Wireshark · Ethereal-dev: Re: [ethereal-dev] dynamic dissector_add/rem

[Guy Harris <gharris@xxxxxxxxxxxx>]

On Mon, Sep 18, 2000 at 09:10:01AM -0500, Frank Singleton wrote:
> I have a protocol xxx that starts on a "well known" port
> then creates a dynamic port also for xxx use, through
> negotiation with its peer.
> 
> Can I use the dissector_add/rem functions at other
> times besides inside  proto_reg_handoff() to allow
> my dissector to register/handle this new dynamic port
> in the "tcp.port" dissector table or are there 
> restrictions ??

You can call those functions at any time...

...but they won't necessarily have the effect you expect; changing the
table of registered dissectors doesn't trigger a rescan of the entire
capture, redissecting packets, which means it won't change the way
packets to or from that port are shown.

As another person noted, this is a job for conversation dissectors; that
technique is used in the Quake RTSP, Microsoft Proxy, and SOCKS
dissectors.  See those dissectors ("packet-quake.c", "packet-msproxy.c",
"packet-rtsp.c", and "packet-socks.c") for examples of how to do this
(look for "conversation_set_dissector" - and do so in such a fashion
that you also find "old_conversation_set_dissector", don't use any
search technique that only works if you're calling a function named
"conversation_set_dissector").