Unleash Networks Forum :: Topic: Protobuf filter and HTTP headers (2/3)

Welcome, Guest

TOPIC: Protobuf filter and HTTP headers

Re:Protobuf filter and HTTP headers 14 years 4 months ago #257

vivek [unleash]
OFFLINE
Karma: 3

Cool !

- The rootfield is different between the request and response. Is there any way to have Unsniff use a different root field for the response vs the request? Perhaps using two different protocols?

Can you use a wrapper , so we have only one root field ?

We use protobuf in one of our products and that is what we do. A sample

message TRPMessage
{
    optional HelloRequest=1,
    optional HelloResponse=2,
    optional CounterGroupInfoRequest=3,
    optional CounterGroupInfoResponse=4,
..
..

}

Thanks,

Vivek

Vivek R
Unleash Networks
Support : www.unleashnetworks.com/forums

The administrator has disabled public write access.

Re:Protobuf filter and HTTP headers 14 years 4 months ago #258

scottbecker OFFLINE Karma: 0	Unfortunately, this is not our protocol so we can't change it. Its being used for communication between many companies. Any other ideas?
	The administrator has disabled public write access.

Re:Protobuf filter and HTTP headers 14 years 4 months ago #259

vivek [unleash]
OFFLINE
Karma: 3

Scott,

Try the new build 1.8.0.1424. I added an option that allows you two specify two separate protocols to decode POST requests and responses (when content-type is application/octet-stream).

1. Copy the generic-protobuf.xml file to something like generic-protobuf-response.xml. (Actually the filenames do not matter, Unsniff will read in all XML files placed in the XMLplugs directory). SO feel free the change the filenames to something better.

2. Change the protid in the new file to something else. You can just change a few hex digits by hand or use an online GUID generator. Also specify the proto file and root field.

3. Go to Plugins : Customize and enter the new protocol id in the "Response protocol..." option.

Cheers

Vivek R
Unleash Networks
Support : www.unleashnetworks.com/forums

The administrator has disabled public write access.

Re:Protobuf filter and HTTP headers 14 years 4 months ago #260

scottbecker OFFLINE Karma: 0	Thanks Vivek, It seems to be working fine for responses now but requests are not being decoded anymore. When I leave the response protoid blank under customize, the requests just have MY-PBUF under type but GBUF doesn't expand into values like it did before. GBUF2 (the shortname of the response xml file) does expand for the responses though when I re-add the 2nd protid under response protocol.
	The administrator has disabled public write access.

Re:Protobuf filter and HTTP headers 14 years 4 months ago #261

vivek [unleash] OFFLINE Karma: 3	Scott, My first guess would be that the root field for responses and requests may be different. You may have to update the xml files to reflect the correct root field names. If that does not work, then can you do this : 1. Open the log window, via View > Log Window 2. Import the file 3. Click on the requests and response PDUs Copy paste any errors here. Thanks,
	Vivek R Unleash Networks Support : www.unleashnetworks.com/forums The administrator has disabled public write access.

Re:Protobuf filter and HTTP headers 14 years 2 months ago #264

scottbecker
OFFLINE
Karma: 0

The root fields are set correctly I believe (they are different).

I am getting the following error when I click on the protobuf request:

# 01-27-2010 16:12:33 0000035c 00000000 [GPBUF] [0x8004030d] UAPI PushField: FieldID was not found in the set of defined fields 0
# 01-27-2010 16:12:33 0000035c 00000000 [GPBUF] [0x8004030d] UAPI BreakoutFields [ Details ]: [0x80040321] Error adding field (ID = 0)

The administrator has disabled public write access.

Forum

Unleash Networks Forums

Unsniff Users

Protobuf filter and HTTP headers