Attached is a dissector for CN/IP protocol described in EIA-852. It is mainly
used to encapsulate and send Lontalk (EIA-709.1) or EIA-600 frames over UDP (or
TCP).
This dissector can only decode the common header and data frames can be decoded
by further dissectors.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5907
svn path=/trunk/; revision=37596
library when no capture filter is used. Then cfilter is NULL and
capture_loop_init_filter() does not call compile_capture_filter() and
pcap_setfilter(). Providing an empty string instead of NULL works around
the problem.
svn path=/trunk/; revision=37588
Add the following enhancements to the UMTS RLC dissector
(as specified in 3GPP 25.322 v9.2.0):
- UDP framing protocol to allow dissection of RLC PDUs over UDP (like what is
done for LTE MAC/RLC/PDCP protocols)
- 15 bits Length Indicator support (both with variable and fixed LI size)
- Poll type SUFI
- enhanced dissection of LIST, Relative List and Bitmap SUFI
- dissection of Reset and Reset Ack Control PDU
- an option to decode RLC headers only
- an option to skip SDU reassembly
svn path=/trunk/; revision=37576
I made 2 changes when merging the source into a single file:
1. Changed filtername to "siii" to match display filter fields (was quicker
than changing all display filter fields to "sercosiii"
2. Converted the "ett_siii arrays" to a single value. Each subtree doesn't
need its own ett_ value.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5990
svn path=/trunk/; revision=37574
stated it had at SNIA years ago.
Example :
tshark -n -r ../captures/smbwrite.cap
-z "io,stat,0.001,LOAD(smb.time)smb.time" -q
svn path=/trunk/; revision=37567
When Wireshark attempts to read an SNMP packet with a variable-bindings item
with an OID containing an index string which includes an entry of type
"Unsigned32", Wireshark will stop dissecting the packet at this index entry and
end with the error:
[Dissector bug, protocol SNMP: proto.c:2761: failed assertion
"DISSECTOR_ASSERT_NOT_REACHED"]
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5883
svn path=/trunk/; revision=37558
1.) The resolution of the time values displayed by tshark's "-z io,stat, ..."
should be increased from milliseconds to microseconds (from 3 to 6 decimal
places) in order to be consistent with -z relative time-related options such as
"-z smb,rtt" and "-z rpc,rtt" which display values to 5 decimal places.
[Please note that separate enhancement requests for 6 decimal of precision in
Wireshark will be submitted shortly.)
2.) The "frames bytes" column displayed in '-z io,stat' is too narrow, frames
and bytes should each have 15 spaces like all the other column types.
3.) The types "FRAMES" and "BYTES" should be added to allow users to display
these values separately and allow for filters to be specified.
4.) The 'SUM' option should allow for relative time values such as SRTs to be
summed. This would be useful for the calculation of such things as
request concurrency (total_SRT_time / duration).
5.) The tshark man page needs some corrections and readability improvements
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4915
svn path=/trunk/; revision=37555
I made the following improvements to the Modbus/TCP dissector:
1. Implemented protocol to the latest specification (v1.1b). See
http://www.modbus.org/specs.php.
2. Upgraded to "tcp_dissect_pdus" instead of having the dissector do it
manually. This also provides TCP packet reassembly support.
3. Removed support for UDP port 502 because it's not supported by the protocol
specification. I believe "Decode As..." could be used in its place.
4. Added dissector support for the following function codes:
a) 8 - Diagnostics
b) 11 - Event Counter
c) 12 - Event Log
d) 43 - Encapsulation Transport (mostly for 43/14)
5. Removed support for function codes not in the protocol specification. None
of them were really being parsed, they just offered a "name" for the function
code.
6. Moved protocol #defines to header file for access from other dissectors. I
plan to have other dissectors use this, but one patch at a time.
7. Created "modbus" dissector that is accessible to other dissectors.
8. Renamed base "display filter name" to reflect PROTOABBREV.
I removed defines for value_strings, I think it's better to export the vaöue strings if needed.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5923
svn path=/trunk/; revision=37539