Wireshark Generic Dissector

Mandatory

Change Log
Behavior modifications

Windows

Wireshark 32 bits 64 bits Last update Support
3.2.X download download 2020/01/19 end 2022
3.0.X download download 2020/01/19 mid 2022
2.6.X download download 2020/01/19 mid 2021
2.4.X download download 2020/01/19 mid 2020
2.2.X download download 2019/01/27 -
Linux clone/build script (wireshark >= 2.4)

Linux 64 bits build on Ubuntu

Wireshark 64 bits Last update Build on Support
3.2.X download 2019/12/25 18.04 end 2022
3.0.X download 2019/12/25 mid 2022
2.6.X download 2018/05/05 16.04 mid 2021
2.4.X download 2017/07/08 mid 2020
2.2.X download 2017/04/03 14.04 -
2.0.X download
1.12.X download
1.10.X download 2015/02/21 12.04 -
1.8.X download
1.6.X download

Linux 64 bits build on CentOS

Wireshark 64 bits Last update Build on Support
3.2.X download 2019/12/28 CentOS 7 -
3.0.X download 2019/03/23
2.6.X download 2019/01/25
2.4.X download 2017/07/01

Linux 32 bits build on Ubuntu

Wireshark 32 bits Last update Build on Support
2.4.X download 2017/07/08 16.04 -
2.2.X download 2017/04/03 14.04
2.0.X download
1.12.X download
1.10.X download 2015/02/21 12.04
1.8.X download
1.6.X download

For a first test

Posted on 27/10/2007 by UserName

example_with_capture.wsgd
example_with_capture.fdesc
example_with_capture.pcap



Source code

Posted on 27/10/2007 by UserName

C++ source code : https://gitlab.com/wsgd/wsgd





Stand-alone

Posted on 27/10/2007 by UserName

The tools here are :
- NOT linked to wireshark tools (or source code)
- NOT able to manage <file>.wsgd
- NOT able to manage directly <file>.pcap
- NOT able to capture packet on network
- NOT able to manage sub-dissector/proto


Byte interpret is a stand-alone command line tool which is able to decode a binary file/input using the <file>.fdesc syntax.
>byte_interpret.exe <file>.fdesc -frame_bin <file_which_contains_binary_data>
...
>byte_interpret.exe byte_order big_endian ; float32 value ; -- 00 01 02 03
value = 9.25572e-041

OS 32 bits 64 bits
Windows byte_interpret.exe -
Ubuntu byte_interpret.x byte_interpret.x
CentOS - byte_interpret.x


Windows frhed with fdesc_decoder           (last update : 2011/04/02)
This is Byte interpret embedded inside frhed (version 1.5.1).
frhed is a hexa-decimal editor, see http://frhed.sourceforge.net/.
Use "File/Open ..." to choose the (binary) file to interpret.
Use "Edit/Apply template ..." to choose the <file>.fdesc to apply to the binary data.


The <file>.fdesc must contains all types definitions.
Then you must add, at the end, the data you want to read.
E.g, very short example :

# First, the definitions 
enum16  my_1st_enum_type
{
    val_false      0
    val_true       1
    val_not_sure   2
}
alias my_1st_int_type  uint32{d=hex}{min=0x22:max=0x2345675};
# Then, what I want to read/decode :
my_1st_enum_type      my_1st_enum_field;
my_1st_int_type[*]    my_1st_int_field;




Text editor highlighters

Posted on 27/10/2007 by UserName

PSPad : fdesc.ini           put it into <pspad>/syntax directory

CSS Template by Rambling Soul