Wireshark-dev: Re: [Wireshark-dev] question(s) on the use of heur_dissector_add

From: Brian Vandenberg <phantal@xxxxxxxxx>
Date: Thu, 21 Sep 2006 22:54:39 -0600

BTW, does your protocol (which I assume runs atop HTTP) have a Content-Type (media type) value associated with it? If so, you might want to register that media type in the "media_type" string dissector table.


Yes. I did some toying around today with that and got it working by just adding it as a dissector for a media type of application/x-url-form-encoded, and I figured I'd just add, or not add, tree items and info to the summary depending on whether it really is one of our packets or not. So, rather than returning a true/false from my heuristic dissector, I just dropped my heuristic code into a regular dissector function, and made some alterations as to what the meaning of the boolean I was using meant.

-Brian