"from_filename" - are both null-terminated strings; compare them with
"strcmp", not "strncmp()". ("cf->filename" is a "char *", so
"sizeof(cf->filename)" is not the right third argument to "strncmp()" in
any case, as it's the size of a pointer, which is probably either 4 or 8
bytes.)
Make the dialog box for "Can't save over current capture file" an
ESD_TYPE_CRIT dialog box, as it's a fatal error.
svn path=/trunk/; revision=5526
- Exit if an error is found in the options or arguments.
- In print_usage(), improve the visibility of any getopt() error
message by suppressing the version information when -h is not
specified, and by adding an empty line.
Ethereal:
- If the -k option is specified, use the interface in the preferences
file, if present.
- Prevent the user from specifying any hidden options which are used
internally in -S mode.
Tethereal:
- Fix a memory leak in the processing of the -f option.
- In print_usage(), change "capture file type" to "output file type",
which I think is clearer; move the -q flag from the non-libpcap case
to the libpcap case.
svn path=/trunk/; revision=5525
specify them on the command line of Tethereal/editcap/etc. (and to keep
those programs from dropping core when enumerating the names); now that
we can write Windows Sniffer 2.00x-format files, give them a short name.
svn path=/trunk/; revision=5524
Added support for NS_LS_TCP, NS_LS_UDP, NS_LS_LOOPBACK, NS_LS_ICMP and
unnamed subsystem 0xb9 (which contains ethernet headers in my captures frames).
However, NS_LS_ICMP will not be dissected since we dont have a
RAW_ICMP wiretap encapsulation type.
Updated decoding of usec timestamp for HPUX11 since HPUX11 has 0.1us
resolution for the scalar in this field.
YMMV but all these ones works for me from nettl traces from HPUX11.
svn path=/trunk/; revision=5523
Put the array of connection states into the per-direction state
structure; its size is fixed, as the connection number field size is 1
byte. Get rid of the "rslot_limit" member, as the number is fixed.
Get rid of the per-state "next" pointer, as it's unused.
Process uncompressed frames even if VJ decompression is turned off, and
even if the "discard compressed frames" flag is set on the connection,
as there's no decompression to do.
If the full IP and TCP header isn't available in an uncompressed frame,
discard subsequent compressed frames.
Only use the "discard compressed frames" flag on the first pass through
the capture; on subsequent passes, the presence of an "uncompressed
header" item attached to the frame indicates whether we could decompress
it or not (the "discard compressed frames" flag would merely indicate
the *last* state it had for that connection, which might not have been
the state at the time we saw that frame).
svn path=/trunk/; revision=5520
When this ption is enabled in Protocols/NFS displayfilters for fhandle fields
such as nfs.fh.{hash|name|full_name} will find both the request and matching
response packets even if the fhandle is only present in one of the packets.
The option supports all NFS and related protocols which use nfs fhandles
including async NLM.
The option will not work with nfs packets containing multiple fhandles in
one PDU, nor will it work if tcp collapses multiple segments/pdus into
one larger segment.
It only works for async NLM if one first enables the MSG/RES stateful
matching for async NLM.
svn path=/trunk/; revision=5515
that it's not included in the tvbuff handed to subdissectors. Use that
tvbuff to compute the FCS.
Properly handle the FCS in frames that don't include all the captured
data.
In VJ-compressed packets, put the VJ compression information into the
protocol tree, and set the Protocol and Info columns, and don't worry
about the CRC - as per the above, it's no longer in the tvbuff (and
never *was* in the tvbuff in some cases).
Also, clean up some other stuff in the VJ dissector.
svn path=/trunk/; revision=5510
- implemented WritePrinter, DeletePrinterData
- fixed dissection of various printerdata routines to use a more
consistent field naming scheme and convert to ndr functions
svn path=/trunk/; revision=5509
draft-ietf-tsvwg-addip-sctp-05.txt for the add-IP extension
draft-stewart-prsctp-00.txt for the 'Partial Reliability' extension
draft-ietf-tsvwg-sctpcsum-07.txt
svn path=/trunk/; revision=5503
them in "packet-ncp2222.inc".
The page at
http://www.odyssea.com/whats_new/tcpipnet/tcpipnet.html
indicates that a positive ACK (0x9999) NCP packet has the same
completion code and connection status fields as a reply (0x3333) packet
(but nothing after them); hand "dissect_ncp_reply()" the packet type as
one of its arguments, and have it handle positive ACK packets as well as
reply packets.
It also indicates that bit 4 of the connection status indicates that the
server is unavailable, and the page at
http://www.unm.edu/~network/presentations/course/appendix/appendix_f/tsld088.htm
speaks of that and of the significance of other bits; put a comment in
"ncp2222.py", before the "hf_ncp_connection_status" field, about that.
From looking at a capture, it appears that a "destroy service
connection" (0x5555) packet should be treated like a "create service
connection" (0x1111) packet and be handed to "dissect_ncp_request()".
Note that perhaps watchdog packets should be handled by
"dissect_ncp_reply()" as well.
svn path=/trunk/; revision=5489
protocol reply if:
we got anything other than SUCCESS for MSG_ACCEPTED;
we got MSG_DENIED;
we got anything other than MSG_ACCEPTED or MSG_DENIED;
as there isn't a protocol reply in there.
Just use "-1, -1" as arguments to "tvb_new_subset()" if you want the new
tvbuff to run to the end of the packet - there's no need to call
"tvb_reported_length_remaining()".
svn path=/trunk/; revision=5483
entry covers both bytes of the connection number (as well as the number
in the middle - alas, there's no way to create a protocol tree item that
covers a discontiguous range of bytes).
svn path=/trunk/; revision=5480
Dissect NCP watchdog packets.
Clean up the handling of NCP packet-specific headers and payload a bit.
Put in a protocol tree item for the upper 8 bits of the connection
number.
Make the "sorry, we don't dissect this yet" protocol tree item cover the
part we *don't* dissect, rather than covering the packet type.
Use the data dissector to dissect the data in a burst mode packet.
svn path=/trunk/; revision=5478
Guy Harris