How to write dissector in this case: asked 22 Jul '15, 02:31  Andrew Chernyh |
One Answer:
You'll need to pass the channel number from your dissector to dissector A, and have it use both the UDP conversation and channel number to determine which subdissector to call. Ideally, the libwireshark notion of conversations would be more general, and your dissector would create a TDMoP conversation which would be indexed by source and destination IP addresses, source and destination ports, and the channel number, and a dissector could be associated with a TDMoP conversation. answered 23 Jul '15, 14:33  Guy Harris ♦♦ |
So your protocol runs over UDP, and other protocols run over it? And a single UDP conversation carrying your protocol can have different subprotocols for different channels in your protocol?
Yes. My answer is about TDMoP protocol dissector. Protocol header contains source and dest TDM channel, and they are independent. I think, that tdmoe protocol dissector has same trouble: subaddress for channel identification. Calling of lapd_handle (lapd-bitstream), will give wrong result when multiply streams (same source mac, dest mac, but not same subaddress) captured.