Hi all,
I noticed that the current X11 dissector works quite well for requests
(from client to server) but doesn't dissect events (vice versa), so I
started modifying it to dissect (guess what) X11 events, errors & Co. .
The current code I have works well but needs some cleanup (from coding
style to renaming of some vars, etc.), therefore it isn't 100% ready: if
you want to see it, it's at
http://www.cli.di.unipi.it/~zunino/ethereal/packet-x11.c
http://www.cli.di.unipi.it/~zunino/ethereal/x11-fields
I'm ready to accept suggestions, of course.
Current status:
1) Event dissecting: 99% done, needs code cleanup.
2) Error dissecting: as above
3) Reply dissecting: 5% done, see below.
4) Desegmenting: 0% done (I'm not going doing it in the near time, maybe
later (maybe!))
A couple of questions:
1) The current code tries to guess the endianness of the packet using some
heuristic rules. That would be unnecessary if the dissector could read (or
maybe remember) the first non-empty segment from client to server (where
the client tells the server the endianness that will be used for all the
data stream). Is there any way to do it? This is related to question 2.
[Yes, the guessing code could be still useful if the first segment has not
been captured...]
2) X11 replies (server->client) cannot be really dissected unless the
dissector can read (or remember) the matching request (client->server).
The matching request is up on the TCP stream. Any ideas?
I thought to keep a cache of these data: i.e.
the dissector gets called for the first packet ->
endianness[tcp_connection_id]=get_end(packet)
the dissector gets called for a request ->
insert(pending_reqs, tcp_connection_id, req_type, req_serial)
the dissector gets called for a reply ->
extract(pending_reqs, rev(tcp_connection_id), req_serial) => req_type
[sorry for being such verbose]
The problem is that the packets could be out of order on the wire: in that
case the cache would be useless.
Is there an "easy" way to solve this? Maybe exploiting the support for
desegmentation of TCP?
TIA, and thank you for this great network analyzer!
Zun.
