Commit graph

6466 commits

Author SHA1 Message Date
Gerald Combs
ae2198ea4e Add references to 'tethereal -D' in the '-i' section.
svn path=/trunk/; revision=6551
2002-11-03 17:38:27 +00:00
Ronnie Sahlberg
e91ed1701a Fix for Netlogon function 0x22 which used the wrong pointer type.
Additional cleanups added when no longer nessecary to pass through two levels of pointers to get to the DOMAIN_CONTROLLER_INFO structure in the code.

svn path=/trunk/; revision=6550
2002-11-03 04:39:22 +00:00
Guy Harris
18fe4b214c Register the ett_ values.
svn path=/trunk/; revision=6549
2002-11-02 22:55:49 +00:00
Ronnie Sahlberg
b1c157b995 From Jochen Friedrich : Support for the RPL (Remote Program Load) protocol implemented on some NIC bootproms.
svn path=/trunk/; revision=6548
2002-11-02 22:23:16 +00:00
Ronnie Sahlberg
d5e3008fff From Jean-Baptiste Marchand update the proto_tree_add_ for UUIDs in the
dcerpc layer (and the subdissectors using dissect_ndr_uuid_t()) so that
it is possible to use display filters on these items.

svn path=/trunk/; revision=6547
2002-11-02 22:14:21 +00:00
Ronnie Sahlberg
ee9c00c024 Fixed small bug in TCP seq/ack analysis. Forgot to check a pointer for NULL which caused crashes sometimes.
svn path=/trunk/; revision=6546
2002-11-02 22:00:17 +00:00
Guy Harris
a3cbe709a0 Handle the 3 bytes of padding before the FDDI frame data in iptrace
captures.

Use #defines rather than magic numbers for various header sizes, and put
in a comment explaining the header formats.

svn path=/trunk/; revision=6545
2002-11-01 20:43:11 +00:00
Gilbert Ramirez
ddc7b4597b Fix a problem when using the same field more than once in a display
filter, as in "ip.src == x.x.x.x || ip.src == y.y.y.y". My previous
change to allow filtering on multiple fields of the same name moved
some code into the wrong block within the function, causing the error.

svn path=/trunk/; revision=6544
2002-11-01 17:37:25 +00:00
Ronnie Sahlberg
707f06ccc2 Three more things for TCP seq/ack analysis to check for and flag:
ZeroWindow:   ZeroWindow segments are detected and flagged
  ZeroWindowProbe: detected and flagged
  ZeroWindowViolation:  attempts to write >1 byte of data to a zerowindow is detected and flagged.

svn path=/trunk/; revision=6543
2002-11-01 11:05:37 +00:00
Ronnie Sahlberg
f4ecf268aa Update to TCP seq/ack analysis: tcp seq/ack analysis should now be able to
detect suspected duplicate ACKs.

svn path=/trunk/; revision=6542
2002-11-01 10:25:35 +00:00
Guy Harris
910de52a04 Note that "tethereal-tap-register.c" is built by the Bash script
"make-tapreg-dotc" from "tap-*.c", using grep and sed.

svn path=/trunk/; revision=6541
2002-11-01 10:02:18 +00:00
Guy Harris
ad9ec1af37 Cygwin doesn't necessarily come with an "sh.exe", so use "$(SH)" rather
than "sh" to run a Bourne-compatible shell in "Makefile.nmake", and
define "SH" to be "bash" in "config.nmake".

svn path=/trunk/; revision=6540
2002-11-01 10:01:21 +00:00
Guy Harris
749d00f331 Put in a portability note telling people to use "strchr()" and
"strrchr()", not "index()" and "rindex()"; MSVC++ doesn't declare
"index()" or "rindex()" if you include <string.h>, and they're
non-standard routines (the ANSI C names for those functions are
"strchr()" and "strrchr()").

Add a bit more to the other portability note on the topic of
non-standard vs. ANSI standard functions.

svn path=/trunk/; revision=6539
2002-11-01 09:41:36 +00:00
Guy Harris
d24c2bc5b9 Use "strchr()", not "index()"; MSVC++ doesn't declare "index()" or
"rindex()" if you include <string.h>, and they're non-standard routines
(the ANSI C names for those functions are "strchr()" and "strrchr()").

svn path=/trunk/; revision=6538
2002-11-01 09:40:23 +00:00
Guy Harris
205d13ca35 Get rid of some trailing blanks in strings.
svn path=/trunk/; revision=6537
2002-11-01 08:21:57 +00:00
Guy Harris
e601f03448 Fix up the handling of WAN captures somewhat, based on looking at a
bunch of those captures.

svn path=/trunk/; revision=6536
2002-11-01 08:18:36 +00:00
Guy Harris
3a3a343566 Remove a newline from a string being put into the protocol tree.
svn path=/trunk/; revision=6535
2002-11-01 08:17:03 +00:00
Guy Harris
4169d3000e Don't bother putting the direction into the ISDN part of the protocol
tree - it's already in there as part of the frame header.

svn path=/trunk/; revision=6534
2002-11-01 05:39:36 +00:00
Guy Harris
1522cd2994 From Fritz Budiyanto: the command in the Packet Transfer Command IE is
one byte, so fetch it with "tvb_get_guint8()", not "tvb_get_ntohl()".

Put in the location in the GPRS standard where that's defined, while
we're at it.

svn path=/trunk/; revision=6533
2002-11-01 05:30:48 +00:00
Ronnie Sahlberg
cdb4e6929c New tap extension for tethereal : ProtocolHierarchyStatistics.
Similar to what is available on ethereal:/Tools/ProtocolHierarchyStatistics
but this one can handle ALL protocols that tethereal has dissectors for.

Maybe a gtk/gtk2 version of this should replace the existing one in ethereal?


Try -z io,phs   or -z io,phs,<filter>  to test it.

svn path=/trunk/; revision=6532
2002-11-01 05:29:36 +00:00
Ronnie Sahlberg
dcc95e010f New tap for tethereal: io statistics that provides frames/bytes counts for frames matching user specified filters.
Try it with
-z io,stat,1,nfs,smb,arp
on a capture containing both nfs, cifs and arp traffic.

svn path=/trunk/; revision=6531
2002-11-01 01:49:40 +00:00
Guy Harris
f0a7b04a05 Convert the "maj_vers" field of a REC_VERS record to host byte order
before passing it to "skip_header_records()".

svn path=/trunk/; revision=6530
2002-11-01 01:49:39 +00:00
Ronnie Sahlberg
42e0065552 Fix for small bug that crashed tethereal if a tap filter was applied and tethereal forgot to tell epan_dissect_new() to build a tree
svn path=/trunk/; revision=6529
2002-11-01 01:11:59 +00:00
Ronnie Sahlberg
422596a0fe Updated all remaining ONC-RPC dissectors to pass the procedure name value_string in the call to prc_init_proc_table()
svn path=/trunk/; revision=6528
2002-11-01 00:48:39 +00:00
Tim Potter
f64906c9b3 Added support for a new DCERPC pipe supported by Windows 2000. It has
something to do with Active Directory and has been named LSA_DS by the
Samba Team.

svn path=/trunk/; revision=6527
2002-11-01 00:42:00 +00:00
Ronnie Sahlberg
f8e79ffbdc Update of my email address
svn path=/trunk/; revision=6526
2002-10-31 23:23:20 +00:00
Guy Harris
8442ad9a32 From Ronnie Sahlberg: have a registration interface for tap listeners,
and generate the table of stuff to register from tap source files, so
Tethereal doesn't need to know what tap listeners exist.

Get rid of "tap-xxx.h" files, as they're now empty.

Add "tethereal-tap-register.c" to the .cvsignore file, as it's a new
generated file.

Update "Makefile.nmake" to generate "tethereal-tap-register.c".

Clean up "Makefile.am" and "Makefile.nmake" a bit.

svn path=/trunk/; revision=6525
2002-10-31 22:16:01 +00:00
Guy Harris
05c9a97091 From Chris Waters: put the "wlan.fc.fromds" and "wlan.fc.tods" fields
into the protocol tree.

svn path=/trunk/; revision=6524
2002-10-31 20:46:00 +00:00
Guy Harris
c2d40f72b9 Don't reset the packet count if we longjmp out of the capture loop, as
that causes us to report that no packets were captured if you ^C out of
a capture.

svn path=/trunk/; revision=6523
2002-10-31 20:24:41 +00:00
Guy Harris
231908c8a5 To determine the direction of the traffic, use "pinfo->p2p_dir", rather
than the p2p pseudo-header's "sent" field, in the LAPD dissector (the
p2p pseudo-header isn't used for ISDN).

Do something similar for the V.120 dissector (which currently will only
be used in ISDN captures, but this makes it possible for it to handle
other captures as well).

svn path=/trunk/; revision=6522
2002-10-31 07:43:10 +00:00
Guy Harris
56f644145e Discard the WTAP_ENCAP_LAPD encapsulation type in favor of a
WTAP_ENCAP_ISDN encapsulation type, which includes a pseudo-header
giving the direction (user-to-network or network-to-user) and the
channel number.

Add a new circuit type, using the ISDN channel number as the circuit ID.

Add an ISDN dissector to put the direction and channel number into the
protocol tree and to call the appropriate dissector for the payload
based on the channel (LAPD for the D channel; V.120, PPP, or data for B
channels, based on some heuristics).

svn path=/trunk/; revision=6521
2002-10-31 07:12:42 +00:00
Guy Harris
663bc2174e Move the stuff to save, recompute, and restore "can_desegment" out of
"try_circuit_dissector()" and "try_conversation_dissector()", as both fo
them call "call_dissector()" and "call_dissector()" now does that stuff
itself.

svn path=/trunk/; revision=6520
2002-10-29 07:22:55 +00:00
Guy Harris
f806f64b71 Some fields that are treated as 16-bit or 8-bit fields followed by
unknown bytes might actually be 32-bit fields.

The field after the upper 32 bits of the time stamp of the capture start
appears to be the speed of the network, in bits/second.

