Commit Graph

1943 Commits

Author SHA1 Message Date
João Valverde 2777003e12 Add version check for plugin compatibility
Only plugins built for the same feature release (X.Y) are assured binary
compatibility. Make sure we don't try to run unsuitable code and, if so,
warn the user. This might happen for example if the user manually copies
a binary plugin to the wrong folder, intentionally or by accident.

I'm using "release version" to loosely mean not a patch release
(i.e: a feature release).

Change-Id: I896e9cbbd2d3843623fff6af8ef51002ec06f1f8
Reviewed-on: https://code.wireshark.org/review/23807
Petri-Dish: João Valverde <j@v6e.pt>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: João Valverde <j@v6e.pt>
2017-10-03 10:09:24 +00:00
Gerald Combs c634f2b184 Capinfos: Add SHA256. Remove MD5.
Print the SHA256, RIPEMD160, and SHA1 hashes for each file instead of
SHA1, RIPEMD160, and MD5. SHA256 seems to be the preferred file hashing
algorithm these days and MD5 is actively discouraged. Note that we might
remove SHA1 (which is also discouraged) as well.

Change-Id: I74d972ae5f3484c83175cd3f3c7a55f99c171e20
Reviewed-on: https://code.wireshark.org/review/23761
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-09-27 08:08:44 +00:00
João Valverde f649064130 Add toy plugin to doc/ as an out-of-tree build example
Change-Id: I9b7abb27d30dbe83996a01b7f722693a974948c5
Reviewed-on: https://code.wireshark.org/review/23665
Reviewed-by: João Valverde <j@v6e.pt>
2017-09-25 14:55:09 +00:00
Michael Mann 5f667694d3 Add Flow Graph functionality to TShark
Add flow graph functionality to tshark through -z option.
Output is same as ASCII format saved from GUI.

Change-Id: Iee0bfea7215858e6488b4728581be28287e9ea1a
Reviewed-on: https://code.wireshark.org/review/23652
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-09-22 04:49:48 +00:00
Håkon Øye Amundsen 018f6bff18 extcap: Interface Toolbar support on Windows
Add support for extcap control pipes on Windows.
Improved read loop in InterfaceToolbarReader.
Delay opening control pipes until extcap has opened the fifo pipe.
Make extcap_example.py work on Windows.

Bug: 13833
Change-Id: I4b47d25452637759b8a3be53be48eee5365bc0e4
Reviewed-on: https://code.wireshark.org/review/23211
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-28 05:48:01 +00:00
Ahmad Fatoum aca55a29f7 Add hardware timestamping support
pcap provides a pcap_set_tstamp_type function, which can be used to request
hardware timestamps from a supporting kernel.

This patch adds support for aforementioned function as well as two new
command line options to dumpcap, wireshark and tshark:

    --list-time-stamp-types
                             List time stamp types supported for the interface
    --time-stamp-type <type>
                             Change the interface's timestamp method

Name choice mimics those used by tcpdump(1), which already supports this
feature. However, unlike tcpdump, we provide both options unconditionally.
If Wireshark was configured without pcap_set_tstamp_type being available,
--list-time-stamp-types reports an empty list.

Change-Id: I418a4b2b84cb01949cd262aad0ad8427f5ac0652
Signed-off-by: Ahmad Fatoum <ahmad.fatoum@siemens.com>
Reviewed-on: https://code.wireshark.org/review/23113
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-22 07:55:26 +00:00
Gerald Combs 719adb4fdc Convert README to README.md.
Convert the contents of the top-level README to Markdown and give it a
.md extension. Most of our documentation is plain text or AsciiDoc, but
the top-level README file in a Git repository is special in that many
online browsers will show the README contents along with the directory
listing and those browsers tend to favor Markdown. This is true of
GitHub (which we're currently mirroring to), Gerrit via its Gitiles
plugin (which we're not yet using but likely will), and other places.

Add "foreign" to AM_INIT_AUTOMAKE. There is probably a joke to be
made here about the FSF and border walls.

Change-Id: I87c306d74864e1f0a432225b160a1b4483ee946c
Reviewed-on: https://code.wireshark.org/review/23049
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-15 14:48:29 +00:00
Gerald Combs 537b083e02 Sync some CMake and Autotools install behaviors.
Adjust the following CMake and Autotools behaviors in order to
synchronize their respective install behaviors:

- Disable tfshark by default in CMakeOptions.txt
- Add profiles/Bluetooth/preferences to Makefile.am
- Add missing captype and ciscodump entries to doc/Makefile.am
- Install help/faq.txt on all platforms in CMakeLists.txt
- Add BUILD_corbaidl2wrs, BUILD_dcerpcidl2wrs, and BUILD_xxx2deb
  options to CMake and use them to adjust the corresponding parts
  of the build.
- Pull the DCERPC idl2wrs build steps into the top-level
  CMakeLists.txt.

This change doesn't sync everything. Some installed content still
diverges, including the following:

- CMake installs a bunch of modules into lib/wireshark:
    FindGLIB2.cmake
    FindWireshark.cmake
    FindWSWinLibs.cmake
    LocatePythonModule.cmake
    UseAsn2Wrs.cmake
    UseMakeDissectorReg.cmake
    WiresharkConfig.cmake
    WiresharkConfigVersion.cmake

  Do we need any or all of these? If so, should the Autotools behavior
  be synced accordingly?

- Autotools installs libtool .la files. It also installs
  wireshark-gtk.desktop unconditionally.

Change-Id: I7846efe08f7139c31b6ceca6f08a1fa5168b3e22
Reviewed-on: https://code.wireshark.org/review/23041
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-08-12 13:53:59 +00:00
Darien Spencer f50d9fe1d6 Update heuristic dissectors documentation
Remove grep output of explict count of heuristic protocols because
it changes too often to bother updating.

Change-Id: I69b0dfbae32f9eb9ffef6c3200238819ddf522e6
Reviewed-on: https://code.wireshark.org/review/22793
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-07-26 01:32:38 +00:00
Guy Harris fe8508b8b3 More precise error message.
"Missing newline after '}'" suggests either that the "}" is the line
character in the file or that it's followed by a character other than a
newline.  What it actually appears to mean is "you didn't put a blank
line between one author entry and the next author entry".

Change-Id: Ic0e4dd02f04680ab84fbfcf1183c911d049ee2d2
Reviewed-on: https://code.wireshark.org/review/22746
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-07-20 21:54:25 +00:00
Pascal Quantin f26778c9c6 Add udpdump documentation to distribution
Bug: 13903
Change-Id: I7e7aadfbec3e66ebac892e20b5632afa9f7e5923
Reviewed-on: https://code.wireshark.org/review/22725
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2017-07-20 09:49:44 +00:00
Peter Wu 44c34ac777 Fix formatting of AUTHORS list, fix Perl warning
Fixes the following warning in Perl 5.26:

    Unescaped left brace in regex is deprecated here (and will be fatal in Perl 5.30), passed through in regex; marked by <-- HERE in m/(.*){ <-- HERE / at doc/make-authors-short.pl line 36.

While at it, fix formatting of the AUTHORS-SHORT file, a newline must be
present after "}" or the file will be mis-parsed.

Change-Id: I76bc1a30714dafd703342d2d430dc1c90cf2bf82
Reviewed-on: https://code.wireshark.org/review/22637
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-07-17 07:57:38 +00:00
Sake Blok 3803e00367 Add option to use wall-clock intervals
Add the "interval" option to "-b". Each new capture starts at the
exact start of a time interval. For instance, using -b interval:3600
will start a new capture file at each whole hour.

Changed the duration option in the GUI interfaces to use the new
interval option.

Change-Id: I0180c43843f5d2f0c2f50153c9ce42ac7fa5aeae
Reviewed-on: https://code.wireshark.org/review/22428
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Sake Blok <sake.blok@SYN-bit.nl>
2017-07-03 16:41:37 +00:00
Guy Harris e0a9192ebc Don't worry about initializing auto aggregates with non-constant values.
On UN*X, you can get C99-or-later compilers, and we request that in the
autoconf script, so it's really a requirement.

At least as I read

	https://msdn.microsoft.com/en-us/library/34h23df8%28v=vs.100%29.aspx

Visual Studio 2010 (and earlier, going back to VS .NET 2003) supports
the "Use of block-scope variables initialized with nonconstant
expressions", with an example of an aggregate (array) initialization
involving function calls, so it sounds as if it's available on Windows
with any version of VS that we support.

(If I've missed something, it'll presumably show up when something is
built with MSVC, and we can update this at that point.)

So the only thing to avoid is initializing global or static variables
with a value that has to be evaluated at run time (the ability to do
that is probably present in most environments, as I think C++
constructors for variables with static storage duration might have to be
evaluated before main() is called, but I guess few C compilers bother to
use it).

Expand the example in the hopes of avoiding confusion between "static
storage duration" (which something declared "static" has, but which
anything declared with file scope, whether declared "static" or not,
also has) and "static storage duration and internal linkage", which is
what the "static" keyword specifies.

Change-Id: I338eb0892e656c2ab59519e4bf76e1dfbec2fa7d
Reviewed-on: https://code.wireshark.org/review/22434
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-28 01:35:39 +00:00
Guy Harris 7321df2a45 Fix the "don't initialize with non-constant variables" item.
It only applies to variables with static storage duration, i.e. global
and static variables.  Expand the example of how to do it, to make it a
bit clearer.

Change-Id: Ie0c473a35a77351dd10d6c9df2c34a39f077fca4
Reviewed-on: https://code.wireshark.org/review/22430
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-27 21:38:45 +00:00
Gerald Combs 7d67af661a Make "matches" case-insensitive.
Make the "matches" operator case-insensitive by default. Case
sensitivity can be switched back on using "(?-i)".

It might be nice to make "contains" case-insensitive as well, but we'd
need a caseless version of epan_memmem.

Change-Id: I5e39a52c148477c30c808152bcace08348df815a
Reviewed-on: https://code.wireshark.org/review/22330
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-06-22 19:32:06 +00:00
Daan De Meyer 07f576ffeb Add --no-duplicate-keys tshark option.
Adds the --no-duplicate-keys option to tshark. If -T json is specified,
this option can be specified in order to transform the duplicate keys
produced by -T json into single keys with as value a json array of all
separate values.

Specifying --no-duplicate-keys changes the function which groups node
children that is passed to write_json_proto_tree. Instead of a function
that puts each node in a separate group (proto_node_group_children_by_unique)
a function is passed that groups children that have the same json key
together (proto_node_group_children_by_json_key). This will lead to
some groups having multiple values. Groups with multiple values are
written to the output as a json array. This includes normal json keys
but also keys with the "_raw" and "_tree" suffix.

If --no-duplicate-keys is specified with an option other than "-T json"
or "-T jsonraw" or without -T an error is shown and tshark will exit.

"Export Packet Dissections -> As JSON" in the GUI is hardcoded to use
the duplicated keys format.

Fixes one regression in the output where a filtered json key (-j) with
both a value and children would not have the "_tree" suffix added to the
json key containing the children.

Includes a little code cleanup (removes one instance of code
duplication and simplifies a while loop).

Fixes a memory leak (I thought this fix was already included in the
previous refactor patch but something must have gone wrong when updating
the patch so I'm including it again in this patch).

Bug: 12958
Change-Id: I401f8fc877b5c590686567c3c44cdb832e9e7dfe
Reviewed-on: https://code.wireshark.org/review/22166
Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-06-22 19:31:01 +00:00
Dirk Weise 9fe90b93ce Add notes about predefined strings not available to plugins
The documention refers dissector authors to helpful predifined string structures
that plugin authors unfortunately cannot use.

