Cool !


- The rootfield is different between the request and response. Is there any way to have Unsniff use a different root field for the response vs the request? Perhaps using two different protocols?


Can you use a wrapper , so we have only one root field ?

We use protobuf in one of our products and that is what we do. A sample




Thanks,

Vivek

Unfortunately, this is not our protocol so we can't change it. Its being used for communication between many companies.

Any other ideas?

Scott,

Try the new build 1.8.0.1424. I added an option that allows you two specify two separate protocols to decode POST requests and responses (when content-type is application/octet-stream).

1. Copy the generic-protobuf.xml file to something like generic-protobuf-response.xml. (Actually the filenames do not matter, Unsniff will read in all XML files placed in the XMLplugs directory). SO feel free the change the filenames to something better.

2. Change the protid in the new file to something else. You can just change a few hex digits by hand or use an online GUID generator. Also specify the proto file and root field.

3. Go to Plugins : Customize and enter the new protocol id in the "Response protocol..." option.



Cheers

Thanks Vivek,

It seems to be working fine for responses now but requests are not being decoded anymore.

When I leave the response protoid blank under customize, the requests just have MY-PBUF under type but GBUF doesn't expand into values like it did before.

GBUF2 (the shortname of the response xml file) does expand for the responses though when I re-add the 2nd protid under response protocol.

Scott,

My first guess would be that the root field for responses and requests may be different. You may have to update the xml files to reflect the correct root field names.

If that does not work, then can you do this :

1. Open the log window, via View > Log Window
2. Import the file
3. Click on the requests and response PDUs

Copy paste any errors here.

Thanks,

The root fields are set correctly I believe (they are different).

I am getting the following error when I click on the protobuf request:

# 01-27-2010 16:12:33 0000035c 00000000 [GPBUF] [0x8004030d] UAPI PushField: FieldID was not found in the set of defined fields 0
# 01-27-2010 16:12:33 0000035c 00000000 [GPBUF] [0x8004030d] UAPI BreakoutFields [ Details ]: [0x80040321] Error adding field (ID = 0)