Wireshark Generic Dissector

Mandatory

Change Log
Behavior modifications

Windows

Wireshark 32 bits 64 bits Support
2.4.X download download mid 2020
2.2.X download download mid 2019
2.0.X download download mid 2018

Linux (Ubuntu)

Wireshark 32 bits 64 bits Last update on Support
2.4.X download download 2017/07/08 16.04 mid 2020
2.2.X download download 2017/04/03 14.04 mid 2019
2.0.X download download mid 2018
1.12.X download download mid 2017
1.10.X download download 2015/02/21 12.04 -
1.8.X download download -
1.6.X download download -

Linux (CentOS)

Wireshark 64 bits Last update on Support
2.4.X download 2017/07/01 CentOS 7 -

For a first test

Posted on 27/10/2007 by UserName

example_with_capture.wsgd
example_with_capture.fdesc
example_with_capture.pcap

Source code

Posted on 27/10/2007 by UserName

C++ source code : zip or svn http://sourceforge.net/p/wsgd/code/HEAD/tree/generic/





Stand-alone

Posted on 27/10/2007 by UserName

The tools here are :
- NOT linked to wireshark tools (or source code)
- NOT able to manage <file>.wsgd
- NOT able to manage directly <file>.pcap
- NOT able to capture packet on network
- NOT able to manage sub-dissector/proto


Byte interpret is a stand-alone command line tool which is able to decode a binary file/input using the <file>.fdesc syntax.
>byte_interpret.exe <file>.fdesc -frame_bin <file_which_contains_binary_data>
...
>byte_interpret.exe byte_order big_endian ; float32 value ; -- 00 01 02 03
value = 9.25572e-041

OS 32 bits 64 bits
Windows byte_interpret.exe -
Ubuntu byte_interpret.x byte_interpret.x
CentOS - byte_interpret.x


Windows frhed with fdesc_decoder           (last update : 2011/04/02)
This is Byte interpret embedded inside frhed (version 1.5.1).
frhed is a hexa-decimal editor, see http://frhed.sourceforge.net/.
Use "File/Open ..." to choose the (binary) file to interpret.
Use "Edit/Apply template ..." to choose the <file>.fdesc to apply to the binary data.


The <file>.fdesc must contains all types definitions.
Then you must add, at the end, the data you want to read.
E.g, very short example :

# First, the definitions 
enum16  my_1st_enum_type
{
    val_false      0
    val_true       1
    val_not_sure   2
}
alias my_1st_int_type  uint32{d=hex}{min=0x22:max=0x2345675};
# Then, what I want to read/decode :
my_1st_enum_type      my_1st_enum_field;
my_1st_int_type[*]    my_1st_int_field;




Text editor highlighters

Posted on 27/10/2007 by UserName

PSPad : fdesc.ini           put it into <pspad>/syntax directory

CSS Template by Rambling Soul