This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi, I have a proprietary protocol (tcp transport layer) that starts (on the same connection ie. same port ) before an underlying known protocol such as HTTP. Is there a way to dissect the the proprietary protocol and than let wireshark to continue dissecting it as the underlying protocol? I am using lua. Thanks

addition On application layer... My protocol dissects on port 8080, and get some info from proprietary protocol then it should switch to HTTP and continue to work as usual till the and of the stream (conversation).

asked 19 Apr '15, 04:30

acohen's gravatar image

acohen
6113
accept rate: 0%

edited 20 Apr '15, 04:23

Please define protocol stack.

From what I make up from your text this is: Ethernet / IP / TCP / Prop.Proto

Which later becomes

Ethernet / IP / TCP / HTTP

on the same ports. Is this correct?

(20 Apr '15, 02:34) Jaap ♦

Yes, On application layer... My protocol dissects on port 8080, and get some info from proprietary protocol then it should switch to HTTP and continue to work as usual till the and of the stream (conversation).

(20 Apr '15, 04:22) acohen
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×431
×6

question asked: 19 Apr '15, 04:30

question was seen: 1,085 times

last updated: 20 Apr '15, 04:23

p​o​w​e​r​e​d by O​S​Q​A