Hi,
I'm trying to write a new dissector for an in-house protocol. This protocol is completely L2, there is no IP header. The frame will be dissected using a specific vlan.id, but I cannot find a way to do so... The following doesn't seem to be working:
dissector_add_uint("vlan.id", xxx_vlan, xxx_handle);
Do i need to use another library than epan/packet.h??
Now that you've provide the information that your data is using an Ethertype of 0xA003, you should be able to add your dissector to the ethertype table:
dissector_add_uint("ethertype", 0xA003, xxx_handle);
If you don't want to modify other dissectors to make yours work, you can fetch the pointer to the VLAN dissector from the ethertype table and store it in a variable, then register your own dissector to the table instead, and let your dissector call the VLAN one if the VID doesn't match the one you've used to identify your protocol. If it matches, your dissector has to do the job of the VLAN one (or just skip the bytes without dissecting them if you are not a perfectionist).
The vlan dissector does not register a dissector table, so unless you modify the dissector, what you're attempting to do isn't going to work.
For example, see the call to register_dissector_table() made in packet-ethertype.c's proto_register_ethertype() routine or search the Wireshark sources for many more examples.
$ grep register_dissector_table packet*.c | wc -l
381
There is no dissector table with the name "vlan.id" and that's why your code does not work. You need to modify the vlan dissector to call your dissector with the rest of the frame when your vlan.id is detected possibly by adding the dissector table for "vlan.id" to the vlan dissector and the code to use it.
Asked: 2018-05-21 12:34:49 +0000
Seen: 1,731 times
Last updated: May 22 '18
Does your protocol have a unique ethertype value, or is it just re-using one already assigned for another purpose? The Ethertype table is here.
it's just 0x8100, 802.1Q type
That's not the Ethertype value for your protocol, it's the value that's put in the last 2 octets of the Ethernet header to indicate that this is an 802.1Q-tagged frame. At least according to 802.1Q, that value is the TPID of the tag header; what follows it is the 2-octet TCI field, which is the second part of the tag header.
So, for those frames, what follows the VLAN tag header? Is it a 2-octet Ethertype field, as 802.1Q seems to indicate that it should be on Ethernet, or is it something else?
Yeap, you're right, sorry I always mix up these two. The ethertype is 0xa003. To be honest, I could also use ethertype instead of vlan.id to call the dissect. I tried that also but I had the same result...
I.e. all of your packets have in them, starting with the destination MAC address at the beginning: