Using Dissectors and Subdissectors

Question

Hi all,

I have to write a Protcol-Analyzer, basing on TCP. The first Level is a company-specific Protocol which encapsulates several other company-specific protocols.

The first Level I have already implemented and it works. That means. The Data from TCP (lets call it Proto_One) I can analyze and make them viewable in the Tree. But next Step is to make the Data from (lets call it Proto_Two and Proto_Three) available for next dissector. Here is my Code which is not completely working:

File: packet-proton.c

void proto_reg_handoff_protone(void)
{
    dissector_handle_t protone_handle;
protone_handle = find_dissector(&quot;protone&quot;);
dissector_add_uint(&quot;tcp.port&quot;, global_protone_port, protone_handle);

data_handle = find_dissector(&quot;data&quot;);

}

File: packet-prottwo.c

void proto_reg_handoff_prottwo(void)
{
dissector_handle_t prottwo_handle;
prottwo_handle = find_dissector(&quot;protone&quot;);
dissector_add(&quot;protone.protid&quot;, 4710, prottwo_handle);

data_handle = find_dissector(&quot;data&quot;);

}

When I startup the WireShark on my Windows XP, I get the Error:
Runtime Error!
Program: C:\Programme\System\Wireshark\Wireshark.exe
This application has requestes the Runtime to terminate it in an unusual way.
Please contact the application’s support team for more information.

Best Regards
tjmaker

By the Way: I was trying to make the System debugable with my MSVS 2008 but it didn’t get it work.

Answer 1

2

You'll have to create a sub dissector table in proto_register_protone(), like so:

register_dissector_table("protone.protid", ....

answered 25 Oct '11, 09:34

Jaap ♦
11.7k●16●101
accept rate: 14%

Thanks for the answer. No I got WireShark started. But the dissection still doesn't work.

I made these changes in packet-proton.c:

void proto_register_protone (void)
{
    ...
static hf_register_info hf[] =
{
    ...

    { &amp;hf_protone_protId,
          { &quot;Protocol Identifier&quot;, &quot;protone.protId&quot;, 
                FT_UINT16, BASE_HEX, VALS(protocolIdTypeNames), 
                0x0, &quot;Protocol Identifier&quot;, HFILL } },

    ...
};

/* subdissector code */
subdissector_table = register_dissector_table(&quot;protone.protid&quot;,
    &quot;Protocol Identifier&quot;, FT_UINT16, BASE_HEX);
register_heur_dissector_list(&quot;protone&quot;, &amp;heur_subdissector_list);

...

}

Do I really need the line with register_heur_dissector_list?

And these changes I made in packet-prottwo.c:

void proto_reg_handoff_prottwo(void)
{
dissector_handle_t prottwo_handle;
prottwo_handle = find_dissector(&quot;protone&quot;);
dissector_add(&quot;protone.protid&quot;, 0x1266, prottwo_handle);

data_handle = find_dissector(&quot;data&quot;);

}

Is there something else, I have to configure?
Is it working with 0x1266 or do I have to use 4710?

Best Regards
tjamaker

(25 Oct ‘11, 22:45) tjamaker

Do I really need the line with register_heur_dissector_list? Answer: No

prottwo_handle = find_dissector(“protone”); should be find_dissector(“prottwo”);

(26 Oct ‘11, 04:47) Jaap ♦

Answer 2

OK, now I got the MSVC++ 2088 EE running to be able to debug the code. And now I can detect, that in my dissect_protone the call_dissector is called but it never appears in dissect_prottwo.

static void dissect_wagosp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
    ...
if (length_remaining != 0) 
{
    tvbuff_t *next_tvb;
    next_tvb = tvb_new_subset_remaining(tvb, offset);

    call_dissector(data_handle, next_tvb, pinfo, tree);
}

...

}