Commit Graph

15473 Commits

Author SHA1 Message Date
Ulf Lamping 7900675ab5 Move "Expert Info" from "Statistics" to "Analyze" menu item.
*significantly* improve performance (100000 infos from ~5min to 25sec!)

Add a simple severity based filter mechanism.

replace // style comments by /**/

svn path=/trunk/; revision=15791
2005-09-13 23:46:42 +00:00
Ulf Lamping 2b82bb3df7 Turn around the sequence of PATH, so the former PATH will be in front of the newly added things.
This way, the cygwin link.exe command will be behind the link.exe from MSVC.

Also added a definition of the docbook dir, floating around in my personal file for a while. This will be needed if the User's Guide is included in the NSIS installer later.

svn path=/trunk/; revision=15790
2005-09-13 19:01:08 +00:00
Gerald Combs a242f1926b In smb_trans_defragment(), throw an exception if we encounter a too-large
fragment size.  The limit is conservatively set at 65536 bytes.  It may
have to be increased.  Fixes bug 421.

Add an entry to the release notes.

svn path=/trunk/; revision=15789
2005-09-13 19:01:01 +00:00
Ulf Lamping a656768170 implement a way to add menu items to the "Analyze" menu
svn path=/trunk/; revision=15788
2005-09-13 18:45:52 +00:00
Ulf Lamping f2712da215 don't crash with a NULL pointer exception, if "do not decode as" is used
svn path=/trunk/; revision=15787
2005-09-13 18:42:12 +00:00
Ulf Lamping 7cc57ec40c add to the protocol item a short description what a "Short Frame" is
svn path=/trunk/; revision=15786
2005-09-13 18:40:58 +00:00
Ulf Lamping 1c6e71542d increment index of IID's in COL_INFO
svn path=/trunk/; revision=15785
2005-09-13 18:39:26 +00:00
Ulf Lamping 5ef6619fc1 use the same name for menu item and dialog box title, use the right capitalization for both
svn path=/trunk/; revision=15784
2005-09-13 18:38:19 +00:00
Anders Broman 542a623f34 Get application ID from the packet.
svn path=/trunk/; revision=15783
2005-09-13 16:56:28 +00:00
Anders Broman cffb22628b From Peter Johansson
PATH contents one had before starting the  build, that PATH is added to the new PATH variable 5 additional times 
instead of 1.
I have made changes (supplied) to config.nmake that takes care of this 
problem.

svn path=/trunk/; revision=15782
2005-09-13 16:48:13 +00:00
Ulf Lamping de0d7959ca don't simply remove the expert_info output at BoundsError, but add the comment from Guy why this (usually) isn't a bug (because of a short snapshot length).
svn path=/trunk/; revision=15781
2005-09-13 08:03:16 +00:00
Anders Broman b1d165da12 From Ankur Aggarwal:
First phase of testing revealed the following errors

svn path=/trunk/; revision=15780
2005-09-13 05:05:19 +00:00
Anders Broman 3048e7b7d4 From Stefan Metzmacher
Some updates to the winsrepl-dssector to add COL_INFO strings...

svn path=/trunk/; revision=15779
2005-09-13 05:00:17 +00:00
Anders Broman 06c1f4ad6c From Alejandro Vaquero.
svn path=/trunk/; revision=15778
2005-09-13 04:53:36 +00:00
Anders Broman c0657dce3a From Piros Lucian:
A new dissector - cimd dissector. CIMD stands for Computer Interface to Message Distribution and it's used to transfer short messages between applications and Nokia Short Message Service Center.

svn path=/trunk/; revision=15777
2005-09-13 04:51:49 +00:00
Guy Harris aba53424dd Move the definition of GNUC_FORMAT_CHECK() to its own header, use it in
column-utils.h, and add it to expert.h, so we check the arguments to
"expert_add_info_format()", at least if the format argument is a
constant string.

Fix some more calls to "expert_add_info_format()" to pass it a format
string.

Don't record BoundsError exceptions as expert events - they merely
reflect a capture done with a snapshot length too short to capture all
of the packet (any case where it's caused by something else is a bug).

svn path=/trunk/; revision=15776
2005-09-13 04:00:47 +00:00
Guy Harris fcc31e309f Don't pass an arbitrary string from a packet to a routine expecting a
format string - the arbitrary string might contain "%" characters, so
the routine might then fetch arbitrary junk and try to use it as, for
example, a string pointer.

svn path=/trunk/; revision=15775
2005-09-13 02:39:37 +00:00
Guy Harris 973920e91d Convert some more "tvb_memcpy()"s fetching IPv4 and IPv6 addresses to
calls to "tvb_get_ipv4()" and "tvb_get_ipv6()".

Fix a call in the BGP dissector to properly fetch an IEEE floating-point
number.

Update some I-D info.

svn path=/trunk/; revision=15774
2005-09-13 00:50:43 +00:00
Ulf Lamping 9e5a98abae When jumping (e.g. using menu item Go/Go to Packet...) to a new packet which is currently not displayed, this newly selected packet will become the first in the packet list.
This is inconvenient, as most of the time (at least) I'm interested not only in the packets behind the newly selected one, but also to have some history *before* it.

So this change will scroll the packet list to have the selected packet after the first third of the packet list.

This change won't take effect if the new packet is already visible (only the selection is changed) or it's near the beginning or end of the packet list (so the whole beginning/end of the list is shown).

svn path=/trunk/; revision=15772
2005-09-12 20:10:44 +00:00
Ulf Lamping ff50ef8490 add number of defragmented bytes to the expert info output
svn path=/trunk/; revision=15771
2005-09-12 20:02:58 +00:00
Guy Harris 75b9062c44 Get rid of "dtd_grammar.out" on a "make distclean".
Get rid of all the Flex-generated (and Lemon-generated) files on a
"nmake -f Makefile.nmake distclean".

svn path=/trunk/; revision=15770
2005-09-12 19:50:45 +00:00
Guy Harris 019ed9005f Add a header file to declare routines defined in lexer and used in
parser, or vice versa.

svn path=/trunk/; revision=15769
2005-09-12 19:32:35 +00:00
Guy Harris 3db317ca2b Again, "g_strdown()" doesn't return a value in GLib 1.2[.x].
svn path=/trunk/; revision=15768
2005-09-12 15:54:20 +00:00
Guy Harris 45e8a4c579 "g_strdown()" doesn't return a value in GLib 1.2[.x]; don't depend on it
doing so.

svn path=/trunk/; revision=15767
2005-09-12 07:55:14 +00:00
Guy Harris 346e5e211c The previous checkin for packet-isup.c was accidentally checked in along
with some unrelated changes; it got rid of some calls to get IPv4/IPv6
addresses and add them to the protocol tree, replacing them with
proto_tree_add_item() calls, and fixed up the length of one protocol
tree item.

Note that we have (at least) three count 'em three different routines
for dissecting/displaying NSAPs (there might be more - I might have
missed some), and suggest that we might want to reduce that to one.

Update the URL for ICP values for IPv{4,6} addresses inside NSAPs.

Fix the offset in the call to add the IPv6 address part of an NSAP
containing such an address, and the length in the call adding the DSP
for an NSAP containing an IPv4 address.

Fix up indentation a bit.

svn path=/trunk/; revision=15766
2005-09-12 07:44:11 +00:00
Michael Tüxen fec9c0ec2b In now supports also:
- http://www.ietf.org/internet-drafts/draft-ietf-tsvwg-sctpimpguide-15.txt
  - http://www.ietf.org/internet-drafts/draft-ietf-tsvwg-addip-sctp-13.txt
  - http://www.ietf.org/internet-drafts/draft-stewart-sctp-pktdrprep-02.txt
  - http://www.ietf.org/internet-drafts/draft-ietf-tsvwg-sctp-auth-01.txt
  - http://www.ietf.org/internet-drafts/draft-ladha-sctp-nonce-02.txt


svn path=/trunk/; revision=15765
2005-09-12 06:24:02 +00:00
Guy Harris 39fd819fb4 Don't collide with the "regular" IPv6 defintions in at least some
platforms in ipv6-utils.h.

svn path=/trunk/; revision=15764
2005-09-12 06:21:35 +00:00
Ulf Lamping f9b1686883 fix fault defragmentation the same way as in the request/response path
Unfortunately, I don't have a capture file to test this...

svn path=/trunk/; revision=15763
2005-09-12 00:29:19 +00:00
Ulf Lamping 55c3e85a95 fix reassembling problem I've introduced yesterday, by using fragment_add_seq_next() function instead of fragment_add()
in addition, I had to implement fragment_get_reassembled() in addition to fragment_get(), which works with reassembled_table

svn path=/trunk/; revision=15762
2005-09-12 00:16:57 +00:00
Guy Harris aee0e1600b Fix a typo.
svn path=/trunk/; revision=15761
2005-09-11 22:31:36 +00:00
Guy Harris d8873511a7 Frame numbers are unsigned, and they start at 1; 0 is what's used for
"unknown" for frame numbers.  Note that in epan/frame_data.h, and make
the frame number in experts unsigned, and use 0 for "unknown", and
display it as an unsigned number - and, if it's 0, don't display it at
all.

Fix the signature of "expert_dlg_draw()" to match what a tap's draw
routine's signature is expected to be.

svn path=/trunk/; revision=15760
2005-09-11 22:25:33 +00:00
Guy Harris 51875708f2 Add some braces to squelch a compiler warning.
Fix up indentation.

svn path=/trunk/; revision=15759
2005-09-11 22:19:41 +00:00
Guy Harris 25c4bc9379 Replace tvb_memcpy() calls that extract IPv4 addresses into a guint32,
and that extract IPv6 addresses into a "struct e_in6_addr", with
tvb_get_ipv4() and tvb_get_ipv6() calls - except for some that we
remove, by using proto_tree_add_item(), rather than replacing.

Have epan/tvbuff.h include epan/ipv6-utils.h, to define "struct
e_in6_addr" (not necessary to declare the tvbuff routines, but including
it there means "struct e_in6_addr" is guaranteed to be defined before
those declarations, so we don't get compiler complaints if we define it
*after* those declarations).

svn path=/trunk/; revision=15758
2005-09-11 21:25:37 +00:00
Ulf Lamping 0bb7a6e003 rename fragment_add_dcerpc -> fragment_add_dcerpc_dg to avoid confusion a bit,
as connection oriented (cn) and connectionless (dg) DCE/RPC uses different ways to handle defragmentation and this function is only used for dg

svn path=/trunk/; revision=15757
2005-09-11 21:10:26 +00:00
Anders Broman a665e35a38 Get rid of dependency on format-oid.h
svn path=/trunk/; revision=15756
2005-09-11 21:10:20 +00:00
Ulf Lamping 57d099a0c2 some things fixed, leftover from code cleanup (thanks to the buggy MSVC dependencies)
svn path=/trunk/; revision=15755
2005-09-11 17:15:00 +00:00
Ulf Lamping 642467ad5c I'm adding the "Expert Info" prototype now, as it seems to be in a state where others might have a look and probably already find it useful :-). Anyway, we can easily disable it at one or two places in the code if it get's in our way of a new release.
Please see: http://wiki.ethereal.com/Development/ExpertInfo for a complete overview of the intended feature and it's current state of implementation.

While I'm working on this, I've also added some more status result codes to the DCE/RPC and DCOM dissectors.

svn path=/trunk/; revision=15754
2005-09-11 16:55:34 +00:00
Guy Harris 266e1a3491 Add "tvb_get_ipv4()" and "tvb_get_ipv6()" addresses, to fetch IPv4 and
IPv6 addresses.  Use "tvb_get_ipv4()" in the WINS Replication dissector,
so that it gets the right answer on little-endian *AND* big-endian
machines.

svn path=/trunk/; revision=15753
2005-09-10 19:43:41 +00:00
Guy Harris c4b2c971fc In "dissect_sip()", return 0 if "dissect_sip_common()" returns a
negative value, so we reject the packet as "not SIP".

Add a "dissect_sip_tcp_heur()" that's heuristic - it'll return FALSE if
the first packet doesn't look like SIP, but once it's dissected one
packet it'll just treat subsequent SIP packets as continuations if they
don't look right.

Clean up indentation a bit.

svn path=/trunk/; revision=15752
2005-09-10 19:39:56 +00:00
Luis Ontanon e95f752afd propperly handle the errors when loading a file fails.
svn path=/trunk/; revision=15751
2005-09-10 18:59:02 +00:00
Luis Ontanon 67b92bc6ff don't use fgets() as MSVC does not implement it. use fgetc instead.
svn path=/trunk/; revision=15750
2005-09-10 18:46:03 +00:00
Ulf Lamping 78a5252c83 fix MSVC slash/backslash and other such problems, now getting:
dtd_preparse.obj : error LNK2001: Nichtaufgeloestes externes Symbol _fgetln

MSVC doesn't support fgetln!

svn path=/trunk/; revision=15749
2005-09-10 18:33:32 +00:00
Luis Ontanon c32307b90d Make sure lemon is built before trying to use it
svn path=/trunk/; revision=15748
2005-09-10 18:00:28 +00:00
Luis Ontanon d71bd835bc fix the dtd_grammar.c rule
svn path=/trunk/; revision=15747
2005-09-10 17:55:16 +00:00
Luis Ontanon 022d9e23c5 nmake does not have the $^ macro
svn path=/trunk/; revision=15746
2005-09-10 17:47:02 +00:00
Luis Ontanon 96326c0b86 the dtd parser (still missing the glue) and few fixes to packet-xml.c
svn path=/trunk/; revision=15745
2005-09-10 17:29:15 +00:00
Ulf Lamping 541fd750b8 fix DCE/RPC defragmentation, if both middle and last DCE/RPC fragments are in the same TCP desegmented data blob
reassemble.c:
I had to change the way the reassemble code works if the dissector is telling that more fragments *will* follow. In this case the reassemble code shouldn't try to reassemble already at that time ...

I've also changed the way if a fragment was already seen or not, as it's not enough to check for the frame number, in the scenario described above.

Unfortunately both changes *might* broke other protocols from reassemble properly. I've checked with excessive TCP desegmentation and it's still working without any changes :-)

packet-dcerpc.c:
use a tvb subset to limit the "end of bytes" processed in a single fragment dissect run, as each fragment has it's own DCE/RPC header (and isn't part of the stub data of the previous packet).

svn path=/trunk/; revision=15744
2005-09-10 15:11:21 +00:00
Ulf Lamping c20ffb9fd9 NSIS warning removed: the label "lbl_winpcap_dont_install" is currently unused
svn path=/trunk/; revision=15743
2005-09-09 21:04:19 +00:00
Anders Broman bb18a56bbd Dissect "nbs-9".
svn path=/trunk/; revision=15742
2005-09-09 19:46:57 +00:00
Anders Broman 4b07f6747e Add some 3GPP AVP:s
svn path=/trunk/; revision=15741
2005-09-09 16:19:51 +00:00