Ethereal-users: Re: [Ethereal-users] defining a new protocol?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Tue, 13 Nov 2001 09:38:03 -0800 (PST)
> Just started using ethereal and really like it.  Next I'd like to let
> ethereal know how to decode a proprietary protocol we use.  Is this
> possible through a plugin

Ethereal supports plugin protocol dissectors; if your protocol has an
Ethernet or PPP packet type, or a particular TCP or UDP port, or... 
assigned to it (where the list in "..." isn't written down anywhere,
unfortunately, but the items I listed are the ones most likely to
matter), or runs atop TCP or UDP without a fixed port number *but* can
be identified by looking at the packet to decide whether it's one of
yours or not, you can write, in C (or perhaps C++), a dissector for your
protocol.

See, in the Ethereal source (which you will need in order to build a
plugin dissector), the files "README.design", "README.developer",
"README.plugins", and "README.tvbuff" in the "doc" subdirectory, and the
examples of plugin dissectors in subdirectories of the "plugins"
subdirectory.