Re: Use of wireshark to interpret input data that does not depend on any other existing protocols

[Mrunal Upadhyay <m.upadhyay () sta samsung com>]

Guys,

Thank You very much for the help and suggestions. It really helped me figure out the problem and the solution to it. I 
carried out the following steps to define a custom dissector that  does not depend or run on top of any existing 
protocol.

Please note these steps are only for local development and these changes should not be checked in as it involves
defining a new mapping for a protocol in the encapsulation table(mapping of a new protocol to a new link_layer_id).

1. Define a macro in the Wtap.h header file for the new protocol.
................................
...............................
#define WTAP_ENCAP_LAPD                         131
#define WTAP_ENCAP_DVBCI                        132
#define WTAP_ENCAP_protocol                          133//macro for new protocol.
..............................
...............................


2. Define a new mapping for the new protocol to a new link_layer_id in the Pcap-common.c file in the pcap_to_wtap_map[]
 array of structures.
 ...............
 ...............
 { 230,          WTAP_ENCAP_IEEE802_15_4_NOFCS },
                /* DVB-CI (Common Interface) */
                { 235,                     WTAP_ENCAP_DVBCI },
                /* New protocol */
    { 240, WTAP_ENCAP_protocol},// mapping for new protocol to a link_layer_type value=240.

                /*
                 * To repeat:
                 *
                 * If you need a n
 ......................
 ....................

 In my case, I have associated my new protocol with link_layer_id=240.

NOTE:Please note if you plan to check in the code and want your protocol to be a part of Wireshark releases then send a 
mail
to tcpdump-workers () lists tcpdump org, asking for a new DLT_ value, and specifying the purpose of the new value. When
you get the new DLT_ value, use that numerical value in the "dlt_value" field of "pcap_to_wtap_map[]".

3.            Create an entry in the encap_table_base[] array of structures supplying the name and short name for the 
new
protocol in the Wtap.c file.

...............................
...........................
                /* WTAP_ENCAP_LAPD */
                { "Lapd header", "lapd" },

                /* WTAP_ENCAP_DVBCI */
                { "DVB-CI (Common Interface)", "dvbci"},

                /*WTAP_ENCAP_protocol*/
                {"Protocol_name","Protocol_short_name"}
};

gint wtap_num_encap_types = sizeof(encap_table_base) / sizeof(struct encap_type_info);
static GArray* encap_table_arr = NULL;
...........................
...............................

4. You can generate the required .pcap file from input text file with appropriate header information specific to your 
protocol by
using the text2pcap utility that comes with the Wireshark installation:

./text2pcap -l 240 input.txt output.pcap

5. Rebuild the Wireshark source code and install it. Copy the plugin (protocol.dll) for your protocol specific
dissector in the plugins directory and restart wireshark.

Mrunal

From: Mrunal Upadhyay
Sent: Thursday, April 21, 2011 1:20 AM
To: 'wireshark-dev () wireshark org'
Subject: Use of wireshark to interpret input data that does not depend on any other existing protocols

Hi All,

I am adding a new protocol to wireshark that does not rely or depend on any other protocols(tcp, udp, 
ethernet,ppp,etc). I will be thankful if anyone can help me understand the following things:

1. I have written the protocol dissector for my unique protocol. But how do I differentiate the input packets in .pcap 
file so that only my protocol dissector gets called to process the data? And how can I add uniqueness to the input data 
stream to customize it to my protocol. Is the protocol identified by means of some common pattern in the input stream 
of bytes .If that is the case, how can I do that?

2. What is the difference between the dissector table and encapsulation table. I have understood how the protocol 
dissector encodes the input data and display it in a tree based on the formatting defined by static arrays ett and hf. 
What all steps I need to perform in order to write a protocol dissector that does not depend on any existing protocols 
and customize the input data in pcap file so that my protocol dissector gets called only when it comes across correct 
input data.

Mrunal

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe