This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi, I've written a dissector plugin to filter my protocolls. I've added dissector_add_uint("tcp.port", 5001, test_handle); to filter the port, but how can I add a filter of an ip adress? I tried something like dissector_add_string("ip.src", 127.0.0.1, test_handle); but this doesn't work. What is the correct way to add an ip to my dissector?

asked 07 Feb '12, 10:09

Nic's gravatar image

Nic
14556
accept rate: 0%


(A dissector doesn't filter protocols, it dissects them. Presumably that's what you meant.)

Most dissector handoffs done with tables such as "tcp.port" use values that are also named protocol fields, in which case the convention is that the table name should be the same as the field name, but it is NOT the case that every named protocol field has a corresponding handoff table; there is, for example, no table named "ip.src", even though there's a field named "ip.src", so your dissector_add_string() call doesn't work.

If you mean that you only want your dissector called for traffic to and from port 5001 that is coming from a particular IP address, the only way to do that would be to make a heuristic dissector and have it check both pinfo->srcport and pinfo->dstport and reject the packet if neither of them have the value 5001 and also check whether pinfo->net_src is equal to the source address in question. (To do that, you could create a (static const) structure of type address, initialize its type value to AT_IPv4 or AT_IPV6 depending on whether it's an IPv4 or IPv6 address, initialize its len value to 4 or 16, and initialize its data value to point to an (const) array of bytes containing the raw bytes of the IP address, and then compare the addresses with CMP_ADDRESS(). Do NOT assume that the address is an IPv4 address! It could, for example, be an IPv6 address.)

permanent link

answered 07 Feb '12, 20:06

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×349
×178

question asked: 07 Feb '12, 10:09

question was seen: 3,294 times

last updated: 07 Feb '12, 23:53

p​o​w​e​r​e​d by O​S​Q​A