Wireshark-dev: Re: [Wireshark-dev] Parallel Redundancy Protocol (PRP) dissector
From: Jeff Morriss <[email protected]>
Date: Wed, 27 Feb 2008 18:26:07 -0500
I added a preference (defaulted to FALSE) that decides if the protocol 
should be enabled or not in rev 24494.  That way it defaults to disabled 
for most people but if you really want it enabled (enough to change the 
preference) then it will stay that way until you change the preference 
again.
Jeff Morriss wrote:
Hi Sven,

Sorry this got overlooked. (That's part of the reason we recently changed to putting patches/new dissectors in the bugs database.)
Anyway I have checked in your new dissector in rev 24493 (that will not 
make 0.99.8).  In testing I did find it a bit annoying that the protocol 
disables itself each time it starts up, but until we find a Better Way 
this works without yielding a performance hit for everyone.
Would you mind adding a protocol description page to the Wiki (and put 
your sample capture on the SampleCaptures page--or would you mind if I do)?
Regards,
-Jeff

Meier Sven (msv) wrote:
Hi

Are there any further comments or wishes on that one?
If not, could someone add it to the repository? Thanks

Regards
    Sven

 ///////  |||   |||  ///|||  ///        Sven Meier
/////// ||| ||| /// ||| /// Dipl.Ing. FH Informationstechnologie
   ///          |||///  |||///          Entwicklungsingenieur IEEE 1588
/// ||/// ||/// Institute of Embedded Systems /////// ||| |/// |/// Raum / Room InES TW 220
///////   |||   ///     ///             Postfach 805
                                        CH-8401 Winterthur
                                        Switzerland
Zuercher Hochschule Winterthur Phone : +41 (0)52 267 70 58
(University of Applied Sciences)        Fax   :    +41 (0)52 268 70 58
Mitglied der Zuercher Fachhochschule    [email protected]
-----Ursprüngliche Nachricht-----
Von: [email protected] [mailto:[email protected]] Im Auftrag von Meier Sven (msv)
Gesendet: Montag, 11. Juni 2007 11:05
An: Developer support list for Wireshark
Betreff: Re: [Wireshark-dev] Parallel Redundancy Protocol (PRP) dissector ->now disabled by default
Hi

Finally I found the required function to disable the protocol by default.
So now the dissector is disabled by default, it can be enabled over the normal enable/disable protocol wizard.
Best regards
    Sven Meier

 ///////  |||   |||  ///|||  ///        Sven Meier
/////// ||| ||| /// ||| /// Dipl.Ing. FH Informationstechnologie
   ///          |||///  |||///          Entwicklungsingenieur IEEE 1588
/// ||/// ||/// Institute of Embedded Systems /////// ||| |/// |/// Raum / Room InES TW 220
///////   |||   ///     ///             Postfach 805
                                        CH-8401 Winterthur
                                        Switzerland
Zuercher Hochschule Winterthur Phone : +41 (0)52 267 70 58
(University of Applied Sciences)        Fax   :    +41 (0)52 268 70 58
Mitglied der Zuercher Fachhochschule    [email protected]
-----Ursprüngliche Nachricht-----
Von: [email protected] [mailto:[email protected]] Im Auftrag von Meier Sven (msv)
Gesendet: Freitag, 1. Juni 2007 10:27
An: Developer support list for Wireshark
Betreff: Re: [Wireshark-dev] Parallel Redundancy Protocol (PRP) dissector

The thing is, that not the "dissector_add" function but the "register_postdissector" function is the problem. So this dissector is called after all other dissectors independent of port or ethertype. And how can I change values of a dissector at runtime? The best solution would be if I could call some function, or set some value, that disables the dissector by default, but that I can enable it by hand over the enable/disable protocol wizard.
In which configuration file are my preferences (which protocols are 
enabled/disabled) stored anyway? If that file already exists at 
installation time, we could probably change the entry of the PRP 
protocol to disabled.
Best regards
    Sven Meier


 ///////  |||   |||  ///|||  ///        Sven Meier
/////// ||| ||| /// ||| /// Dipl.Ing. FH Informationstechnologie
   ///          |||///  |||///          Entwicklungsingenieur IEEE 1588
/// ||/// ||/// Institute of Embedded Systems /////// ||| |/// |/// Raum / Room InES TW 220
///////   |||   ///     ///             Postfach 805
                                        CH-8401 Winterthur
                                        Switzerland
Zuercher Hochschule Winterthur Phone : +41 (0)52 267 70 58
(University of Applied Sciences)        Fax   :    +41 (0)52 268 70 58
Mitglied der Zuercher Fachhochschule    [email protected]
-----Ursprüngliche Nachricht-----
Von: [email protected] [mailto:[email protected]] Im Auftrag von Stephen Fisher
Gesendet: Donnerstag, 31. Mai 2007 21:38
An: Developer support list for Wireshark
Betreff: Re: [Wireshark-dev] Parallel Redundancy Protocol (PRP) dissector

A common method to disable a dissector is to register it with a 0 value for the port/ethertype and have a preference where this can be changed from a value other than 0.
On Tue, May 29, 2007 at 09:51:30AM +0800, Jeff Morriss wrote:
Oops, overlooked this one.  Any idea *how*?

(I'm terribly busy these days so not much time to research it.)

Stephen Fisher wrote:
Let's disable it by default to avoid the overhead of checking every packet.
On Mon, Apr 16, 2007 at 05:53:19PM +0800, Jeff Morriss wrote:
Hi list,

What do you think--how should we go about this?

-J

Glattfelder Christoph (glc) wrote:
Hello Jeff

Unfortunately, a frame must be searched for the trailer to recognize it as PRP frame. But I see no problem to have it disabled by default.

Best regards

Christoph Glattfelder

Z??rcher Hochschule Winterthur
Institute of Embedded Systems - InES

Technikumstrasse 9
Postfach 805
CH-8401 Winterthur
Tel. +41(0)52 260 69 74

[email protected]


-----Urspr??ngliche Nachricht-----
Von: Jeff Morriss [mailto:[email protected]] Gesendet: Montag, 16. April 2007 10:26
An: Developer support list for Wireshark; Glattfelder Christoph (glc)
Betreff: Re: [Wireshark-dev] Parallel Redundancy Protocol (PRP) dissector


Meier Sven (msv) wrote:
This is a dissector for the Parallel Redundancy Protocol (PRP) defined in chapter 6 of the IEC 62439.
PRP uses two independent networks in parallel and allows 
redundancy without switchovers.
The protocol is sending Mac multicast messages with Ethertype 
0x88fb. In addition to that it adds to every Ethernet frame a 4 
byte trailer before the FCS. The trailer is detected by checking 
a size field and an identifier which are part of the trailer. 
Therefore, if the last 4 bytes of a frame match a correct trailer 
they get interpreted as a trailer, although it was probably not a 
real one.
Is there some way to know if the trailer is going to be there without searching for it? As it is, registered as a postdissector (didn't even know those existed until now), this dissector will get called for every frame--which seems a bit excessive to me.
If there's no way to know ahead of time, maybe this dissector 
should be disabled by default, though I'm not sure how to best go 
about doing that.