Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] how do you get SDP dissector info to use itwith a new dissec

From: "Anders Broman" <anders.broman@xxxxxxxxxxxx>
Date: Tue, 22 Apr 2008 17:48:32 +0200
Hi,
Just to add to what Luis said:
The SDP dissector hands information to the RTP dissector for the
conversation in question if your payload dissector
Needs any of this info or additional info you first have to add it to
this information to the SDP data structure then the RTP dissector
Should hand it to your payload dissector which should be called from the
RTP dissector or possibly the payload
Dissector could pick it up from the conversation if the info is stored
in the conversation dissector data by the SDP or RTP dissector.

Probably this is the function you want to look at 
void srtp_add_address().
Regards
Anders

-----Original Message-----
From: wireshark-dev-bounces@xxxxxxxxxxxxx
[mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Luis EG
Ontanon
Sent: den 22 april 2008 15:25
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] how do you get SDP dissector info to use
itwith a new dissector?

I do not understand what you want to do.

If all you want is to get RTP's media dissected just invoking the sdp
dissector to dissect the sdp buffer might be enough. SDP will take care
of "registering" the RTP converstations definded in it so that related
media packets are passed to RTP and that RTP calls the propper dissector
for the payload.

You can take a look on how packet-rtsp.c or packet-sip.c hand over to
sdp and how amr or iuup register themselves to be usable as dynamic RTP
payload.

Hope this helps


On Tue, Apr 22, 2008 at 3:11 PM,  <david.castleford@xxxxxxxxxxxxxxxxxx>
wrote:
>
>
> Hi everyone,
>
> I've been working on a new dissector that I'll hopefully be able to 
> contribute.
>
> So far I've used the protocol preferences menu to allow me to "setup"
> parameters that are usually found in an SDP file or via SDP/SAP or via

> SDP/RTSP.
>
> This can be quite tedious as I'm switching between different RTP 
> streams, each having potentially different setup parameters.
>
> Hence I would like to try and reuse the already dissected SDP 
> parameters (if
> found) and use those automatically i.e.
>
> If  SDP -> Media Format (sdp.media.format)  = certain value,
>
> then
>     Search    SDP -> Media format specific parameters
(sdp.fmtp.parameter)
>             If found "setup" parameter, "store" the value for that 
> setup parameter and associate it with the associated sdp.media.format
type
>     End search
> End SDP search
>
> As I expect the SDP information to contain declarations for multiple 
> RTP streams with different dynamic payload types, each having setup 
> parameters for my dissector, what is the best approach I can take?
>
> How do I search for any relevant SDP info?
>
> I've tried to find relevant examples but haven't exactly succeeded and

> would appreciate a pointer. Wireshark seems extremely powerful but 
> it's rather daunting to a beginner.
> I came across tapping, but I'm not sure whether I need to get info 
> from the SDP tap, or whether I need to create a tap for my 
> dissector....or even tap at all?!
>
> As for using those parameters:
>
> Should I define a structure containing all the relevant setup 
> parameters, define a table containing pointers to that structure, and 
> populate it accordingly for each relevant stream i.e. RTP payload type

> in SDP having my setup parameters?
>
> The idea would then be to search this table for a matching RTP payload

> type so that my dissector can use the correct setup parameters, 
> extracted automatically from SDP, rather than using the potentially 
> incorrect setup parameters defined in my preferences.
>
> Thanks for your help,
>
> David
>
>
>
> _______________________________________________
>  Wireshark-dev mailing list
>  Wireshark-dev@xxxxxxxxxxxxx
>  http://www.wireshark.org/mailman/listinfo/wireshark-dev
>
>



--
This information is top security. When you have read it, destroy
yourself.
-- Marshall McLuhan
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev