Comment # 5
on bug 10695
from Hadriel Kaplan
(In reply to Matthijs Kooijman from comment #4)
> > But a Proto dissector function (usually/should) behaves differently
> > than a heuristic... a heuristic should just return a true/false
> > boolean for whether the packet belongs to this protocol, whereas a
> > dissector should parse fields and set tree items and return the number
> > of bytes consumed (or number of more bytes needed).
>
> Hmm, must have missed the return number of bytes thing in the documentation
> then. However, I was under the impression that a heuristic dissector
> could/should also just parse a packet and add tree items, right? AFAICS, if
> a heuristic dissector returns true but doesn't actually do any parsing, then
> it just prevents any other dissectors from running, leaving the packet
> unparsed?
Right, a heuristic dissector needs to to the parsing and return true so that
the calling code (the protocol layer before it that's trying the heuristic
dissectors) doesn't try other heuristic dissectors. If a heuristic dissector
returns false, it means this packet isn't for it, and other heuristic
dissectors will be tried.
You are receiving this mail because:
- You are watching all bug changes.