Subject: [P2PSIP] Wireshark dissector

From: Marc Petit-Huguenin <[email-masked]>
Date: Thu, 27 May 2010 03:09:16 -0700

Hi,

We plan to work on an implementation of RELOAD but we want first to spend some
time sharpening our axe by implementing a Wireshark dissector for this protocol.
Is there someone already working on something similar?  Also is there existing
RELOAD implementers willing to test the dissector with their implementation?

Thanks.

- -- 
Marc Petit-Huguenin
Personal email: [email-masked]
Professional email: [email-masked]
Blog: http://blog.marc.petit-huguenin.org

---

From: jc <[email-masked]>
Date: Thu, 27 May 2010 15:04:22 -0400

Hi,
You don't need a working implementation to create a wireshark dissector for RELOAD. The PDU's are defined in draft.

Julian

On May 27, 2010, at 6:09 AM, Marc Petit-Huguenin wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi,
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> 
> iEYEARECAAYFAkv+RMsACgkQ9RoMZyVa61fbCwCbBzcMVFOX7nf1Ixmd1hdtcjR6
> QpAAn1m1Oqzhtb51YE2PZNVxGwKZSr8+
> =9EeE
> -----END PGP SIGNATURE-----
> _______________________________________________
> P2PSIP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/p2psip

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Thu, 27 May 2010 12:33:02 -0700

> You don't need a working implementation to create a wireshark dissector for RELOAD. The PDU's are defined in draft.

You mean that I have to actually read the specification to implement RELOAD?  I
hope there is some nice graphics and examples of PDU in it.

> RELOAD implementers willing to test the dissector with their implementation?

159cc63082bcb0fe4ac273ff84e7db274b6390f4

- -- 
Marc Petit-Huguenin

---

From: Michael Chen <[email-masked]>
Date: Fri, 28 May 2010 05:49:08 -0700

Marc,

Yes, you need to read the draft and create the dissector bit-by-bit. It 
will be a great contribution to the community if you can make it 
available to the group. Keep in mind that Wireshark will have to deal 
with D/TLS as man-in-the-middle. Good luck.

Thanks

--Michael

Marc Petit-Huguenin wrote:
> iEYEARECAAYFAkv+yOwACgkQ9RoMZyVa61cLhQCgjB/eGvQvVxa8OxYMoRzzfFWS
> 708AoKNKfVKHnyLPGUT19LX7/Pg5nsuC
> =ctF9

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Fri, 28 May 2010 05:52:57 -0700

On 05/28/2010 05:49 AM, Michael Chen wrote:
>>>> You don't need a working implementation to create a wireshark
>>>> dissector for RELOAD. The PDU's are defined in draft.
>>>>     
> 

*sigh*

echo -n "Yes, it's sarcasm" |sha1sum

- -- 
Marc Petit-Huguenin

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 28 May 2010 07:09:50 -0700

Marc knows this. He was being sarcastic.

FWIW, you don't need to be a MITM. You can passively decode D/TLS if you
have the server key. ssldump will do this, as, I believe will wireshark.

-Ekr

On Fri, May 28, 2010 at 5:49 AM, Michael Chen <[email-masked]> wrote:
> Marc,
>
> Yes, you need to read the draft and create the dissector bit-by-bit. It will
> be a great contribution to the community if you can make it available to the
> group. Keep in mind that Wireshark will have to deal with D/TLS as
> man-in-the-middle. Good luck.
>
> Thanks
>
> --Michael
>
>>> You don't need a working implementation to create a wireshark dissector
>>> for RELOAD. The PDU's are defined in draft.
>>>
>>
>> - -- Marc Petit-Huguenin

---

From: "Richard L. Barnes" <[email-masked]>
Date: Fri, 28 May 2010 10:13:14 -0400

I've definitely done it with IPsec/ESP using wireshark, not sure if it  
does [D]TLS as well.
--Richard

On May 28, 2010, at 10:09 AM, Eric Rescorla wrote:

> On Fri, May 28, 2010 at 5:49 AM, Michael Chen <[email-masked] 
> > wrote:
>> Marc,
>>
>>>> dissector
>>>> We plan to work on an implementation of RELOAD but we want first  
>>>> to spend
>>>> some
>>>> time sharpening our axe by implementing a Wireshark dissector for  
>>>> this
>>>> protocol.
>>>> Is there someone already working on something similar?  Also is  
>>>> there
>>>> existing

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Fri, 28 May 2010 08:04:38 -0700

> I've definitely done it with IPsec/ESP using wireshark, not sure if it

I know that it works fine for TLS, it's also possible to enter a key for DTLS,
but I never tried it.

>>>>>> We plan to work on an implementation of RELOAD but we want first to
>>>>>> spend
>>>>>> some

- -- 
Marc Petit-Huguenin