Wireshark-users Digest, Vol 94, Issue 10

[Mathias Koerber]

I'm trying to have tshark decode a number of packets I got from an
strace(1) output (params of write, read, recvfrom etc).
Thus they are not including any layers below UDP..

I am using Perl's String::Unescape and Data::Hexdumper to
convert them to a format similar to what od(1) would output, then
text2pcap -q -i 6 -u 10000,53
(as an example for a DNS packet) to make pcap input file
and then
tshark -l -V -N t -r filename </dev/null >filename2 2>&1
to have tshark decode them.

However, that also decodes the dummy lower layers I had
text2pcap add to get a full packet.

1. Is there a way to not have to have text2cap add those
dummy layers (ie, can I tell tshark that all it will find
in the pcap file is UDP packet)?

If not:

2. Is there a way to have tshark only decode the UDP part
and print it in -V detail? I don't need the full dummy
info.

thanks
M
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Hadriel Kaplan]

For (1), not that I know of. And there is no libpcap encap type that wouldn't have at least the IP layer anyway if you want to put UDP in it, afaik. (there are some encaps which don't have the link layer header, but I don't think text2pcap is that sophisticated)


Of course you could just write out your data into a pcap file instead of using text2pcap - I'm sure there are Perl modules on cpan.org for pcap file writing. If you do that, then you could write out with a RAW_IP encap type and skip the link layer.


For (2), have you tried "tshark -O 'udp,foo,bar' ..."?

-hadriel




On Sunday, March 23, 2014 9:24 PM, Mathias Koerber <***@koerber.org> wrote:

I'm trying to have tshark decode a number of packets I got from an
strace(1) output (params of write, read, recvfrom etc).
Thus they are not including any layers below UDP..

I am using Perl's String::Unescape and Data::Hexdumper to
convert them to a format similar to what od(1) would output, then
  text2pcap -q -i 6 -u 10000,53
(as an example for a DNS packet) to make pcap input file
and then
  tshark -l -V -N t -r filename </dev/null >filename2 2>&1
to have tshark decode them.

However, that also decodes the dummy lower layers I had
text2pcap add to get a full packet.

1. Is there a way to not have to have text2cap add those
  dummy layers (ie, can I tell tshark that all it will find
  in the pcap file is UDP packet)?

If not:

2. Is there a way to have tshark only decode the UDP part
  and print it in -V detail?  I don't  need the full dummy
  info.

thanks
M
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-***@wireshark.org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Christopher Maynard]

Post by Hadriel Kaplan
For (1), not that I know of. And there is no libpcap encap type that

wouldn't have at least the IP layer anyway if you want to put UDP in it,
afaik. (there are some encaps which don't have the link layer header, but I
don't think text2pcap is that sophisticated)

The LINKTYPE_USER0-LINKTYPE-USER15 link types can be used for this purpose.
See http://www.tcpdump.org/linktypes.html for details.

So basically there are 3 steps:

1) Pick a user DLT, say 149 and enter it into the Wireshark user decode:
Edit -> Preferences -> Protocols -> DLT_USER -> Encapsulations Table -> Edit
-> New -> DLT: (Pick 1, i.e., User 2 (DLT=149)) -> Payload protocol: udp ->
OK -> OK -> OK.

2) text2pcap -l 149 [other options] file.txt file.pcap

3) Open file.pcap in Wireshark.

Hope that helps,
- Chris


___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Christopher Maynard]

Post by Christopher Maynard
Edit -> Preferences -> Protocols -> DLT_USER -> Encapsulations Table -> Edit
-> New -> DLT: (Pick 1, i.e., User 2 (DLT=149)) -> Payload protocol: udp ->
OK -> OK -> OK.
2) text2pcap -l 149 [other options] file.txt file.pcap
3) Open file.pcap in Wireshark.
Hope that helps,
- Chris

For more information, you can also refer to the user guide, section 10.20.
User DLTs protocol table

http://www.wireshark.org/docs/wsug_html_chunked/ChUserDLTsSection.html


___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe