1

In WinHex, I can use the Data Interpreter tool to see the numeric interpretation of data starting from the currently selected byte. This considerably simplifies the initial analysis of the data structures.

enter image description here

Is there a similar way to quickly lookup basic type values in Wireshark without having to define or export the underlying data structures first?

1 Answer 1

2

In a word: no.

Wireshark's design includes the fundamental notion of a dissector. Each dissector is responsible for the interpretation of streams of bytes according the the corresponding protocol, so an IEEE 802.3 frame, for instance, is correctly broken into its constituent pieces based on the definitions in that standard.

However, it is possible (and encouraged!) to write one's own dissectors and to contribute them to the project, so one can imagine writing a dissector that would present the data somewhat in the manner you've described. Because the typical dissector interprets each byte in only one way, a dissector for the purpose you describe would have to be a little different than the usual, but not impossible.

Another possibility would be to add a Lua extension. Recent versions of Wireshark incorporate a Lua interpreter and Lua scripts have access to the underlying data.

Although I've written both dissectors and Lua scripts, my own experience is much more with dissectors than scripts; for that reason, I'd probably attempt this as a dissector if I were to write it.

Another option would be to export the raw binary for particular packets and then use either WinHex or a more specific tool such as Netzob to aid in reverse engineering the protocol.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.