- Dissect ICQ TLV values
- Dissect channel 1 and channel 2 messages correctly in Oscar (required
for dissecting direct connections)
svn path=/trunk/; revision=12072
move CIP protocol to own dissector
clean up code and fix variable names
add more info to info column
fixed decoding of embedded messages in Unconnected send and
Multiple Service packets
add more info to path decoding
add more filter options/clean up
complete CIP vendor codes
svn path=/trunk/; revision=12070
append MPLS fields and values to the MPLS Header subtree;
correct the string displayed for MPLS Label;
don't show non-reserved MPLS label values as "Unknown".
svn path=/trunk/; revision=12065
- Dissect the DC (Direct Connection) info structure
- Dissect the complete buddy icon family (you can now save buddy
icons as .JPG's/.PNG's directly from the capture using the "Export
selected bytes..." option!)
- Add a function that dissects a sequence of TLV's instead of having
while() loops all over the place.
svn path=/trunk/; revision=12063
Remove some code duplication from the Oscar dissector (reduces
the number of lines by 500) by providing a custom registration
function for oscar families (aim_init_family). This also fixes
a number of issues with column names.
Add minor updates such as adding support for the Capability Info
TLV on users.
svn path=/trunk/; revision=12060
1. Fix dissection of Check Point vendor ID version field. The length was
wrong.
2. Added dissection of payloads 130 and 131, which were used in early
NAT-T drafts (and are still used by MS and others). They are equal to
payloads 15 & 16, (NAT-D, NAT-OA), respectively.
3. Added ASN.1 decoding of Certificate requests of type X.509
Certificate - Signature (4)
4. Added ASN.1 decoding of ID of type ID_DER_ASN1_DN (9)
svn path=/trunk/; revision=12059
if that pointer is non-null, put the field in question into the protocol
tree under the top-level item for that attribute/value pair, rather than
hardcoding particular fields for particular attribute codes.
Use BASE_NONE, not BASE_DEC, for FT_STRING, FT_BYTES, and FT_IPv4
fields.
svn path=/trunk/; revision=12048
NETTL_SUBSYS_NS_LS_ICMPV6 - they don't even have IP headers, so we need
to directly call the ICMP and ICMPv6 dissectors.
svn path=/trunk/; revision=12047
within the file) and "burst offset" field (offset of this packet within
the burst).
The burst header is not present if the SYS flag is set in the packet or
if the data offset field is non-zero.
Compute the offset, within a burst packet, of the data, as we advance
through the burst header - and don't advance through the burst header if
it's not present.
Properly display the fields in the "missing fragment list".
svn path=/trunk/; revision=12041
- Support for more generic TLV's
- Support for two more SNAC families: email and sst
- Support for extended status (as used by iChat)
- Use correct TLV in SSI RightsInfo
- Dissect and handle FNAC flags field correctly
svn path=/trunk/; revision=12022
make the dissectors "new-style" dissectors and return 0 for packets that
don't look like iSNS. Do this *before* doing TCP reassembly - once
you've done reassembly, it's too late.
Don't set the columns in the main dissector routines - it's also done in
the PDU dissector, which is sufficient. Set the protocol column to
"iSNS", not "isns".
svn path=/trunk/; revision=12015
I've written this patch to use the 'Delay since last SR' (DLSR) field found
in SR reports to calculate and report roundtrip-propagation delays. This is
described in rfc 3550, section 6.4.1, inside the description of DLSR.
Only the endpoint can compute the end-end roundtrip delay, and only they
know exactly when the report is received and can compare it with the 'Last
SR timestamp' (LSR) that they set. This patch instead takes the difference
between the capture times of the 2 reports and subtracts the DLSR (the LSR
is checked in case the SR it's referring to wasn't captured). The time
difference represents a roundtrip network delay between the point of capture
and the sender of the SR containing the DLSR.
svn path=/trunk/; revision=11998
1. As you said visible fileds are much better.
2. As they became visible I noticed the length and offset of the fields
were wrong, I fixed them.
3. I added few more "essential" fields (as a colleague told me as soon
as you move away from 3G some fileds like username become the most
important)
svn path=/trunk/; revision=11991
Anders Broman