This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm writing a dissector for a TCP-based protocol in C.

Is it possible to determine whether a packet goes in the client-to-server or in the server-to-client direction?

I have set up a conversation state, but I'm not sure what to put into it. I can recognize the first packet in the conversation (client-to-server), and I use that to store pinfo->srcport and pinfo->destport in the conversation state, and in future packets I can compare pinfo->srcport against the stored value in the conversation. But that will break if the source and destination ports are the same.

I noticed that *pinfo contains source and destination addresses, too, but those are fixed for the entire conversation, i.e. they don't change between requests and responses.

What's the idiomatic way to track the direction of the conversation?

asked 08 Jul '13, 07:38

LouisDx's gravatar image

LouisDx
11336
accept rate: 0%

edited 08 Jul '13, 07:38

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×34

question asked: 08 Jul '13, 07:38

question was seen: 2,615 times

last updated: 08 Jul '13, 07:38

p​o​w​e​r​e​d by O​S​Q​A