Scott Harman's profile - activity

Updating MATE config Hi team - I'm trying to work out what's changed in Wireshark between version 2 and 2.6 with regard

Updating MATE config Hi team - I'm trying to work out what's changed in Wireshark between version 2 and 2.6 with regard

Thanks Sindy - that solves it. I'd worked out that it was a bug yesterday, as I did some testing with the sample MATE f

Hi team - I'm trying to work out what's changed in Wireshark between version 2 and 2.6 with regard to MATE

Previously I was successfully matching sessions and PDUs based on the following - but now a new PDU is being created for every message refined question yesterday, with updated MATE filter

Hi team - I've finally gotten around to looking at my MATE dissector issues in 2.6 code

I have worked out a MATE dissector which works(ish) but I'm able to match only on the request_id

Pdu giop_pdu Proto giop Transport tcp/ip {
        Extract giop_addr From ip.addr;
        Extract giop_port From tcp.port;
        Extract giop_request_id From giop.request_id;
        Extract giop_request_op From giop-q_quentin.Request_Operation;
        Extract giop_type From giop.type;
};

Gop giop_req On giop_pdu Match (giop_request_id) {
        Start (giop_type=0);
        Stop (giop_type=1);

};

Done;

Only about 3% of all the GIOP packets in my test capture have a value stored for the extracted field giop_addr

I could use the regular ip.src or ip.addr values, but I'd really like to know why - in many (if not most) cases it's only one half of the conversation that has the giop_addr and giop_port fields populated.

It does appear to have changed since 2.2, and that could be why my previously working MATE dissector is now broken.

Sample file: https://www.dropbox.com/s/fg015gu4wlg...

New dissector: https://www.dropbox.com/s/7s47datxxtq...

Old dissector: https://www.dropbox.com/s/brvfq2wilm0...

Now, I'm getting the PDU displayed, but I'm not able to filter on the request/reply

https://i.imgur.com/XVR06dR.png (image linked separately so it's easier to view)

I'm sure I'm missing something obvious, but I can't work out the syntax to ensure that I'm matching the right object in the reply

solved by Sindy below

Linked question that I asked yesterday after drilling down into it: https://ask.wireshark.org/question/54...

And the bug raised yesterday: https://bugs.wireshark.org/bugzilla/s...

MATE Protocol weirdness Hi team - I've finally gotten around to looking at my MATE dissector issues in 2.6 code I have

Updating MATE config Hi team - I'm trying to work out what's changed in Wireshark between version 2 and 2.6 with regard

Updating MATE config Hi team - I'm trying to work out what's changed in Wireshark between version 2 and 2.6 with regard

Any examples of a LUA script for XML? Hey all - I'm trying to get started writing my first LUA dissector to decode the M

Thanks very much for the response Guy - it's our own protocol for media transfer between our hardware and software appli

Hi Guy - it's our own protocol for media transfer - would I be able to do something piping the capture filter into a dis

How would I map this display filter to a capture filter? Hi guys - I've got the following script that I've made fairly g