Project

General

Profile

Actions

Feature #3092

closed

Wireshark dissector for NDN packets

Added by Alex Afanasyev over 8 years ago. Updated over 8 years ago.

Status:
Closed
Priority:
Normal
Start date:
Due date:
% Done:

100%

Estimated time:

Description

The original dissector code is part of https://github.com/relue2718/ndn-wireshark-dissector, written by Qi Zhao, Seunghyun Yoo, Seungbae Kim.

The developed dissector should be imported to tools, adding additional documentation about basic usage of the dissector.

Actions #1

Updated by Junxiao Shi over 8 years ago

commit:6fbb7b4594c0cf2c8bc4373b4acf90ec9c50d5ad and commit:f1554c8f2087f709d5baea10fbad40c897429b40 have a problem:

  • The script is designed for Wireshark 1.99 and above, which is a "development version", not stable release. Wireshark 1.99 is unavailable through regular package managers in Ubuntu 12.04, 14.04, 15.04, and MacPorts. It is available in HomeBrew and for Windows.
  • README.md does not mention the Wireshark version requirements.
  • wscript does not detect the correct version of Wireshark is installed.
Actions #2

Updated by Junxiao Shi over 8 years ago

Future improvements after commit:357c205aa690c680c50e49a959e235b542311b04:

  • Info column in packet list should show "Interest/Data" and the Name, not "Source Port: 6363 Destination Port: 6363"
  • proper ndn: URI encoding
  • Nonce field in packet detail should omit 0a04, and show only the TLV-VALUE
  • SignatureType field in packet detail should display "SignatureSha256WithRsa" instead of "1"
  • fields in packet detail should show "Type: 20, Length: 4" as sub-fields instead of as part of description text: TLV-TYPE and TLV-VALUE is not useful when glancing at the structure, but it's useful when expanding the field for a more detailed look; having them as sub-fields also allows the user to click on the sub-field to select the corresponding bytes
Actions #3

Updated by Davide Pesavento over 8 years ago

I agree with the proposed improvements. Shouldn't we open separate ticket(s) for them though?

Actions #4

Updated by Alex Afanasyev over 8 years ago

I think separate issues will be better, as the task (per description) has been fulfilled with the current commits.

One comment about note-2. I have added Type and Length originally as described in the note. However, I have removed this, as the output wasn't good. Right now, the dissected structure follows TLV, type and length are not TLVs by themselves but are part of each individual TLV. Therefore, I would keep this part as is.

Agree with other issues in note-2.

Actions #5

Updated by Junxiao Shi over 8 years ago

I have added Type and Length originally as described in note-2. However, I have removed this, as the output wasn't good. Right now, the dissected structure follows TLV, type and length are not TLVs by themselves but are part of each individual TLV. Therefore, I would keep this part as is.

I'm unsure about this.

TLV-TYPE and TLV-LENGTH are too detail to display at unexpanded level.

Part of a DNS query is shown as:

Queries
  clients2.google.com: type A, class IN
    Name: clients2.google.com
    [Name Length: 19]
    [Label Count: 3]
    Type: A (Host Address) (1)
    Class: IN (0x0001)

We can learn from this example: TLV-TYPE and TLV-LENGTH can be shown in a field that looks different, such as wrapping with [ ] or setting a different color.

Another idea we can learn is: enum fields (such as SignatureType) can be shown with both text label and numeric code.

Actions #6

Updated by Junxiao Shi over 8 years ago

  • Status changed from Code review to Closed
  • Start date deleted (08/10/2015)
Actions #7

Updated by Junxiao Shi over 8 years ago

  • Subject changed from Add Lua-based Wireshark dissector for NDN packets to Wireshark dissector for NDN packets
Actions

Also available in: Atom PDF