the use of these keys while editing a filter in the filter toolbar.
The keys "ctrl-home" and "ctrl-end" already provide the functionality to
go to the first or last packet in the packet-list. I added these as
accelerator keys and updated the users guide accordingly.
Of course we can also make "home" and "end" work, without breaking
functionality in the filter toolbar, but that takes a little more
work (at least for me... maybe not after going to Steve's session
at Sharkfest :-)).
(will add this to inclusion list for 1.0.9 and 1.2.0)
svn path=/trunk/; revision=28670
Currently wireshark has ability to decrypt ISAKMP IKEv1 packets, but not IKEv2
packets. With attached patch decryption of IKEv2 packets is now passible.
svn path=/trunk/; revision=28089
- Enabled "Copy Description" in the main menu and gave it
accelerator key CTRL+SHIFT+D
- Added "Copy Fieldname" to copy the fieldname of the selected
field in the detail view (Acc.Key: CTRL+SHIFT+F)
- Added "Copy Value" to copy the value of the selected
field in the detail view (Acc.Key: CTRL+SHIFT+V)
- Updated documentation to reflect the changes
svn path=/trunk/; revision=28006
object identifier when the capture does not contain a PRES package with a
presentation context definition list for the conversation.
Added a few expert infos.
svn path=/trunk/; revision=27631
From me:
Instead of adding adns_config.h, place it a custom adns package in
wireshark-win32-libs. Update tools/win32-setup.sh accordingly.
Split the MSVC2008EE variant into MSVC2008 and MSVC2008EE, similar to
MSVC2005 and MSVC2005EE. We have to worry about vcredist_x86.exe in
both cases.
Add Pascal to AUTHORS.
Update the Developer's Guide.
svn path=/trunk/; revision=25921
GTK+ since version 2.8, when its name was changed to the "GTK MS
Windows-Engine."
Simplify the Windows installer by removing the GTK-Wimp option (which
means the "Wireshark" item can be an entry instead of a group). Move
Rawshark to the "Tools" group.
(If anyone wants to disable the MS Windows Engine they can still do so
after installation by disabling or removing libwimp.dll.)
svn path=/trunk/; revision=25611
- Added description of the expert info bullet
- Added description of the configuration profile with menu
- Show the correct Packets/Displayed/Marked(/Dropped) names
- Describe the display filter message when using the != operator
svn path=/trunk/; revision=25513
to show and document the "Device" column.
Added a note about hidden interfaces.
Added some missing graphics files to Makefile.common.
svn path=/trunk/; revision=25115
correct example and documentation about register_menu()
my own: do not fail to make init.lua when building in a different dir
svn path=/trunk/; revision=24879
selected profile.
Don't save SMI Paths and SMI Modules in the profiles because reloading
currently doesn't work (bug 2309).
svn path=/trunk/; revision=24580
- Added description for WLAN Traffic statistics.
- Added "Limit to display filter" description in conversations and endpoints.
- Added a tip in IO Graphs to click in the graph to select a matching packet.
- Some indentation fixes.
svn path=/trunk/; revision=24371
to override UAT entries from the command line, e.g.
-o "uat:user_dlts:\"User 0 (DLT=147)\",\"http\",\"0\",\"\",\"0\",\"\""
Fix up white space.
svn path=/trunk/; revision=24338
configure and use more than one set of preferences and configuration files.
This can be found in the "Configuration Profiles..." menu item from the Edit
menu, or by pressing Shift-Ctrl-A. It's also possible to start wireshark
and tshark with a named profile by using the "-C ProfileName" option.
A new status pane in the main window will show the current profile.
The configuration files currently stored in the Profiles are:
- Preferences
- Capture Filters
- Display Filters
- Coloring Rules
- Disabled Protocols
- User Accessible Tables
The recent data are by design not added to the profile.
Planned future enhancements:
- make a more convenient function to switch between profiles
- add a "clone profile" button to copy an existing profile
- make the profiles list active and accept return as OK
- save users "Decode as" in the profile
- make new, clone and deletion of profiles more secure
- make some of the recent values available in the profile
This patch also fixes:
- setting default status pane sizes
- a bug setting status pane for packets when not having main lower pane.
svn path=/trunk/; revision=24089
- New column "Marked" in the summary window
- New label "Capture filter" in the hierarchy window
- Moved Copy button in conversations and endpoints
- Added the zero value on the x-axis in io graphs
svn path=/trunk/; revision=23690
quit. Temporary coloring filters can be set by:
- pressing <ctrl>-<digit> will create a conversation coloring filter based on the
addresses of the currently selected packet (order TCP/UDP/IP/Ethernet)
This can also be achieved from the "View|Colorize Conversation" menu.
