Skip to content

GitLab

Commit 8a477c84 authored by Andreas Schmidt's avatar Andreas Schmidt
Browse files

Add wireshark dissector code.

parent 3bc2234b
Pipeline #1907 failed with stages
in 1 minute and 19 seconds
Expand all Hide whitespace changes
Inline Side-by-side
dissect/README.md 0 → 100644
View file @ 8a477c84
PRRT Dissector for Wireshark
============================
Installation
------------
* Download Wireshark Source Code: https://www.wireshark.org/
apt-get install qt-sdk libgtk-3-dev libpcap-dev
tar xvjf wireshark-1.10.2.tar.bz2
./configure
* Copy `packet-prrt.c` to `epan/dissectors`.
* Add a line `packet-prrt.c \` in `DISSECTOR_SRC` of `epan/dissectors/Makefile.common`.
* Call make in the root folder. You can now start wireshark using `./wireshark`.
dissect/legacy_install.txt 0 → 100644
View file @ 8a477c84
This tutorial will show you how to apply the dissector of PRRT in your wireshark.
What our PRRT dissector can do?
Our PRRT dissector can dissector the following PRRT packets: data, repeated data, redundancy, pre-sent redundancy, feedback and channel feedback. By now it can basically display the header info of PRRT packets. The sophistical display and advanced features will be supported later.
How to use it?
To use this dissector in the wireshark basically you need to perform the following steps:
0. Download the source code of wireshark and extract it.
1. Copy our dissector code (packet-prrt.c) to the directory epan/dissectors/ of the source code.
2. Add a line "packet-prrt.c \" in DISSECTOR_SRC of epan/dissectors/Makefile.common, so that we can compile our dissector code.
3. This step is optional and for advanced usage.
If you want our dissector to call subdissectors for some purposes (e.g. using mp2t to parse the payload as MPEG TS.), you need to register the subdissector by adding the following _pattern_ line in the handoff function of the subdissector:
heur_dissector_add("prrt", heuristic_dissect_method, protocol_id);
e.g. add the line in the function proto_reg_handoff_mp2t() of packet-mp2t.c for parsing PRRT payload as MPEG TS.
heur_dissector_add("prrt", heur_dissect_mp2t, proto_mp2t);
NOTE : The subdissector called by PRRT dissector at the moment must support heuristic dissecting.
NOTE : By now we provide two dissector files respectively for two wireshark versions (1.4.6 and 1.6.1), because different version of wireshark provides different methods used in the dissector code. Even the dissector code for the version 1.4.6 is compatible with wireshark 1.6.1, we still recommand you use the dissector code for the version 1.6.1 and wireshark 1.6.1, since the later version of wireshark would not support the old method any more.
The following is fully commands under a specific scenario (see the prerequisite), you may follow, to install wireshark and apply our dissector code. For installation you can choose 1.a or 1.b depending on the version of wireshark you prefer to.
0. Prerequisite :
+ Linux OS : ubuntu 10.04 or later.
+ wireshark 1.4.6 or wireshark 1.6.1.
+ libgtk2.0-dev, bison, automake1.9 and libpcap. (Maybe more dependencies required.)
1.a Installation (wireshark 1.4.6)
sudo apt-get source wireshark-dev
sudo chown -R your_account:your_account wireshark-1.4.6/
mkdir wireshark-installed
svn co https://projects.nt.uni-saarland.de/svn/prrt-dissector
cp prrt-dissector/wireshark-1.4.6/packet-prrt.c wireshark-1.4.6/epan/dissectors/
cd wireshark-1.4.6
./configure --prefix=$PWD/../wireshark-installed/
make -j 2
make install
2.b Installation (wireshark 1.6.1)
download wireshark 1.6.1 from the www.wireshark.org
tar -xjvf wireshark-1.6.1.tar.bz2
mkdir wireshark-installed
svn co https://projects.nt.uni-saarland.de/svn/prrt-dissector
cp prrt-dissector/wireshark-1.6.1/packet-prrt.c wireshark-1.6.1/epan/dissectors/
cd wireshark-1.6.1
./configure --prefix=$PWD/../wireshark-installed/
make -j 2
make install
3. Running the wireshark
sudo ../wireshark-installed/bin/wireshark
dissect/wireshark-1.4.6/packet-prrt.c 0 → 100644
View file @ 8a477c84
This diff is collapsed.
dissect/wireshark-1.6.1/packet-mp2t.c 0 → 100644
View file @ 8a477c84
This diff is collapsed.
dissect/wireshark-1.6.1/packet-prrt.c 0 → 100644
View file @ 8a477c84
This diff is collapsed.
dissect/wireshark-2.0.0/packet-prrt.c 0 → 100644
View file @ 8a477c84
/* packet-prrt.c
* Routines for PRRT packet disassembly
*
* Decoding PRRT packets.
