Ask Your Question

Bustel's profile - activity

2023-07-15 11:55:54 +0000 received badge  Famous Question (source)
2022-05-09 21:36:18 +0000 received badge  Notable Question (source)
2021-08-30 06:21:30 +0000 received badge  Popular Question (source)
2020-10-12 11:10:08 +0000 marked best answer How can I use conversations in custom dissectors

I have a custom dissector written in C that dissects a simple client-server protocol. The protocol though has one quirk: If an operation is successful it sets ACK flag, if not the ACK bit is not set. However if the bit is not set it looks exactly like a packet a client might send to a server. My idea was to use conversations to track if a packet is a response to a query.

From reading the README.dissector documentation I came up with the following:

```C

    guint* conv_frames;
    conversation_t* conv = find_conversation_pinfo(pinfo,0);


    if (conv == NULL){
        conversation_new(pinfo->num, &pinfo->src, 
                                      &pinfo->dst, 
                                      conversation_pt_to_endpoint_type(pinfo->ptype),
                                      pinfo->srcport, pinfo->destport, 0);
    }
    conv_frames = (guint*) conversation_get_proto_data(conv, proto_rnvs);
    if (conv_frames == NULL){
        conv_frames = (guint*) wmem_alloc(wmem_file_scope(), sizeof(guint));
        *conv_frames = 0;
        conversation_add_proto_data(conv, proto_rnvs, conv_frames);
    }

    *conv_frames = *conv_frames + 1;

     ....

    if (*conv_frames % 2 == 0) {
        proto_item_append_text(ti, ", %s", val_to_str(flags, server_response, "Unknown (0x%02x)"));
        col_add_fstr(pinfo->cinfo, COL_INFO, "%s", val_to_str(flags, server_response, "Unknown (0x%02x)"));
        conversation_delete_proto_data(conv, proto_rnvs);
    } else {
        proto_item_append_text(ti, ", %s", val_to_str(flags, client_ops, "Unknown (0x%02x)"));
        col_add_fstr(pinfo->cinfo, COL_INFO, "%s", val_to_str(flags, client_ops, "Unknown (0x%02x)"));
    }

```

This seems to work when I run it in Tshark but in Wireshark as soon as I enter a filter it fails and misinterprets the packets. I suspect that this code only works on the first dissection run and then has some 'leftover' state. But i dont understand the conversation feature enough to tell what I am missing here. Can anobody help me out here?

2020-10-12 11:10:08 +0000 received badge  Scholar (source)
2020-10-12 11:09:55 +0000 commented answer How can I use conversations in custom dissectors

Thanks for the hints. I solved it by copying the way the gryphon plugin handles it: Using PINFO_FD_VISITED and then mark

2020-10-09 12:47:48 +0000 commented answer How can I use conversations in custom dissectors

I understand. How can I then use previous state of the connection properly? Do I have at least the guarantee that all pa

2020-10-09 11:58:12 +0000 asked a question How can I use conversations in custom dissectors

How can I use conversations in custom dissectors I have a custom dissector written in C that dissects a simple client-se