adding patch

shanky · 10-19-2011, 07:55 AM

hii i need to add a mesh support patch to my wireshark.can anybody tell me the steps involved.
Thanks

phaemon · 10-19-2011, 09:56 AM

Do you? The page at http://o11s.org/trac/wiki/HOWTO says that their mesh patches have now been incorporated into Wireshark. Maybe you just need a newer version?

shanky · 10-20-2011, 12:27 AM

yes i did google it before posting but in some links i have read that it is not yet perfect or something like..nevertheless can you guys tell me the steps involved.
thanks

phaemon · 10-20-2011, 03:54 AM

Just get the right version of the source code that matches the patch you have, put the patch in the same directory as the file you want to patch and then do (where patchfile.txt is the name of your patch file):

Code:

patch -p0 < patchfile.txt

That's it! Well, obviously you'll need to compile and install the code as well...

shanky · 10-20-2011, 03:59 AM

Thank you for the info..Can you tell where can i get the source code for my version??
wireshark website? google? soory a little new to this stuff..i googled it but dint get any source code..

phaemon · 10-20-2011, 04:43 AM

Which version is it for? What patch did you get?

shanky · 10-20-2011, 04:58 AM

using wireshark 1.3.2 and got the mesh support patch for this version from this link http://o11s.org/patches/wireshark/

phaemon · 10-20-2011, 05:14 AM

That is *really* old; from 2009. As in, I don't think it's even available any more! My current version of Wireshark is 1.6.2, and the "old" stable version they have for download is 1.4.x!

I just opened http://o11s.org/files/mesh_traffic.cap with my version of Wireshark and it seems to parse it fine. I think you're reading outdated info that says it can't read mesh traffic. Have you actually tried it?

phaemon · 10-20-2011, 05:18 AM

Actually, I found it at http://www.wireshark.org/download/sr...-1.3.2.tar.bz2

...if you really want to just try it out. You'd still be better off with a new version though.

shanky · 10-20-2011, 05:29 AM

i did download that version and installed it in my system and opened some captured files ..but it doesnt read the mesh packets hence i wanted to patch...In my wireshark it shows Malformed packets meaning probably it doesnt understand mesh packets...so will it work out on the latest version??
i am unable to send you a .pcap file ..it says invalid file..thought you could check it out on your version.

phaemon · 10-20-2011, 05:46 AM

Are you saying you tried 1.6.2 and it couldn't open your pcap file? Can you open http://wiki.wireshark.org/SampleCapt...rget=mesh.pcap with it?

shanky · 10-20-2011, 05:53 AM

no no ..i hav tried 1.3.2 ..i thought i would send you my .pcap file which i generated and you could check it up whether 1.6.2 understands mesh packets..but it doesnt allow me to attach saying an invalid file..could you give me your email id ..i can forward you the .pcap files, when i get back home.sorry for the trouble but would be of great help to me..but do you also know how should i add the patch to 1.3.2 ,would try that in the meantime..
Thanks a lot!!

phaemon · 10-20-2011, 05:59 AM

Well, 1.3.2 won't work: that's why there's a patch for it! You just need to extract the source, copy the patch into that directory and then apply it the way I said above.

But just download the new version. That'll work without all the fuss and there are no doubt other features and bug fixes that have been added.

If you want me to test your pcap file, just upload it to http://www.4shared.com/ and send me the link and I'll try it.

phaemon · 10-20-2011, 06:01 AM

What Linux distro are you using that has such an old version of Wireshark anyway?