With 2.3.0 version, I am creating a new in-built dissector as listed below. I have updated the epan/dissectors/CMakeLists and added my file that contains the dissector, packet-probe.c
Done cmake and msbuild and build my wireshark version. However I don't see my dissector when I run my wireshark version.
Could you please let me know if there are any othe makefile or registry files that I need to update?
proto_register_pb(void)
{
...
proto_probe = proto_register_protocol("Probe", "PROBE", "probe");
proto_register_field_array(proto_probe, hf, array_length(hf));
proto_register_subtree_array(ett, array_length(ett));
}
proto_reg_handoff_probe(void)
{
dissector_handle_t probe_handle;
ip_handle = find_dissector("ip");
rsvp_handle = find_dissector("rsvp");
probe_handle = create_dissector_handle(dissect_probe, proto_probe);
dissector_add_uint("udp.port", UDP_PORT_PROBE, probe_handle);
}
static void
dissect_probe(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
col_set_str(pinfo->cinfo, COL_PROTOCOL, "PROBE");
if (tree) {
…
}
…
}
Regards
Sanj
asked 16 Mar ‘17, 09:22
Sanj123
6●3●3●6
accept rate: 0%
edited 16 Mar ‘17, 09:38
grahamb ♦
19.8k●3●30●206
Does your protocol show up under the menu item Analyze -> Enabled Protocols?
No, I am not seeing my “probe” protocol under the Analyze->Enable Protocols menu.
If your code is in the order shown in your excerpt, i.e.
dissect_probe()
defined after it’s used inproto_reg_handoff_probe()
then I suspect it isn’t being compiled which would point to a CMake problem.Presumably you added your dissector to the
DISSECTOR_SRC
item in epan/dissectors/CMakeLists.txt?Try opening the solution in Visual Studio and checking if your source file is shown in the Solution Explorer under
Libs\epan\dissectors\dissectors\dissectors
.dissect_probe() is the 1st and proto_reg_handoff_probe() is the last call in the file. Sorry about the order listed in the example.
I had added the packet-probe.c file.c to set(DISSECTOR_SRC…) I am trying to figure out how to look up the file in Solution Explorer.
If the order is the correct way around it may well be compiled.
In your build directory do you see
packet-probe.obj
underepan\dissectors\dissectors.dir\RelWithDebInfo
?Yes, I do see the packet-prob.obj under Development/wsbuild64\epan\dissectors\dissectors.dir\RelWithDebInfo
It’s compiled then.
Are you certain you’re running the Wireshark you’ve just built, i.e. from your build directory
run\RelWithDebInfo\Wireshark.exe
?Yes, I have checked the timestamp, I am running the one I built with the probe.
The .obj was being created but the executable did not show the new protocol. I deleted the RelWithDebInfo directory and rebuild. Now I can correctly see my protocol. Thanks for your help!!
If you open the generated file register.c is your dissectors register function included,if not delete the file to have it regenerated.
Thanks both!!