Commit Graph

2364 Commits (master)

Author SHA1 Message Date
Gilbert Ramirez 2cb9d54620 Add MGCP dissector plugin from Ed Warnicke <>.
svn path=/trunk/; revision=2588
2000-11-09 10:04:48 +00:00
Gerald Combs d3422a91f5 Change addresses to
svn path=/trunk/; revision=2578
2000-11-07 19:54:53 +00:00
Guy Harris f96d9f65fe GIOP 1.2 support and other GIOP enhancements, from Craig Rodrigues.
svn path=/trunk/; revision=2577
2000-11-07 07:46:22 +00:00
Guy Harris 6d46509f9c Update to reflect the new style for plugin dissectors.
svn path=/trunk/; revision=2575
2000-11-06 09:56:10 +00:00
Guy Harris 13a92d5410 In Tethereal, when printing summary lines, print the fields specified in
the preferences file, don't just print a wired-in list of fields.
Always print the time stamp.

svn path=/trunk/; revision=2573
2000-11-06 09:28:43 +00:00
Guy Harris 2d46c654d4 AIM/OSCAR dissector, from Ralf Holzer.
svn path=/trunk/; revision=2570
2000-11-05 23:45:59 +00:00
Olivier Abad 1fd4721d48 Allow a plugin to specify several underlying protocols (i.e. tcp and udp).
The protocol constant definition in the plugin must be :
DLLEXPORT const gchar protocol[] = "tcp udp";

svn path=/trunk/; revision=2569
2000-11-05 09:40:18 +00:00
Guy Harris 3f4e41dc38 Patch from Craig Rodrigues to fix a call to "check_col()".
Fix a typo in a comment.

svn path=/trunk/; revision=2564
2000-11-05 07:14:40 +00:00
Guy Harris 8c6db228bf WAP support, from Neil Hunter.
svn path=/trunk/; revision=2558
2000-11-04 03:30:41 +00:00
Gilbert Ramirez d1cfc6776b Updates from Jeff Foster.
svn path=/trunk/; revision=2548
2000-11-02 15:47:16 +00:00
Guy Harris 7d663fe7b0 Add a fourth choice of time format in the packet list display, which
shows the date (in YYYY-MM-DD format) as well as the time of day when
the packet arrived.

svn path=/trunk/; revision=2547
2000-11-01 08:31:36 +00:00
Guy Harris 4b15a76ece When looking for definitions of "proto_register" and "proto_reg_handoff"
routines, throw out lines containing semicolons, so that we don't see
*declarations* of those routines.

svn path=/trunk/; revision=2530
2000-10-22 20:01:14 +00:00
Richard Sharpe da5b5e67c7 Adding the magicpoint presentation I am doing for LinuxWorld Malaysia
svn path=/trunk/; revision=2505
2000-10-17 09:32:46 +00:00
Gilbert Ramirez cfe9eb12ad Give Ulrich Kiermayr credit for his ECN addition.
svn path=/trunk/; revision=2490
2000-10-12 15:05:27 +00:00
Guy Harris 54ecbe2d4e Santeri Paavolainen's patch to add a "Capture->Stop" menu item to let
you stop an "Update list of packets in real time" capture from the main
window as well as from the capture statistics dialog.

svn path=/trunk/; revision=2487
2000-10-11 06:01:16 +00:00
Guy Harris 788a6283ff DNS updates from Brian Wellington.
svn path=/trunk/; revision=2486
2000-10-11 04:12:06 +00:00
Gerald Combs 893db6fd12 Update documentation URLs.
svn path=/trunk/; revision=2482
2000-10-09 03:10:01 +00:00
Guy Harris f9daf4932d Patch from Jack Keane to keep the dissector from looping infintely on
malformed packets.

svn path=/trunk/; revision=2480
2000-10-07 06:58:39 +00:00
Guy Harris 19a14b9e67 Assignments for SHA2 and AES encryption and data integrity schemes, from
Yaniv Kaul.

svn path=/trunk/; revision=2476
2000-10-03 22:49:46 +00:00
Guy Harris 7df9d99be6 A6 and DNAME resource record support, and RFC 2673 bitstring label
support, from Per Flock.

svn path=/trunk/; revision=2473
2000-10-02 17:42:38 +00:00
Gilbert Ramirez c312f69abc Make sure to pass the sent/received direction from pppdump.c in
Use generic "p2p_phdr" instead of "lapd_phdr". Modify toshiba.c and
packet-lapd.c to take that into account.
Add frame.p2p_dir, a filterable field, 0=sent, 1=recvd
Make p2p_dir available in packe_info, as I think it will be needed
in VJ COMP and UNCOMP dissection.


Mention pppd-log support in man page.
Mention atmsnoop in README.

svn path=/trunk/; revision=2455
2000-09-21 04:41:37 +00:00
Guy Harris 2ef47f9ccb Give Tethereal a "-l" flag, as tcpdump has, to make the standard output

svn path=/trunk/; revision=2451
2000-09-20 08:28:54 +00:00
Guy Harris 00b4224ee0 Add a "-p" command-line option, and a checkbox in the "Capture
Preferences" dialog box, to control whether to put the interface in
promiscuous mode or not; Debian bug #34376 asked for this.

svn path=/trunk/; revision=2439
2000-09-15 05:32:49 +00:00
Guy Harris ed185bcdfc Changes from Craig Metz to:
decode type 7 LSAs (NSSA AS external);

	print the LS checksum as a four digit hexadecimal number.

svn path=/trunk/; revision=2425
2000-09-13 07:47:21 +00:00
Guy Harris b85ddbe885 Graham Bloice's patch to support inverse video rather than boldface
highlighting of the bytes, in the hex dump window, corresponding to a
selected field.

Also, make "remember_ptree_widget()" static, as it's not used outside

svn path=/trunk/; revision=2399
2000-09-08 09:50:08 +00:00
Laurent Deniel c1c46097b3 Documents the "marked frame" related menu items and associated
features (e.g. GUI "Colors...").

svn path=/trunk/; revision=2352
2000-08-23 19:40:12 +00:00
Laurent Deniel bc547f5647 Missed one IPv4 TOS field display option is the manual.
(why some items are described at two locations ?, one for
menu and one for window ?)

svn path=/trunk/; revision=2351
2000-08-23 19:13:33 +00:00
Laurent Deniel fb3643b8d5 Remove the -D option.
svn path=/trunk/; revision=2349
2000-08-23 18:22:12 +00:00
Laurent Deniel 7c48f6c0d4 Remove the "Decode IPv4 TOS field as DiffServ field" option from the
display options since it is available from the preferences.

svn path=/trunk/; revision=2341
2000-08-22 14:39:41 +00:00
Guy Harris aeaaaf65f4 Instead of each set of built-in preferences having "ok", "save",
"cancel", and "delete" methods, give them:

	"fetch" - fetch from the notebook tab any values not already
	stored in "prefs", and store them there, but doesn't apply them;

	"apply" - apply the settings in "prefs";

	"destroy" - clean up any windows created from the tab.

As we no longer have "cancel" methods, we don't have per-preference code
to revert preference values; instead, we have the common preference
dialog box code make a copy of all the current preferences, and, when
the "Cancel" button is clicked, free the current preferences and copy
the saved preferences to it, and apply the preferences.

Add an "Apply" button to the preference dialog box, which applies the
current preferences without closing the dialog box.

Treat a request to delete the preferences dialog box as equivalent to
clicking "Cancel".

Have a "remember_ptree_widget()" routine to remember all protocol tree
widgets, and use the list of those widgets when we set GUI preferences
for the protocol tree widgets, rather than setting the main protocol
tree widget and then using the list of packet windows.  Move that code
out of "main.c" to "proto_draw.c", as it's not used by anything in
"main.c", but is used by stuff in "proto_draw.c".

Make the font one of the preferences we can set on the fly for protocol
tree widgets.  Also make it something we can set on the fly for the
packet list widget.

svn path=/trunk/; revision=2317
2000-08-21 08:15:48 +00:00
Guy Harris d62f730035 Michael Tuexen's patch to add "sctp.port" as a dissector table so that
protocols running atop SCTP can register themselves with a particular
SCTP port number.

Also, clean up the credits for him - there were two entries, one for
some initial SCTP support in "ipprotostr()" and in the capture dialog,
and one for the SCTP dissector itself - the latter subsumes the former,
so just keep the latter.

svn path=/trunk/; revision=2296
2000-08-19 08:37:43 +00:00
Laurent Deniel f395740875 Modify the Gryphon plugin code in order to avoid an abort when the
plugin is enabled -> disabled -> re-enabled due to the fact that
the protocol registration is performed at each plugin_init() call
(and there is no protocol cleanup like with dfilter_cleanup).

Now we use the proto_xxx static variable to check if it is the first
activation or not (in this case, the proto_register_xxx routines are
not called.

svn path=/trunk/; revision=2290
2000-08-18 13:47:59 +00:00
Laurent Deniel 5a5e16ced7 Add the "Edit:Protocols..." feature which currently only implements
the following:

It is now possible to enable/disable a particular protocol decoding
(i.e. the protocol dissector is void or not). When a protocol
is disabled, it is displayed as Data and of course, all linked
sub-protocols are disabled as well.

Disabling a protocol could be interesting:

- in case of buggy dissectors
- in case of wrong heuristics
- for performance reasons
- to decode the data as another protocol (TODO)

Currently (if I am not wrong), all dissectors but NFS can be disabled
(and dissectors that do not register protocols :-)

I do not like the way the RPC sub-dissectors are disabled (in the
sub-dissectors) since this could be done in the RPC dissector itself,
knowing the sub-protocol hfinfo entry (this is why, I've not modified
the NFS one yet).

Two functions are added in proto.c :

gboolean proto_is_protocol_enabled(int n);
void proto_set_decoding(int n, gboolean enabled);

and two MACROs which can be used in dissectors:

OLD_CHECK_DISPLAY_AS_DATA(index, pd, offset, fd, tree)
CHECK_DISPLAY_AS_DATA(index, tvb, pinfo, tree)

See also the XXX in proto_dlg.c and proto.c around the new functions.

svn path=/trunk/; revision=2268
2000-08-13 14:20:32 +00:00
Guy Harris ce2d5b1ac3 RSH dissector, from Robert Tsai.
svn path=/trunk/; revision=2261
2000-08-12 05:41:10 +00:00
Laurent Deniel 2de43f748b Miscellaneous code cleaning
- add <stdarg.h> or <varargs.h> in snprintf.h
  and remove those inclusions in the other #ifdef NEED_SNPRINTF_H codes

- remove the check of multiple inclusions in source (.c)  code
  (there is a bit loss of _cpp_ performance, but I prefer the gain of
   code reading and maintenance; and nowadays, disk caches and VM are
   correctly optimized ;-).

- protect all (well almost) header files against multiple inclusions

- add header (i.e. GPL license) in some include files

- reorganize a bit the way header files are included:

  #include <system_include_files>
  #include <external_package_include_files (e.g. gtk, glib etc.)>
  #include "ethereal_include_files"

  with the correct HAVE_XXX or NEED_XXX protections.

- add some HAVE_XXX checks before including some system header files

- add the same HAVE_XXX in wiretap as in ethereal

Please forgive me, if I break something (I've only compiled and regression
tested on Linux).

svn path=/trunk/; revision=2255
2000-08-11 13:46:34 +00:00
Guy Harris fa7f38180a Kerberos 5 dissector, from Wes Hardaker.
svn path=/trunk/; revision=2250
2000-08-11 03:32:53 +00:00
Guy Harris 4f08b6f493 Update the man pages to reflect
the addition of support for Cisco Secure Intrusion Detection
	System IPlog output;

	support for selecting only one side of a conversation, for
	showing a conversation in hex, and for saving the displayed data
	to a file, in the "Filter TCP Stream" window.

svn path=/trunk/; revision=2238
2000-08-09 06:38:53 +00:00
Guy Harris 5e751be764 Phil Techau's fix to BOOTP when client address not supplied.
Give Phil credit for the other stuff he added as well.

svn path=/trunk/; revision=2236
2000-08-09 06:15:14 +00:00
Guy Harris b8a983f558 Document that ranges of packet numbers can be specified.
svn path=/trunk/; revision=2234
2000-08-09 05:58:08 +00:00
Richard Sharpe b762041ba3 Added another tool to generate lists of protocols from Ethereal for the
documentation/user guide ...

svn path=/trunk/; revision=2224
2000-08-08 01:56:57 +00:00
Guy Harris ffc1f0a6a2 Fix to the SRVLOC dissector to correctly handle the error field of the
Service Reply (i.e., treat it as the 16-bit field that it is), from
Peter Kjellerstedt.

svn path=/trunk/; revision=2207
2000-08-04 22:56:27 +00:00
Olivier Abad 9348644164 Support for capturing packet data from a pipe (a FIFO, or standard input).
capture.c :
- modified capture() to try to open an interface as a pipe if pcap_open_live()
  failed, and then read data in libpcap format from this pipe ;
- add new functions used by capture() : pipe_open_live() and pipe_dispatch()
  which are equivalents to the pcap_ functions.

libpcap.[ch] :
- moved the MAGIC and headers definitions from libpcap.c to libpcap.h
  because capture() now needs it.

svn path=/trunk/; revision=2181
2000-07-30 16:54:12 +00:00
Guy Harris 888b5a1cdb David Frascone's DIAMETER dissector.
svn path=/trunk/; revision=2176
2000-07-30 07:16:11 +00:00
Richard Sharpe a194f2b07a Added changes so Edit->Filters...->Apply works as I think
it should.

Also added the two files I need to generate an sgml list of fields
that the UserGuide etc needs.

svn path=/trunk/; revision=2174
2000-07-29 03:20:51 +00:00
Gilbert Ramirez 8ceb7d40f9 Add the re-write of the NetWare Core Protocol dissector. It's mostly
a framework for the dissector; of the more than 400 NCP packet types, only
a handful are defined. But this dissector framework is much better than
the previous one.

svn path=/trunk/; revision=2173
2000-07-28 20:03:59 +00:00
Gilbert Ramirez 551a4d58fd ... and remove the old template.
svn path=/trunk/; revision=2172
2000-07-28 16:31:18 +00:00
Gilbert Ramirez 25935e6b19 Don't create dfilter2pod from just for @PERL_PATH@; it's
a waste of time. Instead, set $(PERL) to @PERL_PATH@ in the Makefile and
call via $(PERL) $(src_dir)/

svn path=/trunk/; revision=2171
2000-07-28 16:30:28 +00:00
Guy Harris 7de3b988bd In the final scene of the horror movie, just when you think the monster
is finally dead, and you're walking away, it springs up again and

It appears that the ss990915 version of Alexey Kuznetzov's libpcap patch
has some extra stuff in the per-packet header for some sort of SMP
debugging, and that SuSE Linux 6.3 picked it up.

Thus, even if a libpcap file has the modified magic number, we *still*
have to go through the usual heuristic hell to figure out what type of
file it is.

svn path=/trunk/; revision=2164
2000-07-26 06:04:34 +00:00
Guy Harris 0d959bbec0 A pile of DHCP option names, supplied by Jose Pedro Oliveira.
svn path=/trunk/; revision=2159
2000-07-25 21:26:08 +00:00
Guy Harris 9a1e130403 Improved "" script from Bruce Korb.
svn path=/trunk/; revision=2154
2000-07-22 20:00:29 +00:00
Gilbert Ramirez 9edd4638fc Add SCTP dissector from Tuexen Michael <>
svn path=/trunk/; revision=2148
2000-07-21 12:57:09 +00:00
Guy Harris 18a5059d67 Support for dissecting RPCSEC_GSS credentials in ONC RPC, from Dug Song.
svn path=/trunk/; revision=2141
2000-07-17 20:34:00 +00:00
Guy Harris 9b652d0958 Enhancements/fixed to OSPF from Michael Rozhavsky:
1) DD flags in Database Description packets were translated

	2) Summary-LSA metric was not displayed.

svn path=/trunk/; revision=2136
2000-07-14 03:23:50 +00:00
Guy Harris 071a1f5468 Document the "-o" flag, the fact that the "Preferences" dialog box has
pages for various protocol preferences, and the existence of the global
and personal preferences files.

