Hacker News new | ask | show | jobs
by tptacek 5237 days ago
How does a network admin debug a binary protocol for which no dissector has been implemented/merged into core for Wireshark, and no decoder has been written for tcpdump?

It's obviously doable, but it's very painful.

3 comments

Isn't Wireshark extensible in Lua?

I can see both sides of the argument here, but basing a protocol on text just for the ease of eyeballing it on-the-wire seems like optimizing for the uncommon case.

Heck, almost any decent protocol should only have ciphertext on-the-wire anyway.

That's more or less like saying "well they can just write the decode". They're network administrators. If you use an ASCII protocol, they don't have to do anything.
I'm saying someone can write the decode and share it on their blog post or Github and your admin can start using it without having to recompile Wireshark. (I think, haven't actually tried it myself).

But even still, this only matters if:

A. The protocol is so new that Wireshark isn't shipping a parser,

B. the admin's stuff isn't working,

C. the admin can't get his stuff working by normal troubleshooting and must resort to observing the protocol,

D. the admin can't get his stuff working by observing the binary representation of the protocol, and

E. the admin actually can get his stuff working with a transliterated ASCII representation of the protocol.

Certainly I would probably find it easier to troubleshoot a text-based protocol too. I just think it's a relatively minor case in the grand scheme of things.

How does a sysadmin debug a binary application for which he doesn't have any symbols?
On the other hand, are Wireshark and tcpdump now the gatekeepers for new protocols?
What's your point? I'm not making a value judgement.
You say that to me a lot.

My point is that I imagine a network designer shouldn't focus on Wireshark or tcpdump integration over other non-functional requirements such as, well, network performance.

Network performance isn't as visible as the non-functional requirement of inspectability because it is amortised over potentially millions of machines, whereas inspectability is an immediately visible issue to the select few who "pop the hood" to fix an issue or simply to have a look.

For example: in terms of network capacity, I wonder how much HTTP headers cost all of us collectively. Probably a lot more than the cost of making a Wireshark plugin and having sysadmins install it as necessary.

Edit: put another way, I think designers should prioritise the needs of the people who pay the cost of network operation over the convenience of the operators.

There's a feedback loop here -- if it's too hard and thus very expensive to operate a system, then optimising for performance was a false win. But I don't think this is such a case, especially since as you pointed out elsewhere there are a number of very mature binary wire formats that were extant in 2007.

See: http://cr.yp.to/sarcasm/modest-proposal.txt

"I implore [you] to remember Dave and Virginia, preying on the drug addicts of the next generation and the sexually dissatisfied men of the previous generation. How different their careers could have been if their parents had not downloaded so many terabytes of data! We must not abandon our children to such a fate."