ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] Dissector for MATIP Type A conversational traffic.

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 16 Sep 2003 14:16:55 -0700

On Sep 15, 2003, at 9:25 PM, Jonathan_Fernandes@xxxxxxxxxxxxxxxxxxx wrote:

guint8 mpx; /* ugly, but I need mpx for two functions
               (session open, and the open_confirm() ) */

That won't work, unless the session open and open confirm are in the same frame, or if your capture has exactly one session open packet in it. Given that an open confirm is a response to a session open, they're unlikely to be in the same frame.

This means that will work *only* if you have exactly one session in your capture, or if you *always* click on the "session open" packet for a session before clicking on the corresponding "open confirm". There is no guarantee that, except on the first pass through a capture, your dissector will be called on packets in the order they are in the capture file - a user can click on packets in whatever order they want.

What you should do is:

1) in the "session open" dissector, set up a conversation for the TCP connection, and attach the pmx value to the conversation as conversation data for the MATIP protocol;

2) in the "open confirm" dissector, fetch the mpx value from the conversation, if there is a conversation. (If there isn't a conversation, or there is but there's no mpx value attached to it - those could happen if the "session open" isn't in the capture - you won't be able to dissect the ASCUs unless you assume it's 0 if it's not present).

Also, there are some typos - "Applicatation" instead of "Application", and "dependant" instead of "dependent".