Wireshark · Wireshark-dev: Re: [Wireshark-dev] How does the wireshark identify the corresponding protocol according to the data

["Martin Mathieson" <martin.r.mathieson@xxxxxxxxxxxxxx>]

On Tue, Dec 23, 2008 at 9:09 AM, Yuming fang <fangyuming.leo@xxxxxxxxx> wrote:

2008/12/23 Martin Mathieson <martin.r.mathieson@xxxxxxxxxxxxxx>

On Tue, Dec 23, 2008 at 8:11 AM, Yuming fang <fangyuming.leo@xxxxxxxxx> wrote:

<snipped>

 

 

Yeah, I register the dissector for the LTE data with the "tcp.port" dissector table with the value 9999. And now I could get the LTE data from the 9999 port. Do I just add  my LTE code into the corresponding functions, such as the function of dissect_LET to parse the LTE date?  Could you give me some information about the APIs(in wireshark) which could display the LTE data headers as layers in wireshark?(I want to display these headers like layers)

 

Thank you very much!

 

Best wishes,

Yuming

 

 

Hi Yuming,

Which LTE data headers are you referring to?  I'm planning to check in my LTE MAC dissector tonight.  RLC is almost ready (hopefully early next year) and I have a PDCP dissector that I need to tidy up a little and add a couple more ROHC profiles to.

 

 

At present, I want to check the LTE MAC dissector. Could you give me some information about your solution of checking the code through wireshark?

 

I'll send a brief email to wireshark-dev after I commit the code to subversion (I'm one of the maintainers with write access to subversion).  You do need to attach some configuration information to each frame in order to decode it, I'll show how I do it for my company's log file format.
 

 

Note that Wireshark already has support for several LTE signalling protocols (S1AP, X2AP, RRC, NAS), and and although they're not normally carried over TCP I'm sure we could allow them to be decoded over a configured TCP port.

 

 

I see some code about the RRC in wireshark. It seems we could not decode the LTE data directly because there is no LTE card. So I want to decode the LTE data through a configured TCP port(At present we use the port 9999 as a test.). But how could my LTE code be added into this dissector(tcp.port=9999) perfectly? Could you give me some suggestions?

Is your data on top of TCP MAC/RLC/PDCP/RRC, or just RRC?

If its just RRC, its not just a case of calling the RRC dissector, you need to call the correct entry point, which depends upon the RLC logical channel type it was carried upon.  So you'd need some way of knowing which type of channel a TCP connection was carrying.

 

 

Thank you!

 

Best wishes,

Yuming

 

 

Martin
 

 

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe