So finaly I got something to access protocol layer and the corresponding data (using bad practice for now since I am using tvbuff struct field directly, but I did not found an other way to do this simply). I will update this answer with news on this.
Working on accessing named field.
Part of the Code:
# define LOG_PREFIX "[TAP Listener plugin] => "##__FUNCTION__##"(): "
void pretty_print_edt_tree(epan_dissect_t const *edt)
{
proto_node *node;
if (edt && edt->tree)
{
node = edt->tree->first_child;
while (node)
{
if (node->finfo)
{
if (node->finfo->hfinfo)
printf(LOG_PREFIX"Node name: %s\n", node->finfo->hfinfo->name);
if (node->finfo->ds_tvb)
hex_dump(&node->finfo->ds_tvb->real_data[node->finfo->start], node->finfo->length, 8, 0);
}
node = node->next;
printf(LOG_PREFIX"Going to next node\n");
}
}
}
//gboolean(*packet)(void *tapdata, packet_info *pinfo, epan_dissect_t *edt, const void *data)
static gboolean tap_packet(void *tapdata, packet_info *pinfo, epan_dissect_t *edt, const void *ssl)
{
pretty_print_edt_tree(edt);
return (0);
}
// TL_REQUIRES_PROTO_TREE and TL_REQUIRES_COLUMNS were used to register the tap listener
Output:
[TAP Listener plugin] => pretty_print_edt_tree(): Node name: Ethernet^M$
[TAP Listener plugin] => hex_dump(): 0x000000: 08 00 27 0e e4 14 08 00 ..'…..^M$
[TAP Listener plugin] => hex_dump(): 0x000008: 27 00 44 90 08 00 '.D…^M$
^M$
[TAP Listener plugin] => pretty_print_edt_tree(): Going to next node^M$
[TAP Listener plugin] => pretty_print_edt_tree(): Node name: Internet Protocol Version 4^M$
[TAP Listener plugin] => hex_dump(): 0x000000: 45 00 00 84 73 7d 40 00 E…s}@.^M$
[TAP Listener plugin] => hex_dump(): 0x000008: 80 06 95 3f c0 a8 38 01 …?..8.^M$
[TAP Listener plugin] => hex_dump(): 0x000010: c0 a8 38 65 ..8e^M$
^M$
[TAP Listener plugin] => pretty_print_edt_tree(): Going to next node^M$
[TAP Listener plugin] => pretty_print_edt_tree(): Node name: Transmission Control Protocol^M$
[TAP Listener plugin] => hex_dump(): 0x000000: 01 bb df 78 a2 57 49 c1 …x.WI.^M$
[TAP Listener plugin] => hex_dump(): 0x000008: c9 17 ac be 50 18 01 00 ….P…^M$
[TAP Listener plugin] => hex_dump(): 0x000010: 33 be 00 00 16 03 01 00 3…….^M$
[TAP Listener plugin] => hex_dump(): 0x000018: 57 02 00 00 53 03 01 56 W…S..V^M$
[TAP Listener plugin] => hex_dump(): 0x000020: 01 62 4e 09 09 09 09 09 .bN…..^M$
[TAP Listener plugin] => hex_dump(): 0x000028: 09 09 09 09 09 09 09 09 ……..^M$
[TAP Listener plugin] => hex_dump(): 0x000030: 09 09 09 09 09 09 09 09 ……..^M$
[TAP Listener plugin] => hex_dump(): 0x000038: 09 09 09 09 09 09 09 20 ……..^M$
[TAP Listener plugin] => hex_dump(): 0x000040: 64 f6 ec 95 c2 79 dd 76 d….y.v^M$
[TAP Listener plugin] => hex_dump(): 0x000048: 6f a5 03 ff 94 49 f1 70 o….I.p^M$
[TAP Listener plugin] => hex_dump(): 0x000050: 85 88 df 99 d3 f8 ce 1b ……..^M$
[TAP Listener plugin] => hex_dump(): 0x000058: aa b0 a4 bc 80 ed e3 c9 ……..^M$
[TAP Listener plugin] => hex_dump(): 0x000060: 00 35 00 00 0b ff 01 00 .5……^M$
[TAP Listener plugin] => hex_dump(): 0x000068: 01 00 00 0b 00 02 01 00 ……..^M$
answered 22 Sep ‘15, 07:22
NewUser2
6●1●1●3
accept rate: 0%