Wireshark Plugin: Dissecting Payloads With Multiple Packets Per UDP Frame
Posted
by John Dibling
on Stack Overflow
See other posts from Stack Overflow
or by John Dibling
Published on 2010-05-28T15:50:01Z
Indexed on
2010/05/28
15:52 UTC
Read the original article
Hit count: 236
I am writing a Wireshark plugin to dissect a protocol that places multiple application-level packets in a single UDP frame. There is no enclosing protocol that indicates how many packets there are in the frame. So essentially, the payload coming down the wire will look like this:
uint64 sequence1
uint64 data1
uint8 flags1
uint64 sequence2
uint64 data2
uint8 flags2
: : :
uint64 sequence_n
uint64 data_n
uint8 flags_n
In my server code that actually processes this information, I simply loop through the frame until I reach the end. In looking through the plugins included with the wireshark source code, I didn't see any protocols that did any looping like this.
I know other protocols pack multiple payloads per frame. What is the cannonical or standard way to handle protocols like this in a Wireshark dissector?
© Stack Overflow or respective owner