Put in a field for the rest of the file header, as a bunch of 32-bit
values (most fields are 32 bits, and all of them might be, in that
header), for use when reverse-engineering.

At least in version 002.x of NetXRay-format captures, WAN captures might
be ISDN captures; treat all WAN version 002.x captures as ISDN captures
for now, until we see some captures where that's wrong (and thus stand a
chance of figuring out where in the file header it indicates what type
of capture it is).

svn path=/trunk/; revision=6519
2002-10-29 06:12:35 +00:00
Guy Harris
d958ee1a72 Don't return 0 from "call_dissector_work()" if the packet was dissected
by the dissector we handed off to, even if the tvbuff we handed them was
empty.

svn path=/trunk/; revision=6518
2002-10-29 05:15:24 +00:00
Guy Harris
0b8419fd5b Note why we're including <sys/socket.h> and <winsock2.h> in places where
we're including them to get AF_ values.

Shuffle the order of those includes in "inet_pton.c" to match the order
in "inet_ntop.c".

Include <winsock2.h> in "resolv.c" and "to_str.c" so that we get AF_
values from it - including AF_INET6 - if they exist, as we want to have
everybody who uses AF_INET6 get the same value.

svn path=/trunk/; revision=6517
2002-10-29 00:28:11 +00:00
Guy Harris
a7744b697f Hoist the bulk of the stuff involved in calling a dissector through a
handle into a routine "call_dissector_work()", and have
"dissector_try_port()" and "call_dissector()" use that routine (which
means that "call_dissector()" now saves and restores
"pinfo->can_desegment").

svn path=/trunk/; revision=6516
2002-10-28 23:04:15 +00:00
Guy Harris
522ef0a1b7 The LSA_REFERENCED_DOMAIN_LIST pointer in a LookupSIDs2 reply appears to
be a UNIQUE pointer, at least from one capture I'e seen, just as it is
in a LookupSIDs reply; make it so.

svn path=/trunk/; revision=6515
2002-10-28 20:12:30 +00:00
Olivier Abad
cbe515ceee GtkCList to GtkTreeView conversion in color_dlg.c
svn path=/trunk/; revision=6514
2002-10-27 19:32:25 +00:00
Olivier Abad
e0926b556a Update Debian packaging files. Ethereal is now split in 4 packages :
ethereal-common, ethereal, tethereal, ethereal-dev

svn path=/trunk/; revision=6513
2002-10-26 08:56:39 +00:00
Guy Harris
45ed05190c Fix up some more byte-string displays.
svn path=/trunk/; revision=6512
2002-10-26 06:30:41 +00:00
Guy Harris
54117349d4 Show the elements of authentication triplets as byte strings (as that's
what they are - well, bit strings, really, but...).  Doing so also fixes
a bug, as "decode_gtp_auth_tri()" was copying 16 bytes to an array that
was 8 bytes long....

Do the same for byte-string elements of a quintuplet - and show as byte
strings some elements that weren't being shown at all.

svn path=/trunk/; revision=6511
2002-10-26 06:13:33 +00:00
Guy Harris
daa0dd9f1a Count ICMPv6 packets as ICMP when capturing.
Check the next header type - properly handling extension headers - in
"capture_ipv6()".

Get rid of the count of IPv6 packets - we break that down in
"capture_ipv6()" now.

Fix a typo.

svn path=/trunk/; revision=6510
2002-10-25 23:23:28 +00:00
Guy Harris
86af47dd68 From Didier Gautheron: handle the padding in AFP login packets that put
the password on an even boundary.

svn path=/trunk/; revision=6509
2002-10-25 21:59:47 +00:00
Guy Harris
a9b42ee36c That was a rather unique interpretation of "correctly" I came up with
there.  Try a different interpretation.

svn path=/trunk/; revision=6508
2002-10-25 21:13:38 +00:00
Guy Harris
bf3b1dbd69 Correctly handle the "no IAC found" case in "telnet_sub_option()".
Handle the "unknown command" case in "telnet_command()".

svn path=/trunk/; revision=6507
2002-10-25 21:09:36 +00:00
Guy Harris
b3b2464202 Fix a typo and fix alignment.
svn path=/trunk/; revision=6506
2002-10-25 04:36:45 +00:00
Guy Harris
354f955644 Sometimes a cigar is just a cigar, err, umm, sometimes a KRB5 blob is
just a Kerberos message; we can distinguish that from the other two
cases, so we do so, and handle all three cases.

svn path=/trunk/; revision=6505
2002-10-25 04:22:26 +00:00
Guy Harris
9b2845f8ea Fix the offset for the flags in an NTLMSSP_AUTH message.
svn path=/trunk/; revision=6504
2002-10-25 03:40:13 +00:00
Guy Harris
72d59f0596 The versions of UCD SNMP that we now support all install
<ucd-snmp/version.h>, so get rid of the stuff to check for its presence
and handle its absence.

svn path=/trunk/; revision=6503
2002-10-25 03:13:11 +00:00
Guy Harris
00b3eed033 From Ronnie Sahlberg: dissect the LookupHandleFree call.
svn path=/trunk/; revision=6502
2002-10-25 01:16:02 +00:00