On Jan 27, 2021, at 3:16 AM, Björn <bjoern.peter...@missinglinkelectronics.com>
wrote:
we use a custom dissector to analyze custom protocol traffic. However, to
further increase the usability, we need to add protocol analysis specific GUI
elements. For now, we are not aware of a way to add a first level plugin which
can be called through an encapsulation type from a pcap file.
Encapsulation types in pcap and pcapng files must be one of the
already-registered types, meaning you would either have to
1) request an official type by asking tcpdump-work...@lists.tcpdump.org
or
2) using one of the LINKTYPE_USERn types mentioned in other emails.
One other point is that we are not able to load a compiled plugin to wireshark,
if we don’t build it from source. We can’t link against wireshark and cmake
will not load the project if we install wireshark from the APT packages.
Not every instance of Wireshark is from an APT package:
1) it might be Wireshark on Windows;
2) it might be Wireshark on macOS;
3) it might be Wireshark on *BSD;
4) it might be Wireshark on Solaris;
...
n) it might be Wireshark on a Linux distribution that doesn't use
Debian packages.
You could, however, have a Lua plugin, which should work on *any* platform if
the version of Wireshark being used includes the embedded Lua interpreter
(which our versions for Windows and macOS do, and which I suspect the packages
provided by Linux distributions, *BSDs, etc. do).
• We noticed that distributed packets, e.g. in Ubuntu 18.04 do not
allow for C plugins to be loaded.
[citation needed]
ubu20-04$ egrep DISTRIB_DESCRIPTION /etc/lsb-release
DISTRIB_DESCRIPTION="Ubuntu 20.04.1 LTS"
ubu20-04$ apt list wireshark
Listing... Done
wireshark/focal,now 3.2.3-1 amd64 [installed,automatic]
ubu20-04$ which tshark
/bin/tshark
ubu20-04$ tshark -G plugins
ethercat.so 0.1.0 dissector
/usr/lib/x86_64-linux-gnu/wireshark/plugins/3.2/epan/ethercat.so
gryphon.so 0.0.4 dissector
/usr/lib/x86_64-linux-gnu/wireshark/plugins/3.2/epan/gryphon.so
irda.so 0.0.6 dissector
/usr/lib/x86_64-linux-gnu/wireshark/plugins/3.2/epan/irda.so
...
It appears to be loading the plugins we ship with Wireshark....
Our goal is creating an open source tool to analyze communication within SoCs,
e.g. SoC FPGAs by providing both insight into protocol structure as well as bit
and timing accurate analysis at the same time with cross-references.
2) will not be the best way to do that, because you don't have exclusive use of
any of the USERn types - somebody else might use the same type, meaning users
will have to configure their Wireshark to use yours or theirs.
You may think about this like an analyzer for video data transport protocols,
which provides the ability to cross-reference actual pixels within the frames
to the protocol entities that has contained them by showing the picture and
enables clicking through the pixels / areas of the frames and the frames within
the timeline of the video. When you click on an images pixel/area, the
respective protocol unit containing the pixel is highlighted and vice versa.
This allows for much better interpretation than going through the payload view
or the image separately.
That requires more than a dissector, it requires a tap, with the GUI to display
the video frame being able to look up the packet number in the packet list for
the packet containing that pixel, and telling the Wireshark GUI to display that
packet.
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
