* AC Timestamp (6)
* Add Station (6)
* CAPWAP Local IPv4 Address (30)
* CAPWAP Local IPv6 Address (50)
* CAPWAP Transport Protocol (51)
* MTU Discovery Padding (52)
* ECN Support (53)
Change-Id: Ib8b2768d5df4b0e1b5b8b5bd28ae66e825020205
Reviewed-on: https://code.wireshark.org/review/3986
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
When it is the mininum wrong length for Message Element Type or
when the Message Element Type is not yet decoded by Wireshark
Change-Id: I49aca0df5ba5ec70d8fb764fef39c17c46ee22a0
Reviewed-on: https://code.wireshark.org/review/3956
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Avoid to have all subtree has expended
Only 2 ett actually and there is > 20 subtree...
Change-Id: Ia4af85345a6f1963d24d1fd589ff8ee09a8ef412
Reviewed-on: https://code.wireshark.org/review/3955
Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Avoid to have 2 CAPWAP in Decode as (and more easy to use too...)
Change-Id: I3a332e9b4b069b9215c38b5c08872bd07ac4c2c3
Reviewed-on: https://code.wireshark.org/review/3954
Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
For hf field, reindent code
Use 0x0 by default for bitmask
Remove also some "boilerplate" comment..
Change-Id: I552ccca2e444f3686ee9ecdad456f2ecfbaa5cba
Reviewed-on: https://code.wireshark.org/review/3953
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Thanks to Massimo Velluci for sample
Change-Id: Ibab2658c2c11c9940d3fdebb0bdc42752d57e1ae
Reviewed-on: https://code.wireshark.org/review/3871
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Also make repetition_coding_indications[] standard terminated.
Change-Id: Ice20e1f27f5ab4d111f893608a230b83899efc9f
Reviewed-on: https://code.wireshark.org/review/2288
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Evan Huus <eapache@gmail.com>
* Wireless data ieee80211 RSSI (dBm) is a signed integer. In the wireless radio the dBm value is negative.
* Wireless data ieee80211 Data Rate (Mbps) is a 100Kbps. You need divide this value by 10.
Issue found by Massimo Vellucci (SmartCAPWAP)
Change-Id: I04dd8a9e38a5f60ee5bf64cd304db1b11413c809
Reviewed-on: https://code.wireshark.org/review/2094
Reviewed-by: Anders Broman <a.broman58@gmail.com>
For a number of protocols that encapsulate 802.11 frames inside packets,
whether the frame includes an FCS or not is specified by the protocol,
not by whether the link-layer frame carrying the packets *itself*
includes an FCS. As we've done with Ethernet, add "_withfcs" and
"_withoutfcs" dissectors, which *don't* check the pseudo-header FCS
length indication, and call those, rather than dissectors that check the
pseudo-header length indication, from the dissectors for those protocols.
Change-Id: Ib8c8ecdd872e1782fdfc66e7573415d91911a62e
Reviewed-on: https://code.wireshark.org/review/1866
Reviewed-by: Guy Harris <guy@alum.mit.edu>
(Using sed : sed -i '/^ \* \$Id\$/,+1 d')
Fix manually some typo (in export_object_dicom.c and crc16-plain.c)
Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8
Reviewed-on: https://code.wireshark.org/review/497
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Found by Massimo Vellucci
Change-Id: Ibbe2d0a4d1e421e647028262baf0398d05905c8d
Reviewed-on: https://code.wireshark.org/review/246
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
be done on flows from one address to another; reassembly for protocols
running atop TCP should be done on flows from one TCP endpoint to
another.
We do this by:
adding "reassembly table" as a data structure;
associating hash tables for both in-progress reassemblies and
completed reassemblies with that data structure (currently, not
all reassemblies use the latter; they might keep completed
reassemblies in the first table);
having functions to create and destroy keys in that table;
offering standard routines for doing address-based and
address-and-port-based flow processing, so that dissectors not
needing their own specialized flow processing can just use them.
This fixes some mis-reassemblies of NIS YPSERV YPALL responses (where
the second YPALL response is processed as if it were a continuation of
a previous response between different endpoints, even though said
response is already reassembled), and also allows the DCE RPC-specific
stuff to be moved out of epan/reassembly.c into the DCE RPC dissector.
svn path=/trunk/; revision=48491
The problem is when Wireshark dissect CAPWAP packets from Cisco without preference "Cisco Wireless Controller Support"
In this case the whole packet decoded wrong, not only Wireless Specific Information field in CAPWAP header
I suggest following patch to dissect_capwap_header function to always return correct length of CAPWAP header based on HLEN header field
From me:
Add expert info to display a warning about Calculate length and Header length are different (and suggest to activate Cisco Wireless Controller Support Preference)
svn path=/trunk/; revision=47793
The reassembled fragments tree in the Packet Details view is awesome, but it
lacks one thing: a field that exposes the reassembled data.
tcp.data already exists for exposing a single TCP segment's payload as a byte
array. It would be handy to have something similar for a single application
layer PDU when TCP segment reassembly is involved. I propose
tcp.reassembled.data, named and placed after the already existing field
tcp.reassembled.length.
My primary use case for this feature is outputting tcp.reassembled.data with
tshark for further processing with a script.
The attached patch implements this very feature. Because the reassembled
fragment tree code is general purpose, i.e. not specific to just TCP, any
dissector that relies upon it can add a similar field very cheaply. In that
vein I've also implemented ip.reassembled.data and ipv6.reassembled.data, which
expose reassembled fragment data as a single byte stream for IPv4 and IPv6,
respectively. All other protocols that use the reassembly code have been left
alone, other than inserting NULL into their initializer lists for the newly
introduced struct field reassemble.h:fragment_items.hf_reassembled_data.
svn path=/trunk/; revision=44802
1. If there's no character encoding (ENC_ASCII, ...) specified
then use ENC_ASCII.
2. For all but FT_UINT_STRING, always use ENC_NA
(replacing any existing True/1/FALSE/0
/ENC_BIG_ENDIAN/ENC_LITTLE_ENDIAN).
svn path=/trunk/; revision=39426
Specifically: Replace FALSE|0 and TRUE|1 by ENC_BIG_ENDIAN|ENC_LITTLE_ENDIAN as
the encoding parameter for proto_tree_add_item() calls which directly reference
an item in hf[] which has a type of:
FT_BOOLEAN
FT_IPv4
FT_EUI64
FT_GUID
FT_UINT_STRING
Also: For type FT_ITv6 use ENC_NA. (This was missed in SVN #39260)
svn path=/trunk/; revision=39328
FT_NONE
FT_BYTES
FT_IPV6
FT_IPXNET
FT_OID
Note: Encoding field set to ENC_NA only if the field was previously TRUE|FALSE|ENC_LITTLE_ENDIAN|ENC_BIG_ENDIAN
svn path=/trunk/; revision=39260
when dissect the capwap control header,the sequence's value is decoded
improperly,it tooks the wrong offset value,so the control messages' sequence is
showed improperly.
Changed to uset proto_add_item and encoding type changed from FALSE to ENC_BIG_ENDIAN.
svn path=/trunk/; revision=37962
* Remove proto_tree_add_eui64 function from 802.15.4 Dissector
* Replace print_eui64/print_eui64 by eui64_to_str/get_eui64_name
* Update Documentation (README.dev)
* Add new function in libwireshark.def
* Support of encoding for tvb_eui64_to_str
* Use FT_EUI64 for ICMPv6, CAPWAP, Zbee ... dissector
svn path=/trunk/; revision=37015
keys to have _uint in their names, to match the routines that handle
dissector tables with string keys. (Using _port can confuse people into
thinking they're intended solely for use with TCP/UDP/etc. ports when,
in fact, they work better for things such as Ethernet types, where the
binding of particular values to particular protocols are a lot
stronger.)
svn path=/trunk/; revision=35224