*
* Andreas Schmidt <schmidt@nt.uni-saarland.de>
*
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#include "config.h"
#include <glib.h>
#include <epan/packet.h>
#include <epan/prefs.h>
#define MINIMAL_PACKET_SIZE 8
void proto_register_prrt(void);
void proto_reg_handoff_prrt(void);
static int proto_prrt = -1;
static gint ett_prrt = -1;
static dissector_handle_t data_handle = NULL;
static const value_string packet_type_names[] = {
{ 0, "Data" },
{ 1, "Repeated Data" },
{ 2, "Redundancy" },
{ 3, "Feedback" },
{ 4, "Pre-sent Redundancy" },
{ 5, "Channel Feedback" }
};
/* General Header */
static int hf_prrt_packet_type = -1;
static int hf_prrt_priority = -1;
static int hf_prrt_index = -1;
static int hf_prrt_seqnum = -1;
/* Data Header */
static int hf_prrt_timestamp = -1;
static int hf_prrt_group_rtt = -1;
static int hf_prrt_packet_timeout = -1;
static int hf_prrt_decoding_timeout = -1;
static int hf_prrt_feedback_timeout = -1;
/* Redundancy Header */
static int hf_prrt_sn_base = -1;
static int hf_prrt_n = -1;
static int hf_prrt_k = -1;
/* Feedback Header */
static int hf_prrt_receiver_addr = -1;
static int hf_prrt_rtt = -1;
static int hf_prrt_ftt = -1;
static int hf_prrt_erasure_count = -1;
static int hf_prrt_packet_count = -1;
static int hf_prrt_gap = -1;
static int hf_prrt_ngap = -1;
static int hf_prrt_burst = -1;
static int hf_prrt_nburst = -1;
static int hf_prrt_bw_est = -1;
static int hf_prrt_buf_fb = -1;
/* Payload */
static int hf_prrt_payload = -1; /* payload with arbitrary length, depending on the support of UDP. */
/* Preferences */
static guint gPORT_PREF = 5004;
static void dissect_prrt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
tvbuff_t* new_tvb = 0;
int offset = 0;
guint len = 0;
guint8 packet_type = -1;
proto_item *ti;
proto_tree *prrt_tree;
packet_type = tvb_get_guint8(tvb, 0) >> 4;
len = tvb_captured_length(tvb);
/* Plausibility check */
if (len < MINIMAL_PACKET_SIZE) {
return;
}
else if (packet_type == 0) {
if(len < 16)
return;
}
else if (packet_type == 1) {
if (len < 16)
return;
}
else if (packet_type == 2) {
if (len < 8)
return;
}
else if (packet_type == 3) {
if(len < 36)
return;
}
else if (packet_type == 4) {
if (len < 8)
return;
}
else if (packet_type == 5) {
if(len < 36)
return;
}
else {
return; /* Unknown packet type, the packet doesn't belong to PRRT. */
}
col_set_str(pinfo->cinfo, COL_PROTOCOL, "PRRT");
col_clear(pinfo->cinfo, COL_INFO);
if (tree) {
ti = proto_tree_add_item(tree, proto_prrt, tvb, offset, -1, ENC_NA);
prrt_tree = proto_item_add_subtree(ti, ett_prrt);
/* Parsing the general header */
proto_tree_add_item(prrt_tree, hf_prrt_packet_type, tvb, offset, 1, FALSE);
proto_tree_add_item(prrt_tree, hf_prrt_priority, tvb, offset, 1, FALSE);
offset += 1;
proto_tree_add_item(prrt_tree, hf_prrt_index, tvb, offset, 1, FALSE);
offset += 1;
proto_tree_add_item(prrt_tree, hf_prrt_seqnum, tvb, offset, 2, FALSE);
offset += 2;
if(packet_type == 0) {
col_set_str(pinfo->cinfo, COL_INFO, "Data");
proto_tree_add_item(prrt_tree, hf_prrt_timestamp, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(prrt_tree, hf_prrt_group_rtt, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(prrt_tree, hf_prrt_packet_timeout, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(prrt_tree, hf_prrt_decoding_timeout, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(prrt_tree, hf_prrt_feedback_timeout, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(prrt_tree, hf_prrt_payload, tvb, offset, len - offset, FALSE);
new_tvb = tvb_new_subset(tvb, offset, len-offset, len-offset);
if(len - offset > 0) {
call_dissector(data_handle, new_tvb, pinfo, tree);
}
} else if(packet_type == 1) {
col_set_str(pinfo->cinfo, COL_INFO, "Repeated Data");
proto_tree_add_item(prrt_tree, hf_prrt_timestamp, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(prrt_tree, hf_prrt_group_rtt, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_packet_timeout, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_decoding_timeout, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_feedback_timeout, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_payload, tvb, offset, len - offset, FALSE);
