In my department, we have implemented a new communication protocol. Now, we want to analyze the data traffic in order to show it clearly to the students. We think we can develop a new filter, specific to our protocol, in Wireshark, but we are not sure about this possibility. So we have a few question... Is possible to develop your own wireshark in order to analyse the traffic of your self-created network protocol? Which are the required libraries? And programming language? Thanks in advanced, Alex. asked 16 Jul '13, 07:17  aleshark edited 16 Jul '13, 07:29  grahamb ♦ |
2 Answers:
What you are describing is a Wireshark dissector. There are a few methods to create a dissector, you can look at my SharkFest'13 presentation "PA-10: Writing a Wireshark Dissector" that is downloadable from the SharkFest website, for an introduction to writing a dissector using WSGD, Lua or a traditional C based dissectors. answered 16 Jul '13, 07:24 grahamb ♦ showing 5 of 8 show 3 more comments |
Please have a look at the Generic Wireshark Dissector. It's a very easy way to add protocol support for new protocols. The other way would be to write your own dissector.
Regards answered 16 Jul '13, 07:21  Kurt Knochner ♦ Plus, there had been a talk at this year's Sharkfest by Graham Bloice, which you can find at http://sharkfest.wireshark.org/sharkfest.13/index.html (16 Jul '13, 07:25) Jasper ♦♦ I'm sorry I'm so slow at typing my response, beaten by Kurt and Jasper today :-( (16 Jul '13, 07:28) grahamb ♦ Graham, no worries, your clock is running with a 1 hour delay. Not your fault :-) Also, a good answer always takes time. (16 Jul '13, 07:44) Jasper ♦♦ Never, mind. I'll slow down my typing/answering speed in order for others to have a chance to answer as well ;-)) (16 Jul '13, 07:45) Kurt Knochner ♦ |
I haven't seen your presentation before. Nice work!
Thanks, come to SharkFest and hear it live!
maybe next year. will see...
you should. Just do a talk, and skip the conference fee ;-)
It's the best conference of the year for network analysts IMHO. I'm still slightly annoyed that I didn't start attending back in 2008 :-)
If I find an interesting subject, maybe I'm going to apply for a slot ;-)) Suggestions are welcome...
I'll let you know when the time comes ;-)
Thanks for the answers but, I have been questioned myself this afternoon about...
Wireshark Generic Dissector (WSGD) allows dissection of a protocol based on a text file description and doesn't require development enviroment, as you say in your conference, but... "It needs to copy the appropriate version of the plugin".
Let me explain myself...
generic.dll allows, according to http://wsgd.free.fr/ to describe two protocols named "Example1" and "Example2". So if I want to build up my own protocol analyzer, I guess I must rebuilt a new generic.dll or whatever with the description of my protocol layers, and after that, define my protocol (.wsgd) and its fields (.fdesc). Am I wrong?
No need to build the DLL yourself, but you must use a matching DLL for your version of Wireshark. The only parts you have to create are the two text files; .wsgd & .fdesc.