Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Design Question: more than one protocol per dissector

From: Yves Geissbuehler <yves.geissbuehler@xxxxxxx>
Date: Fri, 21 Sep 2007 10:58:36 +0200
Hi all.

I face the situation where two protocols (RDMA on top of DDP) are not always truly two protocols with respect to the protocol headers. RDMA generally uses some parts to of DDP's header fields to represent RDMA messages. But for two of the RDMA messages, RDMA also adds its own header to the DDP header (see also figure).

case 1: RDMA uses the DDP header:

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   TCP | MPA | DDP | payload | MPA _PADDING | MAP_CRC  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

case 2: RDMA adds its own header:

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   TCP | MPA | DDP | RDMA | payload |  MPA _PADDING | MAP_CRC   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

I see two possibilities to implement this in wireshark:

option 1: Use one dissector for both, DDP and RDMA
Well, I just put both protocols in one dissector and dissect RDMA header on a per need basis by adding a RDMA subtree to the DDP protocol tree.

option 2: Use one dissector for each of the two protocols
Since RDMA relies in some cases on the information of the DDP header I would create a 'conversation' for the DDP traffic and attach to it the DDP header information as a data struct. In the RDMA dissector I would get the DDP conversation and retrieve the DDP information that I attached to it previously. Based on this data I would identify what kind of RDMA message it is and dissect the RDMA header if there is any.

I would like to ask, if there are any implications or potential issues regarding these two options? Would you accept both options for your wireshark repository?

Thanx
- Yves