summaryrefslogtreecommitdiff
path: root/doc
AgeCommit message (Collapse)AuthorFilesLines
2017-07-03Add option to use wall-clock intervalsHEADmasterSake Blok3-12/+21
Add the "interval" option to "-b". Each new capture starts at the exact start of a time interval. For instance, using -b interval:3600 will start a new capture file at each whole hour. Changed the duration option in the GUI interfaces to use the new interval option. Change-Id: I0180c43843f5d2f0c2f50153c9ce42ac7fa5aeae Reviewed-on: https://code.wireshark.org/review/22428 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Sake Blok <sake.blok@SYN-bit.nl>
2017-06-28Don't worry about initializing auto aggregates with non-constant values.Guy Harris1-9/+16
On UN*X, you can get C99-or-later compilers, and we request that in the autoconf script, so it's really a requirement. At least as I read https://msdn.microsoft.com/en-us/library/34h23df8%28v=vs.100%29.aspx Visual Studio 2010 (and earlier, going back to VS .NET 2003) supports the "Use of block-scope variables initialized with nonconstant expressions", with an example of an aggregate (array) initialization involving function calls, so it sounds as if it's available on Windows with any version of VS that we support. (If I've missed something, it'll presumably show up when something is built with MSVC, and we can update this at that point.) So the only thing to avoid is initializing global or static variables with a value that has to be evaluated at run time (the ability to do that is probably present in most environments, as I think C++ constructors for variables with static storage duration might have to be evaluated before main() is called, but I guess few C compilers bother to use it). Expand the example in the hopes of avoiding confusion between "static storage duration" (which something declared "static" has, but which anything declared with file scope, whether declared "static" or not, also has) and "static storage duration and internal linkage", which is what the "static" keyword specifies. Change-Id: I338eb0892e656c2ab59519e4bf76e1dfbec2fa7d Reviewed-on: https://code.wireshark.org/review/22434 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-27Fix the "don't initialize with non-constant variables" item.Guy Harris1-4/+20
It only applies to variables with static storage duration, i.e. global and static variables. Expand the example of how to do it, to make it a bit clearer. Change-Id: Ie0c473a35a77351dd10d6c9df2c34a39f077fca4 Reviewed-on: https://code.wireshark.org/review/22430 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-22Make "matches" case-insensitive.Gerald Combs1-9/+15
Make the "matches" operator case-insensitive by default. Case sensitivity can be switched back on using "(?-i)". It might be nice to make "contains" case-insensitive as well, but we'd need a caseless version of epan_memmem. Change-Id: I5e39a52c148477c30c808152bcace08348df815a Reviewed-on: https://code.wireshark.org/review/22330 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-06-22Add --no-duplicate-keys tshark option.Daan De Meyer1-0/+7
Adds the --no-duplicate-keys option to tshark. If -T json is specified, this option can be specified in order to transform the duplicate keys produced by -T json into single keys with as value a json array of all separate values. Specifying --no-duplicate-keys changes the function which groups node children that is passed to write_json_proto_tree. Instead of a function that puts each node in a separate group (proto_node_group_children_by_unique) a function is passed that groups children that have the same json key together (proto_node_group_children_by_json_key). This will lead to some groups having multiple values. Groups with multiple values are written to the output as a json array. This includes normal json keys but also keys with the "_raw" and "_tree" suffix. If --no-duplicate-keys is specified with an option other than "-T json" or "-T jsonraw" or without -T an error is shown and tshark will exit. "Export Packet Dissections -> As JSON" in the GUI is hardcoded to use the duplicated keys format. Fixes one regression in the output where a filtered json key (-j) with both a value and children would not have the "_tree" suffix added to the json key containing the children. Includes a little code cleanup (removes one instance of code duplication and simplifies a while loop). Fixes a memory leak (I thought this fix was already included in the previous refactor patch but something must have gone wrong when updating the patch so I'm including it again in this patch). Bug: 12958 Change-Id: I401f8fc877b5c590686567c3c44cdb832e9e7dfe Reviewed-on: https://code.wireshark.org/review/22166 Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-06-22Add notes about predefined strings not available to pluginsDirk Weise1-1/+7
The documention refers dissector authors to helpful predifined string structures that plugin authors unfortunately cannot use. Bug: 13828 Change-Id: I62cdfeb200c9b354aed44d40c80a0e8f9e8f910b Reviewed-on: https://code.wireshark.org/review/22339 Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-06-12Add support for color xml attributes in psml and pdml formats.Michael Mann2-0/+6
Bug: 6682 Change-Id: I19330d06aa3d5692503c61369c3c650d595971f5 Reviewed-on: https://code.wireshark.org/review/22077 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Stephen Donnelly <stephen.donnelly@endace.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-06-11tshark: add "--color" option emulating wireshark colorsDave Goodell1-0/+9
With this commit, tshark will mimic the packet coloring present in the Wireshark GUI whenever "--color" is passed. This initial commit only adds such support for the standard text output format. A future commit could potentially broaden this support to other output modes (such as "-V" mode). Bug: 5158 Change-Id: I59329e32475b0c67e28802e79610544d4868ea2d Reviewed-on: https://code.wireshark.org/review/21325 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-05-30Qt: Add support to verify extcap capture filterMichael Mann1-0/+7
Bug: 11668 Change-Id: Ib218d87c1905e53ffdab4e3dd6f93ba2c3d07c8b Reviewed-on: https://code.wireshark.org/review/21770 Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net> Reviewed-by: Roland Knall <rknall@gmail.com>
2017-05-05extcap: Update example help textStig Bjørlykke1-2/+2
Change-Id: I1240af78664d6066650be67b95f0423a5353c711 Reviewed-on: https://code.wireshark.org/review/21508 Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2017-05-05Auto reset epan sessionHessam Jalali1-0/+12
Automatically resets intarnal epan session after reaching to specified number of packets, for example -M 1000 will reset the session every 1000 packets. this is more like a proposal since the usage is very specific it is useful for 24/7 live capture with dissection and sending data directly to another application. example: tshark -Y "gtp" -M 100000 -T fields -e gtp.message -e gtp.teid Change-Id: I8ee8b0380017c684120a93cb3fb43f41615a9c04 Reviewed-on: https://code.wireshark.org/review/21312 Reviewed-by: Evan Huus <eapache@gmail.com> Petri-Dish: Evan Huus <eapache@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-05-02Qt: Interface Toolbar improvementsStig Bjørlykke2-10/+12
- Select one of the capturing interfaces when start capture - Only send user changed control values when start capture - Don't show hidden interfaces - Allow a toolbar with no interfaces - Renamed button role "reset" to "restore" - Improved control number validation - Updated documentation Change-Id: Icc8d04043c95c1f3ef8d7cdc3b251be4471cba0a Reviewed-on: https://code.wireshark.org/review/21445 Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2017-04-28Add proto_tree_add_item_ret_boolean().Guy Harris1-0/+4
It does what it says on the label. You get back TRUE or FALSE in a gboolean. While we're at it, remove a copied-and-pasted comment that doesn't apply, and update another comment. Change-Id: I117391d2ffe44124a614a7f64dad1b389c1ebc6a Reviewed-on: https://code.wireshark.org/review/21394 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-26Add proto_tree_add_item_ret_uint64Michael Mann1-0/+4
Just like proto_tree_add_item_ret_uint, but with 64-bit support Change-Id: Ie0cbfda9e63bf21e85df2d674e391a6c0abe92f7 Reviewed-on: https://code.wireshark.org/review/21355 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-04-25Qt: Add interface toolbar supportStig Bjørlykke2-13/+351
An extcap utility can provide configuration for controls to use in a GUI interface toolbar. This controls are bidirectional and can be used to control the extcap utility while capturing. This is useful in scenarios where configuration can be done based on findings in the capture process, setting temporary values or give other inputs without restarting current capture. Todo: - Add support for Windows Change-Id: Ie15fa67f92eb27d8b73df6bb36f66b9a7d81932d Reviewed-on: https://code.wireshark.org/review/19982 Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2017-04-18Rename BASE_VALS_NO_UNKNOWN to BASE_SPECIAL_VALS.Guy Harris1-7/+9
It makes it a bit clearer what its purpose is - to allow a value_string to be used for numeric rather than enumerated fields, giving certain values of the field a special meaning. Change the explanation in the documentation to match as well. Change-Id: Id07b22eee996b79ea5f3473928d29adcabe09bf3 Reviewed-on: https://code.wireshark.org/review/21209 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-17Qt: Provide both file save and open preferencesAhmad Fatoum1-2/+3
This is a breaking change. prefs_register_filename_preference hasn't been differentiating between files to be saved and ones to be opened. On GTK, a neutral dialog is used, so no problems there. On Qt, a save dialog has been always used, even in dissectors that were reading configuration files without modification. prefs_register_filename_preference now takes an argument to indicate whether UI could be a save dialog with a warning on overwriting a file, or whether it's a general purpose open file dialog. Qt now does this. Previously no warning was shown on overwriting a file, so it may be used for opening files too without irritating the user. This has been changed, as non-destructive reads should now use the open dialog. Dissectors were changed accordingly. Change-Id: I9087fefa5ee7ca58de0775d4fe2c0fdcfa3a3018 Reviewed-on: https://code.wireshark.org/review/21086 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-04-17Clean up documentation and help messages for protocol enabling/disabling.Guy Harris2-4/+20
List all of --enable-protocol, --disable-protocol, --enable-heuristic, and --disable-heuristic in the SYNOPSIS section of the man pages. Undent after the list of taps for the -z option, so the following options are at the same indentation as other options. List --enable-protocol in the DESCRIPTION, above --disable-protocol. Include --enable-protocol in the help message. Change-Id: I680a54430789f3543b2d539fbded22b0b57f7f76 Reviewed-on: https://code.wireshark.org/review/21159 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-10Add support for BASE_VALS_NO_UNKNOWNAlexis La Goutte1-2/+9
BASE_VALS_NO_UNKNOWN is a special value_string value for only a single (maybe 2) numerical value(s). If a field has the numerical value that doesn't match anything in the value_string, just the number is supplied for the field (no "Unknown") Dissectors that had this use case have been converted in the patch. Change-Id: Ie63a36cceec2fe4436938ec7e3d7f9e690d2b8d9 Reviewed-on: https://code.wireshark.org/review/20736 Petri-Dish: Michael Mann <mmann78@netscape.net> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-04-05A bunch of "{Mac} OS X" -> "macOS" changes.Guy Harris2-4/+4
Avoid anachronisms, however; there was no "macOS 10.0" or even "OS X 10.0", for example. It was "Mac OS X" until 10.8 (although 10.7 was sometimes called "OS X" and sometimes called "Mac OS X"), and it was "OS X" from 10.8 to 10.11. Change-Id: Ie4a848997dcc6c45c2245c1fb84ec526032375c3 Reviewed-on: https://code.wireshark.org/review/20933 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-29Add ENC_TIME_MSEC_NTP and use it in packet-gtpv2.cAndersBroman1-1/+4
While at it fix expert info a typo and an calculation. Change-Id: I071a36edb7eed5f58708b98aebcb24bc6c34f2a8 Reviewed-on: https://code.wireshark.org/review/20766 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-03-28Reflect new default value of snaplen in man pages.Martin Sehnoutka3-4/+4
Default value for snaplen is defined in wiretap/wtap.h: #define WTAP_MAX_PACKET_SIZE 262144 and used in capture_opts.c: capture_opts->default_options.snaplen = WTAP_MAX_PACKET_SIZE; but help and man pages don't reflect this change. Change-Id: I35ddf1e8b7ffd657f4e01b3fe6b4c44c9acece2b Reviewed-on: https://code.wireshark.org/review/20738 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com> Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-28text2pcap: define max packet size to WTAP_MAX_PACKET_SIZEPascal Quantin1-1/+1
Change-Id: I73ab87032e4a0c0259227622412be36aaf66a9d6 Reviewed-on: https://code.wireshark.org/review/20758 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-28Get rid of blanks at the ends of lines.Guy Harris1-12/+12
Change-Id: I10a756a4a42d4f27f59e12c11f12d71947191c92 Reviewed-on: https://code.wireshark.org/review/20760 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-28Fix up time encodings.Guy Harris1-8/+50
Add some new encodings for absolute time stamps, and use them as appropriate; this fixes some cases where the time stamps in question were being dissected incorrectly. For the encodings with seconds and 1/2^32s of a second, don't arbitrarily give only microsecond resolution; 2^32 is greater than 1 million, and, in fact, at least some NTP RFCs explicitly talk about time resolution greater than 1 microsecond. Update references in the RELOAD dissector to reflect the documents in question having been updated and published as RFCs. Change-Id: Icbe0b696d65eb622978eb71e99ddf699b84e4fca Reviewed-on: https://code.wireshark.org/review/20759 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-23capinfos: Add -K option and report capture comments lastJim Young1-0/+10
This patch adds a capinfos -K option to suppess printing of capture comments. This patch also changes when capture comments are printed relative to the other enabled infos. Because capture comments are freeform we will now defer their printing until all but the interface detail infos are printed. Change-Id: Ibb3df040c09e4c67d714c561869c00e08b83d6ed Reviewed-on: https://code.wireshark.org/review/20643 Petri-Dish: Jim Young <jim.young.ws@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-03-19Remove a reference to deleted doc/README.epan_childJoerg Mayer1-1/+0
Change-Id: I521674267873fe32c3ff5b53c9fb6a9e971d8772 Reviewed-on: https://code.wireshark.org/review/20631 Reviewed-by: Jörg Mayer <jmayer@loplof.de>
2017-03-19ciscodump (man): fix typo dependant -> dependentAlexis La Goutte1-1/+1
found by lintian Change-Id: I5ce951fca2213d3d18807cde061dea201a36999f Reviewed-on: https://code.wireshark.org/review/20628 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-19Remove echld/.Joerg Mayer1-251/+0
It has been unsupported for some years and when talking about removing it in the past I received some positive and no negative feedback. There is one instance of echld left: capchild/capture_sync.c: * echld might have already reaped the child. Can that case be removed or should be comment be updated to something more accurate? (left for a separate patch) Change-Id: Idac397158dd86fd0728eb95379449ee4a463fc28 Reviewed-on: https://code.wireshark.org/review/20619 Petri-Dish: Jörg Mayer <jmayer@loplof.de> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-03-19tshark: Optionally delimit packet summary columns with tabsJim Young1-2/+6
This patch augments tshark's -T report with a "tabs" option. When the -T tabs option is enabled an ASCII horizontal tab character is inserted between each column of the human-readable one-line packet summary record. Change-Id: Id10a6e21e231eb2e52b6342ed05399db1a5fcfdf Reviewed-on: https://code.wireshark.org/review/20537 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-12rpcap URLs *require* the :<port> argument for remote capture - update manpage.Joerg Mayer1-2/+2
Change-Id: Iabae39347bc0058d106a9b00d81629899bc93249 Reviewed-on: https://code.wireshark.org/review/20526 Reviewed-by: Jörg Mayer <jmayer@loplof.de>
2017-03-03Check profile directory before personal directory for services and subnets fileMichael Mann1-0/+4
Bug: 11228 Change-Id: Id8bcc51ff694ef9f2019bc7509e440021d049d22 Reviewed-on: https://code.wireshark.org/review/19735 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-03-03Update documentation with reference to $XDG_CONFIG_HOMEPeter Wu3-3/+10
Since v2.1.0rc0-184-gb0b53fa593, $XDG_CONFIG_HOME/wireshark (instead of $HOME/.wireshark) is used, clarify this in the WSUG and manuals. Change-Id: I74a6f9b86bd8d54ee326ca83d7536e091d6da08a Reviewed-on: https://code.wireshark.org/review/20364 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-02-26Bugfix for extcap fileselect functionality, start button in extcap options ↵Kim Bäckström2-4/+13
dialog wouldn't get enabled if the user had selected a file (and mustexist=true wasn't specified). This commit also contains minor fixes to doc/README.extcap, it's now more aligned to the actual implementation. Added example usage of fileselect, radio and multiselect to doc/extcap_example.py. Change-Id: Ibfe40a35a26f49322fbe64c0594506a2163f7e20 Reviewed-on: https://code.wireshark.org/review/20274 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Roland Knall <rknall@gmail.com>
2017-02-25json2pcap support addedMartin Kacer1-7/+21
Modified tshark -T json -x output Added tshark -T jsonraw output json2pcap.py (can be used for basic packet editing by modifying json) The modification in tshark -T json -x and new tshark -T jsonraw output add into hex-data output in JSON also information on which position each field is dissected in the original frame, what is the field length, bitmask (for not byte aligned fields) and type. This information can be used for latter processing. One use-case is json2pcap script which assembles the protocol layers back together from upper to lowers layers, which allows the basic packet modification/editing/rewriting. Change-Id: Ibf948eb8fc7e3b0b51c12df6c3855f705a9c7925 Reviewed-on: https://code.wireshark.org/review/19990 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Dario Lombardo <lomato@gmail.com> Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-24pluginif: Add documentation for toolbar interfaceRoland Knall1-0/+108
Add the documentation for the new toolbar interface to the README file Change-Id: I9dd37dc4f31760ccd1c9a3e6ae379cd6f9ca1db9 Reviewed-on: https://code.wireshark.org/review/20261 Reviewed-by: Roland Knall <rknall@gmail.com>
2017-02-17Rawshark: Try to avoid a VC runtime crash.Gerald Combs1-0/+4
The MSDN documentation for _read says "If fd is invalid, the file is not open for reading, or the file is locked, the invalid parameter handler is invoked, as described in Parameter Validation." This means that on Windows, if our parent has closed stdin when we call _read we'll crash. Add a check to bail out early if that's happened. Fix a sign cast while we're here. Change-Id: I8afb75f6e56c6a6c2b62103ba7e2fb635dc85702 Reviewed-on: https://code.wireshark.org/review/20153 Reviewed-by: Gerald Combs <gerald@wireshark.org>
2017-02-13Make Libgcrypt a mandatory dependencyPeter Wu1-4/+3
Removed all guards for HAVE_LIBGCRYPT, change autotools and CMake to error out if it is not available. Update release notes, developer documentation and README with the new status. Clarify relation with GnuTLS in macosx-setup.sh. Install Libgcrypt via brew script. Motivation for this change is that many dissectors depend on Libgcrypt and having it optional increases the maintenance burden (there have been several compile issues in the past due to the optional status). Furthermore, wsutil has crypto code that can be replaced by Libgcrypt. Change-Id: Idf0021b8c4cd5db70b8766f7dcc2a8b3acbf042f Link: https://www.wireshark.org/lists/wireshark-dev/201702/msg00011.html Reviewed-on: https://code.wireshark.org/review/20030 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-08editcap: handle too short frames in frame comparisonJaap Keuter1-3/+4
With option -I one can ignore the first number of bytes from the frame while doing duplicate frame removal. This doesn't handle shorter frames correctly. Add safeguards for this, and update the help text. Bug: 13378 Change-Id: Ia6b65d0797f4069f0b89fa134114d88d80988211 Reviewed-on: https://code.wireshark.org/review/20004 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-02Rawshark: Add a memory limit (-m) option.Gianluca Borello1-0/+6
Add an option to rawshark that lets the user set a maximum memory limit. Change-Id: Ie102ee5f6ba5aec90a35bd63297184c7dc37662c Reviewed-on: https://code.wireshark.org/review/19911 Reviewed-by: Gerald Combs <gerald@wireshark.org>
2017-02-02Qt: Add extcap placeholder parameterStig Bjørlykke2-4/+4
Added a parameter to set placeholder text in textBox. Change-Id: Iccf92fe60abc78be8f0fa112c0c9eb78890674b5 Reviewed-on: https://code.wireshark.org/review/12463 Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Roland Knall <rknall@gmail.com>
2017-01-22MAN wireshark-filter: Add ~ operatorUli Heilmeier1-4/+4
The tilde (~) operator was missing as an alternative for matches. Bug: 13320 Change-Id: Idb96c802145dcdd0d9ffc196b32370cadd8735b3 Reviewed-on: https://code.wireshark.org/review/19723 Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-01-10Rename tvb_new_subset() to tvb_new_subset_length_caplen().Guy Harris1-1/+1
This emphasizes that there is no such thing as *the* routine to construct a subset tvbuff; you need to choose one of tvb_new_subset_remaining() (if you want a new tvbuff that contains everything past a certain point in an existing tvbuff), tvb_new_subset_length() (if you want a subset that contains everything past a certain point, for some number of bytes, in an existing tvbuff), and tvb_new_subset_length_caplen() (for all other cases). Many of the calls to tvb_new_subset_length_caplen() should really be calling one of the other routines; that's the next step. (This also makes it easier to find the calls that need fixing.) Change-Id: Ieb3d676d8cda535451c119487d7cd3b559221f2b Reviewed-on: https://code.wireshark.org/review/19597 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-12-31Add interface for "pinos" (Protocols in name only)Michael Mann1-5/+34
This is for dissectors that need distinguishing names either for registering multiple dissection functions in a single dissector table or for "internal" dissectors whose just need a name associated with the dissection function. Features like enable/disable are handled by the "parent" protocol. This avoids clutter in the "official" protocol list. Change-Id: I69e7d27d332ae85286f254e95e8d79920da7a9e2 Reviewed-on: https://code.wireshark.org/review/19464 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-12-30Add BASE_NO_DISPLAY_VALUE to allow field value to not be shown.Michael Mann1-1/+6
There are times when byte arrays don't want to show their value in the packet tree or there is a field that is the "header" of a subtree where showing the field value distracts from the tree display. For these cases, BASE_NO_DISPLAY_VALUE can be used to not display the value. Change-Id: I8c9f1f57cd2e663dbee07e2289e7f5e1f22d1e32 Reviewed-on: https://code.wireshark.org/review/19479 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-12-14extcap: add info to extcap manpage (taken from README.extcap).Dario Lombardo1-1/+29
Ping-Bug: 13218 Change-Id: Ib43dc2ce8ae7991468b866aec3f03f6a5709f8b2 Reviewed-on: https://code.wireshark.org/review/19177 Reviewed-by: Michael Mann <mmann78@netscape.net> Reviewed-by: Dario Lombardo <lomato@gmail.com>
2016-12-14README.extcap: impagination improvement.Dario Lombardo1-32/+40
Change-Id: I1cc0dc6496bea8e42c199dff116530ccec6fb591 Reviewed-on: https://code.wireshark.org/review/19089 Reviewed-by: Roland Knall <rknall@gmail.com>
2016-12-13Add support for adding unit names to hf_ fields.Michael Mann1-1/+33
This was inspired by the https://www.wireshark.org/lists/wireshark-dev/201505/msg00029.html thread. Used TCP and NTP dissectors as the guinea pig with sample use. Documentation updates includes some unrelated cleanup just because it was noticed. Change-Id: I59b26e1ca3b95e3473e4757f1759d7ad82976965 Reviewed-on: https://code.wireshark.org/review/19211 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-12-09extcap: add new option type (timestamp).Dario Lombardo2-0/+10
Bug: 12787 Change-Id: I941833c55fb607c8af2ef832082af58d7b94e965 Reviewed-on: https://code.wireshark.org/review/18721 Petri-Dish: Roland Knall <rknall@gmail.com> Reviewed-by: Roland Knall <rknall@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-12-03tshark: Add -G folders reportJim Young1-0/+7
Add a new tshark feature to generate a folders report. The folders report is essentially the information presented by Wireshark's About / Folders page in a TAB delimited format. Change-Id: Ic4b3d332b4bdaa7e6b7aad1e9cc5dd18413aada6 Reviewed-on: https://code.wireshark.org/review/19002 Petri-Dish: Jim Young <jim.young.ws@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Michael Mann <mmann78@netscape.net>
generated by cgit v1.2.1 (git 2.18.0) at 2024-05-02 14:48:44 +0000