We still need to document the values that can be put in the preferences

svn path=/trunk/; revision=2127
2000-07-09 04:09:09 +00:00
Guy Harris 9e42b3a4ed Remove the progress bar from the status line, and, instead, for any
potentially long-running operation that has a progress indicator, pop up
a modal dialog box with

	an indication of what is being done;

	a progress bar;

	a "Cancel" button to stop the operation.


	leaves more room on the status line for a filter expression;

	provides a mechanism to allow the user to cancel long-running
	operations (although the way we do so may not back out of them
	as nicely as the user might like, if it's not obvious what the
	"right" way is or if the "right" way is difficult to implement
	or involves doing as much work as letting the operation

	means that, because the dialog box is modal, we don't have to
	worry about the user performing arbitrary UI operations out from
	under the operation and changing arbitrary bits of state being
	used by that operation.

svn path=/trunk/; revision=2103
2000-07-03 08:36:52 +00:00
Guy Harris 7250d49c49 Mark Clayton's patch to add support for capturing on ATM interfaces on
Linux (call the until-now-unused "capture_clip()" routine for each

svn path=/trunk/; revision=2070
2000-06-15 04:23:06 +00:00
Gilbert Ramirez 0ab8dd8cbd Convert IPX-and-friend dissectors in packet-ipx.c to use

In doing so, I realied that my recommendation for using
tvb_new_subset(pi.compat_top_tvb, -1, -1) was incorrect, because
some dissectors (ethernet!) change pi.len and pi.cap_len. So, I have
to take those two variables into account instead of using -1 and -1.

So, I provide a macro called tvb_create_from_top(offset), where
offset is the name of your offset variable. It is a wrapper around

I converted the lines that followed my suggestion to use

In proto.c I added
proto_tree_add_debug_text(proto_tree*, const char*, ...)
It's much like proto_tree_add_text(), except that it takes no offset
or length; it's soley for temporarily putting debug text into the
proto_tree while debugging a dissector. In making sure that its
use is temporary, the funciton also prints the debug string to stdout
to remind the programmer that the debug code needs to be removed
before shipping the code.

svn path=/trunk/; revision=2068
2000-06-15 03:49:00 +00:00
Gilbert Ramirez 8130072d19 Document how to create a tvbuff inside a dissector-table-called dissector,
using packet-cops.c as an example.

svn path=/trunk/; revision=2046
2000-06-08 03:03:43 +00:00
Olivier Abad b977b382b3 Changed my mail address to ( is too

svn path=/trunk/; revision=2019
2000-05-28 17:04:47 +00:00
Gilbert Ramirez ed1863187c Mention Stefan Raab as author of Mobile IP dissector.
svn path=/trunk/; revision=2015
2000-05-27 15:21:31 +00:00
Guy Harris 8efa4b8551 Initial SCTP support (showing it by name from "ipprotostr()") from
Michael Tuexen.

svn path=/trunk/; revision=2011
2000-05-26 21:54:59 +00:00
Guy Harris 8af330852d Support for reading compressed Sniffer files, from Tim Farley, Joerg
Mayer, and yours truly.

svn path=/trunk/; revision=2002
2000-05-25 09:00:24 +00:00
Guy Harris f937a5d86f Assorted padding fixes from Mark Burton.
svn path=/trunk/; revision=1999
2000-05-25 08:32:13 +00:00
Guy Harris 568af9a05d Note that the time stamp is printed only when reading an existing
capture file, not when printing packet summaries as packets are

svn path=/trunk/; revision=1976
2000-05-18 20:58:59 +00:00
Guy Harris e7ea221d9c Paul Ionescu's patch to add support for IPX over GRE.
svn path=/trunk/; revision=1974
2000-05-18 08:41:22 +00:00
Gilbert Ramirez b4905911d3 Updates to doco.
svn path=/trunk/; revision=1971
2000-05-17 04:34:20 +00:00
Gilbert Ramirez 39994bd360 Change 'cp' to 'mv' for 'accept' step.
svn path=/trunk/; revision=1967
2000-05-16 06:23:05 +00:00
Gilbert Ramirez 06ba8a87c2 Add very basic tvbuff documentation. I still need to explain TVBUFF_COMPOSITE's,
and explain how to use exceptions.h.

svn path=/trunk/; revision=1963
2000-05-15 06:48:16 +00:00
Gilbert Ramirez 67e584e2a4 Fix location of $(TETHEREAL) dependency.
svn path=/trunk/; revision=1954
2000-05-13 11:34:12 +00:00
Gilbert Ramirez dbf648436a Add a sample Makefile for regression testing by using tethereal.
svn path=/trunk/; revision=1947
2000-05-12 05:47:00 +00:00
Gilbert Ramirez af9016663d Remove proto_tree doc, as all necessary info in it is in README.developer.
Add tvbtest.c to list of packaged files.

svn path=/trunk/; revision=1944
2000-05-12 04:00:05 +00:00
Guy Harris bc897cf7d3 Yaniv Kaul's patch to add support for the ISAKMP Configuration Method

svn path=/trunk/; revision=1941
2000-05-11 18:55:40 +00:00
Guy Harris b5f25bc16d Use "F<>" rather than "B<>" for file names in the Tethereal man page.
svn path=/trunk/; revision=1932
2000-05-10 06:05:17 +00:00
Guy Harris 33f9afee30 Graham Bloice's changes to make clicking on a column header cause the
display to be sorted by the value in that column (and to reverse the sort
order the next time you click on that column).

Use "F<>" rather than "B<>" for file names in the Ethereal man page.

svn path=/trunk/; revision=1931
2000-05-10 06:00:22 +00:00
Guy Harris b0294c712c Document "match_strval()" and "val_to_str()", as per Gerrit Gehnen's

svn path=/trunk/; revision=1897
2000-04-29 07:57:43 +00:00
Guy Harris 4c071627ed Add a "-s" flag to editcap, to make it truncate packets to a specified
snapshot length before writing them to the output file; this may come in
handy if you are translating the file to a different format so that it
can be read by a program that can't handle packets above a certain size
(e.g., the snoop in Solaris 2.5.1 or 2.6, which reject Ethernet packets
larger than the Ethernet MTU, and thus can't handle gigabit Ethernet
captures using jumbo frames).

svn path=/trunk/; revision=1891
2000-04-27 00:31:30 +00:00
Gilbert Ramirez 9789501a17 Fixed declaration of ip_dissector_table and clarified bitwidth doco.
Patch from Ben Fowler <>

svn path=/trunk/; revision=1888
2000-04-25 08:55:11 +00:00
Guy Harris c9d4dd080d Ralf Schneider's changes to enhance to OSI CLNP, CLTP, and ISIS support
and to add OSI ESIS support.

svn path=/trunk/; revision=1865
2000-04-15 22:11:26 +00:00
Guy Harris e97af65590 Graham Bloice's Win32 icon for Ethereal and Win32 resource-compiler
files to add version/copyright/etc.  information to Win32 executables.

svn path=/trunk/; revision=1862
2000-04-15 19:55:24 +00:00
Guy Harris 8e465e6e48 Mark Muhlestein's code to support CIFS-atop-TCP (without the NetBIOS
Session Service).

svn path=/trunk/; revision=1832
2000-04-12 20:43:53 +00:00
Gilbert Ramirez ef73f1757e Change my e-mail address from to
svn path=/trunk/; revision=1831
2000-04-12 20:24:43 +00:00
Guy Harris 9e8cab115d Update the document to reflect Gilbert's changes to split
"proto_tree_add_item_format()" into multiple routines for different item
types, and to note that a subtree can be added under any item.

svn path=/trunk/; revision=1809
2000-04-06 06:38:24 +00:00
Guy Harris e386451345 Patches from Andreas Sikkema:
On Win32, always save a temporary capture file by copying -
	Win32 systems don't allow you to rename a file that is open, and
	we have the temporary file open.

