gmane.network.wireshark.devel

manual address resolution is broken

Ed Beroset — 2013-05-23T15:05:05

Today I was analyzing some capture files and wanted to use manual name resolution to make things a little to interpret, but I found out that manual name resolution no longer works.  The bug has already been reported https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8462 and a patch submitted, but I'm not sure that patch is the right way to resolve things since it basically undoes (incompletely) a deliberate change that was done some months ago: http://anonsvn.wireshark.org/viewvc?view=revision&revision=45511

In my particular case, I have multiple capture files of traffic between the same two points and so it would actually be convenient in my case for the manual address resolution to persist between capture files.  On this particular machine, I have root privileges, and so could edit the hosts file, but we can't count on that for most people.  

Before I change the code, I think it would be useful to agree on desired behavior first.  At the moment, it's clearly broken because right after a manual name is

Wireshark 1.10.0rc2 is now available

Gerald Combs — 2013-05-22T23:49:25

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I'm proud to announce the release of Wireshark 1.10.0rc2.

     __________________________________________________________

What is Wireshark?

   Wireshark is the world's most popular network protocol
   analyzer. It is used for troubleshooting, analysis, development
   and education.
     __________________________________________________________

What's New

  Bug Fixes

   The following bugs have been fixed:
     * Redirecting the standard output didn't redirect the output
       the of -D or -L flags. This fix means that the output of
       those flags now goes to the standard output, not the
       standard error, as it did in previous releases. [1]Bug 8609

  New and Updated Features

   The following features are new (or have been significantly
   updated) since version 1.8:
     * Wireshark on 32- and 64-bit Windows supports automatic
       updates.
     * The packet bytes view is faster.
     * You can now display a list of resolved host names in

What is the use of pointer "cap_file_" in QtShark

Richard Turner — 2013-05-22T17:21:45

In Wireshark/ui/qt/main_window.h there is a private member variable 
defined as:

capture_file *cap_file_;

I think it's a pointer to the global variable "cfile" (defined in tshark.c).

Is it true that we keep this pointer only to verify the validity of 
cfile (we set cap_file_ to NULL when the capture file is closed)?

Regards,
-Richard Turner

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Add an option to tshark to give the prefix or wholetempfile name?

Anders Broman — 2013-05-22T16:12:51

Hi,
We have some automated scripts that uses tshark occasionally dumpcap crashes and leaves huge files in /tmp to fix that we write to a named file which
Causes its own problems. A solution could be to provide tshark with the name or the prefix of the tempfile to be able to clean up or over write the file.
Would someone be willing to implement this? I think it should be possible to use long option names tempfilename?

Regards
Anders

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Keep getting "unresolved external symbol" error when trying to use "summary_fill_in"

Richard Turner — 2013-05-22T05:19:07

Hello,

I'm trying to implement the statistics summary window in QtShark, but 
when I use these two functions I keep getting LNK2019 "unresolved 
external symbol" error from my VS2010 compiler:

summary_fill_in(&cfile, &summary);
summary_fill_in_capture(&cfile, &global_capture_opts, &summary);

both are located in summary.c

I've tested using the two functions in main.cpp(which properly included 
the headers needed), and I got the same link error.


The headers I've included are as follows:
#include <string.h>
#include <time.h>
#include "config.h"
#include <glib.h>
#include "qt_ui_utils.h"
#include <epan/strutil.h>
#include <wiretap/wtap.h>
#include "globals.h"
#include "file.h"
#include "summary.h"
#include "version_info.h"

#ifdef HAVE_LIBPCAP
#include "../capture.h"
#include "ui/capture_globals.h"
#include "../capture-pcap-util.h"
#endif

Regards,
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public

TCP packet reassemble problem

Hardik Patel — 2013-05-21T09:59:10

Hello,

I am developing plugin in wireshark, which is working fine for single TCP
packet.

My dissector tvb buffer start correctly after tcp checksum at the offset of
0035.

But in case of Reassembled packets, i can see that my tvb buffer for
dissector pointing at the start of frame at 0000.


so how can i make my tvb buffer pointing at the end of tcp checksum as it
should do.??

because of this problem my dissector wrongly dissecting frame.



Regards,
Hardik Patel
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

ZigBee APS decription

Fabio Tarabelloni — 2013-05-20T19:49:04

Hi,

I updated the repository and after the sources compile process wireshark
does't decript the APS command. If I open the same capture with release
software the problem is not present.
(note: I compiled the current trunk sources in linux)

Fabio.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Unexpected tap behaviour

Anders Broman — 2013-05-20T18:36:45

Hi,
I just implemented the export_pdu tap for Diameter as well as SIP to my 
surprise if I don't define
a filter only SIP packets get experted from a file with both Diameter 
and SIP. If I specify a filter of
"diameter or SIP" both gets exported. I would have expected both to be 
exported with no filter. Could any one shed
some light on what's going on?
Regards
Anders

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Kept support of Visual Studio 2005

Alexis La Goutte — 2013-05-20T15:20:47

Hi,

i found this line (in ui/gtk/summary_dialog.c)

#if (defined _WIN32) && (_MSC_VER < 1500)
  /* calling localtime() on MSVC 2005 with huge values causes it to crash */
  /* XXX - find the exact value that still does work */
  /* XXX - using _USE_32BIT_TIME_T might be another way to circumvent this
problem */
  if (ti_time > 2000000000) {
      ti_tm = NULL;
  } else
#endif
  ti_tm = localtime(&ti_time);


and i ask if you need to kept the support of VS2005.

I search in mailing archive and not found specifically a topic about this.

May be cleanup the support of VS2005 with 1.11 ?
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

COTP dissector problems

Daniele Pala — 2013-05-19T12:38:04

Hello, I've written a simple RFC 1006 implementation (
https://github.com/danielePala/tosi) and used Wireshark to monitor the
generated traffic. I'm seeing some problems, I attach a capture file to
illustrate them, generated by the test cases of my implementation:

1. A lot of packets are marked as malformed, with reference to the T.125
protocol (which I never intended to implement). See, for example, packet
number 4 of the capture file.

2. It seems that the ER (error) TPDU is not recognized, see packet number
26 for example.

3. RFC 1006 defines a non-standard TPDU to support expedited data (see page
14 of the standard, http://tools.ietf.org/html/rfc1006), but this is not
recognized, see packet number 132 for example.

Of course, the attached capture file can be also generated by re-running
the tests of my package.

NOTE: I'm using Wireshark 1.8.2 shipped with Debian Wheezy, however, in the
changelogs of the more recent versions I haven't found mentions to these
issues, so I suppose they are still there.

GSOC Project:Process information

kunal bansal — 2013-05-19T13:36:54

based on post
http://www.wireshark.org/lists/wireshark-dev/201305/msg00039.html
&
http://www.wireshark.org/lists/wireshark-dev/201305/msg00118.html

i got to know that the implementation has already been done in linux but we
have to devise a UI via wireshark for the same

Besides For *Windows*:
honeevent can also be implemented using  winpcap
though using netshdump (which works via ETW, a good realtime support)works
great to create a log file but it doesn't seems an option because it uses
higher administrative rights.
So if we really want to realtime access we need to make a script using ETW
on windows.

hone_notify can work as it is
.

FOR* Mac OSX*

As mentioned in my proposal,using dtrace scripts is a nice option.

conntrack DTrace script for Solaris and Opensolaris to monitor all outgoing
TCP and UDP connections by process, user and port.

It has some filtering capabilities allowing to filter traffic by port,
process or user.


https://github.com/kunalbansal16/demo/blob/master/wiresharkdemo/mac%20os/dtra

Wireshark 1.6.7 Memory Corruption

gobejishvili — 2013-05-17T12:01:54

Hello,

 I'm Security Researcher, found memory corruption vulnerability in
Wireshark 1.6.7 version 64BIT, vulnerability detect to kubuntu x64. Drag
and drop can to make memory corruption.
After running it in GDB.

Program received signal SIGSEGV, Segmentation fault.
0x000055555568527f in dnd_open_file_cmd ()
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

Info for Sharkfest'13

Edwin Abraham — 2013-05-17T11:38:57

Is there any session that will be held in a online sense.
I am interested in attending. But I won't be able to come due to the
distance.

Sharkfset '13 - Hackfest

Anders Broman — 2013-05-17T11:00:05

Hi,
If anyone is participating in the Hackfest it might be a good idea to start discussion on topics of interest in case preparations are needed.

-          Bug fixing.

-          New features ( How to implement, not I would like to have this developed by someone else ( well that's OK too but don't expect it to actually happen :) ).

-          Dissector development.

-          Knowledge sharing, how to .... ( debug, profile ...)

-          Qt

-          High speed capturing on standard servers.

-          Scripting data collection.

-          Managing proprietary Wireshark extensions.

-          ?

People new to Wireshark development should try to have their build environments set up before arriving, ask here if you have problems.

Regards
Anders
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wiresh

Code sharing between TLS and DTLS

Hauke Mehrtens — 2013-05-15T15:02:24

The DTLS rfc6347 describes just the differences to tls (ssl) and these
two protocols are very similar. Currently the wireshark dissectors for
tls and dtls are not sharing much code, just at little in ssl-utils.c.

I did some improvements for the DTLS dissector and much of this was
copying the code from tls and doing some small modifications to it. I
would like to place more code like the parsing of a some handshake
messages to ssl-utils.c, so the code is shared between the dissectors.
At first I want to copy dissect_ssl3_hnd_cert_req() to ssl-utils.c and
use it also in dtls. What is the best way to do this? Are there any
examples? I saw that a similar thing was done with the x509 certificates
in the tls handshake.

Hauke
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-d

recent fuzz failures

Jeff Morriss — 2013-05-16T01:43:04

Hi Gerald,

The fuzz bot has been failing every single build recently.  The failures 
related to source capture 10749-test.pcapng.gz make sense to me: I can 
reproduce the out-of-memory condition which is reported in bug 6898. 
But I can't reproduce any of the others and yet the buildbot is 
consistently reporting seg-faults.

Can any problems with those captures be reproduced on the buildbot 
itself?  Can anyone else find a problem with these fuzz'd captures?

Regards,
-Jeff
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

filter packets

Ahmed Elshaer — 2013-05-15T22:19:01

can i filter packets that contains a specific text string , i just
want to capture the packets that contain that string not any other
string , if this can be done please give me example if it cant , could
u please tell me any other way to do it
thanks alot
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

New icon as seen over rdesktop

Jeff Morriss — 2013-05-15T18:57:43

Hi Gerald,

I noticed someplace where the new Wireshark icon...  Well, looks a 
little funny.  I don't mind at all but I mention it because it seems 
sometimes this kind of thing drives graphics people crazy.

The attached crop of a screenshot is what I see when I rdesktop from 
Fedora 18 into a Windows XP laptop (which happens to have 1.10.0rc1 
installed).  Note the... Pixelization(?) around the edges of the icon.

The only interesting options I give to rdesktop are "-xl -E".  When I 
start it, it does complain thus:

 > WARNING: Remote desktop does not support colour depth 24; falling
 > back to 16

but I think this isn't related to color depth.

Regards,
-Jeff
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dt

Tools for GSoC mentors

Flower Platform Team — 2013-05-15T13:17:00

Hello GSoC Mentors,

As you are participating to Google Summer of Code, I'm wondering if you 
could consider using Flower Dev Center [1] while working with students.

Flower Dev Center is an online platform for UML modeling diagramming, 
with a strong focus on code synchronization, integration with dev tools 
(Git, SVN, etc) and real time collaboration on diagrams (and a little 
bit on code as well).

We think Flower Dev Center can be helpful for both: mentors and students 
during Google Summer of Code. We have created an article on this topic 
(i.e. Flower Dev Center + GSoC): [2], [3].

If you have a couple of spare minutes, could you tell us if you would 
like to use Flower Dev Center? And/or raise topics that you think are 
important (based on previous GSoC participations) to be supported by 
Flower Dev Center?

The next version of Flower Dev Center, the 2.0.0 planned for June/July 
2013, has major new features, that we did not demonstrate yet and that 
will improve even more the collaboration between dev

wireshark component in Qt

Ahmed Elshaer — 2013-05-14T18:40:41

could u plz , tell me what is the component i can use in Qt as "packetList"
pane
and what is the technique i can use so when i select a packet from
packetlist pane i can do a tree decode in the second pane ,
plz any information that can help me
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe

compiling qtshark

Ahmed Elshaer — 2013-05-12T23:07:26

i want to compile qtshark which is a port for wireshark in qt, and i just
opened a qtshark.pro
and try to compile and it gives me this erroe:
"Can't find config.pri. Have you run 'nmake -f Makefile.nmake' two
directories up?"
please tell me instructions or steps to compile because i never use make to
compile before.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A< at >public.gmane.org?subject=unsubscribe