THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

How do I let the user specify for which UDP ports a dissector should be used?

I created a dissector under the assumption that a given dissector is applied to every packet picked up by Wireshark.

As such I created an .ini file to define the ports on which the dissector should operate.

More specifically, the .ini file is read at Wireshark startup by the dissector, and the dissector in turn passes ports one at a time into the function

dissector_add_uint("udp.port",...).

This limits the ports the dissector operates on to those in the .ini file. When Wireshark runs the dissector doesn't even see packets not intended for it.

Is the .ini file the way this should be handled or is there another way to do this? My users need a way to change the ports the dissector processes for a given run of Wireshark.

vemson's avatar
1
vemson
asked 2021-09-21 22:16:30 +0000
Guy Harris's avatar
19.9k
Guy Harris
updated 2021-09-22 08:11:12 +0000
edit flag offensive 0 remove flag close merge delete

Comments

"My users need a way to change the ports the dissector processes for a given run of Wireshark."
Are the ports specific to the capture file or is it multiple runs against the same capture with different ports each run?

Chuckc's avatar Chuckc (2021-09-22 14:34:52 +0000) edit
add a comment see more comments

2 Answers

0

The preferred way to do this is to register a so called dissector preference (pun intended ;)) with the dissection engine. This will automagically add your protocol to the list in the protocol tree in the preferences dialog, and allows your users to enter the ports your dissector should register on. When they do you first deregister from all old ports and register again to the new ports. This is a common theme, see section 2.6 in doc/README.dissector and useful convenience functions are provided for this, e.g. dissector_add_uint_with_preference() and dissector_add_for_decode_as_with_preference().

Jaap's avatar
13.7k
Jaap
answered 2021-09-22 05:38:43 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments
0

I created a dissector under the assumption that a given dissector is applied to every packet picked up by Wireshark.

Incorrect assumption. Link-layer dissectors are applied only if the packet's link-layer protocol type corresponds to the link-layer protocol for that dissector. All other dissectors are applied only if another dissector that sees the packet decides to hand the packet to the dissector in question.

In your case, with a protocol that runs atop UDP, a dissector is called only if the packet is a UDP packet and, for the source and destination port numbers in the UDP header, either:

  1. the dissector has explicitly registered one (or both) of those port numbers in the "udp.port" dissector table;
  2. the dissector is set up the way Jaap suggests, and the user configures it to be called for one of those port numbers;
  3. the dissector is a UDP heuristic dissector, and the packet hasn't been handed to another dissector before it was handed to the heuristic dissector to see if it looks like one of its packets.

So, for your case, Jaap's suggest, 2), is the correct answer.

Guy Harris's avatar
19.9k
Guy Harris
answered 2021-09-22 08:17:51 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer