Wireshark · Ethereal-dev: Re: [Ethereal-dev] SPOOLSS, msrpc dissection, please comment

[Todd Sabin <tas@xxxxxxxxxxx>]

Guy Harris <guy@xxxxxxxxxx> writes:
> 
> Those dissectors are, from their entries in the list of protocols in the
> Netmon GUI for constructing display filters, "generated RPC parsers for
> interface XXX"; I assume this means they have something that reads a
> DCERPC IDL file and emits a parser.
> 

Yes, I'm fairly sure they do, although some of their generated parsers
don't seem to be completely correct.  I only point that out as an
indication that it's a non-trivial task.

> I think the free DCERPC code includes an IDL parser; would it make sense
> for us to modify that into something that can generate an Ethereal
> dissector, and use that, plus the IDLs for various services (perhaps
> after modifying the IDL language to include additional information to
> give nice display names to fields), to generate dissectors for those
> services?
> 

Absolutely.  Long term, I plan to do that, unless someone else gets
there first, of course.  I currently have an IDL parser that can
output a bare dissector given a .idl.  (By 'bare' I mean putting the
names of the calls in, but no parameters.)  I'm planning to either
enhance that, or just modify the one from freedce.  I need to grok how
freedce does things first, though, and I haven't had the time to
devote to it.  :(


Todd