Getting started with building a dissector

asked 2023-04-17 14:46:24 +0000

Hi, good afternoon!

I've followed the instructions as described here (https://www.wireshark.org/docs/wsdg_h...) to create a custom dissector based on the sample and I'm getting some trouble trying to load the dissector.

First of all, let me say that I'm not building wireshark (and I don't want to get into that if not needed). I'm using the packages available on my system (Fedora Core 36). Those packages are: wireshark and wireshark-devel.

The thing Is I've been able to build the plugin (as shared object) but after loading into wireshark I see the plugin loaded but I cannot find the filter. I mean, I load a pcap file with the traffic related to the plugin and when I type the "sdts" in the filter bar, I cannot see it.

if I type: tshark -G plugins in the command line I get the sdts loaded but when I click on View -> Internals -> Supported Protocols I can't find the dissector.

Please, can anyone help me with this?

NOTE: I tried to paste some images and source code to give more details about my problem but I couldn't.

edit retag flag offensive close merge delete

Comments

You never said if the traffic related to the plugin is actually dissected by your plugin. Does it, or not?

Looks like there's something off with the way you register your dissector with the dissection engine. Try posting the registration and handoff part of the code on pastebin or alike and add a link here.

Jaap ( 2023-04-18 09:13:30 +0000 )edit

add a comment

answered 2023-04-18 14:43:40 +0000

Chuckc
3023 ●6 ●612 ●20

updated 2023-04-18 14:46:19 +0000

For those following along with the home game, instructions here for building a plugin "out of tree":
doc/plugins.example

With these changes to hello.c to get rid of requirement for wireshark.h from the source tree:
(This is for build using wireshark-dev/jammy,now 3.6.2-2 amd64 [installed] on Ubuntu)

/* #include <wireshark.h> */

/*
WS_DLL_PUBLIC_DEF const int plugin_want_major = WIRESHARK_VERSION_MAJOR;
WS_DLL_PUBLIC_DEF const int plugin_want_minor = WIRESHARK_VERSION_MINOR;
*/
WS_DLL_PUBLIC_DEF const int plugin_want_major = 3;
WS_DLL_PUBLIC_DEF const int plugin_want_minor = 6;

edit flag offensive delete link

Comments

My mistake not using the 3.6 branch example for hello.c which uses the old layout for header files.

Chuckc ( 2023-04-19 12:19:36 +0000 )edit

add a comment

Getting started with building a dissector

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Getting started with building a dissector edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Getting started with building a dissector