Bug: 13828
Change-Id: I62cdfeb200c9b354aed44d40c80a0e8f9e8f910b
Reviewed-on: https://code.wireshark.org/review/22339
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-06-22 12:25:38 +00:00
Michael Mann 585d17ae7f Add support for color xml attributes in psml and pdml formats.
Bug: 6682
Change-Id: I19330d06aa3d5692503c61369c3c650d595971f5
Reviewed-on: https://code.wireshark.org/review/22077
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Stephen Donnelly <stephen.donnelly@endace.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-06-12 03:23:38 +00:00
Dave Goodell 2be411a215 tshark: add "--color" option emulating wireshark colors
With this commit, tshark will mimic the packet coloring present in the
Wireshark GUI whenever "--color" is passed.  This initial commit only
adds such support for the standard text output format.  A future commit
could potentially broaden this support to other output modes (such as
"-V" mode).

Bug: 5158
Change-Id: I59329e32475b0c67e28802e79610544d4868ea2d
Reviewed-on: https://code.wireshark.org/review/21325
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-06-11 13:36:19 +00:00
Michael Mann 6c44f2017c Qt: Add support to verify extcap capture filter
Bug: 11668
Change-Id: Ib218d87c1905e53ffdab4e3dd6f93ba2c3d07c8b
Reviewed-on: https://code.wireshark.org/review/21770
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Roland Knall <rknall@gmail.com>
2017-05-30 18:10:03 +00:00
Stig Bjørlykke 58a0026454 extcap: Update example help text
Change-Id: I1240af78664d6066650be67b95f0423a5353c711
Reviewed-on: https://code.wireshark.org/review/21508
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2017-05-05 13:40:49 +00:00
Hessam Jalali dd884611ac Auto reset epan session
Automatically resets intarnal epan session after reaching to
specified number of packets, for example
-M 1000
will reset the session every 1000 packets.

this is more like a proposal since the usage is very specific
it is useful for 24/7 live capture with dissection and sending
data directly to another application.

example:

tshark -Y "gtp" -M 100000 -T fields -e gtp.message -e gtp.teid

Change-Id: I8ee8b0380017c684120a93cb3fb43f41615a9c04
Reviewed-on: https://code.wireshark.org/review/21312
Reviewed-by: Evan Huus <eapache@gmail.com>
Petri-Dish: Evan Huus <eapache@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-05-05 00:51:58 +00:00
Stig Bjørlykke 741d4f5898 Qt: Interface Toolbar improvements
- Select one of the capturing interfaces when start capture
- Only send user changed control values when start capture
- Don't show hidden interfaces
- Allow a toolbar with no interfaces
- Renamed button role "reset" to "restore"
- Improved control number validation
- Updated documentation

Change-Id: Icc8d04043c95c1f3ef8d7cdc3b251be4471cba0a
Reviewed-on: https://code.wireshark.org/review/21445
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2017-05-02 09:34:01 +00:00
Guy Harris 015d9194e1 Add proto_tree_add_item_ret_boolean().
It does what it says on the label.  You get back TRUE or FALSE in a
gboolean.

While we're at it, remove a copied-and-pasted comment that doesn't
apply, and update another comment.

Change-Id: I117391d2ffe44124a614a7f64dad1b389c1ebc6a
Reviewed-on: https://code.wireshark.org/review/21394
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-28 01:24:39 +00:00
Michael Mann 2c921eb83c Add proto_tree_add_item_ret_uint64
Just like proto_tree_add_item_ret_uint, but with 64-bit support

Change-Id: Ie0cbfda9e63bf21e85df2d674e391a6c0abe92f7
Reviewed-on: https://code.wireshark.org/review/21355
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-04-26 23:46:32 +00:00
Stig Bjørlykke 77751c94f1 Qt: Add interface toolbar support
An extcap utility can provide configuration for controls to use in a
GUI interface toolbar.  This controls are bidirectional and can be
used to control the extcap utility while capturing.

This is useful in scenarios where configuration can be done based on
findings in the capture process, setting temporary values or give other
inputs without restarting current capture.

Todo:
- Add support for Windows

Change-Id: Ie15fa67f92eb27d8b73df6bb36f66b9a7d81932d
Reviewed-on: https://code.wireshark.org/review/19982
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2017-04-25 06:19:39 +00:00
Guy Harris 913f9fb353 Rename BASE_VALS_NO_UNKNOWN to BASE_SPECIAL_VALS.
It makes it a bit clearer what its purpose is - to allow a value_string
to be used for numeric rather than enumerated fields, giving certain
values of the field a special meaning.

Change the explanation in the documentation to match as well.

Change-Id: Id07b22eee996b79ea5f3473928d29adcabe09bf3
Reviewed-on: https://code.wireshark.org/review/21209
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-18 22:28:07 +00:00
Ahmad Fatoum b478df61f5 Qt: Provide both file save and open preferences
This is a breaking change.

prefs_register_filename_preference hasn't been differentiating
between files to be saved and ones to be opened.

On GTK, a neutral dialog is used, so no problems there.
On Qt, a save dialog has been always used, even in dissectors that
were reading configuration files without modification.

prefs_register_filename_preference now takes an argument to indicate
whether UI could be a save dialog with a warning on overwriting
a file, or whether it's a general purpose open file dialog.

Qt now does this. Previously no warning was shown on overwriting a file,
so it may be used for opening files too without irritating the user.
This has been changed, as non-destructive reads should now use
the open dialog.

Dissectors were changed accordingly.

Change-Id: I9087fefa5ee7ca58de0775d4fe2c0fdcfa3a3018
Reviewed-on: https://code.wireshark.org/review/21086
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-04-17 10:51:10 +00:00
Guy Harris 067ef3e08a Clean up documentation and help messages for protocol enabling/disabling.
List all of --enable-protocol, --disable-protocol, --enable-heuristic,
and --disable-heuristic in the SYNOPSIS section of the man pages.

Undent after the list of taps for the -z option, so the following
options are at the same indentation as other options.

List --enable-protocol in the DESCRIPTION, above --disable-protocol.

Include --enable-protocol in the help message.

Change-Id: I680a54430789f3543b2d539fbded22b0b57f7f76
Reviewed-on: https://code.wireshark.org/review/21159
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-17 03:48:14 +00:00
Alexis La Goutte 043df01c56 Add support for BASE_VALS_NO_UNKNOWN
BASE_VALS_NO_UNKNOWN is a special value_string value for only a single
(maybe 2) numerical value(s).  If a field has the numerical value
that doesn't match anything in the value_string, just the number
is supplied for the field (no "Unknown")

Dissectors that had this use case have been converted in the patch.

Change-Id: Ie63a36cceec2fe4436938ec7e3d7f9e690d2b8d9
Reviewed-on: https://code.wireshark.org/review/20736
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-04-10 20:31:37 +00:00
Guy Harris 357cfd3b03 A bunch of "{Mac} OS X" -> "macOS" changes.
Avoid anachronisms, however; there was no "macOS 10.0" or even "OS X
10.0", for example.  It was "Mac OS X" until 10.8 (although 10.7 was
sometimes called "OS X" and sometimes called "Mac OS X"), and it was "OS
X" from 10.8 to 10.11.

Change-Id: Ie4a848997dcc6c45c2245c1fb84ec526032375c3
Reviewed-on: https://code.wireshark.org/review/20933
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-05 19:16:22 +00:00
AndersBroman 572b80d283 Add ENC_TIME_MSEC_NTP and use it in packet-gtpv2.c
While at it fix expert info a typo and an calculation.

Change-Id: I071a36edb7eed5f58708b98aebcb24bc6c34f2a8
Reviewed-on: https://code.wireshark.org/review/20766
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-03-29 05:09:54 +00:00
Martin Sehnoutka 8efd42c4aa Reflect new default value of snaplen in man pages.
Default value for snaplen is defined in wiretap/wtap.h:
 #define WTAP_MAX_PACKET_SIZE    262144

and used in capture_opts.c:
    capture_opts->default_options.snaplen         =
    WTAP_MAX_PACKET_SIZE;

but help and man pages don't reflect this change.

Change-Id: I35ddf1e8b7ffd657f4e01b3fe6b4c44c9acece2b
Reviewed-on: https://code.wireshark.org/review/20738
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-28 16:23:59 +00:00
Pascal Quantin bd486eb9b1 text2pcap: define max packet size to WTAP_MAX_PACKET_SIZE
Change-Id: I73ab87032e4a0c0259227622412be36aaf66a9d6
Reviewed-on: https://code.wireshark.org/review/20758
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-28 10:32:53 +00:00
Guy Harris ed3b5e5764 Get rid of blanks at the ends of lines.
Change-Id: I10a756a4a42d4f27f59e12c11f12d71947191c92
Reviewed-on: https://code.wireshark.org/review/20760
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-28 10:21:50 +00:00
Guy Harris 8f515b1a99 Fix up time encodings.
Add some new encodings for absolute time stamps, and use them as
appropriate; this fixes some cases where the time stamps in question
were being dissected incorrectly.

For the encodings with seconds and 1/2^32s of a second, don't
arbitrarily give only microsecond resolution; 2^32 is greater than 1
million, and, in fact, at least some NTP RFCs explicitly talk about time
resolution greater than 1 microsecond.

Update references in the RELOAD dissector to reflect the documents in
question having been updated and published as RFCs.

Change-Id: Icbe0b696d65eb622978eb71e99ddf699b84e4fca
Reviewed-on: https://code.wireshark.org/review/20759
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-28 10:18:36 +00:00
Jim Young 81ad4cd3bd capinfos: Add -K option and report capture comments last
This patch adds a capinfos -K option to suppess printing of capture
comments.  This patch also changes when capture comments are printed
relative to the other enabled infos. Because capture comments are
freeform we will now defer their printing until all but the interface
detail infos are printed.

Change-Id: Ibb3df040c09e4c67d714c561869c00e08b83d6ed
Reviewed-on: https://code.wireshark.org/review/20643
Petri-Dish: Jim Young <jim.young.ws@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-03-23 11:53:28 +00:00
Joerg Mayer c87cf1a81a Remove a reference to deleted doc/README.epan_child
Change-Id: I521674267873fe32c3ff5b53c9fb6a9e971d8772
Reviewed-on: https://code.wireshark.org/review/20631
Reviewed-by: Jörg Mayer <jmayer@loplof.de>
2017-03-19 17:56:50 +00:00
Alexis La Goutte 78634bbe52 ciscodump (man): fix typo dependant -> dependent
found by lintian

Change-Id: I5ce951fca2213d3d18807cde061dea201a36999f
Reviewed-on: https://code.wireshark.org/review/20628
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-19 16:50:15 +00:00
Joerg Mayer 0b6b152694 Remove echld/.
It has been unsupported for some years and when talking about removing it
in the past I received some positive and no negative feedback.

There is one instance of echld left:
capchild/capture_sync.c:                 * echld might have already reaped the child.

Can that case be removed or should be comment be updated to something more
accurate? (left for a separate patch)

Change-Id: Idac397158dd86fd0728eb95379449ee4a463fc28
Reviewed-on: https://code.wireshark.org/review/20619
Petri-Dish: Jörg Mayer <jmayer@loplof.de>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-03-19 15:13:14 +00:00
Jim Young e66b05fa9d tshark: Optionally delimit packet summary columns with tabs
This patch augments tshark's -T report with a "tabs" option.
When the -T tabs option is enabled an ASCII horizontal tab character
is inserted between each column of the human-readable one-line
packet summary record.

Change-Id: Id10a6e21e231eb2e52b6342ed05399db1a5fcfdf
Reviewed-on: https://code.wireshark.org/review/20537
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-19 13:47:41 +00:00
Joerg Mayer 7f2a39f9ba rpcap URLs *require* the :<port> argument for remote capture - update manpage.
Change-Id: Iabae39347bc0058d106a9b00d81629899bc93249
Reviewed-on: https://code.wireshark.org/review/20526
Reviewed-by: Jörg Mayer <jmayer@loplof.de>
2017-03-12 22:32:05 +00:00
Michael Mann 4a703e01f4 Check profile directory before personal directory for services and subnets file
Bug: 11228
Change-Id: Id8bcc51ff694ef9f2019bc7509e440021d049d22
Reviewed-on: https://code.wireshark.org/review/19735
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-03-03 23:45:36 +00:00
Peter Wu c79b5e0eb7 Update documentation with reference to $XDG_CONFIG_HOME
Since v2.1.0rc0-184-gb0b53fa593, $XDG_CONFIG_HOME/wireshark (instead of
$HOME/.wireshark) is used, clarify this in the WSUG and manuals.

