20 years agoILMI is just SNMP-over-ATM AAL5; if the SNMP dissector is available,
guy [Thu, 18 Nov 1999 07:29:55 +0000 (07:29 +0000)]
ILMI is just SNMP-over-ATM AAL5; if the SNMP dissector is available,
dissect ILMI packets with the SNMP dissector.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1054 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoFixed the checking of the return value from file_gets() (fgets()).
gram [Thu, 18 Nov 1999 07:04:29 +0000 (07:04 +0000)]
Fixed the checking of the return value from file_gets() (fgets()).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1053 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoCraig Rodrigues' fixes to let it compile on AIX using IBM's compiler
guy [Thu, 18 Nov 1999 01:45:05 +0000 (01:45 +0000)]
Craig Rodrigues' fixes to let it compile on AIX using IBM's compiler
(remove commas following the last member of an enum, make all bit fields
"guint32" - GCC lets you get away with that, but at least some other
compilers don't).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1052 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd packet-bgp.h to the list of deliverables.
gram [Wed, 17 Nov 1999 23:31:22 +0000 (23:31 +0000)]
Add packet-bgp.h to the list of deliverables.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1051 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoProvide a general mechanism by which dissectors can register "init"
guy [Wed, 17 Nov 1999 21:58:33 +0000 (21:58 +0000)]
Provide a general mechanism by which dissectors can register "init"
routines, which are called before a dissection pass is made over all the
packets in a capture - the "init" routine would clear out any state
information that needs to be initialized before such a dissection pass.

Make the NCP, SMB, AFS, and ONC RPC dissectors register their "init"
routines with that mechanism, have the code that reads in a capture file
call the routine that calls all registered "init" routines rather than
calling a wired-in set of "init" routines, and also have the code that
runs a filtering or colorizing pass over all the packets call that
routine, as a filtering or colorizing pass is a dissection pass.

Have the ONC RPC "init" routine zero out the table of RPC calls, so that
it completely erases any state from the previous dissection pass (so
that, for example, if you run a filtering pass, it doesn't mark any
non-duplicate packets as duplicates because it remembers them from the
previous pass).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1050 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoTypo fixes, and fix to bug wherein when Ethereal sees a Network-LSA it
guy [Wed, 17 Nov 1999 19:07:10 +0000 (19:07 +0000)]
Typo fixes, and fix to bug wherein when Ethereal sees a Network-LSA it
does not stop dissecting the LSA until it hits the end of the packet,
from Heikki Vatiainen.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1049 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd some comment based on some spelunking done in some capture files,
guy [Wed, 17 Nov 1999 07:50:33 +0000 (07:50 +0000)]
Add some comment based on some spelunking done in some capture files,
and on a comment that "libpcap"/BPF on AIX appears to return 6 as the
network type for an Ethernet device - the BSD IFT_ETHER is 6.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1048 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoPrint unsigned quantities with "%u", not "%d".
guy [Wed, 17 Nov 1999 06:52:19 +0000 (06:52 +0000)]
Print unsigned quantities with "%u", not "%d".

Use "plurality()" to pluralize byte counts.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1047 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoHeikki Vatiainen's SAP (Session Announcement Protocol) dissector.
guy [Wed, 17 Nov 1999 02:17:29 +0000 (02:17 +0000)]
Heikki Vatiainen's SAP (Session Announcement Protocol) dissector.

Rename the dissector for the Netware SAP protocol to "dissect_ipxsap()",
so as to keep its name from colliding with that of the dissector for the
Session Announcement Protocol.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1046 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoTypo fix, from Heikki Vatiainen.
guy [Wed, 17 Nov 1999 01:35:57 +0000 (01:35 +0000)]
Typo fix, from Heikki Vatiainen.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1045 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoWe should be checking the value of loc_of_slash instead of index. It
gram [Tue, 16 Nov 1999 17:03:36 +0000 (17:03 +0000)]
We should be checking the value of loc_of_slash instead of index. It
might be NULL from strchr().

