This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am implementing object export for the FTP protocol ( File-> Export Object -> FTP...).

I have got to the point of getting the list of files in the ExportObjectDialog window. However in such window I get an entry for each TCP packet used for the trasmission of each FTP packet. If save each entry and then join the resulting files in the correct order I get the file I am sopposed to. So I am on the right track but am not doing ftp packet reassembly correctly.

I have tried two approaches:

  1. The one explainded in section 2.7.2 of README.dissector. You can find the code at pastebin.com/nkxDUhkv. In order to make reading easier, I have added left several blank lines before and after the reassemble section. I am preatty sure this is the way to go, if this is the case you can skip to the end of the question. However since this approach has not been successful, I am providing details of the second one.

  2. I have followed the instructions given at https://www.wireshark.org/docs/wsdg_html_chunked/ChDissectReassemble.html#TcpDissectPdus and added some extra code I think necessary, based on implementations I have seen of other dissectors.

    Please note that I think line

    ftpdatafragmented_handle = create_dissector_handle(dissect_ftpdatafragmented, proto_ftpdatafragmented);

    should go at the end of

    void proto_reg_handoff_ftp(void);

    However for some reason such function is not being called. Therefore I have moved the
    ftpdatafragmented_handle to

    dissect_ftpdata(tvbuff_t tvb, packet_info pinfo, proto_tree *tree).

    Please find the relevant code at pastebin.com/wHR2Q1LY. I have upload the whole mofidied FTP dissector code at pastebin.com/jxLUxewm.

Also note that I haven't dealt with conversation and transaction data yet. I will deal with that as soon as I fix packet reassemble.

What am I doing wrong with packet disassemble? Could somebody please help me?

Thank you in advance for your time.

asked 15 Jan '15, 18:48

CrazyL's gravatar image

CrazyL
6224
accept rate: 0%

edited 16 Jan '15, 05:28

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×637
×56
×27
×8

question asked: 15 Jan '15, 18:48

question was seen: 3,167 times

last updated: 16 Jan '15, 05:28

p​o​w​e​r​e​d by O​S​Q​A