DLT_USER mime_multipart: The multipart dissector could not find the required boundary parameter

asked 2024-03-04 08:03:06 +0000

updated 2024-03-04 08:06:35 +0000

Hi there!

We have a PCAPNG data packet with DLT_USER link-layer type. It contains the raw mime multipart message from boundary like:

--boundary

Content-Type: application/json

...

The custom DLT picks up the "mime_multipart" dissector, but wireshark says: "The multipart dissector could not find the required boundary parameter"

Looking at the code in packet-multipart.c -> dissect_multipart i can see, that if no previous "private_data", or "match_string" values are present in the "packet_info" structure, then this error is shown. (as it is/was a sub-dissector called from other protocols like HTTP,SIP,...) Question is, how can we use the "mime_multipart" dissector to dissect this message?

Previous question: https://ask.wireshark.org/question/31...

Thanks, L.

edit retag flag offensive close merge delete

add a comment

Comments

Is it possible to do it via a LUA script?

I tried that:

-- declare our protocol
multipart_shiv = Proto("multipart_shiv", "MIME Multipart from DLT_USER")

 -- create a function to dissect it
 function multipart_shiv.dissector(buffer,pinfo,tree)
     pinfo.cols.protocol = multipart_shiv.name
     local ms = "multipart/related"
     pinfo.match_string = ms
     Dissector.get("mime_multipart"):call(buffer,pinfo,tree)
 end

But I get: No such match_string for method/object pinfo .... Apparently match_string cant be set from a lua script?

[email protected] ( 2024-03-05 08:35:52 +0000 )edit

I'm not versed enough in Lua to know the answer to this.

Jaap ( 2024-03-10 12:32:10 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

DLT_USER mime_multipart: The multipart dissector could not find the required boundary parameter

1 Answer

Comments

Your Answer

Question Tools

Stats

DLT_USER mime_multipart: The multipart dissector could not find the required boundary parameter edit

1 Answer

Comments

Your Answer

Question Tools

Stats

DLT_USER mime_multipart: The multipart dissector could not find the required boundary parameter