This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I wrote a dissector named PROTOC.

for some reasons this dissector doesn't reassemble all of the protocol's packets which can be found as [TCP segment of a reassembled PDU], But there is no trace to the reassembled PDU. Example can be seen at the attached link below of the .pcap, where TYPE D is shown at the beginning of the file (type 4)(line 1 or 3), and TYPE E cannot be shown at the end of the file (type 5)(line 6312)

I uploaded the .pcap I'm using in order to debug my protocol here (I made this .pcap shorter, but it shows the same results on the original .pcap version, and on other .pcaps also) and the source of my protocol here (DOWNLOADING PASSWORD: "wireshark")

My protocol format is:

  • 4 bytes of type
  • 4 bytes of length
  • 256 bytes of something called "context id"
  • length bytes of data

I compiled it on wireshark version 1.8.4, using x64 compiler. "Setting environment for using Microsoft Visual Studio 2010 x64 cross tools"

Compiling the dissector:

  1. get into "cmd" and writes call "C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\vcvarsall.bat"

or for 64bit

call "C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\vcvarsall.bat" x86_amd64

  1. compile the dissector (in the dissector directory) nmake -f Makefile.nmake

Any help will be very appreciated Thanks

asked 02 Apr '13, 00:15

hudac's gravatar image

hudac
61111317
accept rate: 50%

edited 11 Apr '13, 02:24

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×637
×78
×17

question asked: 02 Apr '13, 00:15

question was seen: 1,934 times

last updated: 11 Apr '13, 02:24

p​o​w​e​r​e​d by O​S​Q​A