"End-of-Connection Acknolwedgment") have none of the connection control
bits set; describe them as "Data, No Ack Required" rather than
"Unknown".
svn path=/trunk/; revision=7443
two packets have the same sequence number; use the sequence number in
the hash key.
The sequence number is not incremented for system packets, and system
packets probably don't get ACKed and thus presumably don't get
retransmitted, so don't do retransmission checks for system packets.
svn path=/trunk/; revision=7442
a retransmitted SPX frame, just put the number of the original frame in
as an item not referring to any data (offset and length of 0), and, if
there is any remaining data, put it into the tree as a separate item.
svn path=/trunk/; revision=7440
header be filterable fields.
Don't hand retransmitted SPX frames to subdissectors - just show the
payload as a retransmission of the original frame.
Instead of handing a retransmission indicator to SPX subdissectors, hand
them a structure containing the datastream type (under the assumption
that it's data for the protocol running atop SPX, and that the dissector
for that protocol might use it) and the state of the end-of-message bit
(under the assumption that it's data for the protocol running atop SPX).
svn path=/trunk/; revision=7433
frames that are retransmissions a data structure containing the frame
number of the original frame, and pass that to subdissectors (or, if not
present, pass NULL).
That means we can free the hash values when we're done with the first
pass through the packets.
svn path=/trunk/; revision=7432
transmission (and shared by all retransmissions), and passed to SPX
subdissectors, to "packet-ipx.h", and use the same structure in the SPX
dissector and the NDPS dissector.
Set up conversations and those structures without checking whether we've
seen the packet before or not; just check whether we find the
conversation before creating a new one, and check whether we find a
structure for the packet before creating a new one. Pass it to the
subdissector regardless of whether we've seen the packet before or not,
and check it in the NDPS dissector regardless of whether we've seen it
before or not.
Don't store a "retransmission" flag in the structure - the initial
transmission and the retransmissions all share a single data structure,
but they don't all have the same value for the "retransmission" flag,
and you can tell whether a packet is a retransmission or not by
comparing its frame number with the frame number from the structure; if
they're different, it's a retransmission.
svn path=/trunk/; revision=7418
try as a port number doesn't always give the right answer, as you might
have a name query packet from an SMB-over-IPX server, meaning it's from
IPX_SOCKET_NWLINK_SMB_SERVER to IPX_SOCKET_NWLINK_SMB_NAMEQUERY, and,
unfortunately, IPX_SOCKET_NWLINK_SMB_SERVER is less than
IPX_SOCKET_NWLINK_SMB_NAMEQUERY and it'll now be dissected as an SMB
packet rather than an NMPI name query packet.
So if the higher-numbered socket is IPX_SOCKET_NWLINK_SMB_NAMEQUERY, we
just try that, we don't try the other port.
svn path=/trunk/; revision=7409
Socket 0x9001 is for NLSP - it supports LANs as well as WANs, at least
as I read the specification.
Socket 0x9004 is for "IPX WAN 2".
svn path=/trunk/; revision=7387
structure in the packet as required.
The server name in that structure is not necessarily null-terminated;
use "%.48s", not "%s", to print it.
svn path=/trunk/; revision=7038
qualifiers as necessary to ensure that we don't have to.
"strcmp()", "strcasecmp()", and "memcmp()" don't return booleans; don't
test their results as if they did.
Use "guint8", not "guchar", for a pointer to (one or more) 8-bit bytes.
Update Michael Tuexen's e-mail address.
svn path=/trunk/; revision=6726
"pinfo->srcport", and "pinfo->destport" appropriately in the IPX
dissector. Add support for PT_IPX port types in display columns.
Have an "spx.socket" dissector table, similar to the "ipx.socket"
dissector table, and have the SPX dissector use that, with the IPX
socket numbers from "pinfo->srcport" and "pinfo->destport", so that
dissectors for protocols that run atop SPX can register with particular
socket numbers. (Think of it as similar to what would have been the
case had the IP header had 16-bit source and destination port numbers,
and had TCP and UDP used those port numbers rather than having port
numbers in their headers.) Also, have the SPX dissector dissect
subprotocols regardless of whether we're building a protocol tree or not.
