Ask Your Question
0

How can I add any field in wireshark in order to analyse packet

asked 2018-03-02 09:20:53 +0000

Madhavi gravatar image

updated 2018-10-26 17:42:31 +0000

cmaynard gravatar image

Hi all, I'm doing project in contiki operating system. I have a problem. I have save .pcap file of my rpl communication from contiki cooja. The .pcap file is given as a input to wireshark. I understand how wireshark reads packet but now I want add field(a statement) in wireshark and want to know how wireshark print all flag, header etc. things with values. Can you help me please?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2018-03-02 10:50:15 +0000

grahamb gravatar image

The process whereby Wireshark prints all the details of a protocol is called "dissection", performed by code called "dissectors".

A starting point for dissectors (you don't necessarily need to be a programmer) would be my SharkFest presentation on 3 ways to write a dissector.

edit flag offensive delete link more

Comments

Thank you so much for your kind reply. I am doing project in networking in contiki operating system. I am using wireshark to analyse packet. As we know in wireshark we will get source address, destination address, payload length etc things. Now I want to add a new field (parameter or variable) same as source address e.g ABC : 12. I will write code for value. But I want to how to add that parameter in wireshark? How to modify wireshark for that value. Currently, I am using wireshark 2.2.6. Can you please help me? Thanks in advance.

Madhavi gravatar imageMadhavi ( 2018-03-02 13:37:30 +0000 )edit

Is the field that you want to add an existing field in an already dissected protocol? If so, you can select that field in the packet details tree, right click it and select "Apply as Column".

If your field is not currently dissected, then you will need to add a dissector. You can use any of the approaches in my presentation.

grahamb gravatar imagegrahamb ( 2018-03-02 14:03:24 +0000 )edit

I want to add one more new field. But I didn't understand how to add dissector and what is dissector ? Thanks in advance.

Madhavi gravatar imageMadhavi ( 2018-03-03 06:40:49 +0000 )edit

As I tried to explain above, a dissector is a bit of code that knows how to "interpret" the bytes in the packet and adds them to the Wireshark display.

If your data is already (partially) dissected by Wireshark, then you will need to modify the existing dissector. If this is a new protocol, not already handled by Wireshark, then you will need to write a new dissector.

Can you post your capture file (as a link to the file on an external file sharing site, e.g. CloudShark, Google Drive, DropBox etc.) with details of how you would like it displayed?

grahamb gravatar imagegrahamb ( 2018-03-03 10:25:13 +0000 )edit

I added this link https://www.dropbox.com/s/ua5yx019dkt.... Here I underlined some text. In the similar way I want to add text, which will be seen in wireshark. Can you please help me? Ok I will search for dissector.

Madhavi gravatar imageMadhavi ( 2018-03-03 13:03:03 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2018-03-02 09:20:53 +0000

Seen: 527 times

Last updated: Mar 02 '18