This is a major re-write of the WLCCP version 0xc1 dissector. It now is
able to dissect many more WLCCP message types and the TLVs that may be
included in a message. Placeholders are left for message types and
TLV types that we do not currently have enough data to engineer a
dissector.
svn path=/trunk/; revision=22330
The work is still incomplete (anything but strings and numbers appears as bytes) but I want others to start testing it.
TODO:
builders and decoders for:
- (ntp) timestamps
- addresses
- diameteruris
- diameteridentities
- ipfilterrules
- qosfilterrules
- mipregistrationrequests
svn path=/trunk/; revision=22318
TNEF is a Microsoft defined format for carrying additional information about a message (e.g. rich text formatting)
and generally appears as a "winmail.dat" attachment. Details are here:
http://msdn2.microsoft.com/en-us/library/ms530652.aspx
This is a basic dissector which handles the TNEF attributes and the MAPI properties (found in MAPIPROPS
TNEF attribute). It is not complete and requires further work to complete the dissection. However it will
dissect TNEF generated from Outlook (including messages with attachments).
It is registered under the appropriate BER OID (1.2.840.113556.3.10.1) for X.400 attachments and media
type ("application/ms-tnef") for MIME messages. For MIME messages, any content-transfer-encoding
(usually base64) needs to be removed before calling this dissector. There is a preference in the
MIME multipart dissector to do this.
svn path=/trunk/; revision=22312
body before passing it to a sub-dissector. The decoded content is added
as a new source, named with the filename or the content-type.
svn path=/trunk/; revision=22311
this module was never really finished and was therefore semi-useless.
disabled now since the change to samr broke it and the real fix to
unbreak it would be a substantial rewrite of it
(and adding a nice gui so one can see which sids are mapped...)
disabled it but did not remove it since i do think the module is
useful IF it is completed with a lot more operations.
svn path=/trunk/; revision=22271
add a fix for ack/seq tracking when the tcp is broken and sends a
non-zero ack field for SYN packets.
add a warning to the dissect pane that illustrates that these are broken
packets
svn path=/trunk/; revision=22267
Attached is a patch that fixes bug 1670 and related issues.
For the BACnet GetEventInformation-ACK request dissector:
1. Corrected BitString decoding for acknowledgedTransitions and eventEnable.
2. Corrected the ability to decode more than one event.
3. Grouped each item of the sequence using subtrees. Added more informative
text to Priority and Timestamp.
4. Corrected eventState to use BACnetEventState enumeration instead of
BACnetEventStateFilter.
svn path=/trunk/; revision=22262
First patch is only to reindent the packet-mip6 files.
Second patch adds PMIPv6 options (draft-ietf-netlmm-proxymip6-01.txt) and Mobile Node Identifier Option (RFC4283).
svn path=/trunk/; revision=22258
This patch adds an option to packet-ber to show unexpected tags/data as unknown BER. It also fixes some offset/length combinations when adding the error message to the tree.
svn path=/trunk/; revision=22244
It provides basic dissection of the text-based protocol, providing fields for filtering.
It also calls the multipart dissector for any MIME body that is found.
It includes very basic support for MIXER (RFC 2156) fields.
It also registers itself as "message/rfc822" in the media type table.
svn path=/trunk/; revision=22241
apparently broken and send 64 bytes for these fields.
mark these packets in the decode pane that the isns host is broken
change the calculation of offset to just increment it by tag size len
size and length one at the very end of the attribute dissector
svn path=/trunk/; revision=22236
over anybody who edits the sys/net80211/ieee80211_radiotap.h header on
any operating system. I also think he needs to be willing to use that
power when necessary.
svn path=/trunk/; revision=22217
Changes are only for protocol version 2.
The changes are:
- dissect "TIPC Bundler Protocol" messages correctly
- search for other dissectors which want to dissect encapsulated data according to the TIPC user or TIPC type of a message. The data dissection is difficult since a TIPC data message does not necessarily a "type" set. So for the moment - while TIPC is not widely used - just triggering for the user of a message will be sufficient for people looking into the TIPC protocol.
- "Dissect TIPC data" in the preferences is now switched on by default
- to show undissected data, the "data" dissector is now used.
- corrected some typos
svn path=/trunk/; revision=22183
a SASL encapsulated ldap blob can contain more than one LDAP message so
the rest_is_pad parameter is bogus and thus removed.
make dissect_ldap_pdu handle when we have more than one LDAP message
inside one sasl blob
svn path=/trunk/; revision=22181
receiving a SES MAJOR SYNC POINT, as this indicates the end of the
COTP DT Data stream. Previous the RTSE dissector was called when
receiving a COTP DT Data fragment with the "last data unit" bit set,
but this does not work with messages fragmented in RTSE. Reassembly
can be turned off in the preferences.
svn path=/trunk/; revision=22176
COTP DT Data (class 1) fragment in the same frame. Also added the
generated dst_ref and a reference to the "COTP segment data" to the
tree.
svn path=/trunk/; revision=22173
process WEP keys. Allow the "wep:" prefix for WEP keys even when
HAVE_AIRPDCAP isn't defined. Add a NULL pointer check to
hex_str_to_bytes(). Fixes bug 1584.
Fixup indentation.
svn path=/trunk/; revision=22151
Sometimes edonkey packets comes joined, and wireshark display only last
one on column Info. Now everyone is displayed.
svn path=/trunk/; revision=22143
- the Facility is not bellow the facility itself, but at the end of the tree.
It's not a problem, but it looks strange.. - Fixed
svn path=/trunk/; revision=22141
For the Cancel Location message, you can replace the
old_CancelLocationArgV2 by the Identity message.
So the old syntax for Cancel Location is not used anymore.
For the message Send Authentication Info Res, there is a typo error. The "item" should not be used.
- one with the decoding of "processUnstructuredSS-Data", the IA5 string
is not decoded/displayed.
This should go into 0.99.6.
svn path=/trunk/; revision=22135
packet-smb.c(5479) : error C2220: warning treated as error - no object file generated
packet-smb.c(5479) : warning C4244: '=' : conversion from 'unsigned short ' to 'unsigned char ', possible loss of data
packet-smb.c(5480) : warning C4244: '=' : conversion from 'unsigned short ' to 'unsigned char ', possible loss of data
svn path=/trunk/; revision=22134
- Remove ethertype preference from recently added FCoE dissector
Me:
- Add Joe to the AUTHORS list
- Change previous line in AUTHORS list from @ to [AT] in e-mail address
svn path=/trunk/; revision=22133
Please find attached a patch to fix some bugs in the armagetronad
dissector. More specifically:
* Update the descriptors to armagetronad-0.2.8.2.1, the file
src/network/Makefile.in does not exist anymore in the armagetronad
source code.
* Ensure the printed data is null terminated.
* Avoid guint16 overflow because of the '* 2'.
* Remove a statement with no effect (data = NULL).
svn path=/trunk/; revision=22131
Attached is a small patch that adds a preference option to allow the SQL
Query string to be appended to the INFO column display. This makes life
a little bit easier when scanning a trace to find the packet associated
with a specific query. I thought it was better to implement it as a
preference option with default set FALSE as it can clutter up the
display for applications that generate large amounts of queries.
svn path=/trunk/; revision=22130
Currently the MySQL dissector assumes that an OK-Packet Response
contains the Server_Status field. Having checked the MySQL protocol page
I can't say conclusively whether it should or it shouldn't, however I've
come across a couple of MySQL Java clients that receive the OK-Packet
without the Server_Status field set in response to a "SET AUTOCOMMIT" call.
The attached patched simply adds a check to ensure the Server_Status
field is present before calling function mysql_dissect_server_status.
svn path=/trunk/; revision=22129
I added 5 new packets to packet-edonkey.c and improve 2. Diffs in
attachment. This part of wireshark (decoding emule packets) it's not
finish as I see :) I try to do it, meybe... :)
svn path=/trunk/; revision=22128
the WEP/WPA decryption code instead of re-calculating it. Fixes bug
1639.
Remove fcsPresent, radiotapPresent, and associated code from airpdcap.c
since they were always FALSE. Glib-ize some data types. Fixup white
space.
Update the release notes.
svn path=/trunk/; revision=22104
Attached is a patch file for the PANA protocol dissector. The changes updates the packet-pana.c dissector to support draft-ietf-pana-pana-15.txt.
svn path=/trunk/; revision=22098
not unique between ANSI and ITU so we end up with incorrect behavior. In
particular:
- In non-ANSI if GTI==0x1, don't try to decode TT, NP, and ES.
- In ANSI don't decode the O/E indicator on GTI==0x1.
- In non-ANSI don't decode NAI on GTI==0x1 or 0x4.
svn path=/trunk/; revision=22090
The code for reading ERF files has not been significantly
updated since 2004. This patch brings it up to date with a
number of changes.
1) Increase number of decodable ERF types from 7 to 12. This
covers newer DAG card models and firmware updates.
2) Fix timestamp conversion. Was calculating only microsecond
precision, now displaying with nanosecond resolution. Hardware
precision is 7.5 to 30 ns depending on model.
3) Allow the user to specify HDLC encapsulation as 'chdlc',
'ppp_serial', 'frelay' or 'mtp2'. This is needed because the
ERF HDLC capture formats do not include information on what
protocol is used at the next level. This is currently done via
an environment variable 'ERF_HDLC_ENCAP' and is analagous to the
existing 'ERF_ATM_ENCAP' variable.
If the user does not specify an HDLC encapsulation it tries to
guess, and falls back to MTP2 for backwards compatibility with
Florent's existing behaviour.
I know environment variables are ugly, suggestions are welcome.
4) When reading HDLC captures as MTP2, use
WTAP_ENCAP_MTP2_WITH_PHDR rather than WTAP_ENCAP_MTP2. This
allows us to put the 'Multi-Channel ERF' record 'channel
number' field into the MTP2 pseudo header > 'link_number'
field. This is then displayed in Frame information, and can
be filtered on. (Would be nice if it could be made a display
column?)
Because the ERF record does not specify whether Annex A is used
or not, we pass MTP2_ANNEX_A_USED_UNKNOWN and allow the existing
user preference to decide.
Move the MTP2_ANNEX_A_ definitions into Wiretap, make the annex_a_used
field a guint8, and change MTP2_ANNEX_A_USED_UNKNOWN to 2 so it fits in
a guint8. (This means that if you can save an ERF MTP2 file as a
libpcap file, the pseudo-header will have MTP2_ANNEX_A_USED_UNKNOWN in
it.)
svn path=/trunk/; revision=22067
Following items are changed:
*) Bandwidth efficient decoding re-implemented with expert-info support.
The old implementation supported a single frame only.
*) Support for AMR-WB added
*) Fixes for IF1 and IF2 decoding
svn path=/trunk/; revision=22066
(the old one was mapping file handles that differed only by one bit to
the same hash value; the new one mapped them to different hash values).
svn path=/trunk/; revision=22065
The attached patch adds a small enhancement for the ETHERNET Powerlink
dissector (some well-known CANopen device profiles are decoded in human
readable plaintext in the IdentResponse frame).
svn path=/trunk/; revision=22061
attributes specified at open time, have them take a length value, and
pass 4 if the values are extracted from the current packet and 0 if they
come from values saved when the FID was opened (as they're generated
values not found in the packet) - that fixes bug 1638.
svn path=/trunk/; revision=22053
of the function was missing from the call for monitorRouteRequest. It
also appears that the wrong function was being called for
monitorRouteReport.
svn path=/trunk/; revision=22049
- support of extension in middle of SEQUENCE root elements
- new option EMBEDDED_PDV_CB to set default callback
- ChoiceValue support at syntax level
- ValueSet support at syntax level
- exception identifier support
- ValueFromObject support at syntax level
- next minor changes (to compile X.880 and INAP)
- dissectors using classes regenerated
svn path=/trunk/; revision=22036
TR-111, from the DSL-Forum adds two options to STUN (RFC 3489) to help
with TR-069 enabled devices traverse firewalls. TR-111 can be read here:
http://www.dslforum.org/techwork/tr/*TR-111*.pdf
This patch adds support for decoding the two optional STUN attributes
used by TR-111. One is simply a zero-length attribute, and the other a
string attribute.
Me: Changed stun.att.connection.request.binding to
stun.att.connection_request_binding
svn path=/trunk/; revision=22019
find attached several trivial diffs for viewing RTP SSRC values in Hex
rather than Dec at various places in the UI.
Also includes change from BASE_DEC to BASE_HEX_DEC for corresponding RTP
and RTCP dissector header fields.
svn path=/trunk/; revision=22017
capabilities 7.7.76" function called decode_gtp_mbms_bearer_cap in
an #if 0 block to get the Unix buildbots going again. Left code
intact on the asumption that it is about to be used since it was
recently added.
svn path=/trunk/; revision=22014
routines and routines using those routines. GLib might use different
modifiers for 64-bit quantities than the platform's C library does.
svn path=/trunk/; revision=21990
In all the places where a cast to "long long" or "unsigned long long"
was done, use G_GINT64_MODIFIER and get rid of the cast, as
1) there's no guarantee that "%ll" works
and
2) there's no guarantee that "long long" works
(the latter definitely does *NOT* work with MSVC++; the former doesn't
work with regular printf in MSVC++, but it might work with the GLib
printf-based functions).
svn path=/trunk/; revision=21978
Fix compilation failures when building wireshark-0.99.6-SVN-21916 on an
x86_64-unknown-linux-gnu target with gcc version 4.1.2 20070403 (Red Hat
4.1.2-8).
The failures fall into two categories:
(1) Casts between pointers and 32-bit integers without an intermediary cast
via 'long' or 'unsigned long'. This results in a compiler warning complaining
about casts between a pointer and an integer of a different size.
(2) Passing values to "%lld" or similar printf-style format options that the
compiler thinks are a different size. Such values need to be cast to 'long
long' or 'unsigned long long'.
svn path=/trunk/; revision=21975
Attached is a patch file and a new dissector for FCoE. This protocol
is described at http://fcoe.com and has been submitted to T11. It is an encapsulation protocol that can be used to transport FC frames over raw Ethernet when the link is loss-free due to pause. The Ethertype 0x8906 has been reserved through IEEE for this protocol.
svn path=/trunk/; revision=21967
The enclosed patch updates the ansi isup dissector to support the following parameters:
1. Generic Name
2. Originating Line Info
3. Jurisdiction
4. Charge Number
5. Forward Call Indicator (bits M and N are now being decoded)
6. Cause Code (all values are now being decoded)
svn path=/trunk/; revision=21966
Here is a small patch of a dozen lines that extracts SQL statements from
the packet.
This allows to use the field "drda.sqlstatement" in coloring rules or in a
packet filter so that only SQL statements are dumped from a connection
svn path=/trunk/; revision=21964
adds support for the following RFCs (and RFC-to-be):
- RFC 3519 Mobile IP Traversal of Network Address Translation (NAT) Devices
- RFC 3543 Registration Revocation in Mobile IPv4
- RFC 4433 Mobile IPv4 Dynamic Home Agent (HA) Assignment (including the not
yet published errata about the message extension using the short message
extension format)
- draft-ietf-mip4-message-string-ext Mobile IPv4 Message String Extension
svn path=/trunk/; revision=21948
- packet-user_encap.c: use the new UAT_PROTO_DEF
- gtk/uat_gui.c: change the order of "containment" of the widgets to have the clist fields sized to the scrolledwindow instead of the whole window
svn path=/trunk/; revision=21934
I ran into a problem trying to debug some of my stuff yesterday that depends on the http dissector, and the server I'm working with defaults to ssl traffic; whenever I try to debug it, it always gets hung up on the lines I mentioned in the email quoted below (within the ssl dissector).
It seems the culprit is in the use of g_malloc within ssl_data_alloc, and free (instead of g_free) in tls_prf.
I've attached the diff for the fixes I made.
svn path=/trunk/; revision=21929
compiler warns about checking whether it's >= 0, as it always is.
Don't do that check - we don't use "type" until the switch statement,
and GCC should issue a warning if not all valid "enum QUALITY_TYPE"
values are handled in the switch statement.
Sort the items in the switch statement in the order in which they appear
in the enum definition, so it's clearer that it covers all values.
svn path=/trunk/; revision=21890
