ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] How to handle TCP protocols that have don't include state in the

From: "Saad Nader" <snader@xxxxxxxxxxx>
Date: Wed, 2 Sep 2009 15:41:33 -0700

Hello,


I’m trying to create a dissector plug-in for my protocol and would like to know how I can handle the following situation:

 

I have a protocol that has very little if not any state information in each message that I send or receive as a client.  There is also encryption going on from one direction (e.g. server -> client).  I have trouble when I’m keep state in a conversation since the encryption algorithm relies on the previous packet that was sent.  So anytime I click on a packet from the UI and it fires my dissector, my packets get re-decrypted.  I’d like to traverse backwards and not have to worry about such issues. 


I would also like to know how I can get TCP sequence numbers for a given packet.

 

Thanks,

------------------

Saad Nader