This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi Forum,

I am writing a dissector for a protocol that has different dissectors depending on the direction of the traffic.

The protocol is Length|FCode|Data. For the same FCode value the Data is dissected differently depending on its direction. Ie device to host and host to device. Sending request and response using same function code value.

How is this typically handled? Are there any example dissectors that do this?

Thanks

Stuart

asked 22 Jan '13, 23:23

StuieNorris's gravatar image

StuieNorris
6557
accept rate: 0%


You could do something like:

dir=extract_dir_from_packet(...);
if( dir==FWD ) {
    dissect_foo_fwd(...);
} else {
    dissect_foo_rev(...);
}

If there is nothing in the packet indicating the direction of the packet, you will need to remember the IP address of the host when your dissector gets called for the first data segment. You can do this with conversations. See README.developer paragraph 2.2.1 (especially 2.2.1.5 and 2.2.1.6).

permanent link

answered 22 Jan '13, 23:51

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

I read the referenced section but I understand how to implement. however sounds pretty much exactly what I need.

Are there any existing dissectors that do what I want I could review?

(23 Jan '13, 01:42) StuieNorris
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×63
×18

question asked: 22 Jan '13, 23:23

question was seen: 1,665 times

last updated: 23 Jan '13, 03:09

p​o​w​e​r​e​d by O​S​Q​A