-
Notifications
You must be signed in to change notification settings - Fork 887
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add auxiliary stuff for the COTP protocol #2188
Comments
@IvanNardi @utoni What do you think about it? |
If I understood that correctly, you want to call a certain dissector after another protocol dissector at a lower layer successfully classified the flow, right? That was the initial idea of the "subprotocol" thingy, that I've added a few months (or years? O.o) ago. |
Yea. |
I dunno if it would be correct to call encapsulated stuff a sub-protocols (for me it's kind of like HTTP Live Streaming) in that case, since COTP is a transport protocol, even though in today's world it runs on top of the another transport protocol - TCP. 😄 |
Just to understand the scope of this issue...
In all these cases the identification of the COTP "sub-protocol" is very trivial, basically checking only a few bytes How many others cases do you think we will have? |
Atm I'm working on IEC 61850 MMS protocol dissector, which like some other ICS protocols runs on top of the ISO stack. There's also an IEC 60870-6 TASE.2, but this is more of a special case of MMS. Well, I'm sure there'll be something else. |
In think that we have a few options:
I don't have strong opinions and I am fine with all these options. |
Hmm, option 2 seems the most optimal to me. |
I am also fine with option 2. |
Yeah, that's definitely worth keeping. There are many protocols working on top of HTTP (IPP for example), so I think the subprotocols feature is great for such cases. |
+1 |
Is your feature request related to a problem? Please describe.
I don't think this is a problem now, just wanna suggest a small improvement that will make the code of dissectors of COTP-encapsulated protocols cleaner and easier to understand.
Describe the solution you'd like
Idk, maybe it is worth to add a COTP protocol dissector to replace copypasted TPKT and COTP header checks in the new and existing dissectors with something like this:
if (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_COTP) { do_something(); }
and add to
ndpi_packet_struct
the most frequently checked COTP header fields like these:Additional context
Well, if it's possible to implement, I could give it a try.
The text was updated successfully, but these errors were encountered: