to configure.in. This should allow someone to do 'make ethereal_static' and
get a staticly built copy of ethereal w/o plugin support on platforms that
support -Wl,-static for static linking.
svn path=/trunk/; revision=1585
The files were created by Frederic Peters <fpeters@debian.org>, the maintainer
of the ethereal debian package.
I just modified `rules' to use autogen.sh when building from a CVS tree.
Building a debian package is now very easy :
- in debian/changelog : change the version number (and replace my name with
yours)
- dpkg-buildpackage -rfakeroot -us -uc
svn path=/trunk/; revision=1569
no longer optionally compile the snmp dissector. But I left the dist-hook
line in the Makefile.am in case we're ever in that situation again.
svn path=/trunk/; revision=1492
linking with "-lsnmp".
Link only Ethereal and Tethereal with "-lpcap"; don't link editcap, or
any of the test programs that the configure script builds, with it
(because that means you also have to arrange that those test programs be
linked with @SOCKET_LIBS@ and @NSL_LIBS@) - i.e., don't add it to LIBS,
add it to PCAP_LIBS, and use that only for programs that need it.
svn path=/trunk/; revision=1484
make it link with them.
Provide dependencies for Tethereal as well.
Tethereal may need to be linked with "-lsocket" and/or "-lnsl"; check
for that, and arrange that it be linked with them if necessary.
svn path=/trunk/; revision=1483
with MSVC 6.0 and 'nmake', the make tool that comes with MSVC.
It compiles, links, and runs. It doesn't run correctly. There's a problem
when reading files. I'm getting short reads. I'm not linking in zlib or
libsnmp because it first needs to be debugged.
I changed the plugin code to use gmodule instead of libltdl, but the
Unix build still links ethereal against libltdl. I'll fix that tonight; sorry
about leaving it in such a sad state, but I wanted to check in this code
before I left work on a Friday night. Ethereal still works, but the
building is less than optimal.
svn path=/trunk/; revision=1479
dissector.
Add a "value_string" table for NLPIDs to the OSI dissector, and export
it for use by the CDP dissector.
Fix the CDP dissector as per the documentation in
http://www.cisco.com/univercd/cc/td/doc/product/lan/trsrb/frames.htm
and as per some traces we have with CDP data in them.
svn path=/trunk/; revision=1455
by default.
Use the automake mechanisms for it, and, having done so, arrange that it
not be linked with GTK+ (which it doesn't need) - it currently links
with libpcap, but that should be fixed as well. (It also needs a man
page.)
svn path=/trunk/; revision=1445
The distro is buildable finally. I had to change "plugins/gryphon" from
a separately configured (i.e., "./configure") package to a member of
the main ethereal autoconf package so that PLUGIN_DIR could be passed
to plugins/gryphon/Makefile.am. In doing so, I had to get rid of
plugins/gryphon/config.h which had PACKAGE and VERSION #defined, the latter
of which was actually used in packet-gryphon.c. So I moved those two
#defines into a new file, plugins/gryphon/moduleinfo.h.
svn path=/trunk/; revision=1438
of routines to enable and disable various sets of menu items; call only
those routines, not routines to enable or disable particular menu items,
from files in the top-level directory, as other UIs may not refer to
menu items with path strings of the sort used in GTK+, and as this
buries knowledge of the menu items available in "gtk/menu.c" rather than
requiring stuff outside of "gtk/menu.c" to know what menu items exist.
svn path=/trunk/; revision=1410
"value_string" array for OUIs.
Add the OUI for the ATM Forum to that list.
Handle the OUI for the ATM Forum in the layer 3 information for ISO TR
9577 in a Broadband Low Layer Information information element (for ATM
LANE).
Add an initial version of the dissection of TLV values in LANE LE
Control frames (I have no frames with TLV values against which to test
it, alas).
svn path=/trunk/; revision=1385
(I'm using -ko when checking in the PNGs... I hope I'm checking
these binary files into CVS correctly. I'll double check after
the commit).
svn path=/trunk/; revision=1355
In packet_hex_print(), compute (bstart + blen) only once.
In time_secs_to_str(), return a meaningful string when time == 0, instead
of returing pointer to char buffer with old, inappropriate data in it.
svn path=/trunk/; revision=1297
into "gtk/ui_util.c", and move the declarations of those UI utilities
out of "util.h" into "ui_util.h". (The header file is in the top-level
directory, rather than the "gtk" directory, because it declares
window-system-independent interfaces to routines with
window-system-dependent implementations.)
