Wireshark-dev: Re: [Wireshark-dev] Holding state between packets for an encryption protocol?

From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Sat, 4 Aug 2007 11:09:35 -0600

On Fri, Jul 27, 2007 at 09:57:06AM -0500, David Zarlengo wrote:

> I'm looking at writing my first dissector for a protocol which
> generates a session key to encrypt the remaining packets.
> 
> Where can I store this session key so that it's available for
> subsequent packets?

You can store the key using conversations.  Check out
doc/README.developer, section 2.2, for more information.

> What's a good dissector to use as an example of this class of
> protocols?

I cannot think of a simple dissector that stores a key for later use off
the top of my head, but one dissector that uses conversations to store
other data is packet-exec.c.


Steve