new_tvb = tvb_new_subset(tvb, offset, len-offset, len-offset);
if(len - offset > 0) {
call_dissector(data_handle, new_tvb, pinfo, tree);
}
} else if(packet_type == 2) {
col_set_str(pinfo->cinfo, COL_INFO, "Redundancy");
proto_tree_add_item(prrt_tree, hf_prrt_sn_base, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_n, tvb, offset, 1, FALSE);
offset += 1;
proto_tree_add_item(prrt_tree, hf_prrt_k, tvb, offset, 1, FALSE);
} else if(packet_type == 3) {
col_set_str(pinfo->cinfo, COL_INFO, "Feedback");
proto_tree_add_item(prrt_tree, hf_prrt_receiver_addr, tvb, offset, 4, ENC_BIG_ENDIAN);
offset += 4;
proto_tree_add_item(prrt_tree, hf_prrt_rtt, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(prrt_tree, hf_prrt_ftt, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(prrt_tree, hf_prrt_erasure_count, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_packet_count, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_gap, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_ngap, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_burst, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_nburst, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_bw_est, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(prrt_tree, hf_prrt_buf_fb, tvb, offset, 4, FALSE);
} else if(packet_type == 4) {
col_set_str(pinfo->cinfo, COL_INFO, "Pre-sent Redundancy");
proto_tree_add_item(prrt_tree, hf_prrt_sn_base, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_n, tvb, offset, 1, FALSE);
offset += 1;
proto_tree_add_item(prrt_tree, hf_prrt_k, tvb, offset, 1, FALSE);
} else if(packet_type == 5) {
col_set_str(pinfo->cinfo, COL_INFO, "Channel Feedback");
proto_tree_add_item(prrt_tree, hf_prrt_receiver_addr, tvb, offset, 4, ENC_BIG_ENDIAN);
offset += 4;
proto_tree_add_item(prrt_tree, hf_prrt_rtt, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(prrt_tree, hf_prrt_ftt, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(prrt_tree, hf_prrt_erasure_count, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_packet_count, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_gap, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_ngap, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_burst, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_nburst, tvb, offset, 2, FALSE);
offset += 2;
proto_tree_add_item(prrt_tree, hf_prrt_bw_est, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(prrt_tree, hf_prrt_buf_fb, tvb, offset, 4, FALSE);
} else {
return;
}
}
} /* dissect_prrt */
void proto_register_prrt(void)
{
module_t * prrt_module;
static hf_register_info hf[] = {
{ &hf_prrt_packet_type,
{ "Packet Type", "prrt.base.packettype", FT_UINT8, BASE_DEC, VALS(packet_type_names), 0xF0, "Packet type field in PRRT general header", HFILL }},
{ &hf_prrt_priority,
{ "Packet Priority", "prrt.base.packetpriority", FT_UINT8, BASE_DEC, NULL, 0x0F, "Packet priority field in PRRT general header", HFILL }},
{ &hf_prrt_index,
{ "Packet Index","prrt.base.packetindex", FT_UINT16, BASE_DEC, NULL, 0x0, "Packet index field in PRRT general header", HFILL }},
{ &hf_prrt_seqnum,
{ "Packet Sequence Number","prrt.base.packetseqnum", FT_UINT16, BASE_DEC, NULL, 0x0, "Packet sequence number field in PRRT general header", HFILL }},
{ &hf_prrt_timestamp,
{ "Packet Timestamp (us)", "prrt.data.timestamp", FT_UINT32, BASE_DEC, NULL, 0x0, "(Allocated) Timestamp (us) of the packet in PRRT data header", HFILL }},
{ &hf_prrt_group_rtt,
{ "Group RTT (us)", "prrt.data.grouprtt", FT_UINT32, BASE_DEC, NULL, 0x0, "Group RTT (us) in PRRT data header", HFILL }},
{ &hf_prrt_packet_timeout,
{ "Packet Timeout (us)", "prrt.data.packtimeout", FT_UINT32, BASE_DEC, NULL, 0x0, "Timeout (us) of the packet in PRRT data header", HFILL }},
{ &hf_prrt_decoding_timeout,
