The short answer is "write it as a builtin" if you plan on submitting the dissector code to Wireshark. Plugins come with more "file bloat", so they are discouraged when becoming part of the official Wireshark source.
Many developers start with the plugin for faster build time, when the dissector is in a early state (and there's a lot of "add some fields, see how it looks"). But as it becomes more stable and less rebuilding is necessary, they convert it to a builtin. And converting is basically just "trimming the file fat" of the plugin.
-----Original Message-----
From: Kevin Cox <kevincox@xxxxxxxxxxx>
To: wireshark-dev <wireshark-dev@xxxxxxxxxxxxx>
Sent: Wed, Apr 23, 2014 1:22 pm
Subject: [Wireshark-dev] Plugin Dissector vs Builtin Dissector
Hello,
Forgive me if this has been asked before but I can't find any resources
about the advantages/disadvantages of plugin dissectors and the ideal
cases for each.
So far I have gathered that plugin dissectors are "easiest to write
initially"[0] while builtin dissectors load slightly faster.
[0] https://www.wireshark.org/docs/wsdg_html_chunked/ChDissectAdd.html
I have read the README.{developer,dissector,plugin} and a number of
others but can't find a resource to help me decide which to write.
For the curious I will be working on a dissector for the Ceph[1]
protocol as a gsoc project this summer and am trying to make the
decision whether a builtin or plugin dissector would be preferred.
[1] https://ceph.com/
Cheers,
Kevin