Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] A question related to conversations

From: Richard Achmatowicz <rachmato@xxxxxxxxxx>
Date: Tue, 15 Jul 2008 11:06:58 -0400
Hello

I've created a basic dissector for the JGroups group communication protocol which can dissect JGroups PDU when running atop TCP or UDP. At present, the dissection is based on specifying a port number (either udp port or tcp port, depending on the transport used) in the preferences section, in order to indicate to wireshark which packets it captures should have the JGroups PDU dissector applied. However, this results in PDUs in only one direction of a two process interaction to be dissected.

I'm trying to achieve two things at present:
(i) as a first step, have both directions of a two process interaction dissected (ii) as a second step, within the larger context of a two process interaction, where we can view the interaction as consisting of a sequence of known, prototcol specific phases (e.g in the case of JGroups, discover peers, join group, exchange data with group members, leave group), I want to be able to have wireshark identify and mark those phases, say, with colours
I'll limit my question to the first part, as it is my immediate problem.

Are conversations the principal way of achieving (i) - namely, getting two sides of an interaction to be dissected, as opposed to one specified by a single port number? Is there any special coding of the conversation logic required in order to get this effect? For example, in a JGroups capture session, there may be several addr1/port1 addr2/port2 combinations which are interacting, and i'd like each side of these exchanges to be dissected. Do I just need to try and find a conversation for each packet I encounter, and if it doesn't belong to one, then create one?

Thanks in advance

Richard