Commit Graph

127 Commits

Author SHA1 Message Date
Michael Mann 0c49b4d872 Add filterable expert info to dissect_802_3() and clean up the shrapnel.
svn path=/trunk/; revision=51761
2013-09-05 01:39:35 +00:00
Chris Maynard 6fc009baac Similar to the IPv4 dissector's hf_ip_dst_host, hf_ip_src_host and hf_ip_host fields, add to the Ethernet dissector:
hf_eth_dst_resolved
hf_eth_src_resolved
hf_eth_addr_resolved

and add to the IEEE802.11 dissector:

hf_ieee80211_addr_da_resolved
hf_ieee80211_addr_sa_resolved
hf_ieee80211_addr_ra_resolved
hf_ieee80211_addr_ta_resolved
hf_ieee80211_addr_bssid_resolved
hf_ieee80211_addr_resolved

Change motivated by:
http://ask.wireshark.org/questions/24314/possible-to-use-the-mac-info-in-the-wireshark-manuf-file-as-part-of-display-filter

svn path=/trunk/; revision=51742
2013-09-03 21:20:59 +00:00
Pascal Quantin 3db06ae582 Fix "Could not compile color filter "Checksum Errors" from saved filters: eth.fcs_bad (type=Label) cannot participate in '==' comparison" warning
svn path=/trunk/; revision=50448
2013-07-08 18:49:42 +00:00
Michael Mann 225698ef0b Fix display filter errors caught by checkfiltername.pl
svn path=/trunk/; revision=50399
2013-07-06 02:53:45 +00:00
Chris Maynard 93002cb9c5 A follow-up to r50127 to highlight the correct 4 bytes of the Ethernet FCS for the hf_eth_fcs_good and hf_eth_fcs_bad fields.
svn path=/trunk/; revision=50128
2013-06-24 19:27:47 +00:00
Guy Harris 00b1a9df1a The Ethernet FCS is 32 bits, not 16 bits.
svn path=/trunk/; revision=50127
2013-06-24 19:00:55 +00:00
Sake Blok cf079d0a6c Check on fh_tree is already done within add_ethernet_trailer()
svn path=/trunk/; revision=49676
2013-06-01 12:00:56 +00:00
Sake Blok b2a6a6c15c Add ethernet protocol preference to manually set the trailer length.
(some TAPs can slice packets and then add a custom trailer)


svn path=/trunk/; revision=49675
2013-06-01 09:05:56 +00:00
Michael Mann 5bc22a25df Batch of filterable expert infos.
svn path=/trunk/; revision=49584
2013-05-26 03:29:07 +00:00
Anders Broman 2e52e2ac99 [-Wmissing-prototypes]
Use explicit casts.

svn path=/trunk/; revision=48347
2013-03-17 09:11:21 +00:00
Guy Harris 6b629c4d92 Move show_exception() and show_reported_bounds_error() to
epan/show_exception.c, as it's used outside
epan/dissectors/packet-frame.c.  Update their callers to include
<epan/show_exception.h> to get their declaration.

Add a CATCH_NONFATAL_ERRORS macro that catches all exceptions that, if
there's more stuff in the packet to dissect after the dissector call
that threw the exception, doesn't mean you shouldn't go ahead and
dissect that stuff.  Use it in all those cases, including ones where
BoundsError was inappropriately being caught (you want those passed up
to the top level, so that the packet is reported as having been cut
short in the capture process).

Add a CATCH_BOUNDS_ERRORS macro that catches all exceptions that
correspond to running past the end of the data for a tvbuff; use it
rather than explicitly catching those exceptions individually, and
rather than just catching all exceptions (the only place that
DissectorError should be caught, for example, is at the top level, so
dissector bugs show up in the protocol tree).

Don't catch and then immediately rethrow exceptions without doing
anything else; just let the exceptions go up to the final catcher.

Use show_exception() to report non-fatal errors, rather than doing it
yourself.
 
If a dissector is called from Lua, catch all non-fatal errors and use
show_exception() to report them rather than catching only
ReportedBoundsError and adding a proto_malformed item.

Don't catch exceptions when constructing a trailer tvbuff in
packet-ieee8023.c - just construct it after the payload has been
dissected, and let whatever exceptions that throws be handled at the top
level.

Avoid some TRY/CATCH/ENDTRY cases by using checks such as
tvb_bytes_exist() before even looking in the tvbuff.

svn path=/trunk/; revision=47924
2013-02-27 22:43:54 +00:00
Jeff Morriss 2552c750e5 We always HAVE_CONFIG_H so don't bother checking whether we have it or not.
svn path=/trunk/; revision=45017
2012-09-20 02:03:38 +00:00
Jakub Zawadzki dee4443809 Add data parameter to dissector_try_heuristic
svn path=/trunk/; revision=44871
2012-09-11 08:26:48 +00:00
Guy Harris 8f9acccbc5 Get rid of remaining Booleans-as-encoding-arguments in
proto_tree_add_item() calls.

svn path=/trunk/; revision=42483
2012-05-07 19:47:15 +00:00
Sake Blok 8d4e40559d If we know there is a FCS present, don't hand it to the ethernet trailer dissectors, but dissect it on return
svn path=/trunk/; revision=40146
2011-12-10 12:28:28 +00:00
Guy Harris baa8f66c73 Clarify some stuff in a comment.
Don't call any of the heuristic trailer dissectors if there's no trailer
to dissect.

svn path=/trunk/; revision=40143
2011-12-10 05:33:48 +00:00
Sake Blok efd2ce4116 - Make a distinction between ethernet padding and an ethernet trailer
- ... and make that distinction configurable for capture files that do not have padding in small frames, but do have trailers
- Add VSS-Monitoring dissector to show by the TAP inserted time- and portstamps


svn path=/trunk/; revision=40108
2011-12-06 23:07:55 +00:00
Stig Bjørlykke 293695e82c From Andrew Kampjes via bug 6536:
Improved the Ethernet checksum field, modelled on the TCP checksum field.

svn path=/trunk/; revision=39712
2011-11-02 11:01:57 +00:00
Bill Meier 794757ae8f For proto_tree_add_item(..., proto_xxx, ...)use ENC_NA as the encoding arg.
Also: remove trailing whitespace for a number of files.

svn path=/trunk/; revision=39503
2011-10-21 02:10:19 +00:00
Bill Meier 67ee5049d4 Convert 'encoding' parameter of certain proto_tree_add_item() calls in non-autogenerated epan/dissectors:
Specifically:  Replace FALSE|0 and TRUE|1 by ENC_BIG_ENDIAN|ENC_LITTLE_ENDIAN as
  the encoding parameter for proto_tree_add_item() calls which directly reference
  an item in hf[] which has a type of:
     FT_BOOLEAN
     FT_IPv4
     FT_EUI64
     FT_GUID
     FT_UINT_STRING

Also: For type FT_ITv6 use ENC_NA. (This was missed in SVN #39260)

svn path=/trunk/; revision=39328
2011-10-10 00:39:31 +00:00
Bill Meier 4e57694d4a Convert 'encoding' parameter of certain proto_tree_add_item() calls in non-autogenerated epan/dissectors:
Specifically:  Replace FALSE|0 and TRUE|1 by ENC_BIG_ENDIAN|ENC_LITTLE_ENDIAN as
 the encoding parameter for proto_tree_add_item() calls which directly reference
 an item in hf[] which has a type of:
    FT_UINT8
    FT_UINT16
    FT_UINT24
    FT_UINT32
    FT_UINT64
    FT_INT8
    FT_INT16
    FT_INT24
    FT_INT32
    FT_INT64
    FT_FLOAT
    FT_DOUBLE


svn path=/trunk/; revision=39288
2011-10-06 03:35:44 +00:00
Bill Meier f5ff1c5001 Do some cleanup related to the reversion of SVN #34848 donr in SVN #39100.
1. Revert SVN #35830 (See Bug #5645);
   This patch is no longer needed given the reversion.

   https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5645

   http://anonsvn.wireshark.org/viewvc?revision=39100&view=revision

2. Restore 'col_set_str(pinfo->cinfo, COL_INFO, "Ethernet II");' just to
       be safe (altho it's possible that this line is not needed).

3. Remove several lines of no longer needed code.

svn path=/trunk/; revision=39134
2011-09-25 19:28:07 +00:00
Bill Meier c74f88547a Uh, "Fix the fix (in SVN #39105)" so it compiles.
svn path=/trunk/; revision=39106
2011-09-23 14:47:18 +00:00
Bill Meier f409a21b13 Correction for SVN #39100:"Revert Revision 34838";
Fixes buildbot compile error.

svn path=/trunk/; revision=39105
2011-09-23 14:39:23 +00:00
Anders Broman 7c0741ad15 Revert Revision 34838 "Resolve bug #2254: Migrate the 802.1q VLAN dissector into the Ethernet II."
as this causes a lot of problems.
See 
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5680
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6305
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6366

Original bug:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2254

svn path=/trunk/; revision=39100
2011-09-23 11:01:13 +00:00
Guy Harris 5fe4eb3c33 Always pass the FCS length to dissect_802_3() and ethertype(), so it
will process the FCS if it's known to be present and will attempt to
guess whether it's present if it's not known not to be present.

svn path=/trunk/; revision=38990
2011-09-13 21:17:45 +00:00
Stig Bjørlykke 5359494b1f Second try to move crc routines to libwsutil.
This time keep the tvb routines in epan.

Now we can use common crc routines outside epan.

svn path=/trunk/; revision=38810
2011-08-31 09:00:54 +00:00
Stig Bjørlykke 71f903b956 Revert r38800, as the crc routines contains some tvb functions.
svn path=/trunk/; revision=38803
2011-08-30 14:17:40 +00:00
Stig Bjørlykke 4132d40e50 Move all crc routines to libwsutil.
This way we can use the crc routines in wiretap.

svn path=/trunk/; revision=38800
2011-08-30 13:46:42 +00:00
Chris Maynard 2d99c2dbb4 Although technically not needed, for clarity, explicity catch invalid Ethernet frames, increment the "other" count and return. Previously, code execution would have fallen through to the ETHERNET_II case and capture_ethertype() would have incremented the "other" count.
svn path=/trunk/; revision=37835
2011-06-29 17:22:18 +00:00
Chris Maynard 3dd1b0c0de Based on Guy's suggestion from the user mailing list, dissect Ethernet frames with a type/len field in the range of 1501-1535 as invalid, and add an expert info to make it that much easier to find such invalid frames.
Also did some whitespace cleanup, converting tabs to spaces since most of the file was spaced, not tabbed, and swapped the order that the lg and ig bits get added to the tree because I think it looks better reading bits left-to-right.

TODO: I'm not entirely sure what to do in capture_eth() if that invalid range is encountered, so for now I just added some #if 0'd code as a placeholder.

Ref: http://www.wireshark.org/lists/wireshark-users/201106/msg00127.html


svn path=/trunk/; revision=37832
2011-06-29 16:05:56 +00:00
Chris Maynard e5adfc8e18 Add support for USB CDC Ethernet. Resolves bug 4819.
svn path=/trunk/; revision=37049
2011-05-10 17:40:29 +00:00
Sake Blok 61d592c8ad Fix for bug 5645 : Ethernet packets with both VLAN tag and LLC header no longer displayed correctly
svn path=/trunk/; revision=35830
2011-02-04 17:12:47 +00:00
Guy Harris a8bc4a0d13 Rename the routines that handle dissector tables with unsigned integer
keys to have _uint in their names, to match the routines that handle
dissector tables with string keys.  (Using _port can confuse people into
thinking they're intended solely for use with TCP/UDP/etc. ports when,
in fact, they work better for things such as Ethernet types, where the
binding of particular values to particular protocols are a lot
stronger.)

