Subject: [Roll] RPL Dissectors for Wireshark

From: "Colin O'Flynn" <[email-masked]>
Date: Fri, 1 Oct 2010 14:43:23 +0100

Hello,

I had the beginnings of RPL-11 dissectors for Wireshark. The patch is
available at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5266 , and
if anyone is able to use it I would appreciate feedback of any issues you
find. I don't think it is complete yet so don't expect every feature to be
present.

If there is nothing critical I could see if it can be committed into
Wireshark SVN, which would eventually make it part of a normal release.

If you require Windows builds I have one at
www.newae.com/15dot4tools/wireshark-win32-1.5.0-OFLYNN-P5266.zip .

Regards,

  -Colin

---

From: Alexandru Petrescu <[email-masked]>
Date: Fri, 01 Oct 2010 16:56:42 +0200

Any packet dumps to exercise the filters? (display RPL packets)

Alex

Le 01/10/2010 15:43, Colin O'Flynn a écrit :
>  available at
> https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5266 , and if
> anyone is able to use it I would appreciate feedback of any issues
> you find. I don’t think it is complete yet so don’t expect every
> feature to be present.
>
> www.newae.com/15dot4tools/wireshark-win32-1.5.0-OFLYNN-P5266.zip
> <http://www.newae.com/15dot4tools/wireshark-win32-1.5.0-OFLYNN-P5266.zip>
> .
>
> Regards,
>
> -Colin
>
>
>
> _______________________________________________ Roll mailing list
> [email-masked] https://www.ietf.org/mailman/listinfo/roll

---

From: "Colin O'Flynn" <[email-masked]>
Date: Fri, 1 Oct 2010 16:12:19 +0100

There is one attached to the bug report on Wireshark's Bugzilla. 

I realized that patch is mostly RPL-10 and not RPL-11 so I'll fix that...

  -Colin

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Alexandru Petrescu
Sent: October 1, 2010 3:57 PM
To: [email-masked]
Subject: Re: [Roll] RPL Dissectors for Wireshark

Alex

> [email-masked] https://www.ietf.org/mailman/listinfo/roll

_______________________________________________
Roll mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/roll

---

From: Alexandru Petrescu <[email-masked]>
Date: Fri, 01 Oct 2010 17:18:17 +0200

> I realized that patch is mostly RPL-10 and not RPL-11 so I'll fix

That is fine don't worry.  I have to look at the packets closer.

What I want to know is the order: should I first patch the wireshark?
If I patch the wireshark and look at the dump may I see IP packets?

BEcause when I click the example capture that demonstrates the new patch
(without wireshark being patched)
https://bugs.wireshark.org/bugzilla/attachment.cgi?id=5244

it shows only non-IP packets.

Is it normal?

If I patch then will I see IP packets?

Alex

>
> -Colin
>
> -----Original Message----- From: [email-masked]
> [mailto:[email-masked]] On Behalf Of Alexandru Petrescu Sent:
> October 1, 2010 3:57 PM To: [email-masked] Subject: Re: [Roll] RPL
> Dissectors for Wireshark
>
>> I had the beginnings of RPL-11 dissectors for Wireshark. The patch
>> is available at
>> If there is nothing critical I could see if it can be committed
>> into Wireshark SVN, which would eventually make it part of a
>> normal release.
>>
.

---

From: "Colin O'Flynn" <[email-masked]>
Date: Fri, 1 Oct 2010 16:22:24 +0100

Hello,

It 'should' work, assuming you've enable the special 802.15.4 'cheat' under
edit->preferences->IEEE 802.15.4 and ensure you see the line:

"802.15.4 Ethertype (in hex): 809a"

If you see nothing or some other value than 809a, put 809a in there.

Also check under "Analyze->Enabled Protocols" for "IEEE 802.15.4" and
"6lowpan" as both being enabled.

If you have a very old version of Wireshark it won't have that mentioned
cheat in it. If you don't have a very new version of Wireshark you might not
have proper 6lowpan support either. The best bet is a new build...

Regards,

  -Colin

-----Original Message-----
From: Alexandru Petrescu [mailto:[email-masked]] 
Sent: October 1, 2010 4:18 PM
To: Colin O'Flynn
Cc: [email-masked]
Subject: Re: [Roll] RPL Dissectors for Wireshark

Is it normal?

