{"id":5684,"date":"2014-04-24T09:05:47","date_gmt":"2014-04-24T07:05:47","guid":{"rendered":"http:\/\/daniel.haxx.se\/blog\/?p=5684"},"modified":"2014-04-24T09:09:04","modified_gmt":"2014-04-24T07:09:04","slug":"wireshark-dissector-work","status":"publish","type":"post","link":"https:\/\/daniel.haxx.se\/blog\/2014\/04\/24\/wireshark-dissector-work\/","title":{"rendered":"Wireshark dissector work"},"content":{"rendered":"

\"Wireshark\"<\/a>Recently I cloned the Wireshark git repository<\/a> and started updating the http2 dissector. That’s the piece of code that gets called to analyze a stream of data that Wireshark thinks is http2.<\/p>\n

The current http2 dissector was left at draft-09 state, while the current draft at the time was number 11<\/a> and there have been several changes<\/a> on the binary format since so any reasonably updated client or server would send or receive byte streams that Wireshark couldn’t properly display.<\/p>\n

I never wrote any dissector code before but I must say Wireshark didn’t disappoint. It was straight forward and mostly downright easy to fix most of the wrong details. I’m not pretending to be a master at this nor is the dissector code anywhere near “finished” yet but I still enjoyed the API and how to write a thing like this.<\/p>\n

I’ve since dissected plain-text http2 streams that I’ve done with curl+nghttp2 and I’ve also used the SSLKEYLOGFILE trick<\/a> with Firefox to automatically decrypt the TLS session and have the dissector figure out the underlying http2 parts.<\/p>\n

If there’s any little snag to mention, it is the fact that they insist on getting patches submitted directly to gerrit<\/a> instead of any mailing list or similar. This required me to create a gerrit account, and really figure out how to push my stuff from git to there, instead of the more traditional and simpler approach of just sending my patch to a mailing list or possibly submitting it to a bug\/patch tracker somewhere with my browser.<\/p>\n

Call me old-style but in fact the hip way of today with a pull-request github style would also have been much easier. Here’s what my gerrit submission<\/a> looks like. But I get it, gerrit does push a little more work over to the submitter and I figure that once a submitter such as myself finally has fixed all the nits in the patch it is very easy for the project to actually merge it. I actually got someone else to help me point out how to even find the link to view the code review after the first one was submitted on the site… (when I post this, my patch has not yet been accepted or merged into the wireshark git repo)<\/p>\n

Here’s a basic screenshot showing a trace of Firefox requesting https:\/\/nghttp2.org<\/a> using http2. Click it for the full thing.<\/p>\n

\"wireshark-screenshot\"<\/a><\/p>\n

.. and what happens this morning my time? There’s a brand new http2 draft-12<\/a> out with more changes on the on-the-wire format! Well to be honest, that really wasn’t a surprise. I’ll get the new stuff supported too, but I’ll do that in a separate patch as I prefer to hold off until I see a live stream by at least one implementation to test against.<\/p>\n","protected":false},"excerpt":{"rendered":"

Recently I cloned the Wireshark git repository and started updating the http2 dissector. That’s the piece of code that gets called to analyze a stream of data that Wireshark thinks is http2. The current http2 dissector was left at draft-09 state, while the current draft at the time was number 11 and there have been … Continue reading Wireshark dissector work<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[33,86,369,385],"class_list":["post-5684","post","type-post","status-publish","format-standard","hentry","category-floss","tag-curl-and-libcurl","tag-firefox","tag-http2","tag-wireshark"],"_links":{"self":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/5684","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/comments?post=5684"}],"version-history":[{"count":21,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/5684\/revisions"}],"predecessor-version":[{"id":5706,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/5684\/revisions\/5706"}],"wp:attachment":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/media?parent=5684"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/categories?post=5684"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/tags?post=5684"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}