I've written a protocol dissector plugin for a protocol that uses CORBA for some of its communication. This protocol can send objects that can have any number of member variables and each object has a 64bit id. I have a text file with an text name and ID mapping. I'm able to correctly identify the messages in wireshark during dissection. My dissector plugin code is loosely based off of packet-coseventcomm.c. I call tap_queue_packet right after decode_CosEventComm_PushConsumer_push in the function dissect_coseventcomm. The objects I'm interested in dissected get dissected in decode_CosEventComm_PushConsumer_push so I dissect them in there and after that function I call tap_queue_packet. Does the stats_tree packet callback get called on the packet that gets queued by tap_queue_packet? Does the callback receive the tvb data starting with the same data that gets sent to the dissector? I'm having a hard time trying to figure out what I'm doing wrong. I register the tap listener and the stats_tree plugins with the following code
Thanks for any help with this issue. asked 11 Sep ‘13, 16:44 tlann |
One Answer:
After doing a lot of digging in the source and refreshing of my memory it seems like I was looking at data in the wrong data structure. Although, I didn't even need to do that. answered 17 Sep '13, 09:35 tlann |