17 years agoFix the usage message and man page for text2pcap.
guy [Sat, 24 Nov 2001 08:59:39 +0000 (08:59 +0000)]
Fix the usage message and man page for text2pcap.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4254 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoIf a non-option command-line argument is specified to Ethereal, treat it
guy [Sat, 24 Nov 2001 08:46:13 +0000 (08:46 +0000)]
If a non-option command-line argument is specified to Ethereal, treat it
as the pathname of a capture file to be read.  If more than one such
option is specified, print a usage message.

Fix the documentation of the "-r" option to Ethereal and Tethereal.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4253 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoSupport for time stamping packets in text2pcap, from Gordon McKinney.
guy [Sat, 24 Nov 2001 08:14:12 +0000 (08:14 +0000)]
Support for time stamping packets in text2pcap, from Gordon McKinney.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4252 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFix the return value of a routine.
guy [Sat, 24 Nov 2001 07:55:07 +0000 (07:55 +0000)]
Fix the return value of a routine.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4251 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoIf the expected "next offset" doesn't match the offset we read, it may
guy [Sat, 24 Nov 2001 07:52:05 +0000 (07:52 +0000)]
If the expected "next offset" doesn't match the offset we read, it may
merely mean that we mistakenly treated stuff from the text-dump part of
the file we're reading as if it were hex byte data (e.g., if the first
non-white-space part of the text dump was a 2-digit hex number).  If the
offset we read is less than the expected next offset, assume that's the
problem, and throw away enough extra bytes to make the offset we read
the expected next offset.

"getopt()" will never, for any option that the "getopt()" string says
takes an argument, leave "optarg" null; if no argument was specified,
it'll return an error, so there's no need to check for a null "optarg".

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4250 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoTreat a bunch of digits followed by a newline differently from a bunch
guy [Sat, 24 Nov 2001 02:13:34 +0000 (02:13 +0000)]
Treat a bunch of digits followed by a newline differently from a bunch
of digits followed by a blank or tab, so that we recognize the newline
as an end-of-line.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4249 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoMoved int-64bit.{c,h} into epan/
hagbard [Thu, 22 Nov 2001 03:07:07 +0000 (03:07 +0000)]
Moved int-64bit.{c,h} into epan/

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4248 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoRemove the pointer to the global packet_info from the table of
gram [Wed, 21 Nov 2001 23:34:09 +0000 (23:34 +0000)]
Remove the pointer to the global packet_info from the table of
pointers used for plugins on win32.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4247 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoRemove the global packet_info called "pi". Dissectors now only
gram [Wed, 21 Nov 2001 23:16:26 +0000 (23:16 +0000)]
Remove the global packet_info called "pi". Dissectors now only
access their own "pinfo". A packet_info is stored in epan_dissect_t,
which is created for the dissection of a single packet.

GUI functions which need to access the packet_info of the currently
selected packet used to use "pi"; now they use cfile.edt->pi. cfile's
"edt" member is the epan_dissect_t of the currently-selected packet.

The functionality of blank_packetinfo() was moved into
dissect_packet(), as that's the only place that called blank_packetinfo(),
after a spurious call to blank_packetinfo() was removed from

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4246 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoIf we have to worry about subdissectors changing the "packet_info"
guy [Wed, 21 Nov 2001 21:37:26 +0000 (21:37 +0000)]
If we have to worry about subdissectors changing the "packet_info"
structure, we may have to worry about it in more places than the places
that *used* to set "pi.len" and "pi.captured_len", so there's no point
in just saving and restoring it there.  We'll remove those
saves/restores, and worry about saves and restores when we find a

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4245 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoDiscard stuff in "smb.h" not used by the dissectors, and replace the
guy [Wed, 21 Nov 2001 06:25:58 +0000 (06:25 +0000)]
Discard stuff in "smb.h" not used by the dissectors, and replace the
#defines for SMB commands with ones that use the names from the SNIA
CIFS spec.

