Wireshark code analysis

The application layer protocol must be recognized. Wireshark can be used.

SpecificCodeUsage reference:
Wireshark 1.6.5 depends on Winpcap 4.1.2

 

Wireshark Winpcap differences

Winpcap is a packet capture link layer.Program, Working in parallel with the TCP/IP protocol stack]

Wireshark analyzes data packets and implements multiple protocols and plug-in structure to facilitate expansion.

 

Compilation Method

Developer-guide-us.pdf is the development documentation, read it before using

1、wireshark-win32-libs-1.6.rar: it is a variety of third-party libraries. By default, compilation requires networking.
Offline solution: Put content under c: \ wireshark-win32-libs-1.6

2. Modify WiresharkSource codeUse vs2010 for config. nmake in the package

3. Enter the vs command line to compile nmake-F makefile. nmake all.
Distclean

Clear
Verify_tools check dependent Libraries

 

Tracking Method

The default compilation result is in the C: \ Wireshark \ wireshark-gtk2 directory, wireshark.exe is the main program

1 worker run wireshark.exe

2. Attach the process to.
3. Set a breakpoint in the code to enter

 

Code Description

The default c: \ Wireshark \ epan \ dissectors is the parsing code of various protocols.
Protocol Parsing is based on the tree-like plug-in structure.

For example, HTTP MySQL is based on TCP, it first enters the packet-tcp.c and then enters the packet-mysql.c

Reference

Http://blog.sina.com.cn/s/blog_6d42182e0100z1w1.html

Http://www.wisestudy.cn/opentech/opentech_wireshark_codeanalysis.html

Http://code.google.com/p/wiresharkplugin/