In the Wireshark Developer's Guide, section 8 (http://www.wireshark.org/docs/wsdg_html/#ChCaptureAddLibpcap) briefly describes "How to add a new capture type to libpcap". I am developing a dissector for a unique protocol whose traffic has been captured into a pcap file. Is there a more complete example on how to determine a DLT_ value (DLT_user?), modify the wtap.h and .c files, and call the dissector_add_uint function appropriately? asked 20 Dec '13, 10:12 Tinker |
2 Answers:
Thank you. This response led me to a solution. The dissector I am developing for a unique protocol will not be used externally so it is acceptable and easy for me to use one of the DLT_user slots. First, I had already built the PCAP file with network data link type of DLT_USER User15 (i.e., 162) in the PCAP header. Next, the link http://wiki.wireshark.org/HowToDissectAnything that is referenced in the above answer link of http://ask.wireshark.org/questions/27279/encapsulation-type-value had the information I needed to complete the dissector plugin. That link describes a plugin for an http-type protocol. I needed to "overload" the handling of an existing protocol, preferably some generic type of protocol. I see that the standard Wireshark-supported protocols (Internals -> Supported protocols), includes one named "collectd", which sounds about as generic as one could get. So: a) following the example in the HowToDissectAnything webpage, I enabled User15, in the DLT_USER table, to payload_prototype of "collectd" b) using the information described in link http://ask.wireshark.org/questions/8823/error-in-column-payload-protocol-dissector-not-found, I changed my plugin prototype to use register_dissector("collectd",dissect_foo,proto_foo) in function proto_register_foo in place of the invocation of proto_register_protocol as described in section 9 of http://www.wireshark.org/docs/wsdg_html_chunked, and I deleted the invocation of dissector_add_uint as described in function proto_reg_handoff_foo of that same section 9. Now my plugin dissects the unique protocol PCAP file. answered 02 Jan '14, 09:33 Tinker |
Hi, If you want to add a new DLT_value look at this link : http://ask.wireshark.org/questions/27279/encapsulation-type-value You can also force a file to an existing encap value by using editcap with -T option, see : http://www.wireshark.org/docs/man-pages/editcap.html Read the note of the -T option, I'm not sure that's what you want. answered 23 Dec '13, 07:48 Afrim |