Riverbed Cascade Pilot Personal Edition: Take Wireshark to the Next Level - Advanced Triggers and Alerts; Web and VoIP Analytics; Long-Term Trending and Forensics; Deep Packet Analysis with Wireshark

Wireshark-dev: Re: [Wireshark-dev] Modifying port number for TFTP

Date Index Thread Index Other Months All Mailing Lists

Date Prev Date Next Thread Prev Thread Next

From: Heude Pascal <pascalheude@xxxxxxxxxxx>
Date: Tue, 02 Jun 2009 21:28:09 +0200

The main drawback of this method is that wireshark refreshes the trace window and this could take a while, depending on the trace size and on your PC power.
I had the same request than Yvan, because I have a TFTP protocol based on port 59 (for call) and 50450-50460 ports for the rest of protocol. I came to the conclusion that I have to rebuild wireshark with changing the source packet-tftp.c (define UDP_PORT_TFTP from 69 to 59). Then for the other ports, it seems that the dissector adapts itself automatically, but I need to confirm it by testing because I am not very familiar with wireshark API.

Stig Bjørlykke a écrit :

On Tue, Jun 2, 2009 at 9:49 AM,  <yvanmmailbox-web@xxxxxxxx> wrote:

I need to dissect frames that use tftp protocol but not on the standard
port. Is it possible to modify it without compiling the whole Wireshark or
re-writing a plugin with the same code (I don't want to have a
compiled-specific version of Wireshark)?

You can select the package you want to be dissected as tftp, select
Analyse -> Decode As..., select the correct source/destination port
and select TFTP from the list.

Follow-Ups:
- Re: [Wireshark-dev] Modifying port number for TFTP
  - From: Stig Bjørlykke

References:
- [Wireshark-dev] Modifying port number for TFTP
  - From: yvanmmailbox-web
- Re: [Wireshark-dev] Modifying port number for TFTP
  - From: Stig Bjørlykke

Prev by Date: Re: [Wireshark-dev] 1.2.0 trunk doesn't build ?
Next by Date: Re: [Wireshark-dev] 1.2.0 trunk doesn't build ?
Previous by thread: Re: [Wireshark-dev] Modifying port number for TFTP
Next by thread: Re: [Wireshark-dev] Modifying port number for TFTP
Index(es):
- Date
- Thread