progress, but the beginnings of one exist (it's far from ready for prime
time, but it does read in capture files a lot quicker and consumes a
fair bit less memory).
Get rid of the item about a line-mode capture program - that's
Tethereal.
Get rid of the "Make lines in GTK Tree (proto_tree GUI) user-selectable"
item, as they're now user-selectable.
Put back the item about Kerberos V4 - we hae a V5 dissector, but no V4
dissector yet.
svn path=/trunk/; revision=2377
- add some missing Vines IP header fields in protocol tree
- add protocol type as display filter
- miscellaneous code cleaning
svn path=/trunk/; revision=2374
Add OLD_CHECK_DISPLAY_AS_DATA().
Add display filters.
Check the magic cookie to see if the decoding or frame is correct
(in most cases, we probably need TCP reassembly).
svn path=/trunk/; revision=2371
encapsulation type codes - for those libpcap type codes whose numerical
value is interpreted differently by different versions of libpcap,
include <pcap.h> if you can and, if you can, use what it defines to
control which Wiretap code we map those type codes to.
Also, map the new libpcap type codes introduced by libpcap 0.5.
svn path=/trunk/; revision=2369
examples of errors that generate core dumps, and suggest that a stack
trace from the debugger could be useful for *all* failures that produce
core dumps.
Note that the core dump file may be named "ethereal.core", and note that
"tethereal" rather than "ethereal" should be used in file names if it's
Tethereal that blew up.
svn path=/trunk/; revision=2368
capture, clear the per-frame data pointers of all frames in the capture,
as those pointers now refer to data that's been freed.
Do that to all frames even if the user stops the rescan in the middle -
and clear the "visited" flag for all frames as well.
svn path=/trunk/; revision=2361
- frame numbers are 1-origin, so 0 can be used as an "exception" value.
In the protocol tree for a reply, don't say that the reply is to frame
N, just say that it's to a request starting in frame N - a frame can
contain more than one request, and a request may take more than one
frame.
svn path=/trunk/; revision=2360
redissecting the packets due to some preference changing, as the
preference may affect what state information gets constructed as a
result of some particular frame being dissected.
We don't have to do it when filtering the packets, or colorizing them,
however.
svn path=/trunk/; revision=2359
number of replies seen, keep the frame number of the first request seen
for that call and the first reply seen for that call. Use that to
determine whether a request or reply is a duplicate or not.
That means that we don't have to reset the table of RPC calls on a
rescan of the capture (which didn't even fix all the cases where we'd
have misreported the original call or reply as a duplicate due to having
seen it once on the initial pass through the file and once again when,
for example, the user clicked on the packet); doing so causes plenty of
other problems, so don't do that - and don't clear the "visited" flag on
frames on a rescan, either, as that's only done because we were clearing
out conversations and calling all protocols' "init" routines.
As a free bonus, this means that, for a reply, we know what frame the
request was in; put that information into the protocol tree for the
reply, snoop-style.
Make the table of RPC call information, and the routines that manipulate
it, static to "packet-rpc.c"; nobody outside "packet-rpc.c" uses them.
svn path=/trunk/; revision=2358
pointer to a null-terminated string; you get back a null pointer if the
octet string is zero-length, and even if it's not zero-length there's no
guarantee that the string is null-terminated.
svn path=/trunk/; revision=2357
It appears to be a buglet in GTK+; by explicitly calling gtk_widget_show()
on the menu item, it comes out with proper spacing. Previously I simply
used gtk_widget_show_all() on the topmost vbox, and while the option menu
menu-items showed, they came out with incorrect vertical spacing.
svn path=/trunk/; revision=2356
cleanup functions for the cases in which an exception is thrown but not
caught in a region where cleanup needs to occur.
Use these macros in proto_tree_add_item, where we need to free the field_info*
in case an exception is thrown when accessing the tvbuff.
svn path=/trunk/; revision=2355
selection dialog, the colors are saved with null values.
So do not call fetch_colors if the colors_changed boolean
is FALSE ...
svn path=/trunk/; revision=2350
Add a boolean that will be set to TRUE if the user hit OK
in the font selection dialog. And do nothing about fonts
in the apply routine if the font dialog has not been used
by the user. This gets rid of a warning which was displayed
each time the preferences are "OK, Saved or cancelled"
and that whether the user has used the font selection
dialog or not (which was very annoying) ...
svn path=/trunk/; revision=2348
until the GUI-preferences fetch routine is called, and don't re-colorize
marked packets until the GUI-preferences apply routine is called;
those preferences shouldn't take effect until the user clicks "OK" or
"Apply", as that's the way other preferences work.
Treat a request to close the color selection dialog the same as a click
on the "Cancel" button.
svn path=/trunk/; revision=2346
for the dialog window as an argument (as various dialog creators in GTK+
do), not oblige every caller of it to cut-and-paste a
"gtk_window_set_title()" call after it.
svn path=/trunk/; revision=2345
This allows the display of a short field description (and
field abbreviation) in the status bar when a field is selected
in the protocol tree window.
The description is the blurb field when available (i.e. not empty),
the name otherwise.
When the item is unselected, the file context (e.g. the file name)
is restored.
Now it is much easier to build a display filter without the manual ;-)
svn path=/trunk/; revision=2343
Currently, it allows the selection of the foreground and
background colors of the marked frames but it could be
extended further (e.g. color of normal frames).
Add update_marked_frames() in main.c to update the
display (e.g. colors) of marked frames.
svn path=/trunk/; revision=2339
to proto_tree_add_item() will indicate if the length of the string is
indicated by an UINT8, UINT16, UINT24, or UINT32.
Change NCP dissector-maker to produce FT_UINT_STRING.
Fix off-by-one in dissection of some NCP reply packets.
svn path=/trunk/; revision=2334
the influenza virus, if "wtap_pcap_encap_to_wtap_encap()" returns
WTAP_ENCAP_UNKNOWN, indicating that the libpcap encapsulation type can't
be mapped to a Wiretap encapsulation type, include the data link type in
the message, so the user can at least give us a clue as to what type it
is that we don't support (or, at least, the DLT_ value for that type -
it could well be some standard type whose value just got gratuitously
changed).
svn path=/trunk/; revision=2333
example, "fdata->pfd" doesn't contain junk that upsets dissectors that
try to attach data to the frame (not that it does them much good in
Tethereal, as the frame is never revisited).
svn path=/trunk/; revision=2331
Gilbert Ramirez