lua dissector \ running for TCP AND UDP

Question

Hello,

i am currently writing a dissector with lua which use data from UDP AND TCP. So i register the dissector like this

udp_table = DissectorTable.get("udp.port")
udp_table:add(1024, SEL)
tcp_table = DissectorTable.get("tcp.port")
tcp_table:add(1024, SEL)

but in the function SEL.dissector(_tvbuf, _pktinfo, _root), i need to know if this if data is coming from UDP or TCP.

Is there a way to detect UDP ou TCP data ?

Thank

Answer 1

0

Yes, there is. Create the SEL_udp and SEL_tcp functions to register with the respective protocols and have them call SEL with an extra flag indicating the protocol it came from. This is how it's done in other dissectors as well.

answered 26 Apr '17, 23:48

Jaap ♦
11.7k●16●101
accept rate: 14%

Thank a lot. Can you point me to an existing dissector in order for me to understand.

Thank, Sebastien

(27 Apr '17, 05:36) SebastienRolle

i have done this but unfortunately, it doesn't work. Can you give me a little more details about the proposed solution.

local SEL = Proto("sel", "sel");
function aa(_tvbuf, _pktinfo, _root)
end
function bb(_tvbuf, _pktinfo, _root)
end
function SEL.dissector(_tvbuf, _pktinfo, _root)
end
DissectorTable.get("udp.port"):add_for_decode_as(aa)
DissectorTable.get("tcp.port"):add_for_decode_as(bb)

(27 Apr ‘17, 10:59) SebastienRolle

I don’t do LUA myself, but recon it would be something like this:

local SEL_udp = Proto("sel_udp", "sel_udp")
udp_table = DissectorTable.get("udp.port")
udp_table:add(1024, SEL_udp)
local SEL_tcp = Proto("sel_tcp", "sel_tcp")
tcp_table = DissectorTable.get("tcp.port")
tcp_table:add(1024, SEL_tcp)
function SEL_udp(_tvb, _pktinfo, _root)
SEL(_tvbuf, _pktinfo, _root, FALSE)
end
function SEL_tcp(_tvb, _pktinfo, _root)
SEL(_tvbuf, _pktinfo, _root, TRUE)
end
function SEL(_tvb, _pktinfo, _root, is_tcp)
…
end

If you don’t want to have the separate dissector registrations (one for UDP, one for TCP) you might also be able to look at pktinfo. In that structure you should have a ptype field, which indicates the (transport) protocol as well.

(28 Apr ‘17, 01:39) Jaap ♦