Wireshark-dev: Re: [Wireshark-dev] How to register a UDP src port for one protocol and dst port

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 25 Nov 2014 11:48:53 -0800
On Nov 24, 2014, at 5:39 PM, Andy Howell <andy@xxxxxxxxxxxx> wrote:

> I'm writing some dissectors for a set of UDP based protocols that use the same port number
> as the source port in one direction, and the destination port in the other direction. Its
> a different protocol going each way.
> 
> It seems that I can only call dissector_add_uint with "udp.port", not "udp.srcport" or
> "udp.dstport". Is that correct?

Yes.

> Ideally I like to register a different dissector for each direction. Is that not possible?

No.

But what you can do is register a dissector with that port number and then, in the dissector, check whether pinfo->match_uint is equal to pinfo->srcport (in which case the packet came *from* that port) or pinfo->destport (in which case the packet was sent *to* that port).

(Solving this problem, regardless of what mechanisms are available, if the source and destination port numbers are the same is left as an exercise to the reader.)