Wireshark-dev: [Wireshark-dev] Heuristic dissector for "wtap_encap"
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Shaun Jackman" <sjackman@xxxxxxxxx>
Date: Sat, 23 Dec 2006 20:41:41 -0700
Is it possible to register a heuristic dissector for a particular
"wtap_encap" type? I added a wtap MPEG file type, WTAP_ENCAP_MPEG. Now
I want to add two different dissectors, one for MPEG PES (a normal
MPEG video file), and one for MP3 (MPEG 1 layer 3 audio).

So, I called...
	dissector_add("wtap_encap", WTAP_ENCAP_MPEG, mpeg_pes_handle);
	dissector_add("wtap_encap", WTAP_ENCAP_MPEG, mpeg_audio_handle);

Unfortunately, one of the two dissetors never gets called (for obvious
reasons). So, I'd like to use heuristic dissectors, so that each
dissector can return true if it is in fact a PES stream or a MP3
stream and false otherwise. So, I'd like to call

	heur_dissector_add("wtap_encap", dissect_mpeg_pes_heur, proto_mpeg_pes);

but "wtap_encap" doesn't support heuristic dissectors. Even if it did,
this would call dissect_mpeg_pes_heur for *any* packet, whereas I only
really want it called for packets of type WTAP_ENCAP_MPEG. Any
suggestions?

Thanks,
Shaun