Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 8947] New: Adding request/response tracking into COPS dissector

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	8947
Summary	Adding request/response tracking into COPS dissector
Classification	Unclassified
Product	Wireshark
Version	1.10.0
Hardware	All
OS	All
Status	UNCONFIRMED
Severity	Enhancement
Priority	Low
Component	Wireshark
Assignee	bugzilla-admin@wireshark.org
Reporter	szhong@juniper.net

Build Information:

--
The COPS dissector does not support request/response tracking because it
doesn't decode handle in COPS message. This patch added handle decoding and
request/response matching.

A few implementation details/tradeoffs:

- According to RFC 2748, the handle is "Variable-length field, no implied
format", however in real world implementations (include Juniper JUNOSe and
PacketCable Specification PKT-SP-MM-I06-110629) it's common to use 32bit uint
as handle. This patch uses the lowest 32bit of handle field.
- This patch assumes that there's no retransmit of request/response with same
handle, so it always try to match response with the first unanswered request
which has the same handle.
- There's one situation that one Synchronize State Req (SSQ) with handle unset
or set to 0, it will trigger a full synchronization, it's very likely that PDP
will response with multiple RPTs/DRQs. This patch doesn't handle such scenario
(yet).


Build information:

TShark 1.11.0 (SVN Rev 50731 from /trunk)

Copyright 1998-2013 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.22.5, with libpcap, with libz 1.2.3, without
POSIX
capabilities, without libnl, with SMI 0.4.8, without c-ares, without ADNS,
without Lua, without Python, with GnuTLS 2.8.5, with Gcrypt 1.4.5, with MIT
Kerberos, without GeoIP.

Running on Linux 2.6.32-358.14.1.el6.x86_64, with locale en_US.UTF-8, with
libpcap version 1.0.0, with libz 1.2.3.
       Intel(R) Core(TM) i5-2520M CPU @ 2.50GHz

Built using gcc 4.4.7 20120313 (Red Hat 4.4.7-3).

The patch has passed fuzz testing.

---

      You are receiving this mail because:

• You are watching all bug changes.