In brief: What is the best way to track information between protocol packets during dissection?
More detail: Suppose I have a protocol which has multiple message types, some of which can only be fully dissected if certain information from another message is known (example below). I could just have a
At least one
asked 25 Aug ‘11, 07:07
I think using Wireshark "conversations" is probably the way to go.
"In wireshark a conversation is defined as a series of data packets between two address:port combinations"
A dissector can use a conversation to store state information about that conversation.
See section 2.1 of doc/README.developer for the details.
Keep in mind that Wireshark essentially does a first sequential dissection pass thru the capture file and then will re-dissect individual packets as the user selects particular packets.
So: If general information about the conversation ("config msg has been seen", etc) is not sufficient you may also need to store "per-packet" info to remember any decisions as to how to dissect a particular packet. See section 2.5 of doc/README.developer.
It's also probably worth spending a little time looking at some of the individual Wireshark dissectors to see how they use conversations.
answered 25 Aug '11, 07:33
Bill Meier ♦♦
edited 25 Aug '11, 08:03