parsing - Looking For A Packet Description Language (Preferably With A C# Implementation) -

i in process of developing special-purpose network tool packet sniffing , decoding capabilities. looking languages designed assist in dissection/decoding of arbitrary packet formats. idealy, solution should based on open standards. there related questions on so, deal full lifecycle of packet sniffing (i don't care capture, there other libraries well).

in general, i'm looking language , supporting framework declaritive definition of packet formats , corresponding run-time decoding. because problem can generalized non-network binary data, solution arbitrary binary streams in scope. little surprised no such standard exists in mature , robust state (at least find) - though there seem lot of interesting not-quite-right , almost-there projects (see below). perhaps speaks difficulty of problem, or maybe lack of demand.

by way of example, i'm interested in technologies , ideas similar following (in no particular order):

• packet.net - job of converting binary packet representations structures, dissectors hard-coded , doesn't appear able handle more complex formats.
• dfdl - i've been following 1 while , participating in teleconferences year or ago. standard seems reaching maturity, implementation appears challenging. not mind getting hands dirty, i'm not sure i've got resources on project implement such wide-ranging standard scratch purpose.
• network monitor open source parsers - project describes packets using c-like syntax use microsoft network monitor. has lot of packets defined , language appears robust enough support complex structures. unfortunately, implemention of execution engine in netmon , while grammar language reverse-engineered, implementing processing engine might difficult. worry because of explicit tie between parser language , netmon tool there non-general aspects language make inappropriate uses in other tools.
• netpdl - 1 looks interesting, development seems have languished. it's not totally clear how make use of execution engine outside of own environment.
• wireshark dissectors - i've thought wrapping/using native wireshark dissectors purpose, tied pretty closely wireshark itself. dissectors use code perform of decoding, little counter i'm looking - i'd prefer that's little more declaritive (though there's balance since complex packet structures require switching , other logic determine final makeup).
• bsdl - academic language similar in concept dfdl (see above). interesting , in right direction, outside of couple papers nothing else seems exist.

i'm not looking complete solution here (though if knows of 1 haven't covered, great). i'm more interested in comments or anecdotes technologies i've indicated above pointers or ideas routes haven't thought of or covered.

wireshark dissector framework powerful. please read description here -

http://www.wireshark.org/docs/wsdg_html_chunked/chapterdissection.html#chdissectworks

i had solve similar problem yours. me protocol had agnostic of actual medium of transit (mainly udo or top) during test in memory ipc.

so defined protocol in structured manner using protobuf -

http://code.google.com/p/protobuf/

and defined dissector myself not - http://code.google.com/p/protobuf-wireshark/

so analyse using direct in memory analysis dissection when in test , wireshark dissection when on wire. there lot of code reuse between memory dissector , wireshark dissector of course protocol defined agnostically using protobuf.