gmane.network.wireshark.devel

Re: Catching exceptions in dissector_try_heuristic?

Jeff Morriss — 2012-05-23T21:18:15

I've always tried to /avoid/ too many TRY/CATCH sequences, though I 
don't recall exactly why at the moment.  Performance?  Just Bad Practice?
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Re: Looking for a developer to code an ANSI/ITU mixed decoding mode

Jeff Morriss — 2012-05-23T21:16:45

Hi Jean,

Yes, 1.6.7 is from the "stable" branch.  You'd need 1.7.1 or one of the 
development (buildbot) builds from the trunk (development version).  You 
can get these from the "Development Release" or "Go Spelunking" sections 
on the main download page.

Regards,
-Jeff

ps. feel free to send me sample captures offline (no need to clog the 
list with them)

Jean Gottschalk wrote:

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Re: About the ip address -host name conversion modulein wireshark

Jim Wright — 2012-05-23T16:21:49

"whois" shows you who the domain is registered to. If you are looking for shell commands rather than library routines, then "host" or "nslookup" might work for you.

% host wireshark.com
wireshark.com has address 184.172.141.116

% host 184.172.141.116
116.141.172.184.in-addr.arpa domain name pointer seq.sequoiahosting.com.

However, as the example above shows the result you get depends on the reverse DNS entry. Some organizations do not even supply reverse DNS, in other cases you will get the name of the company or machine which supplies the virtual hosting for a domain name.

Hope this helps.


On May 23, 2012, at 4:00 AM, nangergong wrote:


___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gma

Catching exceptions in dissector_try_heuristic?

Jakub Zawadzki — 2012-05-23T16:12:51

Hi,

Should we catch BoundsError, ReportedBoundsError exceptions in dissector_try_heuristic()?
It'll fix once for ever bugs like #7277.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Re: Looking for a developer to code an ANSI/ITU mixed decoding mode

Jeff Morriss — 2012-05-23T15:48:15

Aww nuts... I already implemented (most of) this for free!  (Well, maybe 
I can get Anders to buy me a beer at Sharkfest for that ;-).)

In the current trunk (or 1.7.1 if you want a (development) release), 
MTP3 has a preference called "Try to determine the MTP3 standard 
heuristically".  When enabled, MTP3 will try to automatically determine 
the MTP3 standard (ANSI, ITU, China, or Japan).

But, this only works for MTP3 (not M3UA) and only when the payload is 
SCCP.  I tried it for M3UA but because the SCCP payload always starts at 
the same offset (because the M3UA message format does not depend on the 
MTP3 standard) the heuristics generally weren't effective.  (Admittedly 
I didn't have many ANSI M3UA captures to try it against; maybe if I had 
more I could come up with some ideas to improve it.)

Do you need it to work for non-SCCP traffic too?
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public

Re: About the ip address -host name conversion module in wireshark

Jeff Morriss — 2012-05-23T15:20:08

Check out gethostbyname() (or getaddrinfo()) and friends.

nangergong wrote:

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Looking for a developer to code an ANSI/ITU mixeddecoding mode

Jean Gottschalk — 2012-05-22T21:54:27

Hello,

we often run traces on our network with MTP3/M3UA packets that are mixed
between ANSI and ITU in the same trace.

In Wireshark, under the MTP3 decoder, we have to select whether to decode
packets as ANSI or ITU, but not both at the same time. When selecting ANSI,
all ITU packets are unreadable, and vice-versa.

I'm assuming that Wireshark is somehow aware that a packet could not be
properly decoded using 1 mode, and if so, it could be smart enough to try
with the other mode to see if that works better, and that on a packet by
packet basis.

We are looking for a wireshark developer who could code such enhancement
for us, for a fee, and contribute it to the wireshark project. It could be
a called "Auto" mode and try all available flavors when any packet cannot
be decoded.

Please contact me directly if you are interested in doing this.

Best regards,

Jean Gottschalk

President
Telecom North America Inc
http://www.telecomnorthamerica.com
_________________________________________________________________

Re: About the ip address -host name conversion module in wireshark

nangergong — 2012-05-23T12:19:50

Thanks! I'm wondering whether there are some public APIs for this function

On Wed, May 23, 2012 at 12:53 PM, Martin Visser <martinvisser99-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org>wrote:

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Re: About the ip address -host name conversion module in wireshark

Martin Visser — 2012-05-23T10:53:14

In Wireshark,  it uses DNS or what ever you manually have written in the
"ethers" or "hosts" file. Whois only shows assignments from the various
Internet Registries.

You can of course infer names (say looking at the "Host:" header in a HTTP
request) but this isn't done.

Unfortunately their is no magic to do this.

Regards, Martin

MartinVisser99-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org


On 23 May 2012 20:00, nangergong <nangergong-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote:

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Re: GnuTLS 3 support?

Anders Broman — 2012-05-23T10:37:29

 

-----Original Message-----
There is no plans to do much of anything, things get done when someone has a need for it and the time to implement it. I don't see Wireshark going
GPLv3 any thime soon so alt 1 seems to be the available option should some one have the time to implement it.
Regards
Anders


--
Guillaume
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             m

About the ip address -host name conversion modulein wireshark

nangergong — 2012-05-23T10:00:29

HI, all:

     I noticed that wireshark can show the host name(or website url) for an
ip address precisely. I need such a function which can convert an IP
address to the host name precisely. With linux command "whois", the result
is very coarse. Can anyone tell how wireshark did the conversion and can I
write some scripts or a small program to do this? I mean the input is an IP
address while the output is a host name or URL, Thanks!
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Buildbot updates - git fetch, Clang update

Gerald Combs — 2012-05-22T22:38:21

I'm in the process of updating the Clang-Code-Analysis Buildbot to use
Clang 3.1, which was officially released today. The Clang-Code-Analysis
and Fuzz-Test (1.6) now fetch code using Git so that they can run
git-compare-abis.sh.

GnuTLS 3 support?

Guillaume ALAUX — 2012-05-22T20:23:57

Hello Wireshark devs,

I recently found out that Wireshark 1.6 does not accept GnuTLS with
version > 3 [0]. Unfortunately we at Arch Linux currently ship version
3.0.19 of GnuTLS thus preventing us from using some features.

May I know what are your plans on this GnuTLS thing?  Is there any
chance version 3 could be supported at some point or do you plan on
keeping the dependency on version 2? Maybe supporting another lib as
mentioned in this thread [1]?

Thanks,

[0] https://wireshark.org/lists/wireshark-dev/201203/msg00171.html
[1] https://wireshark.org/lists/wireshark-dev/201203/msg00169.html

--
Guillaume
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Wireshark 1.4.13 is now available

Gerald Combs — 2012-05-22T18:13:33

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I'm proud to announce the release of Wireshark 1.4.13.

What is Wireshark?

   Wireshark is the world's most popular network protocol analyzer.
   It is used for troubleshooting, analysis, development and
   education.

What's New

  Bug Fixes

   The following vulnerabilities have been fixed.

     o wnpa-sec-2012-08

       Infinite and large loops in the ANSI MAP, BACapp, Bluetooth
       HCI, IEEE 802.3, LTP, and R3 dissectors have been fixed.
       Discovered by Laurent Butti. (Bugs 7118, 7119, 7121, 7122,
       7124, 7125)

       Versions affected: 1.4.0 to 1.4.12, 1.6.0 to 1.6.7.

     o wnpa-sec-2012-09

       The DIAMETER dissector could try to allocate memory improperly
       and crash. (Bug 7138)

       Versions affected: 1.4.0 to 1.4.12, 1.6.0 to 1.6.7.

     o wnpa-sec-2012-10

       Wireshark could crash on SPARC processors due to misaligned
       memory. Discovered by Klaus Heckelmann. (Bug 7221)

       Versions affected: 1.4.0 to 1.4.12,

Re: Expected ABI breakage with 1.6.8

Balint Reczey — 2012-05-21T22:47:33

Hi Gerald,

Thanks, the ABI is now compatible with 1.6.7.

Cheers,
Balint

PS: The logs:

comparing headers ...
comparing libraries ...
creating compatibility report ...
result: COMPATIBLE (total problems: 0, warnings: 0)
see detailed report:
   compat_reports/libwiretap/1.0.7_to_1.0.8/abi_compat_report.html
preparation, please wait ...
comparing headers ...
comparing libraries ...
creating compatibility report ...
result: COMPATIBLE (total problems: 0, warnings: 0)
see detailed report:
   compat_reports/libwsutil/1.0.0_to_1.0.0/abi_compat_report.html
preparation, please wait ...
Using GCC 4.4.5 (i486-linux-gnu)
checking header(s) 1.0.0 ...
Using C99 compatibility mode
checking header(s) 1.0.0 ...
Using C99 compatibility mode
comparing headers ...
comparing libraries ...
creating compatibility report ...
result: COMPATIBLE (total problems: 0, warnings: 0)
see detailed report:
   compat_reports/libwsutil/1.0.0_to_1.0.0/abi_compat_report.html
preparation, please wait ...
comparing headers ...
comparing librar

Re: Possibly unsafe padding in Yahoo dissectors?

Guy Harris — 2012-05-21T21:37:56

On May 21, 2012, at 2:21 PM, Evan Huus wrote:


I vote for 1), and either put the struct into a comment or replace the struct with a description of the packet format, in, for example, prose form, or "boxes made out of plus signs and hyphens" form or....

2) can be compiler-dependent, and not all compilers necessarily support those hints.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Possibly unsafe padding in Yahoo dissectors?

Evan Huus — 2012-05-21T21:21:40

The two files packet-ymsg.c and packet-yhoo.c both define structs
called yahoo_rawpacket. Apart from the fact that the two structs are
not the same but have the same name (confusing, but not technically a
problem), both of these structs share a common feature: they are only
ever used exactly once, and that in a sizeof() call, the result of
which is used to check packet sanity. There is never a declared
instance of either, nor are any of their fields ever directly
accessed.

It occurs to me that this isn't necessarily safe - since different
compilers and different architectures can pad structures differently,
this may result in different behaviour across platforms. Both
structures contain only char-type elements, so in principle they
shouldn't ever be padded, but it seems like a risky assumption.
Normally I'd calculate the desired size of the structure by hand and
replace the whole thing with a #define, but the structures do have the
nice property of making the expected packet layout very clear.

So my questi

Re: Expected ABI breakage with 1.6.8

Gerald Combs — 2012-05-21T19:43:10

Done in r42757. Balint, can you check the updated ABI on your end?

Re: Expected ABI breakage with 1.6.8

Guy Harris — 2012-05-21T19:39:02

On May 21, 2012, at 12:02 PM, Balint Reczey wrote:


Summary:

The data_rate field in the struct ieee_802_11_phdr structure grew from 8 bits to 16 bits.

This was a fix for bug 7134:

r42123 | alagoutte | 2012-04-18 00:22:12 -0700 (Wed, 18 Apr 2012) | 14 lines
  Changed paths:
     M /trunk/wiretap/wtap.h

  From Colus Tang via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7134

  Unable to display the correct IEEE802.11 MCS data rates due to header definition

  The problem is due to the ieee_802_11_phdr.data_rate is defined as guint8,
  since this variable is counting number of 0.5Mbps units, any datarates which is
  higher than 255Mbps would get wrapped up.  In the above example, only the lower
  8bit value will be put into the ieee_802_11_phdr which is 0x04 and result in
  the incorrect 2Mbps display.

  There are 802.11n WLAN product is capable to transmit < at >450Mbps, we should fix
  this data_rate from guint8 to guint16.

  #BACKPORT

This does *NOT* affect radiotap captures or any o

Expected ABI breakage with 1.6.8

Balint Reczey — 2012-05-21T19:02:45

Hi,

Please do not release 1.6.8 in its current state or bump library version to 
2.0.0 for libwireshark. Using 1.1.8 is misleading as 1.6.8 breaks the ABI:
http://rbalint.cs.bme.hu/ws-ABI-1.6.7-1.6.8/libwireshark/abi_compat_report.html

Please run the following command before release to verify ABI compatibility in 
the git repo:

git checkout master-1.6
git checkout master -- tools/git-compare-abis.sh
tools/git-compare-abis.sh  "./autogen.sh && ./configure && make -j3 && make dumpabi"

Thanks,
Balint
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Re: Wireshark 1.6.x requires GLib 2.10 or later, but the configure script doesn't check for that

Jeff Morriss — 2012-05-21T15:23:23

I added the reversion of 40547 to the 1.6.8 queue so 1.6's required glib 
version doesn't have to change.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe