timeline

Here’s a structured development task breakdown for building a Wireshark C plugin that decodes payload data by calling an external API and displays it in the packet detail tree.

---

Project Scope

• Create a C-based dissector plugin for Wireshark.
• The plugin will:
  1. Detect packets matching a custom condition (e.g., specific IP/Port or protocol signature).
  2. Extract payload data from the packet.
  3. Send this data to an external REST API for decoding.
  4. Parse the API response and display it as hierarchical fields in the Wireshark packet detail tree.

---

Key Technical Considerations

• Wireshark’s dissector thread is not designed for blocking calls — calling an API directly inside packet dissection would freeze the UI.
  • Solution: Implement an asynchronous model:
    • Option 1: Maintain a local cache/database pre-filled from the API.
    • Option 2: Use a background thread to fetch API data, store in memory, and refresh the view when available.
• Database integration (optional) — store API results in SQLite/MySQL for faster lookups.

---

High-Level Architecture

1. Packet Matching

   • Register dissector for a specific TCP/UDP port or heuristic match.

2. Payload Extraction

   • Extract relevant bytes from packet.

3. API Call Mechanism

   • Use libcurl (or similar) for HTTP(S) request.
   • Run in a background worker thread to avoid blocking UI.

4. Data Caching

   • Use in-memory map (key: payload hash, value: decoded structure).

5. Tree Display

   • Parse API JSON/XML response.
   • Use proto_tree_add_string() / proto_tree_add_uint() to display fields.

---

Development Tasks & Estimates

Task	Description	Est. Effort
1. Environment Setup	Install Wireshark source, build environment, CMake setup, test custom build.	1 day
2. Protocol/Port Registration	Create a skeleton dissector that hooks into a specific port or heuristic.	0.5 day
3. Payload Extraction Logic	Identify and extract relevant packet payload bytes.	1 day
4. API Integration Layer	Implement libcurl-based async HTTP request handler in C.	2 days
5. Response Parsing	Parse JSON/XML using cJSON or libxml2.	1.5 days
6. Tree Display Integration	Map parsed API data to Wireshark protocol tree fields.	1 day
7. Thread-Safe Caching	Store API responses in memory for reuse.	1 day
8. Error Handling & Fallbacks	Handle API failures, timeouts, and partial results.	0.5 day
9. Testing with PCAPs	Verify correct detection, API calls, and UI display.	1 day
10. Packaging & Documentation	Build plugin .so/.dll, write usage instructions.	0.5 day

---

Timeline

Assuming 1 developer, Full Time:

Week	Milestones
Week 1	Environment setup, dissector skeleton, payload extraction
Week 2	API integration, async handling, JSON/XML parsing
Week 3	Tree integration, caching, error handling
Week 4	Testing, optimizations, packaging, documentation

Total Estimation: ~ 4 weeks (20 working days)

---

Risks & Mitigation

• UI Freeze Risk → Avoid direct API calls in the dissector; use background thread or prefetch.
• Network Dependency → Optionally implement offline cache for PCAP replay.
• API Latency → Tree may display “Fetching…” until data arrives.

---

If you want, I can create a C plugin template that already includes:

• TCP dissector registration
• libcurl HTTP GET call
• JSON parsing
• Example Wireshark tree output

That would speed development by ~1 week.