Wireshark Plugin: Dissecting Payloads With Multiple Packets Per UDP Frame
- by John Dibling
I am writing a Wireshark plugin to dissect a protocol that places multiple application-level packets in a single UDP frame. There is no enclosing protocol that indicates how many packets there are in the frame. So essentially, the payload coming down the wire will look like this:
uint64 sequence1
uint64 data1
uint8 flags1
uint64 sequence2
uint64 data2
uint8 flags2
: : :
uint64 sequence_n
uint64 data_n
uint8 flags_n
In my server code that actually processes this information, I simply loop through the frame until I reach the end. In looking through the plugins included with the wireshark source code, I didn't see any protocols that did any looping like this.
I know other protocols pack multiple payloads per frame. What is the cannonical or standard way to handle protocols like this in a Wireshark dissector?
