Can we get total length of IP packet from pinfo pointer ?

OK, I just took a look at your data. Since "your protocol" seems to change the dst mac address and the last 12 bytes of the IP payload, I'm not sure how you want to dissect this.

• Do you want to dissect only your 12 bytes?
• Or also the IP header (and what happens if the IP payload is less then 12 bytes, will the end of the IP header be overwritten?)
• The dissector of the protocol in which the 12 bytes are overwritten will have a hard time dealing with that, regardless of your dissector.
• How do you plan to handle sliced packets (like in frame 412) where (part of) your 12 bytes are missing

Or will the following do for you:

Ethernet Dissection Padding Dissection of your 12 bytes

If that's the case, you should change the Ethernet dissector to recognize your special mac-address and call your dissector as next (instead of the IP dissector).

Then in your dissector, you need to extract the IP length from the IP header to get the offset to your 12 bytes. Show the "padding" as hexdata and then show the dissection of your protocol.

You might want to create a new TVB with the IP header and payload up to, but not inlcuding your 12 bytes. Get those dissected by calling the IP dissector and when the dissector returns, dissect your 12 octets. I'm not 100% sure though if that will work, I would have to work that out myself.

Hi yogeshg,

Just a neat FYI - if you're using CloudShark you can actually embed the filter directly in the URL, thus:

http://www.cloudshark.org/captures/7e77eba8a6cb?filter=eth.dst%3D%3D02%3A00%3A6f%3A01%3A02%3A01

(When you hit apply filter, the URL will change so you can copy it easily).

/CS

Actually this packet is being steered from one node(a device) to another when any packet from client falls on wrong node. So from client it can be any packet icmp,http .. isn't it ? :)

I just got what i wanted..

for dst mac pinfo->dl_dst

and i also need to know about src mac .. pinfo->dl_src ??

It can be any packet , http,udp,icmp whatever.

crazy "protocol", isn't it? I'm just curious: Why are you doing that???

If it's always an IP packet, why not adding a heuristic IP dissector? HOWEVER: I'm not sure if that's possible, as I could not find one in the sources!!

Within that dissector you can look for the dst mac (maybe pinfo->dl_dst) as soon as your dissector gets the packet. If the dst mac matches, look for your magic bytes (if there are any), possibly at position "pfino->iplen - 12" (or something similar). If neither condition matches return from your dissector.

UPDATE: I don't think you can add a heuristic IP dissector, as packet-ip.c does not try to call heuristic dissectors. In that case, you can try to add a TCP and UDP heuristic dissector instead. I believe a heuristic ICMP dissector is also not possible (can't find code in packet-icmp.c). If that does not work for you, there is still the fallback to the heuristic ethernet dissector :-)

However, with the information given in this thread, somebody with good experience in writing dissectors, might be able to help you. I'm still diving into the wireshark code and there is a lot I don't understand (from the code and data structure perspective).

What you need:

1. Add a heuristic ethernet dissector
2. As soon as your dissector gets called, check if the dst mac matches your pattern
3. If true, extract the last 12 bytes of the ethernet frame (what about trailer?), OR look at the IP structure itself (if the protocol is IP) and extract the last 12 bytes of the IP frame. As you mentioned, look at the IP len filed. You will have to do the later yourself, as the IP dissector will be called after your dissector, so you can't use that information.
4. Build any tree structure you need with the extracted data

Actually this packet is being steered from one node(a device) to another when any packet from client falls on wrong node. So from client it can be any packet icmp,http .. isn't it ? :)

Is this some kind of cluster protocol? I have seen some traffic in your capture that looks like cluster communication.

Kurt, Whatever you just mentioned in "What you need" , i did precisely same in first attempt. But it didn't work. Because when we make heuristic eth dissector , our dissector gets called for every packet before wireshark touches the eth frame and TVB points to first bit of eth header. But problem is, when i did the dissection of those 12 bytes and i called eth dissector using "call_dissector(eth_handle ....)" function , in that call actually it again calls my heuristic dissector with TVB still pointing to first bit of eth header. IF you see line number 249 in packet-eth.c you can find it.

So it becomes loop kind of thing , because i will use call_dissector function inside my heur_dissect_proto function ..and in turn call_dissector will again call my heuristic dissector. I hope you will follow all what i said. That's why the procedure you mentioned won;t work !!

Thanks anyways for your patience Sir!

you should not call the eth dissector in YOUR eth dissector, as it will "loop", as you mentioned. You need to parse the whole data yourself in your own eth dissector, as it will be called very early in the whole dissection process, so you can't access any IP, TCP data structures, as they are not there. No other dissector has been called for that packet, and you should not call any one of them yourself unless you know very well what happens then.

So, basically you need to (kind of) rebuild the basic functionality of the eth and ip dissector to get to the data you need. First look at the eth dst address (see eth fram spec). Look at the protocol field. If it's IP, look at the IP len field and extract the data you need (last 12 bytes).

If you are not interested in the dissection if the IP,TCP,UDP,ICMP part, then you can add your own information to the tree and tell wireshark to stop dissecting the packet any further.

However, if you want other dissectors to be called as well (on such a packet), then it get's really tricky.

No i want to dissect every bit :) .. i tried calling ip dissector in my heuristic dissector and that worked only thing is eth part was not dissected.

And you told that pinfo->dl_dst will give me dst.mac right ? I suppose pinfo->dl_src will then give me src.mac. Ok that said, is there any way to get my dissector called for all packets without using heuristic dissector.AFAIK, only heuristic dissector gets called for all packet.

as SYN-bit said, change the default eth dissector to detect your special mac addresses. As long as you don't want this change to be included into the official source, it's probably the best (simple) way to go.

UPDATE: see my comment below

I think only way for me is to build up dissection of eth part myself in my eth heuristic dissector.

And yes you got it right ,i am supposed to dissect all bits ..

Nice suggestion , until now i was not even thinking of changing default source :) , thanks a ton , i should try to do it.thanks again

you can also do this:

• distribute your own version of the wireshark binary
• just copy the eth dissector code into your heuristic eth dissector plugin and make the necessary changes there. So, you don't have to care about all the obstacles of ethernet. Then just distribute your plugin.