I need the uncompressed text of a http response, however with lua it's a little tricky to process the compressed data. I think I can use the existing data within the dissection tree, because there is already a dissector done that. But the documentation doesn't seem to provide that function. Is this potentially possible? asked 08 Dec '13, 13:33  Jacul |
One Answer:
Does that HTTP response have a particular MIME media-type value? If so, register your dissector in the "media_type" dissector table with the MIME media-type string. answered 08 Dec '13, 22:48  Guy Harris ♦♦ |
I think the content type is "text/html". Will the text content be included in the bytebuffer after registering the media type?
You can't register your dissector for that, as there's already a dissector for it (for obvious reasons).
This means that you will have to look at ALL entity-bodies to see if they happen to correspond to your protocol, before they're handed to media-type-based dissectors.
This means you'll need to write a heuristic dissector and register it in the "http" heuristic dissector table. See the doc/README.heuristic file in the source for the version of Wireshark you're using. Note that you will have to write this dissector in C, as there is currently no support for heuristic Lua dissectors.
Thank you, at least I know where to start now. I think you are the same guy who commented my question in stackoverflow. If you don't mind, can you post a answer there so I can accept it?
And I thought you were the same guy who asked on Stack Overflow, which is why I put in the note about C and Lua.
You might want to file a bug on the Wireshark Bugzilla suggesting that support for heuristic Lua dissectors be added.
OK.
Unfortunately, that won't work, as there's already a text/html dissector, and that'll get called for all entity-bodies with a Content-Type of text/html; the media-type dissectors are checked before the heuristic ones are called.
You might be able to hack the epan/dissectors/packet-text-media.c dissector to look for your protocol, or might add a separate heuristic dissector table to it and then register your dissector in that table.