MATE Protocol weirdness [closed]

asked 2018-10-16 01:49:00 +0000

Scott Harman gravatar image

updated 2018-10-16 10:56:25 +0000

grahamb gravatar image

Hi team - I've finally gotten around to looking at my MATE dissector issues in 2.6 code

I have worked out a MATE dissector which works(ish) but I'm able to match only on the request_id

Pdu giop_pdu Proto giop Transport tcp/ip {
        Extract giop_addr From ip.addr;
        Extract giop_port From tcp.port;
        Extract giop_request_id From giop.request_id;
        Extract giop_request_op From giop-q_quentin.Request_Operation;
        Extract giop_type From giop.type;

Gop giop_req On giop_pdu Match (giop_request_id) {
        Start (giop_type=0);
        Stop (giop_type=1);



Only about 3% of all the GIOP packets in my test capture have a value stored for the extracted field giop_addr

I could use the regular ip.src or ip.addr values, but I'd really like to know why - in many (if not most) cases it's only one half of the conversation that has the giop_addr and giop_port fields populated.

It does appear to have changed since 2.2, and that could be why my previously working MATE dissector is now broken.

Sample file:

New dissector:

Old dissector:

edit retag flag offensive reopen merge delete

Closed for the following reason duplicate question by Scott Harman
close date 2018-10-16 23:25:52.844568


JeffMorriss gravatar imageJeffMorriss ( 2018-10-17 13:34:43 +0000 )edit