Hi all, I'm using tshark for some specific dissectors. I have to modify the function dissect_data(...) in packet-data.c. In my scenario, most of the packet must go through this function. My objective is: at the end of this function, I want to clear all data of this packet before going to the next in order to free memory. So, my question is:
Here is the function dissect_data(...) asked 24 Dec ‘14, 20:30  hoangsonk49 edited 27 Dec ‘14, 15:38  Guy Harris ♦♦ |
2 Answers:
You need to either:
answered 27 Dec '14, 15:37 Guy Harris ♦♦ edited 28 Dec '14, 02:16 |
No you cannot, because the dissection engine memory is owned by the dissection engine, not you dissector. The engine knows when memory can be freed, or not, and does so when appropriate. There have been some serious work in this area with current versions of Wireshark, so this might relieve you situation. If you are looking at the out-of-memory problems you can encounter when having a long capture, or large file, there are other ways to address this. The root cause is that Wireshark accumulates 'state' from the network traffic it sees. This allows Wireshark to do all the amazing things it does. On the downside, this state data cannot be freed until the capture file is closed. So, either capture using dumpcap for long term captures, or use editcap to split your large capture file in order for it to be loaded. But these are only general recommendation. There could be more specific suggestions possible for your particular situation. answered 25 Dec '14, 08:06  Jaap ♦ Hi Jaap, I split file by using : tshark -i 6 -P -w logs/call_log.pcap -b filesize:655350 In another situation, I dissected the CAMEL packet successfully without any problem of memory.In the current situation,the packet is not a standard so it must be decoded before going through SCCP dissector to be output as CAMEL standard.If CAMEL packet has no problem of memory,so I think there is something wrong in my decode function which are related to the memory allocation. It increases about 1.5% of 32GB in 10 minutes until reach 95% before Stop. Here is the decode function:
Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
|
Why must it go through that function?
dissect_data()is what’s used when the data being dissected is of an unknown protocol or is raw data (such as that transported by “read” and “write” requests in remote file system protocols such as SMB, NFS, or AFP). If you’re trying to dissect the data, it’s not of an unknown protocol, it’s of whatever protocol you’re trying to dissect - hackingdissect_data()to call another dissector is always the wrong answer, you should be hacking whatever’s callingdissect_data()so that it calls your dissector instead.Hi Harris, the data stream I received from the network is unknown protocol. After my decode function, it becomes the data of sccp. I know It should be better to create a new dissector to decode so that it can be recognized as sccp data and should not go through dissect_data(…) function as described in the method [1]:
But I choose [2] because I don’t know how to get the data stream before it goes to dissect_data(…) in the source code. So, I have to use the data in dissect_data(…) of packet-data.c as as described in the method [2].
The data stream you receive from the network is for some known protocol, otherwise you wouldn’t have a decode function to apply to it!
In what protocol is your data stream encapsulated? TCP? IP? Ethernet? If you read a capture file into Wireshark without your decode function, presumably, in the “packet details” pane, there will be some protocol that appears before it. That’s the place where
dissect_data()gets called.Hi Harris. The protocol before it is UDP . Here is the pcap file. Thanks for suggestion. I ’ll try to rewrite the dissector.