{"action":"created","issue":{"url":"https://api.github.com/repos/Ettercap/ettercap/issues/741","repository_url":"https://api.github.com/repos/Ettercap/ettercap","labels_url":"https://api.github.com/repos/Ettercap/ettercap/issues/741/labels{/name}","comments_url":"https://api.github.com/repos/Ettercap/ettercap/issues/741/comments","events_url":"https://api.github.com/repos/Ettercap/ettercap/issues/741/events","html_url":"https://github.com/Ettercap/ettercap/issues/741","id":162881820,"number":741,"title":"Dissector \"atexit\" functionality","user":{"login":"magnumripper","id":1268598,"avatar_url":"https://avatars.githubusercontent.com/u/1268598?v=3","gravatar_id":"","url":"https://api.github.com/users/magnumripper","html_url":"https://github.com/magnumripper","followers_url":"https://api.github.com/users/magnumripper/followers","following_url":"https://api.github.com/users/magnumripper/following{/other_user}","gists_url":"https://api.github.com/users/magnumripper/gists{/gist_id}","starred_url":"https://api.github.com/users/magnumripper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/magnumripper/subscriptions","organizations_url":"https://api.github.com/users/magnumripper/orgs","repos_url":"https://api.github.com/users/magnumripper/repos","events_url":"https://api.github.com/users/magnumripper/events{/privacy}","received_events_url":"https://api.github.com/users/magnumripper/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2016-06-29T09:36:47Z","updated_at":"2016-07-28T07:36:18Z","closed_at":null,"body":"I'm working with enhancements to the o5logon dissector. It collects various packets where some of the data is optional so might not be seen at all (eg. stealth scans against Oracle 11G) but is mandatory if present (eg. Oracle 12G auth). In that case, I need to print the partial data we did collect. \r\nI guess I can add trivial logic to detect a TCP tear-down and implement it for that case.\r\n\r\nHowever, I'd also want some kind of \"catch EOF\" functionality (callback, macro, whatever) so any remaining sessions [that have enough data] can be printed on EOF or end-of-sniff - a bit like atexit() if you wish. That'd also mean a need for something like `dissect_getnext()` to iterate over the sessions that remains.\r\n\r\nOr put another way: I have this function:\r\n```c\r\nFUNC_DECODER(dissector_o5logon)\r\n{\r\n      (...)\r\n      dissect_create_session(&s, PACKET, DISSECT_CODE(dissector_o5logon));\r\n      (...)\r\n      if (condition) {\r\n          (...)\r\n          dissect_wipe_session(PACKET, DISSECT_CODE(dissector_o5logon));\r\n      }\r\n}\r\n```\r\n\r\nI reckon I'd need something like this too:\r\n```c\r\nFUNC_DECODER_EOF(dissector_o5logon)\r\n{\r\n      /* iterate through remaining sessions and process them */\r\n      while (dissect_get_next_session(&s)) {\r\n          (...)\r\n          dissect_wipe_session_from_ptr(&s);\r\n      }\r\n}\r\n```\r\nIs this possible to achieve somehow already in some other way?\r\n"},"comment":{"url":"https://api.github.com/repos/Ettercap/ettercap/issues/comments/235821758","html_url":"https://github.com/Ettercap/ettercap/issues/741#issuecomment-235821758","issue_url":"https://api.github.com/repos/Ettercap/ettercap/issues/741","id":235821758,"user":{"login":"magnumripper","id":1268598,"avatar_url":"https://avatars.githubusercontent.com/u/1268598?v=3","gravatar_id":"","url":"https://api.github.com/users/magnumripper","html_url":"https://github.com/magnumripper","followers_url":"https://api.github.com/users/magnumripper/followers","following_url":"https://api.github.com/users/magnumripper/following{/other_user}","gists_url":"https://api.github.com/users/magnumripper/gists{/gist_id}","starred_url":"https://api.github.com/users/magnumripper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/magnumripper/subscriptions","organizations_url":"https://api.github.com/users/magnumripper/orgs","repos_url":"https://api.github.com/users/magnumripper/repos","events_url":"https://api.github.com/users/magnumripper/events{/privacy}","received_events_url":"https://api.github.com/users/magnumripper/received_events","type":"User","site_admin":false},"created_at":"2016-07-28T07:36:17Z","updated_at":"2016-07-28T07:36:17Z","body":"There are such cases in the already linked samples but I'll try to create isolated test cases for you."}}
{"actor":{"display_login":"magnumripper"}}