per Richard Sharpe:
> At 09:10 AM 9/18/00 -0500, Frank Singleton wrote:
> >Hi
> >
> >I have a protocol xxx that starts on a "well known" port
> >then creates a dynamic port also for xxx use, through
> >negotiation with its peer.
> >
> >Can I use the dissector_add/rem functions at other
> >times besides inside proto_reg_handoff() to allow
> >my dissector to register/handle this new dynamic port
> >in the "tcp.port" dissector table or are there
> >restrictions ??
> Hmmm, an additional question relates to changing the dissector on the fly.
> I was looking at an FTP session, and the FTPDATA packets happened to fall
> on a MAPI port because of passive mode, so they were dissected
incorrectly.
> FTP could detect that sort of stuff and register the correct dissector.
The trick here is to install a conversational based dissector. After the
port negotiation is done, create a conversation using the host addresses
and negotiated ports, then add the dissector for the conversation with the
conversation_set_dissector function (assuming you are using tvbuffers).
See the packet-socks code for an example of this.
Jeff Foster
jfoste@xxxxxxxxxxxx