Alex

.

---

From: "Colin O'Flynn" <[email-masked]>
Date: Fri, 1 Oct 2010 17:48:02 +0100

Just a note the patch, example test-case, and binary at that same link have
all been updated just now.

  -Colin

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Colin O'Flynn
Sent: October 1, 2010 2:43 PM
To: [email-masked]
Subject: [Roll] RPL Dissectors for Wireshark

Hello,

Regards,

  -Colin

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 06 Oct 2010 17:06:20 +0200

Wonderful, I've just downloaded the patched wireshark and saw first time 
RPL messages - thanks.

The URLs as you say are:

http://www.newae.com/15dot4tools/wireshark-win32-1.5.0-OFLYNN-P5266.zip

Packet dumps:
https://bugs.wireshark.org/bugzilla/attachment.cgi?id=5252
https://bugs.wireshark.org/bugzilla/attachment.cgi?id=5248

Alex

Le 01/10/2010 18:48, Colin O'Flynn a écrit :
> Just a note the patch, example test-case, and binary at that same link
> have all been updated just now.
>
> -Colin
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *Colin O'Flynn
> *Sent:* October 1, 2010 2:43 PM
> *To:* [email-masked]
> *Subject:* [Roll] RPL Dissectors for Wireshark
>
> Hello,
>
> available at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5266 ,
> and if anyone is able to use it I would appreciate feedback of any
> issues you find. I don’t think it is complete yet so don’t expect every
> feature to be present.
>
> <http://www.newae.com/15dot4tools/wireshark-win32-1.5.0-OFLYNN-P5266.zip> .
>
> Regards,
>
> -Colin
>
>
>

---

From: "Colin O'Flynn" <[email-masked]>
Date: Wed, 20 Oct 2010 10:06:10 +0100

Hello,

The RPL dissectors have now been committed to Wireshark SVN (revision
34579). If you want RPL dissectors you now need to just get version 34759 or
later from http://www.wireshark.org/download/automated . Eventually this
will thus become part of the standard Wireshark release.

The dissectors currently support the following:

Messages:

*DIO Messages

*DIS Messages

*DAO Messages

*DAO-ACK Messages

Options:

                *Pad1

                *PadN

                *Routing Information

                *DODAG Config

                *RPL Target

                *Transit Information

                *Solicited Information

                *Prefix Information

                *RPL Target Descriptor

Thanks to Owen Kirby for his help in getting these started & finished.

Regards,

  -Colin O'Flynn

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Colin O'Flynn
Sent: October 1, 2010 5:48 PM
To: [email-masked]
Subject: Re: [Roll] RPL Dissectors for Wireshark

  -Colin

Hello,

Regards,

  -Colin

---

From: "Cedric Chauvenet" <[email-masked]>
Date: Wed, 20 Oct 2010 14:25:23 +0200

Hi Colin, 

That's an excellent piece of work !

I noticed that all RPL Control Message Option where implemented, except the "Metric Container" option (Section 6.7.4 of RPL draft-11).

Any reason for that ? Plan to add it ?

Thank's again for this achievment.

Regards,
Cédric. 

  ----- Original Message ----- 
  From: Colin O'Flynn 
  To: [email-masked] 
  Sent: Wednesday, October 20, 2010 11:06 AM
  Subject: Re: [Roll] RPL Dissectors for Wireshark

  Hello,

  The RPL dissectors have now been committed to Wireshark SVN (revision 34579). If you want RPL dissectors you now need to just get version 34759 or later from http://www.wireshark.org/download/automated . Eventually this will thus become part of the standard Wireshark release.

  Messages:

  *DIO Messages

  *DIS Messages

  *DAO Messages

  *DAO-ACK Messages

  Options:

                  *Pad1

                  *PadN

                  *Routing Information

                  *DODAG Config

                  *RPL Target

                  *Transit Information

                  *Solicited Information

                  *Prefix Information

                  *RPL Target Descriptor

  Regards,

    -Colin O'Flynn

  From: [email-masked] [mailto:[email-masked]] On Behalf Of Colin O'Flynn
  Sent: October 1, 2010 5:48 PM
  To: [email-masked]
  Subject: Re: [Roll] RPL Dissectors for Wireshark

  Just a note the patch, example test-case, and binary at that same link have all been updated just now.

