Wireshark · Wireshark-users: Re: [Wireshark-users] TNS data dissector

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

Andrej van der Zee wrote:
> > > http://anonsvn.wireshark.org/wireshark/trunk/epan/dissectors/packet-tns.c  ?
> > As far as I can see in Wireshark, it does not dissect the data inside
> > a TNS packet, it shows it as binary. For example, I would like to be
> > able to see the SQL queries going over the wire.
>
> So i guess it is impossible to look inside the data in a TNS packet and we cannot see the actual SQL queries inside the data? Is there a specific reason why it doesnt dissect the data? 

A quick read about TNS:

https://en.wikipedia.org/wiki/Transparent_Network_Substrate

seems to indicate that it's basically a tunneling protocol.  So to 
decode the payload Wireshark would need to know what the contents are. 
Does the protocol have some indication of its payload?  If not, maybe a 
TNS preference or maybe heuristics could be used to determine the 
payload.  (If the payload is usually the same that could be a start or 
the default preference value.)

This kind of thing can be implemented but we'd need sample capture(s) of 
different kinds of things being transported over TNS (of course with a 
description of what those things are) all logged in an bug report.

As for the reason Wireshark doesn't currently do it, it's probably the 
usual reason: no one's gotten around to it or felt the need.