this module was never really finished and was therefore semi-useless.
disabled now since the change to samr broke it and the real fix to
unbreak it would be a substantial rewrite of it
(and adding a nice gui so one can see which sids are mapped...)
disabled it but did not remove it since i do think the module is
useful IF it is completed with a lot more operations.
svn path=/trunk/; revision=22271
add a fix for ack/seq tracking when the tcp is broken and sends a
non-zero ack field for SYN packets.
add a warning to the dissect pane that illustrates that these are broken
packets
svn path=/trunk/; revision=22267
Attached is a patch that fixes bug 1670 and related issues.
For the BACnet GetEventInformation-ACK request dissector:
1. Corrected BitString decoding for acknowledgedTransitions and eventEnable.
2. Corrected the ability to decode more than one event.
3. Grouped each item of the sequence using subtrees. Added more informative
text to Priority and Timestamp.
4. Corrected eventState to use BACnetEventState enumeration instead of
BACnetEventStateFilter.
svn path=/trunk/; revision=22262
First patch is only to reindent the packet-mip6 files.
Second patch adds PMIPv6 options (draft-ietf-netlmm-proxymip6-01.txt) and Mobile Node Identifier Option (RFC4283).
svn path=/trunk/; revision=22258
This patch adds an option to packet-ber to show unexpected tags/data as unknown BER. It also fixes some offset/length combinations when adding the error message to the tree.
svn path=/trunk/; revision=22244
It provides basic dissection of the text-based protocol, providing fields for filtering.
It also calls the multipart dissector for any MIME body that is found.
It includes very basic support for MIXER (RFC 2156) fields.
It also registers itself as "message/rfc822" in the media type table.
svn path=/trunk/; revision=22241
apparently broken and send 64 bytes for these fields.
mark these packets in the decode pane that the isns host is broken
change the calculation of offset to just increment it by tag size len
size and length one at the very end of the attribute dissector
svn path=/trunk/; revision=22236
over anybody who edits the sys/net80211/ieee80211_radiotap.h header on
any operating system. I also think he needs to be willing to use that
power when necessary.
svn path=/trunk/; revision=22217
Changes are only for protocol version 2.
The changes are:
- dissect "TIPC Bundler Protocol" messages correctly
- search for other dissectors which want to dissect encapsulated data according to the TIPC user or TIPC type of a message. The data dissection is difficult since a TIPC data message does not necessarily a "type" set. So for the moment - while TIPC is not widely used - just triggering for the user of a message will be sufficient for people looking into the TIPC protocol.
- "Dissect TIPC data" in the preferences is now switched on by default
- to show undissected data, the "data" dissector is now used.
- corrected some typos
svn path=/trunk/; revision=22183
a SASL encapsulated ldap blob can contain more than one LDAP message so
the rest_is_pad parameter is bogus and thus removed.
make dissect_ldap_pdu handle when we have more than one LDAP message
inside one sasl blob
svn path=/trunk/; revision=22181
receiving a SES MAJOR SYNC POINT, as this indicates the end of the
COTP DT Data stream. Previous the RTSE dissector was called when
receiving a COTP DT Data fragment with the "last data unit" bit set,
but this does not work with messages fragmented in RTSE. Reassembly
can be turned off in the preferences.
svn path=/trunk/; revision=22176
fragmented data without adding an empty data fragment.
This is used by the RTSE dissector which can't identify the
last fragment until after it has been added.
svn path=/trunk/; revision=22174
COTP DT Data (class 1) fragment in the same frame. Also added the
generated dst_ref and a reference to the "COTP segment data" to the
tree.
svn path=/trunk/; revision=22173
process WEP keys. Allow the "wep:" prefix for WEP keys even when
HAVE_AIRPDCAP isn't defined. Add a NULL pointer check to
hex_str_to_bytes(). Fixes bug 1584.
Fixup indentation.
svn path=/trunk/; revision=22151
Sometimes edonkey packets comes joined, and wireshark display only last
one on column Info. Now everyone is displayed.
svn path=/trunk/; revision=22143
- the Facility is not bellow the facility itself, but at the end of the tree.
It's not a problem, but it looks strange.. - Fixed
svn path=/trunk/; revision=22141
For the Cancel Location message, you can replace the
old_CancelLocationArgV2 by the Identity message.
So the old syntax for Cancel Location is not used anymore.
For the message Send Authentication Info Res, there is a typo error. The "item" should not be used.
- one with the decoding of "processUnstructuredSS-Data", the IA5 string
is not decoded/displayed.
This should go into 0.99.6.
svn path=/trunk/; revision=22135
packet-smb.c(5479) : error C2220: warning treated as error - no object file generated
packet-smb.c(5479) : warning C4244: '=' : conversion from 'unsigned short ' to 'unsigned char ', possible loss of data
packet-smb.c(5480) : warning C4244: '=' : conversion from 'unsigned short ' to 'unsigned char ', possible loss of data
svn path=/trunk/; revision=22134
- Remove ethertype preference from recently added FCoE dissector
Me:
- Add Joe to the AUTHORS list
- Change previous line in AUTHORS list from @ to [AT] in e-mail address
svn path=/trunk/; revision=22133
Please find attached a patch to fix some bugs in the armagetronad
dissector. More specifically:
* Update the descriptors to armagetronad-0.2.8.2.1, the file
src/network/Makefile.in does not exist anymore in the armagetronad
source code.
* Ensure the printed data is null terminated.
* Avoid guint16 overflow because of the '* 2'.
* Remove a statement with no effect (data = NULL).
svn path=/trunk/; revision=22131
Attached is a small patch that adds a preference option to allow the SQL
Query string to be appended to the INFO column display. This makes life
a little bit easier when scanning a trace to find the packet associated
with a specific query. I thought it was better to implement it as a
preference option with default set FALSE as it can clutter up the
display for applications that generate large amounts of queries.
svn path=/trunk/; revision=22130
Currently the MySQL dissector assumes that an OK-Packet Response
contains the Server_Status field. Having checked the MySQL protocol page
I can't say conclusively whether it should or it shouldn't, however I've
come across a couple of MySQL Java clients that receive the OK-Packet
without the Server_Status field set in response to a "SET AUTOCOMMIT" call.
The attached patched simply adds a check to ensure the Server_Status
field is present before calling function mysql_dissect_server_status.
svn path=/trunk/; revision=22129
I added 5 new packets to packet-edonkey.c and improve 2. Diffs in
attachment. This part of wireshark (decoding emule packets) it's not
finish as I see :) I try to do it, meybe... :)
svn path=/trunk/; revision=22128
the WEP/WPA decryption code instead of re-calculating it. Fixes bug
1639.
Remove fcsPresent, radiotapPresent, and associated code from airpdcap.c
since they were always FALSE. Glib-ize some data types. Fixup white
space.
Update the release notes.
svn path=/trunk/; revision=22104
Attached is a patch file for the PANA protocol dissector. The changes updates the packet-pana.c dissector to support draft-ietf-pana-pana-15.txt.
svn path=/trunk/; revision=22098
not unique between ANSI and ITU so we end up with incorrect behavior. In
particular:
- In non-ANSI if GTI==0x1, don't try to decode TT, NP, and ES.
- In ANSI don't decode the O/E indicator on GTI==0x1.
- In non-ANSI don't decode NAI on GTI==0x1 or 0x4.
svn path=/trunk/; revision=22090
anywhere else). Instead of using getaddrinfo() and getnameinfo(),
promote inet_pton.c and inet_ntop.c to the top level and use those
routines instead.
(It's 2007, for crying out loud. Why is this even an issue?)
svn path=/trunk/; revision=22075
The code for reading ERF files has not been significantly
updated since 2004. This patch brings it up to date with a
number of changes.
1) Increase number of decodable ERF types from 7 to 12. This
covers newer DAG card models and firmware updates.
2) Fix timestamp conversion. Was calculating only microsecond
precision, now displaying with nanosecond resolution. Hardware
precision is 7.5 to 30 ns depending on model.
3) Allow the user to specify HDLC encapsulation as 'chdlc',
'ppp_serial', 'frelay' or 'mtp2'. This is needed because the
ERF HDLC capture formats do not include information on what
protocol is used at the next level. This is currently done via
an environment variable 'ERF_HDLC_ENCAP' and is analagous to the
existing 'ERF_ATM_ENCAP' variable.
If the user does not specify an HDLC encapsulation it tries to
guess, and falls back to MTP2 for backwards compatibility with
Florent's existing behaviour.
I know environment variables are ugly, suggestions are welcome.
4) When reading HDLC captures as MTP2, use
WTAP_ENCAP_MTP2_WITH_PHDR rather than WTAP_ENCAP_MTP2. This
allows us to put the 'Multi-Channel ERF' record 'channel
number' field into the MTP2 pseudo header > 'link_number'
field. This is then displayed in Frame information, and can
be filtered on. (Would be nice if it could be made a display
column?)
Because the ERF record does not specify whether Annex A is used
or not, we pass MTP2_ANNEX_A_USED_UNKNOWN and allow the existing
user preference to decide.
Move the MTP2_ANNEX_A_ definitions into Wiretap, make the annex_a_used
field a guint8, and change MTP2_ANNEX_A_USED_UNKNOWN to 2 so it fits in
a guint8. (This means that if you can save an ERF MTP2 file as a
libpcap file, the pseudo-header will have MTP2_ANNEX_A_USED_UNKNOWN in
it.)
svn path=/trunk/; revision=22067
Following items are changed:
*) Bandwidth efficient decoding re-implemented with expert-info support.
The old implementation supported a single frame only.
*) Support for AMR-WB added
*) Fixes for IF1 and IF2 decoding
svn path=/trunk/; revision=22066
(the old one was mapping file handles that differed only by one bit to
the same hash value; the new one mapped them to different hash values).
svn path=/trunk/; revision=22065
The attached patch adds a small enhancement for the ETHERNET Powerlink
dissector (some well-known CANopen device profiles are decoded in human
readable plaintext in the IdentResponse frame).
svn path=/trunk/; revision=22061
attributes specified at open time, have them take a length value, and
pass 4 if the values are extracted from the current packet and 0 if they
come from values saved when the FID was opened (as they're generated
values not found in the packet) - that fixes bug 1638.
svn path=/trunk/; revision=22053
of the function was missing from the call for monitorRouteRequest. It
also appears that the wrong function was being called for
monitorRouteReport.
svn path=/trunk/; revision=22049
These changes allow the packet list clist to be destroyed and recreated
with the new column titles/values/order that the user changed in the
preferences without restarting Wireshark.
svn path=/trunk/; revision=22038