svn path=/trunk/; revision=35224
2010-12-20 05:35:29 +00:00
Jaap Keuter ba2d64102c Fix for bug 5422:
Add support for dissecting SLL type 0x03 frames.

svn path=/trunk/; revision=34987
2010-11-20 18:14:30 +00:00
Stephen Fisher b18e8fd1ca Resolve bug #2254: Migrate the 802.1q VLAN dissector into the Ethernet II.
svn path=/trunk/; revision=34838
2010-11-10 22:37:30 +00:00
Jörg Mayer 6ab1662ca7 Add expert info if the eth src mac has the I/G bit set
svn path=/trunk/; revision=34548
2010-10-17 20:28:20 +00:00
Guy Harris add0764bc2 Allow Dissect As... to select the Ethernet-without-FCS dissector for a
given UDP port; this is to handle the output for the Cisco CMTS "cable
intercept" command - it encapsulates Ethernet frames in UDP packets, but
the UDP port is user-defined.

svn path=/trunk/; revision=33964
2010-08-27 21:13:26 +00:00
Stig Bjørlykke 286aaddb05 Use top level tree when using dissectors from "eth.trailer" heuristics.
svn path=/trunk/; revision=33255
2010-06-19 01:16:29 +00:00
Bill Meier 085dd46d5c Slightly reword the preference text about CCSDS packets.
svn path=/trunk/; revision=32558
2010-04-25 17:34:32 +00:00
Gerald Combs 7110e957f6 From Matt P via bug 3774:
Patch utilizes techniques incorporated in the packet-ieee8023.c dissect_802_3()
routine to dynamically calculate the remaining payload length.  This is then
compared to the length included in the CCSDS header.

svn path=/trunk/; revision=29329
2009-08-07 21:53:40 +00:00
Anders Broman 0b0ff6cdcf Get rid of check_col() in some of the more frequently used dissectors.
svn path=/trunk/; revision=29170
2009-07-22 21:33:47 +00:00
Stig Bjørlykke b228488bc0 From Kovarththanan Rajaratnam via bug 3548:
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
    for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
    FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero

svn path=/trunk/; revision=28770
2009-06-18 21:30:42 +00:00
Guy Harris 5b45905ffc Add a preference to force the dissector to assume that packets have an
FCS; this handles protocols where there's no length field, so that the
"is there a trailer and/or an FCS?" heuristic can't work.

svn path=/trunk/; revision=28432
2009-05-20 22:50:30 +00:00
Jaap Keuter 17df7f823e From Matt P:
CCSDS packets may reside within an 802.3 packet.  This patch provides a way for
the CCSDS dissector to be called from the 802.3 dissector.

svn path=/trunk/; revision=27257
2009-01-18 12:08:56 +00:00
Bill Meier aa30dcd129 Minor proto_reg_handoff cleanup: use find_dissector when appropriate.
svn path=/trunk/; revision=26308
2008-09-30 14:49:44 +00:00
Guy Harris cb21120f17 Clean up indentation.
svn path=/trunk/; revision=25723
2008-07-12 17:37:22 +00:00
Sake Blok 4f05930abe Big 2104 - From Benn Bollay:
This patch adds a heuristic dissector to the ethernet trailer under the
keystring "eth.trailer".  This allows for other protocol plugins which coopt
the ethernet trailer for their own devices to register for trailer traffic
without requiring any further changes to the executable.


svn path=/trunk/; revision=23880
2007-12-16 00:35:34 +00:00
Anders Broman b1370e46d0 Didier Gautheron:
Only call ether_to_str(), get_ether_name() if the tree is visible, they are slow.

svn path=/trunk/; revision=23666
2007-11-29 06:29:20 +00:00
Anders Broman c6b3bc723f Apply yet another set of the optimization patches:
move TRY block in its own function.
 __attribute__((noinline)) does not compile with MS VC 6
nor does __declspec(noinline)
Applied the patch without it.

