Wireshark mailing list archives

Improve Generic Netlink family id to name mapping


From: Matt <mattator () gmail com>
Date: Mon, 22 Jul 2019 21:22:56 +0900

Hi,

I've recently been spending some time working with netlink/wireshark.
More precisely with a out-of-tree generic netlink protocol: the
multipath TCP netlink path manager.

I was surprised to see next to the generic netlink family id the name
of the family "mptcp" in wireshark.I've had a look at the code yet I
couldn't figure how it got the mapping from a number to the family
name.
I happen to unload/reload the linux kernel module in charge of this
netlink family, thus its id keeps changing (visible via `genl ctrl
list`). I have a lua script in charge of decoding this custom protocol
which is attached like this
====
netlink_table = DissectorTable.get("genl.family")
local ret = netlink_table:add("mptcp", mptcp_proto)
=====

but once I reload the module, wireshark is unable to map the family
name "mptcp" to the id, so my dissector is never used.

What would you recommand me to work around this ? Would there be
interest in having a C/lua plugin to do the mapping (either via
netlink or by scraping genl ctrl list) ?

Best regards
Matt
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

Current thread: