Ask Your Question
0

How to parse clientbound and serverbound packets differently?

asked 2025-08-14 02:02:16 +0000

I'm dealing with a UDP format that has mildly different formats between the client-to-server protocol and the server-to-client protocol. How do I handle this in a way where I can parse these packets in different ways? Do I have to register 2 different dissectors?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2025-08-14 10:43:33 +0000

Chuckc gravatar image

Can you determine direction programmatically?

One way of doing that is comparing the source and destination port numbers.
Search code for string port >.

epan/dissectors/packet-udp.c:

    /* check direction and get ua lists */
    direction = cmp_address(&pinfo->src, &pinfo->dst);
    /* if the addresses are equal, match the ports instead */
    if (direction == 0) {
        direction = (pinfo->srcport > pinfo->destport) ? 1 : -1;
    }


epan/dissectors/packet-tpm20.c:

    if (pinfo->srcport > pinfo->destport) {
        col_append_sep_str(pinfo->cinfo, COL_INFO, NULL, " [TPM Request]");
        if (length >= TPM_COMMAND_HEADER_LEN)
            dissect_tpm20_tpm_command(tvb, pinfo, tpm_tree);
        else
            dissect_tpm20_platform_command(tvb, pinfo, tpm_tree);

    } else {
        col_append_sep_str(pinfo->cinfo, COL_INFO, NULL, " [TPM Response]");
        if (length >= TPM_COMMAND_HEADER_LEN)
            dissect_tpm20_tpm_response(tvb, pinfo, tpm_tree);
        else
            dissect_tpm20_platform_response(tvb, pinfo, tpm_tree);
    }
edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2025-08-14 02:02:16 +0000

Seen: 57 times

Last updated: yesterday