- Change apply / prepare / ... as filter to use the field's value, which
is now stored in fdata as well as cinfo. Now we don't have to reprocess
the entire packet list when using these features. This also prevents
the use of these features from overwriting custom column information.
(custom columns can now be used in apply / prepare ... as filter)
- Break col_expr and col_expr_val out into a struct that is included not only
in cinfo, but now also fdata.
- Have col_custom_set_fstr() quote FT_STRING & FT_STRINGZ when storing the
col_expr_val value (for filter creation).
svn path=/trunk/; revision=24511
"Invalid Path With Junction Present"
Fix get extended volume info to register correct name with NDS EID value. (added data type of 20 to extract string value)
Fix expert data for file handles to report file handle in expert data. (Added data type of 22 to extract bytes value)
svn path=/trunk/; revision=24505
around the protocol field, use the standard routines for prepending to
and appending to a column. That should fix bug 2311, as the standard
routines use g_strlcat(), and should also keep that code robust in the
face of changes to the way columns are implemented.
svn path=/trunk/; revision=24502
Essentially: A small cleanup of SVN 24479.
(Fortunately the 0.99.8 release does not have this issue).
Also: add some lines of (what appears to be) missing code.
svn path=/trunk/; revision=24500
people to type capital letters in filter expressions, which is a bit
rude. Furthermore, we're not using "Hilscher" in field names, we're
using "hilscher". This should fix bug 2310 - we check for various
illegal characters in filter names, including capital letters, and crash
if they're found.
svn path=/trunk/; revision=24496
This is a new dissector plugin for Hilscher analyzer frames.
These frames are generated by Hilscher analyzer products and are identified via
their unique source MAC address (this is a reserved MAC from Hilscher-range and
will never be used by another network device). Most likely these frames are
only generated on a virtual network interface or the generating device is
attached directly via patch cable to a real network interface, but not routed
through a network. The Ethernet-header (destination MAC, source MAC and
Length/Type) is not displayed in the protocol tree for these frames as this is
overhead-information which has no practical use in this case.
Note:
This is a heuristic Ethernet dissector which means it gets called for every
Ethernet frame. So as to not cause a performance hit for most Wireshark users
it has a preference which, by default, disables the dissector.
svn path=/trunk/; revision=24495
This is a dissector for the Parallel Redundancy Protocol (PRP) defined in chapter
6 of the IEC 62439.
PRP uses two independent networks in parallel and allows redundancy without
switchovers.
The protocol is sending Mac multicast messages with Ethertype 0x88fb. In
addition to that it adds to every Ethernet frame a 4 byte trailer before
the FCS. The trailer is detected by checking a size field and an identifier
which are part of the trailer. Therefore, if the last 4 bytes of a frame
match a correct trailer they get interpreted as a trailer, although it was
probably not a real one.
Note:
This is a post-dissector which means it gets called for every frame. So as
to not cause a performance hit for every Wireshark user (who may not even be
looking at Ethernet frames) it currently disables itself every time Wireshark
starts up. (There should be a better way to do this--maybe different Profiles
(as discussed on -dev recently) is the way to go.)
From me:
Put ETHERTYPE_PRP (not IANA registered) in etypes.h and packet-ethertype.c
svn path=/trunk/; revision=24493
