Ask Your Question

mest112's profile - activity

2019-12-03 14:43:13 +0000 received badge  Popular Question (source)
2019-03-11 13:23:38 +0000 received badge  Famous Question (source)
2018-11-15 08:41:50 +0000 received badge  Notable Question (source)
2018-10-02 15:09:04 +0000 received badge  Famous Question (source)
2018-07-12 09:47:35 +0000 received badge  Notable Question (source)
2018-06-28 09:47:37 +0000 received badge  Popular Question (source)
2018-05-20 11:10:17 +0000 received badge  Popular Question (source)
2018-03-25 21:30:48 +0000 received badge  Notable Question (source)
2018-02-28 02:11:54 +0000 received badge  Popular Question (source)
2017-12-18 14:10:31 +0000 commented answer How do I dissect packets if the dissection depends on information from earlier packets?

Thank you.

2017-12-18 14:10:18 +0000 marked best answer How do I dissect packets if the dissection depends on information from earlier packets?

For example, as shown in the image below, if I have two UDP packets in different frames, frames 39 and 40, how would I go about dissecting them together? I need data from both packets. I assume I can't use reassembly, since reassembly is for split packets.

HERE

Would I need to use more then one dissector?

2017-12-15 19:27:21 +0000 commented answer Is it possible to use reassembly on non-split packets?

Yes, frames 39 to 44 each have MASP packets in them, and I would like to dissect 39 and 40, because only together can I

2017-12-15 19:16:22 +0000 commented answer How do I dissect packets if the dissection depends on information from earlier packets?

Apologies! I changed the image if that helps. At the moment, my protocol just simply takes in all packets from UDP port

2017-12-15 19:14:34 +0000 commented answer How do I dissect packets if the dissection depends on information from earlier packets?

Apologies! I changed the image if that helps. My protocol just simply takes in all packets from UDP port 10160, and chan

2017-12-15 19:12:14 +0000 edited question How do I dissect packets if the dissection depends on information from earlier packets?

Can I dissect multiple packets without using reassembly? For example, as shown in the image below, if I have two UDP pac

2017-12-15 19:06:12 +0000 edited question How do I dissect packets if the dissection depends on information from earlier packets?

Can I dissect multiple packets without using reassembly? For example, as shown in the image below, if I have two UDP pac

2017-12-15 18:36:25 +0000 commented answer Is it possible to use reassembly on non-split packets?

Multiple complete packets, which I don't know how to dissect in a single dissector.

2017-12-15 18:23:39 +0000 edited question How do I dissect packets if the dissection depends on information from earlier packets?

Can I dissect multiple packets without using reassembly? For example, as shown in the image below, if I have two UDP pac

2017-12-15 18:22:42 +0000 commented answer How do I dissect packets if the dissection depends on information from earlier packets?

Oh no that's not it, I just set the text in the column to say "Message fragment" (for no reason really), these aren't ac

2017-12-15 18:22:25 +0000 commented answer How do I dissect packets if the dissection depends on information from earlier packets?

Oh no that's not it, I just set the text in the column to say "Message fragment" (for no reason really), these aren't ac

2017-12-15 14:55:47 +0000 edited question How do I dissect packets if the dissection depends on information from earlier packets?

Can I dissect multiple packets without using reassembly? For example, as shown in the image below, if I have two UDP pac

2017-12-15 14:54:43 +0000 edited question How do I dissect packets if the dissection depends on information from earlier packets?

Can I dissect multiple packets without using reassembly? For example, as shown in the image below, if I have two UDP pac

2017-12-15 14:53:08 +0000 edited question How do I dissect packets if the dissection depends on information from earlier packets?

Can I dissect multiple packets without using reassembly? For example, as shown in the image below, if I have two UDP pac

2017-12-15 14:46:30 +0000 asked a question How do I dissect packets if the dissection depends on information from earlier packets?

Can I dissect multiple packets without using reassembly? For example, if I have two UDP packets (they are not split, and

2017-12-15 14:33:52 +0000 received badge  Commentator
2017-12-15 14:33:52 +0000 commented question Is it possible to use reassembly on non-split packets?

I see, then how would I go about dissecting multiple packets in one dissector? Surely there must be a way to do this.

2017-12-15 14:31:38 +0000 commented answer Is it possible to use reassembly on non-split packets?

No, I'm not talking about multiple fragments in a single packet, I'm talking about entirely separate packets.

2017-12-14 19:37:47 +0000 commented question Is it possible to use reassembly on non-split packets?

It's for a project, if it isn't possible to apply reassembly to packets that aren't split, then is there another way to

2017-12-14 16:46:01 +0000 commented question Is it possible to use reassembly on non-split packets?

These packets are running over UDP. I'm still fairly new to wireshark, so I'm still not familiar with some terms, like "

2017-12-14 16:44:33 +0000 commented question Is it possible to use reassembly on non-split packets?

These packets are running over UDP. I'm still fairly new to wireshark, so I'm still not familiar with some terms, like "

2017-12-14 16:14:04 +0000 received badge  Organizer (source)
2017-12-14 16:06:57 +0000 asked a question Is it possible to use reassembly on non-split packets?

Is it possible to use reassembly on non-split packets? I need to dissect multiple packets, but they are not necessarily

2017-12-14 15:25:16 +0000 asked a question How do I use the fragment_add_seq_check function in UDP packet reassembly?

How do I use the fragment_add_seq_check function in UDP packet reassembly? I'm writing a dissector which dissects multip

2017-12-05 16:46:09 +0000 commented answer How do I dissect multiple packets?

2.7 seems to be only for TCP, is there instructions for reassembly for UDP?

2017-12-05 15:10:41 +0000 asked a question How do I dissect multiple packets?

How do I dissect multiple packets? For example, if there is information I can obtain only by using data from 2 packets (

2017-11-03 18:42:59 +0000 commented answer How do I add "child item" to an item in the subtree?

One more thing, how do I add text as an item?

2017-11-03 18:33:53 +0000 commented answer How do I add "child item" to an item in the subtree?

Thank you.

2017-11-03 18:33:02 +0000 marked best answer How do I add "child item" to an item in the subtree?

For example, if I have the item:

VarData: Active (0x90)

How do I add details under this item? I would like to add some text under it. I use C to make my dissector.

2017-11-03 16:19:38 +0000 edited question How do I add "child item" to an item in the subtree?

How do I add "child item" to an item in the subtree? For example, if I have the item: VarData: Active (0x90) How d

2017-11-03 16:10:08 +0000 marked best answer How do I get and display packet data information at a specific byte from the first byte?

Hello, I am a beginner in Wireshark and dissector building, right now I'm just trying to figure out how to fetch and display packet data. I use the following lines in my dissect function:

guint val;
val = tvb_get_guint8(tvb, 1);
proto_tree_add_uint(masp_tree, hf_masp_data, tvb, 1, 1, val);

Here is an image of the results:

Expected result: 0x00

Actual result: 0x60

Why does fetching the data start from the 43rd byte instead of the very 1st one? How do I resolve this issue?

Thanks

2017-11-03 16:10:08 +0000 received badge  Scholar (source)
2017-11-03 16:03:14 +0000 asked a question How do I add "child item" to an item in the subtree?

How do I add "child item" to an item in the subtree? For example, if I have the item: VarData: Active (0x90) How d

2017-11-02 14:53:18 +0000 commented answer How do I get and display packet data information at a specific byte from the first byte?

I need only the byte

2017-11-01 15:36:12 +0000 commented answer How do I get and display packet data information at a specific byte from the first byte?

It's for a project. Is there a way to access the top tvb corresponding to the Ethernet frame?