Hi,
I've recently been spending some time working with netlink/wireshark.
More precisely with a out-of-tree generic netlink protocol: the
multipath TCP netlink path manager.
I was surprised to see next to the generic netlink family id the name
of the family "mptcp" in wireshark.I've had a look at the code yet I
couldn't figure how it got the mapping from a number to the family
name.
I happen to unload/reload the linux kernel module in charge of this
netlink family, thus its id keeps changing (visible via `genl ctrl
list`). I have a lua script in charge of decoding this custom protocol
which is attached like this
====
netlink_table = DissectorTable.get("genl.family")
local ret = netlink_table:add("mptcp", mptcp_proto)
=====
but once I reload the module, wireshark is unable to map the family
name "mptcp" to the id, so my dissector is never used.
What would you recommand me to work around this ? Would there be
interest in having a C/lua plugin to do the mapping (either via
netlink or by scraping genl ctrl list) ?
Best regards
Matt