Use the dissector handle for the IPX message dissector for both IPX
socket numbers; there's no need to create separate handles for both
registrations.
Have NDPS register as a subdissector of the SPX dissector, using
"spx.socket", and get rid of the duplicate SPX dissection in the NDPS
dissector.
Make the NDPS dissector set the columns regardless of whether a protocol
tree is being built, and clean up the dissector (fixing some bugs).
Get rid of unneeded includes in "packet-ndps.c".
svn path=/trunk/; revision=6424
equivalents for the toplevel directory. The removal of winsock2.h will
hopefully not cause any problems under MSVC++, as those files using
struct timeval still include wtap.h, which still includes winsock2.h.
svn path=/trunk/; revision=5932
"broadcast message waiting" indications.
When handing off dissection from the IPX dissector:
Check the socket numbers before we check the packet type;
we've seen IPX message packets with a type of NCP and a
destination socket of IPX_SOCKET_IPX_MESSAGE, and SAP
packets with a type of NCP and a destination socket of
IPX_SOCKET_SAP.
Assume the lower-numbered socket number is more likely
to be the right one, along the lines of what we do for
TCP and UDP. We've seen NCP packets with a type of NCP,
a source socket of IPX_SOCKET_NCP, and a destination
socket of IPX_SOCKET_IPX_MESSAGE, and we've seen NCP
packets with a type of NCP, a source socket of
IPX_SOCKET_IPX_MESSAGE, and a destination socket of
IPX_SOCKET_NCP.
svn path=/trunk/; revision=5810
arguments to "proto_tree_add_text()", and to "proto_tree_add_XXX()" calls
that add FT_NONE or FT_PROTO items to the protocol tree, with -1.
Replace some calls to "tvb_length()" or "tvb_length_remaining()" with
calls to "tvb_reported_length()" and "tvb_reported_length_remaining()",
as those give the actual length of the data in the packet, not just the
data that happened to be captured.
svn path=/trunk/; revision=4605
"epan/..." pathnames, so as to avoid collisions with header files in any
of the directories in which we look (e.g., "proto.h", as some other
package has its own "proto.h" file which it installs in the top-level
include directory).
Don't add "-I" flags to search "epan", as that's no longer necessary
(and we want includes of "epan" headers to fail if the "epan/" is left
out, so that we don't re-introduce includes lacking "epan/").
svn path=/trunk/; revision=4586
structure to the "packet_info" structure; only stuff that's permanently
stored with each frame should be in the "frame_data" structure, and the
"column_info" structure is not guaranteed to hold the column values for
that frame at all times - it was only in the "frame_data" structure so
that it could be passed to dissectors, and, as all dissectors are now
passed a pointer to a "packet_info" structure, it could just as well be
put in the "packet_info" structure.
That saves memory, by shrinking the "frame_data" structure (there's one
of those per frame), and also lets us clean up the code a bit.
svn path=/trunk/; revision=4370
specifies how the selector values used as keys in those tables are to be
displayed, and the title to use when displaying the table.
Use that information in the code to display the initial and current
entries of various dissector tables.
Have the dissector for BACnet APDUs register itself by name, and have
the BACnet NPDU dissector call it iff the BAC_CONTROL_NET bit isn't set,
rather than doing it with a dissector table.
svn path=/trunk/; revision=4358
take a dissector handle as an argument, rather than a pointer to a
dissector function and a protocol ID. Associate dissector handles with
dissector table entries.
svn path=/trunk/; revision=4308
of packet data captured.
Make the "BYTES_ARE_IN_FRAME()" macro take a "captured length of the
packet" argument.
Add some length checks to capture routines.
svn path=/trunk/; revision=4235
Make the source and destination socket fields enumerated types, so we
don't have to use "proto_tree_add_uint_format()" on them, and so that
you can match on them by service name.
Use lower-case letters when formatting the hex value of sockets; that's
what's done with fields not added with "proto_tree_add_XXX_format".
svn path=/trunk/; revision=4046
Ronnie Sahlberg