- Rightclicking on a packet in the packet-list will give the option to
"Colorize Conversation" just as "Conversation Filter" does.
- Rightclicking on an item in the packet-detail-list will give the option to
"Colorize with filter" which works similar to "Apply as filter"
Temporary filters can be cleared from the same menus or by pressing <ctrl>-<space>.
This patch also adds an item to the above mentioned menu's to add a permanent color filter
in the same way.
The colors for the temporary coloring rules are now hardcoded as I do not know
how to change the color of menu-items and therefore I chose to use icons to
show the actual color of each of the ten temporary coloring rules. Is it at all
possible to have different menu items in different colors?
One other way of solving this is to recreate the icons on the fly after changing
the colors. I will have a look into that once it is clear whether I can use
different colors within the menu structure.
svn path=/trunk/; revision=23560
for the same tvb. This keeps us from freeing the same memory twice and
crashing on some systems.
This might be the same bug Brian Vandenberg was looking for in
http://www.wireshark.org/lists/wireshark-dev/200705/msg00406.html .
svn path=/trunk/; revision=23415
the Lua dissector example in wsluarm.xml uses C defines instead of Lua
defines where display bases for ProtoFields are used.
svn path=/trunk/; revision=22853
Instead of overflowing an unsigned int when determining the number of
items in a range, use a signed int and check for a negative value. Make
sure our offset increments as we step through each item. This should
avoid large/inifinite loops.
Fix the size of hf_dnp3_al_range_stop32.
svn path=/trunk/; revision=22811
setuid instead of Wireshark. Remove the "DANGEROUS" notices, but leave it
disabled by default. Whine if the user runs Wireshark or TShark as root.
Add a preference to disable the whining. Add a "setuid-root" script that
can be used to switch dumpcap and TShark's setuid-ness on and off for
development and testing. Update the release notes and README.packaging.
svn path=/trunk/; revision=22733
Add a section introducing wslua and how scripts are loaded (to be completed).
svn:ignore wsluarm (a dummy file to mark the generation of the various components of the reference manual)
svn path=/trunk/; revision=22375
This new code adds a save button to the Statistics IO Graphs window and
is also reusable by any other code that uses GDK Pixmaps to draw graphs.
The Gdk-pixbuf library included in GTK is used for this save function.
svn path=/trunk/; revision=22166
process WEP keys. Allow the "wep:" prefix for WEP keys even when
HAVE_AIRPDCAP isn't defined. Add a NULL pointer check to
hex_str_to_bytes(). Fixes bug 1584.
Fixup indentation.
svn path=/trunk/; revision=22151
the WEP/WPA decryption code instead of re-calculating it. Fixes bug
1639.
Remove fcsPresent, radiotapPresent, and associated code from airpdcap.c
since they were always FALSE. Glib-ize some data types. Fixup white
space.
Update the release notes.
svn path=/trunk/; revision=22104
wrong timestamp. Place a cap on the amount of silence that we do
insert. This should fix bug 1580.
Update the release notes.
svn path=/trunk/; revision=21818
Fix for bug #491: Unexpected frame.time_delta behavior
This patch ... fixes bug 491. It does this by changing the
behaviour of the frame.time_delta field so it reflects the delta
time between captured packets (tshark already did this). To keep
the delta time between displayed packets, the field
frame.time_delta_displayed is created.
svn path=/trunk/; revision=21154
I did however see some small errors in the
documentation that I did not notice when I sent in the patch. This
patch corrects them and adds an accelerated key:
- table 6.1 remove "Analyze" from "Identical..." column for "Copy as Filter"
- table 6.2 add "Edit" from "Identical..." column for "Copy as Filter"
- Added accelerator key for "Copy as Filter". I chose "Shift+Ctrl+C", so
that "Ctrl+C" is still available for "standard" copy
Image figure 3.4 should be renewed, reflecting the change in the menu
structure.
svn path=/trunk/; revision=21140
I've refactored the offending code branch and added some comments so
hopefully the intent is a bit clearer. The loop termination conditions
are now obviously independent of the content on the wire (they were
meant to be before, but I admit it was obscure). I've tried using the
ephemeral memory routines.
Add a check for a maximum fragment count, and bail out of reassembly instead
of triggering an ep_alloc exception. Add Julian to AUTHORS. Update the
release notes.
svn path=/trunk/; revision=21007
I have changed the patch according to your suggestions and also changed
the doc[book] files accordingly. I tested the patch and it does seem to
work fine on my test-system.
ULFL: In addition, I've added the en-/disabling to the other (already existing) Copy menu items - some just did nothing, some crashed if nothing was selected.
I've also sligthly changed the menu seperators and made both context menus look a bit more identical.
svn path=/trunk/; revision=21005
- Note in the user's guide that export object is not available
in GTK1 builds of Wireshark.
- Make scanning through the slists more efficient
- Use new tap.c function called have_tap_listener() to only save
object payload data when the export object listener is actively
listening for it.
- Save objects in the HTTP dissector with g_malloc() instead of
se_malloc() and free it when we're done with it - when the
export object window is closed (Fixes bug #1412)
- Various minor improvements
svn path=/trunk/; revision=20980
- Add to User's Guide
- Add a help button
- Move a lot of code into the shared export_object.c file and out of
dissector specific file export_object_http.c. This will make adding
additional protocols much easier.
- Change comment in packet-http.c to reflect new name (Export Object)
- Various other minor improvements
svn path=/trunk/; revision=20961
There is an error in the page:
http://wireshark.org/docs/wsug_html_chunked/ChCapCaptureFilterSection.html
According to Example 4.2, the filter 'tcp port 23 and not host 10.0.0.5'
captures all telnet traffic not from 10.0.0.5. But this filter also discards
traffic to 10.0.0.5. Either you use this filter to capture all telnet traffic
not to and not from 10.0.0.5 or you use filter 'tcp port 23 and not src host
10.0.0.5'.
svn path=/trunk/; revision=20955
- Vista is no longer beta
- disk space min. 75MB
- be a bit more specific about no longer supported NT 4.0
- some editing
svn path=/trunk/; revision=20904
Based on comments from Ulf (http://www.wireshark.org/lists/wireshark-dev/200701/msg02802.html), have revised menu structure and labels for copying items, and updated the documentation to match.
(a) All copying now under one sub-menu in each of packet list and details panes
(b) Revised names for copy items, now the same for both panes
(c) Export Selected Packet Bytes item now in pop-up menu for packet list and details panes
(d) Removed Copy and Export from packet bytes pane; this leaves no items in the pop-up menu.
This last is because the functionality in the bytes pane was odd and inconsistent
- right-clicking would often change the selection in unexpected ways
- the export worked on the selected bytes, the copy on the whole packet
- the documentation did not reflect the functionality correctly (at least for Copy / Text Only).
svn path=/trunk/; revision=20787
the changes in r20642 to release-notes.xml. Add "news" targes to the
docbook makefiles to copy release-notes.txt to NEWS.
svn path=/trunk/; revision=20669
Mikus. Add a buf_len parameter to ip_to_str_buf(), and make sure it's
enforced. Copy the release notes over from the 0.99.5 trunk and add a
note about the ISUP dissector (which is affected by the overrun).
svn path=/trunk/; revision=20607
In the Developers Guide, Section 9.3, Example 9.17. Decompressing data
packets for dissection
The code calls tvb_set_free_cb() for the newly created next_tvb. This
is unnecessary as the call to tvb_set_child_real_data() adds next_tvb to
the chained list of tvb, thus ensuring that next_tvb is correctly
deleted. In fact when I had the call in, Visual Studio kept breaking
deep down in ntdll.dll, probably because of a double free every time the
main tvb was deleted.
In README.developer, para 2..2.7 The example conversation code doesn't
assign the result of conversation_new() back into the conversation variable.
svn path=/trunk/; revision=20569
I've added a call to dos2unix to convert check_svn_version.sh that way
Is it safe to assume that dos2unix is available on a common UNIX developer machine?!?
svn path=/trunk/; revision=20491
messy and you shouldn't do it unless you REALLY have to. Change several
routines to use standard tvb_get_* accessors instead of operating on raw
packet data. This fixes an integer overflow in dissect_vendor_ie_rsn()
found by Neil Kettle.
Use value_strings instead of duplicating their functionality with our
own routines. Print the WME surplus bandwidth allowance factor. Fix
some compiler warnings.