Add to "gtk/ui_util.c" a routine to set the window and icon title.
Use that routine to make the title of an Ethereal top-level window be
{filename} - Ethereal
if there's a capture open, and have "{filename}" be "<capture>" if it's
a temporary capture file.
svn path=/trunk/; revision=1255
dissector doesn't use it yet - Nathan Neulinger might use it for a
Kerberos 5 dissector, and it might be of use for other dissectors as
well.
svn path=/trunk/; revision=1215
there are no SNMP libraries to use in a real dissector; this means that
other dissectors don't have to care if there are SNMP libraries, they
can just call "dissect_snmp()" - and this also simplifies "Makefile.am"
and "configure.in" a bit, as they just treat "packet-snmp.c" and
"packet-snmp.h" the same way they treat other dissector source files.
svn path=/trunk/; revision=1214
Archive Centre for HP-UX, who have (perhaps not the latest version of)
Ethereal in their archives, and the HP-UX C compiler options they used
when building their version.
Also note in the "README.hpux" file that there are, in the "INSTALL"
file for "libpcap", several comments about HP-UX that should be read if
you're going to use Ethereal with "libpcap" to capture packets.
svn path=/trunk/; revision=1159
put it into a subroutine in "packet-arp.c", and call it from
"packet-q2931.c".
Add a "packet-arp.h" header to hold declarations of routines exported by
"packet-atm.c" (other than the ATM dissector itself), moving them out of
"packet.h".
Use the aforementioned NSAP dissector to display ATM addresses in NSAP
format, and display E.164 addresses as ASCII text (under the assumption
that they're presented as a string of IA5, i.e. ASCII, characters, just
as they are in Q.931).
svn path=/trunk/; revision=1124
Export some functions from the Q.931 dissector, so the Q.2931 dissector
can use them.
Add a pile of information element dissection to the Q.2931 dissector.
svn path=/trunk/; revision=1104
Rename the dissector for the Netware SAP protocol to "dissect_ipxsap()",
so as to keep its name from colliding with that of the dissector for the
Session Announcement Protocol.
svn path=/trunk/; revision=1046
We now store IPv4 addresses in host order, allowing non-equivalence
comparisons. That is, display filters with lt, le, gt, and ge will work
on big-endian and little-endian machines.
CIDR notation is now supported for IPv4 addresses in display filters.
You can test to see if an IPv4 address is on a certain subnet by using
this notation. For example, to test for IPv4 packets on a Class-C network:
ip.addr == 192.168.1.0/24
svn path=/trunk/; revision=1032
Added stat dissector.
Enhancements to portmap dissector.
Added rpc_prog_name function to packet-rpc to retrieve the name of an
rpc program. This should likely eventually be modified to use the
/etc/rpc or rpc.bynumber NIS maps in addition to the programs that
are registered within ethereal.
svn path=/trunk/; revision=1016
portmap
ypserv
ypxfr
ypserv
bootparams
Stubs currently just map procedure numbers to names. I'll add some more
decoding of the actual procedure call/reply contents eventually.
svn path=/trunk/; revision=998
all the "packet-XXX.c" files doesn't work with some "make"s; they seem
to pass only the first few names in the list to the shell, for some
reason.
Therefore, we use a script to generate the "register.c" file, and run
that script from the Makefile.
svn path=/trunk/; revision=930
structure to "dl_src"/"dl_dst", "net_src"/"net_dst", and "src"/"dst"
addresses, where an address is an address type, an address length in
bytes, and a pointer to that many bytes.
"dl_{src,dst}" are the link-layer source/destination; "net_{src,dst}"
are the network-layer source/destination; "{src,dst}" are the
source/destination from the highest of those two layers that we have in
the packet.
Add a port type to "packet_info" as well, specifying whether it's a TCP
or UDP port.
Don't set the address and port columns in the dissector functions; just
set the address and port members of the "packet_info" structure. Set
the columns in "fill_in_columns()"; this means that if we're showing
COL_{DEF,RES,UNRES}_SRC" or "COL_{DEF,RES,UNRES}_DST", we only generate
the string from "src" or "dst", we don't generate a string for the
link-layer address and then overwrite it with a string for the
network-layer address (generating those strings costs CPU).
Add support for "conversations", where a "conversation" is (at present)
a source and destination address and a source and destination port. (In
the future, we may support "conversations" above the transport layer,
e.g. a TFTP conversation, where the first packet goes from the client to
the TFTP server port, but the reply comes back from a different port,
and all subsequent packets go between the client address/port and the
server address/new port, or an NFS conversation, which might include
lock manager, status monitor, and mount packets, as well as NFS
packets.)
Currently, all we support is a call that takes the source and
destination address/port pairs, looks them up in a hash table, and:
if nothing is found, creates a new entry in the hash table, and
assigns it a unique 32-bit conversation ID, and returns that
conversation ID;
if an entry is found, returns its conversation ID.
Use that in the SMB and AFS code to keep track of individual SMB or AFS
conversations. We need to match up requests and replies, as, for
certain replies, the operation code for the request to which it's a
reply doesn't show up in the reply - you have to find the request with a
matching transaction ID. Transaction IDs are per-conversation, so the
hash table for requests should include a conversation ID and transaction
ID as the key.
This allows SMB and AFS decoders to handle IPv4 or IPv6 addresses
transparently (and should allow the SMB decoder to handle NetBIOS atop
other protocols as well, if the source and destination address and port
values in the "packet_info" structure are set appropriately).
In the "Follow TCP Connection" code, check to make sure that the
addresses are IPv4 addressses; ultimately, that code should be changed
to use the conversation code instead, which will let it handle IPv6
transparently.
svn path=/trunk/; revision=909
protocols (idea shamelessly stolen from GDB). We require that the
register routines
1) be located in "packet.c" or in one of the "packet-XXX.c"
files;
2) have a name of the form "proto_register_XXX";
3) take no argument, and return no value;
4) have their names appear in the source file either at the
beginning of the line, or preceded only by "void " at the
beginning of the line;
and we require that "packet-XXX.c" files be added to "DISSECTOR_SOURCES"
in "Makefile.am".
svn path=/trunk/; revision=891
as BGP is a protocol on top of TCP, it may have trouble parsing
out-of-sync data (in most cases data is aligned on packet, it seems).
svn path=/trunk/; revision=843
definition of "AF_INET6". Declare those functions and, if it's not
defined, define "AF_INET6" in "inet_v6defs.h", and arrange to include
it if "inet_ntop()" is missing. (Systems will probably have both of
them or lack both of them, and we may choose not to use the system's
"inet_pton()" because it's buggy, so base the decision on whether to
include "inet_v6defs.h" on whether we're using the system's
"inet_ntop()" or not.) Fix some macro references in "Makefile.am" and
"configure.in".
svn path=/trunk/; revision=830
for converting IPv[46] numeric notation to/from binary form.
recent BIND includes those functions so fallback is not necessary on
most of the platforms.
sorry if it raises any portability problem on other platforms.
remove partial inclusion of inet_ntop() in packet-ipv6.c.
move ip6_to_str() to packet.c, it fits better there than packet-ipv6.c.
svn path=/trunk/; revision=829
for ip.ip_p and ip6.ip6_nxt (and other IPv6 header chain).
use val_to_str() as much as possible in dissect_{ipv6,pim,ripng}().
make --disable-zlib a default for netbsd (temporary workaround).
svn path=/trunk/; revision=827
the base for numbers to be displayed in, bitmasks for bitfields, and blurbs
(which are one or two sentences describing the field).
proto_tree_add*() routines now automatically handle bitfields. You tell
it which header field you are adding, and just pass it the value of the
entire field, and the proto_tree routines will do the masking and shifting
for you.
This means that bitfields are more naturally filtered via dfilter now.
Added Phil Techau's support for signed integers in dfilters/proto_tree.
Added the beginning of the SNA dissector. It's not complete, but I'm
committing it now because it has example after example of how to use
bitfields with the new header_field_info struct and proto_tree routines.
It was the impetus to change how header_field_info works.
svn path=/trunk/; revision=815
OSes that don't have it.
(Yes, this is BSD code, not GPLed code. I tried getting it from Glibc,
but the glibc version is just the BSD version, so I guess it's OK to mix
BSD code in with GPLed code, or, at least, with LGPLed code....)
svn path=/trunk/; revision=805
"strncasecmp()" or "mkstemp()"; add in source to the GNU "libc"
versions, and have the "configure" script check for the routines in
question and set up the Makefile to build from our versions if they're
missing.
svn path=/trunk/; revision=745
specified number of bytes of captured data in the frame at the specified
offset, and a "IS_DATA_IN_FRAME()" macro, to test whether there are any
bytes of captured data in the frame at the specified offset, and convert
some bounds checks to use them.
