Wireshark-dev: Re: [Wireshark-dev] ask about dissector_add ( ) function to instruct wireshark t

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 21 Jun 2011 17:56:37 -0700
On Jun 21, 2011, at 4:18 PM, Changqin Xia wrote:

> I am a newbie on dissector development. I have a question about the "dissector_add( )" function.
> 
> I went through a few examples, most of them are using "tcp.port" or "udp.port" or something like that.
> 
> My dissector not uses any port number to instruct wireshark to pass packets to my dissector, my dissector is using "Magic" (the first byte).

What protocol does your dissector's protocol run on top of?  TCP, UDP, or something else?

And when you say "my dissector is using "Magic" (the first byte)", do you mean it's looking for a special magic value in the first byte of its packet data?