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1044 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoReplace the ETT_ "enum" members, declared in "packet.h", with
guy [Tue, 16 Nov 1999 11:44:20 +0000 (11:44 +0000)]
Replace the ETT_ "enum" members, declared in "packet.h", with
dynamically-assigned "ett_" integer values, assigned by
"proto_register_subtree_array()"; this:

obviates the need to update "packet.h" whenever you add a new
subtree type - you only have to add a call to
"proto_register_subtree_array()" to a "register" routine and an
array of pointers to "ett_", if they're not already there, and
add a pointer to the new "ett_" variable to the array, if they
are there;

would allow run-time-loaded dissectors to allocate subtree types
when they're loaded.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1043 f5534014-38df-0310-8fa8-9805f1628bb7

20 years ago"gtk_object_get_data()" returns a pointer, so its return value shouldn't
guy [Tue, 16 Nov 1999 08:00:20 +0000 (08:00 +0000)]
"gtk_object_get_data()" returns a pointer, so its return value shouldn't
be cast to a "gint" if that "gint" value is then going to be assigned to
a pointer.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1042 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoI hope no one just committed something on this.
sharpe [Tue, 16 Nov 1999 07:58:12 +0000 (07:58 +0000)]
I hope no one just committed something on this.

There was a core dump because of a coding oversight.  Should be fixed
now Gilbert.

Should now handle names of form \<somepipe>

Will screw up if there is no leading slash, but in a non-fatal way, I

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1041 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoRemove an "#if 0"-ed out chunk of code that was supposed to cause the
guy [Tue, 16 Nov 1999 06:59:17 +0000 (06:59 +0000)]
Remove an "#if 0"-ed out chunk of code that was supposed to cause the
hex window to scroll so that the data in the currently-selected field is
visible, but merely revealed core-dumping bugs in GTK+.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1040 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoDon't store both "start" and "length" in each GUI proto_tree item. Just
gram [Mon, 15 Nov 1999 22:52:03 +0000 (22:52 +0000)]
Don't store both "start" and "length" in each GUI proto_tree item. Just
store the field_info pointer, from which we can get both "start" and
"length" (and "hfinfo" and "value", which I'm working towards, so that
match_selected, or a new function, and create a display filter based on
the field's name, instead of byte offset ).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1039 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoadded sap types, netbios name types, ipx socket names
nneul [Mon, 15 Nov 1999 21:33:57 +0000 (21:33 +0000)]
added sap types, netbios name types, ipx socket names

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1038 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoGot rid of dissect_rpc_string routine, renamed dissect_rpc_string_item to
nneul [Mon, 15 Nov 1999 17:16:51 +0000 (17:16 +0000)]
Got rid of dissect_rpc_string routine, renamed dissect_rpc_string_item to
dissect_rpc_string. Replaced only instance of this routine being called.

Added display filtering to rpc dissector. Replaced most instances of
proto_tree_add_text with proto_tree_add_item.

Added program version and procedure to the program tree in addition to it
being in the RPC tree.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1037 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agostart of display filters and fix for toupper prototype
nneul [Mon, 15 Nov 1999 14:57:38 +0000 (14:57 +0000)]
start of display filters and fix for toupper prototype

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1036 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoFixed rpc dissector to upcase program name.
nneul [Mon, 15 Nov 1999 14:32:16 +0000 (14:32 +0000)]
Fixed rpc dissector to upcase program name.
Fixed nfs and nlm to use a lowercase protocol name so filtering will work.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1035 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoUwe Girlich's patches for nfs,mount,portmap and addition of nlm.
nneul [Mon, 15 Nov 1999 14:17:20 +0000 (14:17 +0000)]
Uwe Girlich's patches for nfs,mount,portmap and addition of nlm.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1034 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoWe have to include <sys/types.h> before including <netinet/in.h> on some
guy [Mon, 15 Nov 1999 07:25:31 +0000 (07:25 +0000)]
We have to include <sys/types.h> before including <netinet/in.h> on some
platforms, e.g. FreeBSD.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1033 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd "class" that understands IPv4 addresses and subnet masks.
gram [Mon, 15 Nov 1999 06:32:38 +0000 (06:32 +0000)]
Add "class" that understands IPv4 addresses and subnet masks.
We now store IPv4 addresses in host order, allowing non-equivalence
comparisons. That is, display filters with lt, le, gt, and ge will work
on big-endian and little-endian machines.

