Ask Your Question
0

How to dissect an ethernet packet, that is an array of bytes

asked 2024-08-16 20:57:44 +0000

CollinX gravatar image

updated 2024-08-16 21:11:38 +0000

Hi. I want to make some kind of dll that can receive an ethernet packet as array of bytes, and then, using the epan framework dissect it (Get columns data, and details tree data) and then return this data to the caller as some JSON string or Xml string.

For now I finally understood the whole WS project structure and managed to build it. Still debugging and researching the code, but so far the solution I like is the rawshark one. It seems like does the same but from and pipe. But there is one issue with rawshark - for some reason it can not get _ws.col data, for example _ws.col.Info never was printed no matter I did. I'm still learning docs and googling about WS source code for 8 days long. But today I decided to actually ask:

  • Is this even possible to implement what I want to or maybe there is some better way to get my goal done?

Also few more extra questions:

  • Can I even use raw ethernet packet data as array of bytes, or epan framework works with .pcap files only?

  • How exactly WS gets data for the columns? For example _ws.col.Info column data generates dynamicly by WS or stores inside .pcap file in some kind of header?

Second solution I see for now it just use tshark's implementation but not sure, because it look like it uses much more code and libs and logic, I mean some internal stuff that I can't even understand e.g load some prefs when I don't even have any pref files on my disk and so on.

So, I would be grateful if somebody shows me the right way to reach my goals.

Thank You in advance.

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
0

answered 2024-08-28 21:02:52 +0000

CollinX gravatar image

Analyzing and debugging source code, also reading docs I found out how the dissection works in epan framework and implemented API that can work with a raw packet payload. So I guess the question is solved. Have a nice day :)

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2024-08-16 20:57:44 +0000

Seen: 137 times

Last updated: Aug 28