ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Getting ACK/SEQ numbers in a dissector

From: "Greg Sinclair" <gssincla@xxxxxxxxxxxxxxx>
Date: Sun, 23 Mar 2008 16:24:23 -0500
I'm trying to write my first dissector and I'm having troubles... lots
of troubles. 

The protocol I'm trying to work with does some simple encryption.
Basically it takes the position in the data stream and XORs it with the
cleartext data. So the decryption is very straightforward.. just take
the byte position, xor it with the payload, and ta-da.

To do this, I need to keep track of the position of each byte in the TCP
payload. The simplest way to do this that came to mind was to take the
sequence number from the TCP header, subtract one to make it zero based
and use this value as the base while looping through the rest of my
payload. so the code would look something like...

	len = tvb_length_remaining(tvb, 0);
	decodeByte = <sequence number...> 
	index = 0;

	while(index < len)
		buffer[index] = payload[index] ^ (unsigned
char)(decodeByte++);

Its the <sequence number..> part I need help filling in. Can someone
help me figure out how to do this in a regular dissector function? And
to make matters worse, I'd need the relative sequence number instead of
the absolute sequence number.

Any help would be greatly, greatly appreciated!

thanks.

greg.