This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

I'm writing a post-dissector, to process some bespoke TCP options.

Im having problems processing the TCP options where the TCP packet is encapsulated. Since TVB is the full buffer, I just want the offset of the TCP.OPTIONS ?

and process that!

or even better, how can i just take the tcp.options userdata, and process that? - I have to iterate over the tcp option data, as there can be many OPTIONS

thanks

asked 25 Mar '14, 07:33

JamesM's gravatar image

JamesM
11113
accept rate: 0%


How about using the "tcp.options" Field to get just the ByteArray of the TCP options?

Like so:

local myproto = Proto("MyTcpOpts","Fake proto example to get at TCP options")

local tcp_opts = Field.new("tcp.options")

function myproto.dissector(tvb,pinfo,tree)
    local tcp_opt_finfo = tcp_opts()
    if tcp_opt_finfo then
        local bytearray = tcp_opt_finfo()
        print("opts bytes length =" .. bytearray:len())
        print("opts bytes in hex =" .. tostring(bytearray))

        -- do stuff to tcp options here

    else
        print("no tcp options")
    end
end

register_postdissector(myproto)
permanent link

answered 25 Mar '14, 11:09

Hadriel's gravatar image

Hadriel
2.7k2939
accept rate: 18%

Thanks for the response :)

I did try this, but had "newbie" issues manipulating the ByteArray.

Will give it another go!

(04 Apr '14, 15:16) JamesM
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×431
×14

question asked: 25 Mar '14, 07:33

question was seen: 2,031 times

last updated: 04 Apr '14, 15:16

p​o​w​e​r​e​d by O​S​Q​A