Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] nested dissector

From: "Abhik Sarkar" <sarkar.abhik@xxxxxxxxx>
Date: Tue, 18 Mar 2008 19:40:15 +0400
Sorry, don't know enough to help you. I doubt a dissector would try to
free a tvbuff, so maybe it is something else.

I did have a similar issue sometime back and but it was because I was
writing past allocated memory. You might want to use some kind of
debugger and attach it to the running wireshark and see if you can get
some information about what is causing the crash. You might find some
useful hints at:
http://wiki.wireshark.org/Development/Tips

I know this is not much help, but this is all the help I can offer.

Best regards,
Abhik.

On Tue, Mar 18, 2008 at 2:34 PM, Filippo Margiotta
<filippo.margiotta@xxxxxxxxx> wrote:
> Hi Abhik,
> thank you for the useful suggestion, it is exactly what i was looking for.
>
> I have another BIG problem.
> Wireshark is crashing when the MIKEY dissector is called from the plugin,
> maybe because the MIKEY dissector (after the dissecting) is trying to
> release all the tvbuff, but this free(tvbuff) makes Wireshark crashing
> because probably this tvbuff was allocated in the plugin dll.
>
> Is it correct my opinion?
> There is a way to avoid this?
>
>
> Thanks,
> Filippo.
>
> 2008/3/18, Abhik Sarkar <sarkar.abhik@xxxxxxxxx>:
>
> > If I understand you correctly, Filippo, I think you want to know how
> > you can find out from within your plug-in if the "mikey" dissector was
> > called (and did its work). I think one of the ways would be to use
> > pinfo->layer_names (which corresponds to frame.protocols). If you can
> > find the string "mikey" in this field after the protocol has been
> > called and has done its work, I think it will work.
> >
> > Perhaps there is a cleaner way of finding out but I hope this helps.
> >
> > Best regards,
> >
> > Abhik.
> >
> >
> > On Mon, Mar 17, 2008 at 11:35 PM, Jaap Keuter <jaap.keuter@xxxxxxxxx>
> wrote:
> > > Hi,
> > >
> > >  Ehm, I don't follow. Either you call the dissector or you don't. You'll
> see
> > >  the mikey dissectors output in the packet detail pane.
> > >
> > >  Thanx,
> > >  Jaap
> > >
> > >  Filippo Margiotta wrote:
> > >  > Hi Jaap,
> > >  > your information were very useful form me. Thank you.
> > >  >
> > >  > I would ask you another question.
> > >  > I used as your suggestion the function
> > >  > call_dissector(mikey_handle, sub_tvb, ppinfo, tree)
> > >  > from the plugin.
> > >  >
> > >  > How can I understand if the the dissect_mikey is called by the plugin
> or
> > >  > not.
> > >  > Depending on that I should do different thinks.
> > >  >
> > >  > Thanks,
> > >  > FIlippo
> > >  >
> > >  >
> > >  >
> > >  > 2008/3/16, Jaap Keuter <jaap.keuter@xxxxxxxxx
> > >  > <mailto:jaap.keuter@xxxxxxxxx>>:
> > >  >
> > >  >     Hi,
> > >  >
> > >  >     You could use find_dissector("mikey") to get a handle on it and
> call
> > >  >     it with a
> > >  >     tvb subset containing the payload for mikey.
> > >  >     Many examples like this in the Wireshark dissectors source tree.
> > >  >
> > >  >     Thanx,
> > >  >     Jaap
> > >  >
> > >  >
> > >  >
> > >  >     Filippo Margiotta wrote:
> > >  >      > Hi All,
> > >  >      > the company I am working has a propietary plugin to dissect a
> > >  >     specific
> > >  >      > protocol (let's call XXX). I should add a dissector for the
> > >  >     data_payload
> > >  >      > field in the XXX to be decoded by the MIKEY dissector.
> > >  >      >
> > >  >      > Somebody could help me on this please?
> > >  >      >
> > >  >      > Thanks,
> > >  >      > Filippo
> > >  >      >
> > >  >
> > >
> > >  _______________________________________________
> > >  Wireshark-dev mailing list
> > >  Wireshark-dev@xxxxxxxxxxxxx
> > >  http://www.wireshark.org/mailman/listinfo/wireshark-dev
> > >
> > _______________________________________________
> > Wireshark-dev mailing list
> > Wireshark-dev@xxxxxxxxxxxxx
> > http://www.wireshark.org/mailman/listinfo/wireshark-dev
> >
>
>
> _______________________________________________
>  Wireshark-dev mailing list
>  Wireshark-dev@xxxxxxxxxxxxx
>  http://www.wireshark.org/mailman/listinfo/wireshark-dev
>
>