On Sep 30, 2009, at 11:30 AM, Alex Lindberg wrote:
> I am creating a custom dissector that runs on a TCP port already
> covered by one of the standard dissectors.
>
> How do can I overload the dissector registration so that if the
> unique condistion exist for my custom dissector my dissector will be
> used, otherwise pass control back to Wireshark?
What is the unique
condition?
Is it something in the contents of the packet, or is it a preference
setting, or is it something else?
One way to do this would be to make your dissector a heuristic
dissector, have it check for the port number and the unique condition
(if there's a match, dissect and return TRUE, otherwise return FALSE),
and set the TCP preference to run the heuristic dissectors first.
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <
wireshark-dev@xxxxxxxxxxxxx>
Archives:
http://www.wireshark.org/lists/wireshark-devUnsubscribe:
https://wireshark.org/mailman/options/wireshark-dev mailto:
wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe