ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] nested dissector

From: "Filippo Margiotta" <filippo.margiotta@xxxxxxxxx>
Date: Tue, 18 Mar 2008 13:20:29 +0100
I can reproduce the case that is creating the problem I have.
When I open my captured test file and I navigate in the various packet using the keyboard, it is workig.
When I click with the mouse in one of the packet Wireshark crashes.

Somebody has a clue?




2008/3/18, Filippo Margiotta <filippo.margiotta@xxxxxxxxx>:
Hi Abhik,
thank you for the useful suggestion, it is exactly what i was looking for.

I have another BIG problem.
Wireshark is crashing when the MIKEY dissector is called from the plugin, maybe because the MIKEY dissector (after the dissecting) is trying to release all the tvbuff, but this free(tvbuff) makes Wireshark crashing because probably this tvbuff was allocated in the plugin dll.

Is it correct my opinion?
There is a way to avoid this?


Thanks,
Filippo.

2008/3/18, Abhik Sarkar <sarkar.abhik@xxxxxxxxx>:
If I understand you correctly, Filippo, I think you want to know how
you can find out from within your plug-in if the "mikey" dissector was
called (and did its work). I think one of the ways would be to use
pinfo->layer_names (which corresponds to frame.protocols). If you can
find the string "mikey" in this field after the protocol has been
called and has done its work, I think it will work.

Perhaps there is a cleaner way of finding out but I hope this helps.

Best regards,

Abhik.


On Mon, Mar 17, 2008 at 11:35 PM, Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:
> Hi,
>
>  Ehm, I don't follow. Either you call the dissector or you don't. You'll see
>  the mikey dissectors output in the packet detail pane.
>
>  Thanx,
>  Jaap
>
>  Filippo Margiotta wrote:
>  > Hi Jaap,
>  > your information were very useful form me. Thank you.
>  >
>  > I would ask you another question.
>  > I used as your suggestion the function
>  > call_dissector(mikey_handle, sub_tvb, ppinfo, tree)
>  > from the plugin.
>  >
>  > How can I understand if the the dissect_mikey is called by the plugin or
>  > not.
>  > Depending on that I should do different thinks.
>  >
>  > Thanks,
>  > FIlippo
>  >
>  >
>  >
>  > 2008/3/16, Jaap Keuter <jaap.keuter@xxxxxxxxx
>  > <mailto:jaap.keuter@xxxxxxxxx>>:
>  >
>  >     Hi,
>  >
>  >     You could use find_dissector("mikey") to get a handle on it and call
>  >     it with a
>  >     tvb subset containing the payload for mikey.
>  >     Many examples like this in the Wireshark dissectors source tree.
>  >
>  >     Thanx,
>  >     Jaap
>  >
>  >
>  >
>  >     Filippo Margiotta wrote:
>  >      > Hi All,
>  >      > the company I am working has a propietary plugin to dissect a
>  >     specific
>  >      > protocol (let's call XXX). I should add a dissector for the
>  >     data_payload
>  >      > field in the XXX to be decoded by the MIKEY dissector.
>  >      >
>  >      > Somebody could help me on this please?
>  >      >
>  >      > Thanks,
>  >      > Filippo
>  >      >
>  >
>
>  _______________________________________________
>  Wireshark-dev mailing list
>  Wireshark-dev@xxxxxxxxxxxxx
>  http://www.wireshark.org/mailman/listinfo/wireshark-dev
>
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev