code from cfile.c and tweak it to handle frame_data_sequence structures. Have a possibly-null pointer to a frame_data_sequence structure in the capture_file structure; if it's null, we aren't keeping a sequence of frame_data structures (we don't keep that sequence when we're doing one-pass processing in TShark). Nothing in libwireshark should care about a capture_file structure; get rid of some unnecessary includes of cfile.h. svn path=/trunk/; revision=36881
2011-04-27Another hack to handle the one-pass case.Guy Harris1-1/+8
svn path=/trunk/; revision=36880
2011-04-25Store the frame_data structures in a tree, rather than a linked list. Guy Harris1-21/+14
This lets us get rid of the per-frame_data-structure prev and next pointers, saving memory (at least according to Activity Monitor's report of the virtual address space size on my Snow Leopard machine, it's a noticeable saving), and lets us look up frame_data structures by frame number in O(log2(number of frames)) time rather than O(number of frames) time. It seems to take more CPU time when reading in the file, but seems to go from "finished reading in all the packets" to "displaying the packets" faster and seems to free up the frame_data structures faster when closing the file. It *is* doing more copying, currently, as we now don't allocate the frame_data structure until after the packet has passed the read filter, so that might account for the additional CPU time. (Oh, and, for what it's worth, on an LP64 platform, a frame_data structure is exactly 128 bytes long. However, there's more stuff to remove, so the power-of-2 size is not guaranteed to remain, and it's not a power-of-2 size on an ILP32 platform.) It also means we don't need GLib 2.10 or later for the two-pass mode in TShark. It also means some code in the TCP dissector that was checking pinfo->fd->next to see if it's NULL, in order to see if this is the last packet in the file, no longer works, but that wasn't guaranteed to work anyway: we might be doing a one-pass read through the capture in TShark; we might be dissecting the frame while we're reading in the packets for the first time in Wireshark; we might be doing a live capture in Wireshark; in which case packets might be prematurely considered "the last packet". #if 0 the no-longer-working tests, pending figuring out a better way of doing it. svn path=/trunk/; revision=36849
2011-04-21Add a new WTAP_ERR_DECOMPRESS error, and use that for errors discoveredGuy Harris1-5/+19
by the gunzipping code. Have it also supply a err_info string, and report it. Have file_error() supply an err_info string. Put "the file" - or, for WTAP_ERR_DECOMPRESS, "the compressed file", to suggest a decompression error - into the rawshark and tshark errors, along the lines of what other programs print. Fix a case in the Netscaler code where we weren't fetching the error code on a read failure. svn path=/trunk/; revision=36748
2011-04-13Cast away size_t warnings on win64.Anders Broman1-4/+4
svn path=/trunk/; revision=36617
2011-04-12Use g_snprintf instead of sprintf and g_strlcat instead of strcat: Coverity 698Chris Maynard1-20/+20
svn path=/trunk/; revision=36597
2011-04-12Now that wtap_read() checks for delayed errors on EOF, there's no needGuy Harris1-10/+4
to check for it on close. svn path=/trunk/; revision=36593
2011-04-12Allow wtap_sequential_close() and wtap_close() to return an error; thisGuy Harris1-4/+10
may happen if, when reading a compressed file, we find an error in the file's contents past the last packet (e.g., the file being cut short so that we can't get a full buffer worth of compressed data), and that reporting of that error is delayed (so that you can get all of the packets that we *can* decompress). Check for those errors, at least on the sequential read pass (the only errors we should see when closing the random stream are errors we've already seen in the sequential stream). svn path=/trunk/; revision=36576
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-08 04:47:05 +0000