(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
and "hdlc" doesn't indicate that it's a protocol type), and, instead of
a "raw" option, have a "try to guess the traffic type" option - for now,
if the first byte is 0x0f or 0x8f, treat it as Cisco HDLC, otherwise
treat it as PPP.
svn path=/trunk/; revision=25737
"aal5_type" dissector, which offers only "guess the traffic type" and
"LLC multiplexed" as options, defaulting to "guess the type".
Add a separate preference to control whether to treat single ATM cells
as raw data or as the first cell of an AAL5 PDU (and dissecting them as
short AAL5 PDUs).
Don't reach inside the tvbuff to get the data and the length; use
tvb_length() and tvb_get_ptr().
Pass the data *after* the AAL5 header to the "guess the traffic type"
routine.
svn path=/trunk/; revision=25736
indicates; replace the "erf.eth" preference with an "erf.ethfcs"
preference, specifying whether the FCS is present in Ethernet frames,
and offer the options "present", "not present", and "maybe present" -
for "maybe present", call the regular Ethernet dissector, which tries to
figure out whether there's an FCS at the end of the packet or not.
svn path=/trunk/; revision=25719
link-layer types static.
If the preference is set to "raw data" for any of those types, display
the raw data with an indication that the preference in question has been
set to "raw data", so people don't just wonder why ERF files aren't
working right any more. (See bug 2641; I had the same surprise when I
tried it on some ERF captures I have.)
Pull the dissect_erf_header() code into dissect_erf() - it's dissecting
the *payload*, not the *header*.
Fill in the Info column with the record type.
When using tvb_new_subset() to chop a header off of a tvbuff, just
specify lengths of -1, so we go all the way to the end.
Clean up the Infiniband dissector call.
svn path=/trunk/; revision=25608
This plugin implements a dissector for Infiniband. It is released
under the GPL v2.
Rather than using say libpcap to capture raw (unframed) IP packets
from near the top of an IPoIB stack, this plugin dissects link level
Infiniband frames.
Infiniband trace files can be read from Endace ERF format trace
files, or from libpcap DLT_ERF files containing ERF TYPE_INFINIBAND
records. There is currently no native DLT_INFINIBAND in libpcap.
Each record contains a hardware timestamp, capture metadata such as
port Id, and a complete link level Infiniband frame starting from
the Local Route Header.
svn path=/trunk/; revision=24628
dissector. This fixes Coverity CID 238 (as we *were* assuming it was
non-null in one statement, and then only checking it later).
Set pinfo->p2p_dir to one of P2P_DIR_RECV or P2P_DIR_SENT, as it's
supposed to be, not to a Boolean value, and explain the basis on which
it's being set.
svn path=/trunk/; revision=24055
This is a replacement of the existing decoding of ERF files (Extensible Record
Format from Endace).
For the decoding of the ERF files, according to the "type of record" given in
the ERF header, several decoders can be used. Up to now, the decoder is
determined according to an environment variable, or with a kind of heuristic.
And, all the treatment is done during the file extraction.
The new architecture, will separate the ERF file decoding, and the ERF record
decoding. The ERF records will be decoded with a specific dissector. This
dissector can be configured with options, to replace the environment variable.
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1839
svn path=/trunk/; revision=23092
Stig Bjørlykke