Currently, for pcapng files, if all of the IDBs we've seen *so far* are
the same, we report it as the file's encapsulation type; however, we may
see IDBs of a different type in the future, so don't check for
per-packet encapsulation before counting packets of the encapsulation
type.
Change-Id: I617ddcf2963aa16e7ba58855b3e5bf326ab7dc32
Reviewed-on: https://code.wireshark.org/review/15808
Reviewed-by: Guy Harris <guy@alum.mit.edu>
g_array_sized_new() sets the amount of *space allocated for* the array,
but doesn't actually set its *length*.
Change-Id: Ia7deab34c758c88910dfb0e246a6903301e68029
Reviewed-on: https://code.wireshark.org/review/15806
Reviewed-by: Guy Harris <guy@alum.mit.edu>
When entering a loop with check for minimum length, don't stick
to the pattern of checking length first thing.
Change-Id: I28c414108efa5499dbacd8527b2c3e654e49e808
Reviewed-on: https://code.wireshark.org/review/15795
Reviewed-by: Anders Broman <a.broman58@gmail.com>
IDBs can occur anywhere in the file, so if we see an interface ID bigger
than the number of IDBs we've see, re-fetch the interface information,
update the IDB count, and grow the packet count array as necessary.
Get the information strings for interfaces after reading the entire
file; we don't need them until then.
Change-Id: Ib6096e481e321de485710d14eadf7b5232bf0be7
Reviewed-on: https://code.wireshark.org/review/15797
Reviewed-by: Guy Harris <guy@alum.mit.edu>
The code tries to show a file handle when the file is relative
to it, but doesn't actually make that determination. Extract the
relevant bit and use that to flag the relative file.
Change-Id: I7259c8843dc388b9dda96a73399a6da5575d3f5e
Reviewed-on: https://code.wireshark.org/review/15789
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Change-Id: I9595abf882adb821fd3c08532afba1b7e20412fe
Reviewed-on: https://code.wireshark.org/review/15788
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Set they to zeros at startup like other fields.
Change-Id: I820e7a0ce8fad5726448cb83f85235ecf578d77d
Reviewed-on: https://code.wireshark.org/review/15792
Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Tested-by: Michal Labedzki <michal.labedzki@tieto.com>
Text over Logcat is in real in Unicode.
ASCII does not display it correctly.
Change-Id: I998dad1ee50c4b00b874a1f197f6e465fadd3e38
Reviewed-on: https://code.wireshark.org/review/15791
Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
We use it when printing *other* seconds-and-fraction values, as we're
just using %f, so we should use it consistently. If you don't want
commas as decimal separators, you presumably don't want them anywhere;
if you want to standardize the way numbers are shown, set the locale to
the C locale.
This addresses one of the two problems mentioned in bug 12500; there may
be other places in the Wireshark suite where we should use the locale's
decimal separator in times.
Change-Id: I41f1c44d12ebf0f46ff678c977a955d09831b0cf
Ping-Bug: 12500
Reviewed-on: https://code.wireshark.org/review/15787
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Remove the "-git" version extra default in CMakeLists.txt and
configure.ac, otherwise we end up with wireshark-2.1.0-git.tar.bz2,
Wireshark-win64-2.1.0-git.exe, etc.
Change-Id: I89b9beaa87ac475950e24a3111cf09e878a33ff7
Reviewed-on: https://code.wireshark.org/review/15784
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Many of our AsciiDoc "macros" are simple string replacements. Start
converting them to attributes.
Update the release notes.
Change-Id: I23d9ffd311f13a34c16cde3b4898b7f7bb8ba638
Reviewed-on: https://code.wireshark.org/review/15778
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
ERO subobjects have subobjects 0..127, while RRO have subobjects
0..255. Make this distinction when retreiving the subobject ID.
See RFC 3936, section 2.3.1.
Change-Id: Iae061c259c59b1cf585ce99d02dd0f6ca09a49c3
Reviewed-on: https://code.wireshark.org/review/15772
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Don't try to add expert items for size < 1 when this code isn't
executed for size == 0. (note: size is unsigned)
Change-Id: Ieb3d2593d4bb5f175ac368ef38571511b4f56f25
Reviewed-on: https://code.wireshark.org/review/15774
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Prefix operators are supposed to be more efficient with iterators,
so lets use them instead of postfix operators.
Change-Id: I3090e4954c5cb67db47c88e2874b1a8ac52aa2cd
Reviewed-on: https://code.wireshark.org/review/15546
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Qt and GTK+ can have wildly different notions about the top-left
position of the main window, particularly in multiple-screen
configurations. For example, on OS X with the following monitor
arrangment:
g .---------.
| |
| |
q--------.| |
| |`---------'
| |
`--------'
GTK+ positions windows relative to 'g' and Qt positions windows relative
to 'q'. As a result it's easy for one UI to clobber the settings of the
other.
Split the geometry_main_x and geometry_main_y recent settings into Qt
and GTK+ versions.
In the Qt UI, try moving the main window onscreen before falling back to
the default geometry. This keeps us from losing our size settings.
Add a link to a Qt geometry bug.
Change-Id: If7ae0dcc1719e646299ee3bbf1c88743f655c9a0
Ping-Bug: 12389
Reviewed-on: https://code.wireshark.org/review/15775
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
The data is not applied anywhere, just stored. The first Section Header block
is still the only one that is used to read a pcapng file.
Change-Id: If9546401101d2fe79b2325bacbd597b92127e86e
Reviewed-on: https://code.wireshark.org/review/15705
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
That way you get dropdown suggestions for filter completion.
