Is there an openwire dissector

edit

A dissector for OpenWire was added to Wireshark in 2012, the Bugzilla entry is here and was released with Wireshark 1.8.

There is a comment in the dissector source about what the dissector can handle that may be relevant:

OpenWire has two wire formats :
- "loose" : more verbose, less CPU-intensive, less network-intensive (1-pass)
- "tight" : more compact, more CPU-intensive, more network-intensive (2-pass)
This dissector only supports the "loose" syntax, which is not the default.
This dissector only supports version 6 of the protocol.
It can be changed on the broker in the activemq.xml file by specifying "tightEncodingEnabled=false" :

<transportConnectors>
    <transportConnector name="tcp-connector" uri="tcp://0.0.0.0:61616?wireFormat.tightEncodingEnabled=false&amp;wireFormat.cacheEnabled=false"/>
</transportConnectors>

Note : The WIREFORMAT_INFO command is always sent in "loose" format.