Commit Graph

135 Commits

Author SHA1 Message Date
Gerald Combs d7cbea9428 TShark: Add a "-E bom=" option.
Add an option to print the UTF-8 BOM.

Change-Id: I3d30c67852b9b89d1548b0f957d97fd8e8741049
Reviewed-on: https://code.wireshark.org/review/15318
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2016-05-11 17:30:33 +00:00
AndersBroman 505bf5945b [tshark] Document -U option and create a list of tap names when entering
an empty name "".

Change-Id: I2b8332ff6900c8a88514a25a416f342d7b696d34
Reviewed-on: https://code.wireshark.org/review/15332
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-05-11 11:27:49 +00:00
Gerald Combs ae4a912af0 TShark: Convert TTY output.
If we detect that we're writing to a TTY and that it doesn't support
UTF-8, convert our output to the current code page on UNIX/Linux or
to UTF-16LE on Windows. This helps to ensure that we don't fill users'
screens with mojibake, along with scrubbing invalid output.

Add a note about our output behavior to the TShark man page. Add a note
about the glyphs we should and shouldn't be using to utf8_entities.h.

Bug: 12393

Change-Id: I52b6dd240173b80ffb6d35b5950a46a565c97ce8
Reviewed-on: https://code.wireshark.org/review/15277
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Graham Bloice <graham.bloice@trihedral.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-05-09 04:11:29 +00:00
João Valverde e005bc819c Remove synchronous DNS name resolution
Change-Id: Ie5e670b769eb0674950f3679ef511047641c2873
Reviewed-on: https://code.wireshark.org/review/14751
Petri-Dish: João Valverde <j@v6e.pt>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-04-04 06:49:55 +00:00
Mike78 ef752689da Allow/Create an option to use "capture filter" labels defined in wireshark GUI from CLI
Move ui/filters.[ch] to filter_files.[ch] because dumpcap is using functionality.

Bug: 8091
Change-Id: I195c82fc023f97d6f331b8718c45a2d83d30faea
Reviewed-on: https://code.wireshark.org/review/5925
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-01-27 13:40:24 +00:00
Jeff Morriss cd7387d22b Add a "fieldcount" report to tshark -G to let us easily see how many fields
are registered.

Change-Id: I06f10d96916640cb9a782cae87898a5dd6c9c6e3
Reviewed-on: https://code.wireshark.org/review/10601
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-09-23 04:38:01 +00:00
Pascal Quantin 1772416170 tshark.pod: fix typo
Change-Id: Iba5f12637e0f494805f2d9aab370fb42a32c1cb9
Reviewed-on: https://code.wireshark.org/review/10335
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2015-08-31 20:12:41 +00:00
Hadriel Kaplan 190e313e9d DNS: move DNS name resolution pref to Name Resolution prefs
Move the boolean flag for using captured DNS packet info for name resolution
to the Name Resolution preferences settings, as it was rather surprising to
disable Name Resolution preferences and still have names being resolved. Also
disble them all if the '-n' command line switch is used, and re-enable it for
a 'd' character in the '-N' option.

Bug: 10337
Change-Id: Ie4d47bab0100db3360cc447cd3e446b2e39aa917
Reviewed-on: https://code.wireshark.org/review/9786
Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com>
2015-07-25 17:05:01 +00:00
Michael Mann 120ed14f34 Add documentation for new enable/disable protocol and heuristic dissector options.
Change-Id: Ia31326105cf559c2196d45369270552fb78da6c7
Reviewed-on: https://code.wireshark.org/review/9692
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-07-22 07:12:28 +00:00
Gerald Combs fdb85029fd Add ServiceResponseTimeDialog.
Add ServiceResponseTimeDialog as a subclass of TapParameterDialog,
similar to StatsTreeDialog. Add initial plumbing for statistics menu
items and command line invocation.

Don't append "..." to menu item names. Don't add menu icons. In each
case this avoids repetitive UI clutter.

Change-Id: I463b95c93090160bb81d2e80b16aad389dc0bd6c
Reviewed-on: https://code.wireshark.org/review/8864
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-07-03 23:09:13 +00:00
Pascal Quantin e28339e590 tshark: add ability to display streams in EBCDIC
As requested in https://ask.wireshark.org/questions/42958/tshark-follow-tcp-stream-for-ebcdic

Change-Id: Ia8d93f59aa038bd6328adea137c92ea5a52361b5
Reviewed-on: https://code.wireshark.org/review/8844
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-06-09 04:00:01 +00:00
Jeff Morriss 2772a11bd5 Document the services file in the man pages.
Bug: 11227
Change-Id: Id9cc64820b238bd8c82a758a553e1352398ad885
Reviewed-on: https://code.wireshark.org/review/8664
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-05-28 04:10:08 +00:00
Jeff Morriss d9c13fab51 Document the subnets file in the man pages.
Text adapted from that in the WSUG documentation of the same.

Ping-Bug: 1445
Ping-Bug: 11227
Change-Id: I4d07cba437e70324d19c5ae23e44b86c47b749a8
Reviewed-on: https://code.wireshark.org/review/8662
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-05-28 04:08:06 +00:00
Gerald Combs cac102eee3 Change a lot of http:// URLs to https://.
Most of our sites are now HTTPS-only. Update URLs accordingly. Update
other URLs while we're at it. Remove or comment out dead links.

Change-Id: I7c4f323e6585d22760bb90bf28fc0faa6b893a33
Reviewed-on: https://code.wireshark.org/review/7621
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-03-10 19:30:50 +00:00
Jeff Morriss 0b0f7fa091 More emem removal.
Remove emem's 8-byte-memory-alignment configure check as well as references
to all the environment variables emem used.

Change-Id: I897aec9e9c68e064454561e7a9f066b18892ec66
Reviewed-on: https://code.wireshark.org/review/6950
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-02-06 08:11:49 +00:00
Dario Lombardo 9bbc337306 Added HPFEEDS stats_tree.
Change-Id: I256fd5395b062fa954ebd60598721323ea1d7ff1
Bug: 10875
Reviewed-on: https://code.wireshark.org/review/6713
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-01-27 13:19:20 +00:00
Dario Lombardo 696fcdba21 Added DNS statistics support
This affects both the dissector (that has been added with a tap interface and a stats generator) and the UI (to recall the stats menu).

Change-Id: I90658f7aa6707aa39bdd787a51b20fed4dbddc53
Reviewed-on: https://code.wireshark.org/review/6236
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-01-05 09:06:32 +00:00
Michael Mann 860cb393d8 tshark: Add endpoints statistics
"stat name" has been official changed to "endpoints" for all dissectors, rather than a mixture of "host"/"endpoints" based on dissector.

Change-Id: If34bcb5165b493948e784ba038ab202803a59843
Reviewed-on: https://code.wireshark.org/review/6154
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-01-02 00:02:18 +00:00
Pascal Quantin 0d414e5d7f Add ability to follow UDP stream by index
-z "follow,udp" tshark cli command now supports a stream index
It is now possible to select the UDP stream displayed in Qt GUI (like for TCP)

Change-Id: Ia367f36ea4f60db0fddb997a7e0903c09e172f2d
Reviewed-on: https://code.wireshark.org/review/6083
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2014-12-29 22:17:47 +00:00
Guy Harris 25f950eca9 Add tshark -G dissector-tables to dump a list of dissector tables.
That list doesn't show the entries in the dissector tables, just
information about the tables themselves.

Clean up some tshark man page issues while we're at it.

Change-Id: I70beee34110f5c0d58105944dd71105a8400f5ca
Reviewed-on: https://code.wireshark.org/review/5360
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-11-17 02:26:57 +00:00
Gerald Combs 175039128a Update the doc directory to use https://www.wireshark.org.
Change-Id: I9bfc57cb6b6ab6962b80ff58d98eb351d6f69829
Reviewed-on: https://code.wireshark.org/review/4140
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2014-09-17 00:12:26 +00:00
Jeff Morriss e0461ecd43 Indicate tshark can read (-r) from stdin and named pipes now.
(Though it works only with certain formats.)  As requested in:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2874#c4

Change-Id: I2ce0509d8750b21ae0167d12459074ba0f9506f8
Reviewed-on: https://code.wireshark.org/review/2646
Reviewed-by: Evan Huus <eapache@gmail.com>
2014-06-25 18:01:28 +00:00
Jeff Morriss f113306e0e More Python-bindings removal.
Change-Id: I4d82175781e65c73179f4c8e737a7900cb050bce
Reviewed-on: https://code.wireshark.org/review/2283
Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>
2014-06-16 23:14:05 +00:00
Hadriel Kaplan 7e423a3a1f Add read_format extension to manual pages
The -X read_format extension was added in code but in the manuals.

Change-Id: I21692120229ef531671fc3db247809ace69d23b3
Reviewed-on: https://code.wireshark.org/review/742
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-03-19 17:03:42 +00:00
Hadriel Kaplan 58fe488822 Lua: add ability for scripts loaded from command-line to be passed arguments
This change adds the ability to pass on to lua scripts loaded from the
command-line (tshark or wireshark) additional arguments supplied by the
command-line.  This will help us in our testsuites, but also might be
useful for user-created scripts.  The additional arguments are passed in
using the '-X' eXtension switch.

Change-Id: Ib94cdf1ffd194ca84692fee7816665e4ff95efbd
Reviewed-on: https://code.wireshark.org/review/156
Reviewed-by: Evan Huus <eapache@gmail.com>
Tested-by: Evan Huus <eapache@gmail.com>
2014-02-13 22:32:58 +00:00
Bill Meier 8ab9c55618 From Ville Skyttä: Spelling Fixes
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9591


svn path=/trunk/; revision=54387
2013-12-23 15:53:13 +00:00
Chris Maynard 4c19d29b7c Improve tshark command-line error help. Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9548 and adds addtional help, better formatting, sorting and some minimal documentation of the -u option to the tshark man page.
svn path=/trunk/; revision=53938
2013-12-11 16:52:40 +00:00
Chris Maynard 93f15d640c Specify SI units for the max filesize autostop condition. For now, keep the capture buffer size in IEC units, but document it as such.
#BACKPORT(1.10, 1.8(?))

svn path=/trunk/; revision=53728
2013-12-02 19:17:12 +00:00
Guy Harris 2a088c1d53 Add support for displaying dates as year and day-of-year (1-origin).
In the process, fix various man page descriptions of the -t flag,
and add support for UTC absolute times in the iousers and iostat TShark
taps.

svn path=/trunk/; revision=53114
2013-11-06 20:39:09 +00:00
Chris Maynard 63e4539229 From Ed Beroset via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9272
Add tshark -G column-formats report and document the missing ftypes, heuristic-decodes and plugins reports.

From me: Sort the reports.  Add modelines to epan/column.c.  Minor whitespace changes.

svn path=/trunk/; revision=52627
2013-10-15 18:27:35 +00:00
Michael Mann ba3e8e070a Make column "filter name" prefixed with _ws. to be the same as other "*shark application filters" created in r52462.
svn path=/trunk/; revision=52474
2013-10-09 19:43:02 +00:00
Jeff Morriss a4882cdcfe Add WIRESHARK_APPDATA description to the rawshark and tshark man pages.
svn path=/trunk/; revision=52024
2013-09-13 21:15:29 +00:00
Chris Maynard bc654875f0 Handle the 2GiB boundary case of the max filesize autostop condition properly so that we avoid overflow conditions and so that we ensure we don't capture more than 2GiB. Also, document the max filesize autostop value of 2GIB as well as indicating that it's truly GiB and not GB.
This fixes the problem reported on ask: http://ask.wireshark.org/questions/23891/wireshark-wont-run-with-multiple-capture-files

#BACKPORT(1.10) ... not sure about 1.8?

svn path=/trunk/; revision=51576
2013-08-29 18:15:13 +00:00
Chris Maynard 41f444ef87 Move the description of the -Y <displaY filter> option to maintain a proper sort.
svn path=/trunk/; revision=51238
2013-08-09 15:26:48 +00:00
Martin Kaiser 11643ecc83 add --capture-comment to tshark's manpage
fix a typo in the dumpcap manpage

svn path=/trunk/; revision=51096
2013-08-01 21:21:35 +00:00
Guy Harris a4ad9e9f74 If a core Wireshark developer repeatedly can't remember that the
argument to the -F flag for pcap format is "libpcap", not "pcap", we
have a problem.  Make it "pcap", and add a backwards-compatibility hack
to support using "libpcap" as well.

Update the man pages to refer to it as pcap as well, and fix the
capitalization of "WinPcap" (see http://www.winpcap.org) while we're at
it.

Also, refer to http://www.tcpdump.org/linktypes.html for the list of
link-layer header types for pcap and pcap-ng.

svn path=/trunk/; revision=50989
2013-07-28 21:12:07 +00:00
Jeff Morriss 36d3734dcb From Jim Young via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8906 :
This patch augments Wireshark's and tshark's augument usage reports (-? and
-t?) and the Wireshark and tshark man pages to list all available timestamp
options available for the -t option.

svn path=/trunk/; revision=50445
2013-07-08 16:25:13 +00:00
Jeff Morriss 470bd4455a Add a new environment variable to cause abort()s if we add too many items
to the tree (to separate this case from the generic DISSECTOR_BUG case).

Enable this environment variable when fuzz testing.

Enable the 3rd (without tree but with a read filter) check (added in r49643)
when testing capture files but not when fuzz testing--not sure if we want to
add even more to the fuzzbot's work load now (OTOH I've been running it for
a while and it hasn't buried me in bugs).

svn path=/trunk/; revision=49784
2013-06-05 14:08:40 +00:00
Chris Maynard 08b0f7296a If tcpdump doesn't exist, why refer to it? Omit this confusing phrase.
svn path=/trunk/; revision=49427
2013-05-20 02:21:07 +00:00
Evan Huus 7e0082988b At the suggestion of Stuart Kendrick via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8647
Improve documentation for tshark's -z io,stat somewhat so that it's clear(er)
that filters for the statistics must be associated with the -z flag and not
applied via -Y.

svn path=/trunk/; revision=49422
2013-05-19 19:49:36 +00:00
Jeff Morriss 2602490a2d From Niels de Vos via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8626 :
It is useful to see not only the minimal, maximum and average service time for
RPC procedures, but also the total time these took.


From me: add it to the man page.

svn path=/trunk/; revision=49144
2013-05-03 13:53:16 +00:00
Jörg Mayer 6c137314aa Add col. pseudo dissector to thsark manpage.
svn path=/trunk/; revision=48931
2013-04-19 16:36:52 +00:00
Chris Maynard 4ac2441d7c Coalesce "-G fields2" and "-G fields3" into "-G fields", as discussed on -dev.
See: http://www.wireshark.org/lists/wireshark-dev/201304/msg00015.html

svn path=/trunk/; revision=48753
2013-04-05 21:58:43 +00:00
Evan Huus 2fba8c0f9d Update -2, -R and -Y to behave consistently as per the concensus reached on
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8223

Mention the new -Y flag and associated changes in the release notes.

svn path=/trunk/; revision=48654
2013-03-30 15:38:03 +00:00
Evan Huus d935a280e3 From Hadriel Kaplan via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8223
Add a 2-pass display-filter flag to tshark so that reassembly and other forward-
looking dissections can be used with filters.

It's a bit of a hack, but this entire area of 2-pass analysis etc. is a giant
pile of hacks to begin with and needs cleaning up. For now just having this
feature is a big enough win.

svn path=/trunk/; revision=48589
2013-03-27 17:14:42 +00:00
Chris Maynard 63b578b182 Updated tshark man page and release notes to document the change in '-x' behavior with r45715.
svn path=/trunk/; revision=48456
2013-03-21 17:30:35 +00:00
Evan Huus 8de4b82fcd Document the wmem override environment variable in the man pages, and improve
README.wmem in a couple of places.

svn path=/trunk/; revision=48251
2013-03-11 19:17:26 +00:00
Jeff Morriss 965cb6384e Followup to r48218: remove documentation of the WIRESHARK_DEBUG_USE_SLICES environment variable.
svn path=/trunk/; revision=48249
2013-03-11 18:04:46 +00:00
Jeff Morriss 018ba4ea65 Default capture buffer size is now 2MB.
svn path=/trunk/; revision=47937
2013-02-28 13:59:47 +00:00
Chris Maynard 503cab9ff7 From Edwin Groothuis via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8353 : Document http-related '-z' statistics; also add document -z help.
From me: Don't print an error message for "-z help".

(Only "http,stat," is suitable for backport to 1.8 and 1.6)

svn path=/trunk/; revision=47763
2013-02-20 03:06:46 +00:00