This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

i am currently writing a dissector with lua which use data from UDP AND TCP. So i register the dissector like this

udp_table = DissectorTable.get("udp.port")
udp_table:add(1024, SEL)
tcp_table = DissectorTable.get("tcp.port")
tcp_table:add(1024, SEL)

but in the function SEL.dissector(_tvbuf, _pktinfo, _root), i need to know if this if data is coming from UDP or TCP.

Is there a way to detect UDP ou TCP data ?

Thank

asked 26 Apr '17, 12:28

SebastienRolle's gravatar image

SebastienRolle
6224
accept rate: 0%

edited 26 Apr '17, 17:07


Yes, there is. Create the SEL_udp and SEL_tcp functions to register with the respective protocols and have them call SEL with an extra flag indicating the protocol it came from. This is how it's done in other dissectors as well.

permanent link

answered 26 Apr '17, 23:48

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Thank a lot. Can you point me to an existing dissector in order for me to understand.

Thank, Sebastien

(27 Apr '17, 05:36) SebastienRolle

i have done this but unfortunately, it doesn't work. Can you give me a little more details about the proposed solution.

local SEL = Proto("sel", "sel");

function aa(_tvbuf, _pktinfo, _root)
end
function bb(_tvbuf, _pktinfo, _root)
end
function SEL.dissector(_tvbuf, _pktinfo, _root)
end

DissectorTable.get("udp.port"):add_for_decode_as(aa)
DissectorTable.get("tcp.port"):add_for_decode_as(bb)
(27 Apr '17, 10:59) SebastienRolle

I don't do LUA myself, but recon it would be something like this:

local SEL_udp = Proto("sel_udp", "sel_udp")
udp_table = DissectorTable.get("udp.port")
udp_table:add(1024, SEL_udp)
local SEL_tcp = Proto("sel_tcp", "sel_tcp")
tcp_table = DissectorTable.get("tcp.port")
tcp_table:add(1024, SEL_tcp)

function SEL_udp(_tvb, _pktinfo, _root)
    SEL(_tvbuf, _pktinfo, _root, FALSE)
end
function SEL_tcp(_tvb, _pktinfo, _root)
    SEL(_tvbuf, _pktinfo, _root, TRUE)
end
function SEL(_tvb, _pktinfo, _root, is_tcp)
    ...
end

If you don't want to have the separate dissector registrations (one for UDP, one for TCP) you might also be able to look at pktinfo. In that structure you should have a ptype field, which indicates the (transport) protocol as well.

(28 Apr '17, 01:39) Jaap ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×431

question asked: 26 Apr '17, 12:28

question was seen: 1,338 times

last updated: 28 Apr '17, 01:39

p​o​w​e​r​e​d by O​S​Q​A