Ask Your Question
0

DLT_USER mime_multipart: The multipart dissector could not find the required boundary parameter

asked 2024-03-04 08:03:06 +0000

lacirta3@freemail.hu gravatar image

updated 2024-03-04 08:06:35 +0000

Hi there!

We have a PCAPNG data packet with DLT_USER link-layer type. It contains the raw mime multipart message from boundary like:

--boundary

Content-Type: application/json

...

The custom DLT picks up the "mime_multipart" dissector, but wireshark says: "The multipart dissector could not find the required boundary parameter"

Looking at the code in packet-multipart.c -> dissect_multipart i can see, that if no previous "private_data", or "match_string" values are present in the "packet_info" structure, then this error is shown. (as it is/was a sub-dissector called from other protocols like HTTP,SIP,...) Question is, how can we use the "mime_multipart" dissector to dissect this message?

Previous question: https://ask.wireshark.org/question/31...

Thanks, L.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2024-03-04 20:19:55 +0000

Jaap gravatar image

Well, you make a dissector shim, that fits between the DLT_USER and the mime-multipart dissector. Use this shim to handle the DLT and setup the private data the mime-multipart dissector needs.

edit flag offensive delete link more

Comments

Is it possible to do it via a LUA script?

I tried that:

-- declare our protocol
multipart_shiv = Proto("multipart_shiv", "MIME Multipart from DLT_USER")

 -- create a function to dissect it
 function multipart_shiv.dissector(buffer,pinfo,tree)
     pinfo.cols.protocol = multipart_shiv.name
     local ms = "multipart/related"
     pinfo.match_string = ms
     Dissector.get("mime_multipart"):call(buffer,pinfo,tree)
 end

But I get: No such match_string for method/object pinfo .... Apparently match_string cant be set from a lua script?

L.

lacirta3@freemail.hu gravatar image[email protected] ( 2024-03-05 08:35:52 +0000 )edit

I'm not versed enough in Lua to know the answer to this.

Jaap gravatar imageJaap ( 2024-03-10 12:32:10 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2024-03-04 08:03:06 +0000

Seen: 177 times

Last updated: Mar 05