Wireshark · Ethereal-dev: RE: [ethereal-dev] On the fly registering of a dissector and a po rt

[andreas.sikkema@xxxxxxxxxxx]

> >How can I find out if there two or more conversations with the same
> >portnumber?
> You can't.

OK, I'll add that to conversation.* ;-)

> > What I want to do is to call dissector_delete() (or simliar)
> > when the last conversation with a certain portnumber has stopped.
> This is possible, but what happens after the first pass, when a packet is
> selected and the detailed decode must be done.

Ah, off course, you can't ;-)

What happens between opening two files, do conversations etc. get 
reinitialized? Most of the data in there is only relevant to the 
previous file...

> I suggest that you look at the heuristic dissectors. With them 
> you can register a dissector and if you don't handle the packet 
> return a FALSE value to indicate that other heuristic 
> dissectors should be called.

OK, I'll try that.

-- 
Andreas Sikkema
andreas.sikkema@xxxxxxxxxxx
"Standing barefoot in a river of clues, most people would 
         not get their toes wet." - Brian Kantor in a.s.r.