This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is there a more complete example about how to add a new capture type to libpcap?

0

In the Wireshark Developer's Guide, section 8 (http://www.wireshark.org/docs/wsdg_html/#ChCaptureAddLibpcap) briefly describes "How to add a new capture type to libpcap". I am developing a dissector for a unique protocol whose traffic has been captured into a pcap file. Is there a more complete example on how to determine a DLT_ value (DLT_user?), modify the wtap.h and .c files, and call the dissector_add_uint function appropriately?

asked 20 Dec '13, 10:12

Tinker's gravatar image

Tinker
21337
accept rate: 100%


2 Answers:

0

Thank you. This response led me to a solution. The dissector I am developing for a unique protocol will not be used externally so it is acceptable and easy for me to use one of the DLT_user slots.

First, I had already built the PCAP file with network data link type of DLT_USER User15 (i.e., 162) in the PCAP header.

Next, the link http://wiki.wireshark.org/HowToDissectAnything that is referenced in the above answer link of http://ask.wireshark.org/questions/27279/encapsulation-type-value had the information I needed to complete the dissector plugin. That link describes a plugin for an http-type protocol. I needed to "overload" the handling of an existing protocol, preferably some generic type of protocol. I see that the standard Wireshark-supported protocols (Internals -> Supported protocols), includes one named "collectd", which sounds about as generic as one could get. So: a) following the example in the HowToDissectAnything webpage, I enabled User15, in the DLT_USER table, to payload_prototype of "collectd"

b) using the information described in link http://ask.wireshark.org/questions/8823/error-in-column-payload-protocol-dissector-not-found, I changed my plugin prototype to use register_dissector("collectd",dissect_foo,proto_foo) in function proto_register_foo in place of the invocation of proto_register_protocol as described in section 9 of http://www.wireshark.org/docs/wsdg_html_chunked, and I deleted the invocation of dissector_add_uint as described in function proto_reg_handoff_foo of that same section 9.

Now my plugin dissects the unique protocol PCAP file.

answered 02 Jan '14, 09:33

Tinker's gravatar image

Tinker
21337
accept rate: 100%

1

Hi,

If you want to add a new DLT_value look at this link : http://ask.wireshark.org/questions/27279/encapsulation-type-value

You can also force a file to an existing encap value by using editcap with -T option, see : http://www.wireshark.org/docs/man-pages/editcap.html

Read the note of the -T option, I'm not sure that's what you want.

answered 23 Dec '13, 07:48

Afrim's gravatar image

Afrim
160101116
accept rate: 22%