    -Colin

  From: [email-masked] [mailto:[email-masked]] On Behalf Of Colin O'Flynn
  Sent: October 1, 2010 2:43 PM
  To: [email-masked]
  Subject: [Roll] RPL Dissectors for Wireshark

  Hello,

  I had the beginnings of RPL-11 dissectors for Wireshark. The patch is available at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5266 , and if anyone is able to use it I would appreciate feedback of any issues you find. I don't think it is complete yet so don't expect every feature to be present.

  If there is nothing critical I could see if it can be committed into Wireshark SVN, which would eventually make it part of a normal release.

  If you require Windows builds I have one at www.newae.com/15dot4tools/wireshark-win32-1.5.0-OFLYNN-P5266.zip .

  Regards,

    -Colin

------------------------------------------------------------------------------

---

From: "Colin O'Flynn" <[email-masked]>
Date: Wed, 20 Oct 2010 13:37:17 +0100

Hi Cedric,

The metric container really doesn’t have anything in it according to RPL-12,
so there’s nothing to decode. I think the dissectors will actually display
the metric container as a “Metric Container” option, but don’t decode it any
further.

Eventually the containers from the metrics ID could be added to give you
useful information.

  -Colin

From: Cedric Chauvenet [mailto:[email-masked]] 
Sent: October 20, 2010 1:25 PM
To: Colin O'Flynn; [email-masked]
Subject: Re: [Roll] RPL Dissectors for Wireshark

Hi Colin, 

I noticed that all RPL Control Message Option where implemented, except the
"Metric Container" option (Section 6.7.4 of RPL draft-11).

Regards,

Cédric. 

----- Original Message ----- 

From: Colin O'Flynn 

To: [email-masked] 

Hello,

Messages:

*DIO Messages

*DIS Messages

*DAO Messages

*DAO-ACK Messages

Options:

                *Pad1

                *PadN

                *Routing Information

                *DODAG Config

                *RPL Target

                *Transit Information

                *Solicited Information

                *Prefix Information

                *RPL Target Descriptor

Regards,

  -Colin O’Flynn

  -Colin

Hello,

I had the beginnings of RPL-11 dissectors for Wireshark. The patch is
available at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5266 , and
if anyone is able to use it I would appreciate feedback of any issues you
find. I don’t think it is complete yet so don’t expect every feature to be
present.

Regards,

  -Colin

  _____

---

From: "Cedric Chauvenet" <[email-masked]>
Date: Thu, 21 Oct 2010 10:18:37 +0200

Hi Colin,

You're right, the Metric Container option is just a classic TLV option, and the relevancy of it is mostly related to the routing-metrics draft, rather than rpl.

Was just a comment.

Cédric
  ----- Original Message ----- 
  From: Colin O'Flynn 
  To: 'Cedric Chauvenet' ; [email-masked] 
  Sent: Wednesday, October 20, 2010 2:37 PM
  Subject: RE: [Roll] RPL Dissectors for Wireshark

  Hi Cedric,

  The metric container really doesn't have anything in it according to RPL-12, so there's nothing to decode. I think the dissectors will actually display the metric container as a "Metric Container" option, but don't decode it any further.

  Eventually the containers from the metrics ID could be added to give you useful information.

    -Colin

  Hi Colin, 

  Regards,

  Cédric. 

    ----- Original Message ----- 

    From: Colin O'Flynn 

    To: [email-masked] 

    Hello,

    Messages:

    *DIO Messages

    *DIS Messages

    *DAO Messages

    *DAO-ACK Messages

    Options:

                    *Pad1

                    *PadN

                    *Routing Information

                    *DODAG Config

                    *RPL Target

                    *Transit Information

                    *Solicited Information

                    *Prefix Information

                    *RPL Target Descriptor

    Regards,

      -Colin O'Flynn

      -Colin

    Hello,

    Regards,

      -Colin

----------------------------------------------------------------------------