Wireshark mailing list archives
Improve Generic Netlink family id to name mapping
From: Matt <mattator () gmail com>
Date: Mon, 22 Jul 2019 21:22:56 +0900
Hi,
I've recently been spending some time working with netlink/wireshark.
More precisely with a out-of-tree generic netlink protocol: the
multipath TCP netlink path manager.
I was surprised to see next to the generic netlink family id the name
of the family "mptcp" in wireshark.I've had a look at the code yet I
couldn't figure how it got the mapping from a number to the family
name.
I happen to unload/reload the linux kernel module in charge of this
netlink family, thus its id keeps changing (visible via `genl ctrl
list`). I have a lua script in charge of decoding this custom protocol
which is attached like this
====
netlink_table = DissectorTable.get("genl.family")
local ret = netlink_table:add("mptcp", mptcp_proto)
=====
but once I reload the module, wireshark is unable to map the family
name "mptcp" to the id, so my dissector is never used.
What would you recommand me to work around this ? Would there be
interest in having a C/lua plugin to do the mapping (either via
netlink or by scraping genl ctrl list) ?
Best regards
Matt
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users () wireshark org>
Archives: https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Improve Generic Netlink family id to name mapping Matt (Jul 22)
- Re: Improve Generic Netlink family id to name mapping Peter Wu (Jul 28)
