ayyaruq / ffxiv-dissector

A Wireshark dissector for the FFXIV wire protocol

FFXIV Wireshark Dissector

This dissector splits FFXIV frames and reassembles messages to assist in debugging the FFXIV wire protocol.

Compilation

To compile the shared library, simply run the following:

$ mkdir build && cd build
$ cmake ..
$ make

To install into ${HOME}/.wireshark/plugins, run:

$ make install

For debugging with GDB or LLDB, use cmake -DCMAKE_BUILD_TYPE=Debug .. instead.

On Linux and MacOS, you will need to have Wireshark installed with the epan headers. For building on Windows, I have no idea. Building a static library is currently possible but I'm terrible at CMake so, good luck.

TODO

• type matching for battle, market, fishing, etc message types
• heuristic protocol detection (currently uses a giant protocol range)
• unit testing
• more useful filtering
• colourisation

Help

For feature requests and debugging, please open a GitHub issue and tag appropriately. For questions about new functionality you'd like to add or how something in particular works, open an issue or find @acchan#4976 on Discord. If you need help with Wireshark itself, please read upstream documentation. This dissector is intended to assist developers and shouldn't be used by the general public for parsing data in realtime or otherwise.

Contributing

1. Fork it ( https://github.com/ayyaruq/ffxiv-dissector/fork )
2. Create your feature branch (git checkout -b my-new-feature)
3. Commit your changes (git commit -am 'Add some feature')
4. Push to the branch (git push origin my-new-feature)
5. Create a new Pull Request

ffxiv-dissector's Issues

Frame timestamp doesn't show valid time

Frame timestamps don't show as time but rather strings. When coerced into timestamps, they're wrong. It looks like they're using epoch without milliseconds. This may be fixed with Wireshark 2.2.7 (currently in RC) or 2.3.0 (untested) but isn't in 2.2.6 which is the default version in OSX and Windows yet.

Basic automated testing

Hookup Travis or alternatives with Windows/Mac/Linux support (options?) to at least build and compile with clang and gcc, and maybe msvc on pull requests and master commits. Some contributor feedback for pull requests in general could be good too.

• compile and verify on each platform with multiple compilers for PR and branch commits
• code style verification for PR
• pcap replay tests for PR and master commits

Verify Stormblood Support

Verify if anything is broken and coordinate fixes if required. Only really relevant to the top level frame and message format parsing than actual messages.

heartbeat messages are only 24bytes in length

therefore they are skipped in dissect_message and with the changes in #2 the following messages in the frame got discarded. Should either cut the messages before processing them in dissect_message or do some extra check in it.