Change-Id: I74a6f9b86bd8d54ee326ca83d7536e091d6da08a
Reviewed-on: https://code.wireshark.org/review/20364
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-03 19:29:44 +00:00
Kim Bäckström f3d52cb534 Bugfix for extcap fileselect functionality, start button in extcap options dialog wouldn't
get enabled if the user had selected a file (and mustexist=true wasn't specified).

This commit also contains minor fixes to doc/README.extcap, it's now more aligned to the
actual implementation.

Added example usage of fileselect, radio and multiselect to doc/extcap_example.py.

Change-Id: Ibfe40a35a26f49322fbe64c0594506a2163f7e20
Reviewed-on: https://code.wireshark.org/review/20274
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Roland Knall <rknall@gmail.com>
2017-02-26 09:22:25 +00:00
Martin Kacer cd7d159c2e json2pcap support added
Modified tshark -T json -x output
Added tshark -T jsonraw output
json2pcap.py (can be used for basic packet editing by modifying json)

The modification in tshark -T json -x and new tshark -T jsonraw output
add into  hex-data output in JSON also information on which position
each field is dissected in the original frame, what is the field length,
bitmask (for not byte aligned fields) and type. This information can be
used for latter processing. One use-case is json2pcap script which
assembles the protocol layers back together from upper to lowers layers,
which allows the basic packet modification/editing/rewriting.

Change-Id: Ibf948eb8fc7e3b0b51c12df6c3855f705a9c7925
Reviewed-on: https://code.wireshark.org/review/19990
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Dario Lombardo <lomato@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-25 19:11:01 +00:00
Roland Knall 3697192ea2 pluginif: Add documentation for toolbar interface
Add the documentation for the new toolbar interface
to the README file

Change-Id: I9dd37dc4f31760ccd1c9a3e6ae379cd6f9ca1db9
Reviewed-on: https://code.wireshark.org/review/20261
Reviewed-by: Roland Knall <rknall@gmail.com>
2017-02-24 09:04:48 +00:00
Gerald Combs 560a6c3823 Rawshark: Try to avoid a VC runtime crash.
The MSDN documentation for _read says

"If fd is invalid, the file is not open for reading, or the file is
locked, the invalid parameter handler is invoked, as described in
Parameter Validation."

This means that on Windows, if our parent has closed stdin when we call
_read we'll crash. Add a check to bail out early if that's happened.

Fix a sign cast while we're here.

Change-Id: I8afb75f6e56c6a6c2b62103ba7e2fb635dc85702
Reviewed-on: https://code.wireshark.org/review/20153
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2017-02-17 17:19:06 +00:00
Peter Wu 6b84ddee83 Make Libgcrypt a mandatory dependency
Removed all guards for HAVE_LIBGCRYPT, change autotools and CMake to
error out if it is not available. Update release notes, developer
documentation and README with the new status. Clarify relation with
GnuTLS in macosx-setup.sh. Install Libgcrypt via brew script.

Motivation for this change is that many dissectors depend on Libgcrypt
and having it optional increases the maintenance burden (there have been
several compile issues in the past due to the optional status).
Furthermore, wsutil has crypto code that can be replaced by Libgcrypt.

Change-Id: Idf0021b8c4cd5db70b8766f7dcc2a8b3acbf042f
Link: https://www.wireshark.org/lists/wireshark-dev/201702/msg00011.html
Reviewed-on: https://code.wireshark.org/review/20030
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-13 18:35:47 +00:00