Ethereal-dev: Re: [Ethereal-dev] Newbie - Plugin Dissector Only entered with non-zero tree onc

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Harry Goldschmitt <harry@xxxxxxxx>
Date: Wed, 1 May 2002 07:17:54 -0700
At 3:23 AM -0700 5/1/02, Guy Harris wrote:

On Wed, May 01, 2002 at 03:12:21AM -0700, Harry Goldschmitt wrote:

 I'm writing a new plug in dissector under RH 7.2 Ethereal 0.8.18.  I
 have a large file of packets for the TCP based protocol I'm trying to
 dissect.  The dissector correctly creates lines in the traffic
 summary window, and via printf's I can see that it was entered once
 in the dissect_protocol routine with a non-zero tree.  At that time,
 I create a proto_tree for the first packet.  I can see it in the
 window, while the file is loading.  As soon as the load completes, my
 proto_tree disappears and my dissector is never entered again with a
 non-zero tree.  I can click around the summary window to my hearts
 content, but never another non-zero tree.


(I assume by "non-zero tree" you mean a non-null "tree" argument.)


Sorry.  Yes that's correct.


Are there any frames in the summary window where the "Protocol" column
indicates that your dissector dissected that frame?
Yes, thousands. The file I'm viewing was collected via Net X-Ray specifying my protocol's port. The only frames not identified as mine are simple ACKs with no data. If I delete my plug in, I can view the data portion of the TCP frames and see my data. 


If so, is your dissector called with a non-null "tree" argument if you
click on one of those frames?


No.  I've clicked on both frames that aren't my protocol and the ACKs.

Any ideas?  I was hoping for an obvious stupid on my part.