Commit Graph

1362 Commits

Author SHA1 Message Date
Stig Bjørlykke c8a187390d From Pascal Quantin via bug 1723:
Make ASCII text dump identification optional.

svn path=/trunk/; revision=38886
2011-09-05 20:03:03 +00:00
Guy Harris d6798876d6 I'm not sure -Q/WIRESHARK_QUIT_AFTER_CAPTURE is actually useful in batch
mode; in batch mode, you probably want to use TShark or dumpcap.

svn path=/trunk/; revision=38787
2011-08-29 23:25:29 +00:00
Gerald Combs 9efd73b9ef -Q → WIRESHARK_QUIT_AFTER_CAPTURE.
svn path=/trunk/; revision=38786
2011-08-29 23:16:57 +00:00
Stig Bjørlykke 5603cef9f2 Remove support for libpcre, we use GRegex in GLib.
svn path=/trunk/; revision=38683
2011-08-23 09:25:06 +00:00
Chris Maynard 3f8edaa2d1 From Jim Young via bug 3196: Add preference for displaying expert infos LEDs.
Reference: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3196

svn path=/trunk/; revision=38408
2011-08-08 15:27:59 +00:00
Jörg Mayer 6dace04493 Add instructions how to work with "git svn" instead of "svn"
svn path=/trunk/; revision=38080
2011-07-18 12:44:19 +00:00
Bill Meier f6b5df0c45 Update ptvcursor API description to reflect 'endianness' --> 'encoding' parameter change.
svn path=/trunk/; revision=38048
2011-07-15 17:44:24 +00:00
Martin Mathieson 092b161d04 Add LTE RLC stats tap to tshark.
svn path=/trunk/; revision=38019
2011-07-14 17:07:41 +00:00
Martin Mathieson a7fac381ca Add LTE MAC statistics to tshark.
svn path=/trunk/; revision=38016
2011-07-14 13:39:02 +00:00
Gerald Combs 49b92440de More GLIB_CHECK_VERSION cleanups. Update the minimum GLib/GTK+ versions
in README.devloper. Remove g_gnuc.h since it's no longer needed. Remove
tvbuff_init(), tvbuff_cleanup(), reassemble_init(), and
reassemble_cleanup() since they were only used for older GLib versions
which didn't support GSlices. Assume we always support the "matches"
operator.

svn path=/trunk/; revision=37978
2011-07-11 20:32:19 +00:00
Michael Tüxen bd6db2a824 Document the handling of command line parameters with respect to
the capturing on multiple interfaces.

svn path=/trunk/; revision=37824
2011-06-28 22:02:43 +00:00
Gerald Combs 8d88f3a790 Make pcap-ng the default. Add a compile-time option to prefer pcap-ng or
pcap.  Add a "-P" capture option which tries to use pcap instead of
pcap-ng ("-P" seemed to be the best option but we may want to use a
different letter).

Update the documentation and release notes.

svn path=/trunk/; revision=37696
2011-06-17 17:52:31 +00:00
Ronnie Sahlberg 9164a7f892 Add description of LOAD stats for tshark to the manpage
svn path=/trunk/; revision=37587
2011-06-07 10:27:44 +00:00
Anders Broman cf3d8e1b69 From Cal Turney:
1.) The resolution of the time values displayed by tshark's "-z io,stat, ..."
should be increased from milliseconds to microseconds (from 3 to 6 decimal
places) in order to be consistent with -z relative time-related options such as
"-z smb,rtt" and "-z rpc,rtt" which display values to 5 decimal places. 
[Please note that separate enhancement requests for 6 decimal of precision in
Wireshark will be submitted shortly.)  

2.) The "frames  bytes" column displayed in '-z io,stat' is too narrow, frames
    and bytes should each have 15 spaces like all the other column types. 

3.) The types "FRAMES" and "BYTES" should be added to allow users to display
    these values separately and allow for filters to be specified.  

4.) The 'SUM' option should allow for relative time values such as SRTs to be
    summed.  This would be useful for the calculation of such things as
    request concurrency (total_SRT_time / duration).

5.) The tshark man page needs some corrections and readability improvements

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4915

svn path=/trunk/; revision=37555
2011-06-05 19:40:05 +00:00
Jörg Mayer 605e6e435a Remove an (almost) duplicate entry
svn path=/trunk/; revision=37461
2011-05-29 14:06:14 +00:00
Alexis La Goutte 7d317e553b Add FT_EUI64 Field Type
* Remove proto_tree_add_eui64 function from 802.15.4 Dissector 
* Replace print_eui64/print_eui64 by eui64_to_str/get_eui64_name
* Update Documentation (README.dev)
* Add new function in libwireshark.def
* Support of encoding for tvb_eui64_to_str
* Use FT_EUI64 for ICMPv6, CAPWAP, Zbee ... dissector

svn path=/trunk/; revision=37015
2011-05-08 10:23:53 +00:00
Stig Bjørlykke 65910b2479 From Edwin Groothuis via bug 5870:
The supplied patch adds a new option -O, which specifies a list of protocols
(names can be found with the "-G protocols" option) to be fully decoded while
the others only show the layer header.

svn path=/trunk/; revision=36947
2011-04-29 06:53:29 +00:00
Alexis La Goutte 2e9f0857f6 Fix tshark doc (ip.src==1.2.3.4) is not a valid filter for ICMPv6 trafic ;)
svn path=/trunk/; revision=36582
2011-04-12 13:30:43 +00:00
Chris Maynard 5abfa49525 Add conversation tracking and tshark tap support to ICMPv6. Fixes bug 5810.
TODO: Add a Wireshark tap or look into possibly using the stats tree instead.
Also, like ICMP, the ICMPv6 payload appears to carry the sender's timestamp, so
it might be possible to make use of this information to estimate the total SRT.
(See bug 5770 for more details.)

svn path=/trunk/; revision=36561
2011-04-11 17:42:01 +00:00
Chris Maynard 9e34d13ff4 Add computation of median and change standard deviation calculation to "sample"
standard deviation.  Split statistics output onto 2 lines.

svn path=/trunk/; revision=36501
2011-04-06 19:48:11 +00:00
Bill Meier 9121c18590 IMHO capinfos, when finished processing, should exit with an error status
if an error occurred while processing.
E.G.,: For the default (no -C option):
  'capinfos invalid.xxx' or 'capinfos a.pcap invalid.xxx c.pcap'
 should exit with an error status
  (after processing all the input args) if there is an error for invalid.xxx.

With this fix, I expect fuzz-test.sh (and list_protos_in_cap.sh
and presumably other scripts) will work a bit more as as expected.


svn path=/trunk/; revision=36487
2011-04-06 01:41:03 +00:00
Chris Maynard 595e5e1c1d Add ICMP tap support, and add a tshark tap to measure such things as:
* Number of ICMP echo requests, replies, lost replies and percent loss.
  * Min, Max, Average SRT (Service Response Time), and standard deviation.
(This is my first tap, so hopefully I didn't miss something, but we'll see ...)
TODO: Add a Wireshark tap.


svn path=/trunk/; revision=36480
2011-04-05 20:21:59 +00:00
Bill Meier f8ce3da390 Add some info as to the determination of the length of a FT_STRINGZ item.
Add a note not leaving trailing whitespace on a line.

svn path=/trunk/; revision=36434
2011-04-01 20:48:56 +00:00
Gerald Combs 941666d525 Add "-z hosts", which dumps name resolution information in hosts format.
svn path=/trunk/; revision=36372
2011-03-27 16:06:03 +00:00
Gerald Combs fcf51fc73b Add initial pcapng name resolution record support. Wireshark has read
support; TShark has read+write support. Additionally TShark can read a
"hosts" file and write those records to a capture file.

This uses "struct addrinfo" in many places and probably won't compile on
some platforms.

svn path=/trunk/; revision=36318
2011-03-24 22:47:57 +00:00
Chris Maynard feb1d468d8 From: http://www.wireshark.org/lists/wireshark-dev/201103/msg00157.html
Change RTT references to SRT.
(tshark.pod could use a description for -z afp,srt and -z camel,srt)

svn path=/trunk/; revision=36297
2011-03-23 20:00:13 +00:00
Jeff Morriss 9a4457ef4f Add README.heuristic to the source distribution
svn path=/trunk/; revision=36205
2011-03-17 13:18:27 +00:00
Chris Maynard 25d68e6c5b Disallow invalid char's in the filename passed to idl2wrs. Fixes bug 1129.
svn path=/trunk/; revision=35944
2011-02-14 01:44:15 +00:00
Jeff Morriss fddb50a582 Document that proto_tree_add_bytes_format() and
proto_tree_add_bytes_format_value() may be given a NULL value_ptr.


svn path=/trunk/; revision=35907
2011-02-10 22:57:50 +00:00
Jeff Morriss 69b78fc118 Document that NTP times can be added with proto_tree_add_item().
svn path=/trunk/; revision=35884
2011-02-09 02:43:10 +00:00
Sake Blok b723ee91a0 From Jason Masker (bug 5240):
`
Allow editcap to chop from beginning of packet for decapsulation


svn path=/trunk/; revision=35832
2011-02-04 21:09:55 +00:00
Jaap Keuter a3611f713e Sharpen the description of preference names.
svn path=/trunk/; revision=35671
2011-01-26 21:20:09 +00:00
Jeff Morriss 4eb43096b1 From Alexis La Goutte via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5603 :
Following the discussion on the dev mailing list about ett_ value in subtree
http://www.wireshark.org/lists/wireshark-dev/201101/msg00039.html

a small to update the Readme Developer Guide !

