Wireshark Plugin: Dissecting Payloads With Multiple Packets Per UDP Frame

Posted by John Dibling on Stack Overflow See other posts from Stack Overflow or by John Dibling
Published on 2010-05-28T15:50:01Z Indexed on 2010/05/28 15:52 UTC
Read the original article Hit count: 208

I am writing a Wireshark plugin to dissect a protocol that places multiple application-level packets in a single UDP frame. There is no enclosing protocol that indicates how many packets there are in the frame. So essentially, the payload coming down the wire will look like this:

uint64  sequence1
uint64  data1
uint8  flags1
uint64  sequence2
uint64  data2
uint8  flags2
: : :
uint64  sequence_n
uint64  data_n
uint8  flags_n

In my server code that actually processes this information, I simply loop through the frame until I reach the end. In looking through the plugins included with the wireshark source code, I didn't see any protocols that did any looping like this.

I know other protocols pack multiple payloads per frame. What is the cannonical or standard way to handle protocols like this in a Wireshark dissector?

© Stack Overflow or respective owner

Related posts about c++

Related posts about wireshark