During a regular Wireshark trace of UCP packets running over ethernet, I noted
that Wireshark said the login packet was malformed, even though it looked OK
and the server responded correctly. After looking at the UCP protocol, it
became clear that Wireshark was parsing a type 60 message which only has one
Reserverd field (RES1) and expecting it to have two Reserved fields (RES1 and
RES2) like a type 61 message. This is because it is using the same function to
parse both messages, and does not have a conditional for the type 60 field.
svn path=/trunk/; revision=23903
there are many reasons why some protocols actually need to be able to access the pinfo structure while determining the pdu size
svn path=/trunk/; revision=19751
- Add TCP reassembly to get the proper packet length
- Add "result = check_ucp(tvb, &endpkt);" in dissect_udp_commong to fill some variables used.
svn path=/trunk/; revision=17843
Also move ncp222.py, x11-fields, process-x11-fields.pl,
make-reg-dotc, and make-reg-dotc.py.
Adjust #include lines in files that include packet-*.h
files.
svn path=/trunk/; revision=11410
Jeff Morriss