search

Open-Markets-Initiative / wireshark-lua

Source generated cross platform Wireshark dissectors
GNU General Public License v3.0
180 stars 64 forks source link

NYSE Pillar Gateway Binary Protocol #44

Closed karljensen closed 8 months ago

karljensen commented 1 year ago

Can a NYSE Pillar Gateway Binary Protocol dissector be generated?

Spec available here: https://www.nyse.com/publicdocs/NYSE_Pillar_Gateway_Binary_Protocol_Specification.pdf

Open-Markets-Initiative commented 1 year ago

Working on options version it right now. Please check back in a few days. A single non source identifiable packet would help.

Open-Markets-Initiative commented 1 year ago

Beta version up: fc24b3a34c48af7f887616b68f1047099a614a35

Enums and some rules are missing. We dont have an example and so its unlikely to work.

karljensen commented 1 year ago

I've only managed to scrap up one message type (rename to just pcap, github doesn't like pcaps) pillar_bin_gw.pcap.txt

Here's best guess at dissection. dissection.txt

Some minor issues with the beta version. 0001-Fixing-to-and-adding-missing-variable.patch

Open-Markets-Initiative commented 1 year ago

Thanks for the pcap. It revealed a couple of issues. First, the protocol model is incorrect around sequenced messages. Also, the generator does not handle Lua not equals correctly. We should have something soon.

Open-Markets-Initiative commented 1 year ago

We hacked the packet and found that these are 0x0240 messages whch is only in the equities specification: https://www.nyse.com/publicdocs/NYSE_Pillar_Gateway_Binary_Protocol_Specification.pdf

We will update the common stream protocol and get to equities after we finish pillar options.

Open-Markets-Initiative commented 8 months ago

General equities Pillar Binary Gateway dissector up in: 022fea4c4bd53a89177470aa2f58aaad2841ab91. Any other messages in a pcap would be great.