tcpdump mailing list archives
Re: [tcpdump] Feature request: conditional run dissector on traffic (#495)
From: Michael Richardson <mcr () sandelman ca>
Date: Wed, 16 Dec 2015 13:01:45 -0500
> It has been mentioned briefly in #471: with the option -T radius it is > possible to dissect traffic over non-RADIUS ports as RADIUS, but this > means all traffic will be dissected as RADIUS > A short use case as an example: FreeRADIUS has the possibility to use a > RESTful server for authorization My RESTful daemon will send a > CoA/Disconnect if this user still has another session, and my NAS > requires that I send it to port 1700 instead of the standard port I > want to see all the traffic that is relevant, which means UDP port 1812 > for RADIUS authentication, TCP port 80 for the RESTful traffic and UDP > port 1700 for RADIUS CoA/Disconnect > Until yesterday, UDP port 1700 was not marked as RADIUS, which means > that would not be dissected If I use -T radius, all traffic would be > dissected as RADIUS, so the HTTP traffic would be mangled > It would be nice if there was a possibility to conditionally mark > traffic as a certain protocol, like saying -T "udp port 1700 = radius, > tcp port 4080 = http" Being able to dynamically map ports -> protocols in TCPDUMP would indeed be a nice thing to have. I think that squishing it all into -T is too hard. I'd rather have a file that describes the mapping, and just bake a file like that in as the default. As for a syntax... I was thinking that maybe we could use pcap filters as the matchers. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | network architect [ ] mcr () sandelman ca http://www.sandelman.ca/ | ruby on rails [ _______________________________________________ tcpdump-workers mailing list tcpdump-workers () lists tcpdump org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
Current thread:
- Re: [tcpdump] Feature request: conditional run dissector on traffic (#495) Michael Richardson (Dec 16)
- Re: [tcpdump] Feature request: conditional run dissector on traffic (#495) Anders Broman (Dec 16)
- <Possible follow-ups>
- Re: [tcpdump] Feature request: conditional run dissector on traffic (#495) Michael Richardson (Dec 16)