Nevo, Do you mind sharing the code? We use TFramedTransport as well and have been thinking about a Wireshark decoder ourselves.
cheers, Diwaker On Fri, Aug 31, 2012 at 11:49 AM, Nevo Hed <[email protected]> wrote: > Hi Prabhakar > > I wrote a pcap-based capture-decode that is very simplistic with the main > caveats that > A) Only handles TFramedTransport (thats the only one we use, as we use > TNonblockingServer) > B) Does *not* reassemble messages from TCP packets, so the messages need > to be small > > I intended to clean it up and release one of these days ... as I did not > implement TBufferedTransport, I can't really help, but what I find curious > about your question is that you state that you use TDebugProtocol, > but TDebugProtocol needs to be template-instantiated with a known type ... > so how do you make it work for an arbitrary type seen on the wire? (my > program produce TDebugProtocol-LIKE output) > > Thanks! > -Nevo > > > > > On Thu, Aug 23, 2012 at 2:06 PM, Prabhakar Henry > <[email protected]>wrote: > >> Hi, >> >> I am using Thrift 0.6.x version and I am writing a Thrift decoder ( using >> TDebugProtocol) to decode and print in text Thrift packets sent over >> TCP which are captured by PCAP. I have access to the Thrift Definitions. >> >> I see two types of transports used TBufferedTransport and TFramedTransport. >> >> I need to know the total length of the Thrift payload so that I can >> reassembly fragmented packets and decode. >> >> For TFramedTransport, I see that Thrift writes a 4 byte total payload >> length just before encoding the Thrift payload. I am able to >> For TBufferedTransport, I dont see a 4 byte total length. So I am unable to >> reassemble the entire payload for decoding. >> >> Any suggestions on how to know the total payload length for >> TBufferedTransport or does Thrift provide any way of handling cases like >> this. >> >> regards, >> Prabhakar >> -- http://maginatics.com
