This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I would like to write a .NET dissector plugin to decode my own protocols. Can wireshark read managed dlls (C# or managed C++), or does it have to be only native code or python script? I have decoders written in C# already, and would like to reuse them if possible. Any ideas how this can be done?

Thanks

asked 19 Nov '13, 02:13

Lews%20Therin's gravatar image

Lews Therin
11447
accept rate: 100%


Wireshark is all native code. I have no idea if an unmanaged program can load a managed DLL, but if it is possible, then your DLL would have to present unmanaged interfaces so that Wireshark can call essential functions in it, your DLL may have to export some unmanaged data for Wireshark, and then any Wireshark infrastructure calls your DLL makes would have to be unmanaged and be passed and receive back unmanaged data structures.

In short if at all possible it's going to be a big chunk of work.

You may want to investigate other Wireshark dissector creation options such as text using WSGD, built-in languages such as Lua, or a C based dissector.

permanent link

answered 19 Nov '13, 03:52

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

Hey Graham, thanks for the quick answer. The idea is to pretty much emulate WSGD -> a generic native dll that will interface with any codecs/protocol I create in C#. It sounds like a lot of work indeed. I was hoping for experienced feedback, but seems there isn't a better way.

(19 Nov '13, 05:15) Lews Therin

I have decoders written in C# already, and would like to reuse them if possible.

Honestly, writing all the mananged -> unmanaged interface code will be much more work (if it works at all) than simply rewriting your decoder logic (you already have that logic) in C and putting that into a template dissector (see Developer guide).

Regards
Kurt

(19 Nov '13, 15:25) Kurt Knochner ♦

Actually, you should be able to create a Lua dissector that uses a C# library via LuaInterface to parse the payload. See a related question on how to set up LuaInterface with Wireshark.

(19 Nov '13, 19:29) helloworld

Thanks for the help guys.

(20 Nov '13, 02:00) Lews Therin

@helloworld, Luainterface looks interesting, but I would suspect implementing a dissector that way might be less than optimal speed wise. I would also think that there will still need to be some translation between Wireshark data structures and whatever the original C# dissectors are doing.

(20 Nov '13, 02:34) grahamb ♦

It's even worse. You'll have to write a dissector in Lua, then pass the tvb data to the C# library and get back "some" data structure of the 'dissected' tvb (as you said). Then you'll have to walk through that data structure and add the proto fields within the Lua code based on the data structure you received from the C# code + convert data types between C# and Lua.

I don't see how that could be less (coding) work or how that could be in any way easier than a migration of the C# decoder logic to either C or Lua, as the dissector framework (handling tvb and proto fields) has to be coded in Lua/C anyways.

(20 Nov '13, 03:11) Kurt Knochner ♦

It might not be optimal in terms of speed, but that wasn't part of the question. The OP asks for a way to reuse his existing C# library. Depending on how much work was already invested into that library; and the size and complexity of the protocol, LuaInterface could be a shorter path than rewriting it.

(20 Nov '13, 06:57) helloworld
showing 5 of 7 show 2 more comments
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×637
×173

question asked: 19 Nov '13, 02:13

question was seen: 3,793 times

last updated: 20 Nov '13, 06:57

p​o​w​e​r​e​d by O​S​Q​A