	When saving by copying the raw bytes of a capture file, create
	the target file with "open()", using the O_BINARY flag, rather
	than with "creat()"; on Win32 systems, "creat()" apparently
	opens the file as a text file rather than a binary file.

svn path=/trunk/; revision=1757
2000-03-28 08:11:52 +00:00
Guy Harris 67d2ea7af0 Doug Nazar's LDAP dissector.
svn path=/trunk/; revision=1756
2000-03-28 07:12:36 +00:00
Guy Harris f6b5d7b8b5 Paul Welchinski's changes to, on Win32 systems:
properly handle ASCII vs. Unicode in the list of interfaces;

	initialize Winsock before starting a capture, so that the code
	in the Win32 libpcap to get the IP address and netmask by
	translating the host name to an IP address works.

svn path=/trunk/; revision=1737
2000-03-21 06:52:13 +00:00
Guy Harris 8fdc3df252 Jochen Friedrich's fix to IPv6 fragment handling.
svn path=/trunk/; revision=1734
2000-03-21 04:15:14 +00:00
Guy Harris 41b76f7209 Florian Lohoff's changes for RADIUS tunnel attributes and for the
Internet Draft for RADIUS tunnel attribute tagging.

svn path=/trunk/; revision=1729
2000-03-20 18:30:59 +00:00
Guy Harris 1321ad97eb Fix some typos.
Get rid of the paragraph about C++-style comments at the beginning of
the document, as it also appears in section 1.1.1 "Comments".

Add a section on how to extract data from packets, which explains the
"pd" and "offset" arguments to a dissector, and notes that you should
not just blithely cast pointers into the packet data to 2-byte or 4-byte
integral types and dereference them, as the pointer may not be aligned,
and the field may not have the same byte order as the processor on which
Ethereal is running (in fact, it's probably *guaranteed* not to on at
least one machine, as Ethereal runs on both big-endian and little-endian

svn path=/trunk/; revision=1710
2000-03-10 08:57:05 +00:00
Olivier Abad 5a89694778 - Jeff Foster's documentation for conversations and coding style
- Documentation for plugins.

svn path=/trunk/; revision=1708
2000-03-09 19:32:31 +00:00
Guy Harris dc8fa8baf3 Note that the "-T" flag doesn't cause "editcap" to translate link-layer
headers, it just causes it to force the encapsulation type of the output
file to the specified type.

svn path=/trunk/; revision=1702
2000-03-07 23:50:32 +00:00
Guy Harris bcb954c51d Document "proto_tree_add_notext()", "proto_item_set_len()", and

svn path=/trunk/; revision=1688
2000-03-03 06:58:28 +00:00
Guy Harris 9490a8ead6 Put in a discussion of "check_col()", "col_add_[f]str()", and

svn path=/trunk/; revision=1687
2000-03-03 06:39:10 +00:00
Guy Harris 8f3dee4470 Put in a note on updating "" and "Makefile.nmake".
svn path=/trunk/; revision=1685
2000-03-03 06:19:50 +00:00
Guy Harris d4de088c60 Merge in Gilbert's "proto_tree" document.
svn path=/trunk/; revision=1684
2000-03-03 06:13:23 +00:00
Guy Harris 0f6d258026 Note that C++-style comments shouldn't be used in dissectors.
svn path=/trunk/; revision=1680
2000-03-02 07:47:20 +00:00
Guy Harris 33afb489e7 Merge in some information from Jeff Foster's developer's notes.
svn path=/trunk/; revision=1674
2000-03-01 08:05:49 +00:00
Guy Harris 4eee1fa7ca James Coe's developer HOWTO.
svn path=/trunk/; revision=1673
2000-03-01 07:48:03 +00:00
Guy Harris 7c11334000 Jeff Foster's changes, with my additions, to allow the user to pop up a
window showing the protocol tree and hex/ASCII data for the currently
selected packet.

svn path=/trunk/; revision=1670
2000-02-29 06:24:41 +00:00
Guy Harris 25c6518e54 Fred Reimer's patch to put the TCP segment length in the TCP packet

svn path=/trunk/; revision=1669
2000-02-28 08:17:39 +00:00
Guy Harris ca9d89b2ba In Tethereal, allow capture filters and read filters either to be
specifies with "-f" and "-R" flags, respectively, or specified with
non-flag command-line arguments, as tcpdump and snoop allow.

svn path=/trunk/; revision=1663
2000-02-22 07:07:55 +00:00
Guy Harris 1b401fa9e1 Note that the read filter specified with the "-R" flag applies only to a
file read in as a result of a "-r" flag specified on the command line.

svn path=/trunk/; revision=1646
2000-02-19 00:18:45 +00:00
Gilbert Ramirez c08f671988 Dietmar Petras provided:
* fix a bug in packet-tftp.c dissecting TFTP Option Acknowledgement
  packets. The is no Block-Id in TFTP Option Acknowledgements, as it is
  in TFTP Acknowledgements.
* Extension of manuf by ethernet addresses from ELSA (my company), a german
  vendor of ISDN routers, cable modems, etc.
* New dissector for Time Protocol [RFC 0868]. That protocol works on port
  37 of UDP and TCP. The implementation in this patch only dissects the
  more usual UDP version. It could print the time in a more fashion way,
  but thats for a later version.

svn path=/trunk/; revision=1609
2000-02-09 17:15:59 +00:00
Guy Harris a82c49732b Change from Ed Meaney - write capture files in binary, rather than ASCII
("w" and "wb" are the same on UNIX, but not on Win32).

svn path=/trunk/; revision=1598
2000-02-03 06:31:30 +00:00
Guy Harris 4410e4274c TFTP Option Extension (RFC 2347) support, from Craig Newell.
svn path=/trunk/; revision=1573
2000-01-27 07:09:45 +00:00
Gilbert Ramirez b3ff562157 Credit fix, and fix for building editcap.1 with build dir != $(srcdir)
svn path=/trunk/; revision=1564
2000-01-26 03:42:28 +00:00
Guy Harris f393a19883 Heikki Vatiainen's patch to add a flag to control whether to interpret
the IPv4 TOS field as a TOS field or as a DiffServ field, and allow that
field to be controlled by a command-line option or an option in the
"Display:Options" dialog box.

svn path=/trunk/; revision=1532
2000-01-24 04:44:58 +00:00
Guy Harris 287efcbbe7 Allow "-w" and/or "-R" to be specified either when doing a live capture
or when reading a saved capture file; if "-w" is specified, the packets
captured or read from the file are written to the specified file rather
than being dissected and printed, and if "-R" is specified, only packets
that pass the specified read filter are dissected and printed or

svn path=/trunk/; revision=1523
2000-01-22 07:19:34 +00:00
Guy Harris 0ce1dab01d Gerrit Gehnen's patch to add support for the "Inactive Subset" of the
ISO 8473 CLNP protocol.

svn path=/trunk/; revision=1513
2000-01-20 19:16:41 +00:00
Guy Harris 766e37db65 Put into the "Capture Preferences" dialog box a check box to control
whether, in a live capture that updates the display as packets arrive,
the packet list pane should scroll to show the most recently captured
packets or not.

svn path=/trunk/; revision=1506
2000-01-18 09:25:04 +00:00
Guy Harris aa718b5e74 Put the "Find Frame" and "Go To Frame" menu items under "Edit"; leave
them under "Display" as well for now.

svn path=/trunk/; revision=1505
2000-01-18 09:05:30 +00:00
Guy Harris 4603877dc4 Jerry Talkington's changes to support, in the packet list and protocol
tree panes, menus popped up by the right mouse button.

svn path=/trunk/; revision=1504
2000-01-18 08:38:18 +00:00
Guy Harris a83998f4f0 Add a "-F" flag, to allow the format of a file being written to be
specified.  This will be of more use when I allow "-w" to be used when
reading an existing capture file rather than doing a live capture (which
will also allow you to specify a read filter, and thus to write a
capture file containing those packets from an existing capture file that
match a given display filter).

Fix up some messages to say "tethereal" rather than "ethereal".

svn path=/trunk/; revision=1499
2000-01-17 08:06:42 +00:00
Guy Harris 1108f9f609 Add a "-x" flag to Tethereal, to make it print a hex and ASCII dump of
the packet data.

svn path=/trunk/; revision=1497
2000-01-17 07:49:03 +00:00
Guy Harris 7f30e566a0 Move the routine to get a list of the network interfaces on the system
to "util.c", and provide a routine to free that list as well.

When picking an interface on which to do a capture (if no "-i" flag was
specified), use that routine, and pick the first interface on the list.

svn path=/trunk/; revision=1495
2000-01-16 02:48:12 +00:00
Guy Harris 278b21900a If no "-i" flag is specified to Tethereal when no file is to be read,,
or to Ethereal when the "-k" flag is specified, i.e. when a capture is
to be started immediately, use "pcap_lookupdev()" to pick an interface,
just as tcpdump does.

svn path=/trunk/; revision=1482
2000-01-15 06:05:21 +00:00
Guy Harris bf9587025a Note that we can read "i4btrace" capture files.
svn path=/trunk/; revision=1471
2000-01-14 08:14:33 +00:00
Guy Harris b799cb10d9 Add "tethereal", a tty-oriented derivative of Ethereal that works like
Sun's snoop or like tcpdump.

svn path=/trunk/; revision=1468
2000-01-14 06:46:00 +00:00
Guy Harris 08fb6dc0c3 Updates to the L2TP parser, from Laurent Cazalet and Thomas Parvais.
svn path=/trunk/; revision=1449
2000-01-10 23:22:30 +00:00
Guy Harris 8fafa9af84 Add a man page for "editcap".
svn path=/trunk/; revision=1446
2000-01-09 20:28:26 +00:00
Guy Harris 6a12f137a1 The L2TP dissector is by John Thomes, not John Thomas.
svn path=/trunk/; revision=1434
2000-01-07 09:13:21 +00:00
Guy Harris 355bd9d8ac Add John Thomas' L2TP dissector.
svn path=/trunk/; revision=1433
2000-01-07 09:10:22 +00:00
Guy Harris 4d638e5045 Improve the description of the packet-printing dialogs, and note that
the Edit:Preferences dialog also lets you edit GUI preferences.

svn path=/trunk/; revision=1425
2000-01-06 07:32:44 +00:00
Gilbert Ramirez 8162d65615 Changed the protocol tree widget from a GtkTree to a GtkCTree. The two reasons
I did this:

First, Havoc Pennington, in "GTK+/Gnome Application Development", in
Appendix seciton A.3.88, recommends using GtkCTree instead of GtkTree
because GtkCtree is faster, and GtkTree has limitation on its total row
height: since it must fit inside a GdkWindow, it is limited to 32,768
pixels of height. GtkTree is more flexible with regards to the types of
widgets that can be placed in the tree, but since we deal only with text,
that doesn't matter, at least for now.

Secondly, a GtkTree doesn't allow arrow-key navigation (at least as far
as I could tell). It always bothered me that the up and down arrow keys
worked in the packet list and in the hex dump, but no in the protocol tree.
GtkCTree does allow arrow-key navigation. In fact, GtkCTree is a subclass
of GtkCList (the packet list widget), so they behave a lot alike.

I went ahead and fixed the selection bar which has been bothering Richard
for a long time now. :) In the GUI preferences dialogue, you can now set
both the packet list selection bar and the protocol tree selection bar
to either "browse" or "select" mode. "browse" mode is what you're used to:
the arrow keys move an outline of the selection bar, but do not change
the selection. "select" mode does change the selection when the arrow keys
are pressed. The default behavior is set to "select", which seems more
natural for a first-time user.

svn path=/trunk/; revision=1393
1999-12-29 20:10:12 +00:00
Guy Harris dcf312c107 Put "Ethereal" in boldface everywhere it appears.
Reformat some (source) paragraphs, for the benefit of those with editors
that don't wrap lines in the display.

Delete some extra "=back" directives.

Fix the description of the "Preferences" dialog (it lets you control
various preferences, not just print preferences; it's the "Print" tab
that lets you control print preferences).

svn path=/trunk/; revision=1352
1999-12-16 08:05:46 +00:00
Gilbert Ramirez f34e877593 Add a new page to the Preferences notebook: a GUI page. The sole
option right now is the placement of the vertical scrollbars in the 3 panes.
(it's one decision; you can't have the placement of the vertical scrollbar
in the packet list pane different than the placement in the protocol tree
pane, for example).

I did this because I find it convenient to have the vertical scrollbars
on the *left* side of the text. My mouse cursor is usually expanding and
collapsing the protocol tree widgets, and once the protocol tree changes
size, I usually have to scroll. I'd rather move my mouse cursor just a few
pixels over to find the vertical scrollbar.

svn path=/trunk/; revision=1351
1999-12-16 06:20:18 +00:00
Guy Harris 096134536e Stuart Stanley's ISIS dissection support.
svn path=/trunk/; revision=1340
1999-12-15 04:34:44 +00:00
Olivier Abad 065d937572 Document the plugins menu and dialogs
svn path=/trunk/; revision=1311
1999-12-13 12:29:42 +00:00
Gilbert Ramirez 4a15f6582a Added Bert Driehuis <>'s I4B wiretap module
and V.120 decoder.

svn path=/trunk/; revision=1304
1999-12-12 22:40:10 +00:00
Guy Harris 7537c5cc73 Jerry Talkington's patch to remove the filter stuff from
"Edit:Preferences" and put it directly under "Edit:Filters", and to add
an "Apply" button to it, which makes the currently selected filter the
current filter and applies it to the current capture.

svn path=/trunk/; revision=1275
1999-12-10 06:28:24 +00:00
Guy Harris 6198327782 Add Dave Chapeskie's name to the list of contributors.
svn path=/trunk/; revision=1240
1999-12-07 22:59:31 +00:00
Guy Harris e5f812d6ed James Coe's patch to add SRVLOC and NCP-over-IP support.
svn path=/trunk/; revision=1234
1999-12-07 06:13:19 +00:00
Guy Harris b5b4e3d57a Patch from Jerry Talkington to:
treat CONNECT as an HTTP request;

	add DELETE and OPTIONS as request names.

Make the order of names in the AUTHORS file match that of the man page
and the About box.

svn path=/trunk/; revision=1231
1999-12-06 20:27:40 +00:00
Guy Harris af31f0b1ad Add support for saving files in a format other than the one they're in
and other than "libpcap", now that Wiretap can write files other than

svn path=/trunk/; revision=1226
1999-12-06 09:08:58 +00:00
Gerald Combs d2ebea8481 Add description of TCP stream prefs.
svn path=/trunk/; revision=1186
1999-12-03 03:56:35 +00:00
Guy Harris dc548e7458 Allow the user to save either all of the current capture, or only the
packets that are currently being displayed from that capture.

Centralize the code to control whether "File:Save" and "File:Save As"
are enabled (and *always* have "File:Save As" enabled if you have a
capture; "File:Save" is enabled only if you have a live capture you've
not yet saved, although it does the same thing as "File:Save As").

Have the "save_file" member of a "capture_file" structure represent
*only* the file currently being *written* to by a capture, and, if there
is no capture currently in progress, have it be NULL; the name of the
file currently being *displayed" is in the "filename" member, and an
"is_tempfile" member indicates whether it's a temporary file for a live
capture or not.

Have "close_cap_file()" delete the current capture file if it's a
temporary capture file that hasn't been saved (in its entirety - saving
selected frames doesn't count).  Do the same (if there *is* a current
capture file) when exiting.

The "Ready to load or capture" message is the only statusbar message in
the "main" context; "close_cap_file()" should never pop it, it should
only pop whatever message exists in the "file" context, and thus has no
need to take, as an argument, the context for the message it should pop.

Update the man page to reflect the new behavior of "File:Save" and
"File:Save As", and to reflect recent changes to "Display:Match Selected".

svn path=/trunk/; revision=1170
1999-11-30 20:50:15 +00:00
Guy Harris 350ea4308c Make the field indices in the sample code for registering fields static.
Add information about registering "ett_" values.

svn path=/trunk/; revision=1163
1999-11-30 05:49:14 +00:00
Gilbert Ramirez f6147bfdd9 Change Olivier's e-mail address.
svn path=/trunk/; revision=1158
1999-11-29 22:45:34 +00:00
Guy Harris 962977f1cd Note that we can now read files from Sun's "atmsnoop", which is a
version of "snoop" that apparently comes with Sun's ATM software and
that supports ATM.

svn path=/trunk/; revision=1148
1999-11-29 07:33:53 +00:00
Gilbert Ramirez 7bd50061f8 Move to version 0.7.8.
Document changes in this version.
Add Greg to ever-growing list of authors (he was in AUTHORS, but not
	in manpage nor in main.c)

svn path=/trunk/; revision=1097
1999-11-23 04:43:44 +00:00
Guy Harris 428e8e2ac8 Document the new "Reset" button.
svn path=/trunk/; revision=1092
1999-11-22 08:09:16 +00:00
Gilbert Ramirez 6e11f6f0b5 Enable IPX network name resolution by providing for an /etc/ipxnets
and a $HOME/.ethereal/ipxnets file. get_ipxnet_name() and other functions,
similar to get_ether_name() and friends, have been added.

svn path=/trunk/; revision=1085
1999-11-21 16:32:23 +00:00
Gilbert Ramirez 2f996a1498 Ugg. Pod format needs a blank line after a =head1 line.
svn path=/trunk/; revision=1075
1999-11-20 03:56:10 +00:00
Gilbert Ramirez 0e3f87e3e4 The resolve routines accept HW addresses in the ethers file with either
dashes or colons as punctuation. Added period as a valid separator, to make
the resolve routines congruent with the display filter syntax options.

Document the fact that both /etc/ethers and $HOME/.ethereal/ethers are
used for resolving hardware address names. I did not know this until
I discovered it in resolv.c!

svn path=/trunk/; revision=1074
1999-11-20 03:39:27 +00:00
Guy Harris b68f2dde89 Heikki Vatiainen's SAP (Session Announcement Protocol) dissector.
Rename the dissector for the Netware SAP protocol to "dissect_ipxsap()",
so as to keep its name from colliding with that of the dissector for the
Session Announcement Protocol.

svn path=/trunk/; revision=1046
1999-11-17 02:17:29 +00:00
Gilbert Ramirez 6a20c7bbc5 Add "class" that understands IPv4 addresses and subnet masks.
We now store IPv4 addresses in host order, allowing non-equivalence
comparisons. That is, display filters with lt, le, gt, and ge will work
on big-endian and little-endian machines.

CIDR notation is now supported for IPv4 addresses in display filters.
You can test to see if an IPv4 address is on a certain subnet by using
this notation. For example, to test for IPv4 packets on a Class-C network:

	ip.addr ==

svn path=/trunk/; revision=1032
1999-11-15 06:32:38 +00:00
Guy Harris f2b8eb42d0 Change my e-mail address to the forwarding address my *alma mater*
provides.  "Every problem in computer science can be solved by adding a
layer of indirection."

svn path=/trunk/; revision=1008
1999-11-11 08:45:34 +00:00
Guy Harris 3e0d1bd4d9 Add a "Go To Frame" menu item, which lets you go to a frame by frame

svn path=/trunk/; revision=990
1999-11-08 01:13:24 +00:00
Guy Harris f3ec699cb3 Add a "Find Frame" menu item under "Display"; it lets you use a display
filter to search forward or backward in the list of displayed frames for
a matching frame.

When filtering the display, readjust the display to show the "current"
frame if it passed the display filter.  When a file is read in, the
first frame becomes the "current" frame; when a frame is selected, it
becomes the "current" frame, and remains so *even if you unselect it*,
until another frame is selected.

Select the first frame when a file is read in.

Disable most of the "Display" and "Tools" menu items if there's no
current capture file, and enable the relevant ones if there is.

svn path=/trunk/; revision=983
1999-11-06 06:38:53 +00:00
Gilbert Ramirez fb9f8ad5ed Mention the Toshiba trace file capability in the man page.
svn path=/trunk/; revision=953
1999-10-31 17:54:27 +00:00
Guy Harris b99cfa28c8 Warren Young's patch to add a "Print" button to the "Follow TCP Stream"
data window.

Some (belated) man page updates.

svn path=/trunk/; revision=950
1999-10-30 06:42:10 +00:00
Guy Harris 21c466ed25 Uwe Girlich's ONC RPC and NFS dissectors.
svn path=/trunk/; revision=945
1999-10-29 01:04:44 +00:00
Guy Harris da1fdf005f Kojak's ICQ dissector.
svn path=/trunk/; revision=919
1999-10-24 00:56:11 +00:00
Guy Harris 6921a22ac5 Additional NTP changes:
added misc. constants for parsing flags, and converting time

	added flags and primary sources explanations;

	added function for converting time stamps;

	improved item analysis;

	new item definitions;

from Tomislav Vujec.

svn path=/trunk/; revision=908
1999-10-22 06:31:39 +00:00
Gilbert Ramirez 25c3854517 Mention nettl in docs, and mention VLAN addition in NEWS.
svn path=/trunk/; revision=904
1999-10-22 02:30:31 +00:00
Guy Harris d4964f4944 Have Ethereal check for a first command-line argument of "-G", rather
than a command name of "ethereal-dump-fields", to decide whether to run
as normal Ethereal or to just dump out the list of fields that can be
used in a display filter.

This allows us to continue to make that check without doing the regular
command line flag parsing (which we don't want to do, as we don't want
to call "gtk_init()" before making that check, as "gtk_init()" tries to
open an X display, and some people want not to have to have X running in
order to build Ethereal, or want not to have Ethereal try to open an X
connection over a slow line if it's just going to print field names to
the standard output), without having to make a link to "../ethereal"
from the "doc" directory (said link couldn't be a hard link, as ATK
apparently disallows hard links between directories, and I have the
vague impression that a symbolic link might cause other problems).

svn path=/trunk/; revision=902
1999-10-21 21:47:08 +00:00
Guy Harris 1b0fc805f7 Document the requirements for getting a protocol's register routine
called automatically at startup time.

svn path=/trunk/; revision=892
1999-10-20 06:40:44 +00:00
Gilbert Ramirez 6522db3535 Enable filtering on the existence of an FT_STRING variable, even though
we don't (yet) filter on the value of an FT_STRING variable.

Added info about FT_DOUBLE fields to man page.

svn path=/trunk/; revision=887
1999-10-19 05:45:56 +00:00
Gilbert Ramirez de7123f718 Added ethereal, randpkt, and intermediate programs (dfilter2pod, rdps) to
.cvsignore files.

svn path=/trunk/; revision=847
1999-10-15 20:54:39 +00:00
Jun-ichiro itojun Hagino 45ca99c55b avoid mistakingly commit dynamically generated files, like "Makefile".
svn path=/trunk/; revision=837
1999-10-15 04:40:28 +00:00
Gilbert Ramirez 46420eee18 Update man page with new bytestring methods (negative offsets, implied
byte-string lengths).

svn path=/trunk/; revision=834
1999-10-14 17:21:12 +00:00
Guy Harris 364274edf3 Nathan Neulinger's dissector for the Yahoo messenger and pager

svn path=/trunk/; revision=824
1999-10-14 01:29:07 +00:00
Gilbert Ramirez bacb9d5bae New proto_tree header_field_info stuff. Header_field_infos now contain
the base for numbers to be displayed in, bitmasks for bitfields, and blurbs
(which are one or two sentences describing the field).

proto_tree_add*() routines now automatically handle bitfields. You tell
it which header field you are adding, and just pass it the value of the
entire field, and the proto_tree routines will do the masking and shifting
for you.

This means that bitfields are more naturally filtered via dfilter now.

Added Phil Techau's support for signed integers in dfilters/proto_tree.

Added the beginning of the SNA dissector. It's not complete, but I'm
committing it now because it has example after example of how to use
bitfields with the new header_field_info struct and proto_tree routines.
It was the impetus to change how header_field_info works.

svn path=/trunk/; revision=815
1999-10-12 06:21:15 +00:00
Guy Harris 817465175d Oops! Forgot to commit the change that adds Christophe Tronche to the
list of authors.

svn path=/trunk/; revision=809
1999-10-11 18:04:48 +00:00
Laurent Deniel 79019e8369 Add reference to tcpdump manual page for capture filter syntax.
svn path=/trunk/; revision=800
1999-10-10 16:25:28 +00:00
Guy Harris 79ec5a3ba9 Get rid of "-F" - "-S" works, and has a more convenient UI.
Print a usage message if an illegal command-line flag is seen.

Clean up the usage message a bit.

svn path=/trunk/; revision=755
1999-10-02 20:00:46 +00:00
Guy Harris 5b83e8d86c Update to reflect changes to the "Capture/Start" and "Display/Options"
dialog boxes.

svn path=/trunk/; revision=709
1999-09-23 06:34:18 +00:00
Ashok Narayanan ac6ad294fb Documentation for compressed file support
svn path=/trunk/; revision=697
1999-09-22 01:38:00 +00:00
Laurent Deniel 6bb5358e85 Added "Automatic scrolling in live capture".
This display option is disabled by default.

svn path=/trunk/; revision=692
1999-09-19 16:03:46 +00:00
Gilbert Ramirez ff20b92b67 Fixed randpkt so it isn't linked to X11 libs. Removed randpkt from default
target list, so a 'make randpkt' is required if you want to build it.

svn path=/trunk/; revision=684
1999-09-17 04:38:23 +00:00
Gerald Combs 182b9f5fe4 Derek W Poon <> pointed out that two examples listed
"ether.src" instead of "eth.src".  Fixed.

svn path=/trunk/; revision=682
1999-09-16 01:24:01 +00:00
Guy Harris f4ac555e90 Peter Torvals' Internet Cache Protocol dissector.
svn path=/trunk/; revision=677
1999-09-14 08:06:47 +00:00
Gerald Combs d47f988543 Updated documentation with Lucent/Ascend information.
svn path=/trunk/; revision=674
1999-09-13 03:51:09 +00:00
Laurent Deniel ee582f4f90 Collapse/Expand All protocol tree added in Display menu.
Remove "experimental feature" warning in -S option description.

Should we remove -F option ?

svn path=/trunk/; revision=661
1999-09-11 15:47:38 +00:00
Gilbert Ramirez 7a37324e12 Added ip, tcp, and udp to randpkt.
svn path=/trunk/; revision=650
1999-09-10 15:38:58 +00:00
Gilbert Ramirez c2bf152b01 Added random packet generator.
svn path=/trunk/; revision=645
1999-09-10 05:15:17 +00:00
Guy Harris 338f3ff2ad Put in an RCS ID (and a copyright notice and GPL notice; unfortunately,
this causes "" to have two GPL notices - "" and
the "Makefile" generated from it are generated files, so maybe that's

svn path=/trunk/; revision=639
1999-09-09 03:55:49 +00:00
Gilbert Ramirez cc7387e116 Removed hacked-up doc/, and replaced it with simple doc/
svn path=/trunk/; revision=615
1999-08-31 05:58:48 +00:00
Gilbert Ramirez 0d9fcad21c Stop processing of colorization display filters after first match.
Remove debugging statements from colors.c.
Add blurb about Match Selected and Colorization to man page.

svn path=/trunk/; revision=607
1999-08-28 23:47:50 +00:00
Gilbert Ramirez b53d4ba179 Changed packet-tr.c to insert, a FT_BOOLEAN field, only if
is true. The test for truth now becomes a test for existence. The dfilter
grammar no longer recognizes 'true' and 'false', since you can now check
a boolean field via:

or by its negation:


svn path=/trunk/; revision=591
1999-08-27 19:27:22 +00:00
Gilbert Ramirez 8904b3b217 Reverted TCP follow back to old behavior of leaving list of packets in
filtered state. The display filter text entry widget is left in its
original state, so an ENTER can reset the packet list. The manpage has
been changed to mention this.

svn path=/trunk/; revision=580
1999-08-25 22:20:03 +00:00
Gilbert Ramirez c0fa3841ee Modified autoconf/automake files for doc subdirectory so that all of
Ethereal can be compiled in a build directory separated from the source

svn path=/trunk/; revision=468
1999-08-11 16:05:19 +00:00
Guy Harris 37ddd5f5ed Jeff Foster's changes to add support for NetBEUI/NBF (NetBIOS atop 802.2
LLC, the original NetBIOS encapsulation).

svn path=/trunk/; revision=466
1999-08-10 20:06:39 +00:00
Guy Harris 8eb998e360 Add the ability to specify a filter to be used when reading the file to
the "Open File" dialog box (the "Open File" dialog box equivalent of the
"-R" flag).  Have "load_cap_file()" take the filter expression as an
argument, and make the global "rfilter" into a member of a
"capture_file" structure.

When reading a temporary capture file after a live capture, don't apply
any filter.

Move the code that pops up error boxes on file opens when reading a
capture file back to "load_cap_file()"; it also pops up error boxes if
the filter expression can't be parsed.

Don't enable "File/Save" or "File/Save As..." if an attempt to read a
capture file fails - if there was already an open capture file, it was
closed by "load_cap_file()", so we no longer have an open file to save.

svn path=/trunk/; revision=460
1999-08-10 07:16:47 +00:00
Guy Harris 059d89e65b Jochen Friedrich's patch to add a "-R" flag, which takes a
display-filter syntax expression as an argument, and causes that filter
to be applied to all packets when a capture file is read in; packets
that don't match the filter are discarded.

svn path=/trunk/; revision=454
1999-08-08 01:29:24 +00:00
Guy Harris eca1e74373 Have Ethereal, when invoked as "ethereal-dump-fields", dump out a
glossary of display filter symbols, just as it does with "-G", except
that, as it can discover that it was so invoked before even looking at
the command-line arguments, it needn't even bother calling "gtk_init()"
to process those command-line arguments GTK+ cares about, and thus
needn't do any X stuff at all when so invoked.

That allows Ethereal to be built in an environment where you don't have
an X server, and, if your connection to your X server is slow, allows
you to built it faster.

Get rid of the "-G" flag, as it had only a somewhat specialized use.

svn path=/trunk/; revision=444
1999-08-05 06:34:43 +00:00
Gilbert Ramirez 48a5d3ee58 Update documentation, including display filter docs.
svn path=/trunk/; revision=427
1999-08-03 16:33:12 +00:00
Gilbert Ramirez aebcf2eb32 Removed the "exists" keyword from the grammar. The name of a protocol or a
field by itself assumes you are checking for the existence of that protocol
or field.

Changed the format of the list of filterable fields in the man page.
Developers: run "./configure" so that your configure script will re-create
dfilter2pod from the new

svn path=/trunk/; revision=426
1999-08-03 15:04:33 +00:00
Guy Harris c61ac5c4b7 Update Olivier Abad's e-mail address.
svn path=/trunk/; revision=420
1999-08-02 05:52:52 +00:00
Guy Harris 7bcc34708d Update the "Contributors" section of the man page to include everybody
listed in the AUTHORS file.  (Arguably, that section - *and* the list of
developers in the "Help/About" box - should be generated from the
AUTHORS file by a script....)

svn path=/trunk/; revision=415
1999-08-01 05:24:19 +00:00
Gilbert Ramirez b2f932c1db Changed the display filter scanner from GLIB's GScanner to lex. The code
as it standed depends on your lex being flex, but that only matters if you're
a developer. The distribution will include the dfilter-scanner.c file, so
that if the user doesn't modify dfilter-scanner.l, he won't need flex to
re-create the *.c file.

The new lex scanner gives me better syntax checking for ether addresses. I
thought I could get by using GScanner, but it simply wasn't powerful enough.

All operands have English-like abbreviations and C-like syntax:
and, && ; or, || ; eq, == ; ne, != ; , etc.

I removed the ETHER_VENDOR type in favor of letting the user use the [x:y]
notation:	ether.src[0:3] == 0:6:29 instead of ether.srcvendor == 00:06:29

I implemented the IPXNET field type; it had been there before, but was
not implemented. I chose to make it use integer values rather than byte
ranges, since an IPX Network is 4 bytes. So a display filter looks like this:
	ipx.srcnet == 0xc0a82c00
rather than this:
	ipx.srcnet == c0:a8:2c:00

I can supposrt the byte-range type IPXNET in the future, very trivially.

I still have more work to do on the parser though. It needs to check ranges
when extracting byte ranges ([x:y]) from packets. And I need to get rid
of those reduce/reduce errors from yacc!

svn path=/trunk/; revision=414
1999-08-01 04:28:20 +00:00
Gilbert Ramirez 1708722fc2 Removed automatically-generated files from CVS. Some files are generated,
others are copied into the build-tree by 'automake -a'. The
script runs autoheader, automake, and autoconf for the developer in order
to populate a fresh CVS image with the generated build tools.

svn path=/trunk/; revision=388
1999-07-27 04:43:22 +00:00
Guy Harris a1f7559b0a Add a "File/Print" menu item, which prints *all* the packets in the
capture to a file or printer.  This should eventually get the ability to
print either all the packets or only the packets selected by the display
filter, and possibly also the ability to print only packets M through N.

Get rid of "cur" member of "capture_file" structure; nobody used it.

There's no need to pass a pointer to a "dialog_button" variable to
"simple_dialog()" for the error boxes displayed if a file copy or move
fails; that dialog box is just a message box and has only an "OK"

Put the declaration of "prefs" into "prefs.h".

svn path=/trunk/; revision=380
1999-07-23 08:33:44 +00:00
Guy Harris bbc785bb90 Don't depend on Perl being in "/usr/bin/perl"; find it, and generate a
"dfilter2pod" with the path of Perl in its "#!" line.

svn path=/trunk/; revision=372
1999-07-20 08:02:24 +00:00
Guy Harris 05fab57665 Fix some typos.
Make the descriptions of all options full sentences (if an option sets
XXX, describe it as "Sets XXX" rather than just "XXX"); some were, some

Note that "-f" sets the *capture* filter expression.

Don't say that Ethereal can read only "libpcap"-format files; it can
read other formats (using "wiretap" to read capture files is no longer
an option, it's what Ethereal always uses).

svn path=/trunk/; revision=368
1999-07-20 03:54:53 +00:00
Gilbert Ramirez 9612b74c16 Added just enough fields to TCP to support "Follow TCP Stream". It works now.
Added the protocol IDs for ipx and IGMP, but not their fields.

svn path=/trunk/; revision=365
1999-07-17 04:19:15 +00:00
Gilbert Ramirez 0d36ec8de2 Modified the proto_register_field_array usage again. Thanks to Guy's
suggestion, this new method using a static array should use less memory
and be faster. It also has a nice side-effect of making the source-code
more readble, IMHO.

Changed the print routines to look for protocol proto_data instead of
looking at the text label as they did before, hoping that the data hex
dump field item starts with "Data (".

Added the -G keyword to ethereal to make it dump a glossary of display
filter keywords to stdout and exit. This data is then formatted with
the doc/dfilter2pod perl program to pod format, which is combined
with doc/ethereal.pod.template to create doc/ethereal.pod, from which
the ethereal manpage is created. This way we can keep the manpage up-to-date
with a list of fields that can be filtered on.

svn path=/trunk/; revision=364
1999-07-15 15:33:52 +00:00
Guy Harris 6a6f7bb8d8 Don't claim that display filters have "tcpdump" filter syntax, as they
no longer do.  (Leave a placeholder comment; the syntax should perhaps
be described here.)  Update the example filter to match current reality.

Note that the <Return> and <Enter> keys, when typed in the display
filter field, cause the filter to be applied.

svn path=/trunk/; revision=356
1999-07-12 05:47:29 +00:00
Gilbert Ramirez 53d2a96094 Added Johan's RADIUS dissector, finally. I modified it to fit in with the
new proto_tree routines. I also removed the check for lex and yacc from
wiretap's configure script. The IP dissector now uses

svn path=/trunk/; revision=348
1999-07-08 04:23:28 +00:00
Gilbert Ramirez acad5a3730 Documented the proto_register_field_array() function, and converted
the registration functions in packet-fddi.c and packet-eth.c to this new
registration method.

svn path=/trunk/; revision=346
1999-07-08 03:18:20 +00:00
Gilbert Ramirez 07f42b5b31 Created a new protocol tree implementation and a new display filter
mechanism that is built into ethereal. Wiretap is now used to read all
file formats. Libpcap is used only for capturing.

svn path=/trunk/; revision=342
1999-07-07 22:52:57 +00:00
Gilbert Ramirez 7ea29fb80d Added Aaron Hillegass' summary dialogue. We're ignoring the problem with
NetMon statistic packets for now. We might fix that problem with wiretap,
either filtering out those packets, and/or providing the summary
information through a new wiretap API.

svn path=/trunk/; revision=326
1999-06-22 22:02:39 +00:00
Guy Harris f8ff7a6a79 Update the man page to reflect the "Capture/Start" and "Display/Options"
menu items.

svn path=/trunk/; revision=321
1999-06-19 08:48:30 +00:00
Guy Harris 5e1f2e3a46 Get rid of an extra line in the author credits (Brad Robel-Forrest
already appears in the list; the extra line is probably leftover from
cutting-and-pasting the author list from the AUTHORS file).

svn path=/trunk/; revision=314
1999-06-15 03:58:42 +00:00
Gilbert Ramirez aca172004f Added RSVP protocol dissector.
svn path=/trunk/; revision=304
1999-06-11 16:45:02 +00:00
Gilbert Ramirez 34450a8a35 Added PPPoE, PPTP, GRE, and ISAKMP dissectors.
svn path=/trunk/; revision=303
1999-06-11 15:30:55 +00:00
Gilbert Ramirez b7b52ec003 Credited John McDermott <> for his pseudo-real-time
capture patch.

svn path=/trunk/; revision=282
1999-05-12 06:04:47 +00:00
Laurent Deniel 32603ce155 Live data capture and display enhancement that allows network capture and
display of fully decoded packets at the same time.
Options added:
-F : fork capture process
-S : sync mode ala tail -f (implies -F)
-f : filter expression
-Q : exit after capture (implies -k)

svn path=/trunk/; revision=277
1999-05-11 20:07:12 +00:00
Gilbert Ramirez 5ccc874dbe Touch-up fixes to my previous fix of making the packet-capture facility save
to a file unknown to the user first. The manpage has now been updated to reflect
the ability of the user to use the TMPDIR environment variable to change the
location of this capture file. And now the capture file is deleted when
ethereal exits, if the user has not saved the trace file.

svn path=/trunk/; revision=243
1999-04-06 16:35:47 +00:00
Gilbert Ramirez 2870ce29ce Capturing packets from ethereal now saves the capture in an "anonymous" buffer. That is, it's
a random name chosen by tempnam(), unknown to the user. If the user decides to save that
trace, he then uses File | Save to save it to a file. File | Save As lets him make a copy
of his named trace file as well. I also updated my e-mail address in the various credit

svn path=/trunk/; revision=242
1999-04-06 16:24:50 +00:00
Gerald Combs cb1f8e34c5 * Added Joerg Mayer's Vines patch
* Added Joerg to the AUTHORS file
* Added Guy's bitfield decode patch
* Fixed time output

svn path=/trunk/; revision=142
1998-12-29 04:05:38 +00:00
Gerald Combs 554e5d3f46 * Pod page update
* Minor tweaks to the filter prefs

svn path=/trunk/; revision=40
1998-10-13 02:10:57 +00:00
Gerald Combs 2e7e493198 Merged in a _huge_ patch from Guy Harris. It adds a time stap column,
generalizes the column printing code, adds a "frame" tree item to
   the tree view, and fixes a bunch of miscellaneous coding bugs.

svn path=/trunk/; revision=31
1998-09-27 22:12:47 +00:00
Gerald Combs 19176fbb4f * Added in Laurent's OSI/ISO CNLP and COTP support.
* Added Laurent's changes to the man (actually pod) page.
* Copied in VERSION file so that others can make doc/Makefile

svn path=/trunk/; revision=8
1998-09-17 02:01:50 +00:00
Gerald Combs 86534f46e1 Initial revision
svn path=/trunk/; revision=2
1998-09-16 02:39:15 +00:00