Objective
I am trying to customize tshark to modify bytes of received frames. Thus, I need to access and modify frame bytes. A similar previous question is currently unanswered: dissector access fragment bytes.
Target usage
$ tshark -r input_pipe -w output_pipe -f <filter> #Packets in output have modified bytes
Approach
For multiple protocols, bytes corresponding to specific fields need to be changed. I let the packets go through dissection instead of re-inventing the dissection wheel. Inside the dissector, bytes corresponding to some fields will be modified in the tvbuff_t *tvb;
With this approach, packets that are fully present in one frame are altered.
For fragmented packets though, changes do not reflect in the output for the constituent fragments. Obviously, dissection is changing the reassembled tvb here & not the frame tvb.
Thus, I added logic (to modify the input file itself):
- after dissect_packet().
- I iterate over packet_info.dependent_frames,
- find each frame_data from cfile.frames
- Then, fetch the bytes from capture file.
- overwrite them with bytes from the reassembled tvb_data (g_slist_last(edt->pi.data_src)->data;)
- and write back the file.
This works well when tshark is run with files:
$ tshark -r in_file.pcap #Works well! Bytes in in_file.pcap are modified
But does not work when reading from and writing to pipes. Key observations:
- cfile.frames or cfile.provider.frames is NULL (tshark.c)
- global_capture_session.cf->frames or global_capture_session.cf->provider.frames is NULL (tshark.c)
NOTE: two-pass analysis would have helped as packets are revisited. But, 2-pass isn't possible with reading & writing from and to pipes! :( while it works perfectly fine with input and output files
Help needed
Could you please help me with:
- Where is the packets information (something like frame_data/packet_info) stored during a live capture
- I was not able to figure out if a temporary file is opened for capturing from pipes and, if opened, where it was
- I am guessing that if a complex (capture or display) filter is specified that needs protocol dissection, where and how previously seen fragments are maintained and when they are output
- Is there another way worth exploring/trying to achieve modification of bytes across all fragments based on dissection
Thanks very much in advance!!!
