Detailed Expert Information for Goose Packet

goose

asked 2022-03-11 00:05:40 +0000

Ke
5 ●1 ●2 ●5

Hi, my team wants to show detailed expert information for Goose packet (IEC61850). The current wireshark shows:

[Malformed Packet: GOOSE]

  [Expert Info (Error/Malformed): Malformed Packet (Exception occurred)]

    [Malformed Packet (Exception Occurred)]

    [Severity level: Error]

    [Group: Malformed]

We want to show the detailed information for the malformed part, for example:

the numDatSetEntries's length is 0 in our malformed packet. According to the Goose protocol, the length should be 1. We want to show that this packet is malformed because of the "numDatSetEntries" field. And ideally also show the reason for it.

I have struggled a lot reading the code about the asn1 dissector, any hint for doing this, or is it possible with existing function?

Thanks for reading my question!

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2022-03-11 07:31:23 +0000

Anders

5023 ●101 ●58

updated 2022-03-11 07:31:53 +0000

Hi, As goose is a dissector generated from the asn1 description you will have to add code on the .cnf file. If you can shar a pcap with the packet in a bug report we could do a fix. Otherwise you would have to do something like.

#.FN_BODY numDatSetEntries VAL_PTR= &num_dataset_entries
gint num_dataset_entries=0;

%(DEFAULT_BODY)s
if(num_dataset_entries == 0){
   "Add expert info here"
}

edit flag offensive delete link

Comments

thanks for the reply, do you mean I have to submit the report to wireshark's gitlab repo?

Ke ( 2022-03-11 10:57:49 +0000 )edit

If you want to report it as an issue/enhancment request https://gitlab.com/wireshark/wireshar...

Anders ( 2022-03-11 12:42:46 +0000 )edit

thanks for the info, I have added the issue

Ke ( 2022-03-24 23:48:37 +0000 )edit

add a comment

answered 2022-03-11 07:26:19 +0000

hugo.vanderkooij
76 ●190 ●4

Do you need to do this in the expert code? My first instinct would be a coloring rule showing this particular issue. That should be easy to accomplish.

edit flag offensive delete link

add a comment