["Graham Bloice" <graham.bloice@xxxxxxxxxxxxx>]

I'm starting a protocol dissector for DNP 3.0 over TCP/IP (see www.dnp.org).
The protocol has 3 layers, a data link layer that provides low level framing
and checksums, a transport layer for message assembly and disassembly over
multiple data link frames, and finally an application layer that actually
handles the data.

My question is which end do I approach the dissection from ?  I've already
written a data link layer dissector, how do I then call the transport layer
dissector and also accumulate all the data over multiple data link frames
for the upper layers ?

Regards,

Graham Bloice
Software Developer
Trihedral UK Limited

Tel: +44 (0)7002 874433
Fax: +44 (0)7002 228880

Email: mailto:graham.bloice@xxxxxxxxxxxxx
Web: http://www.trihedral.com