Change-Id: I2b9d417ca50559ffdc8bd3f7f0e1bbc185c1384d
Reviewed-on: https://code.wireshark.org/review/15592
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
The expert info refers to encoding_id not being zero. So then
test for it.
Change-Id: I6692f0b6ac0275328bc84741d9ded094bdf25e31
Reviewed-on: https://code.wireshark.org/review/15769
Reviewed-by: Anders Broman <a.broman58@gmail.com>
... at least for files for which have file extensions, including the gzip'd
versions of these files.
Add .pkt (Savvius) file extensions to our freedesktop.org registrations.
Change-Id: I0fb72909a1e9e3073451de06a64503fcfc6b57ed
Reviewed-on: https://code.wireshark.org/review/15694
Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>
In the Capture Interfaces dialog, make sure we have exactly one of a
"not applicable" dash or a checkbox. Otherwise if your interface falsely
reports that it supports monitor mode you might end up with both.
Change-Id: I9b256f1ef0e8ff32626e7f2b526130f3c110d142
Reviewed-on: https://code.wireshark.org/review/15761
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Fix a bug in proto_tree_set_uint64() which caused fields to be sign extended.
(This only showed up when a non-zero bitmask was present.)
Change-Id: Ibcc986e3d42f97348966ea66c2ae9fca73b09992
Reviewed-on: https://code.wireshark.org/review/15764
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
This check only works on the GTK UI's "Details" window. And it
only can check version numbers. So there's no way for this code to
be able to differentiate Npcap from WinPcap. And Npcap uses a very
small version like "0.07", which makes itself not welcomed by this
checking code.
Change-Id: I861e9decd123e7d30547789c0488043616b17032
Reviewed-on: https://code.wireshark.org/review/15304
Reviewed-by: Yang Luo <hsluoyz@gmail.com>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Dissector has always been able to cope with unknown record types so pass them
through (and call the data dissector from the ERF dissector in this case).
Previously was stopping processing on the first unrecognized record which is
very unhelpful for otherwise valid files that have new types mixed in.
Remove ERF type check altogether from open heuristic as ERF type could be past
48 in future and with more extension headers bit any byte value could be valid.
Also allow setting ERF_RECORDS_TO_CHECK to 0 to force skipping the heuristic.
Change-Id: I8331eef30ba2e949564f418b3100bd73b8f58116
Reviewed-on: https://code.wireshark.org/review/15361
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Make sure audio_stream_ is non-NULL before we try to use it. Delete
audio_stream_ more gracefully and add a note about mutexes on OS X and
Windows.
Bug: 12166
Change-Id: I12e76c49e631bc1de813c5c7d82c7d928c71237e
Reviewed-on: https://code.wireshark.org/review/15759
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Also make it use ws_inet_ntop6() (rather than implementing the string
conversion ourselves).
Remove ip6_to_str_buf_len().
Change-Id: I1eff3a8941e00987c2ff0c4dcfda13476af86191
Reviewed-on: https://code.wireshark.org/review/15692
Reviewed-by: João Valverde <j@v6e.pt>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Many AFS packets have empty payloads, and Wireshark marks these as
"Malformed Packet" even though they are normal.
Eliminate these false alarms by using tvb_reported_length_remaining when
adding items to the tree.
Change-Id: I4f134fef36b8bb7f99224f02fea9cf29117fb36a
Reviewed-on: https://code.wireshark.org/review/15754
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: Idcbe44bfe0730e42a30107414a7912a6aa50f411
Reviewed-on: https://code.wireshark.org/review/15757
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Add zoom in and zoom out actions. Changes only affect the X axis (the
spacing between the dashed lines).
Bug: 10693
Change-Id: I145e8501239f26e1be6135bffabdebec14f262c1
Reviewed-on: https://code.wireshark.org/review/15746
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Basically a copy/paste of the existing hf_ functionality, but looking for ei_ variables instead.
Change-Id: Ic9a34f6bd5dee895fc858bb9631c00271a86486b
Reviewed-on: https://code.wireshark.org/review/15717
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Put direction indication label and checkbox in a HBox to align vertical.
Change-Id: I2aa7846aef25e9f080349e9dfef5c191b8d323e3
Reviewed-on: https://code.wireshark.org/review/15742
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
Make the netfilter rules more sensible as described in bug 2482.
Switch to long names while we're here.
Ping-bug: 2482
Change-Id: I9e44c4ed88ed83ff1d7d478acea83fa0c2af5cac
Reviewed-on: https://code.wireshark.org/review/15701
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Done for performance improvements.
This could probably be done in checkAPIs.pl, but this was just
a quick manual check with grepping.
Change-Id: I91ff102cb528bb00fa2f65489de53890e7e46f2d
Reviewed-on: https://code.wireshark.org/review/15751
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
ei_dnp3_buffering_user_data_until_final_frame_is_received is #if 0ed
out in the code, so reciprocate that to the declaration/array.
Change-Id: I65dc6bb6f93f736e3adc4f4134f3bdca1f890bf9
Reviewed-on: https://code.wireshark.org/review/15749
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Use it for OPT_COMMENT in the SHB, as there may be ore than one instance
of OPT_COMMENT in an SHB.
Also, use wtap_optionblock_get_option_string for OPT_SHB_HARDWARE,
OPT_SHB_OS, and OPT_SHB_USERAPPL; they're specified as "only one
instance allowed".
Change-Id: I23ad87e41e40b7ae1155e96c0523a6f8caad5204
Reviewed-on: https://code.wireshark.org/review/15750
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Guy Harris