This helps me too. There are some slides about export pdu. But yes, any material is welcome. Thanks for the help team. This is fantastic.
On Wed, Jan 15, 2020 at 2:47 PM Dario Lombardo <lom...@gmail.com> wrote: > I don't think this is what Anders was talking about. This is about extcap, > while I was referring to export_pdu. > If you or Anders can reference the right one, that would be great. > If you want to have a look at something using export_pdu creating a pcap > file, have a loot at the udpdump.c code. > > On Wed, Jan 15, 2020 at 2:37 PM Juanjo Martin Carrascosa <jua...@rti.com> > wrote: > >> https://sharkfestus.wireshark.org/assets/presentations18/17.pptx >> >> On Wed, Jan 15, 2020 at 2:36 PM Dario Lombardo <lom...@gmail.com> wrote: >> >>> Can you share the link, for future reference? >>> >>> On Wed, Jan 15, 2020 at 2:15 PM Juanjo Martin Carrascosa <jua...@rti.com> >>> wrote: >>> >>>> Found the presentation, this is fantastic. >>>> >>>> Thanks! >>>> >>>> On Wed, Jan 15, 2020 at 12:58 PM Anders Broman via Wireshark-dev < >>>> wireshark-dev@wireshark.org> wrote: >>>> >>>>> Hi, >>>>> >>>>> In the frame layer there is the “Encapsulation type” the way the pcap >>>>> format works this indicates how the data following should be interpreted. >>>>> >>>>> Linktype/encapsulation type is defined at >>>>> https://www.tcpdump.org/linktypes.html so one thing you could do is >>>>> to design your own DLT >>>>> >>>>> Add whatever meta data you want and then add the RTPS data at some >>>>> position in that structure. You can try this out by using the USER DLTs in >>>>> Wireshark >>>>> >>>>> Or if you do not want to request a DLT from tcpdump ( DO NOT USE ONE >>>>> WITHOUT ALLOCATING IT) you could use the Exported PDU DLT defined by >>>>> Wireshark >>>>> >>>>> Epan/exported_pdu.h contains some information. If you would require >>>>> new elements for meta information that could be discussed. Adding RTSP >>>>> data >>>>> in >>>>> >>>>> An exported_pdu DLT frame should be simple as an initial test. I think >>>>> there is a sharkfest presentation on how to add any protocol data in an >>>>> exported pdu frame with text2pcap. >>>>> >>>>> Regards >>>>> >>>>> Anders >>>>> >>>>> >>>>> >>>>> *From:* Wireshark-dev <wireshark-dev-boun...@wireshark.org> *On >>>>> Behalf Of *Juanjo Martin Carrascosa >>>>> *Sent:* den 15 januari 2020 12:24 >>>>> *To:* Developer support list for Wireshark < >>>>> wireshark-dev@wireshark.org> >>>>> *Subject:* Re: [Wireshark-dev] Bypassing the first layer >>>>> >>>>> >>>>> >>>>> Hi Dario, >>>>> >>>>> >>>>> >>>>> Could you elaborate on this? I get the idea but my knowledge about the >>>>> how is very basic. >>>>> >>>>> >>>>> >>>>> How can this help me achieve what I need? >>>>> >>>>> >>>>> >>>>> Thanks for the help. >>>>> >>>>> Juanjo Martin >>>>> >>>>> >>>>> >>>>> On Tue, Jan 14, 2020 at 4:48 PM Dario Lombardo <lom...@gmail.com> >>>>> wrote: >>>>> >>>>> You can use export_pdu. This is a layer with multiple attributes (see >>>>> epan/exported_pdu.h), but the only really needed is the proto_name, that >>>>> allows you to directly call a dissector by its name. >>>>> >>>>> You will have frames with this stack: FRAME/EXPORT PDU/RTPS, that is >>>>> properly dissected by wireshark. >>>>> >>>>> >>>>> >>>>> On Tue, Jan 14, 2020 at 4:33 PM Juanjo Martin Carrascosa < >>>>> jua...@rti.com> wrote: >>>>> >>>>> Hi everyone, >>>>> >>>>> >>>>> >>>>> RTPS is a protocol already supported by Wireshark. I have been helping >>>>> maintain that protocol these past years. It sits on top of TCP and UDP, as >>>>> well as some other transports that are not network ones (Shared Memory >>>>> typically with a proprietary implementation). >>>>> >>>>> >>>>> >>>>> We are currently working on implementing a new logging mechanism for >>>>> our product, mainly to address the Shared Memory scenario but it can also >>>>> be really useful when RTPS is used on top of network protocols. >>>>> >>>>> >>>>> >>>>> Problem: We can log the RTPS layer but we don't have some information >>>>> in our middleware like the Frame or Ethernet information, so we need to >>>>> make it up. This is ugly, so I am trying to avoid that: >>>>> >>>>> >>>>> >>>>> How can I register a protocol so it is picked up instead of the Frame >>>>> layer? This is, I want to create a new protocol that detects that the >>>>> information we generate is for that protocol and the Frame protocol is not >>>>> called, but the new protocol I am creating. This new protocol will then >>>>> call the RTPS protocol to dissect the payload I want to display. We are >>>>> planning to also add some information to this custom protocol, that's why >>>>> I >>>>> want it to be called first. >>>>> >>>>> >>>>> >>>>> Note: I just came up with this solution, but if you have a different >>>>> solution for this, please let me know. >>>>> >>>>> >>>>> >>>>> Thanks, >>>>> >>>>> Juanjo Martin >>>>> >>>>> >>>>> ___________________________________________________________________________ >>>>> Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> >>>>> Archives: https://www.wireshark.org/lists/wireshark-dev >>>>> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev >>>>> mailto:wireshark-dev-requ...@wireshark.org >>>>> ?subject=unsubscribe >>>>> >>>>> >>>>> >>>>> >>>>> -- >>>>> >>>>> Naima is online. >>>>> >>>>> >>>>> ___________________________________________________________________________ >>>>> Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> >>>>> Archives: https://www.wireshark.org/lists/wireshark-dev >>>>> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev >>>>> mailto:wireshark-dev-requ...@wireshark.org >>>>> ?subject=unsubscribe >>>>> >>>>> >>>>> >>>>> >>>>> -- >>>>> >>>>> >>>>> >>>>> Juanjo Martin >>>>> >>>>> Principal Application Engineer >>>>> >>>>> EMEA Services Lead @ Professional Services Group >>>>> >>>>> Office: +34 958 27 88 62 >>>>> >>>>> jua...@rti.com >>>>> >>>>> www.rti.com >>>>> <https://protect2.fireeye.com/v1/url?k=ef5c0e3a-b3d6db2c-ef5c4ea1-862f14a9365e-a65581b6c9ebf84e&q=1&e=75a63928-4ca4-405f-a42a-975bcffca831&u=http%3A%2F%2Fwww.rti.com%2F> >>>>> >>>>> >>>>> >>>>> ___________________________________________________________________________ >>>>> Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> >>>>> Archives: https://www.wireshark.org/lists/wireshark-dev >>>>> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev >>>>> mailto:wireshark-dev-requ...@wireshark.org >>>>> ?subject=unsubscribe >>>> >>>> >>>> >>>> -- >>>> >>>> Juanjo Martin >>>> Principal Application Engineer >>>> EMEA Services Lead @ Professional Services Group >>>> Office: +34 958 27 88 62 >>>> jua...@rti.com >>>> www.rti.com >>>> >>>> >>>> >>>> ___________________________________________________________________________ >>>> Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> >>>> Archives: https://www.wireshark.org/lists/wireshark-dev >>>> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev >>>> mailto:wireshark-dev-requ...@wireshark.org >>>> ?subject=unsubscribe >>> >>> >>> >>> -- >>> >>> Naima is online. >>> >>> >>> ___________________________________________________________________________ >>> Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> >>> Archives: https://www.wireshark.org/lists/wireshark-dev >>> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev >>> mailto:wireshark-dev-requ...@wireshark.org >>> ?subject=unsubscribe >> >> >> >> -- >> >> Juanjo Martin >> Principal Application Engineer >> EMEA Services Lead @ Professional Services Group >> Office: +34 958 27 88 62 >> jua...@rti.com >> www.rti.com >> >> >> >> ___________________________________________________________________________ >> Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> >> Archives: https://www.wireshark.org/lists/wireshark-dev >> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev >> mailto:wireshark-dev-requ...@wireshark.org >> ?subject=unsubscribe > > > > -- > > Naima is online. > > ___________________________________________________________________________ > Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> > Archives: https://www.wireshark.org/lists/wireshark-dev > Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev > mailto:wireshark-dev-requ...@wireshark.org > ?subject=unsubscribe -- Juanjo Martin Principal Application Engineer EMEA Services Lead @ Professional Services Group Office: +34 958 27 88 62 jua...@rti.com www.rti.com
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
