Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 4664] USB URB hex bytes not shown in "packet bytes" pane.

Date: Tue, 20 Apr 2010 15:17:11 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4664

Chris Maynard <christopher.maynard@xxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #4541|review_for_checkin?         |
               Flag|                            |
   Attachment #4541|0                           |1
        is obsolete|                            |
   Attachment #4549|                            |review_for_checkin?
               Flag|                            |

--- Comment #12 from Chris Maynard <christopher.maynard@xxxxxxxxx> 2010-04-20 15:17:01 PDT ---
Created an attachment (id=4549)
 --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=4549)
Updated patch #2.

This patch handles the post-processing of the Linux USB pseudo header data in
both libpcap_read() and libpcap_seek_read().  Earlier I had forgotten about the
seek.  In making that change, I also changed the arg list to
pcap_read_post_process() to only pass exactly what is needed and to make it
more generic.

Reverted the atm_guess_xyz_type() stuff for now as I don't know if it's common
or not to pcapng.

Made the necessary changes to pcapng.

Changed the byte swapping macros used to account for possibly unaligned memory
read/write.  Now using PBSWAPX instead of GUINTX_SWAP_LE_BE.

This patch also adds the changes I was working on to the PPP dissector to be
able to pass off dissection from USB -> PPP, and was the whole reason why I
became interested in fixing up the USB dissector in the first place.  With this
change, I now see a protocol stack like [USB URB/PPP In HDLC-Like
Framing/PPP/IP/GRE/IP/UDP/MYPROTO] in appropriate frames, rather than just [USB
URB].

Test with previously attached capture file or the USB capture files posted
here:
http://wiki.wireshark.org/SampleCaptures#head-886e340c31ca977f321c921f81cbec4c21bb7738.
 In particular, if you look at usb_memory_stick.pcap, besides the hex bytes
being displayed now, you'll also notice how some frames (e.g., 1-22, ...) now
appear as USBHUB instead of USB.  I'm not entirely sure why this changed, but I
assume the new behavior is correct.  I may be able to provide additional packet
captures for testing/verification, but I would have to sanitize some of them
first.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.