Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] GIOP dissector reply decode

From: Andy Ling <Andy.Ling@xxxxxxxxx>
Date: Mon, 2 Nov 2015 17:28:44 +0000

I have made some changes to packet-giop.c that appear to work, but I don’t quite understand why.

 

What I have done is added two new members to struct comp_req_list_entry..

 

  address            src;       /* source address */

  guint32            srcport;   /* source port */

 

These I set by extending insert_in_comp_req_list

 

Then in get_mfn_from_fn_and_reqid I have extended the test

 

    if (entry_ptr->reqid == reqid && cmp_address (&entry_ptr->src, addr) == 0 && entry_ptr->srcport == pnum) {    /* similar reqid  */

      return entry_ptr->fn;     /* return MFN */

 

The bit I don’t understand is, to make this work the calls to insert_in_comp_req_list require pinfo->src and pinfo->srcport and the call to get_mfn_from_fn_and_reqid requires pinfo->src, pinfo->destport. This seems wrong I would have thought the get call would require the destination address, not the source.

 

The initial request stores the source IP & port. So I would have thought the reply would have a destination IP & port to match, but it seems I have to use the source IP and destination port.

 

Any idea what is going on?

 

Thanks for any help

 

Andy Ling

 

 

 




This email has been scanned for email related threats and delivered safely by Mimecast.
For more information please visit http://www.mimecast.com