This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi, forks, this is a best practice question. I am decoding a protocol set on top of UDP. The UDP payload is encapsulated in MotherProto, and the payload of MotherProto takes on several dozens of forms.

Each form represents a different message type, and is identified with UDP port number. For example,

udp port 64000 means A01 message, in which byte 1 is status, byte 2 is data_freshness, byte 3-4 is measurement_1
udp port 64001 means B02 message, in which byte 1 is status, byte 2 is data_freshness, byte 3 is command_1, byte 4-5 is command_2

...

There are two ways to handle this as I see it. One way is to set up a sub_dissector table "mothеr.port", and register each tiny little message type as a sub-dissector

Or, I can make call a unique subdissector in MotherProto, Childproto, and handle the message classification internally. One good thing about this is that I don't need to write so many handoff routines and I can put port-to-messageType information in a xml, which is easy to maintain and update (the correlation between port and message type may change between different releases).

Which is the best practice? Or is there a better/standard way? Mother and Child proto are both niche protocols unlikely to be encapsulated in any other way.

Thank you for your help!

asked 18 Jul '17, 20:09

nickzhang's gravatar image

nickzhang
16448
accept rate: 0%

edited 18 Jul '17, 21:53

sindy's gravatar image

sindy
6.0k4851


So basically the question is maintainability, which is an important metric to consider. But also one of the tougher to grasp, because of the amount of uncertainty of future developments. So, both mechanisms you described are in place to handle either situation. Whichever is best, that is something for you to determine.

permanent link

answered 18 Jul '17, 23:04

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×19
×7

question asked: 18 Jul '17, 20:09

question was seen: 457 times

last updated: 18 Jul '17, 23:04

p​o​w​e​r​e​d by O​S​Q​A