Patch for IPv6 dissector to support the ff:
- RFC 2460 sec 3, particularly Traffic Class field's 6-bit DSCP and 2-bit ECN
- RFC 2474 sec 3, copied implementation of ip.c to determine DSCP codepoints
- RFC 3168 sec 5, for ECN's ECT and CE bits
- changed the comment
svn path=/trunk/; revision=30957
- packet-bacapp.h eliminated and included in packet-bacapp.c
- dissection of recipient-list and client-cov-increment added
svn path=/trunk/; revision=30955
NetPerfMeter is an Open Source TCP/UDP/SCTP/DCCP network performance metering
application for Linux, FreeBSD and MacOS X. It can be downloaded here:
http://www.exp-math.uni-essen.de/~dreibh/netperfmeter/ . The protocol used by
this application for the transport of control and data is called NetPerfMeter
protocol. The attached patch is a dissector to decode its packets.
svn path=/trunk/; revision=30943
This patch adds support for PacketBB (RFC 5444) to Wireshark.
PacketBB is a generic message format for mesh networks.
Both OLSR version 2 and DYMO will use packetbb.
svn path=/trunk/; revision=30942
If the "Level Of Interest" referenced in the smb.trans2.FIND_FIRST/FIND_NEXT
requests is 262, wireshark is unable to decode properly (neither the request
nor the response).
svn path=/trunk/; revision=30923
Modified the open/close context tagging to include context tag number.
Modified the info column to show more specific information about certain
packets.
svn path=/trunk/; revision=30869
This enhancement implements dissector for Downstream DOCSIS (Data over Cable)
frames, embedded into MPEG packets and encapsulated into L2TPv3 over IP
(DEPI/D-MPT encapsulation). This type of encapsulation is used in Modular Cable
Modem Termination System (M-CMTS) architecture for head-end components that
comply with DOCSIS.
DEPI, the Downstream External PHY Interface, is the interface between the
M-CMTS Core and the EQAM. More specifically, it is an IP Tunnel between the MAC
and PHY in a Modular CMTS system.
L2TPv3 is described in RFC3931.
DOCSIS DEPI data packet transport mechanism is described CM-SP-DEPI-I03-060728
(Downstream External PHY Interface - CableLabs specification)
The format of MPEG packet carrying DOCSIS data is described in
CM-SP-DRFI-I07-081209 (Data-Over-Cable Service Interface Specifications -
CableLabs specification).
svn path=/trunk/; revision=30857
Since it was named Ethereal and up to today, Wireshark wrongly parses
the IPv4 header flags field:
* it considers it as a 4 bits wide field - according to RFC 791 its a 3 bits
wide field (first 3 bits of the 6th octect of the IPv4 header).
* if for example the DF bit is set, Wireshark displays the flag value as 0x04
(0100) when it should be 0x02 (010), idem for the MF flag.
Attached to this bug report, you can find a patch to fix the issue.
svn path=/trunk/; revision=30855
We've discovered a number of bugs in the 6LoWPAN dissector,
and have fixed them in the following patch. The fixed bugs include:
- Incorrect UDP Checksum calculation.
- Incorrect link-local prefix when decompressing IPHC headers.
- Incorrect parsing of the UDP port numbers when not 8-byte aligned.
- Overflow of the datagram offset field when reassembling fragmented packets.
svn path=/trunk/; revision=30840
The netflow implementation has a bug where the code exists to extract four
fields from a packet, however, the decoder for these fields has not been
registered in proto_register_netflow in the hf_register_info array.
The fix is to include decoders for the fields in the proto_register_netflow.
svn path=/trunk/; revision=30809
This patch set improves packet loss detection in for MPEG2 Transport Streams
(RFC 2250 / ISO/IEC 13818-1).
1. Improve loss detection by counting skipped TS frames (currently we only
detect a drop). (only store the info globally)
2. Introduce an analysis tree and record/count the info per TS frame.
svn path=/trunk/; revision=30789
opcode; an opcode of 0x0001 means PAUSE. Dissect the opcode field even
if it's not a PAUSE frame.
The second field of a PAUSE frame isn't the "quanta" field, it's the
pause_time field; it's in *units* of quanta.
Don't fetch fields until we need them (so we don't throw an exception if
they're missing until we actually look at them).
Clean up indentation.
svn path=/trunk/; revision=30785
I have built and tested a new Wireshark dissector which decodes a mirrored
packet that has an additional prepended UDP header attached to it. The packet
format was designed by Juniper Networks.
svn path=/trunk/; revision=30777
app, and DISSECTOR_ASSERT() throws an exception, but claims the problem
is a dissector bug, not a malformed packet. Presumably the error in
question is the result of a malformed packet, so throw
ReportedBoundsError to indicate that (it's not really the *right*
exception, but the right exception doesn't exist).
svn path=/trunk/; revision=30776
Fixes bugs in dissection of write attributes, read reporting configuration, and
configure reporting clusters in the ZigBee Cluster Library.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4113
svn path=/trunk/; revision=30731
RSVP extensions for G.709 Optical Transport Networks Control, RFC 4328
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4148
With some changes from me:
-(readme.developer:" Furthermore, 'display' field must be ORed with 'BASE_RANGE_STRING' (e.g. BASE_DEC|BASE_RANGE_STRING)."
- Prefix headerfields with hf_
- Remove check_col
svn path=/trunk/; revision=30727
This patch fixes the display filter for the prefix length of IPv6 external
route updates and the length calculation of the destination address in
IPv6 route updates.
svn path=/trunk/; revision=30703
Add the missing ndmp v4 messages, namely the:
NDMP_CONFIG_GET_EXT_LIST
NDMP_CONFIG_SET_EXT_LIST
This may serve as the 1st step into actual extensions (Snapvault etc)
dissector implementation.
svn path=/trunk/; revision=30684
The primary header in bundle protocol contains some offset values(destination
scheme offset, destination ssp offset, source scheme offset, source ssp offset,
etc). These are the offsets within the dictionary if the length of the
dictionary length is greater than 0. But if the dictionary length is 0, then
these offset refer to node number and service number respectively(according to
compressed bundle header encoding). For example if destination scheme offset is
2 and the destination ssp offset is 1, then the destination
EID(<node_number>.<service_number>) is 2.1.
Currently the dtn dissector will consider these offsets to be actual offsets in
the dictionary even if the dictionary length is 0. So the values for the
EID's(destination, source, report, custodian) and their schemes are junk
values. For example if the destination scheme offset is 2 and the destination
ssp offset is 1 and the dictionary length is 0(which means the dictionary is
empty), then the destination scheme is 2 bytes after the beginning of the
metadata block(field after dictionary) and destination is 1 byte after the
beginning of the metadata block.
svn path=/trunk/; revision=30682
display_metadata_block() return 0 (meaning they failed to decode something and
the offset was not incremented) rather than checking if the resulting offset
is 0.
This fixes the infinite loop reported in:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4156
svn path=/trunk/; revision=30672
The 802.3at Power Via MDI TLV dissector is incomplete as it does not decode the
last three bytes. I have attached a patch that decodes the type/source/priority,
PD requested power value, and PSE allocated power value fields.
svn path=/trunk/; revision=30662
