Ethereal-dev: [Ethereal-dev] Inserting a non-standard Ethernet dissector?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Peter J. Creath" <peter-ethereal@xxxxxxxxxx>
Date: Tue, 3 Feb 2004 00:22:30 -0500
I'm having trouble figuring out exactly where to hook in my dissector so that it handles non-standard (proprietary) Ethernet frames.

Currently Ethereal is convinced that they're 802.3 LLC frames. The only way I've found to convince it otherwise is to take over the WTAP_ETHERNET association (via 'dissector_add("wtap_encap", WTAP_ETHERNET, dissect_mine)'). This seems less than ideal. I could do this and pass standard packets through to the original handler, but this seems inelegant (or at least fragile). Is there some way to apply a heuristic to a raw frame and dissect it as my custom frame before Ethereal interprets it as an 802.3 frame?

Or is there another approach I'm missing?

Thanks,

	-P