Ask Your Question
0

How to get the amount of bytes per protocol header?

asked 2018-06-22 08:51:52 +0000

Martijn gravatar image

updated 2018-06-22 09:28:29 +0000

Hi everybody,

For research purposes, I am looking to get the amount of bytes used for each protocol. Unfortunately, the protocol hierarchy all use a cumulative calculation method (size 802.15.4 = size 802.15.4 header + size 6LoWPAN header + ...).

What I want:

  • Frame: 86 bytes
  • Protocol A: 23 bytes
  • Protocol B: 7 bytes
  • Protocol C: 12 bytes
  • Payload: 44 bytes

What wireshark does now:

  • Frame: 86 bytes
  • Protocol A: 86 bytes
  • Protocol B: 63 bytes
  • Protocol C: 56 bytes
  • Payload: 44 bytes

I was wondering I could get this information about bytes per header in a way so I can calculate the total amount of bytes per type of header for a whole pcap file. The information I need seems to be already available per packet on the gui; when you click a header in the tree, the amount of bytes of that header is available in the status bar and the frame bytes window highlights the correct amount of bytes. (screenshot: https://pasteboard.co/Hr2VBLSU.png)

I've thought about writing wrapper dissectors in lua for the protocols I use, but I got stuck there trying to tie in the dissectors and retreiving the correct information.

Extra follow-up question:

The packages I examine are 6LoWPAN packets. I would also like to get the amount of bytes actually transmitted. not decompressed. However, the tree headers only give the decompressed amount of bytes. Is this possibile?

With kind regards,

Martijn

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2018-06-23 19:30:43 +0000

gaddman gravatar image

If the fields already exist, then can you do something like this?

tshark -T fields -e ip.hdr_len -e tcp.hdr_len -e ipv6.hopopts

If that doesn't work and you're comfortable with LUA dissectors, you could use a post-dissector to grab the info you need.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-06-22 08:51:52 +0000

Seen: 49 times

Last updated: Jun 23