>exactly this is what i would need for one of the protocolls that i would
like
>to add. we have a port where the port for further comunication is
negotiated.
>os if one dissector can add and remove another dissector for a
port/protocoll
>pair it is fine for us.
I do this in the socks dissector, see the routine new_udp_conversation in
packet-socks.c. I create a conversation entry for the negotiated port
combination and add a dissector pointer to the routine socks_udp_dissector.
I also store information need to handle the negotiated conversation in the
conversation data pointer. Then in the socks_udp_dissector routine I call
back to the decode_upd_port using the information in the conversation data
pointer.
That was too wordy and messy. Short and sweet, create a conversation based
upon
the negotiated connection. Set the conversation dissector field to be your
other dissector.
Jeff Foster
jfoste@xxxxxxxxxxxx
