Wireshark-dev: Re: [Wireshark-dev] question(s) on the use of heur_dissector_add
BTW, does your protocol (which I assume runs atop HTTP) have a
Content-Type (media type) value associated with it? If so, you might
want to register that media type in the "media_type" string dissector
table.
Yes. I did some toying around today with that and got it working by
just adding it as a dissector for a media type of
application/x-url-form-encoded, and I figured I'd just add, or not add,
tree items and info to the summary depending on whether it really is one
of our packets or not. So, rather than returning a true/false from my
heuristic dissector, I just dropped my heuristic code into a regular
dissector function, and made some alterations as to what the meaning of
the boolean I was using meant.
-Brian