I'm developing a dissector/protocol as a plugin above Network layer so that The IP dissector will dissect all the IP headers and will look at the "protocol" field to pass the payload to my protocol. let's say the protocol number is " 254 ". This is not a heuristic dissector. EDIT : my packet-temp.c file contains :
Thanks. asked 05 Jun ‘15, 03:23 Sammee Sharma edited 06 Jun ‘15, 07:49 |
One Answer:
Hi, This is what packet-tcp.c does:
replace IP_PROTO_TCP with your number and the handle with your protocol handle. answered 05 Jun '15, 04:12 Anders ♦ edited 05 Jun '15, 04:13 showing 5 of 7 show 2 more comments |
You should register your protocol with IANA.
Thanks for the reply @Anders . I replaced IP_PROTO_TCP with my protocol number(254) and tcp_handle with my protocol handle. But still I could not see my protocol number in the ipproto.c file or ip.proto table. Am i missing something?
I'm not sure what you mean. Isn't your dissector being called? If you check the menu item internal integer dissector tables in.protocol, is your protocol registered there? If not you are not registering it properly.
@Anders sir, I've checked (Internals ->Dissector table -> Integer tables -> ip.proto ) in the wireshark but it's not there. I've attached the packet-temp.c code. please have a look at it . waiting for your suggestion.Thanks.
Did you also replace "ip.port" by "ip.proto", as the table to register too?
with this modification , i see that protocol number(254) in (wireshark -> Internals ->Dissector table -> Integer tables -> ip.proto ) but it is not there in ipproto.c file. should it be not there? @jaap
No. The
dissector_add_uint
call causes a run-time modification, not a compile time one. This allows additions of new protocols without having to modify ipproto.c