Wireshark · Ethereal-dev: Re: [ethereal-dev] Checked in Wiretap changes to eliminate "ftell()" calls

[Olivier Abad <abad@xxxxxxxxxxxxx>]

On lun, aoû 30, 1999 at 01:54:53 -0700, Guy Harris wrote:
> > Here is a new patch with no ftell() (I didn't read the subject
> > carefully enough the first time).
> 
> OK, I've checked your patch in, plus the "pletoh[ls]()" calls.
> 
> It works better, although if I click on the TCP packets, the protocol
> tree doesn't include any TCP stuff - the COTP stuff seems to work,
> though.

It works fine here.
Are the byte view and packet view correct (including the info column in
packet view) ?

Here is an example of what I have for packet no. 223 :

Frame (69 on wire, 69 captured)
    Arrival Time: May 21, 1999 15:12:48.5395
    Packet Length: 69 bytes
    Capture Length: 69 bytes
LAPB
    Address: 0x01
    Control field: I, N(R) = 3, N(S) = 4 (0x68)
        011. .... = N(R) = 3
        .... 100. = N(S) = 4
        .... ...0 = Information frame
X.25
    GFI : Q: 0, D: 0, Mod: 8
    Logical channel : 003
    Data
                  010..... : P(R) = 2
                  ...0.... : More bit
                  ....011. : P(S) = 3
                  .......0 : Packet type id = DATA
Internet Protocol
    Version: 4
    Header length: 20 bytes
    Type of service: 0x00 (None)
        000. .... = routine precedence
        ...0 .... = normal delay
        .... 0... = normal throughput
        .... .0.. = normal reliability
        .... ..0. = normal cost
    Total Length: 64
    Identification: 0x535b
    Flags: 0x0
        .0.. .... = may fragment
        ..0. .... = last fragment
    Fragment offset: 0
    Time to live: 30
    Protocol: TCP (0x06)
    Header checksum: 0xd0be
    Source: 163.78.1.1 (163.78.1.1)
    Destination: 163.78.49.1 (163.78.49.1)
Transmission Control Protocol
    Source port: 3540 (3540)
    Destination port: 9010 (9010)
    Sequence number: 205632002
    Acknowledgement number: 316608001
    Header length: 20 bytes
    Flags: 0x18
        ..0. .... = No urgent pointer
        ...1 .... = Acknowledgment
        .... 1... = Push
        .... .0.. = No reset
        .... ..0. = No Syn
        .... ...0 = No Fin
    Window size: 4096
    Checksum: 0x0bf1
Data (24 bytes)

   0  0016 0000 0000 05a9 0000 0101 0000 0337   ...............7 
  10  0000 0101 0000 0003                       ........         

The full byte view is :

0000  01 68 10 03 46 45 00 00  40 53 5b 00 00 1e 06 d0   .h..FE.. @S[..... 
0010  be a3 4e 01 01 a3 4e 31  01 0d d4 23 32 0c 41 b2   ..N...N1...#2.A. 
0020  02 12 df 0e 01 50 18 10  00 0b f1 00 00 00 16 00   .....P.. ........ 
0030  00 00 00 05 a9 00 00 01  01 00 00 03 37 00 00 01   ........ ....7... 
0040  01 00 00 00 03

Olivier
-- 
Hmmm ... A hash-singer and a cross-eyed guy were SLEEPING on a deserted
island, when ...