This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

WireShark : How to create documentation for various Disectors

0

Hello, I wanted to create documentation for various specs, something like

a) PDU Header and port   
b) What are the message type    
c)Information present in each message type   
   b1) its type (ie simple (int,bit,long,etc) or complex (if complex 
       define childs for it)  
   b2) length

Idea is to have something like WSGD (wireshark Generic Dissector ) document , so its easy to understand specs internal. Though information is present in either 3GPP word document but its not computer friendly.

Any suggestions on how I can create it are most welcome (Right now I am parsing the word document to get tables from it, but again it wont work for all specs). If something like this is already existing , please do point.

Initially I want to work on all LTE related specs (NAS, Diameter, RTP, SIP etc) , but then I will create for all dissectors.

regards

asked 08 Jun '15, 23:31

bhardwaj_rajesh's gravatar image

bhardwaj_rajesh
6●2●2●3
accept rate: 0%

edited 09 Jun '15, 02:27

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237

I think rather than trying to infer from the source file, it'd be easier to extract some of this information from a running instance of Wireshark (or tshark). Have you seen what's available in the 'Internals' menu?

(09 Jun '15, 03:57) MartinM

One Answer:

0

Woa... nice LITTLE project ;-)

The idea, to have a protocol definition in a WSGD like format is good, but I don't see how this can be extracted from the Wireshark code. Seriously, I don't see any easy way (or any way at all) to compile a WSGD like protocol definition by reading ("dissecting") the Wireshark source code, neither manually nor by using any tool (script). This task would be way to complex to be worth the effort.

You could check the Microsoft Network Monitor Parsers. They use their own definition language for the parsers (their form of dissectors). The parsers are open source and do contain a lot of common protocols.

http://www.codeplex.com/NMParsers

Regards
Kurt

answered 09 Jun '15, 02:38

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%