Hi, I am trying to build a custom tag Dissector in Lua for the type of packets mentioned in the link below. There are other custom tags like these with different Ether types. http://webmedia.company.ja.net/content/documents/shared/networkshop310309/reid_carrierethernet.pdf. So the packet looks like One or more VLAN tag is followed by one or more custom tags. These tags are indicated by the corresponding ether type values (2 bytes) followed by 2 or 4 bytes specific to the tags. After these 4 or 6 bytes, normal flow follows as indicated by Ether type- IPv4 or IPv6 then TCP. I invoke the custom dissector based on the ether type like below: local Tags_Table = DissectorTable.get("ethertype") Tags_Table:add(CUSTOM_TAG_TYPE, p_customtag) Once this is done, I want wireshark built-in dissector to take over for IP and TCP processing (say). To do this I add the following code (I am not checking the Ether type value for now which I will add later): local ip_dis = Dissector.get("ip") ip_dis:call(buf(2):tvb(), pinfo, root) But the problem is it stops at IP level and does not dissect TCP level. Now my questions are:
This is a type of dissector chaining: 1. First wireshark built-in Ethernet dissector to decode DA, SA, VLAN(s) 2. My custom tag dissector to dissect tags 3. Back to built-in wireshark dissector to decode rest of the packet IP, TCP etc Appreciate your response on this. Thanks, Kanak Here is the link with few sample packets, complete lua code, pdf file and a file with more sample packets. https://drive.google.com/folderview?id=0B_-ushz_LzVxQXpwbDR3UHpfYm8&usp=sharing asked 08 May '13, 10:58 kanak edited 09 May '13, 11:06 |
It would be best if you could upload 1 or 2 packet capture and your full lua code somewhere. Also that link you've posted doesn't work
Thanks Izopizo for your response. For some reason I am not able to post the Google drive link here. I don't know how to share the link.
Found a way to post the link. Edited the original question and posted the link in the end.