Add expert info when Modbus/TCP packet can't be classified.

The common case for this is using Decode As over the Modbus/TCP port preference.  Here the port preference is used to determine request/response because the protocol itself doesn't have any indications (so Decode As can't be helpful).  Looking into the packet itself can lead to too many false positives.

Bug: 10933
Change-Id: Ic6b4304f062f55ff273105edbb0d272c30e53506
Reviewed-on: https://code.wireshark.org/review/15127
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

1 files changed, 14 insertions, 0 deletions

diff --git a/epan/dissectors/packet-mbtcp.c b/epan/dissectors/packet-mbtcp.c
index 2cb213f8cb..f04a6f14b4 100644
--- a/epan/dissectors/packet-mbtcp.c
+++ b/epan/dissectors/packet-mbtcp.c
@@ -158,6 +158,7 @@ static gint ett_device_id_object_items = -1;
 
 static expert_field ei_mbrtu_crc16_incorrect = EI_INIT;
 static expert_field ei_modbus_data_decode = EI_INIT;
+static expert_field ei_mbtcp_cannot_classify = EI_INIT;
 
 static dissector_handle_t modbus_handle;
 static dissector_handle_t mbtcp_handle;
@@ -497,6 +498,9 @@ dissect_mbtcp_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* dat
             len+6, "Modbus/TCP");
     mbtcp_tree = proto_item_add_subtree(mi, ett_mbtcp);
 
+    if (packet_type == CANNOT_CLASSIFY)
+        expert_add_info(pinfo, mi, &ei_mbtcp_cannot_classify);
+
     /* Add items to protocol tree specific to Modbus/TCP */
     proto_tree_add_uint(mbtcp_tree, hf_mbtcp_transid, tvb, offset, 2, transaction_id);
     proto_tree_add_uint(mbtcp_tree, hf_mbtcp_protid, tvb, offset + 2, 2, protocol_id);
@@ -1556,6 +1560,13 @@ proto_register_modbus(void)
         },
     };
 
+    static ei_register_info mbtcp_ei[] = {
+        { &ei_mbtcp_cannot_classify,
+          { "mbtcp.cannot_classify", PI_PROTOCOL, PI_WARN,
+            "Cannot classify packet type. Try setting Modbus/TCP Port preference to this destination or source port", EXPFILL }
+        },
+    };
+
     /* Modbus RTU header fields */
     static hf_register_info mbrtu_hf[] = {
         { &hf_mbrtu_unitid,
@@ -1898,6 +1909,7 @@ proto_register_modbus(void)
     module_t *mbtcp_module;
     module_t *mbrtu_module;
     module_t *modbus_module;
+    expert_module_t* expert_mbtcp;
     expert_module_t* expert_mbrtu;
     expert_module_t* expert_modbus;
 
@@ -1920,6 +1932,8 @@ proto_register_modbus(void)
     proto_register_field_array(proto_mbrtu, mbrtu_hf, array_length(mbrtu_hf));
     proto_register_field_array(proto_modbus, hf, array_length(hf));
     proto_register_subtree_array(ett, array_length(ett));
+    expert_mbtcp = expert_register_protocol(proto_mbtcp);
+    expert_register_field_array(expert_mbtcp, mbtcp_ei, array_length(mbtcp_ei));
     expert_mbrtu = expert_register_protocol(proto_mbrtu);
     expert_register_field_array(expert_mbrtu, mbrtu_ei, array_length(mbrtu_ei));
     expert_modbus = expert_register_protocol(proto_modbus);