This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am trying to write a tap for TCP with access to Wireshark's analysis (such as which frame the current packet is acknowledging.

It seems relatively straight forward to do this in Lua with something like:

acksframe = Field.new("tcp.analysis.acks_frame")
ack = acksframe()

However I have not worked out how to do this in a tap written in C/C++.

From what I understand, I have access to the following information in a TCP tap:

  • packet_info: generic packet information
  • epan_dissect: overall structure of the packet (layers and pointers to corresponding data)
  • tcpheader: the fields of the TCP header

None of these seems to have the TCP analysis information available in the Lua tap. tcpheader contains the basics such as seq and ack fields, however I am hoping to leverage Wireshark's analysis rather than trying to re-implement this myself.

How can I access Wireshark's TCP analysis from a tap listener written in C?

asked 23 Jul '14, 16:29

wainwright's gravatar image

wainwright
11113
accept rate: 0%


In order to access these fields you must ask for them by creating a tap filter when calling register_tap_listener.

For example, to ask for tcp.analysis.acks_frame, you would set up a filter such as:

"frame || tcp.analysis.acks_frame"

which you would pass as the 3rd argument to register_tap_listener.

If the tap is registered with the filter, the data can be found in the protocol tree provided in the epan_dissect_t pointer passed as the 3rd argument to your packet callback.

Note that this requires you to have a filter (performance hit) even if you are willing to receive all packets. There may be a better way where you can request that those fields are filled, without having to filter packets, but I am not aware of it.

permanent link
This answer is marked "community wiki".

answered 27 Jul '14, 16:58

wainwright's gravatar image

wainwright
11113
accept rate: 0%

edited 27 Jul '14, 17:04

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×40
×17
×10

question asked: 23 Jul '14, 16:29

question was seen: 2,130 times

last updated: 27 Jul '14, 17:04

p​o​w​e​r​e​d by O​S​Q​A