mattunderscorechampion/wireshark-dissector

A Wireshark dissector for the DPT protocol, written in Lua

wireshark-dissector's Issues

Reconnections

Wireshark does not identify reconnections or the requested client ID

Subscription service request topic selector leading character

Subscription service request topic selector had a leading character and were being truncated. The conversation ID was being parsed as a single byte instead of a varint.

Unnecessary recovery of lost data

There was an issue with empty fields fixed in commit 25b010d. This was caused by the use of splitting the string using a pattern that strips out the empty fields. The commit restores them but it makes more sense to forego using the string manipulation.

Add support for the development release

The development release appears to break several parts of the dissector. Field names and strangely integer parsing.

Flag out of order topic aliases

The topic aliases are stored in a map first and then looked up later. This means that the dissector can resolve the aliases even when received out of order. It would be good to draw attention to delta messages received with unknown aliases, even when the alias is received.

Better summary for multiple Diffusion messages

Currently when multiple Diffusion messages are received in the same TCP packet the summary only displays the number of messages in the packet. A summary of each messages type would make it easier to find what was looked for.

WS rejected connections have parsing error

Rejected WS connection responses still attempt to parse the session ID etc. This causes the parsing code to attempt to read beyond the last byte of the range.

Use byte range based URI parsing

The string based URI parsing of WS connection requests means that bytes in the dissector are not selectable.

Install script

Write a short install script that, cleans up existing files, copies the files to the correct place for wireshark to find and sets up the init.lua script to load them.

Duplicated fields between DPT and WS

Some fields have counterparts for DPT and WS to accommodate differences in the protocol. The connection type has a field for DPT and a different field for WS because in DPT it is sent as a byte and in W it is sent as a string. It would be better if they were the same field with a value normalised between the protocols.

Incorrect connection rejected response code

The response codes in dpt.proto.lua has the wrong byte value for Connection Rejected is should be 111.