CIDR notation is now supported for IPv4 addresses in display filters.
You can test to see if an IPv4 address is on a certain subnet by using
this notation. For example, to test for IPv4 packets on a Class-C network:

ip.addr ==

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1032 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoFor ONC RPC, when constructing conversations, use a null address as the
guy [Sun, 14 Nov 1999 21:16:58 +0000 (21:16 +0000)]
For ONC RPC, when constructing conversations, use a null address as the
destination address for calls and the source address of the reply - we
should't require the server address to be the same for a call and reply,
as they may not be on a multi-homed server (clients presumably check the
XID only, or perhaps the XID and the port whence the reply came,
although with TI-RPC I don't think they can check the port without
checking the address as well).

This requires that the conversation code not assume that the source and
destination addresses for a given packet in a conversation have the same
type, so, when comparing addresses for equality, it must explicitly
check the address types.

In said code, also check the port numbers before we check the addresses
- testing ports is cheaper, as they're just integers, and there's
probably a decent chance that you won't see two conversations between
different pairs of hosts and the *same* pair of ports in a capture file,
so the cheaper port tests are probably decently likely to fail first.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1031 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoMove the test to see if something looks like an ONC RPC request or reply
guy [Sun, 14 Nov 1999 20:44:52 +0000 (20:44 +0000)]
Move the test to see if something looks like an ONC RPC request or reply
into "dissect_rpc()" itself; it returns TRUE if it is, FALSE if it

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1030 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoSet "conversation_keys" to NULL after destroying the list of
guy [Sun, 14 Nov 1999 19:56:32 +0000 (19:56 +0000)]
Set "conversation_keys" to NULL after destroying the list of
conversation keys.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1029 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd display filters.
deniel [Sun, 14 Nov 1999 10:48:17 +0000 (10:48 +0000)]
Add display filters.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1028 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd display filters.
deniel [Sun, 14 Nov 1999 10:32:26 +0000 (10:32 +0000)]
Add display filters.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1027 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd display filters.
deniel [Sun, 14 Nov 1999 10:16:25 +0000 (10:16 +0000)]
Add display filters.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1026 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoOK,
sharpe [Sun, 14 Nov 1999 06:54:42 +0000 (06:54 +0000)]

much more complete decoding of browse messages.

They are now shown in the parent tree as well.

I still have problems with:

  1. Times
  2. Election criteral

I also haven't been able to see a BecomeBackup request, nor a
GetBackupListResp with more than one browser ... Should run a Windows NT
server or another Samba on my network.

I am also not sure of there are any more message types.  Damn! Old, and
wrong MS documents!

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1025 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoFixed some more small problems and added support for decoding
sharpe [Sun, 14 Nov 1999 02:42:03 +0000 (02:42 +0000)]
Fixed some more small problems and added support for decoding
MS Windows Browser messages.  Can decode host announcements now.

Still need to decode more.  Also need to break the new code out.

I also have the Browse tree at the wrong location.  Can I get at the
parent of the tree somewhere, or do I have to pass it in as a variable?

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1024 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoDissect a whole pile of Q.931 information elements.
guy [Sat, 13 Nov 1999 10:13:24 +0000 (10:13 +0000)]
Dissect a whole pile of Q.931 information elements.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1023 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd ETT_Q931_IE
gram [Sat, 13 Nov 1999 04:06:10 +0000 (04:06 +0000)]
Add ETT_Q931_IE

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1022 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoA few cause codes more (cue Ennio Morricone).
guy [Sat, 13 Nov 1999 02:07:59 +0000 (02:07 +0000)]
A few cause codes more (cue Ennio Morricone).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1021 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd initial support for decoding information elements.
guy [Sat, 13 Nov 1999 01:32:31 +0000 (01:32 +0000)]
Add initial support for decoding information elements.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1020 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd support for HINFO records.
guy [Fri, 12 Nov 1999 22:43:32 +0000 (22:43 +0000)]
Add support for HINFO records.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1019 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoenhancements to ypserv dissector
nneul [Fri, 12 Nov 1999 15:12:23 +0000 (15:12 +0000)]
enhancements to ypserv dissector

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1018 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoadded minimalist MAPI dissector - only determines request/reply
nneul [Thu, 11 Nov 1999 23:13:43 +0000 (23:13 +0000)]
added minimalist MAPI dissector - only determines request/reply

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1017 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdded mount dissector.
nneul [Thu, 11 Nov 1999 21:22:00 +0000 (21:22 +0000)]
Added mount dissector.
Added stat dissector.
Enhancements to portmap dissector.
Added rpc_prog_name function to packet-rpc to retrieve the name of an
        rpc program. This should likely eventually be modified to use the
        /etc/rpc or rpc.bynumber NIS maps in addition to the programs that
        are registered within ethereal.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1016 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agobgp improvements.
itojun [Thu, 11 Nov 1999 21:08:52 +0000 (21:08 +0000)]
bgp improvements.
- a few more tree types
- RFC1771 NLRI printed on advertisements
- AS_PATH parsing
- lots of small cleanup on printing "byte" vs "bytes"

From: Greg Hankins <gregh@cc.gatech.edu>

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1015 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoThe conversation comparison code should, if *any* of the tests that
guy [Thu, 11 Nov 1999 20:44:14 +0000 (20:44 +0000)]
The conversation comparison code should, if *any* of the tests that
check whether the two packets are going in the same direction in the
same conversation fails, check whether the two packets are going in
opposite directions in the same conversation.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1014 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdditions to bootparams, portmap, and ypserv dissectors
nneul [Thu, 11 Nov 1999 20:18:46 +0000 (20:18 +0000)]
Additions to bootparams, portmap, and ypserv dissectors

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1013 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoRemove potential for a bad toshiba trace file to overflow a fixed char[]
gram [Thu, 11 Nov 1999 19:19:17 +0000 (19:19 +0000)]
Remove potential for a bad toshiba trace file to overflow a fixed char[]
buffer in sscanf call.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1012 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoExpanded bootparams dissector to handle decoding getfile calls and replies.
nneul [Thu, 11 Nov 1999 16:20:25 +0000 (16:20 +0000)]
Expanded bootparams dissector to handle decoding getfile calls and replies.
Added proto_registrar_get_name routine to proto.c to retrieve the name
of particular proto_tree field.
Added dissect_rpc_string_item to packet-rpc.c. This routine does the same
thing as dissect_rpc_string, except it takes a hfindex of a
proto_tree item instead of a name. It uses the p_r_get_name call
to get the name, and adds the actual string content as a hidden
field (so that the subtree highlights the entire data area - length,
data, and padding). There is only one call to dissect_rpc_string, so
I believe that this routine should replace it.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1011 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoSome general fixups and some fixes for protocol decode problems
sharpe [Thu, 11 Nov 1999 13:56:58 +0000 (13:56 +0000)]
Some general fixups and some fixes for protocol decode problems
exposed by Win2000 interacting with a Samba server ...

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1010 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoSupport all lengths of call reference value (1 to 15 octets).
guy [Thu, 11 Nov 1999 10:17:29 +0000 (10:17 +0000)]
Support all lengths of call reference value (1 to 15 octets).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1009 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoChange my e-mail address to the forwarding address my *alma mater*
guy [Thu, 11 Nov 1999 08:45:34 +0000 (08:45 +0000)]
Change my e-mail address to the forwarding address my *alma mater*
provides.  "Every problem in computer science can be solved by adding a
layer of indirection."

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1008 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd #defines for bits in the LAPD address field and for the LAPD SAPI
guy [Thu, 11 Nov 1999 08:35:11 +0000 (08:35 +0000)]
Add #defines for bits in the LAPD address field and for the LAPD SAPI

Dissect the LAPD payload, if present.

