Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] How to handle TCP protocols that have don't includestate in

From: "Saad Nader" <snader@xxxxxxxxxxx>
Date: Wed, 9 Sep 2009 10:17:35 -0700

Does anyone have any ideas on this? See problem description below.

 

 

Thanks,

------------------

Saad Nader

Middlware Engineer

Powered By Gamespy

 

From: wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Saad Nader
Sent: Wednesday, September 02, 2009 3:42 PM
To: wireshark-dev@xxxxxxxxxxxxx
Subject: [Wireshark-dev] How to handle TCP protocols that have don't includestate in the message

 

Hello,


I’m trying to create a dissector plug-in for my protocol and would like to know how I can handle the following situation:

 

I have a protocol that has very little if not any state information in each message that I send or receive as a client.  There is also encryption going on from one direction (e.g. server -> client).  I have trouble when I’m keep state in a conversation since the encryption algorithm relies on the previous packet that was sent.  So anytime I click on a packet from the UI and it fires my dissector, my packets get re-decrypted.  I’d like to traverse backwards and not have to worry about such issues. 


I would also like to know how I can get TCP sequence numbers for a given packet.

 

Thanks,

------------------

Saad Nader