Update the release notes.
Some of the changes are untested due to a lack of capture data.
svn path=/trunk/; revision=20126
by myself:
Corrected patch; epan/column.c and epan/column_utils.c were not included. This
one has now been properly tested against a clean checkout of today's code.
- New menu option available under view\time display format
- New sub-option (e) to -t switch for both wireshark and tshark
- Extended recent settings code to handle new value
- Did NOT add new explicit epoch time column
svn path=/trunk/; revision=20040
menu) move to the previous and next packet even if the packet list isn't
in focus (specifically, the packet detail will stay in focus if that was
already the case). Make the return and enter keys toggle tree items in
the packet detail and the backspace key jump to the parent node. Add a
navigation section to the User's Guide.
Make SIGNAL_EMIT_BY_NAME a simple #define, so that we can feed it
multiple arguments. Fix up whitespace.
svn path=/trunk/; revision=19924
While I was reading the development guide I noticed a few typo's.
The attached patch fixes them (the patch is against revision 19724).
svn path=/trunk/; revision=19729
- The AirPcap Multi-Channel Aggregator (which is marketspeak for an "any"
device)
- Merging the 802.11 dissector WEP key list with AirPcap's
- Decrypting WEP in the adapter, in Wireshark, or not at all
Update the release notes.
svn path=/trunk/; revision=19599
and replace it with an "enable_decryption" preference.
Instead of forcing the user to specify how many WEP keys we have,
figure it out for ourselves by parsing the key list. When decrypting,
don't worry about the key index specified in the header (which resulted
in trying to decrypt using the same key twice); simply try each key in
order (which we were doing anyway).
In hex_str_to_bytes(), handle a null hex string.
Update the release notes.
svn path=/trunk/; revision=19592
move content from the README.win32 file into the wsdg. I've moved the cygwin GCC info to a new Wiki page, it seems more promissing that it's getting updated in the future.
svn path=/trunk/; revision=19548
Attached is a patch to fix some spelling mistakes in the Wireshark
User's Guide. I also fixed the author's email addresses as the
addresses did not match the right names.
svn path=/trunk/; revision=19352
Cygwin situation:
- lynx works
- elinks is not available (at least on the standard repositories)
- links and true doesn't produce any output
svn path=/trunk/; revision=19245
Look for a string that starts with "rdp". This should take care of
cases where a default capture filter is set needlessly.
Update the docs accordingly.
svn path=/trunk/; revision=19236
Other minor dependency fixes.
I didn't found a way to implement the SVN version check using make, so using a new shell script instead ...
svn path=/trunk/; revision=19173
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
-This line, and those below, will be ignored--
D docbook/edg_graphics
M docbook/developer-guide.xml
M docbook/Makefile.auto.am
A docbook/wsdg_graphics
D docbook/edg_src
M docbook/README.txt
A docbook/wsdg_src
D docbook/wsdg_src/EDG_meta_info.xml
A docbook/wsdg_src/WSDG_userinterface.xml
D docbook/wsdg_src/EDG_preface.xml
D docbook/wsdg_src/EDG_chapter_userinterface.xml
D docbook/wsdg_src/EDG_chapter_tools.xml
A docbook/wsdg_src/WSDG_meta_info.xml
D docbook/wsdg_src/EDG_chapter_env_intro.xml
D docbook/wsdg_src/EDG_chapter_capture.xml
A docbook/wsdg_src/WSDG_preface.xml
A docbook/wsdg_src/WSDG_works.xml
D docbook/wsdg_src/EDG_chapter_dissection.xml
A docbook/wsdg_src/WSDG_chapter_tools.xml
D docbook/wsdg_src/EDG_chapter_works.xml
A docbook/wsdg_src/WSDG_chapter_env_intro.xml
A docbook/wsdg_src/WSDG_chapter_capture.xml
A docbook/wsdg_src/WSDG_chapter_dissection.xml
D docbook/wsdg_src/EDG_chapter_build_intro.xml
D docbook/wsdg_src/EDG_chapter_libraries.xml
A docbook/wsdg_src/WSDG_chapter_build_intro.xml
A docbook/wsdg_src/WSDG_chapter_libraries.xml
D docbook/wsdg_src/EDG_chapter_sources.xml
A docbook/wsdg_src/WSDG_chapter_sources.xml
M docbook/Makefile
svn path=/trunk/; revision=18368
Gerald Combs