ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] TNS data dissector

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Fri, 18 May 2012 10:13:57 -0400
Andrej van der Zee wrote:
http://anonsvn.wireshark.org/wireshark/trunk/epan/dissectors/packet-tns.c  ?
As far as I can see in Wireshark, it does not dissect the data inside
a TNS packet, it shows it as binary. For example, I would like to be
able to see the SQL queries going over the wire.

So i guess it is impossible to look inside the data in a TNS packet and we cannot see the actual SQL queries inside the data? Is there a specific reason why it doesnt dissect the data?

A quick read about TNS:

https://en.wikipedia.org/wiki/Transparent_Network_Substrate

seems to indicate that it's basically a tunneling protocol. So to decode the payload Wireshark would need to know what the contents are. Does the protocol have some indication of its payload? If not, maybe a TNS preference or maybe heuristics could be used to determine the payload. (If the payload is usually the same that could be a start or the default preference value.)

This kind of thing can be implemented but we'd need sample capture(s) of different kinds of things being transported over TNS (of course with a description of what those things are) all logged in an bug report.

As for the reason Wireshark doesn't currently do it, it's probably the usual reason: no one's gotten around to it or felt the need.