Add a dissector for the Internet Printing Protocol.
svn path=/trunk/; revision=685
family has a set of debug commands that allow you to log the traffic on a
WAN or dialup connection as text, e.g.
RECV-iguana:241:(task: B04E12C0, time: 1975358.50) 15 octets @ 8003D634
[0000]: FF 03 00 3D C0 06 C9 96 2D 04 C1 72 00 05 B8
Created wtap_seek_read() which parses the textual data for and Ascend
trace, and does a normal fseek() and fread() for any other file type.
The fseek()/fread() pairs in file.c were replaced with the new function.
svn path=/trunk/; revision=652
this causes "Makefile.in" to have two GPL notices - "Makefile.in" and
the "Makefile" generated from it are generated files, so maybe that's
OK).
svn path=/trunk/; revision=638
in the IPX header, and have the dissectors it calls use it rather than
being passed the length as an argument.
Treat both packet type 20 ("WAN Broadcast") and 4 ("IPX", although 3 is
also "IPX", according to Network Monitor) as potentially being NetBIOS
packets.
The packet types for the IPX NetBIOS socket (0x0455) and the NWLink
sockets (0x0551 and 0x0553) are different (perhaps because there's one
socket for the 0x0455 NBIPX, so you have to do name service and datagram
service and have the packet types distinguish them, but NWLink has
separate sockets for name service and datagram service).
The packet type for name service and for datagram service are at
*different locations* in the packet, which is unfortunate if you want to
use the packet type to distinguish name service and datagram service
packets. Use the packet length, for now, to distinguish them, with
socket 0x0455.
Dissect datagram packets differently from name service packets.
Export "packet-netbios.c"'s "netbios_add_name()" routine, and use it
when dissecting NBIPX packets as well.
Label NBIPX packets as "NBIPX" rather than "NetBIOS".
svn path=/trunk/; revision=627
directory in which the UCD SNMP library is found (and to check for the
UCD SNMP stuff in "$prefix" if "$prefix" isn't "/usr/local"), and to
have "Makefile.am" use "$(MAKE)" rather than "make".
svn path=/trunk/; revision=624
file, instead of throwing out all but LANE or RFC 1483 data frames and
pretending that the former are just Ethernet or Token-Ring frames.
Add some level of decoding for ATM LANE, but not all of it; the rest,
including decoding non-LANE frames, is left as an exercise for somebody
who has captures they want to decode, an interest in decoding them, ATM
expertise, and time....
svn path=/trunk/; revision=523
instead of "yy". (dfilter-grammar.y was modified to #define yylex as
dfilter_lex).
VERSION is no longer needed since the doc/Makefile now uses @VERSION@,
passed to it from 'configure'.
svn path=/trunk/; revision=469
the source directory. The doc makefile is still broken however.
Thanks to Jan Bernard van Doorn for raising this problem.
svn path=/trunk/; revision=453
SDLC-derived protocols such as HDLC and derivatives of it such as LAPB,
IEEE 802.2 LLC, and so on. Have the LLC and LAPB dissectors use it.
Make "dissect_numeric_bitfield()" put the low-order bit of the bitfield
in the low-order bit of an integer when printing it, so that the right
value is printed.
svn path=/trunk/; revision=434
wiretap support for RADCOM Ltd.'s WAN/LAN analyzers (see
http://www.radcom-inc.com/
). Note: as I remember, IEEE 802.2/ISO 8022 LLC has somewhat of an SDLC
flavor to it, just as I think LAP, LAPB, LAPD, and so on do, so we may
be able to combine some of the LLC dissection and the LAPB dissection
into common code that could, conceivably be used for other SDLC-flavored
protocols.
Make "S" a mnemonic for "Summary" in the "Tools" menu.
Move the routine, used for the "Tools/Summary" display, that turns a
wiretap file type into a descriptive string for it into the wiretap
library itself, expand on some of its descriptions, and add an entry for
files from a RADCOM analyzer.
Have "Tools/Summary" display the snapshot length for the capture.
svn path=/trunk/; revision=416
as it standed depends on your lex being flex, but that only matters if you're
a developer. The distribution will include the dfilter-scanner.c file, so
that if the user doesn't modify dfilter-scanner.l, he won't need flex to
re-create the *.c file.
The new lex scanner gives me better syntax checking for ether addresses. I
thought I could get by using GScanner, but it simply wasn't powerful enough.
All operands have English-like abbreviations and C-like syntax:
and, && ; or, || ; eq, == ; ne, != ; , etc.
I removed the ETHER_VENDOR type in favor of letting the user use the [x:y]
notation: ether.src[0:3] == 0:6:29 instead of ether.srcvendor == 00:06:29
I implemented the IPXNET field type; it had been there before, but was
not implemented. I chose to make it use integer values rather than byte
ranges, since an IPX Network is 4 bytes. So a display filter looks like this:
ipx.srcnet == 0xc0a82c00
rather than this:
ipx.srcnet == c0:a8:2c:00
I can supposrt the byte-range type IPXNET in the future, very trivially.
I still have more work to do on the parser though. It needs to check ranges
when extracting byte ranges ([x:y]) from packets. And I need to get rid
of those reduce/reduce errors from yacc!
svn path=/trunk/; revision=414
output of "ethereal -G" and "doc/ethereal.pod.template". Make
"ethereal.1" depend on "ethereal" and "doc/ethereal.pod.template",
rather than on "doc/ethereal.pod", so that it can be built even if you
don't have "doc/ethereal.pod".
svn path=/trunk/; revision=367
suggestion, this new method using a static array should use less memory
and be faster. It also has a nice side-effect of making the source-code
more readble, IMHO.
Changed the print routines to look for protocol proto_data instead of
looking at the text label as they did before, hoping that the data hex
dump field item starts with "Data (".
Added the -G keyword to ethereal to make it dump a glossary of display
filter keywords to stdout and exit. This data is then formatted with
the doc/dfilter2pod perl program to pod format, which is combined
with doc/ethereal.pod.template to create doc/ethereal.pod, from which
the ethereal manpage is created. This way we can keep the manpage up-to-date
with a list of fields that can be filtered on.
svn path=/trunk/; revision=364
new proto_tree routines. I also removed the check for lex and yacc from
wiretap's configure script. The IP dissector now uses
proto_register_field_array().
svn path=/trunk/; revision=348
mechanism that is built into ethereal. Wiretap is now used to read all
file formats. Libpcap is used only for capturing.
svn path=/trunk/; revision=342
NetMon statistic packets for now. We might fix that problem with wiretap,
either filtering out those packets, and/or providing the summary
information through a new wiretap API.
svn path=/trunk/; revision=326
is the same as "Tools/Capture", and "Display" has an "Options" item,
which pops up a dialog box to let you change the "default" time-stamp
column display format on the fly (the "default" is what the "-t"
command-line option sets), and have the display change when you do that.
Made infrastructure changes to make the immediate display update work.
Removed some unused functions, declared some functions used only in the
file in which they're defined "static", and removed some unnecessary
#includes.
svn path=/trunk/; revision=317
if you have the UCD or CMU SNMP library available. If you have the SNMP
library but do not with to have SNMP support, use the
./configure --disable-snmp
option. Otherwise 'configure' finds the SNMP library and uses it.
svn path=/trunk/; revision=281
proto*() functions. The configure script tries to use ipv6 name resolution if
it knows the type of ipv6 stack the user has (this can be avoided with the
--disable-ipv6 switch) Additionally, the configure script now deals with wiretap
better. If the user doesn't want to compile wiretap, the wiretap is never
visited. A few unnecessary #includes were removed from some wiretap files, and
a CPP macro was moved from bpf.c to wtap.h.
svn path=/trunk/; revision=229
reference the protocol tree with struct proto_tree and struct proto_item
objects. That way, the packet decoding source code file can be used with
non-gtk packet decoders, like a curses-based ethereal, e.g. I also re-arranged
some of the information in packet.h to more appropriate places (like other
packet-*.[ch] files).
svn path=/trunk/; revision=223
wiretap functions to be more generic and therefore allow an easier integration
of more packet-capture file types. I also put in all the GPL copyrights in the
wiretap code.
svn path=/trunk/; revision=83
because it is still in its infancy, but it can be compiled in optionally.
The library exists in its own subdirectory ethereal/wiretap. This patch also
edits all the packet-*.c files to remove the #include <pcap.h> line which is
unnecessary in these files. In the ethereal code, file.c is the most heavily
modified with #ifdef WITH_WIRETAP lines for the optional library.
svn path=/trunk/; revision=82
Guy Harris