svn path=/trunk/; revision=23424
2007-11-10 17:06:49 +00:00
Ronnie Sahlberg 30b586ad61 queue the ip/eth headers for tapping before calling any subdissectors
so that they can be tapped even if the subdissectors cause an exception


this fixes bug 1527

svn path=/trunk/; revision=23004
2007-09-28 05:50:19 +00:00
Stig Bjørlykke 19e901df9a Highlight whole ethernet trailer in Packet Details View.
svn path=/trunk/; revision=22960
2007-09-25 19:30:26 +00:00
Stig Bjørlykke 72af3183ab Added functionality to highlight the FCS bytes in Ethernet and IEEE 802.11
packets in the Packet Details View.

This "appendix" bytes are not copied with the Copy functions or in the
Export Selected Packet Bytes.

svn path=/trunk/; revision=22887
2007-09-17 12:12:02 +00:00
Luis Ontanon 3764b345b3 register dissect_eth_maybefcs as "eth" users might find it useful.
svn path=/trunk/; revision=22381
2007-07-22 16:44:25 +00:00
Stephen Fisher f002ac6db5 Fix various warnings
Move packet-cops.c out of clean dissectors due to a #define conflict
in the headers of net-snmp with our config.h


svn path=/trunk/; revision=21398
2007-04-13 00:50:23 +00:00
Jaap Keuter fce186d76a From Graeme Hewson:
The attached patch adds Homeplug to the table of ethernet types.

svn path=/trunk/; revision=20509
2007-01-20 16:46:42 +00:00
Jaap Keuter 7ded21f336 Squelch compiler warnings
svn path=/trunk/; revision=19597
2006-10-18 19:42:10 +00:00
Ronnie Sahlberg 0899de4bd5 remove the code that conditionally dissects LG only if IG is set
svn path=/trunk/; revision=19034
2006-08-25 21:53:37 +00:00
Ronnie Sahlberg 19f3809cc6 from Stephen F
ethernet IG/LG bit changes   with minor modifications

(only dissect LG if it is a unicast address
 put a hint what locally administered means in the dissect tree
)
 


svn path=/trunk/; revision=19033
2006-08-25 21:33:23 +00:00
Ronnie Sahlberg feab79e328 change a whole bunch of ethereal into wireshark
svn path=/trunk/; revision=18196
2006-05-21 04:49:01 +00:00
Ronnie Sahlberg 19078b5404 add an expansion to ethernet source and destination addresses
inside this expansion show
1,    eth.addr      so people can see that this field exists (i think it is futile to use "hidden" fields and expect people to search through the infinitely long list of fields,   better show everything and they will see themself what fuields they can filter on)
2,  bit 0x01 of the first byte to show if it is Multi or Uni-cast
3, bit 0x02 of the first byte to show if it is a locally administrated address or not.
I do use the (to laymen) more descriptive names  "factory default"    instead of LocallyAdminAddr in the true_false string though.




 

svn path=/trunk/; revision=17378
2006-02-23 09:54:08 +00:00
Guy Harris b7b80d94be Move a pile of protocol-related headers from the top-level source
directory to the epan directory.  Some of them should perhaps ultimately
be moved to epan/dissectors, if they pertain only to stuff exported by a
particular dissector.

Fix Gerald's e-mail address in files we're moving.

svn path=/trunk/; revision=15844
2005-09-17 00:02:31 +00:00
Guy Harris 9cb86fda9c Squelch various signed vs. unsigned warnings by:
making pointers to byte data be "guint8 *" rather than "char *",
	and making buffers holding byte data arrays of "guint8" rather
	than arrays of "char";

	making pointers to text strings "char *" rather than "guchar *";

	appropriately casting pointers (cast to "guint8 *" when passing
	to routines expecting "guint8 *" or when assigning to "guint8
	*");

	making port-number preferences "guint";

	making enum preferences "gint";

	making hf_ variables "int".

Clean up white space.

svn path=/trunk/; revision=14884
2005-07-09 00:53:17 +00:00
Ulf Lamping 2c30357c48 checksum messages: use "[correct]" instead of "(correct)" and other "alike" messages
svn path=/trunk/; revision=14880
2005-07-08 22:11:13 +00:00
Ulf Lamping e419fe42a9 add the resolved Ethernet addresses to the "Ethernet II" summary line
svn path=/trunk/; revision=14520
2005-06-02 00:28:38 +00:00
Guy Harris f98e6c2533 Squelch a compiler warning.
svn path=/trunk/; revision=14313
2005-05-05 11:02:31 +00:00
Gerald Combs 8e46cb49b7 Add a tvb_ensure_bytes_exist(). Fixes bug 62.
svn path=/trunk/; revision=14112
2005-04-17 05:14:44 +00:00
Ronnie Sahlberg 2bc81b2a48 Major speed improvement for filtering and dissection.
It should not dump core as far as all my tests are concerned and Menu_Statistics/ProtocolHierStats work

It needs more testing and there might still be cases where it will crash that will need to be fixed  but I feel it will be worth it since it will decrease the time to filter very large capture files dramatically.

Real significant performance boost for very large captures.


(If we cant fix all the problems we can just revert this patch)



svn path=/trunk/; revision=14051
2005-04-11 08:43:51 +00:00
Guy Harris a46d94072b Get rid of some warnings about variables whose values might be lost in a
longjmp, by properly qualifying those variables as volatile.

svn path=/trunk/; revision=12914
2005-01-01 23:11:46 +00:00
Guy Harris 7c3027c5e9 Export two versions of the Ethereal dissector, for use with encapsulated
Ethernet frames, one for encapsulated frames that include an FCS and one
for encapsulated frames that don't include an FCS.  Use the appropriate
versions.

In the ISL dissector, do the same sort of processing we do in the
Ethernet dissector to figure out whether the frame has a trailer or not
and whether it has an FCS or not.

svn path=/trunk/; revision=12593
2004-11-24 09:13:52 +00:00
Guy Harris ad2583dcd9 Only interpret a frame as an FW1 header if it looks like one, as per a
patch from Yaniv Kaul.

svn path=/trunk/; revision=12590
2004-11-24 06:04:43 +00:00
Guy Harris 0384ceeeb6 Check for ISL frames before checking for ETHERTYPE_UNK, as ISL fields
might have 0 in what would be the Ethernet type field.

Also, handle the first 5 octets of the destination address of an ISL
frame being 0C-00-0C-00-00.

svn path=/trunk/; revision=12484
2004-11-03 20:20:45 +00:00
Guy Harris 6472876ab3 Move the tap infrastructure to the epan directory.
svn path=/trunk/; revision=12128
2004-09-29 00:06:36 +00:00
Guy Harris ac98f225a8 Move various checksum routines and headers to epan.
svn path=/trunk/; revision=12117
2004-09-28 00:06:32 +00:00
Guy Harris bbe7f89742 Move prefs.c and prefs.h into the epan subdirectory.
svn path=/trunk/; revision=12115
2004-09-27 22:55:15 +00:00
Guy Harris 3a583aeb59 From Albert Chin: rename resolv.{ch} to addr_resolv.{ch}, so that an
include of <resolv.h> in any system header file gets the system
<resolv.h> (needed for builds on Tru64 with GTK+ 1.2[.x]).

svn path=/trunk/; revision=11615
2004-08-06 19:57:49 +00:00
Gilbert Ramirez 669db206cb Move dissectors to epan/dissectors directory.
Also move ncp222.py, x11-fields, process-x11-fields.pl,
make-reg-dotc, and make-reg-dotc.py.

Adjust #include lines in files that include packet-*.h
files.

svn path=/trunk/; revision=11410
2004-07-18 18:06:47 +00:00