Wireshark · Wireshark-dev: [Wireshark-dev] tap for IGMPv3 statistics ...

[wireshark@xxxxxxxxxxx]

Hi,

I'm currently working on extending wireshark to create some statistics
related to IGMP.

This includes but is not limited to:

  - IGMP Version (1/2/3)
  - IGMPv1
    # of queries
    # of joins
  - IGMPv2
    # of queries
    # of joins
    # of leaves
  - IGMPv3
    # queries
    # of group records/packet
    # of record types (by type, e.g. 10 IS_INCL, 20 CHANGE_TO_INCL)

In addition I also want to include statistics related to groups. E.g.
    # IS_INCL, #IS_EXCL per group
    Example:
      239.1.2.3 (total):   34
          IS_INCL          15
          IS_EXCL          15
          CHANGE_TO_INCL    2
          CHANGE_TO_EXCL    2

In order to do so I decided to use the stats_tree and to write a plugin
(with a tap in the IGMP dissector). Unfortunately passing the correct
information from the tap to the plugin is not that easy. From what I
understand I have two possibilites:

 a) create an addtional data structure in the 
    IGMP dissector and to fill the data structure 
    during dissection, passing it via the tap
    to the stats_tree plugin for IGMP
    - for IGMPv1/IGMPv2 this might be the way to 
      go but with IGMPv3 and the dissection of an 
      (more or less) arbitrary number of group 
      records this might add an significant overhead
      to the dissector

 b) pass the whole IGMP packet (raw data) from the 
    dissector to the tap/plugin
    - less overhead for the IGMPv3 dissector but more
      work in the tap plugin because parts of the dissector
      need to be reimplemented (mainly copied from 
      packet-igmp.c)

My problem with b) is, how can I pass the whole packet via the tap to my
plugin? Do I have to make a copy from the tvb buffer or is there a way
to pass a pointer to the buffer via the tap to the plugin?

   Regards

      Nic