Use those #define values rather than hardcoded values in various places
that check for specific commands.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4244 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoSupport for Transaction Secondary and Transaction2 Secondary, from
guy [Wed, 21 Nov 2001 06:04:39 +0000 (06:04 +0000)]
Support for Transaction Secondary and Transaction2 Secondary, from
Ronnie Sahlberg.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4243 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoRename the "packet-msrpc-XXX.[ch]" files to "packet-dcerpc-XXX.[ch]", as
guy [Wed, 21 Nov 2001 02:08:57 +0000 (02:08 +0000)]
Rename the "packet-msrpc-XXX.[ch]" files to "packet-dcerpc-XXX.[ch]", as
per Todd Sabin's suggestion.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4242 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoGet rid of some unused variables.
guy [Wed, 21 Nov 2001 02:01:06 +0000 (02:01 +0000)]
Get rid of some unused variables.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4241 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoGet rid of some unused variables.
guy [Wed, 21 Nov 2001 01:21:08 +0000 (01:21 +0000)]
Get rid of some unused variables.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4240 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoGet rid of some unused variables.
guy [Wed, 21 Nov 2001 01:02:03 +0000 (01:02 +0000)]
Get rid of some unused variables.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4239 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFix an earlier typo of mine.
guy [Wed, 21 Nov 2001 01:01:17 +0000 (01:01 +0000)]
Fix an earlier typo of mine.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4238 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoGet rid of "tvb_compat()"; it's no longer needed (the one remaining call
guy [Tue, 20 Nov 2001 22:46:12 +0000 (22:46 +0000)]
Get rid of "tvb_compat()"; it's no longer needed (the one remaining call
to it returns data that's no longer used).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4237 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoGet rid of the "len" and "captured_len" members of the "packet_info"
guy [Tue, 20 Nov 2001 22:29:07 +0000 (22:29 +0000)]
Get rid of the "len" and "captured_len" members of the "packet_info"
structure; they're no longer used.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4236 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoMake the capture routines take an additional argument giving the amount
guy [Tue, 20 Nov 2001 21:59:18 +0000 (21:59 +0000)]
Make the capture routines take an additional argument giving the amount
of packet data captured.

Make the "BYTES_ARE_IN_FRAME()" macro take a "captured length of the
packet" argument.

Add some length checks to capture routines.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4235 f5534014-38df-0310-8fa8-9805f1628bb7

17 years ago"END_OF_FRAME" and "IS_DATA_IN_FRAME()" are no longer used; get rid of
guy [Tue, 20 Nov 2001 20:57:10 +0000 (20:57 +0000)]
"END_OF_FRAME" and "IS_DATA_IN_FRAME()" are no longer used; get rid of

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4234 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoHave a routine to add all the hex dump tabs to the hex dump notebook,
guy [Tue, 20 Nov 2001 10:37:16 +0000 (10:37 +0000)]
Have a routine to add all the hex dump tabs to the hex dump notebook,
and call it both from "select_packet()" and "create_new_window()",
rather than having two similar loops in both places.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4233 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoIf bytes in a hex dump view are selected, the field in the corresponding
guy [Tue, 20 Nov 2001 10:10:45 +0000 (10:10 +0000)]
If bytes in a hex dump view are selected, the field in the corresponding
text view should be selected, rather than always selecting a field in
the main text view.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4232 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoAllow the tvbuff pointer to various "proto_tree_add" routines to be null
guy [Tue, 20 Nov 2001 09:07:34 +0000 (09:07 +0000)]
Allow the tvbuff pointer to various "proto_tree_add" routines to be null
if (and only if) the length of the item being added is 0 (so that it has
no data backing it).

This means the data stream name pointer for the item in question is
null; make sure we handle that.

Use that for some "uses the value from the matching request" fields in
the SMB Pipe protocol.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4231 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFrom Ronnie Sahlberg: handle transaction continuations the way we handle
guy [Tue, 20 Nov 2001 08:18:01 +0000 (08:18 +0000)]
From Ronnie Sahlberg: handle transaction continuations the way we handle
NT Cancel, as transaction continuations don't get a response, either.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4230 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoDissect the rest of the named pipe protocol. Export from "packet-smb.c"
guy [Tue, 20 Nov 2001 07:47:42 +0000 (07:47 +0000)]
Dissect the rest of the named pipe protocol.  Export from "packet-smb.c"
routines used for that.

Rename some named pipe functions as per the SNIA CIFS spec.

Label the "number of files moved" field of the reply to a Move SMB as
such, rather than as an unspecified "Count".

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4229 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoSave the function code and FID for pipe requests, and use it for the
guy [Tue, 20 Nov 2001 06:24:20 +0000 (06:24 +0000)]
Save the function code and FID for pipe requests, and use it for the
matching responses.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4228 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFrom Frank Singleton:
guy [Mon, 19 Nov 2001 23:00:12 +0000 (23:00 +0000)]
From Frank Singleton:

- accept struct and union lists passed in via ethereal_be.py
- these lists are unused until I add the templates for struct
  and union helper functions. So code generation is unchanged
  for the moment.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4227 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFrom Frank Singleton:
guy [Mon, 19 Nov 2001 22:58:49 +0000 (22:58 +0000)]
From Frank Singleton:

- find all union/struct references and store in lists.
  This includes embedded unions and structs.
- pass the struct and union lists onto ethereal_gen.py
- print all found nodes at DEBUG

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4226 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoWhen reading the preferences file, if the "module.preference" string
gram [Mon, 19 Nov 2001 19:53:14 +0000 (19:53 +0000)]
When reading the preferences file, if the "module.preference" string
references an unknown module, check the "preference" part to see if
another "." is found; iterate until a known module is found, or until
nor more "."'s are found.

Needed for the new "x.25.non_q_bit_is_sna" preference.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4225 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoIf we know the pipe function code, put the function into the Info
guy [Mon, 19 Nov 2001 12:34:51 +0000 (12:34 +0000)]
If we know the pipe function code, put the function into the Info

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4224 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoDissect the setup words in pipe transactions that have them; that
guy [Mon, 19 Nov 2001 11:41:51 +0000 (11:41 +0000)]
Dissect the setup words in pipe transactions that have them; that
obviates the need to have a protocol tree item for "MSRPC-over-SMB", as
the setup words for it are just standard TransactNmPipe setup words
(0x26 is the TransactNmPipe function code, and the next setup word is
the FID for the pipe in question.)

Pass to the pipe dissector tvbuffs for setup-words-plus-pipe (which is
the data for the pipe protocol) and parameters-plus-data (which is the
data for the protocol running atop the pipe protocol); use the former
for the top-level protocol tree item for the pipe protocol, and the
latter for the top-level protocol tree item for the LANMAN protocol.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4223 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoMake the register routines for the mailslot, pipe, browser, and
guy [Mon, 19 Nov 2001 10:23:39 +0000 (10:23 +0000)]
Make the register routines for the mailslot, pipe, browser, and
mailslot-based logon protocols just be regular register routines,
detected by the script that generates the "register.c" file, rather than
special stuff known to the SMB dissector.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4222 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoPass, as the first tvbuff argument to "dissect_mailslot_smb()" and
guy [Mon, 19 Nov 2001 10:06:42 +0000 (10:06 +0000)]
Pass, as the first tvbuff argument to "dissect_mailslot_smb()" and
"dissect_pipe_smb()", a tvbuff containing the setup words and the
pipe/mailslot pathname, as those are arguably the part of the packet
that contains the "mailslot protocol" and the "pipe protocol", as
opposed to the protocol running atop mailslots or pipes.

Pass a setup tvbuff to "dissect_pipe_smb()" for it to pass on to the
MSRPC-over-named-pipe dissector, and have the setup tvbuff passed to it
and "dissect_mailslot_smb()" contain *only* the setup words; don't
extract anything other than the setup words from it.

Declare "register_proto_smb_mailslot()" in "packet-smb-mailslot.h"
rather than "packet-smb.c", and declare "register_proto_smb_pipe()" in
"packet-smb-pipe.h" rather than "packet-smb.c".

Add a protocol for MSRPC-over-named-pipes.

Move the stuff to handle the FID in the setup words of
MSRPC-over-named-pipe transactions out of the SMB Transaction dissector
into the MSRPC dissector.  Add a routine to "packet-smb.c", callable
from outside "packet-smb.c", to put an "smb.fid" field into the protocol
tree, and to add ", FID: XXXX" to the Info column, for use by the
MSRPC-over-named-pipe dissector; use it in the SMB dissector as well, in
all the places where we put a FID into the protocol tree.

Move the stuff to check whether the LANMAN protocol is enabled, and to
set "pinfo->current_proto" to "LANMAN" if it is, into the LANMAN
API-over-named-pipe dissector out of the named pipe protocol dissector.

If we didn't dissect a Transaction request or reply as a named pipe or
mailslot message, put any setup words, parameters, and data it has into
the protocol tree as separate items.

Don't put a "Response in" item into the protocol tree for an NT Cancel
request, as there are no responses to NT Cancel requests.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4221 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFrom Tim Potter: use the FID, for DCE RPC-over-SMB, as part of the
guy [Sun, 18 Nov 2001 22:44:08 +0000 (22:44 +0000)]
From Tim Potter: use the FID, for DCE RPC-over-SMB, as part of the
conversation matching.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4220 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFrom Tim Potter:
guy [Sun, 18 Nov 2001 22:12:46 +0000 (22:12 +0000)]
From Tim Potter:

display the returned FID in the Info column for NT Create And X

display the setup words, and treat the second word as a FID in
Transaction requests presumed to contain DCE RPC-over-SMB.

Add the FID to the Info column for other open/create replies while we're
at it.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4219 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoPass in the "smb_info" structure a pointer to the "smb_saved_info_t"
guy [Sun, 18 Nov 2001 02:51:20 +0000 (02:51 +0000)]
Pass in the "smb_info" structure a pointer to the "smb_saved_info_t"
structure, so that it can be updated by subdissectors; this way the
updates affect the structure immediately, and don't get lost if the
subdissector later throws an exception.

Use "tvb_reported_length()" to check for an interim mailslot reply;
"tvb_length()" could give the wrong answer if a short snapshot length
was given in the capture.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4218 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoAdded hooks to allow the registration of heuristic subdissectors of
hagbard [Sun, 18 Nov 2001 02:28:15 +0000 (02:28 +0000)]
Added hooks to allow the registration of heuristic subdissectors of

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4217 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoHave only the request and response frame numbers, and a "void *", in an
guy [Sun, 18 Nov 2001 01:46:51 +0000 (01:46 +0000)]
Have only the request and response frame numbers, and a "void *", in an
"smb_saved_info_t".  Put all the information needed to dissect NT
Transaction replies, Transaction2 replies, or Transaction replies into
separate data structures, allocated separately, and put a pointer to
that data structure in the "void *" in question.

Use the return value of "dissect_pipe_smb()" and
"dissect_mailslot_smb()" to control whether to display as data the stuff
those routines were asked to dissect.

If we've seen a request before, but its "smb_saved_info_t" isn't in the
"matched" hash table, look in the "unmatched" hash table - perhaps we
haven't seen the reply yet.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4216 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoAdd some bits in the Write AndX write mode as per "Microsoft Networks
guy [Fri, 16 Nov 2001 10:19:35 +0000 (10:19 +0000)]
Add some bits in the Write AndX write mode as per "Microsoft Networks
Extensions Version 2.0, Document Version 3.3".

Fix the test for the "connectionless mode" to test the correct bit.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4215 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoNever put an entry into the hash table for an NT Cancel request, even if
guy [Fri, 16 Nov 2001 09:52:29 +0000 (09:52 +0000)]
Never put an entry into the hash table for an NT Cancel request, even if
we didn't find the request it's cancelling.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4214 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoDon't save a full "smb_info" structure in the hash tables for requests
guy [Fri, 16 Nov 2001 09:27:03 +0000 (09:27 +0000)]
Don't save a full "smb_info" structure in the hash tables for requests
and replies, just save a structure holding that information that can't
be derived from the contents of one of the SMBs.

Don't save anything at all for NT Cancel requests - they have the same
TID/PID/MID/UID as the SMB being cancelled, and you want the information
for that request used when dissecting the NT Cancel (so it gets the
number of the frame containing the request being cancelled) and when
dissecting the reply to the request being cancelled.

Get rid of an unused routine.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4213 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoCleanup of request/response matching, from Ronnie Sahlberg.
guy [Fri, 16 Nov 2001 07:56:28 +0000 (07:56 +0000)]
Cleanup of request/response matching, from Ronnie Sahlberg.

Get rid of "Response to" stuff in the LANMAN dissector, as that's now
done in the SMB dissector.

Add a routine for dissecting unknown SMBs (gets the word and byte
counts, and just adds text entries for the word and byte parameters, if
any), and replace null pointers in the dissector table with pointers to
that routine.  Get rid of the check for a null dissector pointer.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4212 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoResponses to queries for stream information can return more than one
guy [Fri, 16 Nov 2001 02:53:11 +0000 (02:53 +0000)]
Responses to queries for stream information can return more than one
piece of information in the reply, as a file can have more than one
stream; show all of them.

Don't use the "File Name" field for stream names.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4211 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoUse "hf_smb_t2_stream_size", not "hf_smb_t2_stream_name_length", when
guy [Fri, 16 Nov 2001 01:52:27 +0000 (01:52 +0000)]
Use "hf_smb_t2_stream_size", not "hf_smb_t2_stream_name_length", when
adding the stream size.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4210 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoAdd "packet-qllc.c".
guy [Thu, 15 Nov 2001 21:50:02 +0000 (21:50 +0000)]
Add "packet-qllc.c".

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4209 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoUpdate Gerald's e-mail address.
guy [Thu, 15 Nov 2001 21:32:18 +0000 (21:32 +0000)]
Update Gerald's e-mail address.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4208 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoAdd support for SNA-over-X.25. Add QLLC dissector. I still need to
gram [Thu, 15 Nov 2001 21:11:01 +0000 (21:11 +0000)]
Add support for SNA-over-X.25. Add QLLC dissector. I still need to
work on dissecting the Information frame of QLLC packets.
Thanks to mario.ferreira@hsbc.com.br for lots of information on SNA
over X.25.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4207 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoAdd some packet-*.h files to noinst_HEADERS.
gram [Thu, 15 Nov 2001 20:35:23 +0000 (20:35 +0000)]
Add some packet-*.h files to noinst_HEADERS.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4206 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoGet rid of NullTVB, the "compat_top_tvb" member of the "packet_info"
guy [Thu, 15 Nov 2001 10:58:51 +0000 (10:58 +0000)]
Get rid of NullTVB, the "compat_top_tvb" member of the "packet_info"
structure, the check for a null tvbuff pointer in "alloc_field_info()",
and the "tvb_create_from_top()" macro; they're no longer needed, as
there's no non-tvbuffified dissector code remaining.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4205 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoTvbuffification of Transaction requests, from Ronnie Sahlberg.
guy [Thu, 15 Nov 2001 10:41:53 +0000 (10:41 +0000)]
Tvbuffification of Transaction requests, from Ronnie Sahlberg.

"Send buffer pointer" and "send buffer length" items appear not to be
sent over the wire.

Add support for Write And X.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4204 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoMake the RADIUS dissector handle bogus AVPs (AVPs with a length less
guy [Wed, 14 Nov 2001 23:10:12 +0000 (23:10 +0000)]
Make the RADIUS dissector handle bogus AVPs (AVPs with a length less
than the size of the AVP header) a bit better.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4203 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoBack the previous hack out - the padding is often zero, but it's not
guy [Wed, 14 Nov 2001 22:54:26 +0000 (22:54 +0000)]
Back the previous hack out - the padding is often zero, but it's not
*always* zero, so it won't always work, and it's somewhat gross.  The
right answer is "don't use Digital/Tru64 UNIX's tcpdump, use

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4202 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoThrow in a hack to try to detect FDDI captures from Digital UNIX's
guy [Wed, 14 Nov 2001 22:34:41 +0000 (22:34 +0000)]
Throw in a hack to try to detect FDDI captures from Digital UNIX's
tcpdump and, if we think we've found one, strip off the 3 padding bytes
they put in front of the frame.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4201 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoUpdate two values for XAUTH (XAUTH-NEXT-PIN, XAUTH-ANSWER), in
gram [Wed, 14 Nov 2001 20:02:23 +0000 (20:02 +0000)]
Update two values for XAUTH (XAUTH-NEXT-PIN, XAUTH-ANSWER), in
accordance with http://www.vpnc.org/draft-beaulieu-ike-xauth.
From Yaniv Kaul <ykaul@checkpoint.com>

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4200 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoHopefully the last time I have to change my e-mail address.
gram [Tue, 13 Nov 2001 23:55:44 +0000 (23:55 +0000)]
Hopefully the last time I have to change my e-mail address.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4199 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoSquelch an MSVC++ complaint.
guy [Tue, 13 Nov 2001 06:17:07 +0000 (06:17 +0000)]
Squelch an MSVC++ complaint.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4198 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoThe hash table merely associates data structures with conversations,
guy [Tue, 13 Nov 2001 04:34:38 +0000 (04:34 +0000)]
The hash table merely associates data structures with conversations,
but you can do that directly, so eliminate the hash table and just
attach the data structures to the conversation directly.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4197 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoInclude the sync I/O alert and nonalert bits.
guy [Mon, 12 Nov 2001 21:43:49 +0000 (21:43 +0000)]
Include the sync I/O alert and nonalert bits.

Put in comments about some of the other bits.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4196 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFrom Tim Potter: added code to call request and reply subdissectors in DCE
guy [Mon, 12 Nov 2001 09:04:11 +0000 (09:04 +0000)]
From Tim Potter: added code to call request and reply subdissectors in DCE

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4195 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoSupport for DCE RPC atop SMB, and support for several Microsoft DCE RPC
guy [Mon, 12 Nov 2001 08:58:45 +0000 (08:58 +0000)]
Support for DCE RPC atop SMB, and support for several Microsoft DCE RPC
services used with SMB, from Tim Potter.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4194 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoTransaction2 tvbuffified, and support added for many Transaction2 SMBs,
guy [Mon, 12 Nov 2001 08:46:14 +0000 (08:46 +0000)]
Transaction2 tvbuffified, and support added for many Transaction2 SMBs,
from Ronnie Sahlberg.

Various other bug fixes, cleanups, and other improvements.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4193 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoDissect the NT create option bits. (Well, some of them, anyway.)
guy [Sun, 11 Nov 2001 02:27:06 +0000 (02:27 +0000)]
Dissect the NT create option bits.  (Well, some of them, anyway.)

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4192 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoChange from Tim Potter to show the error status in the Info column for
guy [Sat, 10 Nov 2001 22:23:11 +0000 (22:23 +0000)]
Change from Tim Potter to show the error status in the Info column for
SMBs that got errors.

Add some additional access mask bits, and the URL of another spec.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4191 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoMicrosoft calls it "Dfs", not "DFS", perhaps to avoid confusion with the
guy [Fri, 9 Nov 2001 22:58:10 +0000 (22:58 +0000)]
Microsoft calls it "Dfs", not "DFS", perhaps to avoid confusion with the
OSF's DCE DFS (which is completely unrelated to Dfs).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4190 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoNT Create and X support, from Ronnie Sahlberg.
guy [Fri, 9 Nov 2001 22:45:22 +0000 (22:45 +0000)]
NT Create and X support, from Ronnie Sahlberg.

"#if 0" out an unused routine, pending determination of whether there's
any place that would use it.

Fix some typos.

Display the NT create options in hex, as they appear to be a bitmask.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4189 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoRemove "text2pcap-scanner.obj" and "tools\lemon\lemon.obj" when a "nmake
guy [Fri, 9 Nov 2001 09:22:07 +0000 (09:22 +0000)]
Remove "text2pcap-scanner.obj" and "tools\lemon\lemon.obj" when a "nmake
clean" is done.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4188 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFix a couple of comments.
guy [Fri, 9 Nov 2001 08:36:56 +0000 (08:36 +0000)]
Fix a couple of comments.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4187 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFixes from Kazushi Sugyo:
guy [Fri, 9 Nov 2001 08:16:25 +0000 (08:16 +0000)]
Fixes from Kazushi Sugyo:

1) print the payload length in AH headers correctly (the field's
   value is length of the payload, minus 2, divided by 2, so we
   have to add 2 before multiplying by 2);

2) correctly handle, in an SIOCGIFCONF list, entries whose
   address has an "sa_len" field less than the size of a "struct
   sockaddr" (the length of the address in an entry is the
   maximum of the real length and the size of a "struct

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4186 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoPut in an XXX note indicating that if we conclude we're using the AIX
guy [Fri, 9 Nov 2001 07:51:01 +0000 (07:51 +0000)]
Put in an XXX note indicating that if we conclude we're using the AIX
libpcap, we may also want to return a flag indicating that we have to
map seconds/nanoseconds in the packet header to seconds/microseconds.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4185 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoWrap calls to "pcap_datalink()" in a routine that attempts to compensate
guy [Fri, 9 Nov 2001 07:44:51 +0000 (07:44 +0000)]
Wrap calls to "pcap_datalink()" in a routine that attempts to compensate
for AIX 5.x's non-standard libpcap, where "pcap_datalink()" doesn't
return DLT_ values, it returns RFC 1573 ifType values.

Put that wrapper, and the routine to get the interface list, in a
separate file, for packet-capture utility routines, so not everybody who
includes "util.h" needs to include <pcap.h>.

Fix up the Wiretap hack for dealing with said incompatibility to use the
correct ifType value for Token Ring.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4184 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoTvbuffification of SMB print commands, from Ronnie Sahlberg.
guy [Fri, 9 Nov 2001 06:43:38 +0000 (06:43 +0000)]
Tvbuffification of SMB print commands, from Ronnie Sahlberg.

