Wireshark · Ethereal-dev: Re: [Ethereal-dev] Ethereal Plugin for decrypting Code.

["Guy Harris" <gharris@xxxxxxxxx>]

Royce Fessenden wrote:
> I need to write a plug in that will take the data from a TCP packet where
> the flags are 0x0018 (PSH, ACK)  and decrypt it.

Did you mean to say "I need to write a plugin to dissect a protocol that
runs atop TCP and contains encrypted data"?

If so, then you first need to arrange that the dissector be called when
the TCP traffic is traffic for your protocol.  If your protocol uses a
standard port number, you could use that; if it doesn't, you could either
give your dissector a preference to specify the port number of numbers to
use, or, *IF* the protocol data can be examined to determine whether it
looks like it's for your protocol or not (which, if it's encrypted, is
probably not the case) make the dissector a heuristic dissector.


_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev