# A Novel Network Protocol Syntax Extracting Method for Grammar-Based Fuzzing
## 3 Methods  
The overview of Wireshark's function blocks is shown in Figure 1. The Wireshark framework mainly consists of GUI, Core, Epan, Wiretap, Capture, and Dumpcap, wherein Epan (Enhanced Packet ANalyzer) is a packet analysis engine and the core of the framework, responsible for the key tasks of parsing packets and extracting protocol information. Epan provides a series of APIs, including Protocol Trees, Dissectors, and Dissector-Plugins.  
Protocol Tree is used to store the parsing information of a single data packet. Dissectors are responsible for parsing data packets of a specific protocol. Dissector files are located in the epan/disectors directory ([[https://github.com/wireshark/wireshark/tree/master/](https://github.com/wireshark/wireshark/tree/master/)]([https://github.com/wireshark/wireshark/tree/master/](https://github.com/wireshark/wireshark/tree/master/)), accessed on 10 March 2024). Each dissector can parse data packets of a specific protocol and fill the parsing results into the protocol tree. Through Dissector-Plugins, Wireshark can flexibly extend its parsing capabilities, allowing users to add new protocol dissectors or improve existing dissectors to better adapt to the changing network communication environment.  
The dissector framework consists of three parts: \"proto_register_PROTOABBREV\", \"proto_reg_handoff_PROTOABBREV\" and \"dissect_PROTOABBREV\", as shown in Figure 2.  
Wherein, in \"proto_register_PROTOABBREV\", protocol names are registered through the \"proto_register_protocol\" function; the global dissector handle is created through the \"new_create_dissector_handle\" function and associated with the protocol name, the dissector is registered to the dissector table through the \"register_dissector_table\" function; all field information of the protocol is registered through the \"proto_register_field_array\" function and maintained in the structure array \"hf_register_info\".  
In \"proto_reg_handoff_PROTOABBREV\", the local dissector handle is created through the \"new_create_dissector_handle\" function and associated with the protocol name; the dissector is registered to Wireshark through the \"dissect_add_uint\" function, and associate the protocol's port with the dissector handle.  
In \"dissect_PROTOABBREV\", this is where the protocol data packet is actually parsed. Field information is added to the protocol tree through the \"proto_tree_add_item\" function.  
Figure 1: Overview of Wireshark’s function blocks ([[https://www.wireshark.org/docs/wsdg_html_chunked/ChWorksOverview.html](https://www.wireshark.org/docs/wsdg_html_chunked/ChWorksOverview.html)]([https://www.wireshark.org/docs/wsdg_html_chunked/ChWorksOverview.html](https://www.wireshark.org/docs/wsdg_html_chunked/ChWorksOverview.html)), accessed on 10 March 2024).  
Through the above analysis, we propose a new protocol syntax information extraction method. The main idea of the method is to extract protocol syntax information by parsing the Wireshark protocol dissector file. It can be mainly divided into the following four extraction tasks:  
* Single-layer protocol field information extraction.
* Multi-layer protocol hierarchical relationship extraction.
* Packet type extraction based on the basic path set.
* Field dependency extraction.