Add the beginnings of a Q.931 dissector.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1007 f5534014-38df-0310-8fa8-9805f1628bb7

20 years ago"XDLC_CONTROL_LEN()" actually returned the length of the entire xDLC
guy [Thu, 11 Nov 1999 08:04:06 +0000 (08:04 +0000)]
"XDLC_CONTROL_LEN()" actually returned the length of the entire xDLC
header, under the assumption that the address field was two octets.

It should return the length of the *control* field, and leave it up to
its caller to add in the length of the address field.  (The address
field appears to be one byte in SNA, not two bytes.)

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1006 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoRemove unnecessary file_seek per packet, speeding up loading of a
gram [Thu, 11 Nov 1999 06:29:59 +0000 (06:29 +0000)]
Remove unnecessary file_seek per packet, speeding up loading of a
gzipped toshiba file.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1005 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd LAPD support.
gram [Thu, 11 Nov 1999 05:36:16 +0000 (05:36 +0000)]
Add LAPD support.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1004 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoexpanded portmap dissector to process some of the procedure calls
nneul [Wed, 10 Nov 1999 22:43:53 +0000 (22:43 +0000)]
expanded portmap dissector to process some of the procedure calls

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1003 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoChanged protocol names to all lowercase. It looks weird in listing though.
nneul [Wed, 10 Nov 1999 21:05:11 +0000 (21:05 +0000)]
Changed protocol names to all lowercase. It looks weird in listing though.
I'm presuming packet-rpc.c will be fixed soon.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1002 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoMore small memleak fixes.
gram [Wed, 10 Nov 1999 19:58:54 +0000 (19:58 +0000)]
More small memleak fixes.

colors.c wasn't freeing path in one place
main.c wasn't freeing rc_file
the frame_buffer fix in wtap.c didn't clear everything.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1001 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoFixed small memory leak in wiretap (frame_buffer wasn't being freed),
gram [Wed, 10 Nov 1999 19:47:57 +0000 (19:47 +0000)]
Fixed small memory leak in wiretap (frame_buffer wasn't being freed),
and aligned g_malloc calls with g_free calls (i.e, we no longer mix-and-match
C-library malloc with GLIB g_free, and vice-versa).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@1000 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdded dissect_imap() prototype to get rid of compilation warning
gram [Wed, 10 Nov 1999 18:32:55 +0000 (18:32 +0000)]
Added dissect_imap() prototype to get rid of compilation warning
in packet-tcp.c

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@999 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdded stubs for various RPC routines:
nneul [Wed, 10 Nov 1999 17:23:55 +0000 (17:23 +0000)]
Added stubs for various RPC routines:

Stubs currently just map procedure numbers to names. I'll add some more
decoding of the actual procedure call/reply contents eventually.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@998 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoadded ypxfr program to rpc
nneul [Wed, 10 Nov 1999 15:10:33 +0000 (15:10 +0000)]
added ypxfr program to rpc

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@997 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agofix ypbinb/ypbind typo
nneul [Wed, 10 Nov 1999 14:54:37 +0000 (14:54 +0000)]
fix ypbinb/ypbind typo

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@996 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdded imap dissector, pretty much a simple translation of the pop
nneul [Wed, 10 Nov 1999 14:44:58 +0000 (14:44 +0000)]
Added imap dissector, pretty much a simple translation of the pop

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@995 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd a "Go To Frame" menu item, which lets you go to a frame by frame
guy [Wed, 10 Nov 1999 07:01:53 +0000 (07:01 +0000)]
Add a "Go To Frame" menu item, which lets you go to a frame by frame

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@994 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoFix up the MX record handling.
guy [Wed, 10 Nov 1999 06:01:21 +0000 (06:01 +0000)]
Fix up the MX record handling.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@993 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoGive all the fields in the VLAN header different names (fixing a
guy [Wed, 10 Nov 1999 05:42:06 +0000 (05:42 +0000)]
Give all the fields in the VLAN header different names (fixing a
presumed cut-and-pasteo).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@992 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoThe equivalent, for NBNS, of Brian J. Murrell's DNS patch to put
guy [Mon, 8 Nov 1999 09:16:52 +0000 (09:16 +0000)]
The equivalent, for NBNS, of Brian J. Murrell's DNS patch to put
information about the queries and answers into the COL_INFO column in
the summary pane.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@991 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd a "Go To Frame" menu item, which lets you go to a frame by frame
guy [Mon, 8 Nov 1999 01:13:24 +0000 (01:13 +0000)]
Add a "Go To Frame" menu item, which lets you go to a frame by frame

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@990 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd a "Go To Frame" menu item, which lets you go to a frame by frame
guy [Mon, 8 Nov 1999 01:03:40 +0000 (01:03 +0000)]
Add a "Go To Frame" menu item, which lets you go to a frame by frame

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@989 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoBrian J. Murrell's patch to put information about the queries and
guy [Sun, 7 Nov 1999 21:00:40 +0000 (21:00 +0000)]
Brian J. Murrell's patch to put information about the queries and
answers into the COL_INFO column in the summary pane.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@988 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd in a gross heuristic that attempts to detect files with the version
guy [Sat, 6 Nov 1999 10:31:47 +0000 (10:31 +0000)]
Add in a gross heuristic that attempts to detect files with the version
of the "libpcap" patch that changes the per-packet header but not the
magic number - it seems to work on at least one capture file I tried it

Give the modified "libpcap" format a WTAP_FILE type of its own (so that,
in the future, we could support writing captures out in that format,

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@987 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd support for capture files written by programs linked with Alexey
guy [Sat, 6 Nov 1999 08:42:01 +0000 (08:42 +0000)]
Add support for capture files written by programs linked with Alexey
Kuznetsov's modified "libpcap" *as long as you have the ss990915 or
later patch*; the 990417 patch, alas, changes the per-packet header but
*doesn't* change the magic number, so you can't just look at the magic
number to see that it's Not Standard Libpcap.  (Even more unfortunately,
Red Hat appears to have picked up *that* patch for Red Hat 6.1; I've
filed bug 6773 with Bugzilla on their site - hopefully, if I'm not
misremembering the RH 6.1 code I've seen, and they really *did* pick up
the older patch, they'll fix it ASAP to use the new magic number, and
will make updates available.)

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@986 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoPop up a message box if a search for a frame fails.
guy [Sat, 6 Nov 1999 06:54:24 +0000 (06:54 +0000)]
Pop up a message box if a search for a frame fails.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@985 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoClean up some stuff I failed to cleanup before the initial checkin.
guy [Sat, 6 Nov 1999 06:42:41 +0000 (06:42 +0000)]
Clean up some stuff I failed to cleanup before the initial checkin.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@984 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd a "Find Frame" menu item under "Display"; it lets you use a display
guy [Sat, 6 Nov 1999 06:38:53 +0000 (06:38 +0000)]
Add a "Find Frame" menu item under "Display"; it lets you use a display
filter to search forward or backward in the list of displayed frames for
a matching frame.

When filtering the display, readjust the display to show the "current"
frame if it passed the display filter.  When a file is read in, the
first frame becomes the "current" frame; when a frame is selected, it
becomes the "current" frame, and remains so *even if you unselect it*,
until another frame is selected.

Select the first frame when a file is read in.

Disable most of the "Display" and "Tools" menu items if there's no
current capture file, and enable the relevant ones if there is.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@983 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoAdd a "Find Frame" menu item under "Display"; it lets you use a display
guy [Sat, 6 Nov 1999 06:28:07 +0000 (06:28 +0000)]
Add a "Find Frame" menu item under "Display"; it lets you use a display
filter to search forward or backward in the list of displayed frames for
a matching frame.

When filtering the display, readjust the display to show the "current"
frame if it passed the display filter.  When a file is read in, the
first frame becomes the "current" frame; when a frame is selected, it
becomes the "current" frame, and remains so *even if you unselect it*,
until another frame is selected.

Select the first frame when a file is read in.

Disable most of the "Display" and "Tools" menu items if there's no
current capture file, and enable the relevant ones if there is.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@982 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoUpdates to the ICQ decoder, from Kojak.
guy [Sat, 6 Nov 1999 03:08:34 +0000 (03:08 +0000)]
Updates to the ICQ decoder, from Kojak.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@981 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoGet rid of an unused #define.
guy [Sat, 6 Nov 1999 02:05:32 +0000 (02:05 +0000)]
Get rid of an unused #define.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@980 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agomore updates to bgp dissector.
itojun [Sat, 6 Nov 1999 01:28:50 +0000 (01:28 +0000)]
more updates to bgp dissector.
- separate tree for each message
- added some comments
- merged my code for OPEN message, mainly just terminology updates
- searched all RFCs and defined known attributes

from: Greg Hankins <gregh@cc.gatech.edu>

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@979 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agofixed processing of tci and encapsulated proto
nneul [Fri, 5 Nov 1999 18:50:52 +0000 (18:50 +0000)]
fixed processing of tci and encapsulated proto

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@978 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoFix LPD dissector problem for bug reported by
gram [Fri, 5 Nov 1999 15:55:09 +0000 (15:55 +0000)]
Fix LPD dissector problem for bug reported by
Fabrizio Ammollo <f.ammollo@reitek.com>

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@977 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoUpdates to the ONC RPC and NFS code, from Uwe Girlich.
guy [Fri, 5 Nov 1999 07:16:23 +0000 (07:16 +0000)]
Updates to the ONC RPC and NFS code, from Uwe Girlich.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@976 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoNote that "ethereal -v" should give the GTK+ and "libpcap" version
guy [Thu, 4 Nov 1999 21:18:50 +0000 (21:18 +0000)]
Note that "ethereal -v" should give the GTK+ and "libpcap" version

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@975 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoFor the "-v" flag, dump the "libpcap" version number, if we were built
guy [Thu, 4 Nov 1999 21:04:35 +0000 (21:04 +0000)]
For the "-v" flag, dump the "libpcap" version number, if we were built
with "libpcap".

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@974 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoExpand the description of the steps to take when reporting a bug.
guy [Thu, 4 Nov 1999 19:14:53 +0000 (19:14 +0000)]
Expand the description of the steps to take when reporting a bug.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@973 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoDecode the hardware and protocol types.
guy [Thu, 4 Nov 1999 08:21:04 +0000 (08:21 +0000)]
Decode the hardware and protocol types.

Define the hardware type, protocol type, and opcode values fields as

Dissect the addresses the same way the ARP dissector does, so that we
don't completely give up if the hardware addresses aren't 6-byte
Ethernet/Token Ring addresses or the protocol addresses aren't 4-byte
Appletalk IDs.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@972 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoDefine the hardware type, protocol type, and opcode values fields as
guy [Thu, 4 Nov 1999 08:15:38 +0000 (08:15 +0000)]
Define the hardware type, protocol type, and opcode values fields as

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@971 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoInclude <netinet/in.h> before including "global.h", so that if - as
guy [Thu, 4 Nov 1999 07:06:50 +0000 (07:06 +0000)]
Include <netinet/in.h> before including "global.h", so that if - as
appears to be the case on AIX 4.3.2 - it defines BIG_ENDIAN or
LITTLE_ENDIAN differently from the way "global.h" defines them, and also
defines BYTE_ORDER, we don't get a compiler warning - instead,
"global.h" refrains from defining them (as BYTE_ORDER is defined).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@970 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoWe *do* need <netinet/in.h> on Debian (and probably other Linuxes, and
guy [Wed, 3 Nov 1999 07:06:17 +0000 (07:06 +0000)]
We *do* need <netinet/in.h> on Debian (and probably other Linuxes, and
quite possibly other UNIX-flavored OSes), in order to declare "ntohs()"
and the like.  Put the include back (I guess we could include "global.h"
after including it, or move the byte-order stuff into a separate header
file and include *that* after <netinet.h>, in order to squelch the
complaints somebody saw compiling on AIX).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@969 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoInclude <time.h>, so as to declare "ctime()" on systems where
guy [Wed, 3 Nov 1999 06:21:35 +0000 (06:21 +0000)]
Include <time.h>, so as to declare "ctime()" on systems where
<sys/time.h> doesn't include <time.h>.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@968 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoDon't include <netinet/in.h>; at least on AIX 4.3.2, that causes
guy [Wed, 3 Nov 1999 06:18:50 +0000 (06:18 +0000)]
Don't include <netinet/in.h>; at least on AIX 4.3.2, that causes
<sys/machine.h> to be included (presumably to define the machine's byte
order, to declare the "ntoh" and "hton" routines/macros correctly),
which causes BIG_ENDIAN and LITTLE_ENDIAN to be defined, but that's done
after we've included "globals.h", so they're already defined, and the
compiler complains.  We don't need it (at least not on FreeBSD).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@967 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoDon't define IPV6_VERSION; at least on AIX 4.3.2, one user got a
guy [Wed, 3 Nov 1999 06:13:20 +0000 (06:13 +0000)]
Don't define IPV6_VERSION; at least on AIX 4.3.2, one user got a
compiler warning because it was also defined by <netinet/in.h>, and
we're not using it.

Don't define IPV6_VERSION, either.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@966 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoFormat the IP header length as an unsigned quantity.
guy [Tue, 2 Nov 1999 07:06:07 +0000 (07:06 +0000)]
Format the IP header length as an unsigned quantity.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@965 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoMake the TCP header length field more closely resemble the IP header
guy [Tue, 2 Nov 1999 07:04:46 +0000 (07:04 +0000)]
Make the TCP header length field more closely resemble the IP header
length field.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@964 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoMake a bunch of the bitfields in the IP header filterable items.
guy [Tue, 2 Nov 1999 05:38:51 +0000 (05:38 +0000)]
Make a bunch of the bitfields in the IP header filterable items.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@963 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoMake a bunch of the TCP header fields filterable items.
guy [Tue, 2 Nov 1999 05:03:02 +0000 (05:03 +0000)]
Make a bunch of the TCP header fields filterable items.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@962 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agolittle bit more fixes to bgp dissector.
itojun [Tue, 2 Nov 1999 00:11:58 +0000 (00:11 +0000)]
little bit more fixes to bgp dissector.
From: Greg Hankins <gregh@cc.gatech.edu>

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@961 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoforgot to add this file... (separated from packet-bgp.c)
itojun [Mon, 1 Nov 1999 14:22:36 +0000 (14:22 +0000)]
forgot to add this file... (separated from packet-bgp.c)

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@960 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agotabify. fix BGP marker offsets.
itojun [Mon, 1 Nov 1999 09:51:59 +0000 (09:51 +0000)]
tabify.  fix BGP marker offsets.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@959 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoseparate bgp declaration into separate header file.
itojun [Mon, 1 Nov 1999 06:57:01 +0000 (06:57 +0000)]
separate bgp declaration into separate header file.
bgp message types will now appear on topmost frame.

From: gregh@cc.gatech.edu (Greg Hankins)

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@958 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoGive it an RCS ID.
guy [Sun, 31 Oct 1999 19:35:32 +0000 (19:35 +0000)]
Give it an RCS ID.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@957 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoMove the initial comment inside the first "%{", so that it shows up in
guy [Sun, 31 Oct 1999 19:34:46 +0000 (19:34 +0000)]
Move the initial comment inside the first "%{", so that it shows up in
the generated parser, so that "ident" will tell you from which version
of the grammar that parser was generated.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@956 f5534014-38df-0310-8fa8-9805f1628bb7

20 years agoThe answer to the question "why pass err to open_routines[i]() if err is
guy [Sun, 31 Oct 1999 19:30:53 +0000 (19:30 +0000)]
The answer to the question "why pass err to open_routines[i]() if err is
overwritten here?" is probably "because I was cutting-and-pasting text
to insert the error-handling code, and didn't remove the "*err = errno"
from that particular case.  Remove it now.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@955 f5534014-38df-0310-8fa8-9805f1628bb7