Wireshark mailing list archives
How to parse a protocol with two different PDU types in a single connection?
From: Kaul <mykaul () gmail com>
Date: Sat, 7 Nov 2009 22:27:00 +0200
Hello, I have a protocol that begins with a PDU of type A ('link' state), then switches after it performed some negotiation to a PDU type B ('data' state). I've tried something similar to: conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst, pinfo->ptype, pinfo->srcport, pinfo->destport, 0); if (!conversation) { conversation = conversation_new(pinfo->fd->num, &pinfo->src, &pinfo->dst, pinfo->ptype, pinfo->srcport, pinfo->destport, 0); } myproto_info = (myproto_conversation_t*)conversation_get_proto_data(conversation, proto_myproto); if(!myproto_info) { /* We don't yet have a conversation, so create one. */ myproto_info = se_alloc0(sizeof(myproto_conversation_t)); myproto_info->destport = pinfo->destport; /* Useful to differ between c2s and s2c packets */ myproto_info->pdu_type_A = TRUE; conversation_add_proto_data(conversation, proto_myproto, myproto_info); } if (myproto_info->pdu_type_A == TRUE) { /* If we are still in the link state part of the protocol */ tcp_dissect_pdus(tvb, pinfo, tree, myproto_desegment, 16, get_myproto_link_pdu_len, dissect_myproto_link_pdu); } else { tcp_dissect_pdus(tvb, pinfo, tree, myproto_desegment, 16, get_myproto_data_pdu_len, dissect_myproto_data_pdu); } And in dissect_myproto_link_pdu(): if (myproto_info->destport == pinfo->destport) { /* dissectC2S messages */ } else { /* S2C messages - and turn off pdu_type_A ! */ myproto_info->pdu_type_A = FALSE; } This doesn't work well. Once I turn it off, nothing is dissected any more - as if it won't reach the first tcp_dissect_pdus() line anymore - even for other conversations. 1. Is my approach correct? 2. Any hint as to what I'm doing wrong here? TIA, Yaniv.
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- How to parse a protocol with two different PDU types in a single connection? Kaul (Nov 07)