svn path=/trunk/; revision=35610
2011-01-21 17:08:35 +00:00
Chris Maynard 116d67e164 Add tvb_get_[n|le]toh[40|48|56]() accessors. Addresses bug 5082.
svn path=/trunk/; revision=35538
2011-01-14 19:02:38 +00:00
Anders Broman c2cefb1e10 Document and export:
tvb_bcd_dig_to_ep_str();

svn path=/trunk/; revision=35499
2011-01-12 07:25:34 +00:00
Jeff Morriss 0c4e881911 Introduce, and start using, tvb_get_const_stringz(). This function returns a
pointer to a NULL-terminated string in the TVB.  It is no safer than dissectors
which call tvb_get_strsize() and then tvb_get_ptr() but it makes it clear that
this usage of tvb_get_ptr() is safe.

This function is slightly more efficient than tvb_get_ephemeral_stringz()--but
only as long as we're not using composite TVBs.

svn path=/trunk/; revision=35493
2011-01-12 02:25:08 +00:00
Stephen Fisher 1d4c01023b State in the developer documentation that the tvb_fake_unicode() and
tvb_get_ephemeral_fake_unicode() functions have been superceded by
tvb_get_unicode_string() and tvb_get_ephemeral_unicode_string() respectivey.


svn path=/trunk/; revision=35349
2011-01-03 19:37:13 +00:00
Stephen Fisher 159b55ad12 Document new tvb_get_unicode_string() and tvb_get_ephemeral_string()
functions.


svn path=/trunk/; revision=35345
2011-01-03 18:33:02 +00:00
Stephen Fisher 4f5ccc00f8 Introduce new function called tvb_get_ephemeral_unicode_stringz(), which
is a unicode (UTF-16) version of tvb_get_ephemeral_stringz().  It scans
a tvbuff for a UTF-16 string and converts it to UTF-8 upon return.


svn path=/trunk/; revision=35253
2010-12-23 17:59:34 +00:00
Jaap Keuter fc4d25fcc4 Allow for NULL preference descriptions.
svn path=/trunk/; revision=35242
2010-12-22 06:25:33 +00:00
Guy Harris a8bc4a0d13 Rename the routines that handle dissector tables with unsigned integer
keys to have _uint in their names, to match the routines that handle
dissector tables with string keys.  (Using _port can confuse people into
thinking they're intended solely for use with TCP/UDP/etc. ports when,
in fact, they work better for things such as Ethernet types, where the
binding of particular values to particular protocols are a lot
stronger.)

svn path=/trunk/; revision=35224
2010-12-20 05:35:29 +00:00
Bill Meier cd5544679a Revert SVN #35214 based upon comments in the Wireshark-dev list.
http://www.wireshark.org/lists/wireshark-dev/201012/msg00206.html

svn path=/trunk/; revision=35218
2010-12-18 17:55:06 +00:00
Bill Meier 160bee8c16 The Styleguide section has been moved to the Wireshark Developer's Guide.
svn path=/trunk/; revision=35214
2010-12-17 20:55:45 +00:00
Bill Meier 2798debd90 Update the "Following Conversations" section to use se_alloc() instead of GMemChunks.
Also: add information about the conversation_set_dissector() function.

svn path=/trunk/; revision=35185
2010-12-14 14:23:27 +00:00
Sake Blok bd8c1e7a3a ... and update the documentation too :-)
svn path=/trunk/; revision=35144
2010-12-07 11:59:15 +00:00
Gerald Combs 40af498b36 We don't include a comprehensive display filter reference; don't say we
do.

svn path=/trunk/; revision=35079
2010-11-30 17:46:09 +00:00
Stephen Fisher d381b5dea4 From OKANO Takayoshi via bug #5442: Fix typos in documentation
svn path=/trunk/; revision=35038
2010-11-27 16:51:24 +00:00
Jaap Keuter 3232869503 Make some updates to describe the newer features.
svn path=/trunk/; revision=34964
2010-11-19 00:05:38 +00:00
Jaap Keuter b310bbf4d0 Small clarification.
svn path=/trunk/; revision=34921
2010-11-17 07:29:40 +00:00
Sake Blok 9cf1d89732 Make editcap -B work like expected: output no packets after the stop time.
Old behavior was to include a packet with a timestamp of 12:00:00.934 if -B "YYYY-MM-DD 12:00:00" was used.


svn path=/trunk/; revision=34913
2010-11-16 20:22:20 +00:00