Fix up some SMBs I missed when adding the byte-count checks.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4183 f5534014-38df-0310-8fa8-9805f1628bb7

17 years ago2^n is 1 << n, not 2 << n.
guy [Fri, 9 Nov 2001 02:04:35 +0000 (02:04 +0000)]
2^n is 1 << n, not 2 << n.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4182 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFrom <a.stockmeier[AT]avm.de>: fix the file dialog box code to use
guy [Fri, 9 Nov 2001 00:08:30 +0000 (00:08 +0000)]
From <a.stockmeier[AT]avm.de>: fix the file dialog box code to use
"g_strdup()", not "strdup()" to copy strings.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4181 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoPrint the create flags with 8 hex digits.
guy [Thu, 8 Nov 2001 10:57:09 +0000 (10:57 +0000)]
Print the create flags with 8 hex digits.

Add some checks of the return value of
"get_unicode_or_ascii_string_tvb()" - if a null terminator is missing,
it might well run past the end of the byte parameters - and add some
code to keep the byte count updated so that the right byte count is
passed to "get_unicode_or_ascii_string_tvb()".

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4180 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoPut the stuff to handle file data in read and write requests into a
guy [Thu, 8 Nov 2001 10:34:11 +0000 (10:34 +0000)]
Put the stuff to handle file data in read and write requests into a
common subroutine.

Label the "total data length" field in Write Raw and Write Multiplexed
requests as such.

Dissect the IPC State/Device State field of Open and X requests and NT
Create and X requests ass per the stuff on page 67 of


Make a variable that doesn't need to be static not static.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4179 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoNT Transact dissection, from Ronnie Sahlberg.
guy [Thu, 8 Nov 2001 08:21:13 +0000 (08:21 +0000)]
NT Transact dissection, from Ronnie Sahlberg.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4178 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoAllow periods in module names.
gram [Thu, 8 Nov 2001 02:54:31 +0000 (02:54 +0000)]
Allow periods in module names.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4177 f5534014-38df-0310-8fa8-9805f1628bb7

17 years ago"dissect_open_print_file_smb()" was defined but not used; put it into
guy [Wed, 7 Nov 2001 20:30:43 +0000 (20:30 +0000)]
"dissect_open_print_file_smb()" was defined but not used; put it into
the appropriate entry in the "dissect[]" table.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4176 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoMPLS support for handling either IPv4 or IPv6 as the payload protocol
guy [Wed, 7 Nov 2001 20:26:38 +0000 (20:26 +0000)]
MPLS support for handling either IPv4 or IPv6 as the payload protocol
type, from Hamish Moffatt.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4175 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoUpdate the URL for Cygwin.
guy [Wed, 7 Nov 2001 18:49:57 +0000 (18:49 +0000)]
Update the URL for Cygwin.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4174 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoExpand on the comments about AIX libpcap.
guy [Wed, 7 Nov 2001 08:16:26 +0000 (08:16 +0000)]
Expand on the comments about AIX libpcap.

No, Nokia *weren't* kind enough to change the major or minor version
number in the capture file when they changed the format, just as they
weren't kind enough to change the magic number.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4173 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFurther tvbuffication from Ronnie Sahlberg.
guy [Wed, 7 Nov 2001 08:05:04 +0000 (08:05 +0000)]
Further tvbuffication from Ronnie Sahlberg.

Get rid of a bunch of stuff for which said tvbuffication removes the

When dissecting byte parameters, make sure you don't consume more bytes
than the byte count, and handle captures where the last string in the
byte parameters area isn't properly null-terminated (I think I've seen
that in packets from various versions of Windows NT).

Make various bitfields given as decimal in SMB specs decimal.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4172 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agocode cleanup
girlich [Wed, 7 Nov 2001 07:05:58 +0000 (07:05 +0000)]
code cleanup
AUTH reply dissector added

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4171 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoIEEE 802.1x, a/k/a EAPOL, and PPP/EAPOL EAP support, from Pekka
guy [Tue, 6 Nov 2001 20:30:40 +0000 (20:30 +0000)]
IEEE 802.1x, a/k/a EAPOL, and PPP/EAPOL EAP support, from Pekka

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4170 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoAUTH call dissected. It includes XOR encoded user name/passwords. I did
girlich [Tue, 6 Nov 2001 18:32:30 +0000 (18:32 +0000)]
AUTH call dissected. It includes XOR encoded user name/passwords. I did
a decode on the fly.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4169 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoPCNFSD added for Uwe Girlich
girlich [Tue, 6 Nov 2001 13:44:08 +0000 (13:44 +0000)]
PCNFSD added for Uwe Girlich

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4168 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoPCNFSD dissector file packet-pcnfsd.c added to source list
girlich [Tue, 6 Nov 2001 13:43:44 +0000 (13:43 +0000)]
PCNFSD dissector file packet-pcnfsd.c added to source list

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4167 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agostart of a PCNFSD dissector, header file
girlich [Tue, 6 Nov 2001 13:42:35 +0000 (13:42 +0000)]
start of a PCNFSD dissector, header file

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4166 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoStart of a PCNFSD dissector as the RPC dissector 150001.
girlich [Tue, 6 Nov 2001 13:42:04 +0000 (13:42 +0000)]
Start of a PCNFSD dissector as the RPC dissector 150001.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4165 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoAdd in some heuristics to try to detect AIX libpcap format. (This works
guy [Tue, 6 Nov 2001 01:55:14 +0000 (01:55 +0000)]
Add in some heuristics to try to detect AIX libpcap format.  (This works
with one capture I've seen, but perhaps that was done with an old
version of AIX, and newer versions use a minor version number, in the
file, of 4.

However, libpcap hasn't used a minor version of 2 for ages, so perhaps
AIX hasn't updated their libpcap in ages, and aren't about to do so
soon.  If they do, let's hope they change the magic number.  The capture
file in question *does* have the capture length and real length in the
old, pre-2.3, order, so it really looks as if it's an old version,
rather than IBM trying to be "helpful" by using a different minor
version number so that you can distinguish between normal libpcap and
AIX libpcap formats.)

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4164 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFrom Tom Uijldert: have an non-heuristic UCP dissector, and register it
guy [Mon, 5 Nov 2001 21:41:33 +0000 (21:41 +0000)]
From Tom Uijldert: have an non-heuristic UCP dissector, and register it
as a TCP conversation dissector, so that it can be selected in the
"Decode As" dialog box.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4163 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoIPCOMP transformation and ID_IPV4_ADDR_SUBNET for ISAKMP, from
guy [Mon, 5 Nov 2001 21:36:07 +0000 (21:36 +0000)]
IPCOMP transformation and ID_IPV4_ADDR_SUBNET for ISAKMP, from

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4162 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFix the previous change to handle SMBs with tvbuffified dissectors.
guy [Mon, 5 Nov 2001 07:58:33 +0000 (07:58 +0000)]
Fix the previous change to handle SMBs with tvbuffified dissectors.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4161 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoPut andX commands at the same level as the first command.
guy [Mon, 5 Nov 2001 07:46:01 +0000 (07:46 +0000)]
Put andX commands at the same level as the first command.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4160 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoPut in some references.
guy [Mon, 5 Nov 2001 05:39:31 +0000 (05:39 +0000)]
Put in some references.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4159 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFurther tvbuffication, from Ronnie Sahlberg.
guy [Mon, 5 Nov 2001 05:24:17 +0000 (05:24 +0000)]
Further tvbuffication, from Ronnie Sahlberg.

Convert a bunch of "proto_tree_add_XXX" calls to "proto_tree_add_item"

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4158 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoFuther tvbuffification from Ronnie Sahlberg.
guy [Mon, 5 Nov 2001 01:44:17 +0000 (01:44 +0000)]
Futher tvbuffification from Ronnie Sahlberg.

Do more sanity checking on DOS dates and times.

Convert a bunch of "proto_tree_add_XXX" calls to "proto_tree_add_item"

Put the word and byte data for untvbuffified SMBs under a subtree just
as is done for tvbuffified SMBs.

Get rid of some no-longer-used routines.

Fix some displays in untvbuffified SMBs to resemble the way those fields
are displayed for tvbuffified SMBs.

Display timesouts as seconds and milliseconds when they're in units of

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4157 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoSUA dissector, from Michael Tuexen, replacing (and subsuming) the SUA
guy [Sun, 4 Nov 2001 22:19:23 +0000 (22:19 +0000)]
SUA dissector, from Michael Tuexen, replacing (and subsuming) the SUA
Light dissector.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4156 f5534014-38df-0310-8fa8-9805f1628bb7

17 years agoInclude "conversation.h", as the plugin API now includes the routines to
guy [Sun, 4 Nov 2001 22:14:43 +0000 (22:14 +0000)]
Include "conversation.h", as the plugin API now includes the routines to
create and find conversations.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4155 f5534014-38df-0310-8fa8-9805f1628bb7