Wireshark-dev: [Wireshark-dev] How to handle TCP protocols that have don't include state in the
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Saad Nader" <snader@xxxxxxxxxxx>
Date: Wed, 2 Sep 2009 15:41:33 -0700

Hello,


I’m trying to create a dissector plug-in for my protocol and would like to know how I can handle the following situation:

 

I have a protocol that has very little if not any state information in each message that I send or receive as a client.  There is also encryption going on from one direction (e.g. server -> client).  I have trouble when I’m keep state in a conversation since the encryption algorithm relies on the previous packet that was sent.  So anytime I click on a packet from the UI and it fires my dissector, my packets get re-decrypted.  I’d like to traverse backwards and not have to worry about such issues. 


I would also like to know how I can get TCP sequence numbers for a given packet.

 

Thanks,

------------------

Saad Nader