Wireshark-dev: Re: [Wireshark-dev] Questions about dev
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 07 Nov 2006 09:26:58 -0800
Neha Chahal wrote:


I am very new to the ethereal source code. I want to add a dissector
that understands my protocol –" my_proto".
 	
Problem statement:

I have a binary file my_proto_dump.log. This file has packets received
by my application.


What format is that file in?


I want ethereal to read from a binary file packets in my_proto
protocol and then be able to dissect these packets and produce an
output file.

I am having a hard time understanding how to join the pieces together.

I have a few questions about this.

1.	To make ethereal dissect my protocol I have to add a dissector,
right ? I would have to add under plugins/my_proto.c – which is my
dissector. This step has been explained nicely in the manual. I did
this.
2.	How do I make ethereal call my dissector?
Is your protocol the bottommost protocol (for example, in an Ethernet capture, the bottommost protocol is Ethernet), or is it a protocol that runs atop another protocol (for example, in that Ethernet capture, an IP packet would probably have IP running atop Ethernet)? 


3.	Do I have to make changes to add my capture file type in the wiretap/ dir.
Only if your binary file is in a format that Wireshark doesn't already support. If, for example, it's a capture file in the format that tcpdump/WinDump supports, that's also the standard format that Wireshark uses, and so you already have code to support it. 


4.	What is the difference between read and seek_read functions.
The read function is used in TShark, which only does a sequential read of the file, and in Wireshark when the file is first read in.
The seek_read function is used after that in Wireshark, because packets aren't necessarily processed in sequential order once the capture has been read in. 


Do I
have to return the packet in the wth->format_buffer?


Presumably you meant "wth->frame_buffer".
If so, then the read routine returns the packet there, and the seek_read routine returns the packet in the buffer pointed to by the "pd" argument. 


Is this packet
used by the dissector to dissect?
Those packet contents are what the dissectors in TShark and Wireshark dissect. 


If yes this packet should have all
the bits I mention in the dissector code ?


It should have all the bits that were captured from the network. :-)
("Bits" here meaning "binary digits" - i.e., it's just the raw contents of the packet.) 


5.	After this wht is the ethereal output format. Do I have to specify
the output format also.


What do you mean by "output format"?
The output of a dissector is some protocol tree entries added to the tree, and information used to generate the columns in the summary display. Code outside the dissector - code that you will not have to write or modify, unless your protocol somehow requires some additional features, which it almost certainly doesn't - turns that into information in windows on the display, or text in a text file, or XML in a PSML or PDML file, or.... Those output formats are not anything you have to deal with.
If your capture file is in a format that Wireshark doesn't currently support writing, and you want to allow it to read in a file in some other format and write it out in your format, you'd have to add code to Wiretap to write that format.