Developer support list for Wireshark ()

Richard Sharpe | 1 Jul 2012 18:37

The NEGOEX dissector is proceeding well

Hi folks,

I have now procured a capture with NEGOEX messages in it and am about half done.

I will post the dissector later today, most likely.

--

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev <at> wireshark.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request <at> wireshark.org?subject=unsubscribe

headers

Pontus Fuchs | 1 Jul 2012 23:20

Re: compile error related to nl ?

On 2012-06-29 21:43, Toralf Förster wrote:
> The current svn tree produces here at a Gentoo Linux a compilation error :
>
> In file included from /usr/include/libnl3/netlink/route/link.h:18:0,
>                   from iface_monitor.c:44:
> /usr/include/linux/if.h:136:8: error: redefinition of ‘struct ifmap’
> /usr/include/net/if.h:112:8: note: originally defined here
> /usr/include/linux/if.h:170:8: error: redefinition of ‘struct ifreq’
> /usr/include/net/if.h:127:8: note: originally defined here
> /usr/include/linux/if.h:219:8: error: redefinition of ‘struct ifconf’
> /usr/include/net/if.h:177:8: note: originally defined here

Hi,

This should hopefully fix your problem. net/if.h collides with 
linux/if.h (included by libnl3)

diff --git a/iface_monitor.c b/iface_monitor.c
index 71c72e1..76db493 100644
--- a/iface_monitor.c
+++ b/iface_monitor.c
 <at>  <at>  -37,7 +37,9  <at>  <at> 
  #include <strings.h>
  #include <errno.h>

+#if defined(HAVE_LIBNL1) || defined(HAVE_LIBNL2)
  #include <net/if.h>
+#endif

  #include <netlink/msg.h>

(Continue reading)

headers

Richard Sharpe | 2 Jul 2012 00:53

A much better version of packet-negoex.c ...

Hi Folks,

Here a version of the NEGOEX dissector that is pretty functional ...
and reveals that I need to add a GSS-API EAP dissector 

When I get permission to post the capture, I will create a bug and add
the capture to the bug.

Index: epan/CMakeLists.txt
===================================================================
--- epan/CMakeLists.txt	(revision 43186)
+++ epan/CMakeLists.txt	(working copy)
 <at>  <at>  -893,6 +893,7  <at>  <at> 
 	dissectors/packet-ndmp.c
 	dissectors/packet-ndp.c
 	dissectors/packet-ndps.c
+	dissectors/packet-negoex.c
 	dissectors/packet-netanalyzer.c
 	dissectors/packet-netbios.c
 	dissectors/packet-netdump.c
Index: epan/dissectors/Makefile.common
===================================================================
--- epan/dissectors/Makefile.common	(revision 43186)
+++ epan/dissectors/Makefile.common	(working copy)
 <at>  <at>  -814,6 +814,7  <at>  <at> 
 	packet-ndmp.c		\
 	packet-ndp.c		\
 	packet-ndps.c		\
+	packet-negoex.c		\
 	packet-netanalyzer.c	\

(Continue reading)

headers

Richard Sharpe | 2 Jul 2012 02:40

A bug in the SPNEGO asn1-based dissector that shows up when dissecting NTLMSSP

Hi folks,

There is a bug in the SPNEGO dissector that shows up when dissecting
the new445stream242.pcap file that was shown in the CIFS/SMB session
at Sharkfest.

It occurs in frame 8 and seems to happen because, when dissecting the
negTokenTarg, it dissects the NTLMSSP responseToken and then dissects
the mechListMIC, however, it does not think that it has used up all
the bytes in the TVB by the look of things, and redissects the
mechListMIC using a heuristic approach that tries to dissect it as
NTLMSSP, which it is not, so it screws up.

Can someone have a look at it.

--

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev <at> wireshark.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request <at> wireshark.org?subject=unsubscribe

headers

Lloyd | 2 Jul 2012 17:12

Display filter implementation

Hi,

I would like to know more about Wireshark display filters. Is its
internals are documented? Especially the display filter execution
virtual machine's instruction set.

I saw the instructions (Byte code) in the source tree, I would like to
know more about it, any documentation available?

Thanks,
  Lloyd
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@...>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@...?subject=unsubscribe

headers

Helge Kruse | 3 Jul 2012 07:17

compiling 1.8.0 on Win7

A new Wireshark stable version is out and I need to update my dissectors 
build package. Therefore I need to compile the Wireshark 1.8.0 sources.

During the build I get an error

 > tools/textify.sh: line 50: u2d: command not found

just after building of tshark.exe.

I have Cygwin installed. When I run in Cygwin bash "u2d" I get the 
"command not found" too. But I have installed cygutils 1.4.10-2 that 
should include this Unix/Dos format conversion tool. Do I need a 
specific version of Cygwin? Are there any other changes necessary in the 
build environment since Wireshark 1.6.2?

Regards
Helge

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@...>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@...?subject=unsubscribe

headers

Toralf Förster | 2 Jul 2012 16:20

Re: compile error related to nl ?

Hello Pontus,

You wrote :
>Hi,

>This should hopefully fix your problem. net/if.h collides with
>linux/if.h (included by libnl3)

fixed, thx 

--

-- 
MfG/Sincerely
Toralf Förster
pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@...>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@...?subject=unsubscribe

headers

Richard Sharpe | 3 Jul 2012 16:45

Exposing KRB5 value_strings to other dissectors ...

Hi Folks,

There are protocols that specify the use of KRB5 specified values. Eg,
NegoEx specifies RFC3961 strings.

Rather than simply re-entering these values it would be useful to
reuse the existing value_string variables, but they are static ...

Suggestions?

--

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev <at> wireshark.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request <at> wireshark.org?subject=unsubscribe

headers

mmann78 | 3 Jul 2012 17:06

Re: Exposing KRB5 value_strings to other dissectors ...

packet-cip.[ch] exposes some value_string variables, you should be able to use that as an example.

-----Original Message-----
From: Richard Sharpe <realrichardsharpe-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: Developer support list for Wireshark <wireshark-dev-IZ8446WsY0/dtAWm4Da02A@public.gmane.org>
Sent: Tue, Jul 3, 2012 10:51 am
Subject: [Wireshark-dev] Exposing KRB5 value_strings to other dissectors ...

Hi Folks, There are protocols that specify the use of KRB5 specified values. Eg, NegoEx specifies RFC3961 strings. Rather than simply re-entering these values it would be useful to reuse the existing value_string variables, but they are static ... Suggestions? -- Regards, Richard Sharpe (何以解憂？唯有杜康。--曹操) ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/dtAWm4Da02A@public.gmane.org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request-IZ8446WsY0/dtAWm4Da02A@public.gmane.org?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@...>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@...?subject=unsubscribe

headers

Stephen Fisher | 3 Jul 2012 17:22

Re: Exposing KRB5 value_strings to other dissectors ...


---- On Tue, 03 Jul 2012 08:45:46 -0600 Richard Sharpe  wrote ---- 

>There are protocols that specify the use of KRB5 specified values. Eg,
>NegoEx specifies RFC3961 strings.
>
>Rather than simply re-entering these values it would be useful to
>reuse the existing value_string variables, but they are static ...

Move them to a separate header file (without the static identifier) and include that in each dissector
source file.  Take a look at packet-x11-keysym.h for an example of sharing a value string, which is used by
packet-x11.c and packet-vnc.c.

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@...>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@...?subject=unsubscribe

194	May 2013
306	April 2013
286	March 2013
226	February 2013
157	January 2013
141	December 2012
145	November 2012
271	October 2012
231	September 2012
270	August 2012
259	July 2012
212	June 2012
271	May 2012
155	April 2012
188	March 2012
218	February 2012
267	January 2012
141	December 2011
189	November 2011
271	October 2011
297	September 2011
702	August 2011
519	July 2011
330	June 2011
367	May 2011
371	April 2011
293	March 2011
235	February 2011
278	January 2011
311	December 2010
369	November 2010
376	October 2010
313	September 2010
248	August 2010
254	July 2010
225	June 2010
341	May 2010
382	April 2010
357	March 2010
313	February 2010
382	January 2010
204	December 2009
287	November 2009
341	October 2009
350	September 2009
380	August 2009
463	July 2009
372	June 2009
393	May 2009
425	April 2009
397	March 2009
368	February 2009
192	January 2009
266	December 2008
288	November 2008
330	October 2008
218	September 2008
259	August 2008
348	July 2008
347	June 2008
280	May 2008
555	April 2008
342	March 2008
344	February 2008
350	January 2008
279	December 2007
513	November 2007
389	October 2007
325	September 2007
633	August 2007
431	July 2007
305	June 2007
433	May 2007
394	April 2007
675	March 2007
512	February 2007
736	January 2007
386	December 2006
523	November 2006
536	October 2006
578	September 2006
392	August 2006
322	July 2006
84	June 2006

Mon	Tue	Wed	Thu	Fri	Sat	Sun

						1
2	3	4	5	6	7	8
9	10	11	12	13	14	15
16	17	18	19	20	21	22
23	24	25	26	27	28	29
30	31