{ "Decoding Timeout (us)", "prrt.data.dectimeout", FT_UINT32, BASE_DEC, NULL, 0x0, "Timeout (us) of the decoding in PRRT data header", HFILL }},
{ &hf_prrt_feedback_timeout,
{ "Feedback Timeout (us)", "prrt.data.fbtimeout", FT_UINT32, BASE_DEC, NULL, 0x0, "Timeout (us) of the receiver feedback for this packet in PRRT data header", HFILL }},
{ &hf_prrt_sn_base,
{ "Based Serial Number", "prrt.redundancy.snbase", FT_UINT16, BASE_DEC, NULL, 0x0, "The number of first data packet in block, stored in PRRT redundancy data header", HFILL }},
{ &hf_prrt_n,
{ "Code Length (n)", "prrt.redundancy.n", FT_UINT8, BASE_DEC, NULL, 0x0, "The overall number of packets in the block, stored in PRRT redundancy data header", HFILL }},
{ &hf_prrt_k,
{ "Information Length (k)", "prrt.redundancy.k", FT_UINT8, BASE_DEC, NULL, 0x0, "The number of information packets in the block, stored in PRRT redundancy data header", HFILL }},
{ &hf_prrt_receiver_addr,
{ "Receiver IP", "prrt.feedback.ipaddr", FT_IPv4, BASE_NONE, NULL, 0x0, "The IP address of the receiver, stored in general PRRT feedback header", HFILL }},
{ &hf_prrt_rtt,
{ "RTT", "prrt.feedback.rtt", FT_UINT32, BASE_DEC, NULL, 0x0, "The timestamp of most recent data packet plus delay since reception of this packet, stored in general PRRT feedback header", HFILL }},
{ &hf_prrt_ftt,
{ "FTT", "prrt.feedback.ftt", FT_UINT32, BASE_DEC, NULL, 0x0, "The forward trip time", HFILL }},
{ &hf_prrt_erasure_count,
{ "Erasure Count", "prrt.feedback.erasureCount", FT_UINT16, BASE_DEC, NULL, 0x0, "The erasure count measured at the receiver, stored in general PRRT feedback header", HFILL }},
{ &hf_prrt_packet_count,
{ "Packet Count", "prrt.feedback.packetCount", FT_UINT16, BASE_DEC, NULL, 0x0, "The packet count used for loss calculations at the receiver, stored in general PRRT feedback header", HFILL }},
{ &hf_prrt_gap,
{ "Aggregated Gap Length", "prrt.feedback.gap", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
{ &hf_prrt_ngap,
{ "Gap Count", "prrt.feedback.ngap", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
{ &hf_prrt_burst,
{ "Aggregated Burst Length", "prrt.feedback.burst", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
{ &hf_prrt_nburst,
{ "Burst Count", "prrt.feedback.nburst", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
{ &hf_prrt_bw_est,
{ "Estimated Bandwidth", "prrt.feedback.bw", FT_UINT32, BASE_DEC, NULL, 0x0, "The bandwidth estimated at the receiver, stored in general PRRT feedback header", HFILL }},
{ &hf_prrt_buf_fb,
{ "Buffer Feedback", "prrt.feedback.buf_fb", FT_UINT32, BASE_DEC, NULL, 0x0, "", HFILL }},
{ &hf_prrt_payload,
{ "PRRT Payload", "prrt.payload", FT_NONE, BASE_NONE, NULL, 0x0, "The payload of the PRRT packet", HFILL }}
};
static gint *ett[] = {
&ett_prrt
};
proto_prrt = proto_register_protocol("PRRT", "PRRT", "prrt");
register_heur_dissector_list("prrt");
proto_register_field_array(proto_prrt, hf, array_length(hf));
proto_register_subtree_array(ett, array_length(ett));
prrt_module = prefs_register_protocol(proto_prrt, proto_reg_handoff_prrt);
prefs_register_uint_preference(prrt_module, "udp.port", "PRRT UDP Port", "PRRT UDP port if other than the default of 5004", 10, &gPORT_PREF);
}
void proto_reg_handoff_prrt(void)
{
static gboolean initialized = FALSE;
static dissector_handle_t prrt_handle;
static int current_port;
if(!initialized) {
prrt_handle = create_dissector_handle(dissect_prrt, proto_prrt);
data_handle = find_dissector("data");
initialized = TRUE;
} else {
dissector_delete_uint("udp.port", current_port, prrt_handle);
dissector_delete_uint("udp.port", current_port+1, prrt_handle);
}
current_port = gPORT_PREF;
dissector_add_uint("udp.port", current_port, prrt_handle);
dissector_add_uint("udp.port", current_port+1, prrt_handle);
}
/*
* Editor modelines - http://www.wireshark.org/tools/modelines.html
*
* Local Variables:
* c-basic-offset: 2
* tab-width: 8
* indent-tabs-mode: nil
* End:
*
* ex: set shiftwidth=2 tabstop=8 expandtab:
* :indentSize=2:tabSize=8:noTabs=true:
*/
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment