https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6467
Summary: Add Binary JSON (BSON) decoding support to Mongo
packet dissector
Product: Wireshark
Version: SVN
Platform: All
OS/Version: All
Status: NEW
Severity: Enhancement
Priority: Low
Component: Wireshark
AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
ReportedBy: tom@xxxxxxxxxxxxxxxxxx
Created an attachment (id=7261)
--> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=7261)
Sample packet capture
Build Information:
wireshark 1.7.0 (SVN Rev 39443 from /trunk)
Copyright 1998-2011 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GTK+ 2.22.0, with Cairo 1.10.0, with Pango 1.28.2, with
GLib 2.26.1, with libpcap 1.1.1, with libz 1.2.3.4, without POSIX capabilities,
with threads support, without SMI, without c-ares, without ADNS, with Lua 5.1,
with Python 2.6.6, without GnuTLS, without Gcrypt, with MIT Kerberos, without
GeoIP, without PortAudio, without AirPcap.
Running on Linux 2.6.35-30-generic, with locale en_US.utf8, with libpcap
version
1.1.1, with libz 1.2.3.4.
Built using gcc 4.4.5.
--
This patch attempts to address the TODO in epan/dissectors/packet-mongo.c:
Implement BSON spec to correctly see BSON document type and not in Bytes
format...
The specification for BSON can be found at http://bsonspec.org/
The decoding is not entirely complete, there are still potential enhancements
to provide more information about a couple of data types, but it greatly
enhances visibility into these packet types for me.
This is my first effort working with the Wireshark codebase, so comments are
greatly appreciated.
Patch built and fuzzed on 64bit Linux (Ubuntu 10.10).
The sample packet capture is traffic generated by the OWASP Hatkit Proxy tool
communicating with a local MongoDB installation.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
