Dissecting protocol that has message direction based dissectors

Question

Hi Forum,

I am writing a dissector for a protocol that has different dissectors depending on the direction of the traffic.

The protocol is Length|FCode|Data. For the same FCode value the Data is dissected differently depending on its direction. Ie device to host and host to device. Sending request and response using same function code value.

How is this typically handled? Are there any example dissectors that do this?

Thanks

Stuart

Answer 1

You could do something like:

dir=extract_dir_from_packet(...);
if( dir==FWD ) {
    dissect_foo_fwd(...);
} else {
    dissect_foo_rev(...);
}

If there is nothing in the packet indicating the direction of the packet, you will need to remember the IP address of the host when your dissector gets called for the first data segment. You can do this with conversations. See README.developer paragraph 2.2.1 (especially 2.2.1.5 and 2.2.1.6).