"Wireshark" rather than "WireShark" nonwithstanding.
Say we run on NT 4.0 rather than "NT" - I don't know whether we run on
NT 3.x (and 2000/2003/XP are really NT 5.x and Vista/2008 are really NT
6.x - that's why Microsoft are talking about "Windows 7" as the next big
release).
In the capture-privileges paragraph, note that it's dumpcap that needs
to run as root, and suggest not only that Wireshark shouldn't be set-UID
root, but that it shouldn't even be run as root, and that the same
applies to TShark.
Update "How to Report a Bug" to reflect that we're telling people to
report bugs on Bugzilla, and that "wireshark -v"/"tshark -v" give almost
all the version information we want.
svn path=/trunk/; revision=25605
they have LF at the end of the line on UN*X and CR/LF on Windows;
hopefully this means that if a CR/LF version is checked in on Windows,
the CRs will be stripped so that they show up only when checked out on
Windows, not on UN*X.
svn path=/trunk/; revision=11400
work (or inferred to work - some lists were changed to "XXX and later",
on the assumption that later releases didn't break anything).
svn path=/trunk/; revision=9592
except that the 0x80 bit is turned on in the file version number field.
Turn that bit off before processing that field.
svn path=/trunk/; revision=9342
formats we can read; include vendor names.
We should be able to read TokenPeek captures, as well as captures from
the Windows versions of EtherPeek.
Don't list the version numbers for EtherPeek and TokenPeek - those are
file format version numbers, not program version numbers.
svn path=/trunk/; revision=4599
libpcap format, and say that it's also used by "other tools" (tcpdump
and Ethereal/Tethereal aren't the only tools that write captures in that
format).
Weaken the claim that we read Etherpeek files to say only that we read
Etherpeek versions 5, 6, and 7 for Macintosh, so people don't conclude
that we read Etherpeek-for-Windows captures (we don't).
svn path=/trunk/; revision=4337
formats we can read (and to put them in the order in which they're
mentioned in the man pages, to make it easier to make sure the lists are
the same).
svn path=/trunk/; revision=4330
pseudo_header.
Use generic "p2p_phdr" instead of "lapd_phdr". Modify toshiba.c and
packet-lapd.c to take that into account.
Add frame.p2p_dir, a filterable field, 0=sent, 1=recvd
Make p2p_dir available in packe_info, as I think it will be needed
in VJ COMP and UNCOMP dissection.
Rename WTAP_ENCAP_TR to WTAP_ENCAP_TOKEN_RING.
Mention pppd-log support in man page.
Mention atmsnoop in README.
svn path=/trunk/; revision=2455
examples of errors that generate core dumps, and suggest that a stack
trace from the debugger could be useful for *all* failures that produce
core dumps.
Note that the core dump file may be named "ethereal.core", and note that
"tethereal" rather than "ethereal" should be used in file names if it's
Tethereal that blew up.
svn path=/trunk/; revision=2368
a framework for the dissector; of the more than 400 NCP packet types, only
a handful are defined. But this dissector framework is much better than
the previous one.
svn path=/trunk/; revision=2173
editcap.
Expand the list of OSes on which Ethereal has (at least at one time)
been built and used.
Note that systems other than Solaris that use DLPI (e.g., HP-UX) may
also have "/dev" entries that can be made more widely readable and
writable to allow non-root users to capture packets.
Note that we can read "i4btrace" capture files.
Note that we now always do SNMP dissection, and that an external library
just allows us to do more sophisticated dissection.
svn path=/trunk/; revision=1470
Guy Harris