Modification to (proto.h) is made to add an additional expert group type of PI_REQUEST_CODE to allow Request tag information to be passed to the expert tap. This is for such reasons where a dissector would like to echo specific information about certain types of requests. For example: NCP connection request is really a request not a REPLY_CODE. Same is true for the TCP SYN request.
Changes to packet-ncp.c
1. Server broadcast message flag. Now indicates if the message is a pending message or an oplock clear notification.
2. Cleanup of packet signature detection process. Previous method had some flaws so I redesigned it. Appears to be solid now.
3. Echo NCP Server Session information to expert tap.
Note on item #3: NCP Connection+Task = NCP Session, a Single connection can have many tasks. The server sees each connection/task as a unique session. For this reason the NCP session information is now echoed to the expert composite statistics so that you can easily identify the different NCP processes and sessions. It is important to NCP analysis to understand that each session is most likely a different program on the requesting host sharing the same NCP connection.
Changes to packet-ncp2222.inc
1. Comment out the echo of NCP connection info to expert tap. Replaced by NCP sessions.
2. Add displayEID in request decode (resolves Coverity defect for dead code in NCP dissector)
Changes to ncp2222.py
1. Fix for endian display of bindery object type in NCP 0x1720.
2. Fix for size of bindery object type to 2 bytes instead of 4 to match other bindery NCP's.
svn path=/trunk/; revision=17636
This small patch will cause the current AVP dictionary to be freed and
repopulated when relevant preferences have changed.
svn path=/trunk/; revision=17635
Please find enclosed a patch for the BGP dissector.
A 0 length IP address is valid in NLRI dissection. It just means "0/0 address".
svn path=/trunk/; revision=17634
update it to dissect it as such and create new helpers for the new structure that takes one extra guint32 at the end of the previous structure.
svn path=/trunk/; revision=17632
The code assumes Template FlowSet contains only one Template Record, which is not necessarily true. Please find attached the patch to fix it.
svn path=/trunk/; revision=17630
> This patch:
> - adds a few filterable fields (currently there are only hidden
> boolean fields for request and response).
svn path=/trunk/; revision=17629
>>>This patch:
>>>- makes it possible to turn off use of the XML AVP dictionary (which
>>>relies upon the XML lib being installed). A failed load results in 3
>>>annoying dialogs popping up the first time a diameter packet is read.
>>>Default is previous behaviour.
svn path=/trunk/; revision=17628
2 patches for the "flow graph" display. It is better not to insert invalid packets into the list than to control the list is correct while using it...
svn path=/trunk/; revision=17622
and if the checksum is wrong
and if the checksum field is 0x0000
mark the packet as [Checksum Offloaded] and still allow reassembly of
tcp segmetns
since it is most likely just a tco checksum offload engine and not a real checksum error
svn path=/trunk/; revision=17612
(report luns with allocation length 8 for example)
Therefore it is a bit wrong to mark these packets as [malformed packets]
Since they are truncated by scsi and this is NOTY an error condition.
Add a new exception type : ScsiBoundsError
If this exception is caught by packet-frame, then print an appropriate message
instead of [malformed packet]
For SCSI, add helper macros TRY_SCSI_SHORT_PACKET and END_...
If the packet was not short in the normal sense (snaplen < packetlen) then intercept the exception for BoundsError and rethrow it as ScsiBoundsError instead.
svn path=/trunk/; revision=17611
added another command preventallowmediaremoval besides those 3.
> enhanced packet-scsi.c a bit to decode 3 more scsi commands
>
> getperformance
> setcdspeed
> readdiscstructure.
svn path=/trunk/; revision=17610
I've also changed the way the secondary error message is transported from former "header message 0 secondary 0" to "header header message 0 header secondary 0" as that might be a bit more clearer, and I'll need it for further development anyway.
I was using this while debugging and not recognizing the real problem - for about four hours :-(. I'll need this feature when doing the interface (and link layer type) browsing later (transferring this data from dumpcap to Ethereal) to get a full blown privilege seperation.
svn path=/trunk/; revision=17608
Jaap Keuter