Wireshark mailing list archives

Get follwing Packets in a protocol dissector


From: Jan-Niklas Meier <dschanoeh () googlemail com>
Date: Mon, 15 Feb 2010 08:48:52 +0100

Hi!
I am currently working on a protocol dissector for a protocol, which is
based on XML. The protocol is spoken inside a TCP stream. I am using the
libxml to parse single requests and responses. I choose libxml because i
want to check, if the XML is valid and because i need to parse the protocol
quite deep. this works very well for normal requests and responses which are
usually only one packet long (so the XML is valid and i can parse it). if
there is for example a very long request it is splitted into different
packets and the xml in the first packet is invalid (because all the closing
tags are missing). in the following packets i can't even regognize that this
is my protocol because they don't start with my header.
I searched the documentation and some other dissectors, if there is a
mechanism to request the following packets of a tcp stream from wireshark to
be able to parse the whole request. I was not able to find something on this
topic (request/response tracking is not quite what i want) so i'd like to
ask here now. I would be happy about some suggestions how i could solve this
problem or shouldn't i do something like this?

with kind regards
Jan-Niklas Meier
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

Current thread: